forks/go-ethereum
1
0
Fork 1
mirror of https://github.com/ethereum/go-ethereum.git synced 2026-07-26 14:46:42 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

cmd/utils: enforce no group/public permissions on all config files

Browse source
This commit is contained in:
Péter Szilágyi 2017-01-11 14:09:55 +02:00
parent 25f4ffd6aa
commit 67e3f40940
No known key found for this signature in database
GPG key ID: E9AE538CEDF8293D
1 changed files with 15 additions and 19 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

34
cmd/utils/flags.go
View file

@ -435,6 +435,21 @@ func OverrideDefaults(ctx *cli.Context) {
if config == "" { if config == "" {
return return
} }
// Ensure the any config file and containing folder can only be written by the current user
info, err := os.Stat(config)
if err != nil {
Fatalf("Failed to retrieve config file stats: %v", err)
}
if perms := info.Mode().Perm(); perms&0022 > 0 {
Fatalf("Config file is publicly or group writeable, refusing to trust it!")
}
info, err = os.Stat(filepath.Dir(config))
if err != nil {
Fatalf("Failed to retrieve config folder stats: %v", err)
}
if perms := info.Mode().Perm(); perms&0022 > 0 {
Fatalf("Config folder is publicly or group writeable, refusing to trust it!")
}
// Gather all known configuration fields to enforce config validity // Gather all known configuration fields to enforce config validity
flags := make(map[string]struct{}) flags := make(map[string]struct{})
for _, flag := range ctx.GlobalFlagNames() { for _, flag := range ctx.GlobalFlagNames() {
@ -464,25 +479,6 @@ func OverrideDefaults(ctx *cli.Context) {
ctx.GlobalSet(name, key.Value()) ctx.GlobalSet(name, key.Value())
} }
} }
// If dangerous flags were specified from a publicly writeable file, abort
if len(dangerous) > 0 {
// Ensure the file itself can only be written by the current user
info, err := os.Stat(config)
if err != nil {
Fatalf("Failed to retrieve config file stats: %v", err)
}
if perms := info.Mode().Perm(); perms&0022 > 0 {
Fatalf("Config file contains dangerous flags and is publicly (or group) writeable!")
}
// Ensure the folder containing the config can only be written by the user
info, err = os.Stat(filepath.Dir(config))
if err != nil {
Fatalf("Failed to retrieve config file parent folder stats: %v", err)
}
if perms := info.Mode().Perm(); perms&0022 > 0 {
Fatalf("Config file contains dangerous flags and containing folder is publicly (or group) writeable!")
}
}
// Warn the user in case of some weird configuration combos // Warn the user in case of some weird configuration combos
if len(overrides) > 0 || len(dangerous) > 0 { if len(overrides) > 0 || len(dangerous) > 0 {
fmt.Println("-----------------------------------------------------------------") fmt.Println("-----------------------------------------------------------------")