Logs are readable by any user on the system by default

[Swarkin]

version 2.1.18

What's happening?

When log files are enabled (unsure whether this is the default, I believe it is), all queries can be read by any user on the system since they use -rw-r--r-- 644 permissions.

When does this occur?

n/a

Where does it happen?

n/a

How do we replicate the issue?

Install dnscrypt-proxy and check file permissions of log files

Expected behavior

Privacy: don't make this accessible to regular users.

Additional context

n/a

[jedisct1]

This should already be covered. Query logging is off by default, so a stock install doesn't record queries at all. You have to uncomment the file line under [query_log] to turn it on. And when you do turn it on, dnscrypt-proxy creates the log file as 600, readable only by the account it runs under. I double checked this against the current code and confirmed it on a freshly created file.

So if you're seeing 644, one of two things is probably going on.

The first possibility is that you're looking at dnscrypt-proxy.log rather than the query log. That one is the general application log (startup messages, warnings, errors) rather than a record of your queries. It follows the system umask, so if you'd like it to be private, setting a stricter umask for the service will do it.

The second possibility, and the more likely one if it really is the query log, is that the file already existed before dnscrypt-proxy ever wrote to it.

If that's what happened, a chmod 600 on the existing log file will fix it for good. Even better, you can restrict the directory the logs live in, since that also covers the rotated and compressed copies and doesn't depend on anything dnscrypt-proxy does.

[syphyr]

This has to do with what user you are running dnscrypt-proxy as. It also has to do with what directory you choose to put the logs into.

[Swarkin]

I just renamed the log files and restarted the service, the created files look like this:

-rw-r--r--  1 _dnscrypt-proxy nogroup    0 Aug  9 19:26 nx.log
-rw-r--r--  1 _dnscrypt-proxy nogroup    0 Aug  9 19:26 query.log

Auto created /var/log/dnscrypt-proxy directory looks like: drwxr-xr-x 2 _dnscrypt-proxy nogroup 4.0K Aug 9 19:26 .

My service file looks like this, the only lines i remember editing is adding the wg-quick and pihole stuff near the top.
Im quite certain everything else has been set up like that after the apt install process.

[Unit]
Description=DNSCrypt client proxy
Documentation=https://github.com/DNSCrypt/dnscrypt-proxy/wiki

Wants=pihole-FTL.service
Before=pihole-FTL.service

Wants=wg-quick@wg.service
After=wg-quick@wg.service

Requires=dnscrypt-proxy.socket

[Install]
Also=dnscrypt-proxy.socket
WantedBy=multi-user.target

[Service]
NonBlocking=true
ExecStart=/usr/sbin/dnscrypt-proxy -config /etc/dnscrypt-proxy/dnscrypt-proxy.toml
ProtectHome=true
ProtectKernelModules=true
ProtectKernelTunables=true
ProtectControlGroups=true
MemoryDenyWriteExecute=true

User=_dnscrypt-proxy
CacheDirectory=dnscrypt-proxy
LogsDirectory=dnscrypt-proxy
RuntimeDirectory=dnscrypt-proxy

My config is this, I have edited this but specifically the lines about log file paths were there already (I believe commented out by default)

 1
 2 listen_addresses = ["127.0.0.1:5030"]
 3 server_names = ['libre_dns']
 4
 5 ipv6_servers = false
 6 block_ipv6 = true
 7
 8 require_dnssec = true
 9
10 http3 = true
11 cache = false
12
13 log_level = 3
14 use_syslog = true
15 ignore_system_dns = true
16
17 [blocked_ips]
18 blocked_ips_file = 'blocked-ips.txt'
19
20
21 [query_log]
22   file = '/var/log/dnscrypt-proxy/query.log'
23
24 [nx_log]
25   file = '/var/log/dnscrypt-proxy/nx.log'
26
[...] (only DNS provider configuration follows here so I cut that out.)

Using Debian forky

Im not too familiar what the umask stuff means, but it appears to be the setting for default file permissions on the system. Maybe this should be set in the service file by default?

[jedisct1]

Following up on my earlier comment, which I need to correct: I said the log file is created with 600 permissions. That
was wrong, I checked against the development branch rather than 2.1.18. Sorry for the confusion, and thanks for the
detailed follow-up, it made this easy to pin down.

The 644 you're seeing is deliberate, though. dnscrypt-proxy runs under its own dedicated user, _dnscrypt-proxy in your
case, and if the log files were only readable by that account you'd have to switch users or use sudo every time you
wanted to look at them. Keeping the files readable means an administrator can just read them.

The access control is meant to live on the directory instead. That's the more reliable place for it anyway, since it
covers the rotated and compressed copies too, and it doesn't depend on the file permissions surviving a rotation.

In your case the directory is created by systemd, through the LogsDirectory=dnscrypt-proxy line in the unit file.
systemd defaults that to 755, which is why /var/log/dnscrypt-proxy is readable by everyone. You can change it by adding
this under [Service]:

  LogsDirectoryMode=0700

Then reload and restart:

  systemctl daemon-reload
  systemctl restart dnscrypt-proxy

After that the directory is only accessible to _dnscrypt-proxy, and the file permissions inside stop mattering. You'll
need sudo to read the logs yourself, which is the tradeoff.

[Swarkin]

I'm not fully sure how packaging and all that works, but would it be possible to have that LogsDirectoryMode=0700 line be appended to the systemd service by default upon installation?