feat(SUPERVISOR): restrict process umask

PI-Portal · Mar 4, 2024 · c899642 · c899642
1 parent 39bd61f
commit c899642
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 0 deletions.
diff --git a/.vale/Vocab/pi_portal/accept.txt b/.vale/Vocab/pi_portal/accept.txt
@@ -51,6 +51,7 @@ testcase
 typecheck
 ubuntu
 uid
+umask
 url
 uuid
 virtualenv

diff --git a/pi_portal/installation/templates/supervisor/supervisord.conf b/pi_portal/installation/templates/supervisor/supervisord.conf
@@ -50,6 +50,7 @@ stdout_logfile={{ LOG_PREFIX_SUPERVISOR }}.bot.out.log
 stdout_logfile_maxbytes=1MB
 stdout_logfile_backups=10
 stdout_capture_maxbytes=1MB
+umask=027
 
 [program:camera]
 command={{ PATH_CAMERA_BINARY }}
@@ -70,6 +71,7 @@ stdout_logfile={{ LOG_PREFIX_SUPERVISOR }}.camera.out.log
 stdout_logfile_maxbytes=1MB
 stdout_logfile_backups=10
 stdout_capture_maxbytes=1MB
+umask=027
 
 [program:contact_switch_monitor]
 user={{ PI_PORTAL_USER }}
@@ -92,6 +94,7 @@ stdout_logfile={{ LOG_PREFIX_SUPERVISOR }}.contact_switch_monitor.out.log
 stdout_logfile_maxbytes=1MB
 stdout_logfile_backups=10
 stdout_capture_maxbytes=1MB
+umask=027
 
 [program:filebeat]
 command={{ FILE_BEAT_BINARY }} -c {{ FILE_BEAT_CONFIG }}
@@ -112,6 +115,7 @@ stdout_logfile={{ LOG_PREFIX_SUPERVISOR }}.filebeat.out.log
 stdout_logfile_maxbytes=1MB
 stdout_logfile_backups=10
 stdout_capture_maxbytes=1MB
+umask=027
 
 [program:task_scheduler]
 user={{ PI_PORTAL_USER }}
@@ -134,6 +138,7 @@ stdout_logfile={{ LOG_PREFIX_SUPERVISOR }}.task_scheduler.out.log
 stdout_logfile_maxbytes=1MB
 stdout_logfile_backups=10
 stdout_capture_maxbytes=1MB
+umask=027
 
 [program:temp_monitor]
 user={{ PI_PORTAL_USER }}
@@ -156,3 +161,4 @@ stdout_logfile={{ LOG_PREFIX_SUPERVISOR }}.temp_monitor.out.log
 stdout_logfile_maxbytes=1MB
 stdout_logfile_backups=10
 stdout_capture_maxbytes=1MB
+umask=027
-Original file line number
+Diff line change
@@ Expand Up / @@ -51,6 +51,7 @@ testcase @@
     typecheck
     ubuntu
     uid
+    umask
     url
     uuid
     virtualenv
@@ Expand Down @@