permissions of files in attachments/sends are 600 not 644 #2061

New Issue

MrUnknownDE · 2026-04-06T02:54:36+02:00

MrUnknownDE commented

2026-04-06 02:54:36 +02:00

Originally created by @hellodword on 7/9/2022

Subject of the issue

rocket::fs::TempFile::persist_to() will create file as 600, will have backup issue when using some cloud storage.

Deployment environment

vaultwarden version: 1.25.0
Install method: docker run --rm --name bitwarden -e WEB_VAULT_ENABLED=false -e WEBSOCKET_ENABLED=false -p 8888:80 -v $(pwd)/data:/data vaultwarden/server:1.25.0
Clients used: all
Reverse proxy and version: none
MySQL/MariaDB or PostgreSQL version: none

Steps to reproduce

Create a send, or an attachment.

ls -R -l /data/attachments/

ls -R -l /data/sends/

# /data/attachments/dec756ad-1481-4e2b-9b9d-9a74ba5d3eb9:
# -rw-------+ 1 root root 65 Jul  9 14:01 794d8b149b9a0f39dcc6

b64cf27038/src/api/core/ciphers.rs (L1001)
b64cf27038/src/api/core/sends.rs (L228)

For example, I'm using CFS - kine of cloud storage, I mounted it to vaultwarden as the /data. When I mounted it to another service with a non-root user, I will fail to read the files in /data/attachments and /data/sends.

I think 644 like other files in the /data will bring better compatibility.

*Originally created by @hellodword on 7/9/2022* ### Subject of the issue `rocket::fs::TempFile::persist_to()` will create file as `600`, will have backup issue when using some cloud storage. ### Deployment environment * vaultwarden version: `1.25.0` * Install method: `docker run --rm --name bitwarden -e WEB_VAULT_ENABLED=false -e WEBSOCKET_ENABLED=false -p 8888:80 -v $(pwd)/data:/data vaultwarden/server:1.25.0` * Clients used: `all` * Reverse proxy and version: `none` * MySQL/MariaDB or PostgreSQL version: `none` ### Steps to reproduce Create a send, or an attachment. ```sh ls -R -l /data/attachments/ ls -R -l /data/sends/ # /data/attachments/dec756ad-1481-4e2b-9b9d-9a74ba5d3eb9: # -rw-------+ 1 root root 65 Jul 9 14:01 794d8b149b9a0f39dcc6 ``` https://github.com/dani-garcia/vaultwarden/blob/b64cf27038f04368af8f25aa80782d37471e6303/src/api/core/ciphers.rs#L1001 https://github.com/dani-garcia/vaultwarden/blob/b64cf27038f04368af8f25aa80782d37471e6303/src/api/core/sends.rs#L228 For example, I'm using [CFS - kine of cloud storage](https://intl.cloud.tencent.com/products/cfs), I mounted it to vaultwarden as the `/data`. When I mounted it to another service with a non-root user, I will fail to read the files in `/data/attachments` and `/data/sends`. I think `644` like other files in the `/data` will bring better compatibility.

MrUnknownDE closed this issue

2026-04-06 02:54:36 +02:00

MrUnknownDE referenced this issue

2026-04-06 03:22:54 +02:00

Fix missing encrypted key after emergency access reject #2304

Sign in to join this conversation.

No Label

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: github/vaultwarden#2061