[PATCH cluster v4 1/2] pmxcfs: remove world-readable permissions from backups

[Shannon Sterz <s.sterz@proxmox.com>]

this could lead to information disclosure of data that is private
within pmxcfs. currently the impact is low as a backup is only
triggered before joining a new cluster. however, if we trigger more
backups going forward, this could leak sensitive information.

Signed-off-by: Shannon Sterz <s.sterz@proxmox.com>
---

the version in the postinst hook should probably be adapted when
pve-cluster is bumped.

 debian/pve-cluster.dirs     | 1 +
 debian/pve-cluster.postinst | 8 ++++++++
 src/PVE/Cluster.pm          | 5 +++--
 3 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/debian/pve-cluster.dirs b/debian/pve-cluster.dirs
index a07aa4e..df4a258 100644
--- a/debian/pve-cluster.dirs
+++ b/debian/pve-cluster.dirs
@@ -1,2 +1,3 @@
 /usr/bin
 /var/lib/pve-cluster
+/var/lib/pve-cluster/backup
diff --git a/debian/pve-cluster.postinst b/debian/pve-cluster.postinst
index 34bf0e1..048199e 100644
--- a/debian/pve-cluster.postinst
+++ b/debian/pve-cluster.postinst
@@ -11,12 +11,20 @@ remove_fabrics_directory() {
   fi
 }

+update_permissions() {
+    chmod 0600 /var/lib/pve-cluster/backup;
+}
+
 case "$1" in
   configure)
     # TODO: remove with PVE 10+
     if dpkg --compare-versions "$2" 'lt' '9.0.1'; then
       remove_fabrics_directory
     fi
+
+    if dpkg --compare-versions "$2" 'lt' '9.1.1'; then
+      update_permissions
+    fi
   ;;
 esac

diff --git a/src/PVE/Cluster.pm b/src/PVE/Cluster.pm
index bdb465f..e96a7fe 100644
--- a/src/PVE/Cluster.pm
+++ b/src/PVE/Cluster.pm
@@ -9,7 +9,7 @@ use File::Path qw(make_path);
 use JSON;
 use List::Util;
 use Net::SSLeay;
-use POSIX qw(ENOENT);
+use POSIX qw(ENOENT EEXIST);
 use Socket;
 use Storable qw(dclone);
 use Time::HiRes qw(usleep);
@@ -892,7 +892,8 @@ sub complete_migration_target {

 # NOTE: filesystem must be offline here, no DB changes allowed
 sub cfs_backup_database {
-    mkdir $dbbackupdir;
+    mkdir $dbbackupdir or $!{EEXIST} or die "failed to create backup dir - $!\n";
+    chmod 0600, $dbbackupdir or die "failed to change mode for backup dir - $!\n";

     my $ctime = time();
     my $backup_fn = "$dbbackupdir/config-$ctime.sql.gz";
--
2.47.3