Merge ~r00ta/maas:lp-2026802 into maas:master

[Jacopo Rota]

Fix rack secret permissions

This MP aims to fix https://bugs.launchpad.net/maas/+bug/2026802 .

In particular, with 44ff8e0feca45b2c67f9e9fc9dd932c683011831 we refactored the way we store secrets on the filesystems and we started using the function `atomic_write` from `utils/fs.py`. But by default that function creates the file with `0o600` permissions, while for the secrets we need `0o640`.

[Adam Collard (adam-collard)]

review: Approve

[MAAS Lander (maas-lander)]

UNIT TESTS
-b lp-2026802 lp:~r00ta/maas/+git/maas into -b master lp:~maas-committers/maas

STATUS: SUCCESS
COMMIT: 06e64fcd915665ae9e3127787f5eee3b48d875ca

review: Approve

[MAAS Lander (maas-lander)]

LANDING
-b lp-2026802 lp:~r00ta/maas/+git/maas into -b master lp:~maas-committers/maas

STATUS: FAILED BUILD
LOG: http://maas-ci.internal:8080/job/maas-tester/2951/console

diff --git a/src/provisioningserver/utils/env.py b/src/provisioningserver/utils/env.py
index 4ea40f8..f0c32a0 100644
--- a/src/provisioningserver/utils/env.py
+++ b/src/provisioningserver/utils/env.py
@@ -80,7 +80,7 @@ class FileBackedValue:
             else:
                 # ensure the parent dirs exist
                 self.path.parent.mkdir(exist_ok=True)
-                atomic_write(value.encode("ascii"), self.path)
+                atomic_write(value.encode("ascii"), self.path, mode=0o640)
                 self._value = value
 
     def _normalise_value(self, value: Optional[str]) -> Optional[str]:
diff --git a/src/tests/provisioningserver/utils/test_env.py b/src/tests/provisioningserver/utils/test_env.py
index dba8b77..f123f4a 100644
--- a/src/tests/provisioningserver/utils/test_env.py
+++ b/src/tests/provisioningserver/utils/test_env.py
@@ -198,3 +198,8 @@ class TestFileBackedValue:
         file_value.path.write_text("new content")
         # the file is read again
         assert file_value.get() == "new content"
+
+    def test_set_default_permission(self, factory, file_value):
+        factory.make_name("contents")
+        file_value.set("content")
+        assert (file_value.path.stat().st_mode & 0o777) == 0o640