From 9d204abfae4cfa3970b2a281eb676c995f5ade06 Mon Sep 17 00:00:00 2001 From: SomberNight Date: Mon, 23 Mar 2026 17:57:27 +0000 Subject: [PATCH] daemon: set restrictive permission on RPC-server unix domain socket 0600 instead of 0775. --- electrum/daemon.py | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/electrum/daemon.py b/electrum/daemon.py index a8fc2ceb1..12c7fbdea 100644 --- a/electrum/daemon.py +++ b/electrum/daemon.py @@ -34,6 +34,7 @@ from typing import Dict, Optional, Tuple, Callable, Union, Sequence, Mapping, TY from base64 import b64decode, b64encode import json import socket +import stat import aiohttp from aiohttp import web, client_exceptions @@ -43,7 +44,7 @@ from . import util from .network import Network from .util import ( json_decode, to_bytes, to_string, profiler, standardize_path, constant_time_compare, InvalidPassword, - log_exceptions, randrange, OldTaskGroup, UserFacingException, JsonRPCError + log_exceptions, randrange, OldTaskGroup, UserFacingException, JsonRPCError, os_chmod ) from .wallet import Wallet, Abstract_Wallet from .storage import WalletStorage @@ -327,6 +328,12 @@ class CommandsServer(AuthenticatedServer): await site.start() except Exception as e: raise Exception(f"failed to start CommandsServer at {self._socket_config_str()}. got exc: {e!r}") from None + # now server has started. + if self.socktype == 'unix': + # set restrictive permissions on unix domain socket. + # FIXME race? we are late. should set this during socket-file creation but aiohttp API does not let us. + os_chmod(self.sockpath, stat.S_IREAD | stat.S_IWRITE) + # write server conn details into lockfile fd if self.socktype == 'unix': addr = self.sockpath elif self.socktype == 'tcp':