mirror of
https://github.com/Chia-Network/chia-blockchain.git
synced 2026-09-05 02:24:21 -05:00
Jeff CruikshankandGitHub
39fbe2aa17
* Create directories with 755 permissions, SSL certs with 644, and keys with 600. * Check SSL file permissions during chia_init(). Exits if permissions are incorrect. * Overwrite certs/keys instead of failing to write * Skip SSL file permission checks on Windows (requires checking ACLs) * Check SSL file permissions when creating an ssl_context * Skip check_ssl on Windows. Handle some SSLInvalidPermissions exceptions. * Added a few comments * Added chia init --fix-ssl-permissions option to attempt to fix SSL file permission issues. Update imported cert permissions when using chia init -c. Code cleanup/restructuring. * Return a tuple instead of a list * LGTM and other minor fixes * Fixed SSL test breakage when calling ssl_context_for_client. The ca_crt param was being passed in as both the cert and private key, triggering the permission check failure. * Don't exit if SSL file permissions issues are found * Tweak the exception types that are raised from traverse_dict
21 lines
539 B
Python
21 lines
539 B
Python
import os
|
|
from pathlib import Path
|
|
from typing import Tuple
|
|
|
|
|
|
def verify_file_permissions(path: Path, mask: int) -> Tuple[bool, int]:
|
|
"""
|
|
Check that the file's permissions are properly restricted, as compared to the
|
|
permission mask
|
|
"""
|
|
if not path.exists():
|
|
raise Exception(f"file {path} does not exist")
|
|
|
|
mode = os.stat(path).st_mode & 0o777
|
|
return (mode & mask == 0, mode)
|
|
|
|
|
|
def octal_mode_string(mode: int) -> str:
|
|
"""Yields a permission mode string: e.g. 0644"""
|
|
return f"0{oct(mode)[-3:]}"
|