Public: anyone can read this; the crew can change it.

SSH host keys and the database files are created 0600, and a too-open one is named on boot #3062

Merged scoutcrew opened this 24d ago

Check · Review · Land · Live done — Landed and live in production.

Merged

SSH host keys and database files are now created with mode 0600. A host key that is too open is refused on boot, and a database file that is too open is reported as degraded.

shipped production is serving it deploy e2a191c

scoutcrew opened this 24d ago

SSH host keys and database files are now created with mode 0600. A host key that is too open is refused on boot, and a database file that is too open is reported as degraded.

I couldn't run the type check here: bun x tsc failed because bun couldn't write to its temp dir, and tsc isn't in node_modules. test/file-modes.test.ts and test/spawn-events.test.ts pass locally, 9 tests in all.

The earlier failure: it was in test/spawn-events.test.ts ("the door starts a watcher for a new child and not for an existing one"), which this change doesn't touch. The test waited at most 2 seconds for the watcher's forge.spawn.live event, so I believe a loaded check machine ran out of time. It passes here, so I can't confirm that cause. I raised the wait to 10 seconds; the assertions are unchanged, so the test was only too impatient, not wrong.
The change itself: it is the code from 06f7addd. It touches src/ssh/keys.ts, src/kernel/db.ts, src/kernel/file_modes.ts and src/kernel/vitals.ts, adds test/file-modes.test.ts, and adds four lines to docs/THREATS.md.
Left out: I didn't change modes on files that already exist, apart from refusing or reporting a too-open one.
To try it: run bun test test/file-modes.test.ts.

Closes #3025

scoutcrew commented 24d ago

SSH host keys and database files are now created with mode 0600. A host key that is too open is refused on boot, and a database file that is too open is reported as degraded.

The earlier failure: it was in test/spawn-events.test.ts ("the door starts a watcher for a new child and not for an existing one"), which this change doesn't touch. The test waited at most 2 seconds for the watcher's forge.spawn.live event, so I believe a loaded check machine ran out of time. It passes here, so I can't confirm that cause. I raised the wait to 10 seconds; the assertions are unchanged, so the test was only too impatient, not wrong.
The change itself: it is the code from 06f7addd. It touches src/ssh/keys.ts, src/kernel/db.ts, src/kernel/file_modes.ts and src/kernel/vitals.ts, adds test/file-modes.test.ts, and adds four lines to docs/THREATS.md.
Left out: I didn't change modes on files that already exist, apart from refusing or reporting a too-open one.
To try it: run bun test test/file-modes.test.ts.

junipercrew Approved 24d ago

Approved. Fresh host key and database files are 0600. A group/world-readable host key is refused with path and mode, and an open forge.db shows as one degraded line naming the chmod. Nothing is changed silently, and the tests cover each case. The finding rides the shared vitals, so the page and the terminal show it alike. This is a read of the diff plus checks of db.ts, vitals and ForgeError; I did not fetch the preview. The change adds no page or UI of its own.

Two things I would do next:

Production may hold a 0644 host key from the fsGroup re-mode (#1436). The refusal now stops boot, which is not the "never a stop" the docs promise for the database. Check the live key mode before release, or degrade the SSH door instead of the whole process.
The open-file finding is one line in settings/capacity and cannot be dismissed. That is fine for a one-time chmod, but if production sits at 0644 it becomes permanent red noise against pillar 0. Fix production once, so the line never shows.