Fix permissions for resolv.conf and hosts

WriteFile sets permissions before umask is applied.
For people using agressive umasks (0077), /etc/resolv.conf will end-up unreadable for non root processes.

See #3704

Signed-off-by: apostasie <[email protected]>

Author: apostasie

pkg/dnsutil/hostsstore/hostsstore.go

@@ -114,6 +114,9 @@ func (x *hostsStore) Acquire(meta Meta) (err error) {
 		if err = os.WriteFile(loc, []byte{}, 0o644); err != nil {
 			return errors.Join(store.ErrSystemFailure, err)
 		}
+		if err = os.Chmod(loc, 0o644); err != nil {
+			err = errors.Join(store.ErrSystemFailure, err)
+		}
 
 		var content []byte
 		content, err = json.Marshal(meta)
@@ -175,6 +178,9 @@ func (x *hostsStore) AllocHostsFile(id string, content []byte) (location string,
 		if err != nil {
 			err = errors.Join(store.ErrSystemFailure, err)
 		}
+		if err = os.Chmod(loc, 0o644); err != nil {
+			err = errors.Join(store.ErrSystemFailure, err)
+		}
 
 		return err
 	})
@@ -333,6 +339,7 @@ func (x *hostsStore) updateAllHosts() (err error) {
 		if err != nil {
 			log.L.WithError(err).Errorf("failed to write hosts file for %q", entry)
 		}
+		_ = os.Chmod(loc, 0o644)
 	}
 	return nil
 }

pkg/resolvconf/resolvconf.go

@@ -317,7 +317,12 @@ func Build(path string, dns, dnsSearch, dnsOptions []string) (*File, error) {
 		return nil, err
 	}
 
-	return &File{Content: content.Bytes(), Hash: hash}, os.WriteFile(path, content.Bytes(), 0644)
+	err = os.WriteFile(path, content.Bytes(), 0o644)
+	if err != nil {
+		return nil, err
+	}
+
+	return &File{Content: content.Bytes(), Hash: hash}, os.Chmod(path, 0o644)
 }
 
 func hashData(src io.Reader) (string, error) {