noise: restrict persisted config permissions

[benma-agent]

Create new Noise config files with mode 0600 on Unix and tighten permissions on
existing files. Apply permissions before truncating existing configs so failures
preserve pairing data. Leave symlinks and their targets untouched.

Document that callers must create the config directory themselves, with mode 0700
recommended on Unix.

[NickeZ]

• Medium — The permission check has a pathname race. Between symlink_metadata() and set_permissions() at
  src/noise.rs:62, an actor able to modify the directory can replace bitbox.json. set_permissions() may
  then follow a new symlink and chmod an unrelated target, while the originally opened file remains
  permissive. Use handle-based permission changes and a no-follow open.

• Low — A permission error destroys the existing config. src/noise.rs:118 truncates the file before
  permission enforcement. If chmod subsequently fails, store_config() returns an error but the previous
  pairing data is already gone. Open without truncation, validate permissions first, then truncate/write;
  an atomic temporary-file replacement would be stronger.

Should we also emit a warning/error if the config directory is not 0700, like ssh does for .ssh?

[benma]

• Medium — The permission check has a pathname race. Between symlink_metadata() and set_permissions() at
  src/noise.rs:62, an actor able to modify the directory can replace bitbox.json. set_permissions() may
  then follow a new symlink and chmod an unrelated target, while the originally opened file remains
  permissive. Use handle-based permission changes and a no-follow open.
• Low — A permission error destroys the existing config. src/noise.rs:118 truncates the file before
  permission enforcement. If chmod subsequently fails, store_config() returns an error but the previous
  pairing data is already gone. Open without truncation, validate permissions first, then truncate/write;
  an atomic temporary-file replacement would be stronger.

Should we also emit a warning/error if the config directory is not 0700, like ssh does for .ssh?

Emit the warning where/how?

I'd avoid an error, could be breaking downstream apps or be bad if someone has different needs.

Edit: fixed the "low" issue. For medium issue, codex added the "libc" dep and said it's not easy without it. I don't think that issue is a realistic concern anyway, imo we can ignore it.

[NickeZ]

I guess you want to avoid printing to stderr/stdout. I agree, but since we are writing files the library is already doing I/O so we are already kind of not following best practice.

I think a better design would be for the library to just take a file handle and let the consumer of the app handle opening/closing of files.

[NickeZ]

utACK

[benma]

I agree, but since we are writing files the library is already doing I/O so we are already kind of not following best practice.

It is following best practice, as it's behind a trait, so an app can plug in whatever storage backend for the noise data they want too - the PersistedNoiseConfig is a convenience impl.