From 67e3f40940747a380a3049f144cbd28aa31f12d4 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?P=C3=A9ter=20Szil=C3=A1gyi?= <peterke@gmail.com>
Date: Wed, 11 Jan 2017 14:09:55 +0200
Subject: [PATCH] cmd/utils: enforce no group/public permissions on all config
 files

---
 cmd/utils/flags.go | 34 +++++++++++++++-------------------
 1 file changed, 15 insertions(+), 19 deletions(-)

diff --git a/cmd/utils/flags.go b/cmd/utils/flags.go
index 3733e09214..54dc427c4e 100644
--- a/cmd/utils/flags.go
+++ b/cmd/utils/flags.go
@@ -435,6 +435,21 @@ func OverrideDefaults(ctx *cli.Context) {
 	if config == "" {
 		return
 	}
+	// Ensure the any config file and containing folder can only be written by the current user
+	info, err := os.Stat(config)
+	if err != nil {
+		Fatalf("Failed to retrieve config file stats: %v", err)
+	}
+	if perms := info.Mode().Perm(); perms&0022 > 0 {
+		Fatalf("Config file is publicly or group writeable, refusing to trust it!")
+	}
+	info, err = os.Stat(filepath.Dir(config))
+	if err != nil {
+		Fatalf("Failed to retrieve config folder stats: %v", err)
+	}
+	if perms := info.Mode().Perm(); perms&0022 > 0 {
+		Fatalf("Config folder is publicly or group writeable, refusing to trust it!")
+	}
 	// Gather all known configuration fields to enforce config validity
 	flags := make(map[string]struct{})
 	for _, flag := range ctx.GlobalFlagNames() {
@@ -464,25 +479,6 @@ func OverrideDefaults(ctx *cli.Context) {
 			ctx.GlobalSet(name, key.Value())
 		}
 	}
-	// If dangerous flags were specified from a publicly writeable file, abort
-	if len(dangerous) > 0 {
-		// Ensure the file itself can only be written by the current user
-		info, err := os.Stat(config)
-		if err != nil {
-			Fatalf("Failed to retrieve config file stats: %v", err)
-		}
-		if perms := info.Mode().Perm(); perms&0022 > 0 {
-			Fatalf("Config file contains dangerous flags and is publicly (or group) writeable!")
-		}
-		// Ensure the folder containing the config can only be written by the user
-		info, err = os.Stat(filepath.Dir(config))
-		if err != nil {
-			Fatalf("Failed to retrieve config file parent folder stats: %v", err)
-		}
-		if perms := info.Mode().Perm(); perms&0022 > 0 {
-			Fatalf("Config file contains dangerous flags and containing folder is publicly (or group) writeable!")
-		}
-	}
 	// Warn the user in case of some weird configuration combos
 	if len(overrides) > 0 || len(dangerous) > 0 {
 		fmt.Println("-----------------------------------------------------------------")