search

status-im / nimbus-eth2

Nim implementation of the Ethereum Beacon Chain
https://nimbus.guide
Other
527 stars 229 forks source link

[SEC] There no more warning about insecure file/folder permissions for sensitive files/folders. #2115

Open cheatfate opened 3 years ago

cheatfate commented 3 years ago

According to previous audit review issues:

nimbus beacon node MUST

check and warn if file permissions are set insecurely

Warn if secret material is loaded from an unsafe configuration (file/folder perms are not matching expected security)

But right now beacon-node silently updates folder/file permissions without any warning in https://github.com/status-im/nimbus-eth2/pull/1922 without proper consensus.

stefantalpalaru commented 3 years ago

without proper consensus

How much does uninformed consensus matter?

There is no attack scenario in which the attacker benefits from changing directory permissions, but is thwarted by the program refusing to restart at some point in the future.