pub fn write_private(path: &Path, bytes: &[u8]) -> Result<(), StoreError>Expand description
Atomic write with restrictive permissions: temp file then rename.
The mode is set as the file is created, not chmodded afterwards.
Writing at the ambient umask and tightening after leaves a window in which
the plaintext temp file is world-readable — and act secret prints
filesystem permissions as the store’s only protection, so that window is a
broken promise rather than a small imprecision. rename carries the mode
with the inode, so the destination is never briefly loose either.
create_new for the same reason: the temp file must be one we created. A
leftover from a crash is removed first, but anything that reappears in
between (a hostile pre-created file, a symlink pointed elsewhere) makes the
open fail loudly instead of writing plaintext through someone else’s inode.