Set default config file permissions after renaming (#2184)

* Set default config file permissions after renaming

Add permission change for the updated config file

* Use os.open with restricted permissions from file creation

Replace open()+chmod approach with os.open() using O_CREAT|O_TRUNC
and mode 0o400 to ensure the temp config file is never temporarily
world-readable. Wraps fd with os.fdopen for safe writing.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Guard fd close if os.fdopen fails

os.fdopen takes ownership of the fd, so the with-statement handles
closing on normal/write-error paths. Add explicit os.close for the
rare case where os.fdopen itself raises before taking ownership.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: simathih

AzureMonitorAgent/agent.py

@@ -967,14 +967,20 @@ def enable():
         if os.path.isfile(config_file):
             new_config = "\n".join(["export {0}={1}".format(key, value) for key, value in default_configs.items()]) + "\n"
 
-            with open(temp_config_file, "w") as f:
+            tmp_fd = os.open(temp_config_file, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o400)
+            try:
+                f = os.fdopen(tmp_fd, "w")
+            except:
+                os.close(tmp_fd)
+                raise
+            with f:
                 f.write(new_config)
 
             if not os.path.isfile(temp_config_file):
                 log_and_exit("Enable", GenericErrorCode, "Error while updating environment variables in {0}".format(config_file))
 
             os.remove(config_file)
-            os.rename(temp_config_file, config_file)            
+            os.rename(temp_config_file, config_file)
         else:
             log_and_exit("Enable", GenericErrorCode, "Could not find the file {0}".format(config_file))
     except Exception as e: