From 4cd38feae7756512a2eb76def2d13ad353773417 Mon Sep 17 00:00:00 2001 From: Zhengchao An Date: Wed, 26 Aug 2026 14:29:51 +0800 Subject: [PATCH] fix(tests): restrict Connect state tempdirs (#6642) --- rustfs/tests/connect_registration.rs | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/rustfs/tests/connect_registration.rs b/rustfs/tests/connect_registration.rs index b8a8161fa..54a99f149 100644 --- a/rustfs/tests/connect_registration.rs +++ b/rustfs/tests/connect_registration.rs @@ -427,10 +427,13 @@ fn secure_tempdir() -> tempfile::TempDir { .expect("test home directory must resolve without symlink components"); fs::set_permissions(&home, fs::Permissions::from_mode(0o700)) .expect("test home directory permissions must be restricted to the process owner"); - tempfile::Builder::new() + let temp = tempfile::Builder::new() .prefix(".connect-registration-") .tempdir_in(home) - .expect("temporary directory inside the protected home directory") + .expect("temporary directory inside the protected home directory"); + fs::set_permissions(temp.path(), fs::Permissions::from_mode(0o700)) + .expect("temporary state root permissions must be restricted to the process owner"); + temp } fn stage_next_identity(temp: &tempfile::TempDir) -> DeviceIdentity {