Store authentication files only as user readable
As reported into silkaj#420 (closed), save v1 auth file as user readable 600 rw------- mode, not group and world readable.
I found two approaches:
Using the umask
Set 077 umask (for 600 permissions) and restore previous one:
current_umask = os.umask(0o077)
with open(path, encoding="utf-8") as fh:
fh.write(seedhex)
os.umask(current_umask)
- Inspired from
libnaclthat we are already using.
Using an opener
def opener_user_rw(path, flags):
return os.open(path, flags, 0o600)
with open(path, "w", encoding="utf-8", opener=self.opener_user_rw) as fh:
fh.write(seedhex)
Edited by Moul