Prevent broad temporary permissions before atomic JSON write #484

Classification

• Category: security / confidentiality
• Micro-category: temporary-file permission window
• Severity: P2

Source

• Pull request: Persist lifecycle JSON atomically #477
• Review comment:
  Persist lifecycle JSON atomically #477 (comment)
• Reviewed SHA: c6c7bfd0b90fa1a4155a27e7986c44ed6dd89f85

Expected

When replacing an existing lifecycle JSON file, its temporary file must never
begin with permissions broader than the destination. Any widening required to
restore the exact destination mode must happen before payload bytes are written.

Observed

The temporary file is created with requested mode 0666. Under umask 022,
replacing an existing 0600 file therefore exposes an initially empty 0644
temporary entry until fchmod. Another account can open that entry during the
window and retain read access after payload bytes are written.

Acceptance

• For replacement, request the existing destination mode during exclusive
  creation.
• Preserve process-umask behavior for first writes.
• Restore the exact existing mode before writing when umask removed bits.
• Add a deterministic regression that observes the temporary descriptor mode
  before fchmod.

Primary sources

• os.open mode and umask:
  https://docs.python.org/3/library/os.html#os.open
• os.fchmod:
  https://docs.python.org/3/library/os.html#os.fchmod