fix: harden supervisor log permissions

Author: TrentBrown

src/platform/paths.js

@@ -1,6 +1,6 @@
 // @ts-check
 
-import { chmod, lstat, mkdir } from 'node:fs/promises';
+import { chmod, lstat, mkdir, open } from 'node:fs/promises';
 import { homedir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { OWNERSHIP_MARKER_FILENAME, ensureOwnershipMarker } from './ownership.js';
@@ -36,7 +36,12 @@ export function resolveRuntimePaths(environment = process.env) {
 }
 
 /**
- * @param {{applicationDirectory: string, socketPath: string}} paths
+ * @param {{
+ *   applicationDirectory: string,
+ *   socketPath: string,
+ *   supervisorStandardOutputPath?: string,
+ *   supervisorStandardErrorPath?: string
+ * }} paths
  */
 export async function prepareRuntimeDirectories(paths) {
   await ensurePrivateDirectory(paths.applicationDirectory);
@@ -48,6 +53,14 @@ export async function prepareRuntimeDirectories(paths) {
   if (socketDirectory !== paths.applicationDirectory) {
     await ensurePrivateDirectory(socketDirectory);
   }
+  for (const path of [
+    paths.supervisorStandardOutputPath,
+    paths.supervisorStandardErrorPath,
+  ]) {
+    if (path !== undefined) {
+      await ensurePrivateFile(path);
+    }
+  }
 }
 
 /**
@@ -110,13 +123,65 @@ async function ensurePrivateDirectory(directory) {
   }
 }
 
+/**
+ * Pre-create supervisor logs so native supervisors cannot create them with a
+ * permissive inherited umask or follow an existing symbolic link.
+ *
+ * @param {string} path
+ */
+async function ensurePrivateFile(path) {
+  let information;
+  try {
+    information = await lstat(path);
+  } catch (error) {
+    if (!isMissingFile(error)) {
+      throw error;
+    }
+    let handle;
+    try {
+      handle = await open(path, 'wx', 0o600);
+      await handle.chmod(0o600);
+      information = await handle.stat();
+    } catch (creationError) {
+      if (!hasCode(creationError, 'EEXIST')) {
+        throw creationError;
+      }
+      information = await lstat(path);
+    } finally {
+      await handle?.close();
+    }
+  }
+  if (!information.isFile() || information.isSymbolicLink()) {
+    throw new Error(`Unsafe Portreeve runtime file: ${path}`);
+  }
+  if (typeof process.getuid === 'function' && information.uid !== process.getuid()) {
+    throw new Error(`Portreeve runtime file has another owner: ${path}`);
+  }
+  if ((information.mode & 0o077) !== 0) {
+    throw new Error(
+      `Portreeve runtime file is not private: ${path} (mode ${(information.mode & 0o777).toString(8)})`,
+    );
+  }
+  if ((information.mode & 0o600) !== 0o600) {
+    throw new Error(`Portreeve runtime file lacks owner access: ${path}`);
+  }
+}
+
 /**
  * @param {unknown} error
  */
 function isMissingFile(error) {
+  return hasCode(error, 'ENOENT');
+}
+
+/**
+ * @param {unknown} error
+ * @param {string} code
+ */
+function hasCode(error, code) {
   return (
     error instanceof Error &&
     'code' in error &&
-    /** @type {{code?: string}} */ (error).code === 'ENOENT'
+    /** @type {{code?: string}} */ (error).code === code
   );
 }

src/supervision/systemd.js

@@ -41,6 +41,7 @@ Description=Portreeve local development port authority
 [Service]
 Type=simple
 Environment=PORTREEVE_SUPERVISED=1
+UMask=0077
 ExecStart=${command}
 Restart=on-failure
 StandardOutput=append:${escapeSystemdSpecifiers(definition.standardOutputPath)}

test/platform/paths.test.js

@@ -30,14 +30,48 @@ test('creates private application and socket directories', async () => {
   const root = await directory();
   const applicationDirectory = join(root, 'data');
   const socketDirectory = join(root, 'runtime');
+  const supervisorStandardOutputPath = join(
+    applicationDirectory,
+    'supervisor.stdout.log',
+  );
+  const supervisorStandardErrorPath = join(
+    applicationDirectory,
+    'supervisor.stderr.log',
+  );
 
   await prepareRuntimeDirectories({
     applicationDirectory,
     socketPath: join(socketDirectory, 'portreeve.sock'),
+    supervisorStandardOutputPath,
+    supervisorStandardErrorPath,
   });
 
   expect((await stat(applicationDirectory)).mode & 0o777).toBe(0o700);
   expect((await stat(socketDirectory)).mode & 0o777).toBe(0o700);
+  expect((await stat(supervisorStandardOutputPath)).mode & 0o777).toBe(0o600);
+  expect((await stat(supervisorStandardErrorPath)).mode & 0o777).toBe(0o600);
+});
+
+test('rejects unsafe existing supervisor logs rather than repairing them', async () => {
+  const root = await directory();
+  const applicationDirectory = join(root, 'data');
+  const supervisorStandardOutputPath = join(
+    applicationDirectory,
+    'supervisor.stdout.log',
+  );
+  await mkdir(applicationDirectory);
+  await chmod(applicationDirectory, 0o700);
+  await writeFile(supervisorStandardOutputPath, '');
+  await chmod(supervisorStandardOutputPath, 0o664);
+
+  await expect(
+    prepareRuntimeDirectories({
+      applicationDirectory,
+      socketPath: join(applicationDirectory, 'portreeve.sock'),
+      supervisorStandardOutputPath,
+    }),
+  ).rejects.toThrow(/not private|writable by another user/u);
+  expect((await stat(supervisorStandardOutputPath)).mode & 0o777).toBe(0o664);
 });
 
 test('rejects rather than repairs an unsafe existing directory', async () => {

test/supervision/native-adapters.test.js

@@ -119,6 +119,7 @@ describe('native supervisor adapters', () => {
     try {
       const content = supervisor.renderDefinition(definition);
       expect(content).toContain('Environment=PORTREEVE_SUPERVISED=1');
+      expect(content).toContain('UMask=0077');
       expect(content).toContain('%%');
       expect(content).toContain('"/Users/Example User/.portreeve/bin/portreeve"');
       await supervisor.installDefinition(content);