blockyard 0.1.0 → 0.1.2

package/server/rpc/client.js

@@ -34,6 +34,34 @@ import http from 'node:http';
 import https from 'node:https';
 import { resolveCookie } from '../config.js';
 
+
+/**
+ * A file path as it may be shown to a viewer (audit 2026-09-16, L11): its last two parts, which say
+ * which cookie or log it is (`main/.cookie`, `bitcoin/debug.log`) without the directories above --
+ * a home directory in them names the account the node runs as, and in open mode anyone who can
+ * reach the port reads these responses.
+ */
+export function shortPath(p) {
+  if (typeof p !== 'string' || !p) return p ?? null;
+  const parts = p.split(/[\\/]+/).filter(Boolean);
+  return parts.length <= 2 ? parts.join('/') : `…/${parts.slice(-2).join('/')}`;
+}
+
+/**
+ * The RPC URL as it may be shown to a viewer (audit 2026-09-16, L3): never with a username or
+ * password in it. `http://user:pass@host:8332` is a valid rpcUrl, and the endpoint is shown on the
+ * Node page and in the node picker's tooltip to everyone who can read the monitor.
+ */
+export function displayUrl(u) {
+  if (typeof u !== 'string' || !u) return u ?? null;
+  try {
+    const url = new URL(u);
+    if (!url.username && !url.password) return u;
+    url.username = ''; url.password = '';
+    return url.toString();
+  } catch { return u.replace(/\/\/[^@/]*@/, '//'); }
+}
+
 export class RpcError extends Error {
   constructor(message, { code = null, httpStatus = null, kind = 'rpc' } = {}) {
     super(message);
@@ -399,8 +427,8 @@ export class RpcClient {
   telemetry() {
     return {
       nodeId: this.id,
-      url: this.node.rpcUrl,
-      cookieSource: this._cookieSource,
+      url: displayUrl(this.node.rpcUrl),
+      cookieSource: shortPath(this._cookieSource),
       online: !!this.lastGoodAt && !this.lane.breakerOpen && (!this.lastError || (this.lastGoodAt > this.lastError.at)),
       lastGoodAt: this.lastGoodAt,
       lastError: this.lastError,

package/server/store/audit.js

@@ -14,7 +14,7 @@
 import fsp from 'node:fs/promises';
 import fs from 'node:fs';
 import path from 'node:path';
-import { appendJsonl } from './history.js';
+import { appendJsonl, fchmodOwnerOnly } from './history.js';
 
 export class AuditLog {
   constructor(file, { maxBytes = 8 * 1024 * 1024, keep = 5, log = () => {} } = {}) {
@@ -129,6 +129,11 @@ export class AuditLog {
 
   /** Adopt an existing file's size so the first append after a restart is correct. */
   async adopt() {
+    // THE MODE IS TIGHTENED ON FILES THAT ALREADY EXIST (audit 2026-09-16, L10): appendJsonl passes
+    // 0o600, which applies only when it creates the file, so a trail written before 2026-09-14 kept
+    // whatever the umask gave it. Opened without following a symlink where the platform allows, and
+    // fchmod'ed through the descriptor.
+    for (const f of this.chain()) await fchmodOwnerOnly(f);
     try {
       this.bytes = (await fsp.stat(this.file)).size;
       return { adopted: this.bytes };

package/server/store/history.js

@@ -7,6 +7,7 @@
 // whole"), and it is the only sane answer when the process can be SIGKILLed
 // mid-flush by a system OOM killer this box has actually triggered before.
 import fsp from 'node:fs/promises';
+import fs from 'node:fs';
 import path from 'node:path';
 import { Ring } from './ring.js';
 
