Linter: gosec, Rule: G301 - Poor file permissions used when creating a directory. Should we enable it?

[zak-pawel]

Use Case

This issue starts discussion about enabling:

• linter: gosec - Inspects source code for security problems by scanning the Go AST.
• rule: G301 - Poor file permissions used when creating a directory

Rule is mapped to CWE-276: Incorrect Default Permissions.

Expected behavior

Decision if rule should be enabled or not.

Actual behavior

For this rule no findings were found in current code.

Additional info

For this rule additional configuration can be provided:

      # Maximum allowed permissions mode for os.Mkdir and os.MkdirAll
      # Default: "0750"
      G301: "0750"

[zak-pawel]

With exclude-use-default: false set in .golangci.yml following findings were found for this rule:

plugins/inputs/bcache/bcache_test.go:33:9                     gosec  G301: Expect directory permissions to be 0750 or less
plugins/inputs/bcache/bcache_test.go:36:8                     gosec  G301: Expect directory permissions to be 0750 or less
plugins/inputs/bcache/bcache_test.go:39:8                     gosec  G301: Expect directory permissions to be 0750 or less
plugins/inputs/bcache/bcache_test.go:48:8                     gosec  G301: Expect directory permissions to be 0750 or less
plugins/inputs/directory_monitor/directory_monitor.go:401:9   gosec  G301: Expect directory permissions to be 0750 or less
plugins/inputs/directory_monitor/directory_monitor.go:413:11  gosec  G301: Expect directory permissions to be 0750 or less
plugins/inputs/lustre2/lustre2_test.go:139:9                  gosec  G301: Expect directory permissions to be 0750 or less
plugins/inputs/lustre2/lustre2_test.go:143:8                  gosec  G301: Expect directory permissions to be 0750 or less
plugins/inputs/lustre2/lustre2_test.go:147:8                  gosec  G301: Expect directory permissions to be 0750 or less
plugins/inputs/lustre2/lustre2_test.go:211:9                  gosec  G301: Expect directory permissions to be 0750 or less
plugins/inputs/lustre2/lustre2_test.go:215:8                  gosec  G301: Expect directory permissions to be 0750 or less
plugins/inputs/lustre2/lustre2_test.go:275:9                  gosec  G301: Expect directory permissions to be 0750 or less
plugins/inputs/lustre2/lustre2_test.go:279:8                  gosec  G301: Expect directory permissions to be 0750 or less
plugins/inputs/postfix/postfix_test.go:19:22                  gosec  G301: Expect directory permissions to be 0750 or less
plugins/inputs/zfs/zfs_linux_test.go:198:9                    gosec  G301: Expect directory permissions to be 0750 or less
plugins/inputs/zfs/zfs_linux_test.go:201:8                    gosec  G301: Expect directory permissions to be 0750 or less
plugins/inputs/zfs/zfs_linux_test.go:250:9                    gosec  G301: Expect directory permissions to be 0750 or less
plugins/inputs/zfs/zfs_linux_test.go:253:8                    gosec  G301: Expect directory permissions to be 0750 or less
plugins/inputs/zfs/zfs_linux_test.go:294:8                    gosec  G301: Expect directory permissions to be 0750 or less

Currently they are excluded by default by:

# EXC0009 gosec: Too many issues in popular repos
- (Expect directory permissions to be 0750 or less|Expect file permissions to be 0600 or less)

[powersj]

+1

[srebhan]

Also think this is a good one to enable.