Security hardening: improve file handling and socket permissions

[assisted-by-ai]

Summary

This PR improves security and robustness across the privleap codebase by hardening file permission handling, refining socket creation with proper umask management, and fixing several edge cases in configuration parsing and PAM authentication.

Key Changes

File and Socket Permission Hardening

• Set restrictive umask (0o177) when binding UNIX sockets to prevent world-readable socket creation
• Changed state and communication directory permissions from 0o755 to 0o711 to restrict directory listing while maintaining execute access
• Improved socket cleanup logic to distinguish between missing files (warning) and actual errors (error level)

Configuration Parsing Improvements

• Refactored config directory permission checking to use file descriptor-based validation instead of path-based checks
• Added proper error handling for directory opening failures
• Fixed config file name validation to use only the filename instead of full path
• Ensured file descriptors are properly closed with try/finally blocks

PAM Authentication Fix

• Separated account management PAM session from credential initialization PAM session
• Account management now uses a dedicated pam_acct_obj instance
• Credential initialization uses a fresh pam_obj instance with proper user context
• This prevents credential state from being mixed between different PAM operations

Regex Pattern Refinements

• Removed path separators (. and /) from config file regex pattern to prevent directory traversal
• Added anchor (\Z) to uid_regex for stricter matching
• These changes prevent malformed or malicious filenames from being processed

Notable Implementation Details

• Socket binding now properly restores the original umask after creation
• Configuration directory validation uses os.open() with O_RDONLY | O_DIRECTORY flags for safer file descriptor operations
• Exception handling is more granular, distinguishing between FileNotFoundError and other exceptions for appropriate logging levels

https://claude.ai/code/session_01W6kXMiJ5ULwNV9cega66Dx

[ArrayBolt3]

Partially accepted in ArrayBolt3@763ba07. Notes below.

[ArrayBolt3]

I don't see this as being a problem. If the socket setup fails, maybe it will leave a socket with bad permissions on disk, but the application won't use it because socket setup failed. If the socket setup succeeds, the ownership and permissions are set properly, so the umask isn't needed. privleapd already sets a restrictive umask anyway.

[ArrayBolt3]

Ditto.

[ArrayBolt3]

Accepted.

[ArrayBolt3]

Accepted.

[ArrayBolt3]

Accepted.

[ArrayBolt3]

I get the reasoning here, but disagree with it. The original code is easier to read, and while it is arguably susceptible to a TOCTOU, in practice a TOCTOU doesn't matter here. If an attacker can change the permissions from secure to insecure, swap out the directory, etc. between the check and the open, they already have the ability to write anything they want into the configuration directory and compromise the system, or set up the permissions to be correct before the swap. This patch does plug the TOCTOU, but in practice that does nothing for security.

[ArrayBolt3]

Accepted.

[ArrayBolt3]

This will break the ability to list the directory contents. I don't think being able to list the contents is a risk.

[ArrayBolt3]

Ditto. (This would have the advantage of hiding the list of active users from others, but most of that info can be gotten using loginctl, so I don't think that's particularly valuable.)

[ArrayBolt3]

I don't understand why this is useful. The PAM documentation doesn't seem to hint at why this might be desirable, and sudo doesn't seem to make separate PAM sessions for this scenario, so rejecting for now.