Merge branch 'check_file_perm_and_user' of github.com:ClusterCockpit/cc-metric-collector into check_file_perm_and_user

.github/workflows/runonce.yml

@@ -33,6 +33,11 @@ jobs:
     - name: Build MetricCollector
       run: make
 
+    - name: Set config file permissions
+      run: |
+        chown $USER .github/ci*.json
+        chmod 0600 .github/ci*.json
+
     - name: Run MetricCollector once
       run: ./cc-metric-collector --once --config .github/ci-config.json
 
@@ -59,6 +64,11 @@ jobs:
     - name: Build MetricCollector
       run: make
 
+    - name: Set config file permissions
+      run: |
+        chown $USER .github/ci*.json
+        chmod 0600 .github/ci*.json
+
     - name: Run MetricCollector once
       run: ./cc-metric-collector --once --config .github/ci-config.json
 
@@ -85,6 +95,11 @@ jobs:
     - name: Build MetricCollector
       run: make
 
+    - name: Set config file permissions
+      run: |
+        chown $USER .github/ci*.json
+        chmod 0600 .github/ci*.json
+
     - name: Run MetricCollector once
       run: ./cc-metric-collector --once --config .github/ci-config.json
 
@@ -331,4 +346,4 @@ jobs:
       id: dpkg-build
       run: |
           export PATH=/usr/local/go/bin:/usr/local/go/pkg/tool/linux_amd64:$PATH
-          make DEB
+          make DEB

cc-metric-collector.go

@@ -3,6 +3,7 @@ package main
 import (
 	"encoding/json"
 	"flag"
+	"fmt"
 	"os"
 	"os/signal"
 	"syscall"
@@ -15,9 +16,9 @@ import (
 	"sync"
 	"time"
 
+	lp "github.com/ClusterCockpit/cc-energy-manager/pkg/cc-message"
 	mr "github.com/ClusterCockpit/cc-metric-collector/internal/metricRouter"
 	cclog "github.com/ClusterCockpit/cc-metric-collector/pkg/ccLogger"
-	lp "github.com/ClusterCockpit/cc-energy-manager/pkg/cc-message"
 	mct "github.com/ClusterCockpit/cc-metric-collector/pkg/multiChanTicker"
 )
 
@@ -42,6 +43,27 @@ func LoadCentralConfiguration(file string, config *CentralConfigFile) error {
 	return err
 }
 
+func ConfigFileCheck(file string) error {
+
+	info, err := os.Stat(file)
+	if err != nil {
+		cclog.Error("Cannot access file", file)
+		return err
+	}
+	uid := info.Sys().(*syscall.Stat_t).Uid
+	perm := info.Mode().Perm()
+	if uid != uint32(os.Getuid()) {
+		err = fmt.Errorf("file %s has a different owner", file)
+		return err
+	}
+	if perm != 0600 {
+		err = fmt.Errorf("file %s has a invalid permissions", file)
+		return err
+	}
+
+	return nil
+}
+
 type RuntimeConfig struct {
 	Interval   time.Duration
 	Duration   time.Duration
@@ -167,6 +189,12 @@ func mainFunc() int {
 		CliArgs:        ReadCli(),
 	}
 
+	err = ConfigFileCheck(rcfg.CliArgs["configfile"])
+	if err != nil {
+		cclog.Error(err.Error())
+		return 1
+	}
+
 	// Load and check configuration
 	err = LoadCentralConfiguration(rcfg.CliArgs["configfile"], &rcfg.ConfigFile)
 	if err != nil {
@@ -208,16 +236,31 @@ func mainFunc() int {
 		cclog.Error("Metric router configuration file must be set")
 		return 1
 	}
+	err = ConfigFileCheck(rcfg.ConfigFile.RouterConfigFile)
+	if err != nil {
+		cclog.Error(err.Error())
+		return 1
+	}
 
 	if len(rcfg.ConfigFile.SinkConfigFile) == 0 {
 		cclog.Error("Sink configuration file must be set")
 		return 1
 	}
+	err = ConfigFileCheck(rcfg.ConfigFile.SinkConfigFile)
+	if err != nil {
+		cclog.Error(err.Error())
+		return 1
+	}
 
 	if len(rcfg.ConfigFile.CollectorConfigFile) == 0 {
 		cclog.Error("Metric collector configuration file must be set")
 		return 1
 	}
+	err = ConfigFileCheck(rcfg.ConfigFile.CollectorConfigFile)
+	if err != nil {
+		cclog.Error(err.Error())
+		return 1
+	}
 
 	// Set log file
 	if logfile := rcfg.CliArgs["logfile"]; logfile != "stderr" {
@@ -260,6 +303,11 @@ func mainFunc() int {
 
 	// Create new receive manager
 	if len(rcfg.ConfigFile.ReceiverConfigFile) > 0 {
+		err = ConfigFileCheck(rcfg.ConfigFile.ReceiverConfigFile)
+		if err != nil {
+			cclog.Error(err.Error())
+			return 1
+		}
 		rcfg.ReceiveManager, err = receivers.New(&rcfg.Sync, rcfg.ConfigFile.ReceiverConfigFile)
 		if err != nil {
 			cclog.Error(err.Error())