Lab: find out who else can read your config

Before encryption, before vaults, before any of it, there is a plainer question about a secret on disk: which accounts on this machine can open it. The answer is usually decided by a setting nobody chose deliberately.

1. 1

   Create a config file the ordinary way and look at what the system gave it.

   bash Copy

   mkdir -p /tmp/permlab && cd /tmp/permlab
   printf 'STRIPE_KEY=sk-live-9f2a\n' > cfg.env
   ls -l cfg.env

2. 2

   On most systems that is -rw-r--r--, which is world-readable. Check the umask that decided it.

   bash Copy

   umask
   # 022 -> new files are 644, readable by every account on the box

3. 3

   Restrict it, and confirm.

   bash Copy

   chmod 600 cfg.env
   ls -l cfg.env
   # -rw-------

4. 4

   Now check the directory, which people forget. A file nobody can read is still listed by anyone who can traverse the directory, and filenames leak too.

   bash Copy

   ls -ld .
   chmod 700 .
   ls -ld .

5. 5

   Clean up.

   bash Copy

   cd /tmp && rm -rf permlab

Nothing here is exotic. A default umask of 022 means every file you create is readable by every account on the machine, and on a shared build agent, a jump host, or a container with more than one user, that is a real set of people.

• 600 on the file is the baseline for anything holding a credential. The 1Claw local vault writes its file that way for exactly this reason.
• 700 on the directory matters separately. Permissions on a file do not stop someone listing the directory and learning that stripe-prod.env exists.
• Backups, editors and archive tools frequently create siblings with default permissions. A carefully chmodded file next to a world-readable cfg.env.swp has achieved nothing.