Merge pull request #435 from naturallaw777/security/lnd-macaroon-argv

security: prevent LND admin macaroon exposure in curl argv

README.md

@@ -26,7 +26,7 @@ are ready.
 [Verify the Download](https://downloads.sovransystems.com/Sovran_SystemsOS-1.1.1.iso.sha256) ·
 [Build from Source](#build-from-source)
 
-<img src="assets/desktop-screenshot.png" alt="Sovran_SystemsOS private Bitcoin desktop" width="800" />
+<img src="assets/desktop-screenshot.webp" alt="Sovran_SystemsOS private Bitcoin desktop" width="800" />
 
 *Bitcoin sovereignty from the first boot.*
 
@@ -281,6 +281,10 @@ From one place, the Hub helps you:
 - Reach your Bitcoin tools, private cloud, and communications
 - Perform supported system operations without everyday terminal commands
 
+<img src="assets/sovran-hub-screenshot.webp" alt="The Sovran Hub dashboard" width="800" />
+
+*The Sovran Hub: manage your private infrastructure from one place.*
+
 ### Example home setup
 
 ```text

modules/bitcoin/lnd.nix

@@ -264,13 +264,16 @@ in {
           curl = "${pkgs.curl}/bin/curl -fsS --cacert ${cfg.certPath}";
           restUrl = "https://${nbLib.addressWithPort cfg.restAddress cfg.restPort}/v1";
           # Setting macaroon permissions for other users needs root permissions
+          # The admin macaroon is passed to curl via a fd because argv is
+          # world-readable through /proc/<pid>/cmdline
           script = nbLib.rootScript "lnd-create-macaroons" ''
             umask ug=r,o=
             ${lib.concatMapStrings (macaroon: ''
               echo "Create custom macaroon ${macaroon}"
               macaroonPath="$RUNTIME_DIRECTORY/${macaroon}.macaroon"
+              adminMacaroonHex=$(${pkgs.xxd}/bin/xxd -ps -u -c 99999 '${networkDir}/admin.macaroon')
               ${curl} \
-                -H "Grpc-Metadata-macaroon: $(${pkgs.xxd}/bin/xxd -ps -u -c 99999 '${networkDir}/admin.macaroon')" \
+                -H @<(printf 'Grpc-Metadata-macaroon: %s\n' "$adminMacaroonHex") \
                 -X POST \
                 -d '{"permissions":[${cfg.macaroons.${macaroon}.permissions}]}' \
                 ${restUrl}/macaroon |\

tests/test_security.py

@@ -333,6 +333,33 @@ class TestSshPubkeyValidation(unittest.TestCase):
             _validate_ssh_pubkey("ssh-ed25519")
 
 
+# ---------------------------------------------------------------------------
+# LND macaroon command-line safety
+# ---------------------------------------------------------------------------
+
+class TestLndMacaroonCommandLineSafety(unittest.TestCase):
+    """The LND admin macaroon must never be exposed in curl's argv."""
+
+    @classmethod
+    def setUpClass(cls):
+        path = os.path.join(_REPO_ROOT, "modules", "bitcoin", "lnd.nix")
+        with open(path, encoding="utf-8") as f:
+            cls.lnd_module = f.read()
+
+    def test_admin_macaroon_not_interpolated_into_header_argument(self):
+        self.assertNotIn(
+            '-H "Grpc-Metadata-macaroon: $(',
+            self.lnd_module,
+        )
+
+    def test_admin_macaroon_header_is_passed_via_file_descriptor(self):
+        self.assertIn("adminMacaroonHex=$(", self.lnd_module)
+        self.assertIn(
+            """-H @<(printf 'Grpc-Metadata-macaroon: %s\\n' "$adminMacaroonHex")""",
+            self.lnd_module,
+        )
+
+
 # ---------------------------------------------------------------------------
 # Auth-exempt paths
 # ---------------------------------------------------------------------------