pub fn open_private_append(path: &Path) -> Result<File>Expand description
Open path for appending, owner-only (0o600 on Unix, an owner-only ACL on
Windows, plain elsewhere).
write_private covers a file written in one shot. A file that is appended
to over time cannot use it, and opening one plainly creates it at the umask
default. That is how a run’s archive (run.lvr) and its stage logs ended up
world-readable: nobody chose 0o644 for them, they inherited it, while the
answer sidecar written beside them through write_private was owner-only.
The containing run directory is 0o700, so those files were not reachable in
place. Directory permissions do not survive a copy though, and tar, rsync
or a backup tool preserves the per-file mode while dropping the protection
the directory was providing.
On Windows the restriction is best-effort: a failed ACL call still yields an
open file. write_private guards secrets and fails instead, but these are
a run’s own files, which until now were created at the default and never
restricted at all. Refusing to open one because icacls did not run would
trade “less protected than intended” for “the run cannot record anything”.