Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: race condition in private key creation #4673

Merged
merged 1 commit into from
Aug 22, 2024

Conversation

LesnyRumcajs
Copy link
Member

@LesnyRumcajs LesnyRumcajs commented Aug 22, 2024

Summary of changes

Changes introduced in this pull request:

  • this mitigates a potential vulnerability where a malicious actor could intercept the private key before proper permissions were assigned to the file,
  • Removed the needless compilation conditionals - Forest doesn't work outside of Unix and it won't happen anytime soon. If we want to support other platforms, there are way more things to do (and test).

After the change, the permissions are still 0600

drwxr-xr-x. 1 rumcajs rumcajs  70 Aug 22 11:40 ./
drwx------. 1 rumcajs rumcajs 538 Aug 22 11:40 ../
drwxr-xr-x. 1 rumcajs rumcajs  12 Aug 22 11:40 calibnet/
-rw-------. 1 rumcajs rumcajs 161 Aug 22 11:40 keystore
-rw-------. 1 rumcajs rumcajs 116 Aug 22 11:40 keystore.json
drwxr-xr-x. 1 rumcajs rumcajs  14 Aug 22 11:40 libp2p/

Reference issue to close (if applicable)

Closes

Other information and links

Change checklist

  • I have performed a self-review of my own code,
  • I have made corresponding changes to the documentation,
  • I have added tests that prove my fix is effective or that my feature works (if possible),
  • I have made sure the CHANGELOG is up-to-date. All user-facing changes should be reflected in this document.

@LesnyRumcajs LesnyRumcajs force-pushed the mitigate-potential-race-vulnerability branch from 74fd562 to d4e07cf Compare August 22, 2024 09:40
@LesnyRumcajs LesnyRumcajs marked this pull request as ready for review August 22, 2024 09:43
@LesnyRumcajs LesnyRumcajs requested a review from a team as a code owner August 22, 2024 09:43
@LesnyRumcajs LesnyRumcajs requested review from lemmih and elmattic and removed request for a team August 22, 2024 09:43
@LesnyRumcajs LesnyRumcajs added this pull request to the merge queue Aug 22, 2024
Merged via the queue into main with commit d0ba0d9 Aug 22, 2024
34 of 52 checks passed
@LesnyRumcajs LesnyRumcajs deleted the mitigate-potential-race-vulnerability branch August 22, 2024 10:14
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants