From f3687104dd1c25330c09ccd57f22ec9bd387296c Mon Sep 17 00:00:00 2001
From: Ainar Garipov <a.garipov@adguard.com>
Date: Fri, 28 May 2021 18:45:11 +0300
Subject: [PATCH] Pull request: all: rework file perms

Updates #3198.

Squashed commit of the following:

commit 3de1ecf4535220cdd769100ef0ea96c166419d12
Author: Ainar Garipov <A.Garipov@AdGuard.COM>
Date:   Fri May 28 18:39:52 2021 +0300

    all: imp chlog

commit f1a46efed917c9b70f047505449a816284d7c71e
Author: Ainar Garipov <A.Garipov@AdGuard.COM>
Date:   Fri May 28 18:13:55 2021 +0300

    all: rework file perms
---
 CHANGELOG.md                | 5 +++++
 internal/home/filter.go     | 9 +++++++++
 internal/updater/updater.go | 4 ++--
 3 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a8c5b424..17e31a65 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -21,6 +21,10 @@ and this project adheres to
 - New flag `--local-frontend` to serve dinamically changeable frontend files
   from disk as opposed to the ones that were compiled into the binary.
 
+### Changed
+
+- Permissions on filter files are now `0o644` instead of `0o600` ([#3198]).
+
 ### Deprecated
 
 <!--
@@ -43,6 +47,7 @@ released by then.
 [#3184]: https://github.com/AdguardTeam/AdGuardHome/issues/3184
 [#3185]: https://github.com/AdguardTeam/AdGuardHome/issues/3185
 [#3186]: https://github.com/AdguardTeam/AdGuardHome/issues/3186
+[#3198]: https://github.com/AdguardTeam/AdGuardHome/issues/3198
 
 
 
diff --git a/internal/home/filter.go b/internal/home/filter.go
index de2ad2ef..91cedd7e 100644
--- a/internal/home/filter.go
+++ b/internal/home/filter.go
@@ -559,6 +559,15 @@ func (f *Filtering) updateIntl(filter *filter) (updated bool, err error) {
 		}
 	}()
 
+	// Change the default 0o600 permission to something more acceptable by
+	// end users.
+	//
+	// See https://github.com/AdguardTeam/AdGuardHome/issues/3198.
+	err = tmpFile.Chmod(0o644)
+	if err != nil {
+		return updated, fmt.Errorf("changing file mode: %w", err)
+	}
+
 	var reader io.Reader
 	if filepath.IsAbs(filter.URL) {
 		var f io.ReadCloser
diff --git a/internal/updater/updater.go b/internal/updater/updater.go
index 47ae1397..0cc49f9e 100644
--- a/internal/updater/updater.go
+++ b/internal/updater/updater.go
@@ -332,7 +332,7 @@ func tarGzFileUnpackOne(outDir string, tr *tar.Reader, hdr *tar.Header) (name st
 			return "", nil
 		}
 
-		err = os.Mkdir(outputName, os.FileMode(hdr.Mode&0o777))
+		err = os.Mkdir(outputName, os.FileMode(hdr.Mode&0o755))
 		if err != nil && !errors.Is(err, os.ErrExist) {
 			return "", fmt.Errorf("os.Mkdir(%q): %w", outputName, err)
 		}
@@ -352,7 +352,7 @@ func tarGzFileUnpackOne(outDir string, tr *tar.Reader, hdr *tar.Header) (name st
 	wc, err = os.OpenFile(
 		outputName,
 		os.O_WRONLY|os.O_CREATE|os.O_TRUNC,
-		os.FileMode(hdr.Mode&0o777),
+		os.FileMode(hdr.Mode&0o755),
 	)
 	if err != nil {
 		return "", fmt.Errorf("os.OpenFile(%s): %w", outputName, err)