change perms: 0666 -> 0600; 0777 -> 0750

api.go

@@ -2725,7 +2725,7 @@ func (api *API) RestoreShard(ctx context.Context, indexName string, shard uint64
 	db := dbs.W
 	finalPath := db.Path() + "/data"
 	tempPath := finalPath + ".tmp"
-	o, err := os.OpenFile(tempPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0666)
+	o, err := os.OpenFile(tempPath, os.O_CREATE|os.O_WRONLY|os.O_TRUNC, 0600)
 	if err != nil {
 		return err
 	}

boltdb/translate.go

@@ -110,9 +110,9 @@ func (s *TranslateStore) Open() (err error) {
 		}
 	}()
 
-	if err := os.MkdirAll(filepath.Dir(s.Path), 0777); err != nil {
+	if err := os.MkdirAll(filepath.Dir(s.Path), 0750); err != nil {
 		return errors.Wrapf(err, "mkdir %s", filepath.Dir(s.Path))
-	} else if s.db, err = bolt.Open(s.Path, 0666, &bolt.Options{Timeout: 1 * time.Second, NoSync: !s.fsyncEnabled}); err != nil {
+	} else if s.db, err = bolt.Open(s.Path, 0600, &bolt.Options{Timeout: 1 * time.Second, NoSync: !s.fsyncEnabled}); err != nil {
 		return errors.Wrapf(err, "open file: %s", err)
 	}
 

cmd/roaring-migrate/main.go

@@ -239,7 +239,7 @@ func (d *rbfFile) Close() error {
 		exists, sz := fileExists(d.last)
 		src := filepath.Join(d.temp, "data")
 		if !exists {
-			err := os.MkdirAll(filepath.Dir(d.last), 0777)
+			err := os.MkdirAll(filepath.Dir(d.last), 0750)
 			if err != nil {
 				return err
 			}
@@ -280,7 +280,7 @@ func copyFile(src, dest string) error {
 func Migrate(dataDir, backupPath string, verbose bool) error {
 	dataDir = strings.TrimSuffix(dataDir, "/")
 
-	err := os.MkdirAll(backupPath, 0777)
+	err := os.MkdirAll(backupPath, 0750)
 	if err != nil {
 		return err
 	}
@@ -389,7 +389,7 @@ func Migrate(dataDir, backupPath string, verbose bool) error {
 
 func writeIfBigger(dst string, srcFile string) error {
 	if stats, err := os.Stat(dst); os.IsNotExist(err) {
-		err = os.MkdirAll(filepath.Dir(dst), 0777)
+		err = os.MkdirAll(filepath.Dir(dst), 0750)
 		if err != nil {
 			return err
 		}

ctl/backup.go

@@ -141,7 +141,7 @@ func (cmd *BackupCommand) Run(ctx context.Context) (err error) {
 	// Ensure output directory doesn't exist; then create output directory.
 	if _, err := os.Stat(cmd.OutputDir); !os.IsNotExist(err) {
 		return fmt.Errorf("output directory already exists")
-	} else if err := os.MkdirAll(cmd.OutputDir, 0777); err != nil {
+	} else if err := os.MkdirAll(cmd.OutputDir, 0750); err != nil {
 		return err
 	}
 
@@ -187,7 +187,7 @@ func (cmd *BackupCommand) backupSchema(ctx context.Context, schema *pilosa.Schem
 		return fmt.Errorf("marshaling schema: %w", err)
 	}
 
-	if err := ioutil.WriteFile(filepath.Join(cmd.OutputDir, "schema"), buf, 0666); err != nil {
+	if err := ioutil.WriteFile(filepath.Join(cmd.OutputDir, "schema"), buf, 0600); err != nil {
 		return fmt.Errorf("writing schema: %w", err)
 	}
 
