{"action":"created","issue":{"url":"https://api.github.com/repos/hashicorp/consul-template/issues/358","labels_url":"https://api.github.com/repos/hashicorp/consul-template/issues/358/labels{/name}","comments_url":"https://api.github.com/repos/hashicorp/consul-template/issues/358/comments","events_url":"https://api.github.com/repos/hashicorp/consul-template/issues/358/events","html_url":"https://github.com/hashicorp/consul-template/issues/358","id":100223957,"number":358,"title":"Support for specifying file mode and ownership","user":{"login":"hashbrowncipher","id":124699,"avatar_url":"https://avatars.githubusercontent.com/u/124699?v=3","gravatar_id":"","url":"https://api.github.com/users/hashbrowncipher","html_url":"https://github.com/hashbrowncipher","followers_url":"https://api.github.com/users/hashbrowncipher/followers","following_url":"https://api.github.com/users/hashbrowncipher/following{/other_user}","gists_url":"https://api.github.com/users/hashbrowncipher/gists{/gist_id}","starred_url":"https://api.github.com/users/hashbrowncipher/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/hashbrowncipher/subscriptions","organizations_url":"https://api.github.com/users/hashbrowncipher/orgs","repos_url":"https://api.github.com/users/hashbrowncipher/repos","events_url":"https://api.github.com/users/hashbrowncipher/events{/privacy}","received_events_url":"https://api.github.com/users/hashbrowncipher/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":6,"created_at":"2015-08-11T04:40:16Z","updated_at":"2015-09-08T17:49:41Z","closed_at":null,"body":"Currently, consul-template's atomicWrite function preserves mode of any file it overwrites.  If a file doesn't exist, it will be created with mode 0644.  There is no support for specifying or preserving file ownership.  In #16, the possibility of specifying the permissions of output files was discussed.\r\n\r\nMy use-case is consul-template retrieving secrets from Vault.  Services with different security levels will coexist on a multi-tenant node, with each service having its own Linux user.  I would like to map a Vault policy to each service, and the whole node will have the union of all such policies.  consul-template will have access to the \"union token\", and will be responsible for generating tokens with a subset of its policies and distributing them to each service user.  Such files should be owned by serviceuser:servicegroup, and have mode no greater than 0640.  Writing data into the file and later changing the file permissions (as would happen using a post-write command) leaves a window of opportunity for an attacker to use a tool such as inotify to open the file before the post-write command changes its mode.\r\n\r\nBack when #16 was being discussed, consul-template did not have Vault integration, and was not specialized to handling secrets.  Now that it does, I think it might be worth revisiting some of that discussion.\r\n\r\nI can envision three possible solutions that would fit the above use-case:\r\n\r\n1. provide a global option to specify the mode for all files created by consul-template.  This _could_ just be the umask of the consul-template process.  consul-template would write files into a staging area according to the configured value, and post-write commands would use cp, chown, and mv to place them in their final destinations with the appropriate permissions.\r\n2. same as 1, but _also_ preserve ownership of existing files.  This mostly eliminates the need for a staging area, meaning that post-write commands for each template need only do chown.\r\n3. individually specify file ownership and mode in consul-template.hcl for each templated file, and set those attributes before any data is written into the file.\r\n\r\nIs #16 worth revisiting? Do any of the above options make sense?\r\n\r\ncc @EvanKrall, @bgirardeau"},"comment":{"url":"https://api.github.com/repos/hashicorp/consul-template/issues/comments/138646982","html_url":"https://github.com/hashicorp/consul-template/issues/358#issuecomment-138646982","issue_url":"https://api.github.com/repos/hashicorp/consul-template/issues/358","id":138646982,"user":{"login":"wwalker","id":23478,"avatar_url":"https://avatars.githubusercontent.com/u/23478?v=3","gravatar_id":"","url":"https://api.github.com/users/wwalker","html_url":"https://github.com/wwalker","followers_url":"https://api.github.com/users/wwalker/followers","following_url":"https://api.github.com/users/wwalker/following{/other_user}","gists_url":"https://api.github.com/users/wwalker/gists{/gist_id}","starred_url":"https://api.github.com/users/wwalker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/wwalker/subscriptions","organizations_url":"https://api.github.com/users/wwalker/orgs","repos_url":"https://api.github.com/users/wwalker/repos","events_url":"https://api.github.com/users/wwalker/events{/privacy}","received_events_url":"https://api.github.com/users/wwalker/received_events","type":"User","site_admin":false},"created_at":"2015-09-08T17:49:41Z","updated_at":"2015-09-08T17:49:41Z","body":"+1 for a create_command, or a pre_command\r\n\r\nand passing the filename of the template to both of them would be nice, either as an argument, or an environment variable."}}