Bugfix: Auto-assessment - Restricting execution permissions to root user/ owner

[nikhim-um]

6.aa.core.log
6.core.log
The changes are related to

IcM 526315073
Work Item: 29003600

In existing behavior the service, timer files and the auto assessment script file are getting created with 775 permissions which means other than root users also can execute and modify the file. Which may lead to unauthorized modification of files. This change intends to restrict the execution permissions to root user.

Test Results:

Periodic Assessment result after 12hrs:

[codecov]

Codecov Report

Attention: Patch coverage is 92.59259% with 4 lines in your changes missing coverage. Please review.

Project coverage is 92.49%. Comparing base (cb5eb95) to head (7c41e05).
Report is 1 commits behind head on master.

Files with missing lines	Patch %	Lines
src/core/tests/Test_ServiceManager.py	92.00%	2 Missing ⚠️
src/core/tests/Test_TimerManager.py	92.00%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #299      +/-   ##
==========================================
+ Coverage   92.43%   92.49%   +0.06%     
==========================================
  Files          97       99       +2     
  Lines       16237    16287      +50     
==========================================
+ Hits        15008    15064      +56     
+ Misses       1229     1223       -6     

Flag	Coverage Δ
python27	92.49% <92.59%> (-0.03%)	⬇️
python39	92.49% <92.59%> (-0.03%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[rane-rajasi]

Test for an auto assessment run that is auto triggered on schedule. The one added to this description is a default one that triggers during ConfigurePatching. You'll have to wait for ~12 hours for the auto assessment service to run without any external push. It will write status to the previous seqno but the activityId between PatchAssessmentResult and ConfigurePatchingResult will be different alongwith the startTime

[kjohn-msft]

Please provide the *.aa.log file into PR description showing an actual AA run (edit -> attach). Also include a regular log file showing the aa configuration by core. Status entries as 'Platform' also come from non-auto-assessment configurePatching calls and is not conclusive on which code path executed.

[kjohn-msft]

Comment on log notes inline.

General comment on adding comments also.

[feng-j678]

lets not include any msft internal application docs/links etc here, security concern

[feng-j678]

since this pr touches 2 files with lowest code coverage, this will flag code coverage while merge current state it won't affect coverage %, but best practice is to add ut coverage for other logics in servicemanager and timermanager.py, so our overall coverage will reach target goal: 95%

[nikhim-um]

Please provide the *.aa.log file into PR description showing an actual AA run (edit -> attach). Also include a regular log file showing the aa configuration by core. Status entries as 'Platform' also come from non-auto-assessment configurePatching calls and is not conclusive on which code path executed.

attached

[nikhim-um]

Test for an auto assessment run that is auto triggered on schedule. The one added to this description is a default one that triggers during ConfigurePatching. You'll have to wait for ~12 hours for the auto assessment service to run without any external push. It will write status to the previous seqno but the activityId between PatchAssessmentResult and ConfigurePatchingResult will be different alongwith the startTime

Provided screenshot to verify this

[kjohn-msft]

Some comments inline -- pulling code locally right now to see tests running. Should not have any other comments, but sharing what's going on.