fix: set IPC socket permissions to 0600 for security by jdx · Pull Request #133 · jdx/pitchfork

jdx · 2026-01-19T02:40:42Z

Summary

Set Unix socket permissions to 0600 (owner read/write only) after creation
Prevents unauthorized local users from connecting to the supervisor
Uses #[cfg(unix)] to ensure it only runs on Unix platforms

Security

Previously, the IPC socket was created with default permissions, which could allow any local user to connect and control daemons. This change restricts access to the socket owner only.

Test plan

Build passes
All tests pass
Verify socket permissions after starting supervisor: ls -la ~/.local/state/pitchfork/ipc/main.sock

🤖 Generated with Claude Code

Note

Secures IPC socket creation on Unix by enforcing restrictive permissions at creation time.

Temporarily sets process umask to 0o077 around ListenerOptions::create_tokio() to ensure the socket is created with 0600, then restores the original umask
Refactors socket initialization to capture the listener result before converting with into_diagnostic()
Adds libc under [target.'cfg(unix)'.dependencies] for umask

^{Written by Cursor Bugbot for commit 91ac10f. This will update automatically on new commits. Configure here.}

The Unix socket was created with default permissions, allowing any local user to potentially connect to the supervisor. Now the socket is restricted to owner read/write only (0600), preventing unauthorized local access. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

cursor

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

src/ipc/server.rs

Instead of creating the socket with default permissions and then changing them (which has a brief window where an attacker could connect), set a restrictive umask (0077) before creating the socket so it's created with 0600 permissions from the start. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

cursor

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

src/ipc/server.rs

cursor · 2026-01-19T02:53:33Z

src/ipc/server.rs

+        #[cfg(unix)]
+        unsafe {
+            libc::umask(old_umask);
+        }


Process-wide umask affects concurrent file operations

Medium Severity

The umask system call affects the entire process, not just the current thread. In the tokio multi-threaded runtime, other async tasks (web server, interval_watch, cron_watch, signals) are already running when IpcServer::new() is called. Any file or directory creation by these concurrent tasks during the umask manipulation window will unexpectedly receive restrictive 0600/0700 permissions instead of normal permissions, potentially causing functionality issues.

Capture the result of create_tokio() before restoring umask, then propagate any error afterward. This ensures the process umask is always restored to its original value. Also added a note explaining that IpcServer::new() runs during supervisor startup before other async tasks, so the brief umask change won't affect concurrent operations. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

## 🤖 New release * `pitchfork-cli`: 0.3.0 -> 0.3.1 <details><summary>Changelog</summary> <blockquote> ## [0.3.1](v0.3.0...v0.3.1) - 2026-01-19 ### Added - implement daemon dependency resolution ([#135](#135)) - add restart command to CLI ([#134](#134)) ### Fixed - restart command preserves daemon dependency configuration ([#142](#142)) - add missing depends field to restart command ([#136](#136)) - set IPC socket permissions to 0600 for security ([#133](#133)) - handle shell command parsing errors instead of silently failing ([#132](#132)) ### Other - reduce unnecessary daemon cloning in loops ([#144](#144)) - use periodic log flushing instead of per-line ([#139](#139)) - refresh only tracked PIDs instead of all processes ([#141](#141)) - cache compiled regex patterns ([#143](#143)) ### Security - add rate limiting to IPC server ([#137](#137)) - canonicalize config paths to prevent symlink exploitation ([#138](#138)) - add centralized daemon ID validation ([#140](#140)) </blockquote> </details> --- This PR was generated with [release-plz](https://github.com/release-plz/release-plz/).  --- > [!NOTE] > Prepares the 0.3.1 release and updates metadata/documentation accordingly. > > - **Changelog**: Adds `0.3.1` entry detailing added dependency resolution, new `restart` command, fixes, performance tweaks, and security hardening > - **Version bumps**: Updates `version` to `0.3.1` in `Cargo.toml`, `Cargo.lock`, `docs/cli/commands.json`, `docs/cli/index.md`, and `pitchfork.usage.kdl` > - **Docs regen**: Refreshes CLI docs/spec to reflect the new version (no behavioral changes in this diff) > > Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 9f9d386. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).  --------- Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

## 🤖 New release * `pitchfork-cli`: 1.0.0 <details><summary>Changelog</summary> <blockquote> ## [1.0.0](https://github.com/jdx/pitchfork/releases/tag/v1.0.0) - 2026-01-19 ### Added - implement daemon dependency resolution ([#135](#135)) - add restart command to CLI ([#134](#134)) ### Fixed - restart command preserves daemon dependency configuration ([#142](#142)) - add missing depends field to restart command ([#136](#136)) - set IPC socket permissions to 0600 for security ([#133](#133)) - handle shell command parsing errors instead of silently failing ([#132](#132)) ### Other - bump version to 1.0.0 ([#147](#147)) - release v0.3.1 ([#121](#121)) - reduce unnecessary daemon cloning in loops ([#144](#144)) - use periodic log flushing instead of per-line ([#139](#139)) - refresh only tracked PIDs instead of all processes ([#141](#141)) - cache compiled regex patterns ([#143](#143)) ### Security - add rate limiting to IPC server ([#137](#137)) - canonicalize config paths to prevent symlink exploitation ([#138](#138)) - add centralized daemon ID validation ([#140](#140)) </blockquote> </details> --- This PR was generated with [release-plz](https://github.com/release-plz/release-plz/).  --- > [!NOTE] > Prepares the 1.0.0 release and updates `CHANGELOG.md` with the finalized notes. > > - Adds `1.0.0` section: daemon dependency resolution, new CLI `restart` command, fixes for dependency preservation and shell parsing, secure IPC socket perms, plus performance/maintenance updates > - Documents security hardening: IPC rate limiting, config path canonicalization, centralized daemon ID validation > - Retains prior `0.3.1` notes for historical context > > Written by [Cursor Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit 4182984. This will update automatically on new commits. Configure [here](https://cursor.com/dashboard?tab=bugbot).

cursor bot reviewed Jan 19, 2026

View reviewed changes

src/ipc/server.rs Show resolved Hide resolved

cursor bot reviewed Jan 19, 2026

View reviewed changes

jdx merged commit a69c3e6 into main Jan 19, 2026
4 checks passed

jdx deleted the fix/ipc-socket-permissions branch January 19, 2026 03:10

jdx mentioned this pull request Jan 19, 2026

chore: release v0.3.1 #121

Merged

jdx mentioned this pull request Jan 19, 2026

chore: release v1.0.0 #148

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: set IPC socket permissions to 0600 for security#133

fix: set IPC socket permissions to 0600 for security#133
jdx merged 3 commits intomainfrom
fix/ipc-socket-permissions

jdx commented Jan 19, 2026 •

edited by cursor bot

Loading

Uh oh!

cursor bot left a comment

Uh oh!

Uh oh!

cursor bot left a comment

Uh oh!

Uh oh!

cursor bot Jan 19, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

jdx commented Jan 19, 2026 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Security

Test plan

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

cursor bot Jan 19, 2026

Choose a reason for hiding this comment

Process-wide umask affects concurrent file operations

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

jdx commented Jan 19, 2026 •

edited by cursor bot

Loading