refactor: move config to user dir and enforce owner-only perms#1078
refactor: move config to user dir and enforce owner-only perms#1078madhavilosetty-intel wants to merge 2 commits into
Conversation
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #1078 +/- ##
==========================================
+ Coverage 43.44% 43.49% +0.05%
==========================================
Files 143 143
Lines 13621 13663 +42
==========================================
+ Hits 5917 5943 +26
- Misses 7143 7155 +12
- Partials 561 565 +4 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
|
@madhavilosetty-intel : could you please add some context to this PR on why this PR is needed. Is it an enhancement or a fix. |
There was a problem hiding this comment.
Pull request overview
Moves the tray-mode configuration file into the per-user config directory (aligned with where the embedded SQLite DB lives) and adds a one-time migration path so installer-provisioned credentials carry over on first tray launch.
Changes:
- Update config-path resolution so tray mode prefers
<UserConfigDir>/device-management-toolkit/config.yml, otherwise fall back beside the binary. - Add
seedConfigto copy an installer-provisioned config into the per-user location on first tray run. - Add unit tests covering config path resolution and seeding behavior.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
config/config.go |
Adds per-user config path resolution for tray mode and seeds per-user config from beside-binary config. |
config/config_test.go |
Adds tests for tray/non-tray config path resolution and for seedConfig behavior. |
@sudhir-intc This is for the installers, at present config file will be in the app’s install folder, which anyone could read. Now it’s stored securely in each user’s own space. I link this PR to #870 |
f3350fd to
f364653
Compare
Address PR #1078 review findings: - writeConfig: generate path now writes 0o600/0o700 (was 0o666/0o777), so a freshly generated config's secrets are not world-readable. - seedConfig: surface unexpected os.Stat errors instead of treating any stat error as "missing" and silently re-seeding. - Share configFilePerm/configDirPerm constants across both paths. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
71bb9f8 to
888e6c5
Compare
131d8a8 to
48f48b2
Compare
ca05b67 to
7e130bf
Compare
c3aa1c4 to
11228d4
Compare
Relocate config to the user directory and harden seedConfig error handling, enforcing owner-only file permissions.
11228d4 to
7f45ee5
Compare
|
tested on linux, results look good both user config path and machine config path are not exist
user config path exist, but machine config path not exist
user config path not exist, but machine config path exist
both user config path and machine config path are exist
|
No description provided.