cni-server: set cni config file permission to 600 (#5906)

* cni-server: set cni config file permission to 600

Signed-off-by: zhangzujian <[email protected]>

* fix

Signed-off-by: zhangzujian <[email protected]>

---------

Signed-off-by: zhangzujian <[email protected]>

Author: zhangzujian

cmd/daemon/cniserver.go

@@ -194,9 +194,14 @@ func main() {
 
 func mvCNIConf(configDir, configFile, confName string) error {
 	cniConfPath := filepath.Join(configDir, confName)
-	if _, err := os.Stat(cniConfPath); err == nil {
-		klog.Infof("CNI config file %q already exists, skipping copying CNI config file", cniConfPath)
-		return nil
+	if info, err := os.Stat(cniConfPath); err == nil {
+		// File exists, check permissions.
+		if info.Mode().Perm() == 0o600 {
+			klog.Infof("CNI config file %q already exists with correct permissions, skipping.", cniConfPath)
+			return nil
+		}
+		klog.Infof("Fixing permission of existing CNI config file %q to 600", cniConfPath)
+		return os.Chmod(cniConfPath, 0o600)
 	}
 
 	data, err := os.ReadFile(configFile) // #nosec G304
@@ -206,7 +211,7 @@ func mvCNIConf(configDir, configFile, confName string) error {
 	}
 
 	klog.Infof("Installing cni config file %q to %q", configFile, cniConfPath)
-	return os.WriteFile(cniConfPath, data, 0o644) // #nosec G306
+	return os.WriteFile(cniConfPath, data, 0o600) // #nosec G306
 }
 
 func Retry(attempts, sleep int, f func(configuration *daemon.Configuration) error, ctrl *daemon.Configuration) (err error) {