Restrict NAP file/dir permissions

src/extensions/nginx-app-protect/nap/nap.go

@@ -15,17 +15,16 @@ import (
 	"strings"
 	"time"
 
-	log "github.com/sirupsen/logrus"
-
 	"github.com/nginx/agent/v2/src/core"
+
+	log "github.com/sirupsen/logrus"
 )
 
 const (
 	DefaultOptNAPDir      = "/opt/app_protect"
 	DefaultNMSCompilerDir = "/opt/nms-nap-compiler"
 	compilerDirPrefix     = "app_protect-"
-
-	dirPerm = 0o755
+	dirPerm               = 0o750
 )
 
 var (

src/extensions/nginx-app-protect/nap/nap_metadata.go

@@ -10,6 +10,7 @@ package nap
 import (
 	"encoding/json"
 	"errors"
+	"fmt"
 	"os"
 	"path/filepath"
 
@@ -33,11 +34,11 @@ func UpdateMetadata(
 	data, err := os.ReadFile(appProtectWAFDetails.GetWafLocation())
 	if err != nil {
 		if !errors.Is(err, os.ErrNotExist) {
-			return err
+			return fmt.Errorf("failed to update metadata: %v", err)
 		}
 	} else {
 		if err := json.Unmarshal(data, &previousMeta); err != nil {
-			return err
+			return fmt.Errorf("failed to unmarshal current metadata: %v", err)
 		}
 		previousPrecompiledPublication = previousMeta.PrecompiledPublication
 	}
@@ -53,14 +54,16 @@ func UpdateMetadata(
 	policies, profiles := sdk.GetAppProtectPolicyAndSecurityLogFilesWithIgnoreDirectives(cfg, ignoreDirectives)
 
 	policyBundles := []*BundleMetadata{}
-	profileBundles := []*BundleMetadata{}
 
 	for _, policy := range policies {
 		bundle := &BundleMetadata{
 			Name: policy,
 		}
 		policyBundles = append(policyBundles, bundle)
 	}
+
+	profileBundles := []*BundleMetadata{}
+
 	for _, profile := range profiles {
 		bundle := &BundleMetadata{
 			Name: profile,
@@ -84,21 +87,27 @@ func UpdateMetadata(
 
 	m, err := json.Marshal(metadata)
 	if err != nil {
-		return err
+		return fmt.Errorf("failed to marshal metadata update: %v", err)
 	}
 
 	// Make dir if not exists
 	directory := filepath.Dir(appProtectWAFDetails.GetWafLocation())
 	_, err = os.Stat(directory)
 	if os.IsNotExist(err) {
-		err = os.MkdirAll(directory, 0o755)
+		err = os.MkdirAll(directory, 0o750)
 		if err != nil {
-			return err
+			return fmt.Errorf("failed to create directory for metadata update: %v", err)
 		}
 	}
 
 	log.Debugf("Writing NAP Metadata %s", m)
-	return os.WriteFile(appProtectWAFDetails.GetWafLocation(), m, 0o644)
+
+	err = os.WriteFile(appProtectWAFDetails.GetWafLocation(), m, 0o644)
+	if err != nil {
+		return fmt.Errorf("failed to write NAP Metadata update: %v", err)
+	}
+
+	return nil
 }
 
 // metadataAreEqual compares the metadata for equality

src/extensions/nginx-app-protect/nap/nap_metadata_test.go

@@ -14,6 +14,7 @@ import (
 
 	"github.com/nginx/agent/sdk/v2"
 	"github.com/nginx/agent/sdk/v2/proto"
+
 	"github.com/stretchr/testify/assert"
 )
 
@@ -170,9 +171,10 @@ func TestUpdateNapMetadata(t *testing.T) {
 				WafLocation:             metadataFile,
 				PrecompiledPublication:  tc.precompPub,
 			}
-			ignoreDirecitves := []string{}
 
-			err = UpdateMetadata(cfg, appProtectWAFDetails, ignoreDirecitves)
+			ignoreDirectives = []string{}
+
+			err = UpdateMetadata(cfg, appProtectWAFDetails, ignoreDirectives)
 			assert.NoError(t, err)
 
 			data, err := os.ReadFile(metadataFile)

src/extensions/nginx-app-protect/nap/nap_test.go

@@ -12,10 +12,10 @@ import (
 	"os"
 	"testing"
 
+	testutils "github.com/nginx/agent/v2/test/utils"
+
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
-
-	testutils "github.com/nginx/agent/v2/test/utils"
 )
 
 const (

src/extensions/php_fpm_metrics.go

@@ -13,11 +13,11 @@ import (
 	agent_config "github.com/nginx/agent/sdk/v2/agent/config"
 	"github.com/nginx/agent/v2/src/core"
 	"github.com/nginx/agent/v2/src/core/config"
+
 	log "github.com/sirupsen/logrus"
 )
 
 const (
-	// Version
 	phpFpmMetricsExtensionPluginVersion = "v0.1.0"
 )
 

src/extensions/php_fpm_metrics_test.go

@@ -13,6 +13,7 @@ import (
 	"github.com/nginx/agent/v2/src/core/config"
 	"github.com/nginx/agent/v2/src/extensions"
 	tutils "github.com/nginx/agent/v2/test/utils"
+
 	"github.com/stretchr/testify/assert"
 )
 

src/extensions/prometheus-metrics/prometheus_exporter.go

@@ -4,8 +4,8 @@ import (
 	"strings"
 
 	"github.com/nginx/agent/sdk/v2/proto"
-
 	"github.com/nginx/agent/v2/src/core/metrics"
+
 	"github.com/prometheus/client_golang/prometheus"
 )
 

src/extensions/prometheus-metrics/prometheus_exporter_test.go

@@ -3,9 +3,9 @@ package prometheus_metrics
 import (
 	"testing"
 
+	"github.com/nginx/agent/sdk/v2/proto"
 	"github.com/nginx/agent/v2/src/core/metrics"
 
-	"github.com/nginx/agent/sdk/v2/proto"
 	"github.com/prometheus/client_golang/prometheus"
 	"github.com/stretchr/testify/assert"
 )