From d19481ae59dce473fbe6e49bdc19886fbcca7c7f Mon Sep 17 00:00:00 2001
From: Matthew Jackson <1085847+MattJackson@users.noreply.github.com>
Date: Sat, 5 Sep 2026 12:37:43 -0700
Subject: [PATCH] persist keydb.cfg at mode 0600 (it holds key material)

keydb.cfg carries AACS key material plus the host private key/cert. write_atomic renamed a File::create()'d temp file onto it, so the final mode depended on umask and could leave the keys world-readable. On Unix, open the temp file with mode 0600 explicitly via OpenOptionsExt; non-Unix keeps the plain create().
---
 src/keydb.rs | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/src/keydb.rs b/src/keydb.rs
index 4007881..0e906a4 100644
--- a/src/keydb.rs
+++ b/src/keydb.rs
@@ -443,6 +443,20 @@ fn write_atomic(path: &Path, text: &str) -> Result<(), Error> {
         ))
     };
     let write_result = (|| -> std::io::Result<()> {
+        // The temp file is renamed onto keydb.cfg, which holds AACS key
+        // material and the host private key/cert — create it 0600 on Unix so
+        // umask can't leave the keys world-readable. Non-unix keeps create().
+        #[cfg(unix)]
+        let mut f = {
+            use std::os::unix::fs::OpenOptionsExt;
+            std::fs::OpenOptions::new()
+                .write(true)
+                .create(true)
+                .truncate(true)
+                .mode(0o600)
+                .open(&tmp)?
+        };
+        #[cfg(not(unix))]
         let mut f = std::fs::File::create(&tmp)?;
         f.write_all(text.as_bytes())?;
         f.sync_all()?;