REQ 016

REQ-016: Credential temp files created with mode 0600

Requirement

Guest/service-account credential files written to a runner's temp directory during provisioning shall be created with mode 0600.

Rationale

Limits the blast radius of a credential file if the runner's temp directory is otherwise readable.

Fit Criterion

install -m 0600 /dev/null "$WINRM_PASSWORD_FILE" (or equivalent) precedes every write of a guest password/PAT to a temp file across provision-windows-labview-vm.yml.

Verification

Code review of every credential-file-writing step in provision-windows-labview-vm.yml.

Source

Software-Requirements-Specification

Priority

Medium

TestID

TEST-016

TestArtifact

Code review of every credential-write site

CodeRef

.github/workflows/provision-windows-labview-vm.yml

Status

Verified (manual)