From b2f8f14b2e7dfc4a82a56901bb2f994daed670e0 Mon Sep 17 00:00:00 2001 From: Dominik Jain Date: Thu, 17 Sep 2026 13:17:53 +0200 Subject: [PATCH] Restrict configuration file permissions on POSIX - Set configuration permissions to 0600 before reading and log adjustments. - Log chmod failures and continue loading; leave Windows permissions unchanged. --- src/serena/config/serena_config.py | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/serena/config/serena_config.py b/src/serena/config/serena_config.py index de47c016..976c3304 100644 --- a/src/serena/config/serena_config.py +++ b/src/serena/config/serena_config.py @@ -7,6 +7,7 @@ import dataclasses import os import re import shutil +import stat import threading from collections.abc import Iterator, Sequence from copy import deepcopy @@ -1122,6 +1123,17 @@ class SerenaConfig(SharedConfig, ModeSelectionDefinitionWithBaseModes): log.info(f"Serena configuration file not found at {config_file_path}, autogenerating...") cls._generate_config_file(config_file_path) + # restrict access to the owner's read/write permissions (as the config file contains secrets) + if os.name == "posix": + current_mode = stat.S_IMODE(os.stat(config_file_path).st_mode) + if current_mode != 0o600: + try: + os.chmod(config_file_path, 0o600) + except Exception as e: + log.error("Failed to restrict permissions of Serena configuration %s to 0600: %s", config_file_path, e) + else: + log.info("Changed permissions of Serena configuration %s from %04o to 0600", config_file_path, current_mode) + # load the configuration log.info(f"Loading Serena configuration from {config_file_path}") try: