devs/cproof
1
2
Fork 1
Code Issues 43 Pull Requests 10 Actions Packages Projects 1 Releases Wiki Activity

security: protect local data at rest (issue #146) #172

Open
jabber.developer2 wants to merge 1 commits from fix/data-at-rest-hardening into master
pull from: fix/data-at-rest-hardening
merge into: devs:master
Conversation 0 Commits 1 Files Changed 17 +370 -12

1 Commits

Author SHA1 Message Date
jabber.developer2
b63a9d29f8 security: protect local data at rest (issue #146)
All checks were successful
CI Code / Check spelling (pull_request) Successful in 15s
Details
CI Code / Check coding style (pull_request) Successful in 26s
Details
CI Code / Linux (debian) (pull_request) Successful in 5m3s
Details
CI Code / Linux (arch) (pull_request) Successful in 6m25s
Details
CI Code / Linux (ubuntu) (pull_request) Successful in 8m1s
Details
CI Code / Code Coverage (pull_request) Successful in 9m27s
Details 
T03 — keep secrets out of profanity.log:
- new redact_secrets() helper (common.c) masks the content of SASL
  auth/response/challenge/success and <password> elements; applied in
  the libstrophe logger (_xmpp_file_logger) and the stderr-to-log
  bridge (REQ-DAR-03, REQ-LOG-06)
- _add_to_db() no longer logs decrypted message bodies or the full
  INSERT statement (REQ-DAR-03)

T07 — owner-only permissions on key material and history (REQ-AUTH-01):
- chmod 0600 on chatlog.db after open (journal/WAL files inherit)
- chmod 0600 on OTR keys.txt and fingerprints.txt after every write
- parent dirs are already 0700 (create_dir); this is defense in depth

T08 — integrity before trust:
- PRAGMA quick_check(1) gates every chatlog.db open; on failure the
  DB stays closed, the user is warned once in the console and the
  session continues without history (REQ-RES-02)
- OMEMO aesgcm downloads decrypt into a 0600 tempfile next to the
  target and rename it into place only after the GCM tag verifies;
  the open-command hook no longer runs on failed decryption
  (REQ-CRY-06)

Tests: redact_secrets unit tests; AES-256-GCM roundtrip and
tampered-tag/ciphertext unit tests (crypto.c now linked into
unittests under BUILD_OMEMO); functional test planting a corrupt
chatlog.db and asserting graceful degradation.

Closes #146
 2026-07-21 10:25:31 +03:00