@@ -315,7 +315,7 @@ func (cmd *BackupCommand) backupShardNode(ctx context.Context, indexName string,
 	defer rc.Close()
 
 	filename := filepath.Join(cmd.OutputDir, "indexes", indexName, "shards", fmt.Sprintf("%04d", shard))
-	if err := os.MkdirAll(filepath.Dir(filename), 0777); err != nil {
+	if err := os.MkdirAll(filepath.Dir(filename), 0750); err != nil {
 		return err
 	}
 
@@ -373,7 +373,7 @@ func (cmd *BackupCommand) backupIndexPartitionTranslateData(ctx context.Context,
 	defer rc.Close()
 
 	filename := filepath.Join(cmd.OutputDir, "indexes", name, "translate", fmt.Sprintf("%04d", partitionID))
-	if err := os.MkdirAll(filepath.Dir(filename), 0777); err != nil {
+	if err := os.MkdirAll(filepath.Dir(filename), 0750); err != nil {
 		return err
 	}
 
@@ -402,7 +402,7 @@ func (cmd *BackupCommand) backupFieldTranslateData(ctx context.Context, indexNam
 	defer rc.Close()
 
 	filename := filepath.Join(cmd.OutputDir, "indexes", indexName, "fields", fieldName, "translate")
-	if err := os.MkdirAll(filepath.Dir(filename), 0777); err != nil {
+	if err := os.MkdirAll(filepath.Dir(filename), 0750); err != nil {
 		return err
 	}
 

field.go

@@ -543,7 +543,7 @@ func (f *Field) Open() error {
 	if err := func() (err error) {
 		// Ensure the field's path exists.
 		f.holder.Logger.Debugf("ensure field path exists: %s", f.path)
-		if err := os.MkdirAll(f.path, 0777); err != nil {
+		if err := os.MkdirAll(f.path, 0750); err != nil {
 			return errors.Wrap(err, "creating field dir")
 		}
 

fragment.go

@@ -2605,11 +2605,11 @@ func (f *fragment) flushCache() error {
 		return errors.Wrap(err, "marshalling")
 	}
 
-	if err := os.MkdirAll(filepath.Dir(f.cachePath()), 0777); err != nil {
+	if err := os.MkdirAll(filepath.Dir(f.cachePath()), 0750); err != nil {
 		return errors.Wrap(err, "mkdir")
 	}
 	// Write to disk.
-	if err := ioutil.WriteFile(f.cachePath(), buf, 0666); err != nil {
+	if err := ioutil.WriteFile(f.cachePath(), buf, 0600); err != nil {
 		return errors.Wrap(err, "writing")
 	}
 
@@ -2771,7 +2771,7 @@ func (f *fragment) readCacheFromArchive(r io.Reader) error {
 	buf, err := ioutil.ReadAll(r)
 	if err != nil {
 		return errors.Wrap(err, "reading")
-	} else if err := ioutil.WriteFile(f.cachePath(), buf, 0666); err != nil {
+	} else if err := ioutil.WriteFile(f.cachePath(), buf, 0600); err != nil {
 		return errors.Wrap(err, "writing")
 	}
 

fragment_internal_test.go

@@ -3178,7 +3178,7 @@ func mustOpenFragmentFlags(tb testing.TB, index, field, view string, shard uint6
 	idx := fragTestMustOpenIndex(index, th, IndexOptions{})
 
 	fragDir := fmt.Sprintf("%v/%v/views/%v/fragments/", idx.path, field, view)
-	PanicOn(os.MkdirAll(fragDir, 0777))
+	PanicOn(os.MkdirAll(fragDir, 0750))
 	fragPath := fragDir + fmt.Sprintf("%v", shard)
 	f := newFragment(th, makeTestFragSpec(fragPath, index, field, view), shard, flags)
 

holder.go

@@ -376,7 +376,7 @@ func (h *Holder) Open() error {
 	h.closing = make(chan struct{})
 
 	h.Logger.Printf("open holder path: %s", h.path)
-	if err := os.MkdirAll(h.IndexesPath(), 0777); err != nil {
+	if err := os.MkdirAll(h.IndexesPath(), 0750); err != nil {
 		return errors.Wrap(err, "creating directory")
 	}
 
