Harden ACME secrets and filesystem boundaries

Author: eldryoth

CHANGELOG.md

@@ -44,10 +44,10 @@ behavior when the change improves security or project direction.
   retry, contention diagnostics, and a 10-second lock-wait deadline. Public
   bounded async credential load, store, and removal APIs prevent downstream
   Tokio callers from falling back to indefinitely blocking lifecycle methods.
-- Verify the vendored `instant-acme` source against published `0.8.5` hashes in
-  CI and release gates after removing the single marked downstream API patch;
-  separately pin the exact permitted patch body and use a private unpredictable
-  validation workspace to prevent local symlink clobbering.
+- Verify unchanged vendored `instant-acme 0.8.5` files against published hashes
+  and intentionally modified files against reviewed patched hashes plus an
+  aggregate digest in CI and release gates, without creating
+  attacker-addressable temporary paths.
 - Validate online ACME directories structurally and require exact advertised ToS
   agreement, with an explicit private-directory override only for omitted terms.
 - Parse every advertised ACME endpoint as a bounded HTTPS URI with a real
@@ -88,6 +88,12 @@ behavior when the change improves security or project direction.
   advisory leases; recover interrupted pair publication through a durable
   journal; preserve primary renewal errors; redact challenge secrets; and keep
   ACME account, EAB, and private-key material in `sanitization` containers.
+- Keep ACME account PKCS#8 bytes in `sanitization::SecretVec` across the patched
+  client credential boundary, including drop-cleared Base64 serialization and
+  deserialization buffers, bootstrap creation, and account recovery.
+- Create ACME account, certificate, and challenge directories component by
+  component with descriptor-relative no-follow operations on Unix, and reuse
+  the same traversal for account mutation and certificate read locks.
 
 - Open snapshot files with no-follow semantics before validating the opened
   descriptor, closing the check-then-open race while preserving typed unsafe
@@ -99,6 +105,9 @@ behavior when the change improves security or project direction.
   descriptor and use descriptor-relative create, link, rename, cleanup,
   metadata, and durability operations, preventing pathname re-resolution and
   parent replacement during atomic writes.
+- Open the private snapshot mutation lock relative to the same no-symlink parent
+  descriptor, with component-wise fallback traversal on platforms without
+  Linux `openat2`.
 
 ## 1.7.8 - 2026-07-11
 

Cargo.lock

@@ -1,6 +1,6 @@
 use super::*;
 use crate::acme_account_state::ACCOUNT_BOOTSTRAP_PENDING_FILE;
-use rustls::pki_types::{PrivateKeyDer, PrivatePkcs8KeyDer};
+use rustls::pki_types::PrivatePkcs8KeyDer;
 use sanitization::SecretVec;
 use sanitization::ct::ConstantTimeEq as _;
 use sha2::{Digest as _, Sha256};
@@ -92,9 +92,11 @@ fn begin_account_bootstrap_locked(
     if let Some(credentials) = credentials {
         if let Some(pending) = pending {
             let matches = pending.with_secret(|pending| {
-                pending
-                    .ct_eq(credentials.private_key().secret_pkcs8_der())
-                    .declassify("ACME bootstrap key recovery result is public")
+                credentials.with_private_key(|key| {
+                    pending
+                        .ct_eq(key)
+                        .declassify("ACME bootstrap key recovery result is public")
+                })
             });
             if !matches {
                 return Err(AcmeAccountStoreError::UnsafePath {
@@ -111,13 +113,13 @@ fn begin_account_bootstrap_locked(
     let (key_der, initial_key, recovered) = match pending {
         Some(key_der) => (key_der, None, true),
         None => {
-            let (key, generated) = instant_acme::Key::generate_pkcs8().map_err(|error| {
+            let (key, generated) = instant_acme::Key::generate_secret_pkcs8().map_err(|error| {
                 AcmeAccountStoreError::UnsafePath {
                     path: pending_path.clone(),
                     message: format!("failed to generate pending account key: {error}"),
                 }
             })?;
-            let key_der = SecretVec::from_slice(generated.secret_pkcs8_der());
+            let key_der = generated;
             write_pending_key(directory, &pending_path, issuer_directory, &key_der)?;
             (key_der, Some(key), false)
         }
@@ -141,37 +143,39 @@ impl PendingAccountBootstrap {
 