@@ -141,7 +142,7 @@ export class History {
     if (this.saving) return { skipped: true };
     this.saving = true;
     try {
-      await fsp.mkdir(this.dir, { recursive: true });
+      await fsp.mkdir(this.dir, { recursive: true, mode: 0o700 });
       const payload = {
         version: 1,
         savedAt: Date.now(),
@@ -151,7 +152,10 @@ export class History {
         eventsSeq: this.eventsSeq,
       };
       const tmp = `${this.file}.tmp`;
-      const fh = await fsp.open(tmp, 'w', 0o600);   // node-derived detail: owner-only, like users and sessions
+      // node-derived detail: owner-only, like users and sessions. The temporary name is unlinked and
+      // created with O_EXCL, so a symlink planted there is never followed (audit 2026-09-16, L10)
+      await fsp.unlink(tmp).catch((err) => { if (err.code !== 'ENOENT') throw err; });
+      const fh = await fsp.open(tmp, 'wx', 0o600);
       await fh.writeFile(JSON.stringify(payload));
       await fh.sync();
       await fh.close();
@@ -170,6 +174,7 @@ export class History {
   }
 
   async load() {
+    await fchmodOwnerOnly(this.file);   // a snapshot written before the mode was passed (audit 2026-09-16, L10)
     let raw;
     try {
       raw = await fsp.readFile(this.file, 'utf8');
@@ -215,6 +220,17 @@ export class History {
 
 // Atomic append-only text sink, used by the audit log.
 export async function appendJsonl(file, row) {
-  await fsp.mkdir(path.dirname(file), { recursive: true });
+  await fsp.mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
   await fsp.appendFile(file, JSON.stringify(row) + '\n', { encoding: 'utf8', mode: 0o600 });   // who did what: owner-only (audit 2026-09-14, L4)
 }
+
+// An existing file made owner-only through its own descriptor (audit 2026-09-16, L10). O_NOFOLLOW
+// where the platform has it, so a symlink's target is never re-moded; a missing file, or a platform
+// that keeps no modes (Windows), is not an error.
+export async function fchmodOwnerOnly(file) {
+  let fh;
+  try {
+    fh = await fsp.open(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0));
+    await fh.chmod(0o600);
+  } catch { /* absent, a symlink, or modes not kept here */ } finally { await fh?.close().catch(() => {}); }
+}

package/server/store/ledger.js

@@ -54,7 +54,7 @@ async function sqliteEngine() {
 
 export async function openLedger({ file, engine = 'auto', keepHeights = 52_594, log = () => {} } = {}) {
   if (!file) throw new Error('openLedger needs a file path');
-  fs.mkdirSync(path.dirname(file), { recursive: true });
+  fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });   // owner-only (audit 2026-09-16, L10)
   let chosen = engine;
   if (engine === 'auto') {
     chosen = (process.env.BLOCKYARD_LEDGER_ENGINE ?? 'sqlite').trim().toLowerCase();
@@ -90,6 +90,9 @@ class SqliteLedger {
       height INTEGER PRIMARY KEY, pool_key TEXT, pool_label TEXT, seen_at INTEGER, row TEXT
     )`);
     this.db.exec('CREATE INDEX IF NOT EXISTS attribution_seen ON attribution(seen_at DESC)');
+    // SQLite creates its files by the umask: tightened to owner-only, and an older file with them
+    // (audit 2026-09-16, L10)
+    for (const f of [file, `${file}-wal`, `${file}-shm`]) ownerOnly(f);
     this.insert = this.db.prepare('INSERT OR REPLACE INTO attribution VALUES (?,?,?,?,?)');
   }
 
@@ -164,7 +167,8 @@ class JsonlLedger {
         if (Number.isInteger(row?.height)) this.byHeight.set(row.height, row);
       } catch { /* the incomplete final write; ignored, then overwritten */ }
     }
-    this.fd = fs.openSync(file, 'a');
+    this.fd = fs.openSync(file, 'a', 0o600);
+    try { fs.fchmodSync(this.fd, 0o600); } catch { /* not every filesystem keeps modes */ }   // one created before (audit 2026-09-16, L10)
   }
 
