Merge ~r00ta/maas:lp-2026802-3.4 into maas:3.4

[Jacopo Rota]

Backport of e0a86ecd5863a8f8aa6e8342bb0801ac248e0e86 - Fix secret permissions

Backport of https://code.launchpad.net/~r00ta/maas/+git/maas/+merge/446480

[Alberto Donato (ack)]

review: Approve

[MAAS Lander (maas-lander)]

LANDING
-b lp-2026802-3.4 lp:~r00ta/maas/+git/maas into -b 3.4 lp:~maas-committers/maas

STATUS: FAILED BUILD
LOG: http://maas-ci.internal:8080/job/maas-tester/2959/console

[MAAS Lander (maas-lander)]

UNIT TESTS
-b lp-2026802-3.4 lp:~r00ta/maas/+git/maas into -b 3.4 lp:~maas-committers/maas

STATUS: FAILED
LOG: http://maas-ci.internal:8080/job/maas-tester/2963/console
COMMIT: b6a9255e240186f700b6d3ca59f3665b12b0c710

review: Needs Fixing

[MAAS Lander (maas-lander)]

LANDING
-b lp-2026802-3.4 lp:~r00ta/maas/+git/maas into -b 3.4 lp:~maas-committers/maas

STATUS: FAILED BUILD
LOG: http://maas-ci.internal:8080/job/maas-tester/2965/console

diff --git a/src/provisioningserver/utils/env.py b/src/provisioningserver/utils/env.py
index 4ea40f8..f0c32a0 100644
--- a/src/provisioningserver/utils/env.py
+++ b/src/provisioningserver/utils/env.py
@@ -80,7 +80,7 @@ class FileBackedValue:
             else:
                 # ensure the parent dirs exist
                 self.path.parent.mkdir(exist_ok=True)
-                atomic_write(value.encode("ascii"), self.path)
+                atomic_write(value.encode("ascii"), self.path, mode=0o640)
                 self._value = value
 
     def _normalise_value(self, value: Optional[str]) -> Optional[str]:
diff --git a/src/tests/provisioningserver/utils/test_env.py b/src/tests/provisioningserver/utils/test_env.py
index dba8b77..f123f4a 100644
--- a/src/tests/provisioningserver/utils/test_env.py
+++ b/src/tests/provisioningserver/utils/test_env.py
@@ -198,3 +198,8 @@ class TestFileBackedValue:
         file_value.path.write_text("new content")
         # the file is read again
         assert file_value.get() == "new content"
+
+    def test_set_default_permission(self, factory, file_value):
+        factory.make_name("contents")
+        file_value.set("content")
+        assert (file_value.path.stat().st_mode & 0o777) == 0o640