stackchain/stackchain-dashboard
1
0
Fork 0
Code Issues 9 Pull Requests 1 Actions Packages Projects Releases 713 Wiki Activity

Harden private SQLite state filesystem boundaries #891

New Issue
Closed
opened 2026-08-15 12:22:40 +00:00 by timmy · 0 comments
timmy commented 2026-08-15 12:22:40 +00:00
Owner
Copy Link

Evidence

Private operator state databases are created with inconsistent filesystem protection. Current store constructors for Today, Later, saved searches, drafts, security events, and idempotency create parent directories/connect directly, while only a subset of stores enforce private modes. Under a normal umask 022, sensitive issue drafts, work history, searches, device labels, and mutation receipts can remain mode 0644. No historical issue title or recent commit covers a shared private-state filesystem boundary.

Product/security slice

Introduce one shared private SQLite path guard and adopt it across every durable private store. The guard must create/repair the state directory to 0700, create/repair database plus SQLite WAL/SHM sidecars to 0600, reject symlink database paths, and preserve existing store behavior. This protects the full signed-in/offline workflow without requiring operators to tune umask.

Acceptance tests

  • Under umask 022, each private store creates its directory as 0700 and database as 0600.
  • Opening a pre-existing permissive database repairs its mode without losing rows.
  • WAL and SHM sidecars are 0600 while a WAL connection is active.
  • A symlink database path is rejected before SQLite reads or writes the target.
  • Existing store-focused tests and the full suite pass.
  • Documentation states the enforced filesystem boundary and its limits (host access/backups still require encryption controls).
## Evidence Private operator state databases are created with inconsistent filesystem protection. Current store constructors for Today, Later, saved searches, drafts, security events, and idempotency create parent directories/connect directly, while only a subset of stores enforce private modes. Under a normal `umask 022`, sensitive issue drafts, work history, searches, device labels, and mutation receipts can remain mode `0644`. No historical issue title or recent commit covers a shared private-state filesystem boundary. ## Product/security slice Introduce one shared private SQLite path guard and adopt it across every durable private store. The guard must create/repair the state directory to `0700`, create/repair database plus SQLite WAL/SHM sidecars to `0600`, reject symlink database paths, and preserve existing store behavior. This protects the full signed-in/offline workflow without requiring operators to tune umask. ## Acceptance tests - Under `umask 022`, each private store creates its directory as `0700` and database as `0600`. - Opening a pre-existing permissive database repairs its mode without losing rows. - WAL and SHM sidecars are `0600` while a WAL connection is active. - A symlink database path is rejected before SQLite reads or writes the target. - Existing store-focused tests and the full suite pass. - Documentation states the enforced filesystem boundary and its limits (host access/backups still require encryption controls).
timmy self-assigned this 2026-08-15 12:22:40 +00:00
timmy closed this issue 2026-08-15 12:33:36 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels   
P0

Drop everything

  
P1

High priority

  
P2

Medium priority

  
agent:nightprowl

Assignments routed to the LongCat NightProwl evaluation worker

  
backend

Backend service

  
ci

Continuous integration / actions

  
frontend

Frontend / UI

  
meta

Meta / planning

  
pages

Gitea Pages

  
template

Repo template / standards

No Label
P0
P1
P2
agent:nightprowl
backend
ci
frontend
meta
pages
template
Milestone
Clear milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
No Assignees
timmy
1 Participants
Notifications
Due Date
The due date is invalid or out of range. Please use the format 'yyyy-mm-dd'.

No due date set.

Dependencies

No dependencies set.

Reference: stackchain/stackchain-dashboard#891
No description provided.
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?