Use restrictive permissions (0700) for cache directories (#714)

Signed-off-by: Radoslav Dimitrov <radoslav@stacklok.com>

Author: rdimitrov

metadata/config/config.go

@@ -84,7 +84,12 @@ func (cfg *UpdaterConfig) EnsurePathsExist() error {
 	}
 
 	for _, path := range []string{cfg.LocalMetadataDir, cfg.LocalTargetsDir} {
-		if err := os.MkdirAll(path, os.ModePerm); err != nil {
+		// Use 0700 for cache directories: only the owner can read, write, and
+		// access the directory. This prevents other users on shared systems from
+		// reading or writing to the TUF cache, which could be a security risk.
+		// If different permissions are needed, pre-create the directories with
+		// the desired permissions before calling this function.
+		if err := os.MkdirAll(path, 0700); err != nil {
 			return err
 		}
 	}

metadata/multirepo/multirepo.go

@@ -351,7 +351,12 @@ func (cfg *MultiRepoConfig) EnsurePathsExist() error {
 		return nil
 	}
 	for _, path := range []string{cfg.LocalMetadataDir, cfg.LocalTargetsDir} {
-		err := os.MkdirAll(path, os.ModePerm)
+		// Use 0700 for cache directories: only the owner can read, write, and
+		// access the directory. This prevents other users on shared systems from
+		// reading or writing to the TUF cache, which could be a security risk.
+		// If different permissions are needed, pre-create the directories with
+		// the desired permissions before calling this function.
+		err := os.MkdirAll(path, 0700)
 		if err != nil {
 			return err
 		}