fix: preserve file permissions in safe_open() by Copilot · Pull Request #1117 · NethServer/ns8-core

Copilot · 2026-03-10T09:03:03Z

tempfile.mkstemp() unconditionally creates files with mode 0600, ignoring both the existing file's permissions and the process umask, causing every file written through safe_open() to end up with 0600.

Refs NethServer/dev#7915

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Narrow the validity period from 1 month to 24 hours.

- Automatically stop the support.service unit 24 hours after support begins. - The auxiliary unit support-expire.timer can be stopped manually, to extend the support session duration as wanted. - In any case support.service will die after 30 days.

Return the session expiry timestamp in ISO 8601 format. Standard session duration is 24 hours, but it can be extended up to 30 days.

Co-authored-by: DavidePrincipi <2920838+DavidePrincipi@users.noreply.github.com>

Re-read per-user allowed networks from Redis in IdentityHandler and check the client IP in Authorizator before the GET bypass, so all HTTP methods are gated by the allowlist on every request. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Usernames matching 'cluster', 'node/*', or 'module/*' are NS8 agent credentials. Return loopback + VPN network (cluster/network) as their forced allowlist so they cannot be used from outside the cluster, regardless of any per-user networks entry in Redis. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

After credentials are verified, check the client IP against the per-user allowed networks (GetUserNetworks) before proceeding to role/action authorization. Returns 403 if the IP is not allowed. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Set Gin's trusted proxy list to 127.0.0.1 and ::1 so that X-Forwarded-For is honoured only for connections coming from the local Traefik instance. Direct connections (e.g. cluster agents over the VPN) use the TCP peer address, preventing clients from spoofing their source IP via forged headers. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Extend user-attributes schema with an allowed_networks array of IPv4/IPv6 addresses and CIDR networks. Add ipv6-cidr and ip-cidr definitions to cluster.json. add-user stores the array as a CSV string in HSET user/<username> allowed_networks <csv> alter-user updates it when the key is present in the set block. An empty array removes all IP restrictions. Fix GetUserNetworks in api-server to read the allowed_networks field instead of the old networks field name. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Test suite 61__allowed_networks_login.robot covers all three enforcement points of the allowed_networks feature: - JWT login denied when source IP not in allowed_networks (401) - JWT login succeeds after restriction is removed (200) - JWT rejected mid-session after restriction is re-applied (403) - cluster/node/module agent credentials blocked from external IP (401) - HTTP-Basic module endpoint blocked from external IP (403) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Agent credentials (cluster, node/*, module/*) are always restricted to loopback + cluster VPN network by the API server. Regular user accounts can optionally carry an allowed_networks restriction. Document this in: - core/api-server/README.md (new "Network access restrictions" section) - docs/core/api_server.md (new "Network access control" section) - docs/core/agents.md (note in the task-submission section) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Pass a space-separated list of IPs/CIDRs to restrict which source addresses the new user may log in from. add-user bob --role owner --allowed-networks 192.168.1.0/24 10.0.0.1 When the flag is omitted no IP restriction is applied. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Allow nethsupport cluster-admin access only from official Nethesis IP addresses. The loopback address is required for cluster-admin and SSH access from the support VPN.

The client IP address must be read from X-Forwarded-For header, set by the local, trusted Traefik proxy.

- Decrease session age hard limit from 30 to 7 days - Extend SSH key expire period to 7 days - Update subscription docs

The validation error protocol expects an array output.

…ling (#1101) NethServer/dev#7842

Automatic stop of support.service unit

api-server: enforce per-user IP/network allowlist at login

Translate-URL: https://hosted.weblate.org/projects/ns8/core/it/ Translation: NS8/core Co-authored-by: Davide Principi <davide.principi@nethesis.it>

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> [skip ci]

[skip ci]

Check the image existence with skopeo. [skip ci]

Revert environment file permissions to default mode 644.

- If the file is new, generate a unique temporary file name and write to it. Use os.open() to honor the process umask. - If the file already exists, copy its permissions to a temporary file created with tempfile.mkstemp().

Copilot

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-12T18:23:41Z

+                try:
+                    # Try to create a new file on tmp_path. Kernel
+                    # applies current process umask on file creation
+                    fd = os.open(tmp_path, base_flags | os.O_CREAT | os.O_EXCL, 0o666)


In the FileNotFoundError fallback branch, the temp file is created with os.open(..., base_flags | os.O_CREAT | os.O_EXCL, 0o666) but without os.O_CLOEXEC. Unlike tempfile.mkstemp() (which uses close-on-exec), this can leak the FD into any subsequently exec'd process before the context manager closes it. Consider adding os.O_CLOEXEC to the os.open flags (and/or using tempfile APIs that ensure CLOEXEC) to keep behavior consistent and avoid FD leaks.

