Kovri operational security example(s) - file permissions

Question

The Kovri User Guide has a Step 2. (Recommended) Operational security. It is currently as follows:

• Consider creating a designated kovri user and run kovri only using that user
• If using Linux, consider using a hardened kernel (such as grsec with RBAC)
• After installing the appropriate resources in your kovri data path, considering setting appropriate access control with setfacl, umask, or whatever your OS uses for ACL
• Don't share your port number with anyone as it will effect your anonymity!

I'm mainly curious about the third item. How might running Kovri put my computer at risk, and how would those named softwares, or similar softwares, be used to mitigate those risks? What are some specific examples (or even one specific example) of what a user would do to follow the third item in this step? After following that third step, how it my system more safe/hardened?

If this may require a distro-specific response, I'm most familiar with (and therefore most curious about) Debian-based linux distros, and I've got Kovri currently on an Ubuntu 16.04.3 box.

Answer 1

The third point is about general operating system security with regards to which system users have read, write and executable permissions on files and folders in the kovri data path. setfacl (or chmod) can be used to set permissions on existing files / directories and umask is used to set permissions for newly created files in a directory.

Which users / groups you grant what access to is specific to your setup and needs.

As an example, if you only want the korvi user to have any access you could run: chmod 700 && umask 0077