fix(all): codebase hardening to improve protocol and code safety

Author: acud

Dockerfile

@@ -20,7 +20,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     useradd -r -g bee --uid 999 --no-log-init -m bee;
 
 # make sure mounted volumes have correct permissions
-RUN mkdir -p /home/bee/.bee && chown 999:999 /home/bee/.bee
+RUN mkdir -p /home/bee/.bee && chown 999:999 /home/bee/.bee && chmod 700 /home/bee/.bee
 
 COPY --from=build /src/dist/bee /usr/local/bin/bee
 

Dockerfile.ci

@@ -4,7 +4,7 @@ USER root
 
 RUN addgroup --system bee --gid 998; \
     adduser -S -G bee -u 998 -D -h /home/bee bee; \
-    mkdir -p /home/bee/.bee && chown 998:998 /home/bee/.bee
+    mkdir -p /home/bee/.bee && chown 998:998 /home/bee/.bee && chmod 700 /home/bee/.bee
 
 COPY bee /bee
 

Dockerfile.dev

@@ -31,7 +31,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     groupadd -r bee --gid 999; \
     useradd -r -g bee --uid 999 --no-log-init -m bee;
 
-RUN mkdir -p /home/bee/.bee && chown 999:999 /home/bee/.bee
+RUN mkdir -p /home/bee/.bee && chown 999:999 /home/bee/.bee && chmod 700 /home/bee/.bee
 
 COPY --from=build /src/dist/bee /usr/local/bin/bee
 

Dockerfile.goreleaser

@@ -10,7 +10,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     useradd -r -g bee --uid 999 --no-log-init -m bee;
 
 # make sure mounted volumes have correct permissions
-RUN mkdir -p /home/bee/.bee && chown 999:999 /home/bee/.bee
+RUN mkdir -p /home/bee/.bee && chown 999:999 /home/bee/.bee && chmod 700 /home/bee/.bee
 
 COPY bee /usr/local/bin/bee
 

Dockerfile.scratch

@@ -8,7 +8,7 @@ RUN apt-get update && apt-get install -y --no-install-recommends \
     useradd -r -g bee --uid 999 --no-log-init -m bee;
 
 # make sure mounted volumes have correct permissions
-RUN mkdir -p /home/bee/.bee && chown 999:999 /home/bee/.bee
+RUN mkdir -p /home/bee/.bee && chown 999:999 /home/bee/.bee && chmod 700 /home/bee/.bee
 
 FROM scratch
 

cmd/bee/cmd/split.go

@@ -104,7 +104,7 @@ func splitRefs(cmd *cobra.Command) {
 				refs = append(refs, ch.Address().String())
 				return nil
 			})
-			writer, err := os.OpenFile(outputFileName, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0o644)
+			writer, err := os.OpenFile(outputFileName, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0o600)
 			if err != nil {
 				return fmt.Errorf("open output file: %w", err)
 			}
@@ -192,7 +192,7 @@ func splitChunks(cmd *cobra.Command) {
 			var chunksCount atomic.Int64
 			store := newPutter(func(chunk swarm.Chunk) error {
 				filePath := filepath.Join(outputDir, chunk.Address().String())
-				err := os.WriteFile(filePath, chunk.Data(), 0o644)
+				err := os.WriteFile(filePath, chunk.Data(), 0o600)
 				if err != nil {
 					return err
 				}

cmd/bee/cmd/split_test.go

@@ -14,6 +14,7 @@ import (
 	"os"
 	"path"
 	"path/filepath"
+	"runtime"
 	"sync"
 	"testing"
 
@@ -172,3 +173,47 @@ func requestPipelineFn(s storage.Putter, encrypt bool, rLevel redundancy.Level)
 		return builder.FeedPipeline(ctx, pipe, r)
 	}
 }
+
+// TestDBSplitChunksFilePermissions is a regression test for PERM-01: the
+// "split chunks" command wrote each chunk payload file world-readable (0o644),
+// disclosing chunk contents to other local users on a shared host. Files must
+// not be group- or world-accessible.
+func TestDBSplitChunksFilePermissions(t *testing.T) {
+	t.Parallel()
+	if runtime.GOOS == "windows" {
+		t.Skip("permission bits are not meaningful on windows")
+	}
+
+	buf := make([]byte, 16*1024)
+	if _, err := crand.Read(buf); err != nil {
+		t.Fatal(err)
+	}
+
+	inputFileName := path.Join(t.TempDir(), "input")
+	if err := os.WriteFile(inputFileName, buf, 0o600); err != nil {
+		t.Fatal(err)
+	}
+	outputDir := t.TempDir()
+
+	err := newCommand(t, cmd.WithArgs("split", "chunks", "--input-file", inputFileName, "--output-dir", outputDir)).Execute()
+	if err != nil {
+		t.Fatal(err)
+	}
+
+	entries, err := os.ReadDir(outputDir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if len(entries) == 0 {
+		t.Fatal("no chunk files were written")
+	}
+	for _, e := range entries {
+		info, err := e.Info()
+		if err != nil {
+			t.Fatal(err)
+		}
+		if perm := info.Mode().Perm(); perm&0o077 != 0 {
+			t.Fatalf("chunk file %s is group/other-accessible: %#o", e.Name(), perm)
+		}
+	}
+}

pkg/api/api.go

@@ -391,7 +391,9 @@ func (s *Service) SetProbe(probe *Probe) {
 }
 
 func (s *Service) SetIsWarmingUp(v bool) {
-	s.isWarmingUp = v
+	if s != nil {
+		s.isWarmingUp = v
+	}
 }
 
 // Close hangs up running websockets on shutdown.

pkg/api/warmup_test.go

@@ -0,0 +1,25 @@
+// Copyright 2026 The Swarm Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style
+// license that can be found in the LICENSE file.
+
+package api_test
+
+import (
+	"testing"
+
+	"github.com/ethersphere/bee/v2/pkg/api"
+)
+
+// TestSetIsWarmingUpNilReceiver is a regression test for NIL-01. When the API
+// is disabled (empty --api-addr) the apiService is nil, and the warmup
+// completion goroutine calls SetIsWarmingUp on it. Like its sibling setters,
+// SetIsWarmingUp must be a no-op on a nil receiver rather than panicking.
+func TestSetIsWarmingUpNilReceiver(t *testing.T) {
+	t.Parallel()
+
+	var s *api.Service // nil, as when the API is disabled
+
+	// Must not panic.
+	s.SetIsWarmingUp(false)
+	s.SetIsWarmingUp(true)
+}

pkg/file/buffer.go

@@ -68,6 +68,13 @@ func (c *ChunkPipe) Write(b []byte) (int, error) {
 	return nw, nil
 }
 
+// CloseRead closes the read side of the underlying pipe. A pending or
+// subsequent Write then fails with io.ErrClosedPipe, which lets a writer
+// blocked on the pipe (e.g. the copier in SplitWriteAll) unblock and exit.
+func (c *ChunkPipe) CloseRead() error {
+	return c.ReadCloser.Close()
+}
+
 // Close implements io.Closer
 func (c *ChunkPipe) Close() error {
 	if c.cursor > 0 {