danvics/zerobyte
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 1

fix: enforce 0o600 permissions on sensitive files by unlinking before write

Browse source 
Unlink any existing file before writing in writeFileWithMode so the
mode option is always applied on fresh file creation (Node.js ignores
mode for existing files). This prevents inheriting wrong permissions
on Docker bind-mount filesystems such as Synology NAS where ACLs can
cause SSH key files to be created with 755 instead of 600.

The fs.unlink error is only swallowed for ENOENT (file doesn't exist);
other errors (e.g. EPERM) propagate as before. The chmod call is kept
as an additional safety net against umask effects.

A test for the new-file creation case is added alongside the existing
existing-file rewrite test.

Agent-Logs-Url: https://github.com/mowdep/zerobyte/sessions/2a4ab129-9668-402e-8687-d792f9b9e704

Co-authored-by: mowdep <10937987+mowdep@users.noreply.github.com>
This commit is contained in:
copilot-swe-agent[bot] 2026-05-10 22:08:51 +00:00 committed by GitHub
parent a58fe82d48
commit 1b8d8e670d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 19 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
packages/core/src/node/__tests__/fs.test.ts
View file

@ -16,6 +16,18 @@ afterEach(async () => {
});
describe("writeFileWithMode", () => {
test("applies the requested mode when creating a new file", async () => {
const tempDirectory = await fs.mkdtemp(path.join(os.tmpdir(), "zerobyte-write-file-with-mode-"));
tempDirectories.add(tempDirectory);
const filePath = path.join(tempDirectory, "identity");
await writeFileWithMode(filePath, "content", FILE_MODES.ownerReadWrite);
expect(await fs.readFile(filePath, "utf8")).toBe("content");
expect((await fs.stat(filePath)).mode & 0o777).toBe(0o600);
});
test("applies the requested mode even when rewriting an existing file", async () => {
const tempDirectory = await fs.mkdtemp(path.join(os.tmpdir(), "zerobyte-write-file-with-mode-"));
tempDirectories.add(tempDirectory);

7
packages/core/src/node/fs.ts
View file

@ -7,6 +7,13 @@ export const FILE_MODES = {
type FileMode = (typeof FILE_MODES)[keyof typeof FILE_MODES];
export const writeFileWithMode = async (filePath: string, data: string, mode: FileMode) => {
// Remove any existing file first so the mode option on writeFile is always applied
// on a fresh file creation (mode is ignored for existing files). This also avoids
// inheriting incorrect permissions from a previously-created file on filesystems
// where chmod may not behave as expected (e.g. Docker bind-mounts on some NAS systems).
await fs.unlink(filePath).catch((error: NodeJS.ErrnoException) => {
if (error.code !== "ENOENT") throw error;
});
await fs.writeFile(filePath, data, { mode });
await fs.chmod(filePath, mode);
};