Function write_atomic_with_mode 

pub fn write_atomic_with_mode(
    path: &Path,
    bytes: &[u8],
    mode: u32,
) -> Result<(), Error>

Like write_atomic, but create the temp file with the given Unix permission mode (e.g. 0o600) so the renamed destination is never even briefly world-readable. mode is ignored on non-Unix, where directory ACLs scope the file. Use this for secret-bearing files such as the config.