Security Hardening: Keep config files locked down with mode 0o600 when not running in debug mode.

Author: jhuckaby

bin/container-start.sh

@@ -30,5 +30,9 @@ PIDFILE=$HOMEDIR/logs/xyops.pid
 # delete old pid file
 rm -f $PIDFILE
 
+# set perms on config files
+[[ -f conf/config.json ]] && chmod 600 conf/config.json
+[[ -f conf/overrides.json ]] && chmod 600 conf/overrides.json
+
 # start xyops, replace current process
 exec $BINARY

bin/control.sh

@@ -79,6 +79,8 @@ do
 			continue
 		fi
 		echo "$0 $ARG: Starting up $NAME..."
+		[[ -f conf/config.json ]] && chmod 600 conf/config.json
+		[[ -f conf/overrides.json ]] && chmod 600 conf/overrides.json
 		if $BINARY ; then
 			echo "$0 $ARG: $NAME started"
 		else

lib/util.js

@@ -163,7 +163,9 @@ class Util {
 		} // master
 
 		// save file to disk
-		Tools.writeFileAtomic( co_file, JSON.stringify(this.server.configOverrides, null, "\t") + "\n", callback );
+		var opts = {};
+		if (!this.server.debug) opts.mode = 0o600;
+		Tools.writeFileAtomic( co_file, JSON.stringify(this.server.configOverrides, null, "\t") + "\n", opts, callback );
 	}
 
 	convertCronicleDataFile(opts, callback) {