Ensure Container Network Interface File Permissions Are Restrictive

#!/usr/bin/env bash
#
# Purpose: Ensure Container Network Interface files have permissions 644 or more restrictive.
# Scope:   Run on every control plane node.
# Impact:  None on running processes; only file mode changes under CNI dirs.

set -euo pipefail

# Directories to check/fix
CNI_CONF_DIRS=()
CNI_NET_DIRS=("/var/lib/cni/networks")

echo "=== Detecting CNI configuration directories from kubelet arguments (if any) ==="
if pgrep -x kubelet >/dev/null 2>&1; then
  # Extract any --cni-conf-dir values from kubelet command line
  while read -r dir; do
    [ -n "$dir" ] && CNI_CONF_DIRS+=("$dir")
  done < <(ps -ef | grep kubelet | grep -- '--cni-conf-dir' | \
           sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | sort -u)
else
  echo "kubelet process not found; skipping kubelet-based CNI config detection."
fi

# De-duplicate all directories
uniq_dirs() {
  awk '!x[$0]++'
}

ALL_DIRS=()
for d in "${CNI_CONF_DIRS[@]}" "${CNI_NET_DIRS[@]}"; do
  [ -n "$d" ] && ALL_DIRS+=("$d")
done
# Print unique, existing directories
UNIQ_EXISTING_DIRS=()
printf '%s\n' "${ALL_DIRS[@]}" 2>/dev/null | uniq_dirs | while read -r d; do
  if [ -d "$d" ]; then
    UNIQ_EXISTING_DIRS+=("$d")
  else
    echo "Note: directory '$d' does not exist; skipping."
  fi
done

# Because arrays aren’t preserved across the while subshell, rebuild from stdout
mapfile -t TARGET_DIRS < <(printf '%s\n' "${ALL_DIRS[@]}" 2>/dev/null | uniq_dirs | while read -r d; do [ -d "$d" ] && echo "$d"; done)

echo "=== Directories to process ==="
if [ "${#TARGET_DIRS[@]}" -eq 0 ]; then
  echo "No existing CNI directories found; nothing to change."
  exit 0
fi
printf '  %s\n' "${TARGET_DIRS[@]}"

echo "=== Fixing permissions to 0644 where more permissive ==="
for dir in "${TARGET_DIRS[@]}"; do
  echo "Processing: $dir"
  # Find files with permissions more permissive than 644 (i.e., world or group write/execute)
  # and set them to 644. This is idempotent: files already at 644 or stricter remain unchanged.
  find "$dir" -type f 2>/dev/null | while read -r f; do
    # Get current numeric permissions
    perm=$(stat -c '%a' "$f" 2>/dev/null || echo "")
    [ -z "$perm" ] && continue

    # Normalize to three digits if shorter
    perm=$(printf '%03d' "$perm")

    # Extract owner/group/other bits
    o=${perm:0:1}
    g=${perm:1:1}
    w=${perm:2:1}

    # Determine if more permissive than 644 (i.e. any write/exec beyond 644)
    # 644 = owner:6 (rw-), group:4 (r--), other:4 (r--)
    change=false
    # If owner has exec (1) or setuid bits we leave; we only tighten group/other writes/exec.
    # If group >4 or other >4 then it's more permissive.
    if [ "$g" -gt 4 ] || [ "$w" -gt 4 ]; then
      change=true
    fi

    if $change; then
      chmod 644 "$f"
    fi
  done
done

echo "=== Verification: listing permissions for CNI files ==="
echo "--- From kubelet --cni-conf-dir (if present) ---"
ps -ef | grep kubelet | grep -- '--cni-conf-dir' | \
  sed 's%.*cni-conf-dir[= ]\([^ ]*\).*%\1%' | \
  xargs -I{} find {} -mindepth 1 -type f 2>/dev/null | \
  xargs --no-run-if-empty stat -c '%n permissions=%a' || true

echo "--- From /var/lib/cni/networks ---"
find /var/lib/cni/networks -type f 2>/dev/null | \
  xargs --no-run-if-empty stat -c '%n permissions=%a' || true

echo "=== Completed. Re-run this script at any time; it is idempotent. ==="