#45 Fixed directory permissions and prevent osquery stop with partial configuration Pull request opened by javuto Problem • (Medium): a pre-created secret file can receive the enrollment secret under attacker ownership. If a lower-privileged user could write in the secret's directory, they could pre-create the file.

writeContentExists

then copied that file's owner onto the newly written

0600

secret, letting the user read it. • (Medium): a mid-install error leaves osquery stopped with partial configuration.

installNode

stopped osquery, wrote the secret, flags and certificate in sequence, and only started it at the end. A write error returned early with the agent down and some files already changed. Change •

writeContentExists

no longer copies the previous file's owner onto the secret. Flags and certificate still keep theirs. •

install

refuses a secret directory that anyone but root (Administrators on Windows) can write, using the existing

adminOwnedDir

. The check runs before osquery is stopped. •

install

snapshots the current config with the existing

snapshotOsqueryConfig

before stopping osquery. If a write fails afterwards, it restores the snapshot (contents, modes, owners), starts osquery again and returns the error. The three writes moved into

writeInstallFiles

. • README and

ARCHITECTURE.md

updated. Security / operational impact •

install

now fails, before stopping anything, when the secret directory is writable by non-admins. Default directories pass. •

install

now fails, before stopping anything, when the secret, flags or certificate path is a symlink or other non-regular file. It used to replace them. • A failed fresh install does not delete files it already wrote; re-running

install

overwrites them. Validation •

go test ./cmd/osctrld/ -race

passes •

golangci-lint run ./...

and `GOOS=windows golangci-lint run ./...`: 0 issues • New tests: •

TestInstallNodeRefusesUnsafeSecretDir

•

TestInstallNodeRestoresConfigOnWriteFailure

•

TestWriteContentExistsNeverKeepsSecretOwner

• Not exercised on a real endpoint. The Windows directory check is compiled and linted only. jmpsec/osctrld