feat: add `--auth-ipc.permissions` flag to execution client

[0x416e746f6e]

there is --ipc.permissions that controls file-perms for rpc socket. would be great to have a matching flag doing the same tor authrpc one.

[melekes]

Hey! Thanks for flagging this. Could you please open issue in https://github.com/paradigmxyz/reth, since this is where we get most of our flags (except ones specific to Arc)?

[osr21]

Did the source archaeology to make the upstream filing easier — @melekes' redirect is right: neither flag is Arc-specific. --ipc.permissions doesn't appear anywhere in this repo; both it and --auth-ipc/--auth-ipc.path live in upstream reth (crates/node/core/src/args/rpc_server.rs), so the matching --auth-ipc.permissions belongs there and would flow into Arc on the next reth bump with no Arc-side change.

A few verified specifics worth carrying into the reth issue, since they make it both easy to implement and stronger than a cosmetic-parity ask:

• The capability already exists in the shared IPC layer. Both the regular and auth IPC servers are the same reth_ipc::server::Builder; set_ipc_socket_permissions is implemented in crates/rpc/ipc/src/server/mod.rs. The regular RPC path wires it up in crates/rpc/rpc-builder/src/config.rs (.set_ipc_socket_permissions(...)), while the auth path a few lines below builds its IpcServerBuilder without it. So the upstream change is roughly: one clap arg (--auth-ipc.permissions) plus one builder call in the auth server config — no new mechanism.
• File permissions are the only access control on the auth IPC socket, which is the real argument for the flag. In crates/rpc/rpc-builder/src/auth.rs, the JWT layer (AuthLayer<JwtAuthValidator>) is applied to the HTTP transport, but the IPC server is started on the module directly — no JWT on the socket. The Engine API over IPC is gated purely by filesystem perms, so not being able to set them is a genuine hardening gap, not just asymmetry with --ipc.permissions.
• No existing upstream issue or PR covers this — I searched paradigmxyz/reth for auth-ipc/permissions in issues and PRs and came up empty, so a fresh issue won't be a dup.

Interim workaround until the flag exists and Arc picks up the reth bump: point --auth-ipc.path into a directory with 0700 permissions. Unix-socket connects require search permission on every parent directory, so restricting the parent gates access regardless of the socket file's own mode (which otherwise follows the process umask).