From f140167454a3d8c9558514078a7f552d4977410e Mon Sep 17 00:00:00 2001
From: Florian Klink <flokli@flokli.de>
Date: Tue, 27 Feb 2024 22:32:39 +0200
Subject: [PATCH] Set mode when creating key file

Make sure a generated key file is not readable by others.

This ensures the file is not group/world-readable.
---
 src/main.rs | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/src/main.rs b/src/main.rs
index c5d8ea0..3afbd69 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -309,8 +309,23 @@ async fn load_key_file(path: &Path) -> Result<crypto::SecretKey, io::Error> {
 }
 
 async fn save_key_file(key: &crypto::SecretKey, path: &Path) -> io::Result<()> {
-    let mut file = File::create(path).await?;
-    file.write_all(key.as_bytes()).await?;
+    #[cfg(target_family = "unix")]
+    {
+        use tokio::fs::OpenOptions;
+
+        let mut file = OpenOptions::new()
+            .create(true)
+            .write(true)
+            .mode(0o600) // rw by the owner, not readable by group or others
+            .open(path)
+            .await?;
+        file.write_all(key.as_bytes()).await?;
+    }
+    #[cfg(not(target_family = "unix"))]
+    {
+        let mut file = File::create(path).await?;
+        file.write_all(key.as_bytes()).await?;
+    }
 
     Ok(())
 }