@cryptotaxi247 / netdata-1 / commits / d6029b8bb

Fix based on Coverity and Sonar audits (part 3) (#22331)

* api: tighten management API key file permissions to 0600 Sonar c:S2612 (MAJOR vulnerability): the management API key file was created with `open(..., O_WRONLY|O_CREAT|O_TRUNC|O_CLOEXEC, 444)`. The literal `444` is decimal, not octal, which equals octal 0674 = rw-rwxr--. Group gets read+write+execute and others get read on a file that stores the management API key (a UUID granting admin endpoint access). Anyone with local read on the host can lift the key. Even if the original intent was octal `0444` (world-readable), a secret-key file should not be readable by group or others. Use `0600` (owner read+write only), the standard mode for secrets. * file_lock: tighten lock file creation mode from 0666 to 0600 Sonar c:S2612: file_lock_get() created the advisory lock file with mode 0666 (rw-rw-rw-). Netdata runs as a single dedicated user, so group/other access is unnecessary and adds latent risk if any local user can interfere with the lock file. flock(2) is purely advisory and does not enforce by mode, but the open() permission still controls who can create/access the file. Owner-only 0600 keeps the locking behavior intact for the netdata user while preventing unrelated local users from creating or opening the file. The function is currently unused (its caller in src/daemon/main.c is commented out), but it is exposed in the public header and may be revived for single-instance enforcement; tightening the default now avoids carrying permissive bits forward. * listen-sockets: drop misleading exec bit from UNIX socket chmod (0777 -> 0666) Sonar c:S2612: create_listen_socket_unix() chmod'd the bound UNIX socket file to 0777. For UNIX domain socket files only the read/write permissions affect client connect() access -- the execute bit is unused. 0777 and 0666 are functionally identical for socket connect. Both callers (web API and statsd) intentionally allow arbitrary local clients to connect, so the broad rw permission is preserved with 0666. The execute bit was misleading and unnecessary; remove it and update the explanatory comment. --------- Co-authored-by: Costa Tsaousis <costa@netdata.cloud>

Stelios Fragkakis committed May 7, 2026 at 00:42 UTC d6029b8bb7cb61d7803b3ac828fe1edc0f1d5e75

3 files changed +4 -5

src/libnetdata/os/file_lock.c

+1 -1

@@ -18,7 +18,7 @@ FILE_LOCK file_lock_get(const char *filename) {

19 #if defined(OS_LINUX) || defined(OS_FREEBSD) || defined(OS_MACOS)

20 // Try to create a new file, or open existing one

21 - int fd = open(filename, O_RDWR | O_CREAT, 0666);

21 + int fd = open(filename, O_RDWR | O_CREAT, 0600);

22 if(fd == -1)

23 return FILE_LOCK_INVALID;

src/libnetdata/socket/listen-sockets.c

+2 -3

@@ -98,9 +98,8 @@ static int create_listen_socket_unix(const char *path, int listen_backlog) {

98 return -1;

99 }

100

101 - // we have to chmod this to 0777 so that the client will be able

102 - // to read from and write to this socket.

103 - if(chmod(path, 0777) == -1)

101 + // Clients need read and write permissions to connect to this socket.

102 + if(chmod(path, 0666) == -1)

103 nd_log(NDLS_DAEMON, NDLP_ERR,

104 "LISTENER: failed to chmod() socket file '%s'.",

105 path);

src/web/api/v1/api_v1_manage.c

+1 -1

@@ -40,7 +40,7 @@ static char *get_mgmt_api_key(void) {

40 guid[GUID_LEN] = '\0';

42 // save it

43 - fd = open(api_key_filename, O_WRONLY|O_CREAT|O_TRUNC | O_CLOEXEC, 444);

43 + fd = open(api_key_filename, O_WRONLY|O_CREAT|O_TRUNC | O_CLOEXEC, 0600);

44 if(fd == -1) {

45 netdata_log_error("Cannot create unique management API key file '%s'. Please adjust config parameter 'netdata management api key file' to a proper path and file.", api_key_filename);

46 goto temp_key;