Bitcoin Core Unix Permissions and Process Isolation

This guide explains Bitcoin Core process isolation in plain English. It focuses on what the subject is, why it matters and what a beginner should remember.

Dedicated service identity

Run the daemon under a non-login account that does not own unrelated applications. The user needs access to its binary, configuration, data, PID and runtime paths, not a general home directory or deployment credentials. A shared web-server account defeats the containment expected from a separate process.

Data and configuration permissions

The 0.12 guidance advised that configuration and data be readable only by the bitcoin user and its intentional group. Wallet files and RPC credentials are sensitive even when balances are public. Directory execute permission also controls traversal, so audit the full parent path rather than checking one file mode.

RPC client membership

Local clients can be authorised through access to the cookie or configuration credential. Group membership should represent a reviewed capability, not convenience. A monitoring reader may not need the same RPC surface as a pool coordinator or wallet, and modern deployments should use release-supported RPC permission separation where available.

Service-manager controls

A service unit should set the intended user, group, paths, restart policy and dependencies explicitly. Environment overrides and writable unit drop-ins can silently change binaries or arguments. Capture the effective configuration shown by the service manager, because reviewing only the vendor file can miss local modifications.

Writable-path and binary integrity

The daemon must not load a binary, shared library, configuration or wallet from a directory writable by a less-trusted account. Logs and PID files need bounded permissions without allowing symlink substitution. Package or release signatures establish provenance only before an attacker gains write access to the installed runtime.

Backups and crash artefacts

Backups, core dumps, support bundles and snapshots can bypass live file permissions. Exclude RPC cookies and redact secrets; encrypt wallet-bearing backups and test restoration under the dedicated identity. Disable or tightly control core dumps when process memory could contain keys or credentials.

Isolation audit

Enumerate the daemon process, supplementary groups, open files, listening sockets, writable directories and service-unit overrides. Attempt access from a web-service account and a monitoring account. Restart, rotate logs and restore a sanitised test backup, confirming no path becomes root-owned or broadly readable.

Conclusion

Process isolation is not one permission bit; it is the combined boundary around identity, files, sockets, startup and backups. A dedicated Bitcoin Core account with minimal paths and reviewed client access materially reduces the blast radius of adjacent-service compromise.