Nomad use of world-writable permissions in alloc directory should be documented or adjusted by task driver

Background

As brought up in https://github.com/hashicorp/nomad/issues/12310, Nomad utilizes world-writable permissions (a.k.a. 777) within the alloc directory. World-writable files are an audit finding under NIST CCE-80131-6 and CIS 6.1.10:

Data in world-writable files can be modified by any user on the system. In almost all circumstances, files can be
configured using a combination of user and group permissions to support whatever legitimate access is needed without the risk caused by world-writable files.

It is generally a good idea to remove global (other) write access to a file when it is discovered. However, check with documentation for specific applications before making changes. Also, monitor for recurring world-writable files, as these may be symptoms of a misconfigured application or user account. Finally, this applies to real files and not virtual files that are a part of pseudo file systems such as sysfs or procfs.

In https://github.com/hashicorp/nomad/issues/12310, @DerekStrickland explains that restrictive permissions on the parent data and/or alloc directory protect the child world-writable files and folders. Also inferred is, the world-writable permissions are necessary for certain task drivers (i.e. exec) to function. However, I have only ever seen this mentioned in https://github.com/hashicorp/nomad/issues/12310 and not explained anywhere in Nomad documentation.

Proposal - Option 1

Please add to the Nomad Filesystem and Threat Model documentation pages with details as to the use of world-writable permissions within the alloc directory, an explanation why, and how restrictive parent directory permissions mitigate the world-writable permissions within the alloc directory. This information is important for Nomad cluster administrators. Additionally, it serves as a reference when addressing the audit findings detailed above.

Proposal - Option 2

Change the behavior of Nomad to set permissions in the most restrictive manner supported by the task driver used for the given allocation. There is no need for raw_exec allocations to be world-writable. Raw_exec could use permissions of 700. I would assume exec would continue to require 777. I believe the documentation in Option 1 would still be necessary, but this change would allow Nomad clusters to operate is the most secure manner supported by their workload.

Use-cases

These proposed changes apply to all Nomad use cases, but is especially important for environments following security frameworks such as National Institute of Standards and Technology (NIST) 800-53 or the Center for Internet Security (CIS).

Attempted Solutions

Setting the permissions manually does not fix or address the issue as allocation files and folders and dynamically created by Nomad.

Start with the Nomad Filesystem and Threat Model documentation pages, then review issue 12310 for the existing explanation of alloc-directory permissions and task-driver requirements. Done means documenting why world-writable permissions are used, how restrictive parent permissions mitigate them, and whether driver-specific adjustment remains in scope.