install: create autoinstall-user-data 0400

[dbungert]

CVE-2023-5182

As autoinstall-user-data contains a password hash hash for a user with sudo access, create the autoinstall-user-data as 0400 root:root.

The old permissions are 0640 root:adm, and the adm group does not by default have sudo access, so cracking that hash could lead to privilege escallation for someone in the adm group.

Thanks to Patric Åhlin and Johan Hortling for identifying and reporting the issue.

[dbungert]

Target system logs now look like:

ubuntu@ubuntu:/var/log/installer$ ls -al
total 896
drwxr-x--- 4 root adm    4096 Oct  5 00:07 .
drwxr-xr-x 8 root root   4096 Oct  5 00:07 ..
-r-------- 1 root root   3038 Oct  5 00:07 autoinstall-user-data
drwxr-xr-x 2 root root   4096 Oct  5 00:05 block
-rw-r--r-- 1 root root     75 Oct  5 00:06 casper-md5check.json
-rw-r----- 1 root adm    5406 Oct  5 00:05 cloud-init-output.log
-rw-r----- 1 root adm   62300 Oct  5 00:05 cloud-init.log
drwxr-xr-x 2 root root   4096 Oct  5 00:06 curtin-install
-rw-r--r-- 1 root root 115677 Oct  5 00:07 curtin-install.log
-rw-r--r-- 1 root root    155 Oct  5 00:06 device-map.json
-rw-r----- 1 root adm  545519 Oct  5 00:07 installer-journal.txt
-rw-r--r-- 1 root root     62 Oct  5 00:06 media-info
lrwxrwxrwx 1 root root     31 Oct  5 00:05 subiquity-client-debug.log -> subiquity-client-debug.log.1620
-rw-r----- 1 root adm    2363 Oct  5 00:05 subiquity-client-debug.log.1620
lrwxrwxrwx 1 root root     30 Oct  5 00:05 subiquity-client-info.log -> subiquity-client-info.log.1620
-rw-r----- 1 root adm     207 Oct  5 00:05 subiquity-client-info.log.1620
-rw-r----- 1 root adm     472 Oct  5 00:05 subiquity-curtin-apt.conf
lrwxrwxrwx 1 root root     31 Oct  5 00:05 subiquity-server-debug.log -> subiquity-server-debug.log.1636
-rw-r----- 1 root adm  118860 Oct  5 00:07 subiquity-server-debug.log.1636
lrwxrwxrwx 1 root root     30 Oct  5 00:05 subiquity-server-info.log -> subiquity-server-info.log.1636
-rw-r----- 1 root adm    4520 Oct  5 00:07 subiquity-server-info.log.1636