Describe the bug

The code used to create directories with secure permissions contains a race condition that results in a lingering security issue.

Currently the code does the following:

1. Create directory.
2. Set restrictive permissions on the new directory.

Using inotify on Linux or FileSystemWatcher on Windows, an attacker could take advantage of the delay between when the directory is created and when it is locked down to circumvent the encryption use to secure sensitive information stored in MongoDB

The race condition looks like:

1. Create directory.
2. Attacker creates a mongo_key.bin in the new data_dir.
3. Set restrictive permissions on the new directory.

Since they created it, the attacker has the key that will be used to encrypt credentials and can potentially read all encrypted information that monkey stores in MongoDB.

To Resolve

On Linux, we can pass mode=0o700 to os.mkdir() and os.makedirs() in order to avoid this race condition.

On windows, we can use CreateDirectoryA instead of os.mkdir().

Tasks:

• Fix linux (0d) - @VakarisZ
• Fix windows (0d) - @shreyamalviya