CNI configuration files have permissions 644 when 600 should be enough

[OlofKalufs]

Describe the bug

The CNI configuration file at /etc/cni/net.d/10-antrea.conflist gets the permissions 644 even though 600 should suffice. This is marked as a failure by the CIS Kubernetes Benchmark 1.9.0 #1.1.9

To Reproduce
Run

$ stat -c %a /etc/cni/net.d/10-antrea.conflist

Expected

$ stat -c %a /etc/cni/net.d/10-antrea.conflist
600

Actual behavior

$ stat -c %a /etc/cni/net.d/10-antrea.conflist
644

Versions:

• Antrea version (Docker image tag):
  projects.registry.vmware.com/tkg/antrea-advanced-debian@sha256:cd855cf402d22aff0826062bbd91fb330a1c294d0f8ca87b9d765f7dc11934e2
  (from tanzu standard packages 1.13.1+vmware.3-tkg.1)
• Kubernetes version: v1.28.4+vmware.1
• Container runtime: containerd 1.6.24
• Linux kernel version on the Kubernetes Nodes (uname -r): 5.15.0-89-generic

Additional context

It is set - it seems - in the file https://github.com/antrea-io/antrea/blob/main/build/images/scripts/install_cni on this line:

install -m 644 /etc/antrea/antrea-cni.conflist /host/etc/cni/net.d/10-antrea.conflist

[antoninbas]

@OlofKalufs Thanks for submitting this. Do you have some supporting evidence that 600 should always be enough? I took a quick look at other CNIs, and they also seem to be using 644 when installing the files on the Node.
I assume that in your typical case, everyone runs as root (CNI, containerd, kubelet) and 600 works fine, but is this always the case?

[github-actions]

This issue is stale because it has been open 90 days with no activity. Remove stale label or comment, or this will be closed in 90 days