@@ -1171,7 +1171,7 @@ func (h *Holder) logStartup() error {
 	time := time.Now().Format(RFC3339NanoFixedWidth)
 	logLine := fmt.Sprintf("%s\t%s\n", time, Version)
 
-	if err := os.MkdirAll(h.path, 0777); err != nil {
+	if err := os.MkdirAll(h.path, 0750); err != nil {
 		return errors.Wrap(err, "creating data directory")
 	}
 

holder_test.go

@@ -164,7 +164,7 @@ func TestHolder_HasData(t *testing.T) {
 		}
 
 		// Create an index directory to indicate data exists.
-		if err := os.Mkdir(h.IndexPath("test"), 0777); err != nil {
+		if err := os.Mkdir(h.IndexPath("test"), 0750); err != nil {
 			t.Fatal(err)
 		}
 

http_handler_test.go

@@ -739,7 +739,7 @@ admin: "ac97c9e2-346b-42a2-b6da-18bcb61a32fe"`
 
 	tmpDir := t.TempDir()
 	permissionsPath := path.Join(tmpDir, "test-permissions.yaml")
-	err := ioutil.WriteFile(permissionsPath, []byte(permissions1), 0666)
+	err := ioutil.WriteFile(permissionsPath, []byte(permissions1), 0600)
 	if err != nil {
 		t.Fatalf("failed to write permissions file: %v", err)
 	}

idalloc.go

@@ -47,7 +47,7 @@ type idAllocator struct {
 type OpenIDAllocatorFunc func(path string, enableFsync bool) (*idAllocator, error) // whyyyyyyyyy
 
 func OpenIDAllocator(path string, enableFsync bool) (*idAllocator, error) {
-	db, err := bolt.Open(path, 0666, &bolt.Options{Timeout: 1 * time.Second, NoSync: !enableFsync})
+	db, err := bolt.Open(path, 0600, &bolt.Options{Timeout: 1 * time.Second, NoSync: !enableFsync})
 	if err != nil {
 		return nil, err
 	}
@@ -81,7 +81,7 @@ func (ida *idAllocator) Replace(reader io.Reader) error {
 	} else {
 		_ = os.Remove(liveFile + ".sav")
 	}
-	db, err := bolt.Open(liveFile, 0666, &bolt.Options{Timeout: 1 * time.Second, NoSync: !ida.fsyncEnabled})
+	db, err := bolt.Open(liveFile, 0600, &bolt.Options{Timeout: 1 * time.Second, NoSync: !ida.fsyncEnabled})
 	ida.db = db
 	return err
 }

idalloc_test.go

@@ -27,7 +27,7 @@ func TestIDAlloc(t *testing.T) {
 	}()
 
 	// Open bolt.
-	db, err := bolt.Open(f.Name(), 0666, &bolt.Options{Timeout: 1 * time.Second, NoSync: true})
+	db, err := bolt.Open(f.Name(), 0600, &bolt.Options{Timeout: 1 * time.Second, NoSync: true})
 	if err != nil {
 		t.Errorf("opening bolt: %v", err)
 		return

index.go

@@ -189,7 +189,7 @@ func (i *Index) open(idx *disco.Index) (err error) {
 	defer i.mu.Unlock()
 	// Ensure the path exists.
 	i.holder.Logger.Debugf("ensure index path exists: %s", i.FieldsPath())
-	if err := os.MkdirAll(i.FieldsPath(), 0777); err != nil {
+	if err := os.MkdirAll(i.FieldsPath(), 0750); err != nil {
 		return errors.Wrap(err, "creating directory")
 	}
 	i.closing = make(chan struct{})

logger/filewriter.go

@@ -90,7 +90,7 @@ func (f *FileWriter) Fd() uintptr {
 // it is a ReopenWriteCloser...
 func NewFileWriter(name string) (*FileWriter, error) {
 	// Standard default mode
-	return NewFileWriterMode(name, 0666)
+	return NewFileWriterMode(name, 0600)
 }
 
