1 files changed, 22 insertions, 0 deletions
diff --git a/src/swarm/auth.rs b/src/swarm/auth.rs
index 1bca60d..46efd77 100644
--- a/src/swarm/auth.rs
+++ b/src/swarm/auth.rs
@@ -39,6 +39,27 @@ struct Rejections {
     suppressed: u64,
 }
 
+/// The key is a secret: a file others may read is worth a warning (not an error: a
+/// group may be deliberate, e.g. shared with a deployment tool).
+fn warn_if_readable_by_others(path: &Path) {
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        if let Ok(metadata) = std::fs::metadata(path) {
+            let mode = metadata.permissions().mode();
+            if mode & 0o077 != 0 {
+                tracing::warn!(
+                    path = %path.display(),
+                    mode = format!("{:o}", mode & 0o777),
+                    "The swarm key file is readable by others than its owner; chmod 600 it"
+                );
+            }
+        }
+    }
+    #[cfg(not(unix))]
+    let _ = path;
+}
+
 /// At most one rejection log line per this interval.
 const REJECTION_LOG_INTERVAL: Duration = Duration::from_secs(10);
 
@@ -48,6 +69,7 @@ impl SwarmKey {
     pub(crate) fn from_file(path: &Path) -> Result<Self> {
         let key = std::fs::read(path)
             .with_context(|| format!("Reading the swarm key from {}", path.display()))?;
+        warn_if_readable_by_others(path);
         if key.len() < 16 {
             bail!(
                 "The swarm key in {} has {} bytes; use at least 16 (32 random bytes recommended)",