Set permissions of Data.fs to sane value

[Berthold Stöger]

When installing a Zope instance, Data.fs by default ends up with permissions 0644. Permissions should instead probably be set to 0600 independently of umask, since there seems to be no reason that anyone but the application server (and maybe backup programs) should be able to read the file. On the other hand a world readable Data.fs poses a security risk on multi-user systems (think for example stored DB-Passwords).

[Andreas Jung (ajung)]

The right place is possible in FileStorage.py:

        if self._file is None and create:
            if os.path.exists(file_name):
                os.remove(file_name)

            self._file = open(file_name, 'w+b')
>> os.chmod(....)
            self._file.write(packed_version)

[Jens Vagelpohl (dataflake-deactivatedaccount-deactivatedaccount)]

Moving to the ZODB project

[Tres Seaver (tseaver)]

Controlling this setting is *policy*, and belongs in the config file: not surprisingly, the 'umask' value in the ZConfig schemas for both Zope2 and zdaemon allow this value to be tweaked.