cloud-init resets permissions on log file after reboot

[Richard Harding]

In attempting to apply CIS security guidelines onto an Ubuntu system it was found that changing the log files in /var/log to 640, that on a reboot cloud-init would reset the permissions to 644. As long as cloud-init can write to the file it should be ok to alter the permissions without issue.

[Dan Watkins (oddbloke)]

When it runs on each boot, specifically in the init stages (i.e. when the `cloud-init-local.service` and `cloud-init.service` systemd units run), cloud-init executes `ensure_file`[0] on `/var/log/cloud-init.log` and in so doing resets the permissions to 644.

I am fairly confident that this resetting of the permissions is not intentional; I can't think of a compelling reason to do that, so I expect we can stop doing it.

I believe the fix is fairly simple: `write_file` (which `ensure_file` uses) has a `preserve_mode` parameter which defaults to `False`. We should expose that in `ensure_file` and pass `preserve_mode=True` when calling `ensure_file` for `cloud-init.log`. Then it will be created
world-readable if it does not already exist, but its permissions will not be modified if it does.

[0] https://github.com/canonical/cloud-init/blob/master/cloudinit/util.py#L1807-L1808

[Dan Watkins (oddbloke)]

I've just opened a PR for this: https://github.com/canonical/cloud-init/pull/624

[Dan Watkins (oddbloke)]

A fix for this has landed in the cloud-init codebase: https://github.com/canonical/cloud-init/commit/f5b3ad741679cd42d2c145e574168dafe3ac15c1

[Chad Smith (chad.smith)]

This bug is believed to be fixed in cloud-init in version 20.4. If this is still a problem for you, please make a comment and set the state back to New

Thank you.

[James Falcon (falcojr)]

Tracked in Github Issues as https://github.com/canonical/cloud-init/issues/3796