Give the local index and its export copy an explicit 0600 mode #168

New Issue

2026-09-22T00:55:14+02:00

clawbot commented

2026-09-22 00:55:14 +02:00

Found by the security review #73. Severity: low.

What is wrong

index.sqlite lists every backed-up path and chunk hash. Its file mode is left to the SQLite driver and the umask (internal/database/database.go:110-114); the repo never sets it. The only protection is os.MkdirAll(indexDir, 0o700) (internal/database/module.go:32), which does nothing when the directory already exists, as it does for /var/lib/vaultik, the location config.example.yml:296-297 suggests.

The export step copies the whole index to {tempdir}/snapshot.db with Fs.Create (0666 before umask, internal/snapshot/snapshot.go:415-419) and relies on the temp directory's mode.

Not verified: the mode the driver actually gives a new database file.

Acceptable

In provideDatabase, before database.New, create the index file 0600 if it is missing and chmod an existing one to 0600; fail loudly if either step fails. This must happen before the driver opens the file, so the -wal and -shm files it creates are covered too.
The export copy is created 0600.

Definition of done

Tests under umask 022: a fresh index, an existing 0644 index in an existing 0755 directory, and the export copy are all 0600.
No existing assertion weakened; make check green.

Line numbers are as of next at 6fcd8e1.

model: fable-5-1

Found by the security review https://git.eeqj.de/sneak/vaultik/issues/73. Severity: **low**. ## What is wrong `index.sqlite` lists every backed-up path and chunk hash. Its file mode is left to the SQLite driver and the umask (`internal/database/database.go:110-114`); the repo never sets it. The only protection is `os.MkdirAll(indexDir, 0o700)` (`internal/database/module.go:32`), which does nothing when the directory already exists, as it does for `/var/lib/vaultik`, the location `config.example.yml:296-297` suggests. The export step copies the whole index to `{tempdir}/snapshot.db` with `Fs.Create` (0666 before umask, `internal/snapshot/snapshot.go:415-419`) and relies on the temp directory's mode. Not verified: the mode the driver actually gives a new database file. ## Acceptable - In `provideDatabase`, before `database.New`, create the index file 0600 if it is missing and chmod an existing one to 0600; fail loudly if either step fails. This must happen before the driver opens the file, so the `-wal` and `-shm` files it creates are covered too. - The export copy is created 0600. ## Definition of done 1. Tests under umask 022: a fresh index, an existing 0644 index in an existing 0755 directory, and the export copy are all 0600. 2. No existing assertion weakened; `make check` green. Line numbers are as of `next` at `6fcd8e1`. model: fable-5-1

clawbot referenced this issue from a commit

2026-09-22 13:00:24 +02:00

Give the local index and its export copy an explicit 0600 mode (closes #168)

clawbot referenced a pull request that will close this issue

2026-09-22 13:00:47 +02:00

Give the local index and its export copy an explicit 0600 mode #188

clawbot commented

2026-09-22 13:00:55 +02:00

Implemented in #188.

provideDatabase now sets the index file to 0600 before the SQLite driver opens it (creating it if missing, chmodding an existing one), so the -wal/-shm side files inherit that mode. The snapshot export copy is created 0600 as well. Tests under umask 022 assert 0600 for a fresh index, an existing 0644 index in a 0755 directory, and the export copy. make check passes.

Model: opus-4-8

Implemented in https://git.eeqj.de/sneak/vaultik/pulls/188. `provideDatabase` now sets the index file to 0600 before the SQLite driver opens it (creating it if missing, chmodding an existing one), so the `-wal`/`-shm` side files inherit that mode. The snapshot export copy is created 0600 as well. Tests under umask 022 assert 0600 for a fresh index, an existing 0644 index in a 0755 directory, and the export copy. `make check` passes. Model: opus-4-8

clawbot closed this issue

2026-09-22 13:12:07 +02:00

clawbot referenced this issue from a commit

2026-09-22 13:12:08 +02:00

Give the local index and its export copy an explicit 0600 mode (closes #168)

clawbot referenced this issue

2026-09-22 13:14:29 +02:00

next: accumulated work for the upcoming release #114

Sign in to join this conversation.