coreci/orca
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 91 Wiki Activity

fix(P13): step-ca /tmp hardening (REQ-128, F10)

Browse Source 
---ci---
project: orca
phase: 13
milestone: v0.12
status: execute
---/ci---

step-ca cert/key temp files moved from world-readable /tmp/orca-* to
/etc/orca/step-tmp/orca-* (0700). mkdir + chmod 700 before writing.
Fixes both stepca.go and spiffe.go. All tests updated + pass.
This commit is contained in:
Jon Chery
2026-08-07 11:22:07 +00:00
parent 7f81042abd
commit 0d5ff663b4
4 changed files with 26 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/identity/spiffe.go
+2 -2
View File
@@ -37,8 +37,8 @@ func MintSVID(ctx context.Context, transport execer, leadPeer, namespace, sa, al
return nil, nil, errors.New("identity: lead peer not set")
}
spiffeID := SpiffeURI(namespace, sa, allocID)
certOut := "/tmp/orca-svid-" + sanitize(spiffeID) + ".crt"
keyOut := "/tmp/orca-svid-" + sanitize(spiffeID) + ".key"
certOut := "/etc/orca/step-tmp/orca-svid-" + sanitize(spiffeID) + ".crt"
keyOut := "/etc/orca/step-tmp/orca-svid-" + sanitize(spiffeID) + ".key"
var sb strings.Builder
sb.WriteString("step ca certificate ")
sb.WriteString(shellQuote(spiffeID))
internal/identity/spiffe_test.go
+6 -6
View File
@@ -155,8 +155,8 @@ func TestMintSVID_Success(t *testing.T) {
keyPEM := []byte("-----BEGIN PRIVATE KEY-----\nFAKE\n-----END PRIVATE KEY-----\n")
mx := &mockExec{responses: []mockResp{
{match: "step ca certificate", out: nil, err: nil},
{match: "cat '/tmp/orca-svid-spiffe-orca.local_ns__defaults_sa_web_abc123.crt'", out: certPEM, err: nil},
{match: "cat '/tmp/orca-svid-spiffe-orca.local_ns__defaults_sa_web_abc123.key'", out: keyPEM, err: nil},
{match: "cat '/etc/orca/step-tmp/orca-svid-spiffe-orca.local_ns__defaults_sa_web_abc123.crt'", out: certPEM, err: nil},
{match: "cat '/etc/orca/step-tmp/orca-svid-spiffe-orca.local_ns__defaults_sa_web_abc123.key'", out: keyPEM, err: nil},
{match: "rm -f", out: nil, err: nil},
}}
gotCert, gotKey, err := MintSVID(context.Background(), mx, "lead:22", "_defaults", "web", "abc123")
@@ -203,8 +203,8 @@ func TestMintSVID_EmptyLead(t *testing.T) {
func TestMintSVID_EmptyCert(t *testing.T) {
mx := &mockExec{responses: []mockResp{
{match: "step ca certificate", out: nil, err: nil},
{match: "cat '/tmp/orca-svid-spiffe-orca.local_ns__defaults_sa_web_abc123.crt'", out: nil, err: nil},
{match: "cat '/tmp/orca-svid-spiffe-orca.local_ns__defaults_sa_web_abc123.key'", out: []byte("KEY"), err: nil},
{match: "cat '/etc/orca/step-tmp/orca-svid-spiffe-orca.local_ns__defaults_sa_web_abc123.crt'", out: nil, err: nil},
{match: "cat '/etc/orca/step-tmp/orca-svid-spiffe-orca.local_ns__defaults_sa_web_abc123.key'", out: []byte("KEY"), err: nil},
{match: "rm -f", out: nil, err: nil},
}}
_, _, err := MintSVID(context.Background(), mx, "lead:22", "_defaults", "web", "abc123")
@@ -217,8 +217,8 @@ func TestMintSVID_URISANMissing(t *testing.T) {
wrongCert := mintTestSVIDCert(t, "spiffe://orca.local/ns/other/sa/api/0")
mx := &mockExec{responses: []mockResp{
{match: "step ca certificate", out: nil, err: nil},
{match: "cat '/tmp/orca-svid-spiffe-orca.local_ns__defaults_sa_web_abc123.crt'", out: wrongCert, err: nil},
{match: "cat '/tmp/orca-svid-spiffe-orca.local_ns__defaults_sa_web_abc123.key'", out: []byte("KEY"), err: nil},
{match: "cat '/etc/orca/step-tmp/orca-svid-spiffe-orca.local_ns__defaults_sa_web_abc123.crt'", out: wrongCert, err: nil},
{match: "cat '/etc/orca/step-tmp/orca-svid-spiffe-orca.local_ns__defaults_sa_web_abc123.key'", out: []byte("KEY"), err: nil},
{match: "rm -f", out: nil, err: nil},
}}
_, _, err := MintSVID(context.Background(), mx, "lead:22", "_defaults", "web", "abc123")