pleroma

commit: 4befb3b1d02f32eb2c56f12e4684a7bb3167b0ee
parent 18a0c923d0da4c8fb6e33b383dabd1d06bb22968
Author: Haelwenn (lanodan) Monnier <contact@hacktivis.me>
Date:   Thu, 22 Jun 2023 00:46:52 +0200

Config: Restrict permissions of OTP config file

Diffstat:
M
lib/pleroma/config/release_runtime_provider.ex
14
++++++++++++++

1 file changed, 14 insertions(+), 0 deletions(-)
diff --git a/lib/pleroma/config/release_runtime_provider.ex b/lib/pleroma/config/release_runtime_provider.ex
@@ -20,6 +20,20 @@ defmodule Pleroma.Config.ReleaseRuntimeProvider do
 
     with_runtime_config =
       if File.exists?(config_path) do
+        # <https://git.pleroma.social/pleroma/pleroma/-/issues/3135>
+        %File.Stat{mode: mode} = File.lstat!(config_path)
+
+        if Bitwise.band(mode, 0o007) > 0 do
+          raise "Configuration at #{config_path} has world-permissions, execute the following: chmod o= #{config_path}"
+        end
+
+        if Bitwise.band(mode, 0o020) > 0 do
+          raise "Configuration at #{config_path} has group-wise write permissions, execute the following: chmod g-w #{config_path}"
+        end
+
+        # Note: Elixir doesn't provides a getuid(2)
+        # so cannot forbid group-read only when config is owned by us
+
         runtime_config = Config.Reader.read!(config_path)
 
         with_defaults