From 62b68cc461b5e298add3ab190fe9a38f3efefe7a Mon Sep 17 00:00:00 2001
From: murilo ijanc
Date: Wed, 25 Mar 2026 15:26:44 -0300
Subject: Harden identity key permissions, atomic writes, and HTTP method

- Write identity.key with mode 0600 to prevent other users from
  reading the Ed25519 private seed
- Use destination filename in atomic_write temp path to avoid
  collisions between concurrent writes to different files
- Reject HTTP methods other than GET/HEAD with 405
- Return "Hello Tesseras World" on GET /
---
 src/bin/tpd.rs | 28 ++++++++++++++++++++++++----
 1 file changed, 24 insertions(+), 4 deletions(-)

(limited to 'src/bin')

diff --git a/src/bin/tpd.rs b/src/bin/tpd.rs
index 54dbd7f..a1edf79 100644
--- a/src/bin/tpd.rs
+++ b/src/bin/tpd.rs
@@ -308,14 +308,34 @@ fn load_or_create_identity(path: &std::path::Path) -> Vec<u8> {
     }
     let mut seed = [0u8; 32];
     tesseras_dht::sys::random_bytes(&mut seed);
-    if let Err(e) = std::fs::write(path, seed) {
-        log::warn!("identity: failed to save to {}: {e}", path.display());
-    } else {
-        log::info!("identity: generated new keypair at {}", path.display());
+    match write_private_file(path, &seed) {
+        Ok(()) => {
+            log::info!("identity: generated new keypair at {}", path.display());
+        }
+        Err(e) => {
+            log::warn!("identity: failed to save to {}: {e}", path.display());
+        }
     }
     seed.to_vec()
 }
 
+/// Write data to a file with mode 0600 (owner read/write only).
+fn write_private_file(
+    path: &std::path::Path,
+    data: &[u8],
+) -> std::io::Result<()> {
+    use std::io::Write;
+    use std::os::unix::fs::OpenOptionsExt;
+    let mut f = std::fs::OpenOptions::new()
+        .write(true)
+        .create(true)
+        .truncate(true)
+        .mode(0o600)
+        .open(path)?;
+    f.write_all(data)?;
+    f.sync_all()
+}
+
 const SIGINT: i32 = 2;
 const SIGTERM: i32 = 15;
 
-- 
cgit v1.2.3