group permissions are not good with s3fs about keywhiz-fs HOT 4 CLOSED

It's possible to override the permissions on the server-side when adding a secret by setting the "mode" field in the metadata.

For example, if you set the metadata to

{"mode":"0400"}

the secret will have permissions 0400 in keywhiz-fs.

You can also override the owner/group with (for example):

{"owner":"cs","group":"cs","mode":"0400"}

That would make the secret be owned by cs:cs and have mode 0400.

If you're using the web UI to add a secret there should be a metadata field to add this.

If you're using the CLI, you can do it like this:

java -jar $KEYWHIZ_CLI_JAR -U https://localhost:4444/ add secret --name secret-name --json '{"mode":"0400"}'

That said, I think it would make sense to have a flag in keywhiz-fs to override the default permissions for secrets that don't have metadata attached to them.

from keywhiz-fs.

We could allow an override in keywhiz-fs by adding a flag, maybe like this:

keywhiz-fs [OPTIONS] --default-permissions 0400

would that be useful to you?

from keywhiz-fs.

@csstaub: Big Thanks for the explanation; yes, a default permission flag would be useful. I think I'll try to implement it, just for practicing golang.

from keywhiz-fs.

@gyulaweber sounds good!

from keywhiz-fs.