From a898fe8e2859f66c7c8d0a7d23e9353e5de1cf04 Mon Sep 17 00:00:00 2001 From: Chris Lu Date: Tue, 7 Apr 2026 12:34:41 -0700 Subject: [PATCH] shell: restrict export file permissions, rollback policy on user create failure - s3.iam.export: use os.OpenFile with mode 0600 instead of os.Create to protect exported credentials from other users - s3.user.provision: rollback the created policy if CreateUser fails, with a warning if the rollback itself fails --- weed/shell/command_s3_iam_export.go | 2 +- weed/shell/command_s3_user_provision.go | 6 +++++- 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/weed/shell/command_s3_iam_export.go b/weed/shell/command_s3_iam_export.go index d72907f6e..b0a1c6d7f 100644 --- a/weed/shell/command_s3_iam_export.go +++ b/weed/shell/command_s3_iam_export.go @@ -59,7 +59,7 @@ func (c *commandS3IAMExport) Do(args []string, commandEnv *CommandEnv, writer io var out io.Writer = writer if *file != "" { - fp, err := os.Create(*file) + fp, err := os.OpenFile(*file, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, 0600) if err != nil { return fmt.Errorf("create file: %v", err) } diff --git a/weed/shell/command_s3_user_provision.go b/weed/shell/command_s3_user_provision.go index 397c07ed7..040fafa3d 100644 --- a/weed/shell/command_s3_user_provision.go +++ b/weed/shell/command_s3_user_provision.go @@ -156,7 +156,11 @@ func (c *commandS3UserProvision) Do(args []string, commandEnv *CommandEnv, write } _, err = client.CreateUser(ctx, &iam_pb.CreateUserRequest{Identity: identity}) if err != nil { - return fmt.Errorf("create user: %v", err) + // Rollback: remove the policy we just created + if _, delErr := client.DeletePolicy(ctx, &iam_pb.DeletePolicyRequest{Name: policyName}); delErr != nil { + fmt.Fprintf(writer, "Warning: failed to rollback policy %q: %v\n", policyName, delErr) + } + return fmt.Errorf("create user: %w", err) } fmt.Fprintf(writer, "Created user %q with policy %q attached\n", *name, policyName)