Read-only config file(s) #530

New Issue

2026-10-05T04:27:53+02:00

adam commented

2026-10-05 04:27:53 +02:00

I'd like to make my config files read-only. I use a provisioning tool to manage my servers, including ZNC configuration, and would ideally like to prevent a running ZNC process from making any changes to the files.

I thought I could achieve this by making the files read-only (chmod 400), but apparently ZNC opens znc.conf in read+write mode even when only reading+parsing the file, so that's not a possibility.

--- Want to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/22017607-read-only-config-file-s?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github).

I'd like to make my config files read-only. I use a provisioning tool to manage my servers, including ZNC configuration, and would ideally like to prevent a running ZNC process from making any changes to the files. I thought I could achieve this by making the files read-only (`chmod 400`), but apparently ZNC [opens znc.conf in read+write mode even when only reading+parsing the file](https://github.com/znc/znc/blob/a314d3057efdb19d8259c7bf4160f31392418f7b/src/znc.cpp#L934), so that's not a possibility. ## <bountysource-plugin> --- Want to back this issue? **[Post a bounty on it!](https://www.bountysource.com/issues/22017607-read-only-config-file-s?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github)** We accept bounties via [Bountysource](https://www.bountysource.com/?utm_campaign=plugin&utm_content=tracker%2F1759&utm_medium=issues&utm_source=github). </bountysource-plugin>

adam commented

2026-10-05 04:27:54 +02:00

The comment above describes why it needs RW permissions. Are you asking us to look into alternative manners of handling this so it only needs read permissions, or are you looking for suggestions on how you can handle this differently?

I'm also pretty sure ZNC writes to the config every time a change is made (i.e. new user created, network added), so it definitely needs write permission.

The comment above describes why it needs RW permissions. Are you asking us to look into alternative manners of handling this so it only needs read permissions, or are you looking for suggestions on how you can handle this differently? I'm also pretty sure ZNC writes to the config every time a change is made (i.e. new user created, network added), so it definitely needs write permission.

adam commented

2026-10-05 04:27:55 +02:00

Are you asking us to look into alternative manners of handling this so it only needs read permissions, or are you looking for suggestions on how you can handle this differently?

Either one would be fine by me, honestly. If there's a workaround that's available in the current version of ZNC I'd love to know about it.

Off the top of my head, I imagine you could create a znc.conf.lock file in the same directory as the config file to prevent two processes from using the same config file. Also, if the intent of the file lock is to prevent another process from modifying the config file, that intent is kinda moot if the file is set to read-only (chmod 400) in the first place. Correct me if I'm wrong.

I'm also pretty sure ZNC writes to the config every time a change is made (i.e. new user created, network added), so it definitely needs write permission.

This is true, but my plan is to not rely on this live-updating, instead I'd like to update my provisioning script (adding the user/network/module/whatever centrally), deploy the new config file and then /msg *status rehash. I'm guessing this is not the intent ZNC is designed around, but would still love if it was possible.

> Are you asking us to look into alternative manners of handling this so it only needs read permissions, or are you looking for suggestions on how you can handle this differently? Either one would be fine by me, honestly. If there's a workaround that's available in the current version of ZNC I'd love to know about it. Off the top of my head, I imagine you could create a `znc.conf.lock` file in the same directory as the config file to prevent two processes from using the same config file. Also, if the intent of the file lock is to prevent another process from modifying the config file, that intent is kinda moot if the file is set to read-only (`chmod 400`) in the first place. Correct me if I'm wrong. > I'm also pretty sure ZNC writes to the config every time a change is made (i.e. new user created, network added), so it definitely needs write permission. This is true, but my plan is to not rely on this live-updating, instead I'd like to update my provisioning script (adding the user/network/module/whatever centrally), deploy the new config file and then `/msg *status rehash`. I'm guessing this is not the intent ZNC is designed around, but would still love if it was possible.

adam commented

2026-10-05 04:27:55 +02:00

I don't know if ZNC has improved it over the years, but ZNC REHASH is supposedly very, very poorly written (and very unstable) and needs drastic improving.

I don't know if ZNC has improved it over the years, but ZNC REHASH is supposedly very, very poorly written (and very unstable) and needs drastic improving.

adam commented

2026-10-05 04:27:56 +02:00

Also, if the intent of the file lock is to prevent another process from modifying the config file

No. It's to prevent 2 ZNC processes to run together with the same config.

/znc rehash is supposed to go away at some point. But before that, I'd like to provide some alternative way to configure ZNC from external.

If you really want to manage config file by something else, restarting ZNC would be better than rehashing.

I'm also pretty sure ZNC writes to the config every time a change is made (i.e. new user created, network added)

Not quite. It does that if changes are made through webadmin. Also config is saved if user joins/part a channel when chansaver is loaded. Adding a network through *status doesn't write config itself.

> Also, if the intent of the file lock is to prevent another process from modifying the config file No. It's to prevent 2 ZNC processes to run together with the same config. `/znc rehash` is supposed to go away at some point. But before that, I'd like to provide some alternative way to configure ZNC from external. If you really want to manage config file by something else, restarting ZNC would be better than rehashing. > I'm also pretty sure ZNC writes to the config every time a change is made (i.e. new user created, network added) Not quite. It does that if changes are made through webadmin. Also config is saved if user joins/part a channel when chansaver is loaded. Adding a network through `*status` doesn't write config itself.

adam commented

2026-10-05 04:27:57 +02:00

Btw, znc.conf is only part of config. Modules store their settings in different places.

Btw, znc.conf is only part of config. Modules store their settings in different places.

adam commented

2026-10-05 04:27:57 +02:00

No. It's to prevent 2 ZNC processes to run together with the same config.

A separate lock file would still work to prevent this, then. Though if you were to theoretically change from a file lock to a lock file in a future version, that would make two differing versions of ZNC running on the same config possible.

I wasn't aware that rehash is being deprecated, I'll keep that in mind.

I don't currently have a problem with module config files, as they're being opened as read-only (at least .registry files).

> No. It's to prevent 2 ZNC processes to run together with the same config. A separate lock file would still work to prevent this, then. Though if you were to theoretically change from a file lock to a lock file in a future version, that would make two differing versions of ZNC running on the same config possible. I wasn't aware that rehash is being deprecated, I'll keep that in mind. I don't currently have a problem with module config files, as they're being opened as read-only (at least `.registry` files).

adam commented

2026-10-05 04:27:58 +02:00

I'm also trying to automate ZNC deployment with a configuration management tool, and would love to see a way to have ZNC not write its config file (and possibly keep users and networks in a different file than listeners and global config)

I'm also trying to automate ZNC deployment with a configuration management tool, and would love to see a way to have ZNC not write its config file (and possibly keep users and networks in a different file than listeners and global config)

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: adam/znc#530