[jira] [Created] (CAMEL-24447) camel-pqc - FileBasedKeyLifecycleManager writes private keys with default file permissions

["Andrea Cosentino (Jira)" <ji...@apache.org>]

Andrea Cosentino created CAMEL-24447:
----------------------------------------

             Summary: camel-pqc - FileBasedKeyLifecycleManager writes private keys with default file permissions
                 Key: CAMEL-24447
                 URL: https://issues.apache.org/jira/browse/CAMEL-24447
             Project: Camel
          Issue Type: Bug
          Components: camel-pqc
            Reporter: Andrea Cosentino
            Assignee: Andrea Cosentino
             Fix For: 4.23.0


{{FileBasedKeyLifecycleManager.storeKey()}} writes {{<keyId>.private.json}} - a Base64 PKCS#8 private key in plain JSON - with {{Files.writeString}} and no permission restriction. The constructor creates the key directory the same way, and {{migrateLegacyKey()}} re-stores legacy keys into the same layout.

Under the common {{022}} umask the directory and the private-key files end up world-readable.

Proposal: create the directory with {{PosixFilePermissions}} {{rwx------}} and the key files {{rw-------}} where the file system supports POSIX permissions, falling back to {{File.setReadable(false, false)}} / {{setWritable(false, false)}} elsewhere, and verify the permissions after creation rather than assuming the umask cooperated. Existing files created by an earlier version should be tightened on load, or at least warned about.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)