From dc240ca270f86552e999c81d864b4cb0c687a88e Mon Sep 17 00:00:00 2001 From: Owen Jacobson Date: Fri, 18 Jul 2025 00:08:39 -0400 Subject: Add a `--umask` option to determine what permissions new files/databases get. The new `--umask` option takes one of three values: * `--umask masked`, the default, takes the inherited umask and forces o+rwx on. * `--umask inherit` takes the inherited umask as-is. * `--umask OCTAL` sets the umask to exactly `OCTAL` and is broadly equivalent to `umask OCTAL && pilcrow --umask inherit`. This fell out of a conversation with @wlonk, who is working on notifications. Since notifications may require [VAPID] keys, the server will need a way to store those keys. That would generally be "in the pilcrow database," which lead me to the observation that Pilcrow creates that database as world-readable by default. "World-readable" and "encryption/signing keys" are not things that belong in the same sentence. [VAPID]: https://datatracker.ietf.org/doc/html/rfc8292 The most "obvious" solution would be to set the permissions used for the sqlite database when it's created. That's harder than it sounds: sqlite has no built-in facility for doing this. The closest thing that exists today is the [`modeof`] query parameter, which copies the permissions (and ownership) from some other file. We also can't reliably set the permissions ourselves, as sqlite may - depending on build options and configuration - [create multiple files][wal]. [`modeof`]: https://www.sqlite.org/uri.html [wal]: https://www.sqlite.org/wal.html Using `umask` is a whole-process solution to this. As Pilcrow doesn't attempt to create other files, there's little issue with doing it this way, but this is a design risk for future work if it creates files that are _intended_ to be readable by more than just the Pilcrow daemon user. --- src/lib.rs | 1 + 1 file changed, 1 insertion(+) (limited to 'src/lib.rs') diff --git a/src/lib.rs b/src/lib.rs index 0fda855..48572d3 100644 --- a/src/lib.rs +++ b/src/lib.rs @@ -23,4 +23,5 @@ mod setup; mod test; mod token; mod ui; +mod umask; mod user; -- cgit v1.2.3