[security] accessTokens.json is 0644

[ahmetb]

# stat ~/.azure/accessTokens.json
  File: ‘/root/.azure/accessTokens.json’
  Size: 5874        Blocks: 16         IO Block: 4096   regular file
Device: 2dh/45d Inode: 4429        Links: 1
Access: (0644/-rw-r--r--)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2016-08-01 18:30:06.312827283 +0000
Modify: 2016-08-01 18:29:52.128670025 +0000
Change: 2016-08-01 18:29:52.128670025 +0000
 Birth: -

Should be 0600. Please do not repeat the same mistakes azure-xplat-cli did.

[yugangw-msft]

yep, this will be prioritized and fixed in near future

[derekbekoe]

To add to this, I have seen the following error after running az login -u <USER> -p <PASS>.

[Errno 13] Permission denied: '/home/ubuntu/.azure/accessTokens.json'
Traceback (most recent call last):
  File "/usr/local/az/envs/default/local/lib/python2.7/site-packages/azure/cli/main.py", line 55, in main
    cmd_result = APPLICATION.execute(args)
  File "/usr/local/az/envs/default/local/lib/python2.7/site-packages/azure/cli/application.py", line 117, in execute
    result = expanded_arg.func(params)
  File "/usr/local/az/envs/default/local/lib/python2.7/site-packages/azure/cli/commands/__init__.py", line 212, in _execute_command
    result = operation(client, **kwargs) if client else operation(**kwargs)
  File "/usr/local/az/envs/default/local/lib/python2.7/site-packages/azure/cli/command_modules/profile/custom.py", line 68, in login
    tenant)
  File "/usr/local/az/envs/default/local/lib/python2.7/site-packages/azure/cli/_profile.py", line 109, in find_subscriptions_on_login
    self._creds_cache.persist_cached_creds()
  File "/usr/local/az/envs/default/local/lib/python2.7/site-packages/azure/cli/_profile.py", line 324, in persist_cached_creds
    with codecs_open(self._token_file, 'w', encoding='ascii') as cred_file:
  File "/usr/local/az/envs/default/lib/python2.7/codecs.py", line 878, in open
    file = __builtin__.open(filename, mode, buffering)
IOError: [Errno 13] Permission denied: '/home/ubuntu/.azure/accessTokens.json'

You can see that the file owner is root but the current user is 'ubuntu'. So 'ubuntu' doesn't have access to write to the file. It looks like the file owner should be 'ubuntu'.

$ id
uid=1000(ubuntu) gid=1000(ubuntu) 
$ ls -la /home/ubuntu/.azure/
total 24
drwxr-xr-x 2 root   root   4096 Aug  3 19:24 .
drwxr-xr-x 9 ubuntu ubuntu 4096 Jul 22 23:26 ..
-rw-r--r-- 1 root   root      2 Aug  3 19:25 accessTokens.json
-rw-r--r-- 1 root   root      5 May 23 23:40 az.json
-rw-r--r-- 1 root   root      5 May 23 23:40 az.sess
-rw-r--r-- 1 root   root    292 Aug  3 19:24 azureProfile.json

It makes sense that the file owner is 'root' as to install the CLI globally, sudo is required. But then ideally, the owner of the accessToken file should be 'ubuntu' (especially since the file is in the user directory).

[ahmetb]

Derek Bekoe (@derekbekoe) please open a separate issue, this looks unrelated to the chmod issue. It looks like when you install the CLI, it creates an empty accessTokens.json file (2 bytes?) and does this operation as root, hence the owner is root(?). In any case, I recommend moving this to another issue.

[derekbekoe]

Created a new issue at #613