Securely handle /etc/snap.assertions

Signed-off-by: Simon Deziel <[email protected]>
sdg0919 · Sep 8, 2021 · 39dfa4e · 39dfa4e
1 parent 37b938f
commit 39dfa4e
Showing 1 changed file with 2 additions and 4 deletions.
diff --git a/cloudconfig/cloudinit/cloudinit_ubuntu.go b/cloudconfig/cloudinit/cloudinit_ubuntu.go
@@ -344,10 +344,8 @@ func (cfg *ubuntuCloudConfig) updateProxySettings(proxyCfg PackageManagerProxyCo
 }
 
 func (cfg *ubuntuCloudConfig) genSnapStoreProxyCmds(assertions, storeID string) {
-	cfg.AddRunCmd(fmt.Sprintf(
-		`printf '%%s\n' %s > %s`,
-		utils.ShQuote(assertions),
-		"/etc/snap.assertions"))
+	cfg.AddRunTextFile("/etc/snap.assertions", assertions, 0600)
 	cfg.AddRunCmd("snap ack /etc/snap.assertions")
+	cfg.AddRunCmd("rm /etc/snap.assertions")
 	cfg.AddRunCmd("snap set core proxy.store=" + storeID)
 }