Merge branch 'check_file_perm_and_user' of github.com:ClusterCockpit/cc-metric-collector into check_file_perm_and_user

.github/workflows/Release.yml

@@ -73,21 +73,21 @@ jobs:
         NEW_SRPM=${OLD_SRPM/el8/alma8}
         mv "${OLD_RPM}" "${NEW_RPM}"
         mv "${OLD_SRPM}" "${NEW_SRPM}"
-        echo "EL8_SRPM=${NEW_SRPM}" >> $GITHUB_OUTPUT
-        echo "EL8_RPM=${NEW_RPM}" >> $GITHUB_OUTPUT
+        echo "SRPM=${NEW_SRPM}" >> $GITHUB_OUTPUT
+        echo "RPM=${NEW_RPM}" >> $GITHUB_OUTPUT
 
     # See: https://github.com/actions/upload-artifact
     - name: Save RPM as artifact
       uses: actions/upload-artifact@v4
       with:
         name: cc-metric-collector RPM for AlmaLinux 8
-        path: ${{ steps.rpmrename.outputs.EL8_RPM }}
+        path: ${{ steps.rpmrename.outputs.RPM }}
         overwrite: true
     - name: Save SRPM as artifact
       uses: actions/upload-artifact@v4
       with:
         name: cc-metric-collector SRPM for AlmaLinux 8
-        path: ${{ steps.rpmrename.outputs.EL8_SRPM }}
+        path: ${{ steps.rpmrename.outputs.SRPM }}
         overwrite: true
 
   #
@@ -152,21 +152,21 @@ jobs:
         NEW_SRPM=${OLD_SRPM/el9/alma9}
         mv "${OLD_RPM}" "${NEW_RPM}"
         mv "${OLD_SRPM}" "${NEW_SRPM}"
-        echo "EL9_SRPM=${NEW_SRPM}" >> $GITHUB_OUTPUT
-        echo "EL9_RPM=${NEW_RPM}" >> $GITHUB_OUTPUT
+        echo "SRPM=${NEW_SRPM}" >> $GITHUB_OUTPUT
+        echo "RPM=${NEW_RPM}" >> $GITHUB_OUTPUT
 
     # See: https://github.com/actions/upload-artifact
     - name: Save RPM as artifact
       uses: actions/upload-artifact@v4
       with:
         name: cc-metric-collector RPM for AlmaLinux 9
-        path: ${{ steps.rpmrename.outputs.EL9_RPM }}
+        path: ${{ steps.rpmrename.outputs.RPM }}
         overwrite: true
     - name: Save SRPM as artifact
       uses: actions/upload-artifact@v4
       with:
         name: cc-metric-collector SRPM for AlmaLinux 9
-        path: ${{ steps.rpmrename.outputs.EL9_SRPM }}
+        path: ${{ steps.rpmrename.outputs.SRPM }}
         overwrite: true
 
   #
@@ -235,6 +235,10 @@ jobs:
     # See: https://catalog.redhat.com/software/containers/ubi8/ubi/5c359854d70cc534b3a3784e?container-tabs=gti
     container: redhat/ubi9
     # The job outputs link to the outputs of the 'rpmbuild' step
+    # The job outputs link to the outputs of the 'rpmbuild' step
+    outputs:
+      rpm : ${{steps.rpmbuild.outputs.RPM}}
+      srpm : ${{steps.rpmbuild.outputs.SRPM}}
     steps:
 
     # Use dnf to install development packages

.github/workflows/runonce.yml

@@ -33,6 +33,11 @@ jobs:
     - name: Build MetricCollector
       run: make
 
+    - name: Set config file permissions
+      run: |
+        chown $USER .github/ci*.json
+        chmod 0600 .github/ci*.json
+
     - name: Run MetricCollector once
       run: ./cc-metric-collector --once --config .github/ci-config.json
 
@@ -59,6 +64,11 @@ jobs:
     - name: Build MetricCollector
       run: make
 
+    - name: Set config file permissions
+      run: |
+        chown $USER .github/ci*.json
+        chmod 0600 .github/ci*.json
+
     - name: Run MetricCollector once
       run: ./cc-metric-collector --once --config .github/ci-config.json
 
