[Security] Credential and config files lack strict file permissions

[Prodesire]

Bug Description

File: src/iac_code/config.py:48-51, config.py:250-252, utils/log.py:69-79
Type: Insecure File Permissions (CWE-732)
Severity: Medium
Verified: Confirmed _save_yaml does not call restrict_file_permissions

Problem

.credentials.yml and .cloud-credentials.yml contain plaintext API keys but are written without setting restrictive permissions (0600). On multi-user systems, other users can read these credential files.

Additionally:

• Configuration directories are created without enforcing 0700
• Log directories and log files also lack strict permissions
• If debug logs record prompts, tool parameters, or tool results, sensitive information may be exposed through overly permissive log files

Impact

On shared systems (multi-user servers, CI environments), any local user can read:

• API keys for LLM providers
• Cloud credentials (Alibaba Cloud AccessKey, etc.)
• Potentially sensitive content from debug logs

Expected Behavior

• Credential files should be created with 0600 permissions (owner read/write only)
• Configuration and log directories should be created with 0700 permissions
• After writing, restrict_file_permissions() should be called

Actual Behavior

• Files are created with default umask permissions (often 0644)
• No permission restriction is applied after write
• Any local user may read credential files

Suggested Fix

# After writing credential files
path.write_text(content)
os.chmod(path, 0o600)

# When creating directories
dir_path.mkdir(parents=True, exist_ok=True)
os.chmod(dir_path, 0o700)

[guima-why]

Thanks for reporting this. I checked the current main branch and this appears to have already been fixed before this issue was opened.

The fix was introduced in commit 751073e (fix: consolidate issue batch fixes), which was merged via PR #62 and is present in current main (d1f7930).

Relevant fixed locations:

• YAML writes now restrict both the parent directory and written file: src/iac_code/config.py#L51-L55
• The config directory is created/restricted through ensure_private_dir(): src/iac_code/config.py#L262-L271
• POSIX files/directories are restricted to 0600 / 0700: src/iac_code/utils/file_security.py#L26-L48
• Log directories and log files are restricted after creation: src/iac_code/utils/log.py#L71-L85 and src/iac_code/utils/log.py#L108-L125
• .cloud-credentials.yml is saved through _save_yaml(), so it inherits the same private directory/file handling: src/iac_code/services/providers/aliyun.py#L250-L277

There is also test coverage for the permissions behavior:

• _save_yaml() writes owner-only files: tests/test_config.py#L228-L238
• ensure_private_dir() / ensure_private_file() permissions: tests/utils/test_file_security.py#L32-L55
• log file permission coverage: tests/utils/test_log_symlink.py#L29-L52

I also verified locally that saving .credentials.yml, saving .cloud-credentials.yml, and creating a debug log produce 0700 directories and 0600 files. The targeted permission tests passed (29 passed).