Merge branch 'centralise_dir_perms' into 'master'

Centralise directory permissions within the gitaly project

See merge request https://gitlab.com/gitlab-org/gitaly/-/merge_requests/5334

Merged-by: James Fargher <proglottis@gmail.com>
Approved-by: Patrick Steinhardt <psteinhardt@gitlab.com>
Approved-by: Pavlo Strokov <pstrokov@gitlab.com>
Reviewed-by: Patrick Steinhardt <psteinhardt@gitlab.com>
Co-authored-by: James Fargher <jfargher@gitlab.com>

19 files changed, 45 insertions, 26 deletions

diff --git a/internal/gitaly/service/repository/apply_gitattributes.go b/internal/gitaly/service/repository/apply_gitattributes.go
index 973d59581..6b10b13aa 100644
--- a/internal/gitaly/service/repository/apply_gitattributes.go
+++ b/internal/gitaly/service/repository/apply_gitattributes.go
@@ -14,6 +14,7 @@ import (
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/localrepo"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/service"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/transaction"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/safe"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/structerr"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/transaction/txinfo"
@@ -42,7 +43,7 @@ func (s *server) applyGitattributes(ctx context.Context, repo *localrepo.Repo, o
 	}
 
 	// Create  /info folder if it doesn't exist
-	if err := os.MkdirAll(infoPath, 0o755); err != nil {
+	if err := os.MkdirAll(infoPath, perm.SharedDir); err != nil {
 		return err
 	}
 
diff --git a/internal/gitaly/service/repository/apply_gitattributes_test.go b/internal/gitaly/service/repository/apply_gitattributes_test.go
index a168f08b1..0eeb7ecb5 100644
--- a/internal/gitaly/service/repository/apply_gitattributes_test.go
+++ b/internal/gitaly/service/repository/apply_gitattributes_test.go
@@ -11,6 +11,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/backchannel"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/gittest"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/metadata"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/structerr"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
@@ -61,13 +62,13 @@ func TestApplyGitattributes_successful(t *testing.T) {
 
 			t.Run("without 'info/attributes' directory", func(t *testing.T) {
 				require.NoError(t, os.RemoveAll(infoPath))
-				require.NoError(t, os.Mkdir(infoPath, 0o755))
+				require.NoError(t, os.Mkdir(infoPath, perm.SharedDir))
 				requireApplyGitattributes(t, ctx, client, repo, attributesPath, tc.revision, tc.expectedContent)
 			})
 
 			t.Run("with preexisting 'info/attributes'", func(t *testing.T) {
 				require.NoError(t, os.RemoveAll(infoPath))
-				require.NoError(t, os.Mkdir(infoPath, 0o755))
+				require.NoError(t, os.Mkdir(infoPath, perm.SharedDir))
 				require.NoError(t, os.WriteFile(attributesPath, []byte("*.docx diff=word"), 0o644))
 				requireApplyGitattributes(t, ctx, client, repo, attributesPath, tc.revision, tc.expectedContent)
 			})
diff --git a/internal/gitaly/service/repository/backup_custom_hooks_test.go b/internal/gitaly/service/repository/backup_custom_hooks_test.go
index 6aa538790..9c897bcd2 100644
--- a/internal/gitaly/service/repository/backup_custom_hooks_test.go
+++ b/internal/gitaly/service/repository/backup_custom_hooks_test.go
@@ -13,6 +13,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/gittest"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/v15/proto/go/gitalypb"
 	"gitlab.com/gitlab-org/gitaly/v15/streamio"
@@ -33,7 +34,7 @@ func TestBackupCustomHooks_successful(t *testing.T) {
 		"custom_hooks/prepare-commit-msg.sample",
 		"custom_hooks/pre-push.sample",
 	}
-	require.NoError(t, os.Mkdir(filepath.Join(repoPath, "custom_hooks"), 0o700), "Could not create custom_hooks dir")
+	require.NoError(t, os.Mkdir(filepath.Join(repoPath, "custom_hooks"), perm.PrivateDir), "Could not create custom_hooks dir")
 	for _, fileName := range expectedTarResponse[1:] {
 		require.NoError(t, os.WriteFile(filepath.Join(repoPath, fileName), []byte("Some hooks"), 0o700), fmt.Sprintf("Could not create %s", fileName))
 	}
diff --git a/internal/gitaly/service/repository/calculate_checksum_test.go b/internal/gitaly/service/repository/calculate_checksum_test.go
index 1679d05c8..229d34f83 100644
--- a/internal/gitaly/service/repository/calculate_checksum_test.go
+++ b/internal/gitaly/service/repository/calculate_checksum_test.go
@@ -11,6 +11,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/gittest"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/v15/proto/go/gitalypb"
 	"google.golang.org/grpc/codes"
@@ -26,7 +27,7 @@ func TestSuccessfulCalculateChecksum(t *testing.T) {
 	// Force the refs database of testRepo into a known state
 	require.NoError(t, os.RemoveAll(filepath.Join(repoPath, "refs")))
 	for _, d := range []string{"refs/heads", "refs/tags", "refs/notes"} {
-		require.NoError(t, os.MkdirAll(filepath.Join(repoPath, d), 0o755))
+		require.NoError(t, os.MkdirAll(filepath.Join(repoPath, d), perm.SharedDir))
 	}
 
