Ensure files on USB have read permissions, not just enclosing directory.

[rocodes]

Status

Ready for review

Description

Fixes file permissions on USB export drive (ref #1726 and adds test case. The initial change (in #1777) correctly changed the permission on the export directory, but not on the files being copied into that directory.

Test Plan

• CI passing (looks like there are some issues to iron out, for tomorrow..)
• visual review makes sense
• Export succeeds and files have desired permissions (For quick testing that avoids building a deb, this can also be tested at the commandline. Check out this branch, activate venv, open a terminal, attach a supported USB drive to the VM and unlock it).

$ mkdir -p /tmp/export/export_data/
$ echo "foo" > /tmp/export/export_data/test.txt
$ python3
>> from securedrop_export.disk.cli import CLI
>> cli = CLI()
>> usb = cli.get_volume()  # will show you have a MountedVolume object attached
>> cli.write_data_to_device(usb, "/tmp/export", "test")
>> # Command succeeds, usb is locked/unmounted, and contains a folder called "test" with `export_data/test.txt` in it, with 644 permissions

Checklist

If these changes modify code paths involving cryptography, the opening of files in VMs or network (via the RPC service) traffic, Qubes testing in the staging environment is required. For fine tuning of the graphical user interface, testing in any environment in Qubes is required. Please check as applicable:

• I have tested these changes in the appropriate Qubes environment
• I do not have an appropriate Qubes OS workstation set up (the reviewer will need to test these changes)
• These changes should not need testing in Qubes

If these changes add or remove files other than client code, the AppArmor profile may need to be updated. Please check as applicable:

• I have updated the AppArmor profile
• No update to the AppArmor profile is required for these changes
• I don't know and would appreciate guidance

If these changes modify the database schema, you should include a database migration. Please check as applicable:

• I have written a migration and upgraded a test database based on main and confirmed that the migration is self-contained and applies cleanly
• I have written a migration but have not upgraded a test database based on main and would like the reviewer to do so
• I need help writing a database migration
• No database schema changes are needed

[rocodes]

locally (the export component tests):

(securedrop-export-py3.9) user@sd-dev:~/projects/securedrop-client/export$ git show --name-only
commit 060604e02803495b152db9c89d1fe75f76823b36 (HEAD -> export-permissions-on-files, origin/export-permissions-on-files)
Author: Ro <ro@freedom.press>
Date:   Thu Mar 14 20:19:20 2024 -0400

    Ensure files on USB have read permissions, not just enclosing directory.

export/securedrop_export/disk/cli.py
export/tests/disk/test_cli.py
(securedrop-export-py3.9) user@sd-dev:~/projects/securedrop-client/export$ make test && make check && echo "OK" || echo "Tests failed"
[... snip ]
======================================= 126 passed, 1 skipped in 6.68s ========================================
OK

[legoktm]

LGTM