Enabling audit logs with mode="0000" changes file permissions

[nomeelnoj]

Per the vault audit device docs: https://www.vaultproject.io/docs/audit/file#mode

Setting mode="0000" will prevent vault from modifying the file mode. The expectation is that if a file is already being logged to and read from by something like cwagent or splunk, vault will not rewrite the file mode. However, setting mode="0000" does not yield the intended result, and vault changes the file mode to the default of 0600.

To Reproduce
Steps to reproduce the behavior:

1. Run touch /opt/vault/vault_audit.log
2. Run chmod 0644 /opt/vault/vault_audit.log
3. Run vault audit enable file file_path="/opt/vault/vault_audit.log" mode="0000" or run the terraform config snippet below
4. Verify file permissions ls -asl /opt/vault/vault_audit.log and see that they have been reverted to the default of 0600

resource "vault_audit" "default" {
  type = "file"

  options = {
    file_path = "/opt/vault/vault_audit.log"
    mode      = "0000"
  }
}

Expected behavior
Vault will not touch the file and leave the permissions as they were: -rw-r--r--, or 0644.

Environment:

• Vault Server Version (retrieve with vault status): 1.8.6+ent
• Vault CLI Version (retrieve with vault version): 1.8.6+ent
• Server Operating System/Architecture: ubuntu 20.04

Vault server configuration file(s):

disable_performance_standby = true
ui = true
disable_mlock = true
storage "raft" {
  path    = "/opt/vault/data"
  node_id = "${instance_id}"
  retry_join {
    auto_join = "provider=aws region=us-east-1 tag_key=VaultName tag_value=testing"
    auto_join_scheme = "https"
    leader_tls_servername = "vault.server.com"
    leader_ca_cert_file = "/opt/vault/tls/vault-ca.pem"
    leader_client_cert_file = "/opt/vault/tls/vault-cert.pem"
    leader_client_key_file = "/opt/vault/tls/vault-key.pem"
  }
}

cluster_addr = "https://${ip_addr}:8201"
api_addr = "https://vault.server.com"

listener "tcp" {
  address            = "0.0.0.0:8200"
  tls_disable        = false
  tls_cert_file      = "/opt/vault/tls/vault-cert.pem"
  tls_key_file       = "/opt/vault/tls/vault-key.pem"
  tls_client_ca_file = "/opt/vault/tls/vault-ca.pem"
}
seal "awskms" {
  region     = "us-east-1"
  kms_key_id = "<arn to kms key>"
}
telemetry {
  prometheus_retention_time = "60s"
  disable_hostname = true
}

Note that when you set the value to something non-zero, like 0644, it does work as expected. However, setting it to 0000 per the docs does not work as intended.