From fece4cf9ac63e82ec4ea6054d69067c7d8ff5d3b Mon Sep 17 00:00:00 2001
From: akshya96 <87045294+akshya96@users.noreply.github.com>
Date: Fri, 3 Jun 2022 09:17:41 -0700
Subject: [PATCH] File Audit Mode 0000 bug  (#15759)

* adding file mode changes

* add changelog

* adding error

* adding fmt changes
---
 builtin/audit/file/backend.go      | 14 ++++++++++-
 builtin/audit/file/backend_test.go | 40 ++++++++++++++++++++++++++++++
 changelog/15759.txt                |  3 +++
 3 files changed, 56 insertions(+), 1 deletion(-)
 create mode 100644 changelog/15759.txt

diff --git a/builtin/audit/file/backend.go b/builtin/audit/file/backend.go
index 67163039b..9e7d7c36c 100644
--- a/builtin/audit/file/backend.go
+++ b/builtin/audit/file/backend.go
@@ -78,9 +78,21 @@ func Factory(ctx context.Context, conf *audit.BackendConfig) (audit.Backend, err
 		if err != nil {
 			return nil, err
 		}
-		if m != 0 {
+		switch m {
+		case 0:
+			// if mode is 0000, then do not modify file mode
+			if path != "stdout" && path != "discard" {
+				fileInfo, err := os.Stat(path)
+				if err != nil {
+					return nil, err
+				}
+				mode = fileInfo.Mode()
+			}
+		default:
 			mode = os.FileMode(m)
+
 		}
+
 	}
 
 	b := &Backend{
diff --git a/builtin/audit/file/backend_test.go b/builtin/audit/file/backend_test.go
index 702918d57..817518c50 100644
--- a/builtin/audit/file/backend_test.go
+++ b/builtin/audit/file/backend_test.go
@@ -93,6 +93,46 @@ func TestAuditFile_fileModeExisting(t *testing.T) {
 	}
 }
 
+func TestAuditFile_fileMode0000(t *testing.T) {
+	f, err := ioutil.TempFile("", "test")
+	if err != nil {
+		t.Fatalf("Failure to create test file. The error is %v", err)
+	}
+	defer os.Remove(f.Name())
+
+	err = os.Chmod(f.Name(), 0o777)
+	if err != nil {
+		t.Fatalf("Failure to chmod temp file for testing. The error is %v", err)
+	}
+
+	err = f.Close()
+	if err != nil {
+		t.Fatalf("Failure to close temp file for test. The error is %v", err)
+	}
+
+	config := map[string]string{
+		"path": f.Name(),
+		"mode": "0000",
+	}
+
+	_, err = Factory(context.Background(), &audit.BackendConfig{
+		Config:     config,
+		SaltConfig: &salt.Config{},
+		SaltView:   &logical.InmemStorage{},
+	})
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	info, err := os.Stat(f.Name())
+	if err != nil {
+		t.Fatalf("cannot retrieve file mode from `Stat`. The error is %v", err)
+	}
+	if info.Mode() != os.FileMode(0o777) {
+		t.Fatalf("File mode does not match.")
+	}
+}
+
 func BenchmarkAuditFile_request(b *testing.B) {
 	config := map[string]string{
 		"path": "/dev/null",
diff --git a/changelog/15759.txt b/changelog/15759.txt
new file mode 100644
index 000000000..068700008
--- /dev/null
+++ b/changelog/15759.txt
@@ -0,0 +1,3 @@
+```release-note:bug
+core: Prevent changing file permissions of audit logs when mode 0000 is used.
+```
\ No newline at end of file