[Audit fixes] FOR-16: Unnecessary Extensive Permissions for Private Keys

forest/src/daemon.rs

@@ -51,13 +51,20 @@ pub(super) async fn start(config: Config) {
             let gen_keypair = ed25519::Keypair::generate();
             // Save Ed25519 keypair to file
             // TODO rename old file to keypair.old(?)
-            if let Err(e) = write_to_file(
+            match write_to_file(
                 &gen_keypair.encode(),
                 &format!("{}{}", &config.data_dir, "/libp2p/"),
                 "keypair",
             ) {
-                info!("Could not write keystore to disk!");
-                trace!("Error {:?}", e);
+                Ok(file) => {
+                    // Restrict permissions on files containing private keys
+                    #[cfg(unix)]
+                    utils::set_user_perm(&file).expect("Set user perms on unix systems");
+                }
+                Err(e) => {
+                    info!("Could not write keystore to disk!");
+                    trace!("Error {:?}", e);
+                }
             };
             Keypair::Ed25519(gen_keypair)
         });

key_management/Cargo.toml

@@ -21,6 +21,7 @@ serde_json = "1.0.57"
 serde_cbor = "0.11.1"
 log = "0.4.8"
 sodiumoxide = "0.2.6"
+utils = { path = "../node/utils" }
 
 [features]
 json = ["base64", "crypto/json"]

key_management/src/keystore.rs

@@ -326,6 +326,11 @@ impl KeyStore {
                     .ok_or_else(|| Error::Other("Invalid Path".to_string()))?;
                 fs::create_dir_all(dir)?;
                 let file = File::create(&persistent_keystore.file_path)?;
+
+                // Restrict permissions on files containing private keys
+                #[cfg(unix)]
+                utils::set_user_perm(&file)?;
+
                 let mut writer = BufWriter::new(file);
 
                 match &self.encryption {

node/utils/Cargo.toml

@@ -7,7 +7,9 @@ edition = "2018"
 [dependencies]
 dirs = "3.0"
 toml = "0.5.5"
+libc = "0.2"
 serde = "1.0"
+log = "0.4.8"
 
 [dev-dependencies]
 serde_derive = "1.0"

node/utils/src/lib.rs

@@ -6,15 +6,30 @@ use std::fs::{create_dir_all, File};
 use std::io::{prelude::*, Result};
 use std::path::Path;
 
+/// Restricts permissions on a file to user-only: 0600
+#[cfg(unix)]
+pub fn set_user_perm(file: &File) -> Result<()> {
+    use log::info;
+    use std::os::unix::fs::PermissionsExt;
+
+    let mut perm = file.metadata()?.permissions();
+    perm.set_mode((libc::S_IWUSR | libc::S_IRUSR) as u32);
+    file.set_permissions(perm)?;
+
+    info!("Permissions set to 0600 on {:?}", file);
+
+    Ok(())
+}
+
 /// Writes a string to a specified file. Creates the desired path if it does not exist.
 /// Note: `path` and `filename` are appended to produce the resulting file path.
-pub fn write_to_file(message: &[u8], path: &str, file_name: &str) -> Result<()> {
+pub fn write_to_file(message: &[u8], path: &str, file_name: &str) -> Result<File> {
     // Create path if it doesn't exist
     create_dir_all(Path::new(path))?;
     let join = format!("{}{}", path, file_name);
     let mut file = File::create(join)?;
     file.write_all(message)?;
-    Ok(())
+    Ok(file)
 }
 
 /// Read file as a `Vec<u8>`