Change file permissions on instances

[Sploder12]

This PR changes file permissions on Multipass cache and data directories to be read/write only by root. Previously the files could be read by all.

Fixes #3866

MULTI-1403
MULTI-1723

[codecov]

Codecov Report

Attention: Patch coverage is 88.09524% with 5 lines in your changes missing coverage. Please review.

Project coverage is 89.11%. Comparing base (5b4d884) to head (e6fee0a).
Report is 18 commits behind head on main.

Files with missing lines	Patch %	Lines
src/platform/platform_unix.cpp	50.00%	3 Missing ⚠️
src/utils/permission_utils.cpp	93.33%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3715      +/-   ##
==========================================
- Coverage   89.11%   89.11%   -0.01%     
==========================================
  Files         255      256       +1     
  Lines       14603    14643      +40     
==========================================
+ Hits        13014    13049      +35     
- Misses       1589     1594       +5     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[levkropp]

Looks good, it seems that codecov wants to see test coverage for some lines:

• if (!MP_PLATFORM.set_root_as_owner(path)) in write_to
• extract_image doesn't seem to have tests for it at all?

[Sploder12]

I have decided that the vm_image_vault tests are out of the scope of this PR. This is because writing tests would require a significant refactor of unrelated code (see 1653 in Jira).

[sharder996]

Thanks for your work on this @Sploder12! Tackling these parts of the code can be tricky :)

Since this PR is closely related with #3782, there might be some overlap. But, here are some thoughts I had reviewing this:

1. Existing instance directories/files do not have their permissions changed, only new instances.
2. Is there a reason to apply permissions specifically to cloud_init_iso and instance directories and not to the other files stored within the data_directory and cache_directory?
3. Would it be better/easier to apply blanket permissions on the storage_directory/cache_directory/data_directory in daemon_config? That would solve 1 if it doesn't interfere with 2.
4. Instead of the name set_root_as_owner(), how about takeown()? If need be, it could default to root/admin with an option to set ownership to the current user. That would follow pretty closely the Windows definition of takeown.

[Sploder12]

@sharder996

1. Good point! Updating the permissions when the daemon starts is what I'm thinking to fix that, WDYT?
2. Some files aren't as sensitive, but it might be worth covering those too, @ricab might have more thoughts on this.
3. That might work, I'll give it a try
4. I don't like takeown personally, reminds me too much of runic C string functions like wcsxfrm. But something like take_ownership or set_owner could be nice for that. WDYT?

[ricab]

Some files aren't as sensitive, but it might be worth covering those too, @ricab might have more thoughts on this.

I guess covering the whole directory would be safer for the future and agree with principle of least privilege better. We can always expose any thing we need on a case by case basis.

[sharder996]

Initial review pass and I noticed some things that I think could be improved. Will make a more detailed review afterwards.

By setting permissions on the top level data/cache directories, all sub-directories should inherit those permissions, correct? If so, some of the code could be cleaned up.

[ricab]

I meant to review this but I am a little bogged down with reviews right now. This has 2 reviewers already, so I'll leave it up to them.

[levkropp]

Well done with these changes! Tests pass including new ones, and I can see the permissions are changed for the cache and data folders with no loss in functionality to multipass:

this PR:

/var/snap/multipass/common/cache/multipassd# ls -l
total 40
-rwx------ 1 root root 32287 Feb 21 10:11 multipass-blueprints.zip
drwx------ 4 root root  4096 Feb 12 10:30 network-cache
drwx------ 3 root root  4096 Feb 21 10:11 vault

/var/snap/multipass/common/data/multipassd# ls -l
total 28
drwx------ 2 root root 4096 Feb 12 10:30 authenticated-certs
drwx------ 2 root root 4096 Feb 12 10:30 certificates
-rwx------ 1 root root 5142 Feb 21 10:13 multipassd-vm-instances.json
drwx------ 2 root root 4096 Feb 21 10:11 network
drwx------ 2 root root 4096 Feb 12 10:30 ssh-keys
drwx------ 3 root root 4096 Feb 19 22:21 vault

current main:

/var/snap/multipass/common/data/multipassd# ls -l
total 24
drwxr-xr-x 2 root root 4096 Feb 21 10:25 authenticated-certs
drwxr-xr-x 2 root root 4096 Feb 21 10:25 certificates
-rw-r--r-- 1 root root 1567 Feb 21 10:30 multipassd-vm-instances.json
drwxr-xr-x 2 root root 4096 Feb 21 10:25 network
drwxr-xr-x 2 root root 4096 Feb 21 10:25 ssh-keys
drwxr-xr-x 3 root root 4096 Feb 21 10:26 vault

/var/snap/multipass/common/cache/multipassd# ls -l
total 40
-rw-r--r-- 1 root root 32287 Feb 21 10:25 multipass-blueprints.zip
drwxr-xr-x 4 root root  4096 Feb 21 10:25 network-cache
drwxr-xr-x 3 root root  4096 Feb 21 10:26 vault

[sharder996]

Looks much better now. Thanks @Sploder12!