     pub(crate) fn key_pair(
         &mut self,
-    ) -> Result<(instant_acme::Key, PrivatePkcs8KeyDer<'static>), AcmeAccountStoreError> {
+    ) -> Result<(instant_acme::Key, SecretVec), AcmeAccountStoreError> {
         self.key_der.with_secret(|key_der| {
             let key = if let Some(key) = self.initial_key.take() {
                 key
             } else {
-                instant_acme::Key::from_pkcs8_der(PrivatePkcs8KeyDer::from(key_der.to_vec()))
-                    .map_err(|_| AcmeAccountStoreError::UnsafePath {
+                instant_acme::Key::from_pkcs8_der(PrivatePkcs8KeyDer::from(key_der)).map_err(
+                    |_| AcmeAccountStoreError::UnsafePath {
                         path: self.pending_path.clone(),
                         message: "pending account key is not valid PKCS#8 P-256 material"
                             .to_owned(),
-                    })?
+                    },
+                )?
             };
-            Ok((key, PrivatePkcs8KeyDer::from(key_der.to_vec())))
+            Ok((key, SecretVec::from_slice(key_der)))
         })
     }
 
     pub(crate) fn existing_key_pair(
         &mut self,
-    ) -> Result<(instant_acme::Key, PrivateKeyDer<'static>), AcmeAccountStoreError> {
-        let (key, key_der) = self.key_pair()?;
-        Ok((key, PrivateKeyDer::Pkcs8(key_der)))
+    ) -> Result<(instant_acme::Key, SecretVec), AcmeAccountStoreError> {
+        self.key_pair()
     }
 
     pub(crate) fn promote(
         self,
         credentials: &instant_acme::AccountCredentials,
     ) -> Result<(), AcmeAccountStoreError> {
         let matches = self.key_der.with_secret(|pending| {
-            pending
-                .ct_eq(credentials.private_key().secret_pkcs8_der())
-                .declassify("ACME bootstrap credential key match result is public")
+            credentials.with_private_key(|key| {
+                pending
+                    .ct_eq(key)
+                    .declassify("ACME bootstrap credential key match result is public")
+            })
         });
         if !matches {
             return Err(AcmeAccountStoreError::UnsafePath {

crates/fluxheim-acme/src/acme_account_bootstrap.rs

@@ -1,7 +1,9 @@
 use std::fs;
 use std::io;
 use std::io::{Read, Write};
-use std::path::{Path, PathBuf};
+use std::path::Path;
+#[cfg(any(feature = "acme-client", not(unix)))]
+use std::path::PathBuf;
 
 use sanitization::SecretVec;
 
@@ -362,19 +364,29 @@ pub fn remove_account_credentials(
 }
 
 pub(crate) fn ensure_safe_account_directory(directory: &Path) -> Result<(), AcmeAccountStoreError> {
-    reject_existing_symlink_in_account_path(directory)?;
-    fs::create_dir_all(directory).map_err(|error| account_store_io_error(directory, error))?;
-    reject_existing_symlink_in_account_path(directory)?;
-    let metadata = fs::symlink_metadata(directory)
-        .map_err(|error| account_store_io_error(directory, error))?;
-    if metadata.file_type().is_symlink() || !metadata.is_dir() {
-        return Err(AcmeAccountStoreError::UnsafePath {
-            path: directory.to_path_buf(),
-            message: "path is not a real directory".to_owned(),
-        });
+    #[cfg(unix)]
+    {
+        crate::acme_directory::create_private_directory_all(directory)
+            .map_err(|error| account_store_io_error(directory, error))?;
+        Ok(())
     }
 
-    Ok(())
+    #[cfg(not(unix))]
+    {
+        reject_existing_symlink_in_account_path(directory)?;
+        fs::create_dir_all(directory).map_err(|error| account_store_io_error(directory, error))?;
+        reject_existing_symlink_in_account_path(directory)?;
+        let metadata = fs::symlink_metadata(directory)
+            .map_err(|error| account_store_io_error(directory, error))?;
+        if metadata.file_type().is_symlink() || !metadata.is_dir() {
+            return Err(AcmeAccountStoreError::UnsafePath {
+                path: directory.to_path_buf(),
+                message: "path is not a real directory".to_owned(),
+            });
+        }
+
+        Ok(())
+    }
 }
 
 pub(crate) fn ensure_safe_account_destination(path: &Path) -> Result<(), AcmeAccountStoreError> {
@@ -391,6 +403,7 @@ pub(crate) fn ensure_safe_account_destination(path: &Path) -> Result<(), AcmeAcc
     }
 }
 
