From 24c2f51cec798f09b92c1343ebcdf104042341cb Mon Sep 17 00:00:00 2001 From: Giuseppe Lumia Date: Thu, 14 Oct 2021 14:51:07 +0200 Subject: [PATCH] Improve config security Since the configuration file of the CLI contains secrets, it should be readable only to its owner. --- command/config/init.go | 2 ++ 1 file changed, 2 insertions(+) diff --git a/command/config/init.go b/command/config/init.go index fb3d60c7..4a350eac 100644 --- a/command/config/init.go +++ b/command/config/init.go @@ -20,6 +20,7 @@ package config import ( "errors" "fmt" + "os" "strings" "github.com/arduino/arduino-cloud-cli/internal/config" @@ -65,6 +66,7 @@ func Init(params *InitParams) error { } newSettings := viper.New() + newSettings.SetConfigPermissions(os.FileMode(0600)) config.SetDefaults(newSettings) if err := newSettings.WriteConfigAs(configFile.String()); err != nil { return fmt.Errorf("cannot create config file: %v", err)