 	testhelper.CopyFile(t, "testdata/checksum-test-packed-refs", filepath.Join(repoPath, "packed-refs"))
@@ -117,7 +118,7 @@ func TestInvalidRefsCalculateChecksum(t *testing.T) {
 	// Force the refs database of testRepo into a known state
 	require.NoError(t, os.RemoveAll(filepath.Join(repoPath, "refs")))
 	for _, d := range []string{"refs/heads", "refs/tags", "refs/notes"} {
-		require.NoError(t, os.MkdirAll(filepath.Join(repoPath, d), 0o755))
+		require.NoError(t, os.MkdirAll(filepath.Join(repoPath, d), perm.SharedDir))
 	}
 	require.NoError(t, exec.Command("cp", "testdata/checksum-test-invalid-refs", filepath.Join(repoPath, "packed-refs")).Run())
 
diff --git a/internal/gitaly/service/repository/cleanup_test.go b/internal/gitaly/service/repository/cleanup_test.go
index 6c57b77d4..01a921173 100644
--- a/internal/gitaly/service/repository/cleanup_test.go
+++ b/internal/gitaly/service/repository/cleanup_test.go
@@ -12,6 +12,7 @@ import (
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/gittest"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/v15/proto/go/gitalypb"
 	"google.golang.org/grpc/codes"
@@ -101,7 +102,7 @@ func TestCleanupDeletesOrphanedWorktrees(t *testing.T) {
 	basePath := filepath.Join(repoPath, "worktrees")
 	worktreePath := filepath.Join(basePath, "test-worktree")
 
-	require.NoError(t, os.MkdirAll(worktreeCheckoutPath, os.ModePerm))
+	require.NoError(t, os.MkdirAll(worktreeCheckoutPath, perm.PublicDir))
 	require.NoError(t, os.Chtimes(worktreeCheckoutPath, oldWorktreeTime, oldWorktreeTime))
 
 	//nolint:staticcheck
diff --git a/internal/gitaly/service/repository/create_bundle_from_ref_list_test.go b/internal/gitaly/service/repository/create_bundle_from_ref_list_test.go
index 6653ad339..e95ea57df 100644
--- a/internal/gitaly/service/repository/create_bundle_from_ref_list_test.go
+++ b/internal/gitaly/service/repository/create_bundle_from_ref_list_test.go
@@ -12,6 +12,7 @@ import (
 
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/gittest"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/text"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/v15/proto/go/gitalypb"
@@ -30,7 +31,7 @@ func TestCreateBundleFromRefList_success(t *testing.T) {
 	// clean this up before creating the bundle.
 	sha := gittest.WriteCommit(t, cfg, repoPath, gittest.WithBranch("branch"))
 
