fix: chmod config 0600 such that only the creating user can read

garethgeorge · Jan 25, 2024 · ecff0e5 · ecff0e5
1 parent ee6134a
commit ecff0e5
Showing 1 changed file with 6 additions and 2 deletions.
diff --git a/internal/config/jsonstore.go b/internal/config/jsonstore.go
@@ -33,8 +33,7 @@ func (f *JsonFileStore) Get() (*v1.Config, error) {
 	}
 
 	var config v1.Config
-
-	if err = protojson.Unmarshal(data, &config); err != nil {
+	if err = (protojson.UnmarshalOptions{DiscardUnknown: true}).Unmarshal(data, &config); err != nil {
 		return nil, fmt.Errorf("failed to unmarshal config: %w", err)
 	}
 
@@ -72,5 +71,10 @@ func (f *JsonFileStore) Update(config *v1.Config) error {
 		return fmt.Errorf("failed to write config file: %w", err)
 	}
 
+	// only the user running backrest should be able to read the config.
+	if err := os.Chmod(f.Path, 0600); err != nil {
+		return fmt.Errorf("chmod(0600) config file: %w", err)
+	}
+
 	return nil
 }