 // NewFileWriterMode opens a Reopener file with a specific permission

rbf/db.go

@@ -131,12 +131,12 @@ func (db *DB) Open() (err error) {
 
 	if err := os.MkdirAll(db.Path, 0755); err != nil {
 		return err
-	} else if db.file, err = os.OpenFile(db.DataPath(), os.O_WRONLY|os.O_CREATE, 0666); err != nil {
+	} else if db.file, err = os.OpenFile(db.DataPath(), os.O_WRONLY|os.O_CREATE, 0600); err != nil {
 		return fmt.Errorf("open file: %w", err)
 	}
 
 	// Open read-only database mmap.
-	if f, err := os.OpenFile(db.DataPath(), os.O_RDONLY, 0666); err != nil {
+	if f, err := os.OpenFile(db.DataPath(), os.O_RDONLY, 0600); err != nil {
 		return fmt.Errorf("open mmap file: %w", err)
 	} else if db.data, err = syswrap.Mmap(int(f.Fd()), 0, int(db.cfg.MaxSize), syscall.PROT_READ, syscall.MAP_SHARED); err != nil {
 		f.Close()
@@ -174,12 +174,12 @@ func (db *DB) Open() (err error) {
 
 func (db *DB) openWAL() (err error) {
 	// Open WAL file writer.
-	if db.walFile, err = os.OpenFile(db.WALPath(), os.O_WRONLY|os.O_CREATE, 0666); err != nil {
+	if db.walFile, err = os.OpenFile(db.WALPath(), os.O_WRONLY|os.O_CREATE, 0600); err != nil {
 		return fmt.Errorf("open wal file: %w", err)
 	}
 
 	// Open read-only mmap.
-	if f, err := os.OpenFile(db.WALPath(), os.O_RDONLY, 0666); err != nil {
+	if f, err := os.OpenFile(db.WALPath(), os.O_RDONLY, 0600); err != nil {
 		return fmt.Errorf("open wal mmap file: %w", err)
 	} else if db.wal, err = syswrap.Mmap(int(f.Fd()), 0, int(db.cfg.MaxWALSize), syscall.PROT_READ, syscall.MAP_SHARED); err != nil {
 		f.Close()

rbf/tx_test.go

@@ -1311,7 +1311,7 @@ func mustReadPage(tb testing.TB, path string, pgno uint32) []byte {
 
 func mustWritePage(tb testing.TB, path string, pgno uint32, buf []byte) {
 	tb.Helper()
-	f, err := os.OpenFile(path, os.O_WRONLY, 0666)
+	f, err := os.OpenFile(path, os.O_WRONLY, 0600)
 	if err != nil {
 		tb.Fatal(err)
 	}

roaring/fuzzer.go

@@ -292,7 +292,7 @@ func bytesToUint64s(data []byte) []uint64 {
 // make sure filename is not already in the corpus.
 func addSliceToCorpus(slice []uint64, filename, path string) {
 	data := uint64sToBytes(slice)
-	err := ioutil.WriteFile(path+"/"+filename, data, 0777)
+	err := ioutil.WriteFile(path+"/"+filename, data, 0750)
 	if err != nil {
 		fmt.Printf("could not write to file: %v\n", err)
 	}

view.go

@@ -203,11 +203,11 @@ func (v *view) openEmpty() error {
 	if err := func() error {
 		// Ensure the view's path exists.
 		v.holder.Logger.Debugf("ensure view path exists: %s", v.path)
-		err := os.MkdirAll(v.path, 0777)
+		err := os.MkdirAll(v.path, 0750)
 		if err != nil {
 			return errors.Wrap(err, "creating view directory")
 		}
-		err = os.MkdirAll(filepath.Join(v.path, "fragments"), 0777)
+		err = os.MkdirAll(filepath.Join(v.path, "fragments"), 0750)
 		if err != nil {
 			return errors.Wrap(err, "creating fragments directory")
 		}