Reduce permissions for created files on Unix-like platforms

src/backend.rs

@@ -28,6 +28,8 @@ use subspace_farmer::NodeRpcClient;
 use subspace_networking::libp2p::identity::ed25519::{Keypair, SecretKey};
 use subspace_networking::{Node, NodeRunner};
 use tokio::fs;
+use tokio::fs::OpenOptions;
+use tokio::io::AsyncWriteExt;
 use tokio::runtime::Handle;
 use tracing::{error, info_span, warn, Instrument};
 
@@ -657,7 +659,14 @@ async fn create_networking_stack(
             })?;
         }
 
-        fs::write(&keypair_path, network_keypair.secret())
+        let mut options = OpenOptions::new();
+        options.write(true).truncate(true).create(true);
+        #[cfg(unix)]
+        options.mode(0x600);
+        options
+            .open(&keypair_path)
+            .await?
+            .write_all(network_keypair.secret().as_ref())
             .await
             .map_err(|error| {
                 anyhow::anyhow!(

src/backend/config.rs

@@ -7,6 +7,8 @@ use std::str::FromStr;
 use subspace_core_primitives::PublicKey;
 use subspace_farmer::utils::ss58::{parse_ss58_reward_address, Ss58ParsingError};
 use tokio::fs;
+use tokio::fs::OpenOptions;
+use tokio::io::AsyncWriteExt;
 
 // TODO: Replace with `DiskFarm`
 #[derive(Debug, Clone, Serialize, Deserialize)]
@@ -94,11 +96,19 @@ impl RawConfig {
     }
 
     pub async fn write_to_path(&self, config_file_path: &Path) -> io::Result<()> {
-        fs::write(
-            config_file_path,
-            serde_json::to_string_pretty(self).expect("Config serialization is infallible; qed"),
-        )
-        .await
+        let mut options = OpenOptions::new();
+        options.write(true).truncate(true).create(true);
+        #[cfg(unix)]
+        options.mode(0x600);
+        options
+            .open(config_file_path)
+            .await?
+            .write_all(
+                serde_json::to_string_pretty(self)
+                    .expect("Config serialization is infallible; qed")
+                    .as_bytes(),
+            )
+            .await
     }
 
     pub fn reward_address(&self) -> &str {

src/main.rs

@@ -610,7 +610,7 @@ fn supervisor() -> io::Result<()> {
             ContentLimit::Bytes(LOG_FILE_LIMIT_SIZE),
             Compression::OnRotate(0),
             #[cfg(unix)]
-            None,
+            Some(0o600),
         )
     });