-	require.NoError(t, os.MkdirAll(filepath.Join(repoPath, "gitlab-worktree"), 0o755))
+	require.NoError(t, os.MkdirAll(filepath.Join(repoPath, "gitlab-worktree"), perm.SharedDir))
 
 	gittest.Exec(t, cfg, "-C", repoPath, "worktree", "add", "gitlab-worktree/worktree1", sha.String())
 	require.NoError(t, os.Chtimes(filepath.Join(repoPath, "gitlab-worktree", "worktree1"), time.Now().Add(-7*time.Hour), time.Now().Add(-7*time.Hour)))
diff --git a/internal/gitaly/service/repository/create_bundle_test.go b/internal/gitaly/service/repository/create_bundle_test.go
index 9cc63d30c..6276242a8 100644
--- a/internal/gitaly/service/repository/create_bundle_test.go
+++ b/internal/gitaly/service/repository/create_bundle_test.go
@@ -12,6 +12,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/gittest"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/config"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/tempdir"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/v15/proto/go/gitalypb"
@@ -30,7 +31,7 @@ func TestSuccessfulCreateBundleRequest(t *testing.T) {
 	// clean this up before creating the bundle.
 	sha := gittest.WriteCommit(t, cfg, repoPath, gittest.WithBranch("branch"))
 
-	require.NoError(t, os.MkdirAll(filepath.Join(repoPath, "gitlab-worktree"), 0o755))
+	require.NoError(t, os.MkdirAll(filepath.Join(repoPath, "gitlab-worktree"), perm.SharedDir))
 
 	gittest.Exec(t, cfg, "-C", repoPath, "worktree", "add", "gitlab-worktree/worktree1", sha.String())
 	require.NoError(t, os.Chtimes(filepath.Join(repoPath, "gitlab-worktree", "worktree1"), time.Now().Add(-7*time.Hour), time.Now().Add(-7*time.Hour)))
diff --git a/internal/gitaly/service/repository/create_fork_test.go b/internal/gitaly/service/repository/create_fork_test.go
index 45a7cedd4..9b40586b3 100644
--- a/internal/gitaly/service/repository/create_fork_test.go
+++ b/internal/gitaly/service/repository/create_fork_test.go
@@ -17,6 +17,7 @@ import (
 	"gitlab.com/gitlab-org/gitaly/v15/client"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/gittest"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/config"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/text"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/praefect/praefectutil"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/structerr"
@@ -232,14 +233,14 @@ func TestCreateFork_targetExists(t *testing.T) {
 		{
 			desc: "empty target directory",
 			seed: func(t *testing.T, targetPath string) {
-				require.NoError(t, os.MkdirAll(targetPath, 0o770))
+				require.NoError(t, os.MkdirAll(targetPath, perm.GroupPrivateDir))
 			},
 			expectedErrWithAtomicCreation: structerr.NewAlreadyExists("creating fork: repository exists already"),
 		},
 		{
 			desc: "non-empty target directory",
 			seed: func(t *testing.T, targetPath string) {
-				require.NoError(t, os.MkdirAll(targetPath, 0o770))
+				require.NoError(t, os.MkdirAll(targetPath, perm.GroupPrivateDir))
 				require.NoError(t, os.WriteFile(
 					filepath.Join(targetPath, "config"),
 					nil,
@@ -251,7 +252,7 @@ func TestCreateFork_targetExists(t *testing.T) {
 		{
 			desc: "target file",
 			seed: func(t *testing.T, targetPath string) {
-				require.NoError(t, os.MkdirAll(filepath.Dir(targetPath), 0o770))
+				require.NoError(t, os.MkdirAll(filepath.Dir(targetPath), perm.GroupPrivateDir))
 				require.NoError(t, os.WriteFile(targetPath, nil, 0o644))
 			},
 			expectedErrWithAtomicCreation: structerr.NewAlreadyExists("creating fork: repository exists already"),
diff --git a/internal/gitaly/service/repository/create_repository_from_url_test.go b/internal/gitaly/service/repository/create_repository_from_url_test.go
index 6d4ba8da0..027bf13fd 100644
--- a/internal/gitaly/service/repository/create_repository_from_url_test.go
+++ b/internal/gitaly/service/repository/create_repository_from_url_test.go
@@ -15,6 +15,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/gittest"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/text"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/praefect/praefectutil"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
@@ -130,9 +131,9 @@ func TestCreateRepositoryFromURL_existingTarget(t *testing.T) {
 			importedRepoPath := filepath.Join(cfg.Storages[0].Path, importedRepo.GetRelativePath())
 
