fix: open log file with mode 0600 and remove permission widening fallback

The agent runs as root, so if it cannot open its own log file, chmod/chown
workarounds won't help — just fail. Removed the fallback that ran chmod 666
which made the log world-writable. Now opens with 0600 and returns the error
directly on failure.

Author: bcho

components/arc/v20260301/arc_registration.go

@@ -169,8 +169,6 @@ func (a *installArcAction) addAuthenticationArgs(ctx context.Context, args *[]st
 	// The token is short-lived (~60 minutes) which limits the exposure window, but it is
 	// still observable during the registration process. azcmagent does not currently support
 	// reading the token from stdin or an environment variable.
-	// Consider switching to --service-principal-cert or --use-azcli when feasible.
-	// See: https://learn.microsoft.com/en-us/azure/azure-arc/servers/azcmagent-connect
 	*args = append(*args, "--access-token", accessToken)
 
 	a.logger.Debug("Authentication arguments added to Arc agent command")

pkg/logger/logger.go

@@ -158,20 +158,9 @@ func setupLogFileWriter(logDir string) (io.Writer, error) {
 		return nil, fmt.Errorf("failed to create log file '%s': %w", logFilePath, err)
 	}
 
-	// Try to open log file for writing, handle permission issues
-	file, err := os.OpenFile(logFilePath, os.O_WRONLY|os.O_APPEND, 0666)
+	// Try to open log file for writing
+	file, err := os.OpenFile(logFilePath, os.O_WRONLY|os.O_APPEND, 0600) //#nosec G304 - logFilePath is from trusted agent config
 	if err != nil {
-		// If it's a permission error and we're not running as root, try to fix permissions
-		if os.IsPermission(err) {
-			// Try to fix permissions using system command
-			if fixErr := utils.RunSystemCommand("chmod", "666", logFilePath); fixErr == nil {
-				// Retry opening the file after fixing permissions
-				file, err = os.OpenFile(logFilePath, os.O_WRONLY|os.O_APPEND, 0666)
-				if err == nil {
-					return file, nil
-				}
-			}
-		}
 		return nil, fmt.Errorf("failed to open log file '%s': %w", logFilePath, err)
 	}