v0.31.0 refinements

internal/tlsx/tlsx.go

@@ -240,13 +240,14 @@ var warnedSecrets sync.Map
 
 // SecretFileWarning describes a secret file every local user can read, once
 // per path per process. Group access is left alone: container secret mounts
-// commonly grant it on purpose.
+// commonly grant it on purpose. Terminals, pipes and descriptors hold no
+// secret at rest; lw closes /dev/fd/N after reading, and N then names another.
 func SecretFileWarning(key, path string) string {
-	if path == "" {
+	if path == "" || strings.HasPrefix(path, "/dev/fd/") {
 		return ""
 	}
 	fi, err := os.Stat(path)
-	if err != nil || fi.Mode().Perm()&0o004 == 0 {
+	if err != nil || !fi.Mode().IsRegular() || fi.Mode().Perm()&0o004 == 0 {
 		return ""
 	}
 	if _, seen := warnedSecrets.LoadOrStore(path, struct{}{}); seen {

internal/tlsx/tlsx_test.go

@@ -4,10 +4,13 @@ import (
 	"crypto/tls"
 	"crypto/x509"
 	"crypto/x509/pkix"
+	"fmt"
 	"net"
+	"os"
 	"path/filepath"
 	"slices"
 	"strings"
+	"syscall"
 	"testing"
 	"time"
 
@@ -200,3 +203,33 @@ func TestTLSOptionConflicts(t *testing.T) {
 		}
 	}
 }
+
+// Terminals, pipes and descriptors hold no secret at rest: /dev/tty, mode
+// 0666 like /dev/null, is not warned about, nor /dev/fd/N whatever it names,
+// while a world-readable file is.
+func TestSecretFileWarningSkipsTerminalsAndPipes(t *testing.T) {
+	dir := t.TempDir()
+	fifo, file := filepath.Join(dir, "fifo"), filepath.Join(dir, "pw")
+	if err := syscall.Mkfifo(fifo, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	testutil.WriteFile(t, file, "secret\n")
+	for _, path := range []string{fifo, file} {
+		if err := os.Chmod(path, 0o644); err != nil { // past the umask
+			t.Fatal(err)
+		}
+	}
+	held, err := os.Open(file)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer held.Close()
+	for _, path := range []string{os.DevNull, fifo, fmt.Sprintf("/dev/fd/%d", held.Fd())} {
+		if w := SecretFileWarning("auth.password_file", path); w != "" {
+			t.Errorf("%s: %s", path, w)
+		}
+	}
+	if SecretFileWarning("auth.password_file", file) == "" {
+		t.Error("a world-readable file was not warned about")
+	}
+}