Agent renders secret templates world-readable (0644) with no way to set the mode

[alekc]

The agent writes rendered secret templates with whatever os.Create gives it, so on a normal umask they land 0644. There is no config option to change that, which makes the agent awkward to adopt anywhere it replaces something that wrote 0600.

Reproduce with the published image against any project and path you have access to:

templates:
  - source-path: /etc/infisical/dotenv.tmpl
    destination-path: /out/app/app.env
    config:
      polling-interval: 60s

$ stat -c '%a %U' /out/app/app.env
644 root

WriteBytesToFile (packages/cmd/agent.go:789) is a bare os.Create with no chmod, and Template.Config carries only polling-interval and execute, so there is nothing to set.

The execute hook is not a workaround for this. A chmod 600 /out/app/app.env there is valid and runs under sh -c, but the hook is guarded by if !firstRun && execCommand != "" (agent.go:1934), so it is skipped on the first render and only fires once an etag change causes a re-render. The file stays 0644 from the moment it is created until the first rotation.

Certificates already handle this. AgentCertificateConfig.FileConfig takes a permission per output file (agent.go:250, :254, :258) and getFilePermission (agent.go:2676) parses it as octal with a 0600 default. Wiring that same field and helper into the secret template config would be enough:

templates:
  - source-path: /etc/infisical/dotenv.tmpl
    destination-path: /out/app/app.env
    config:
      permission: "0600"

Defaulting secret templates to 0600 would be better still, given the content, though that is a behaviour change for anyone depending on the current mode.

Version 0.43.114, reproduced with infisical/cli:0.43.114 on linux/arm64.