From d636bfdaea31ea3dceb04d33fd11d81cbbf49dc9 Mon Sep 17 00:00:00 2001
From: "pulse-triage[bot]"
 <249995291+pulse-triage[bot]@users.noreply.github.com>
Date: Tue, 13 Oct 2026 13:22:11 +0100
Subject: [PATCH] Set exact initial modes in NAS executable controls

The chosen source proof runs with umask 077. Explicitly chmod the inert pre-update binaries so failure controls can require exact preservation of a 0755 executable rather than assuming WriteFile overrides the caller's mask. This changes only fixture setup; production permission, trust and recovery assertions are retained.

Change-source: pulse-maintainer
---
 internal/agentupdate/coverage_test.go    |  8 +++-----
 internal/agentupdate/update_http_test.go | 16 +++++++++++++---
 2 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/internal/agentupdate/coverage_test.go b/internal/agentupdate/coverage_test.go
index 0ec8da460c..1fb5b8aacc 100644
--- a/internal/agentupdate/coverage_test.go
+++ b/internal/agentupdate/coverage_test.go
@@ -1600,13 +1600,11 @@ func TestPersistentBinaryCopyFailuresRetainExecutable(t *testing.T) {
 			dir := t.TempDir()
 			execPath := filepath.Join(dir, "runtime")
 			persistPath := filepath.Join(dir, "pulse-agent")
-			if err := os.WriteFile(execPath, newBinary, 0755); err != nil {
-				t.Fatal(err)
-			}
+			writeNASUpdateExecutable(t, execPath, newBinary)
 			if phase == "same-file" {
 				persistPath = execPath
-			} else if err := os.WriteFile(persistPath, oldBinary, 0755); err != nil {
-				t.Fatal(err)
+			} else {
+				writeNASUpdateExecutable(t, persistPath, oldBinary)
 			}
 			if phase == "hardlink" {
 				if err := os.Link(persistPath, persistPath+".old-link"); err != nil {
diff --git a/internal/agentupdate/update_http_test.go b/internal/agentupdate/update_http_test.go
index edb9ff1f00..3eca63bee0 100644
--- a/internal/agentupdate/update_http_test.go
+++ b/internal/agentupdate/update_http_test.go
@@ -69,6 +69,18 @@ func runNASUpdateExecutable(t *testing.T, path, wantVersion string) {
 	}
 }
 
+func writeNASUpdateExecutable(t *testing.T, path string, data []byte) {
+	t.Helper()
+	if err := os.WriteFile(path, data, 0755); err != nil {
+		t.Fatal(err)
+	}
+	// The controls run under a restrictive umask. Set the old executable's
+	// exact starting mode rather than assuming WriteFile overrides that mask.
+	if err := os.Chmod(path, 0755); err != nil {
+		t.Fatal(err)
+	}
+}
+
 func TestNASAuthenticatedUpdateKeepsExecutableCopies(t *testing.T) {
 	if runtime.GOOS != "linux" {
 		t.Skip("QNAP/Unraid executable-layout controls require Linux")
@@ -94,9 +106,7 @@ func TestNASAuthenticatedUpdateKeepsExecutableCopies(t *testing.T) {
 				execPath = persistPath
 			}
 			for _, path := range []string{execPath, persistPath} {
-				if err := os.WriteFile(path, oldBinary, 0755); err != nil {
-					t.Fatal(err)
-				}
+				writeNASUpdateExecutable(t, path, oldBinary)
 			}
 			if layout == "qnap-directory-alias" {
 				alias := filepath.Join(dir, "state-alias")