github/kubernetes
1
0
Fork 0
mirror of https://github.com/k3s-io/kubernetes.git synced 2025-07-29 14:37:00 +00:00
Code Issues Projects Releases Wiki Activity

Merge pull request #81217 from SataQiu/fix-kubeadm-20190809

Browse Source 
kubeadm: change the permissions of generated CSR files from 0644 to 0600
This commit is contained in:
Kubernetes Prow Robot 2019-08-12 08:21:13 -07:00 committed by GitHub
commit ca6290538b
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
cmd/kubeadm/app/util/pkiutil/pki_helpers.go
View File

@ -153,20 +153,20 @@ func WriteKey(pkiPath, name string, key crypto.Signer) error {
} }
// WriteCSR writes the pem-encoded CSR data to csrPath. // WriteCSR writes the pem-encoded CSR data to csrPath.
// The CSR file will be created with file mode 0644. // The CSR file will be created with file mode 0600.
// If the CSR file already exists, it will be overwritten. // If the CSR file already exists, it will be overwritten.
// The parent directory of the csrPath will be created as needed with file mode 0755. // The parent directory of the csrPath will be created as needed with file mode 0700.
func WriteCSR(csrDir, name string, csr *x509.CertificateRequest) error { func WriteCSR(csrDir, name string, csr *x509.CertificateRequest) error {
if csr == nil { if csr == nil {
return errors.New("certificate request cannot be nil when writing to file") return errors.New("certificate request cannot be nil when writing to file")
} }
csrPath := pathForCSR(csrDir, name) csrPath := pathForCSR(csrDir, name)
if err := os.MkdirAll(filepath.Dir(csrPath), os.FileMode(0755)); err != nil { if err := os.MkdirAll(filepath.Dir(csrPath), os.FileMode(0700)); err != nil {
return errors.Wrapf(err, "failed to make directory %s", filepath.Dir(csrPath)) return errors.Wrapf(err, "failed to make directory %s", filepath.Dir(csrPath))
} }
if err := ioutil.WriteFile(csrPath, EncodeCSRPEM(csr), os.FileMode(0644)); err != nil { if err := ioutil.WriteFile(csrPath, EncodeCSRPEM(csr), os.FileMode(0600)); err != nil {
return errors.Wrapf(err, "unable to write CSR to file %s", csrPath) return errors.Wrapf(err, "unable to write CSR to file %s", csrPath)
} }