Standard grpc mTLS

src/cert/ssl_cert_provider.cpp

@@ -46,14 +46,14 @@
     {
         if (result == nullptr)
         {
             throw std::runtime_error(errorMessage);
         }
     }
     else
     {
         if (result <= 0)
         {
             throw std::runtime_error(fmt::format("{}, with the error code {}", errorMessage, result));
         }
     }
 }
@@ -110,7 +110,7 @@
         if (std::filesystem::exists(key_path_std))
         {
             // enable fopen in WritableFile with wb mode
             MP_PLATFORM.set_permissions(key_path_std,
                                         std::filesystem::perms::owner_read | std::filesystem::perms::owner_write);
         }
 
@@ -312,7 +312,14 @@
         const std::filesystem::path root_cert_path = MP_PLATFORM.get_root_cert_path();
         if (std::filesystem::exists(root_cert_path) && QFile::exists(priv_key_path) && QFile::exists(cert_path))
         {
+            // In cases where the root certificate exists within the data folder (such as in Snap or Windows
+            // environments), its file permissions is unintentionally overwritten due to recursive permission
+            // settings applied to the entire folder. To ensure the client process has access, we need to explicitly
+            // reset the file permissions on the root certificate.
+            MP_PLATFORM.set_permissions(root_cert_path,
+                                        std::filesystem::perms::owner_all | std::filesystem::perms::group_read |
+                                            std::filesystem::perms::others_read);
             return {mp::utils::contents_of(cert_path), mp::utils::contents_of(priv_key_path)};
         }
 
         const auto priv_root_key_path = cert_dir.filePath(prefix + "_root_key.pem");