From: merge-script <withtvpeter@gmail.com>
Date: Fri, 25 Sep 2026 03:19:54 +0000 (+0100)
Subject: Merge bitcoindevkit/bdk-cli#334: fix(datadir): enforce strict permissions on datadir... 
X-Git-Url: http://internal-gitweb-vhost/tx_graph/%22https:/encode/database/static/enum.SigFromSliceError.html?a=commitdiff_plain;p=bdk-cli

Merge bitcoindevkit/bdk-cli#334: fix(datadir): enforce strict permissions on datadir and config.toml

b2b99b4297a955c4ff5aee59475fc4e64e6f2868 fix: harden datadir and config file permissions (Vihiga Tyonum)

Pull request description:

  ### Description

  wallet config persisted descriptors including xprv/tprv to config.toml via fs::write, and created the datadir / wallet dirs with umask defaults. Any other local user or process that could read the home tree could recover the account-level key and sweep the wallet. The existing warning only mentioned plaintext storage, not world-readability.
  This PR creates new datadirs and wallet/payjoin subdirs with DirBuilder mode 0700 on Unix (create_restricted_dir), writes config.toml with OpenOptions mode 0600. On load/save, it hardens an existing config.toml (and the default ~/.bdk-bitcoin on startup) when group/other bits are set, and prints a warning when it does so.
  Also, adds unit and integration tests that a private-descriptor config is 0600 and that a stale 0644 file is repaired on load and save.

  Behaviour is unchanged for windows. wallet.sqlite / payjoin DB files may still be created 0644 by the DB libraries, they sit under a 0700 parent.

  Fixes #331

  ### Notes to the reviewers

  - `limit_access` only acts when mode & 0o077 != 0, so an already owner-only file (0400) is not widened to 0600.
  - Payjoin’s create_dir_all was the same umask defaults and is included so a session dir is not left 0755 beside the wallet.

  ## Changelog notice
  - Fixed the data directory and config.toml permission being world-readable (0755/0644) to 0700/0600 on Unix.

  ### Checklists

  #### All Submissions:

  * [x] I've signed all my commits
  * [x] I followed the [contribution guidelines](https://github.com/bitcoindevkit/bdk-cli/blob/master/CONTRIBUTING.md)
  * [x] I ran `cargo fmt` and `cargo clippy` before committing

  #### Bugfixes:

  * [ ] This pull request breaks the existing API
  * [x] I've added tests to reproduce the issue which are now passing
  * [x] I'm linking the issue being fixed by this PR

Top commit has no ACKs.

Tree-SHA512: f394c3d6021902d3968b33953fef5d586bb1594139ca0a2ff6e6b90279aef4a9dbd8e4363ddab4c9a4b2e8dfc243cd667356dafb3f5338d5abcd8efc135c0ba6
---

f3a1eafed9cefc3816ad066b4a7c554a4cb4d8df