[jira] [Resolved] (CAMEL-24447) camel-pqc - FileBasedKeyLifecycleManager writes private keys with default file permissions

["Andrea Cosentino (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CAMEL-24447?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Andrea Cosentino resolved CAMEL-24447.
--------------------------------------
    Resolution: Fixed

Fixed on main via https://github.com/apache/camel/pull/25826 (squash commit 957b28aa), targeting 4.23.0.

_Claude Code on behalf of Andrea Cosentino_

> camel-pqc - FileBasedKeyLifecycleManager writes private keys with default file permissions
> ------------------------------------------------------------------------------------------
>
>                 Key: CAMEL-24447
>                 URL: https://issues.apache.org/jira/browse/CAMEL-24447
>             Project: Camel
>          Issue Type: Bug
>          Components: camel-pqc
>            Reporter: Andrea Cosentino
>            Assignee: Andrea Cosentino
>            Priority: Major
>             Fix For: 4.23.0
>
>
> {{FileBasedKeyLifecycleManager.storeKey()}} writes {{<keyId>.private.json}} - a Base64 PKCS#8 private key in plain JSON - with {{Files.writeString}} and no permission restriction. The constructor creates the key directory the same way, and {{migrateLegacyKey()}} re-stores legacy keys into the same layout.
> Under the common {{022}} umask the directory and the private-key files end up world-readable.
> Proposal: create the directory with {{PosixFilePermissions}} {{rwx------}} and the key files {{rw-------}} where the file system supports POSIX permissions, falling back to {{File.setReadable(false, false)}} / {{setWritable(false, false)}} elsewhere, and verify the permissions after creation rather than assuming the umask cooperated. Existing files created by an earlier version should be tightened on load, or at least warned about.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)