github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-08-10 20:42:26 +00:00
Code Issues Projects Releases Wiki Activity

Ensure audit log permissions are restricted

Browse Source 
While the apiserver audit options merely use the lumberjack logger in
order to write the appropriate log files, this library has very loose
permissions by default for these files [1]. However, this library will
respect the permissions that the file has, if it exists already. This is
also the most tested scenario in the library [2].

So, let's follow the pattern marked in the library's tests and
pre-create the audit log file with an appropriate mode.

[1] https://github.com/natefinch/lumberjack/blob/v2.0/lumberjack.go#L280
[2] https://github.com/natefinch/lumberjack/blob/v2.0/linux_test.go

Signed-off-by: Juan Antonio Osorio Robles <jaosorior@redhat.com>
This commit is contained in:
Juan Antonio Osorio Robles 2020-10-08 09:38:57 +03:00
parent c0841211fd
commit 42df7bc5b3
1 changed files with 21 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
staging/src/k8s.io/apiserver/pkg/server/options/audit.go
View File

@ -293,7 +293,11 @@ func (o *AuditOptions) ApplyTo(
// 2. Build log backend
var logBackend audit.Backend
if w := o.LogOptions.getWriter(); w != nil {
w, err := o.LogOptions.getWriter()
if err != nil {
return err
}
if w != nil {
if checker == nil {
klog.V(2).Info("No audit policy file provided, no events will be recorded for log backend")
} else {
@ -505,9 +509,13 @@ func (o *AuditLogOptions) enabled() bool {
return o != nil && o.Path != ""
}
func (o *AuditLogOptions) getWriter() io.Writer {
func (o *AuditLogOptions) getWriter() (io.Writer, error) {
if !o.enabled() {
return nil
return nil, nil
}
if err := o.ensureLogFile(); err != nil {
return nil, err
}
var w io.Writer = os.Stdout
@ -520,7 +528,16 @@ func (o *AuditLogOptions) getWriter() io.Writer {
Compress: o.Compress,
}
}
return w
return w, nil
}
func (o *AuditLogOptions) ensureLogFile() error {
mode := os.FileMode(0600)
f, err := os.OpenFile(o.Path, os.O_CREATE|os.O_APPEND|os.O_RDWR, mode)
if err != nil {
return err
}
return f.Close()
}
func (o *AuditLogOptions) newBackend(w io.Writer) audit.Backend {