Suggested change

fd = os.open(tmp_path, base_flags | os.O_CREAT | os.O_EXCL, 0o666)

fd = os.open(

tmp_path,

base_flags | os.O_CREAT | os.O_EXCL | getattr(os, "O_CLOEXEC", 0),

0o666,

)

https://docs.python.org/3.11/library/os.html#inheritance-of-file-descriptors

FDs are not inheritable by default

[root@rl1 state]# strace python3 -c 'import agent with agent.safe_open("x") as fd: print("x", file=fd) ' ... openat(AT_FDCWD, "./.x.tmp-61119-0", O_WRONLY|O_CREAT|O_EXCL|O_CLOEXEC, 0666) = 3

renovate Bot and others added 30 commits March 2, 2026 15:48

chore(deps): update dependency carbon-components to v10.58.15 (#1051)

6cc50bc

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

feat: 24 hours validity for support's SSH key

29363bc

Narrow the validity period from 1 month to 24 hours.

feat(get-support-session): expires_at timestamp

739157f

Return the session expiry timestamp in ISO 8601 format. Standard session duration is 24 hours, but it can be extended up to 30 days.

chore(AGENTS.md): branch name conventions

8ae817c

chore(AGENTS.md): commit convention

ade9c46

Add IP/network allowlist enforcement at login time in api-server

dd4459c

Co-authored-by: DavidePrincipi <2920838+DavidePrincipi@users.noreply.github.com>

feat(ui): show support session expiration

ce86cff

feat: restrict nethsupport access IP

68ade0b

Allow nethsupport cluster-admin access only from official Nethesis IP addresses. The loopback address is required for cluster-admin and SSH access from the support VPN.

fix(middleware.go): log correct client IP

5ceb962

The client IP address must be read from X-Forwarded-For header, set by the local, trusted Traefik proxy.

fix: set session age hard limit at 7 days

93a5356

- Decrease session age hard limit from 30 to 7 days - Extend SSH key expire period to 7 days - Update subscription docs

fixup! Add IP/network allowlist enforcement at login time in api-server

56dd33c

fixup! feat(cluster): add allowed_networks to user management

a9028f9

fix(alter-user): format of validation output

ad85545

The validation error protocol expects an array output.

Add notification for offline Traefik instances and improve error hand…

e65a220

…ling (#1101) NethServer/dev#7842

Merge branch 'rel-318'

50d1336

Merge pull request #1100 from NethServer/feat-7900

048684b

Automatic stop of support.service unit

Merge pull request #1103 from NethServer/feat-7900-2

deec586

api-server: enforce per-user IP/network allowlist at login

Translated with Weblate (#1105)

8c06321

Translate-URL: https://hosted.weblate.org/projects/ns8/core/it/ Translation: NS8/core Co-authored-by: Davide Principi <davide.principi@nethesis.it>

chore(deps): update dependency @nethserver/ns8-ui-lib to v1.12.1 (#1106)

509e2e0

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> [skip ci]

fix(deps): update module github.com/mattn/go-sqlite3 to v1.14.34 (#1086)

f3ca4bf

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> [skip ci]

DavidePrincipi added the testing Start test suite label Mar 10, 2026

chore(build): sanitize image tag

9199245

[skip ci]

DavidePrincipi force-pushed the copilot/fix-file-permission-handling branch from 13ca326 to c9192e8 Compare March 10, 2026 18:13

DavidePrincipi added testing Start test suite and removed testing Start test suite labels Mar 10, 2026

DavidePrincipi requested a review from Copilot March 12, 2026 14:53

DavidePrincipi marked this pull request as ready for review March 12, 2026 14:53

Copilot started reviewing on behalf of DavidePrincipi March 12, 2026 14:54 View session

This comment was marked as outdated.

Sign in to view

fix(build): overcome 150 tag limit

41b324a

Check the image existence with skopeo. [skip ci]

DavidePrincipi force-pushed the copilot/fix-file-permission-handling branch from 24836f7 to 3007c7f Compare March 12, 2026 15:54

DavidePrincipi requested a review from Copilot March 12, 2026 15:55

Copilot started reviewing on behalf of DavidePrincipi March 12, 2026 15:55 View session

This comment was marked as outdated.

Sign in to view

DavidePrincipi force-pushed the copilot/fix-file-permission-handling branch from 3007c7f to ccf044a Compare March 12, 2026 16:17

DavidePrincipi added 2 commits March 12, 2026 19:12

fix: environment permissions

5e82ec6

Revert environment file permissions to default mode 644.

fix: preserve file permissions in safe_open()

8666106

- If the file is new, generate a unique temporary file name and write to it. Use os.open() to honor the process umask. - If the file already exists, copy its permissions to a temporary file created with tempfile.mkstemp().

DavidePrincipi force-pushed the copilot/fix-file-permission-handling branch from ccf044a to 8666106 Compare March 12, 2026 18:13

DavidePrincipi requested a review from Copilot March 12, 2026 18:13

DavidePrincipi removed testing Start test suite labels Mar 12, 2026

Copilot started reviewing on behalf of DavidePrincipi March 12, 2026 18:18 View session

Copilot AI reviewed Mar 12, 2026

View reviewed changes

DavidePrincipi added the testing Start test suite label Mar 12, 2026

DavidePrincipi linked an issue Mar 13, 2026 that may be closed by this pull request

safeio.py creates files with wrong permissions NethServer/dev#7915

Closed

DavidePrincipi changed the base branch from main to rel3181 March 13, 2026 11:02

DavidePrincipi merged commit cbe667f into rel3181 Mar 13, 2026
9 of 11 checks passed

DavidePrincipi deleted the copilot/fix-file-permission-handling branch March 13, 2026 11:02

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: preserve file permissions in safe_open()#1117

fix: preserve file permissions in safe_open()#1117
DavidePrincipi merged 44 commits intorel3181from
copilot/fix-file-permission-handling

Copilot AI commented Mar 10, 2026 •

edited by DavidePrincipi

Loading

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 12, 2026

Uh oh!

DavidePrincipi Mar 12, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Conversation

Copilot AI commented Mar 10, 2026 • edited by DavidePrincipi Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Mar 12, 2026

Choose a reason for hiding this comment

Uh oh!

DavidePrincipi Mar 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

6 participants

Copilot AI commented Mar 10, 2026 •

edited by DavidePrincipi

Loading

DavidePrincipi Mar 12, 2026 •

edited

Loading