+#[cfg(not(unix))]
 fn reject_existing_symlink_in_account_path(path: &Path) -> Result<(), AcmeAccountStoreError> {
     let mut current = PathBuf::new();
     for component in path.components() {

crates/fluxheim-acme/src/acme_account_store.rs

@@ -14,9 +14,9 @@ mod revocation_fs;
 use backup::{backup_existing_file, cleanup_backup};
 #[cfg(not(unix))]
 use fs_ops::CertificateDirectoryFd;
-pub(crate) use fs_ops::{
-    ManagedCertificateOwner, managed_certificate_owner, reject_existing_symlink_in_path,
-};
+#[cfg(not(unix))]
+pub(crate) use fs_ops::reject_existing_symlink_in_path;
+pub(crate) use fs_ops::{ManagedCertificateOwner, managed_certificate_owner};
 use fs_ops::{
     certificate_directory, ensure_safe_destination, ensure_safe_directory,
     open_safe_certificate_directory, rename_certificate_file, write_new_file,

crates/fluxheim-acme/src/acme_certificate_install.rs

@@ -95,46 +95,43 @@ pub(super) fn ensure_safe_directory(
     directory: &Path,
     owner: ManagedCertificateOwner,
 ) -> Result<(), AcmeCertificateInstallError> {
-    reject_existing_symlink_in_path(directory)?;
-    fs::create_dir_all(directory).map_err(|error| AcmeCertificateInstallError::Io {
-        path: directory.to_path_buf(),
-        error,
-    })?;
-    apply_owner_to_path(directory, owner)?;
-    reject_existing_symlink_in_path(directory)?;
-    let metadata =
-        fs::symlink_metadata(directory).map_err(|error| AcmeCertificateInstallError::Io {
+    #[cfg(unix)]
+    {
+        let directory_fd =
+            crate::acme_directory::create_private_directory_all(directory).map_err(|error| {
+                AcmeCertificateInstallError::Io {
+                    path: directory.to_path_buf(),
+                    error,
+                }
+            })?;
+        let directory_file = fs::File::from(directory_fd);
+        apply_owner_to_file(&directory_file, directory, owner)?;
+        Ok(())
+    }
+
+    #[cfg(not(unix))]
+    {
+        reject_existing_symlink_in_path(directory)?;
+        fs::create_dir_all(directory).map_err(|error| AcmeCertificateInstallError::Io {
             path: directory.to_path_buf(),
             error,
         })?;
-    if metadata.file_type().is_symlink() || !metadata.is_dir() {
-        return Err(AcmeCertificateInstallError::UnsafePath {
-            path: directory.to_path_buf(),
-            message: "path is not a real directory".to_owned(),
-        });
-    }
-
-    Ok(())
-}
-
-#[cfg(unix)]
-fn apply_owner_to_path(
-    path: &Path,
-    owner: ManagedCertificateOwner,
-) -> Result<(), AcmeCertificateInstallError> {
-    let Some(owner) = owner else {
-        return Ok(());
-    };
+        apply_owner_to_path(directory, owner)?;
+        reject_existing_symlink_in_path(directory)?;
+        let metadata =
+            fs::symlink_metadata(directory).map_err(|error| AcmeCertificateInstallError::Io {
+                path: directory.to_path_buf(),
+                error,
+            })?;
+        if metadata.file_type().is_symlink() || !metadata.is_dir() {
+            return Err(AcmeCertificateInstallError::UnsafePath {
+                path: directory.to_path_buf(),
+                message: "path is not a real directory".to_owned(),
+            });
+        }
 
-    rustix::fs::chown(
-        path,
-        Some(rustix::fs::Uid::from_raw(owner.uid)),
-        Some(rustix::fs::Gid::from_raw(owner.gid)),
-    )
-    .map_err(|error| AcmeCertificateInstallError::Io {
-        path: path.to_path_buf(),
-        error: error.into(),
-    })
+        Ok(())
+    }
 }
 
 #[cfg(not(unix))]
@@ -192,6 +189,7 @@ pub(super) fn ensure_safe_destination(path: &Path) -> Result<(), AcmeCertificate
     }
 }
 
+#[cfg(not(unix))]
 pub(crate) fn reject_existing_symlink_in_path(
     path: &Path,
 ) -> Result<(), AcmeCertificateInstallError> {
@@ -311,40 +309,11 @@ fn certificate_file_raw_mode(
 pub(super) fn open_safe_certificate_directory(
     directory: &Path,
 ) -> Result<rustix::fd::OwnedFd, AcmeCertificateInstallError> {
-    #[cfg(target_os = "linux")]
-    {
-        match rustix::fs::openat2(
-            rustix::fs::CWD,
-            directory,
-            rustix::fs::OFlags::RDONLY
-                | rustix::fs::OFlags::DIRECTORY
-                | rustix::fs::OFlags::CLOEXEC,
-            rustix::fs::Mode::empty(),
-            rustix::fs::ResolveFlags::NO_SYMLINKS | rustix::fs::ResolveFlags::NO_MAGICLINKS,
-        ) {
-            Ok(fd) => return Ok(fd),
-            Err(rustix::io::Errno::NOSYS | rustix::io::Errno::INVAL) => {}
-            Err(error) => {
-                return Err(AcmeCertificateInstallError::Io {
-                    path: directory.to_path_buf(),
-                    error: error.into(),
-                });
-            }
+    crate::acme_directory::open_directory_no_symlinks(directory).map_err(|error| {
+        AcmeCertificateInstallError::Io {
+            path: directory.to_path_buf(),
+            error,
         }
-    }
-
-    rustix::fs::openat(
-        rustix::fs::CWD,
-        directory,
-        rustix::fs::OFlags::RDONLY
-            | rustix::fs::OFlags::DIRECTORY
-            | rustix::fs::OFlags::NOFOLLOW
-            | rustix::fs::OFlags::CLOEXEC,
-        rustix::fs::Mode::empty(),
-    )
-    .map_err(|error| AcmeCertificateInstallError::Io {
-        path: directory.to_path_buf(),
-        error: error.into(),
     })
 }
 

crates/fluxheim-acme/src/acme_certificate_install_fs.rs

@@ -157,19 +157,28 @@ impl AcmeHttp01ChallengeStore {
     }
 
     fn ensure_root_directory(&self) -> io::Result<()> {
-        reject_existing_symlink_in_path(&self.root)
-            .map_err(|error| io::Error::new(io::ErrorKind::InvalidInput, error.to_string()))?;
-        fs::create_dir_all(&self.root)?;
-        reject_existing_symlink_in_path(&self.root)
-            .map_err(|error| io::Error::new(io::ErrorKind::InvalidInput, error.to_string()))?;
-        let metadata = fs::symlink_metadata(&self.root)?;
-        if metadata.file_type().is_symlink() || !metadata.is_dir() {
-            return Err(io::Error::new(
-                io::ErrorKind::InvalidInput,
-                "ACME HTTP-01 challenge root is not a real directory",
-            ));
+        #[cfg(unix)]
+        {
+            crate::acme_directory::create_private_directory_all(&self.root)?;
+            Ok(())
+        }
+
+        #[cfg(not(unix))]
+        {
+            reject_existing_symlink_in_path(&self.root)
+                .map_err(|error| io::Error::new(io::ErrorKind::InvalidInput, error.to_string()))?;
+            fs::create_dir_all(&self.root)?;
+            reject_existing_symlink_in_path(&self.root)
+                .map_err(|error| io::Error::new(io::ErrorKind::InvalidInput, error.to_string()))?;
+            let metadata = fs::symlink_metadata(&self.root)?;
+            if metadata.file_type().is_symlink() || !metadata.is_dir() {
+                return Err(io::Error::new(
+                    io::ErrorKind::InvalidInput,
+                    "ACME HTTP-01 challenge root is not a real directory",
+                ));
+            }
+            Ok(())
         }
-        Ok(())
     }
 
     fn token_path(&self, token: &str) -> io::Result<PathBuf> {