[Feature Request] Proper permission setting for /etc/v2ray/config.json

[BeautyyuYanli]

The config file contains all the info (and secrets) of the tunnels, however it is not properly protected. By default, the permission setting of the dir /etc doesn't forbiden read access to the files in it. It can be dangerous as all the applications (including those produced in somewhere, e.g. linuxqq) can read users' v2ray config.

My proposal is to add a new user (i.e. v2ray) to run the program. The permission setting for config.json should be like:

-rw-rw---- 1 v2ray v2ray 1024  1月 01 00:00 config.json

and v2ray.service:

[Service]
User=v2ray

relate to #428

[yin1999]

We can also use Credentials with DynamicUser:

[Service]
DynamicUser=true
LoadCredential=config.json:/etc/v2ray/config.json
ExecStart=/usr/bin/v2ray -config ${CREDENTIALS_DIRECTORY}/config.json

[mydogshitgold]

IMO you should try avoid running untrustworthy programs on devices with sensitive data. And if you have to, run them in isolated environments like sandboxes or containers, and setup MAC like SeLinux or AppArmor.

Merely changing file permissions won't protect you against such programs, the adversaries could deduce that you are using V2Ray and potentially your server configuration from command hash table, shell history, system caches and browser data.

[BeautyyuYanli]

I do use sandbox, but it is still necessary to set proper permissions I think.