set appropriate filemodes on unwrapped identity files

ziti/cmd/file_mode_unix.go

@@ -0,0 +1,27 @@
+//go:build !windows
+
+package cmd
+
+import (
+	"os"
+	"syscall"
+)
+
+func getFileMode(isPrivateKey bool) os.FileMode {
+	// Default modes before umask:
+	// - Private keys: 0600 (rw-------)
+	// - Public files: 0644 (rw-r--r--)
+	mode := os.FileMode(0644)
+	if isPrivateKey {
+		mode = os.FileMode(0600)
+	}
+
+	// Get current umask
+	oldMask := syscall.Umask(0)
+	syscall.Umask(oldMask) // Restore original umask
+
+	// Apply umask to our default mode
+	mode &= ^os.FileMode(oldMask)
+
+	return mode
+}

ziti/cmd/file_mode_windows.go

@@ -0,0 +1,15 @@
+//go:build windows
+
+package cmd
+
+import "os"
+
+func getFileMode(isPrivateKey bool) os.FileMode {
+	// Default modes for Windows:
+	// - Private keys: 0600 (rw-------)
+	// - Public files: 0644 (rw-r--r--)
+	if isPrivateKey {
+		return os.FileMode(0600)
+	}
+	return os.FileMode(0644)
+}

ziti/cmd/unwrap_identity.go

@@ -57,7 +57,7 @@ func NewUnwrapIdentityFileCommand(out io.Writer, errOut io.Writer) *cobra.Comman
 
 			if strings.HasPrefix(config.ID.Cert, "pem:") {
 				data := strings.TrimPrefix(config.ID.Cert, "pem:")
-				if err := os.WriteFile(outCertFile, []byte(data), 0); err != nil {
+				if err := os.WriteFile(outCertFile, []byte(data), getFileMode(false)); err != nil {
 					_, _ = fmt.Fprintf(errOut, "error writing certificate to file [%s]: %v\n", outCertFile, err)
 					return
 				}
@@ -67,22 +67,22 @@ func NewUnwrapIdentityFileCommand(out io.Writer, errOut io.Writer) *cobra.Comman
 
 			if strings.HasPrefix(config.ID.Key, "pem:") {
 				data := strings.TrimPrefix(config.ID.Key, "pem:")
-				if err := os.WriteFile(outKeyFile, []byte(data), 0); err != nil {
+				if err := os.WriteFile(outKeyFile, []byte(data), getFileMode(true)); err != nil {
 					_, _ = fmt.Fprintf(errOut, "error writing private key to file [%s]: %v\n", outKeyFile, err)
 					return
 				}
 			} else {
 				_, _ = fmt.Fprintf(errOut, "error writing private key to file [%s]: missing pem prefix, type is unsupported\n", outKeyFile)
 			}
 
-			if strings.HasPrefix(config.ID.Key, "pem:") {
+			if strings.HasPrefix(config.ID.CA, "pem:") {
 				data := strings.TrimPrefix(config.ID.CA, "pem:")
-				if err := os.WriteFile(outCaFile, []byte(data), 0); err != nil {
+				if err := os.WriteFile(outCaFile, []byte(data), getFileMode(false)); err != nil {
 					_, _ = fmt.Fprintf(errOut, "error writing CAs to file [%s]: %v\n", outCaFile, err)
 					return
 				}
 			} else {
-				_, _ = fmt.Fprintf(errOut, "error writing CAs to file [%s]: missing pem prefix, type is unsupported\n", outKeyFile)
+				_, _ = fmt.Fprintf(errOut, "error writing CAs to file [%s]: missing pem prefix, type is unsupported\n", outCaFile)
 			}
 		},
 	}