account: create account files with 0600 permissions

Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>

diff --git a/src/acme.rs b/src/acme.rs
index ef6f4e7c5f29463639134919d745543e87ff7517..4c8e5dfacf82928c2bee809d8716fb9e3783bfb8 100644 (file)
--- a/src/acme.rs
+++ b/src/acme.rs
@@ -3,6 +3,8 @@
 //! The functions in here are perl bindings.
 
 use std::io::{self, Write};
+use std::fs::OpenOptions;
+use std::os::unix::fs::OpenOptionsExt;
 
 use anyhow::{format_err, Error};
 use serde::{Deserialize, Serialize};
@@ -85,7 +87,9 @@ impl Inner {
         };
 
         let _account = self.client.new_account(contact, tos_agreed, rsa_bits)?;
-        let file = std::fs::File::create(&account_path)
+        let mut options = OpenOptions::new();
+        options.write(true).create(true).mode(0o600);
+        let file = options.open(&account_path)
             .map_err(|err| format_err!("failed to open {:?} for writing: {}", account_path, err))?;
         self.write_to(file).map_err(|err| {
             format_err!(
@@ -137,7 +141,9 @@ impl Inner {
 
         let tmp_path = format!("{}.tmp", account_path);
         // FIXME: move proxmox::tools::replace_file & make_temp out into a nice *little* crate...
-        let mut file = std::fs::File::create(&tmp_path)
+        let mut options = OpenOptions::new();
+        options.write(true).create(true).mode(0o600);
+        let mut file = options.open(&tmp_path)
             .map_err(|err| format_err!("failed to open {:?} for writing: {}", tmp_path, err))?;
         self.write_to(&mut file).map_err(|err| {
             format_err!("failed to write acme account to {:?}: {}", tmp_path, err)