From 4411d78580e9f1fd954e5f1d0f38c69cff5be32e Mon Sep 17 00:00:00 2001 From: KhooLy <73142442+KhooLy@users.noreply.github.com> Date: Thu, 16 Jul 2026 18:05:43 +0300 Subject: [PATCH] Create storage key file with 0600 from the start fs::write followed by set_permissions left a window where the key was world-readable. --- src-tauri/src/storage.rs | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/src-tauri/src/storage.rs b/src-tauri/src/storage.rs index adc7d66..9c95454 100644 --- a/src-tauri/src/storage.rs +++ b/src-tauri/src/storage.rs @@ -39,12 +39,16 @@ fn load_or_create_key(dir: &Path) -> Result, String> { } fs::create_dir_all(dir).map_err(|e| e.to_string())?; let key = Aes256Gcm::generate_key(&mut OsRng); - fs::write(&path, key.as_slice()).map_err(|e| e.to_string())?; + let mut options = fs::OpenOptions::new(); + options.write(true).create(true).truncate(true); #[cfg(unix)] { - use std::os::unix::fs::PermissionsExt; - let _ = fs::set_permissions(&path, fs::Permissions::from_mode(0o600)); + use std::os::unix::fs::OpenOptionsExt; + options.mode(0o600); } + use std::io::Write; + let mut file = options.open(&path).map_err(|e| e.to_string())?; + file.write_all(key.as_slice()).map_err(|e| e.to_string())?; Ok(key) }