Security: Insecure default permissions (644) for face model files in /etc/howdy/models

[omartayel]

[SECURITY] Insecure default permissions (644) for face model files

Description

I discovered that the howdy add command (and the installation process) creates facial model files (.dat) with world-readable permissions (644 / -rw-r--r--).

Additionally, the /etc/howdy/models directory is created with 755 permissions, allowing any user to list the registered face models on the system.

While these .dat files are mathematical vectors and not raw images, they represent sensitive biometric data. In their current state, any unprivileged user or malicious process on the system can read these models, which could potentially be used for reconstruction or spoofing in other biometric contexts.

Environment

• OS: CachyOS (Arch Linux)
• Hardware: Ryzen 9 9950X3D / Logitech Brio (IR)
• Howdy Version: 3.0.0 Beta (howdy-git)
• Python Version: 3.14+

Steps to Reproduce

1. Enroll a new face model: sudo howdy add
2. Check the permissions of the newly created model as a non-root user:

   ls -l /etc/howdy/models/

3. Observe the output: -rw-r--r-- 1 root root ... *.dat

Expected Behavior

Biometric data should follow the principle of least privilege:

• Models: Should be created with 600 (-rw-------) permissions.
• Directory: /etc/howdy/models should be 700 (drwx------).
  Only the root user (and the PAM stack running as root) should have access to this data.

Actual Behavior

The files are created with 644 permissions, making the biometric vectors accessible to all users on the system.

Evidence

Terminal capture showing the insecure state of the model files:

Proposed Fix

Update the enrollment script (e.g., in cli/add.py) to explicitly set strict permissions immediately after file creation:

os.chmod(model_path, 0o600)

The installation script should also ensure that the /etc/howdy/models directory is initialized with 700 during the build process.

[omartayel]

UPDATE: The "Lock Screen" Conflict

After manually hardening my installation to 600 (files) and 700 (directory), I discovered that the KDE Plasma 6 lock screen (kscreenlocker_greet) fails to authenticate.

On Plasma 6 (Wayland), the lock screen process appears to run in the user's context rather than root. Consequently, it is denied access to the biometric models when permissions are set to the more secure 600/700 configuration.

Current Workaround:
To restore lock screen functionality while maintaining some security, I had to use:

• Directory: chmod 711 /etc/howdy/models (Allows traversal but not listing)
• Models: chmod 644 /etc/howdy/models/omar.dat

Conclusion for Developers:
The current 644 default seems to be a compromise for lock screen compatibility. However, from a security standpoint, this still leaves biometric vectors world-readable.

Is there a plan for the 3.0.0 release to handle model reading through a more privileged helper process so we can achieve 600 security without breaking DE-level authentication?

[RedEye1605]

Nice find. I ran into this too — the postinst chmod 755 -R /etc/howdy/ is what resets everything to world-readable even if you manually fix it.

Opened #1106 with a fix that:

• Sets the models dir to 700 and model files to 600 at creation time
• Also fixes the postinst to re-apply strict permissions after the broad chmod

Tested on Fedora 43, works as expected.