[HackTuah]

What (Linear SCR-450, input to the slice 54 security review)

The server's word list could be read by other accounts on a shared computer: kotiko.db, its -wal/-shm, migration backups, models-cache.json, and a new data folder all followed the process umask. Now they're private, at the root and in depth:

• Checked first, empirically, with exqlite: SQLite gives -wal/-shm/-journal the database's mode when it creates them. So the database is created empty at 0600 before SQLite opens it, and the others follow. VACUUM INTO into an existing empty 0600 file keeps 0600.
• New Kotiko.Private. The BEAM can't create a file with a mode, so the code creates empty 0600 files, writes through a private temp file and renames, and makes new folders 0700. The token, the model cache, the db, the partial copy and the backups all use it.
• At every start, before the db opens (DataDir.make_private/1):
  • Kotiko's own files are tightened to 0600 and backups/ to 0700, with one warning listing what changed.
  • The folder becomes 0700 only if everything in it is Kotiko's. A folder with other files in it, or a link, may be shared on purpose (KOTIKO_DATA_DIR=~), so it's left alone and a warning gives the chmod. A disk that ignores modes (WSL /mnt/c) gets one warning.
  • The server never refuses to start over this.
• run.sh sets umask 077, and the systemd unit gets UMask=0077. Re-running install-service.sh picks this up, and the CHANGELOG says so.
• Existing installs: on the first start after updating, the files are tightened. Nothing moves and nothing is deleted.

Tests (each fails without the fix; verified by breaking it on purpose)

• private_test.exs covers the helpers, and the SQLite behaviour this relies on.
• data_dir_test.exs has 6 make_private cases, including the exact warning text.
• Config, token, catalog and script tests:
  • run.sh gives mix umask 0077 even from a 022 shell;
  • the unit has UMask=0077.
• The boot test starts from umask 022 and checks 700 600 600 600 600 (folder, db, -wal, -shm, token) while running.

Docs: the assurance case (gap closed, new residual risk: a shared folder stays shared), the security requirements, configuration.md ("Files in the data folder"), the site's server page, the CHANGELOG and slice 29.

Checked

• Server: mix format, compile --warnings-as-errors and credo --strict pass. mix test --warnings-as-errors --cover: 1106 tests, 23 properties, 0 failures, 91.68 %. mix sobelow: exit 0.
• Other: shellcheck, check-old-name, bestpractices-links --check, reuse lint, and site npm test / npm run check all pass.

Known and left for later (recorded for slice 54)

• mix kotiko.export --output writes the export with the shell's umask.
• When the server isn't started by run.sh or the unit, a new, still-empty file has the umask mode for a moment before its chmod.

🤖 Generated with Claude Code