bark: harden created datadir and file access

lucarequested to merge
luca/eng-526-harden-mnemonic-file-and-db into master
  • check or remove this line after you've added a CHANGELOG entry or if your PR doesn't need one (they should go into CHANGELOG/unreleased/)

This MR aims at hardening the datadir against unauthorized access and the mnemonic and db against unauthorized access as well. It sets the datadir to 0700 (can be read, written and modified by root and the parent process) and the db and mnemonic to 0600 (can be read or written by root and parent access).

At first I thought about enforcing existing wallets to this hardening as well, but this could break setups. We just must put a note on the release. It has a warn on how to harden them.

Summary by CodeRabbit

Release Notes

  • Security

    • Hardened newly created wallet/server data with owner-only permissions for the datadir, mnemonic/seed, config, auth token, SQLite db, and wallet state (including safer atomic owner-only writes).
    • On wallet open, emits warnings (no auto-fixing) when permissions are too loose, including SQLite db and wallet-related files.
    • barkd applies owner-only hardening on first-run and re-hardens after wallet deletion; new debug.log is owner-only.

  • Tests

    • Added/extended checks for atomic replacement, refusal to clobber, symlink handling, and owner-only permission enforcement.
Edited by coderabbit

Merge request reports