   put(row) { return this.putMany([row]); }
@@ -188,13 +192,15 @@ class JsonlLedger {
   #compact() {
     const rows = [...this.byHeight.values()].sort((a, b) => a.height - b.height);
     const tmp = `${this.file}.tmp`;
-    const fd = fs.openSync(tmp, 'w');
+    // never a planted symlink followed: unlinked, then created afresh and owner-only (audit 2026-09-16, L10)
+    try { fs.unlinkSync(tmp); } catch (err) { if (err.code !== 'ENOENT') throw err; }
+    const fd = fs.openSync(tmp, 'wx', 0o600);
     for (const r of rows) fs.writeSync(fd, JSON.stringify(r) + '\n');
     fs.fsyncSync(fd);
     fs.closeSync(fd);
     fs.closeSync(this.fd);
     fs.renameSync(tmp, this.file);
-    this.fd = fs.openSync(this.file, 'a');
+    this.fd = fs.openSync(this.file, 'a', 0o600);
     this.dirty = 0;
   }
 
@@ -288,3 +294,8 @@ export function aggregate(rows = []) {
     }))
     .sort((a, b) => b.blocks - a.blocks || b.lastHeight - a.lastHeight);
 }
+
+// chmod 0o600 when the file exists; a missing file or a filesystem without modes is not an error
+function ownerOnly(file) {
+  try { fs.chmodSync(file, 0o600); } catch { /* absent, or modes not kept here */ }
+}

package/systemd/blockyard.service

@@ -84,15 +84,46 @@ Environment=BLOCKYARD_LOG_LEVEL=info
 #Environment=BLOCKYARD_ENABLE_ACTIONS=1
 #Environment=BLOCKYARD_ACTIONS=testmempoolaccept,savemempool
 
-# Modest hardening. NoNewPrivileges plus a read-only /home is enough here: the
-# service must read the node's RPC cookie and log, so a full PrivateTmp/
-# ProtectSystem=strict would fight the thing it is monitoring.
+# SANDBOX (audit 2026-09-16, M8). This block used to be "modest hardening", and its comment said
+# NoNewPrivileges plus a read-only /home was enough -- but no read-only /home was ever set, and it
+# claimed ProtectSystem=strict would stop the service reading the node's cookie. It would not:
+# strict makes paths READ-ONLY, and reading is all the monitor does with the node. Everything below
+# was started and checked against this app (tests/unit-sandbox note in docs/INSTALL.md section 6).
+#
+# The whole filesystem is read-only to the service except what it writes: its data directory
+# (sessions, history, audit trail, TLS certificate), its config directory (the node form and the
+# Display settings save there), and the address index if you configured one. EDIT ME: these paths
+# follow WorkingDirectory above; add the index directory (`addressIndex` in config/local.json) as a
+# third ReadWritePaths line. The leading "-" skips a path that does not exist yet.
+ReadWritePaths=-/storage/blockyard/data
+ReadWritePaths=-/storage/blockyard/config
+#ReadWritePaths=/var/lib/blockyard-index
+ProtectSystem=strict
+# The node's cookie and log are usually under a home directory: readable, never writable.
+ProtectHome=read-only
+PrivateTmp=true
+PrivateDevices=true
+UMask=0077
 NoNewPrivileges=true
+CapabilityBoundingSet=
+AmbientCapabilities=
 ProtectKernelTunables=true
 ProtectKernelModules=true
+ProtectKernelLogs=true
 ProtectControlGroups=true
+ProtectClock=true
+ProtectHostname=true
+ProtectProc=invisible
+RestrictNamespaces=true
+RestrictRealtime=true
 RestrictSUIDSGID=true
 LockPersonality=true
+# AF_NETLINK: the boot check that a configured address exists reads the interfaces through it.
+RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6 AF_NETLINK
+SystemCallArchitectures=native
+SystemCallFilter=@system-service
+SystemCallErrorNumber=EPERM
+# NOT MemoryDenyWriteExecute: V8's JIT needs writable-executable memory, and node aborts under it.
 
 StandardOutput=journal
 StandardError=journal