Module fs_perm 

Unix secret file/dir permission helpers (G-AUD-24). Unix secret file/dir modes — single source (G-AUD-24 / no hardcode drift).

Platform coverage (A9)

Only Unix is implemented. A Windows DACL restricted to the current user needs windows-sys with the Win32_Security / Win32_Storage_FileSystem features, which this crate does not currently enable, so the code cannot be written here without touching Cargo.toml. Until then, every entry point reports crate::fs_perm::SecretProtection::Unsupported instead of returning a success that would make the caller believe a secret file is locked down when it is not.

Enums

SecretProtection

Whether a restrictive mode was actually applied to a path.

Functions

secret_dir_mode

Compile-time alias for call sites that need the raw secret-dir mode integer.

secret_file_mode

Compile-time alias for call sites that need the raw secret-file mode integer.

secret_protection_supported

True when this build can restrict access to secret files and directories.

set_secret_dir_mode

Sets secret-dir mode (0o700) on Unix; warns on unsupported targets.

set_secret_dir_mode_checked

Sets secret-dir mode (0o700) and reports whether it was applied.

set_secret_file_mode

Sets secret-file mode (0o600) on Unix; warns on unsupported targets.

set_secret_file_mode_checked

Sets secret-file mode (0o600) and reports whether it was applied.

write_secret_file_atomic

Writes secret bytes to path atomically, never exposing them at a wider mode.