Module perms 

File and directory permission hardening.

On Unix these set POSIX mode bits; on other platforms they are no-ops that succeed (Windows ACLs are not modeled here).

Functions

ensure_file_private

If path exists and is accessible to group or others, tighten it to owner-only (0o600) and return Ok(Some(previous_mode)). If it is already private, or does not exist, return Ok(None). On non-Unix platforms this always returns Ok(None).

secure_dir_perms

Restrict a directory to owner-only read/write/execute (0o700 on Unix; no-op elsewhere).

secure_file_perms

Restrict a file to owner-only read/write (0o600 on Unix; no-op elsewhere).

write_private

Write contents to path such that it is never readable by anyone but the owner, not even briefly.