Changes local storage pods to have 700 permissions

[dereknola]

Signed-off-by: dereknola [email protected]

Proposed Changes

Individual storage pods under /var/lib/rancher/k3s/storage will now have 0700 permissions to prevent other users from accessing them.

Types of Changes

Changed mkdir call in local-storage.yaml

Verification

• Start k3s server
• Create local storage by following rancher guide https://rancher.com/docs/k3s/latest/en/storage/
• Verify that created storage under /var/lib/rancher/k3s/storage/ has 0700 permissions

Linked Issues

#2348

[briandowns]

LGTM

[flokli]

This broke all volumes for containers running not as root. See #3704, which reported this as a k3s regression.

From rancher/local-path-provisioner#182 (comment), /var/lib/rancher/k3s/storage shouln't be world-readable (but restricted to root), and individual volumes should be chmod 777:

So volume itself is 0777, but the parent directory secured with 0700 and accessible by root only.

[brandond]

@flokli if you look at the bottom of that issue you should see linked PRs for every branch resolving the regression. The fix will be included in the next release.

[flokli]

@brandond let's take the discussion over to #2348 (comment).