 			if testCase.isDir {
-				require.NoError(t, os.MkdirAll(importedRepoPath, 0o770))
+				require.NoError(t, os.MkdirAll(importedRepoPath, perm.GroupPrivateDir))
 			} else {
-				require.NoError(t, os.MkdirAll(filepath.Dir(importedRepoPath), os.ModePerm))
+				require.NoError(t, os.MkdirAll(filepath.Dir(importedRepoPath), perm.PublicDir))
 				require.NoError(t, os.WriteFile(importedRepoPath, nil, 0o644))
 			}
 			t.Cleanup(func() { require.NoError(t, os.RemoveAll(importedRepoPath)) })
diff --git a/internal/gitaly/service/repository/gc_test.go b/internal/gitaly/service/repository/gc_test.go
index 585b682aa..97ea88b17 100644
--- a/internal/gitaly/service/repository/gc_test.go
+++ b/internal/gitaly/service/repository/gc_test.go
@@ -18,6 +18,7 @@ import (
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/gittest"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/stats"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/text"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/metadata/featureflag"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
@@ -506,7 +507,7 @@ func testCleanupInvalidKeepAroundRefs(t *testing.T, ctx context.Context) {
 	cfg, repo, repoPath, client := setupRepositoryService(t, ctx)
 
 	// Make the directory, so we can create random reflike things in it
-	require.NoError(t, os.MkdirAll(filepath.Join(repoPath, "refs", "keep-around"), 0o755))
+	require.NoError(t, os.MkdirAll(filepath.Join(repoPath, "refs", "keep-around"), perm.SharedDir))
 
 	testCases := []struct {
 		desc        string
@@ -589,7 +590,7 @@ func testCleanupInvalidKeepAroundRefs(t *testing.T, ctx context.Context) {
 func mustCreateFileWithTimes(tb testing.TB, path string, mTime time.Time) {
 	tb.Helper()
 
-	require.NoError(tb, os.MkdirAll(filepath.Dir(path), 0o755))
+	require.NoError(tb, os.MkdirAll(filepath.Dir(path), perm.SharedDir))
 	require.NoError(tb, os.WriteFile(path, nil, 0o644))
 	require.NoError(tb, os.Chtimes(path, mTime, mTime))
 }
diff --git a/internal/gitaly/service/repository/info_attributes_test.go b/internal/gitaly/service/repository/info_attributes_test.go
index eb1f2ea06..7c5ea034d 100644
--- a/internal/gitaly/service/repository/info_attributes_test.go
+++ b/internal/gitaly/service/repository/info_attributes_test.go
@@ -10,6 +10,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/require"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/v15/proto/go/gitalypb"
 	"gitlab.com/gitlab-org/gitaly/v15/streamio"
@@ -24,7 +25,7 @@ func TestGetInfoAttributesExisting(t *testing.T) {
 	_, repo, repoPath, client := setupRepositoryService(t, ctx)
 
 	infoPath := filepath.Join(repoPath, "info")
-	require.NoError(t, os.MkdirAll(infoPath, 0o755))
+	require.NoError(t, os.MkdirAll(infoPath, perm.SharedDir))
 
 	buffSize := streamio.WriteBufferSize + 1
 	data := bytes.Repeat([]byte("*.pbxproj binary\n"), buffSize)
diff --git a/internal/gitaly/service/repository/optimize_test.go b/internal/gitaly/service/repository/optimize_test.go
index 618a6f2b5..c54fddcca 100644
--- a/internal/gitaly/service/repository/optimize_test.go
+++ b/internal/gitaly/service/repository/optimize_test.go
@@ -18,6 +18,7 @@ import (
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/housekeeping"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/localrepo"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/stats"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/text"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/metadata/featureflag"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/structerr"
@@ -228,7 +229,7 @@ func testOptimizeRepository(t *testing.T, ctx context.Context) {
 		// Git will leave behind empty refs directories at times. In order to not slow down
 		// enumerating refs we want to make sure that they get cleaned up properly.
 		emptyRefsDir := filepath.Join(repoPath, "refs", "merge-requests", "1")
-		require.NoError(t, os.MkdirAll(emptyRefsDir, 0o755))
+		require.NoError(t, os.MkdirAll(emptyRefsDir, perm.SharedDir))
 
