Merge pull request #85 from Cray-HPE/CASMCMS-9040

CASMCMS-9040 - change permissions on image config files after recipe build.

CHANGELOG.md

@@ -10,6 +10,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - CSM 1.6 moved to Kubernetes 1.24, so use client v24.x to ensure compatability
 - Simplify how `ims-python-helper` major/minor version is pinned
 
+### Changed
+- CASMCMS-9040 - change permissions on image config files after recipe build.
+
 ## [2.13.2] - 2024-07-25
 ### Dependencies
 - Resolve CVES:

scripts/package_and_upload.sh

@@ -2,7 +2,7 @@
 #
 # MIT License
 #
-# (C) Copyright 2018-2023 Hewlett Packard Enterprise Development LP
+# (C) Copyright 2018-2024 Hewlett Packard Enterprise Development LP
 #
 # Permission is hereby granted, free of charge, to any person obtaining a
 # copy of this software and associated documentation files (the "Software"),
@@ -76,6 +76,22 @@ check_image_artifact_exists() {
 check_image_artifact_exists "$IMAGE_ROOT_DIR/boot/$KERNEL_FILENAME"
 check_image_artifact_exists "$IMAGE_ROOT_DIR/boot/$INITRD_FILENAME"
 
+# Change ownership and permissions on /image dir if it exists.
+#  This dir contains config files that may have sensative information
+#  in them and should only be readable by root.
+if [[ -d ${IMAGE_ROOT_DIR}/image ]]; then
+  # change read/write permissions of dir to root only
+  chown root ${IMAGE_ROOT_DIR}/image
+  chmod 700 ${IMAGE_ROOT_DIR}/image
+
+  # change files in the dir to root ownership and only rw for root
+  chown root ${IMAGE_ROOT_DIR}/image/*
+  chmod 600 ${IMAGE_ROOT_DIR}/image/*
+
+  # change the .sh file to rwx for root
+  chmod 700 ${IMAGE_ROOT_DIR}/image/*.sh
+fi
+
 # Make the squashfs formatted archive
 time mksquashfs "$IMAGE_ROOT_DIR" "$IMAGE_ROOT_PARENT/$IMAGE_ROOT_ARCHIVE_NAME.sqsh"
 fail_if_error "Creating squashfs of image root"