Skip to content

Harden permissions of seeds and datadir - #3340

Merged
t-bast merged 1 commit into
ACINQ:masterfrom
rorp:seed_file_permissions
Aug 13, 2026
Merged

Harden permissions of seeds and datadir#3340
t-bast merged 1 commit into
ACINQ:masterfrom
rorp:seed_file_permissions

Conversation

@rorp

@rorp rorp commented Aug 3, 2026

Copy link
Copy Markdown
Contributor

node_seed.dat and channel_seed.dat were written with plain Files.write, so under a common 022 umask they end up world-readable. These seeds derive the node identity key and all channel keys, so on a multi-user host any local user could read them and steal the node's funds. The datadir (which also holds eclair.conf with RPC/API passwords) was never hardened either. We already do this for the Tor key, but never for the seeds. Found independently by two auditors.

Fix

  • Set rw------- on seed files in both the creation and legacy-migration paths.
  • Harden datadir/chaindir to rwx------ (defense-in-depth; also protects eclair.conf).

@t-bast
t-bast requested review from pm47, sstone and t-bast August 4, 2026 14:16
@t-bast

t-bast commented Aug 4, 2026

Copy link
Copy Markdown
Member

This change looks good to me, thanks! I've tried it on regtest and it seems to be working fine. I'd like to wait for @pm47 and @sstone's review though to make sure that this doesn't create issues with our operational setup.

@t-bast
t-bast merged commit 17edd76 into ACINQ:master Aug 13, 2026
1 of 2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants