From 0959f84fd54c7a7f1ebfb1d8fbc74409c5b8b241 Mon Sep 17 00:00:00 2001 From: jvoisin Date: Tue, 14 Apr 2026 23:08:35 +0200 Subject: [PATCH] Use a sane permission for the encryption key file The typical Linux umask of 0022, meaning the encrypted file is world-readable (-rw-r--r--). Any OS-level user on the same system can read the key and decrypt the encrypted credentials from app.db. --- cps/config_sql.py | 1 + 1 file changed, 1 insertion(+) diff --git a/cps/config_sql.py b/cps/config_sql.py index 8f0ab0857..d7208b37d 100644 --- a/cps/config_sql.py +++ b/cps/config_sql.py @@ -583,6 +583,7 @@ def get_encryption_key(key_path): try: with open(key_file, "wb") as f: f.write(key) + os.chmod(key_file, 0o600) except PermissionError as e: error = e return key, error