Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Revert "update file permissions to read/write (#751)" #755

Merged
merged 3 commits into from
Sep 24, 2024

Conversation

chrnorm
Copy link
Contributor

@chrnorm chrnorm commented Sep 24, 2024

What changed?

Reverts the change made in #751.

Why?

#751 incorrectly removed the executable flag on some of the directories created by Granted. The execute flag is required. Additionally, the PR relaxed some of the permissions from 0600 to 0644 which allows users other than the current one to read the various config and frecency files. Given that we've never had a permissions issue opened due to a use case where 0644 is required, I think this is too permissive.

How did you test it?

Build the CLI locally:

sudo make cli

Move the ~/.dgranted folder:

mv ~/.dgranted ~/.dgranted.bak

Run dassume, which will run through the onboarding wizard.

Confirm that the config file is not executable and has the expected permissions:

❯ ls -al ~/.dgranted
drwx------ chrisnorman staff 128 B  Tue Sep 24 17:35:51 2024  .
drwxr-x--- chrisnorman staff 3.5 KB Tue Sep 24 17:35:51 2024  ..
.rw------- chrisnorman staff 200 B  Tue Sep 24 17:35:54 2024  config
.rw------- chrisnorman staff 1.7 KB Tue Sep 24 17:35:55 2024  log

Potential risks

Low, as we are reverting a known issue in the new release.

Is patch release candidate?

Yes

Link to relevant docs PRs

the file should be 0600, not 0700
@chrnorm
Copy link
Contributor Author

chrnorm commented Sep 24, 2024

Fixes #754. A big thankyou to jpbelleau for helping to diagnose this issue so quickly.

@chrnorm
Copy link
Contributor Author

chrnorm commented Sep 24, 2024

I also removed most of the constants like USER_READ_WRITE_PERM here - using SCREAMING_SNAKE_CASE makes these constants publicly available for each package which isn't really desirable. Additionally, I found that in a few cases the constants were only used in a single location, so it's easier IMO to just use the bitmask directly rather than adding a layer of indirection.

Co-authored-by: James Belleau <[email protected]>
Copy link
Contributor

@VigneshSelvaraj96 VigneshSelvaraj96 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested Locally and file permissions match as expected. Great catch on the screaming snake case.

@chrnorm chrnorm merged commit 18daa6e into main Sep 24, 2024
3 checks passed
@chrnorm chrnorm deleted the fix-file-permissions branch September 24, 2024 17:09
tmeijn pushed a commit to tmeijn/dotfiles that referenced this pull request Oct 11, 2024
This MR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [common-fate/granted](https://github.com/common-fate/granted) | minor | `v0.33.0` -> `v0.35.1` |

MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot).

**Proposed changes to behavior should be submitted there as MRs.**

---

### Release Notes

<details>
<summary>common-fate/granted (common-fate/granted)</summary>

### [`v0.35.1`](https://github.com/common-fate/granted/releases/tag/v0.35.1)

[Compare Source](common-fate/granted@v0.35.0...v0.35.1)

This release includes bug fixes for the RDS plugin.

#### What's Changed

-   Remove Grant is activated message, use new Grant Output API by [@&#8203;JoshuaWilkes](https://github.com/JoshuaWilkes) in common-fate/granted#769
-   Improve how RDS proxy command handles grant expiry and proxy connection errors by [@&#8203;JoshuaWilkes](https://github.com/JoshuaWilkes) in common-fate/granted#770

**Full Changelog**: common-fate/granted@v0.35.0...v0.35.1

### [`v0.35.0`](https://github.com/common-fate/granted/releases/tag/v0.35.0)

[Compare Source](common-fate/granted@v0.34.1...v0.35.0)

#### AWS IAM Identity Center phishing protection

![Frame 13](https://github.com/user-attachments/assets/4e315c6c-694f-45bf-84bc-7f56f1df47d2)

This release adds support for the new [Granted browser extension for Chrome](https://chromewebstore.google.com/detail/granted/cjjieeldgoohbkifkogalkmfpddeafcm), which confirms the user code automatically when logging in to AWS IAM Identity Center. This makes authenticating faster and protects against being phished for your AWS credentials. [Read more in our announcement blog post here.](https://www.commonfate.io/blog/granted-mitigates-aws-phishing).

[Follow our install guide here to get set up with Granted.](https://docs.commonfate.io/granted/getting-started)

#### What's Changed

-   add fixes to setting custom browser by [@&#8203;meyerjrr](https://github.com/meyerjrr) in common-fate/granted#760
-   Fix the version output when running `assume -v` by [@&#8203;chrnorm](https://github.com/chrnorm) in common-fate/granted#762
-   Added support for manual setting of PassDir to avoid pass password pollution in default location by [@&#8203;VigneshSelvaraj96](https://github.com/VigneshSelvaraj96) in common-fate/granted#761
-   Add apigw -> apigateway service shortcut by [@&#8203;alexjurkiewicz](https://github.com/alexjurkiewicz) in common-fate/granted#763
-   Add AWS IAM Identity Center device code flow automation by [@&#8203;chrnorm](https://github.com/chrnorm) in common-fate/granted#765

#### New Contributors

-   [@&#8203;VigneshSelvaraj96](https://github.com/VigneshSelvaraj96) made their first contribution in common-fate/granted#761

**Full Changelog**: common-fate/granted@v0.34.2...v0.35.0

### [`v0.34.1`](https://github.com/common-fate/granted/releases/tag/v0.34.1)

[Compare Source](common-fate/granted@v0.34.0...v0.34.1)

This release fixes a folder permissions issue introduced in v0.34.0, and fixes an issue with using `assume -s ram` to open Resource Access Manager. A big thankyou to contributors [@&#8203;jpbelleau](https://github.com/jpbelleau) and [@&#8203;wayne-folkes](https://github.com/wayne-folkes).

#### What's Changed

-   Add RAM (Resource Access Manager) by [@&#8203;wayne-folkes](https://github.com/wayne-folkes) in common-fate/granted#757
-   Revert "update file permissions to read/write ([#&#8203;751](common-fate/granted#751))" by [@&#8203;chrnorm](https://github.com/chrnorm) and [@&#8203;jpbelleau](https://github.com/jpbelleau) in common-fate/granted#755

**Full Changelog**: common-fate/granted@v0.34.0...v0.34.1

### [`v0.34.0`](https://github.com/common-fate/granted/releases/tag/v0.34.0)

[Compare Source](common-fate/granted@v0.33.0...v0.34.0)

#### What's Changed

-   Sort sso profiles by profile name by [@&#8203;shwethaumashanker](https://github.com/shwethaumashanker) in common-fate/granted#733
-   Fix using default duration on auto approved requests by [@&#8203;meyerjrr](https://github.com/meyerjrr) in common-fate/granted#748
-   Update file permissions to read/write by [@&#8203;meyerjrr](https://github.com/meyerjrr) in common-fate/granted#751
-   Implement custom templated launch for sso browser option by [@&#8203;meyerjrr](https://github.com/meyerjrr) in common-fate/granted#750

**Full Changelog**: common-fate/granted@v0.33.0...v0.34.0

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this MR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this MR, check this box

---

This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNy40NDAuNyIsInVwZGF0ZWRJblZlciI6IjM3LjQ0MC43IiwidGFyZ2V0QnJhbmNoIjoibWFpbiIsImxhYmVscyI6WyJSZW5vdmF0ZSBCb3QiXX0=-->
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants