Merge pull request #2572 from freeacetone/key-files-owner-only

i2p::fs::CreatePrivateFile

daemon/I2PControl.cpp

@@ -527,6 +527,7 @@ namespace client
 		X509_free (x509);
 
 		// save key
+		i2p::fs::CreatePrivateFile (key_path);
 		if ((f = fopen (key_path, "wb")) != NULL)
 		{
 			LogPrint (eLogInfo, "I2PControl: saving cert key to ", key_path);

libi2pd/Destination.cpp

@@ -1549,7 +1549,7 @@ namespace client
 		memset (keys->pub.data (), 0, keys->pub.size ());
 		keys->GenerateKeys ();
 
-		std::ofstream f1 (path, std::ofstream::binary | std::ofstream::out);
+		std::ofstream f1 (i2p::fs::CreatePrivateFile (path), std::ofstream::binary | std::ofstream::out);
 		if (f1)
 		{
 			f1.write ((char *)keys->pub.data (), keys->pub.size ());

libi2pd/FS.cpp

@@ -302,6 +302,17 @@ namespace fs {
 		return fs_lib::create_directory(path);
 	}
 
+	std::filesystem::path CreatePrivateFile (const std::filesystem::path& path)
+	{
+		std::ofstream f (path, std::ofstream::out | std::ofstream::app);
+		std::error_code ec;
+		std::filesystem::permissions (path, std::filesystem::perms::owner_read | std::filesystem::perms::owner_write,
+			std::filesystem::perm_options::replace, ec);
+		if (ec)
+			LogPrint (eLogWarning, "FS: Can't restrict access to ", path.string (), ": ", ec.message ());
+		return path;
+	}
+
 	void HashedStorage::SetPlace(const std::string &path) {
 		root = path + i2p::fs::dirSep + name;
 	}

libi2pd/FS.h

@@ -14,6 +14,7 @@
 #include <iostream>
 #include <sstream>
 #include <functional>
+#include <filesystem>
 #include <inttypes.h>
 
 #ifndef STD_FILESYSTEM
@@ -151,6 +152,7 @@ namespace fs {
 	uint32_t GetLastUpdateTime (const std::string & path); // seconds since epoch
 
 	bool CreateDirectory (const std::string& path);
+	std::filesystem::path CreatePrivateFile (const std::filesystem::path& path);
 
 	template<typename T>
 	void _ExpandPath(std::stringstream & path, T c) {

libi2pd/Garlic.cpp

@@ -955,7 +955,7 @@ namespace garlic
 		if (m_Tags.empty ()) return;
 		std::string ident = GetIdentHash().ToBase32();
 		std::string path  = i2p::fs::DataDirPath("tags", (ident + ".tags"));
-		std::ofstream f (path, std::ofstream::binary | std::ofstream::out | std::ofstream::trunc);
+		std::ofstream f (i2p::fs::CreatePrivateFile (path), std::ofstream::binary | std::ofstream::out | std::ofstream::trunc);
 		uint32_t ts = i2p::util::GetSecondsSinceEpoch ();
 		// 4 bytes timestamp, 32 bytes tag, 32 bytes key
 		for (auto it: m_Tags)

libi2pd/RouterContext.cpp

@@ -309,7 +309,7 @@ namespace i2p
 		memcpy (m_NTCP2Keys->staticPublicKey, m_NTCP2StaticKeys->GetPublicKey (), 32);
 		RAND_bytes (m_NTCP2Keys->iv, 16);
 		// save
-		std::ofstream fk (i2p::fs::DataDirPath (NTCP2_KEYS), std::ofstream::binary | std::ofstream::out);
+		std::ofstream fk (i2p::fs::CreatePrivateFile (i2p::fs::DataDirPath (NTCP2_KEYS)), std::ofstream::binary | std::ofstream::out);
 		fk.write ((char *)m_NTCP2Keys.get (), sizeof (NTCP2PrivateKeys));
 	}
 
@@ -322,7 +322,7 @@ namespace i2p
 		memcpy (m_SSU2Keys->staticPublicKey, m_SSU2StaticKeys->GetPublicKey (), 32);
 		RAND_bytes (m_SSU2Keys->intro, 32);
 		// save
-		std::ofstream fk (i2p::fs::DataDirPath (SSU2_KEYS), std::ofstream::binary | std::ofstream::out);
+		std::ofstream fk (i2p::fs::CreatePrivateFile (i2p::fs::DataDirPath (SSU2_KEYS)), std::ofstream::binary | std::ofstream::out);
 		fk.write ((char *)m_SSU2Keys.get (), sizeof (SSU2PrivateKeys));
 	}
 
@@ -1246,7 +1246,7 @@ namespace i2p
 	void RouterContext::SaveKeys ()
 	{
 		// save in the same format as .dat files
-		std::ofstream fk (i2p::fs::DataDirPath (ROUTER_KEYS), std::ofstream::binary | std::ofstream::out);
+		std::ofstream fk (i2p::fs::CreatePrivateFile (i2p::fs::DataDirPath (ROUTER_KEYS)), std::ofstream::binary | std::ofstream::out);
 		size_t len = m_Keys.GetFullLen ();
 		uint8_t * buf = new uint8_t[len];
 		m_Keys.ToBuffer (buf, len);

libi2pd_client/ClientContext.cpp

@@ -323,7 +323,7 @@ namespace client
 		{
 			LogPrint (eLogInfo, "Clients: Can't open file ", fullPath, " Creating new one with signature type ", sigType, " crypto type ", cryptoType);
 			keys = i2p::data::PrivateKeys::CreateRandomKeys (sigType, cryptoType, true);
-			std::ofstream f (fullPath, std::ofstream::binary | std::ofstream::out);
+			std::ofstream f (i2p::fs::CreatePrivateFile (fullPath), std::ofstream::binary | std::ofstream::out);
 			size_t len = keys.GetFullLen ();
 			uint8_t * buf = new uint8_t[len];
 			len = keys.ToBuffer (buf, len);