 		// But we don't expect the first call to OptimizeRepository to do anything. This is
 		// because we have a grace period so that we don't delete empty ref directories that
diff --git a/internal/gitaly/service/repository/remove.go b/internal/gitaly/service/repository/remove.go
index 08967d7a5..f59db5025 100644
--- a/internal/gitaly/service/repository/remove.go
+++ b/internal/gitaly/service/repository/remove.go
@@ -10,6 +10,7 @@ import (
 	"github.com/grpc-ecosystem/go-grpc-middleware/logging/logrus/ctxlogrus"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/service"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/transaction"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/safe"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/structerr"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/transaction/txinfo"
@@ -32,7 +33,7 @@ func (s *server) RemoveRepository(ctx context.Context, in *gitalypb.RemoveReposi
 		return nil, structerr.NewInternal("temporary directory: %w", err)
 	}
 
-	if err := os.MkdirAll(tempDir, 0o755); err != nil {
+	if err := os.MkdirAll(tempDir, perm.SharedDir); err != nil {
 		return nil, structerr.NewInternal("%w", err)
 	}
 
diff --git a/internal/gitaly/service/repository/rename.go b/internal/gitaly/service/repository/rename.go
index 5e4079cd8..2ebc68484 100644
--- a/internal/gitaly/service/repository/rename.go
+++ b/internal/gitaly/service/repository/rename.go
@@ -9,6 +9,7 @@ import (
 
 	"github.com/grpc-ecosystem/go-grpc-middleware/logging/logrus/ctxlogrus"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/service"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/safe"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/structerr"
 	"gitlab.com/gitlab-org/gitaly/v15/proto/go/gitalypb"
@@ -48,7 +49,7 @@ func (s *server) renameRepository(ctx context.Context, sourceRepo, targetRepo *g
 		return structerr.NewAlreadyExists("target repo exists already")
 	}
 
-	if err := os.MkdirAll(filepath.Dir(targetPath), 0o770); err != nil {
+	if err := os.MkdirAll(filepath.Dir(targetPath), perm.GroupPrivateDir); err != nil {
 		return fmt.Errorf("create target parent dir: %w", err)
 	}
 
diff --git a/internal/gitaly/service/repository/replicate.go b/internal/gitaly/service/repository/replicate.go
index 9f2227312..a5eb1ab11 100644
--- a/internal/gitaly/service/repository/replicate.go
+++ b/internal/gitaly/service/repository/replicate.go
@@ -20,6 +20,7 @@ import (
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/service"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/storage"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/transaction"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/metadata"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/safe"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/structerr"
@@ -319,7 +320,7 @@ func (s *server) syncInfoAttributes(ctx context.Context, in *gitalypb.ReplicateR
 
 func (s *server) writeFile(ctx context.Context, path string, mode os.FileMode, reader io.Reader) (returnedErr error) {
 	parentDir := filepath.Dir(path)
-	if err := os.MkdirAll(parentDir, 0o755); err != nil {
+	if err := os.MkdirAll(parentDir, perm.SharedDir); err != nil {
 		return err
 	}
 
diff --git a/internal/gitaly/service/repository/replicate_test.go b/internal/gitaly/service/repository/replicate_test.go
index f0d3f5a33..ca10e838f 100644
--- a/internal/gitaly/service/repository/replicate_test.go
+++ b/internal/gitaly/service/repository/replicate_test.go
@@ -25,6 +25,7 @@ import (
 	gitalyhook "gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/hook"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/storage"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/transaction"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/text"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/metadata"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
@@ -63,7 +64,7 @@ func TestReplicateRepository(t *testing.T) {
 
