Explicitly secure rw perms for recovery.conf at creation time
We don't want anybody except patroni/postgres user reading this file, it contains replication user and password.
@@ -5,6 +5,7 @@ import re
import shlex
import shutil
import socket
+import stat
import subprocess
import tempfile
import time
@@ -1186,6 +1187,7 @@ class Postgresql(object):
def write_recovery_conf(self, recovery_params):
with open(self._recovery_conf, 'w') as f:
+ os.chmod(self._recovery_conf, stat.S_IWRITE | stat.S_IREAD)
for name, value in recovery_params.items():
f.write("{0} = '{1}'\n".format(name, value))
