Windows refusing to load key from delegation.key: private key file delegation.key must not be readable or writable by others

[HubDevUser]

Description

Can not load delegation key

Steps to reproduce the issue:
1.openssl genrsa -out delegation.key 2048
2.openssl req -new -sha256 -key delegation.key -out delegation.csr
3.openssl x509 -req -sha256 -days 365 -in delegation.csr -signkey delegation.key -out delegation.crt
4. C:\test> docker trust key load delegation.key --name tester
Loading key from "delegation.key"...
refusing to load key from delegation.key: private key file delegation.key must not be readable or writable by others

Describe the results you received:
refusing to load key from delegation.key: private key file delegation.key must not be readable or writable by others

Describe the results you expected:
key to be added

Additional information you deem important (e.g. issue happens only occasionally):

Output of docker version:

docker version
Client: Docker Engine - Community
 Version:           18.09.2
 API version:       1.39
 Go version:        go1.10.8
 Git commit:        6247962
 Built:             Sun Feb 10 04:12:31 2019
 OS/Arch:           windows/amd64
 Experimental:      false

Server: Docker Engine - Community
 Engine:
  Version:          18.09.2
  API version:      1.39 (minimum version 1.24)
  Go version:       go1.10.6
  Git commit:       6247962
  Built:            Sun Feb 10 04:28:48 2019
  OS/Arch:          windows/amd64
  Experimental:     true

Output of docker info:

docker info
Containers: 0
 Running: 0
 Paused: 0
 Stopped: 0
Images: 0
Server Version: 18.09.2
Storage Driver: windowsfilter
 Windows:
Logging Driver: json-file
Plugins:
 Volume: local
 Network: ics l2bridge l2tunnel nat null overlay transparent
 Log: awslogs etwlogs fluentd gelf json-file local logentries splunk syslog
Swarm: inactive
Default Isolation: process
Kernel Version: 10.0 14393 (14393.2791.amd64fre.rs1_release.190205-1511)
Operating System: Windows Server 2016 Datacenter Version 1607 (OS Build 14393.2791)
OSType: windows
Architecture: x86_64
CPUs: 8
Total Memory: 15.92GiB
Name: subzero
ID: IM7O:6MJT:GKDZ:6UHH:URZG:YE24:6VUX:4BPT:U2VM:WGWM:IS23:6WMA
Docker Root Dir: C:\ProgramData\Docker
Debug Mode (client): false
Debug Mode (server): true
 File Descriptors: -1
 Goroutines: 30
 System Time: 2019-02-21T14:40:03.2108863-05:00
 EventsListeners: 2
Registry: https://index.docker.io/v1/
Labels:
Experimental: true
Insecure Registries:
 127.0.0.0/8
Live Restore Enabled: false
Product License: Community Engine

Additional environment details (AWS, VirtualBox, physical, etc.):

moby/moby#38771
chmod 600 fixes the issue in Linux but icacls and changing acls does not help on Windows

[HubDevUser]

I think its a go issue with Windows, i was able to repro. no matter what the acls are go returns the same no matter what
`
package main
import (
"fmt"
"os"
)

func main() {
var fileInfo os.FileInfo
var err error
fileInfo, err = os.Stat("C:\\test.key")
fmt.Println(fileInfo.Mode())
fmt.Println(err)
}
`
always prints
-rw-rw-rw-

even after acls changes

so &ing with a nonOwnerReadWriteMask will be non zero on windows
https://github.com/docker/cli/blob/master/cli/command/trust/key_load.go#L77
https://github.com/docker/cli/blob/master/cli/command/trust/key_load.go#L22

we can bypass that checking if the if the platform is windows

[jpertejo]

Same problem. Is there any solution planned?

[northtyphoon]

hit the same issue

[thaJeztah]

Yes, looks like Go on Windows just does not take actual permissions into account, so it'll be 0444, 0666 or 0777; https://github.com/golang/go/blob/go1.12.6/src/os/types_windows.go#L112-L134

func (fs *fileStat) Mode() (m FileMode) {
	if fs == &devNullStat {
		return ModeDevice | ModeCharDevice | 0666
	}
	if fs.FileAttributes&syscall.FILE_ATTRIBUTE_READONLY != 0 {
		m |= 0444
	} else {
		m |= 0666
	}
	if fs.isSymlink() {
		return m | ModeSymlink
	}
	if fs.FileAttributes&syscall.FILE_ATTRIBUTE_DIRECTORY != 0 {
		m |= ModeDir | 0111
	}
	switch fs.filetype {
	case syscall.FILE_TYPE_PIPE:
		m |= ModeNamedPipe
	case syscall.FILE_TYPE_CHAR:
		m |= ModeDevice | ModeCharDevice
	}
	return m
}

I'll open a PR to skip that check on Windows