[preservefiles] Apply restrictive default permissions

src/modules/preservefiles/PreserveFiles.cpp

@@ -192,6 +192,10 @@ void PreserveFiles::setConfigurationMap(const QVariantMap& configurationMap)
         return;
     }
 
+    QString defaultPermissions = configurationMap[ "perm" ].toString();
+    if ( defaultPermissions.isEmpty() )
+        defaultPermissions = QStringLiteral( "root:root:0400" );
+    
     QVariantList l = files.toList();
     unsigned int c = 0;
     for ( const auto& li : l )
@@ -200,7 +204,7 @@ void PreserveFiles::setConfigurationMap(const QVariantMap& configurationMap)
         {
             QString filename = li.toString();
             if ( !filename.isEmpty() )
-                m_items.append( Item{ filename, filename, Permissions(), ItemType::Path } );
+                m_items.append( Item{ filename, filename, Permissions( defaultPermissions ), ItemType::Path } );
             else
                 cDebug() << "Empty filename for preservefiles, item" << c;
         }
@@ -214,6 +218,8 @@ void PreserveFiles::setConfigurationMap(const QVariantMap& configurationMap)
                 ( from == "config" ) ? ItemType::Config :
                 ItemType::None;
             QString perm = map[ "perm" ].toString();
+            if ( perm.isEmpty() )
+                perm = defaultPermissions;
 
             if ( dest.isEmpty() )
             {
@@ -225,7 +231,7 @@ void PreserveFiles::setConfigurationMap(const QVariantMap& configurationMap)
             }
             else
             {
-                m_items.append( Item{ QString(), dest, Permissions(perm), t } );
+                m_items.append( Item{ QString(), dest, Permissions( perm ), t } );
             }
         }
         else

src/modules/preservefiles/preservefiles.conf

@@ -41,3 +41,9 @@ files:
   - from: config
     dest: /root/install.cfg
     perm: root:wheel:400
+
+# The *perm* key contains a default value to apply to all files listed
+# above that do not have a *perm* key of their own. If not set,
+# root:root:0400 (highly restrictive) is used.
+#
+# perm: "root:root:0400"