 	// write info attributes
 	attrFilePath := filepath.Join(repoPath, "info", "attributes")
-	require.NoError(t, os.MkdirAll(filepath.Dir(attrFilePath), 0o755))
+	require.NoError(t, os.MkdirAll(filepath.Dir(attrFilePath), perm.SharedDir))
 	attrData := []byte("*.pbxproj binary\n")
 	require.NoError(t, os.WriteFile(attrFilePath, attrData, 0o644))
 
diff --git a/internal/gitaly/service/repository/restore_custom_hooks.go b/internal/gitaly/service/repository/restore_custom_hooks.go
index 51a82714b..a3b24d392 100644
--- a/internal/gitaly/service/repository/restore_custom_hooks.go
+++ b/internal/gitaly/service/repository/restore_custom_hooks.go
@@ -15,6 +15,7 @@ import (
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/repository"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/service"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/transaction"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/metadata/featureflag"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/safe"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/structerr"
@@ -124,7 +125,7 @@ func (s *server) restoreCustomHooks(ctx context.Context, tar io.Reader, repo rep
 	// it means the repository should be set with an empty `custom_hooks`
 	// directory. Create `custom_hooks` in the temporary directory so that any
 	// existing repository hooks will be replaced with this empty directory.
-	if err := os.Mkdir(tempHooksPath, os.ModePerm); err != nil && !errors.Is(err, fs.ErrExist) {
+	if err := os.Mkdir(tempHooksPath, perm.PublicDir); err != nil && !errors.Is(err, fs.ErrExist) {
 		return fmt.Errorf("making temp hooks directory: %w", err)
 	}
 
diff --git a/internal/gitaly/service/repository/restore_custom_hooks_test.go b/internal/gitaly/service/repository/restore_custom_hooks_test.go
index 48afedb17..f9bee0ba1 100644
--- a/internal/gitaly/service/repository/restore_custom_hooks_test.go
+++ b/internal/gitaly/service/repository/restore_custom_hooks_test.go
@@ -14,6 +14,7 @@ import (
 	"github.com/stretchr/testify/require"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/gittest"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/transaction"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/metadata"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/metadata/featureflag"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
@@ -228,7 +229,7 @@ func setupTestHooks(t *testing.T, files []testFile) string {
 	tmpDir := testhelper.TempDir(t)
 	hooksPath := filepath.Join(tmpDir, customHooksDir)
 
-	err := os.Mkdir(hooksPath, 0o755)
+	err := os.Mkdir(hooksPath, perm.SharedDir)
 	require.NoError(t, err)
 
 	for _, f := range files {
diff --git a/internal/gitaly/service/repository/snapshot_test.go b/internal/gitaly/service/repository/snapshot_test.go
index fe52c42a4..8a543c400 100644
--- a/internal/gitaly/service/repository/snapshot_test.go
+++ b/internal/gitaly/service/repository/snapshot_test.go
@@ -18,6 +18,7 @@ import (
 	"gitlab.com/gitlab-org/gitaly/v15/internal/git/localrepo"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/archive"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/gitaly/config"
+	"gitlab.com/gitlab-org/gitaly/v15/internal/helper/perm"
 	"gitlab.com/gitlab-org/gitaly/v15/internal/testhelper"
 	"gitlab.com/gitlab-org/gitaly/v15/proto/go/gitalypb"
 	"gitlab.com/gitlab-org/gitaly/v15/streamio"
@@ -56,8 +57,8 @@ func TestGetSnapshotSuccess(t *testing.T) {
 	// WriteCommit produces a loose object with the given sha
 	sha := gittest.WriteCommit(t, cfg, repoPath, gittest.WithBranch("master"))
 	zeroes := strings.Repeat("0", 40)
-	require.NoError(t, os.MkdirAll(filepath.Join(repoPath, "hooks"), 0o755))
-	require.NoError(t, os.MkdirAll(filepath.Join(repoPath, "objects/pack"), 0o755))
+	require.NoError(t, os.MkdirAll(filepath.Join(repoPath, "hooks"), perm.SharedDir))
+	require.NoError(t, os.MkdirAll(filepath.Join(repoPath, "objects/pack"), perm.SharedDir))
 	touch(t, filepath.Join(repoPath, "shallow"))
 	touch(t, filepath.Join(repoPath, "objects/pack/pack-%s.pack"), zeroes)
 	touch(t, filepath.Join(repoPath, "objects/pack/pack-%s.idx"), zeroes)