Problem
Beets stores authentication/token files that may contain sensitive credentials. These files should not be readable or writable by other users on the system.
Currently, token files may be created using the default filesystem permissions, which can result in permissions that are more permissive than intended depending on the user's umask.
Expected behavior
Token files should always be created with permissions:
This means:
- Owner: read + write
- Group: no access
- Others: no access
The implementation should explicitly set the file mode rather than relying solely on the process umask.
Proposed solution
When creating or writing token files, ensure they are created with 0600 permissions. Ideally, the file should be created atomically with the desired mode to avoid a window where the file has broader permissions.
For existing token files, consider restricting their permissions to 0600 when they are accessed or updated.
Problem
Beets stores authentication/token files that may contain sensitive credentials. These files should not be readable or writable by other users on the system.
Currently, token files may be created using the default filesystem permissions, which can result in permissions that are more permissive than intended depending on the user's
umask.Expected behavior
Token files should always be created with permissions:
This means:
The implementation should explicitly set the file mode rather than relying solely on the process
umask.Proposed solution
When creating or writing token files, ensure they are created with
0600permissions. Ideally, the file should be created atomically with the desired mode to avoid a window where the file has broader permissions.For existing token files, consider restricting their permissions to
0600when they are accessed or updated.