Set permissions of the restore --to dir more securely

1 files changed, 8 insertions, 0 deletions

diff --git a/obnamlib/plugins/restore_plugin.py b/obnamlib/plugins/restore_plugin.py
index 22162685..0eb580ab 100644
--- a/obnamlib/plugins/restore_plugin.py
+++ b/obnamlib/plugins/restore_plugin.py
@@ -134,6 +134,14 @@ class RestorePlugin(obnamlib.ObnamPlugin):
         if self.write_ok:
             self.fs = self.app.fsf.new(self.app.settings['to'], create=True)
             self.fs.connect()
+
+            # Set permissions on this directory to be quite
+            # restrictive, so that nobody else can access the files
+            # while the restore is happening. The directory named by
+            # --to is set to have the permissions of the filesystem
+            # root directory (/) in the backup as the final step, so
+            # the permissions will eventually be correct.
+            self.fs.chmod_not_symlink('.', 0700)
         else:
             self.fs = None # this will trigger error if we try to really write