security: create store entries with private permissions (ai:gpt-5) #53

New issue

Closed

opened 2026-05-23 22:20:39 +02:00 by heiko · 0 comments

heiko commented

2026-05-23 22:20:39 +02:00

Owner

Finding from a whole-codebase security review.

Affected code:

cmd/once-server/store/store.go:153-171 creates UUID directories with os.MkdirAll(f.path, 0777) and creates meta.json/content with os.Create.
cmd/once-server/examples/once.service:12 mitigates this only for the packaged systemd path via UMask=0077.

Impact:
The store contains uploaded secrets. Outside the systemd example, permissions depend on the process umask. With a common umask like 0022, directories may become 0755 and files 0644, exposing uploaded content and metadata to other local users on the host. Security should not depend on deployment-specific umask hygiene.

Suggested fix:

Create store directories with mode 0700.
Create meta.json, temp metadata files, and content with mode 0600 via os.OpenFile.
Consider chmod/migration for existing store entries whose permissions are too broad.
Add tests that set a permissive umask temporarily and assert private store permissions.

Finding from a whole-codebase security review. Affected code: - cmd/once-server/store/store.go:153-171 creates UUID directories with `os.MkdirAll(f.path, 0777)` and creates `meta.json`/`content` with `os.Create`. - cmd/once-server/examples/once.service:12 mitigates this only for the packaged systemd path via `UMask=0077`. Impact: The store contains uploaded secrets. Outside the systemd example, permissions depend on the process umask. With a common umask like 0022, directories may become 0755 and files 0644, exposing uploaded content and metadata to other local users on the host. Security should not depend on deployment-specific umask hygiene. Suggested fix: - Create store directories with mode 0700. - Create `meta.json`, temp metadata files, and `content` with mode 0600 via `os.OpenFile`. - Consider `chmod`/migration for existing store entries whose permissions are too broad. - Add tests that set a permissive umask temporarily and assert private store permissions.

heiko added the

security

label

2026-05-24 18:44:09 +02:00

heiko referenced this issue from a commit

2026-05-24 20:43:23 +02:00

Merge branch 'fix/53-private-permissions' into security/all-fixes

heiko referenced this issue

2026-05-24 20:44:00 +02:00

security: comprehensive fixes for issues #48, #50, #51, #52, #53 ai:claude-sonnet-4-5 #61

heiko referenced this issue

2026-05-24 20:44:20 +02:00