@@ -85,6 +95,11 @@ jobs:
     - name: Build MetricCollector
       run: make
 
+    - name: Set config file permissions
+      run: |
+        chown $USER .github/ci*.json
+        chmod 0600 .github/ci*.json
+
     - name: Run MetricCollector once
       run: ./cc-metric-collector --once --config .github/ci-config.json
 

cc-metric-collector.go

@@ -3,6 +3,7 @@ package main
 import (
 	"encoding/json"
 	"flag"
+	"fmt"
 	"os"
 	"os/signal"
 	"syscall"
@@ -15,9 +16,9 @@ import (
 	"sync"
 	"time"
 
+	lp "github.com/ClusterCockpit/cc-energy-manager/pkg/cc-message"
 	mr "github.com/ClusterCockpit/cc-metric-collector/internal/metricRouter"
 	cclog "github.com/ClusterCockpit/cc-metric-collector/pkg/ccLogger"
-	lp "github.com/ClusterCockpit/cc-energy-manager/pkg/cc-message"
 	mct "github.com/ClusterCockpit/cc-metric-collector/pkg/multiChanTicker"
 )
 
@@ -42,6 +43,27 @@ func LoadCentralConfiguration(file string, config *CentralConfigFile) error {
 	return err
 }
 
+func ConfigFileCheck(file string) error {
+
+	info, err := os.Stat(file)
+	if err != nil {
+		cclog.Error("Cannot access file", file)
+		return err
+	}
+	uid := info.Sys().(*syscall.Stat_t).Uid
+	perm := info.Mode().Perm()
+	if uid != uint32(os.Getuid()) {
+		err = fmt.Errorf("file %s has a different owner", file)
+		return err
+	}
+	if perm != 0600 {
+		err = fmt.Errorf("file %s has a invalid permissions", file)
+		return err
+	}
+
+	return nil
+}
+
 type RuntimeConfig struct {
 	Interval   time.Duration
 	Duration   time.Duration
@@ -167,6 +189,12 @@ func mainFunc() int {
 		CliArgs:        ReadCli(),
 	}
 
+	err = ConfigFileCheck(rcfg.CliArgs["configfile"])
+	if err != nil {
+		cclog.Error(err.Error())
+		return 1
+	}
+
 	// Load and check configuration
 	err = LoadCentralConfiguration(rcfg.CliArgs["configfile"], &rcfg.ConfigFile)
 	if err != nil {
@@ -208,16 +236,31 @@ func mainFunc() int {
 		cclog.Error("Metric router configuration file must be set")
 		return 1
 	}
+	err = ConfigFileCheck(rcfg.ConfigFile.RouterConfigFile)
+	if err != nil {
+		cclog.Error(err.Error())
+		return 1
+	}
 
 	if len(rcfg.ConfigFile.SinkConfigFile) == 0 {
 		cclog.Error("Sink configuration file must be set")
 		return 1
 	}
+	err = ConfigFileCheck(rcfg.ConfigFile.SinkConfigFile)
+	if err != nil {
+		cclog.Error(err.Error())
+		return 1
+	}
 
 	if len(rcfg.ConfigFile.CollectorConfigFile) == 0 {
 		cclog.Error("Metric collector configuration file must be set")
 		return 1
 	}
+	err = ConfigFileCheck(rcfg.ConfigFile.CollectorConfigFile)
+	if err != nil {
+		cclog.Error(err.Error())
+		return 1
+	}
 
 	// Set log file
 	if logfile := rcfg.CliArgs["logfile"]; logfile != "stderr" {
@@ -260,6 +303,11 @@ func mainFunc() int {
 
 	// Create new receive manager
 	if len(rcfg.ConfigFile.ReceiverConfigFile) > 0 {
+		err = ConfigFileCheck(rcfg.ConfigFile.ReceiverConfigFile)
+		if err != nil {
+			cclog.Error(err.Error())
+			return 1
+		}
 		rcfg.ReceiveManager, err = receivers.New(&rcfg.Sync, rcfg.ConfigFile.ReceiverConfigFile)
 		if err != nil {
 			cclog.Error(err.Error())