[1.27] fix typo, use rancher/permissions

go.mod

@@ -135,6 +135,7 @@ require (
  github.com/prometheus/client_golang v1.19.1
  github.com/rancher/dynamiclistener v0.3.6
  github.com/rancher/lasso v0.0.0-20230830164424-d684fdeb6f29
+ github.com/rancher/permissions v0.0.0-20240523180510-4001d3d637f7
  github.com/rancher/remotedialer v0.3.0
  github.com/rancher/wharfie v0.5.3
  github.com/rancher/wrangler v1.1.1

go.sum

@@ -1246,6 +1246,8 @@ github.com/rancher/dynamiclistener v0.3.6 h1:iAFWeiFNra6tYlt4k+jINrK3hOxZ8mjW2S/
 github.com/rancher/dynamiclistener v0.3.6/go.mod h1:VqBaJNi+bZmre0+gi+2Jb6jbn7ovHzRueW+M7QhVKsk=
 github.com/rancher/lasso v0.0.0-20230830164424-d684fdeb6f29 h1:+kige/h8/LnzWgPjB5NUIHz/pWiW/lFpqcTUkN5uulY=
 github.com/rancher/lasso v0.0.0-20230830164424-d684fdeb6f29/go.mod h1:kgk9kJVMj9FIrrXU0iyM6u/9Je4bEjPImqswkTVaKsQ=
+github.com/rancher/permissions v0.0.0-20240523180510-4001d3d637f7 h1:0Kg2SGoMeU1ll4xPi4DE0+qNHLFO/U5MwtK0WrIdK+o=
+github.com/rancher/permissions v0.0.0-20240523180510-4001d3d637f7/go.mod h1:fsbs0YOsGn1ofPD5p+BuI4qDhbMbSJtTegKt6Ucna+c=
 github.com/rancher/remotedialer v0.3.0 h1:y1EO8JCsgZo0RcqTUp6U8FXcBAv27R+TLnWRcpvX1sM=
 github.com/rancher/remotedialer v0.3.0/go.mod h1:BwwztuvViX2JrLLUwDlsYt5DiyUwHLlzynRwkZLAY0Q=
 github.com/rancher/wharfie v0.5.3 h1:6hiO26H7YTgChbLAE6JppxFRjaH3tbKfMItv/LqV0Q0=

pkg/agent/config/config.go

@@ -205,7 +205,7 @@ func ensureNodePassword(nodePasswordFile string) (string, error) {
  return nodePassword, err
  }
 
- if err = configureACL(nodePassword); err != nil {
+ if err = configureACL(nodePasswordFile); err != nil {
  return nodePassword, err
  }
 

pkg/agent/config/config_windows.go

@@ -6,10 +6,12 @@ package config
 import (
  "path/filepath"
 
- "github.com/k3s-io/k3s/pkg/agent/util/acl"
  "github.com/k3s-io/k3s/pkg/cli/cmds"
  "github.com/k3s-io/k3s/pkg/daemons/config"
  "github.com/pkg/errors"
+ "github.com/rancher/permissions/pkg/access"
+ "github.com/rancher/permissions/pkg/acl"
+ "github.com/rancher/permissions/pkg/sid"
  "golang.org/x/sys/windows"
 )
 
@@ -33,8 +35,8 @@ func configureACL(file string) error {
  // as the owner and current user group as the allowed group
  // additionally, we define a DACL to permit access to the file to the local system and all administrators
  if err := acl.Apply(file, nil, nil, []windows.EXPLICIT_ACCESS{
- acl.GrantSid(windows.GENERIC_ALL, acl.LocalSystemSID()),
- acl.GrantSid(windows.GENERIC_ALL, acl.BuiltinAdministratorsSID()),
+ access.GrantSid(windows.GENERIC_ALL, sid.LocalSystem()),
+ access.GrantSid(windows.GENERIC_ALL, sid.BuiltinAdministrators()),
  }...); err != nil {
  return errors.Wrapf(err, "failed to configure Access Control List For %s", file)
  }