Create private node directories and create private SQLite database files - #1088
Open
tankyleo wants to merge 4 commits into
Open
Create private node directories and create private SQLite database files#1088tankyleo wants to merge 4 commits into
tankyleo wants to merge 4 commits into
Conversation
Create new storage, filesystem-store, seed, and log directories with owner-only permissions on Unix. With the usual 0022 umask, create_dir_all made directories 0755. That let other local users list and traverse node storage, inspect metadata, and reach files with permissive mode bits. Restricting new directories to the owner adds defense in depth for node data. Non-Unix platforms retain their existing directory creation behavior. This commit was created with assistance from Codex.
|
👋 Thanks for assigning @benthecarman as a reviewer! |
Pre-create new SQLite database files with mode 0600 on Unix before opening them with rusqlite. Existing database files are left unchanged. This requires database names to resolve to ordinary filesystem paths. SQLite's :memory: name and file: URI filenames are now rejected. This keeps persisted node and payment data from being readable by other local users when the database is created under a permissive umask. This commit was created with assistance from Codex.
tankyleo
force-pushed
the
2026-09-private-node-storage
branch
from
September 4, 2026 01:39
2618c77 to
27d3e14
Compare
benthecarman
reviewed
Sep 4, 2026
| fs::create_dir_all(parent_dir) | ||
| create_dir_all_private(parent_dir) | ||
| .map_err(|e| eprintln!("ERROR: Failed to create log parent directory: {}", e))?; | ||
|
|
Contributor
There was a problem hiding this comment.
Log file stays world-readable while its directory becomes private. src/logger.rs:270 and src/logger.rs:213 still open the log file with default options, so it is created 0644. The directory is now 0700, so protection depends entirely on nobody copying or rotating the file out. Logs contain peer IDs, channel IDs, payment hashes, and amounts. Either give the file 0600 with the same pattern used for the database, or leave the log directory alone. Right now the PR hardens the wrong half of the pair.
Contributor
Author
There was a problem hiding this comment.
Thanks I added a commit below to address this
benthecarman
reviewed
Sep 4, 2026
benthecarman
left a comment
benthecarman
left a comment
Contributor
There was a problem hiding this comment.
small comment otherwise lgtm
Validate the composed SQLite database path for file: URI prefixes before creating the database directory and file. Database file names continue to reject SQLite's :memory: and file: pseudo-filenames. This prevents a data directory such as file:. from redirecting rusqlite to an unprotected database while a private decoy file is created instead. This commit was created with assistance from Codex.
Create new log files with mode 0600 on Unix during logger initialization and when a missing file is recreated during a later write. Existing log files are left unchanged. This keeps peer IDs, channel IDs, payment hashes, and payment amounts from being readable by other local users when log files are created under a permissive umask. Non-Unix platforms retain their existing log file creation behavior. This commit was created with assistance from Codex.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.