Expected Behavior

I expect the key file and the key database to be created mode 0600 (-rw-------) but instead they get default permissions, generally 0644 (-rw-r--r--).

This is not the most secure default because other users on the system can access the key file and password database. A misconfigured system, such as one with a web server, could inadvertently allow access to the key file & database remotely. Defaulting to mode 0600 would help prevent exposure.

Users can change the file mode if desired (see #1871).

Steps to Reproduce

On Linux,

1. Create a new password database.
2. Create a new key file.
3. Inspect file permissions (eg. ls -l *.key *.kdbx)

Debug Info

KeePassXC - Version 2.3.4
Revision: 6fe821c

Libraries:

• Qt 5.11.2
• libgcrypt 1.8.4

Operating system: Debian GNU/Linux 9 (stretch)
CPU architecture: x86_64
Kernel: linux 4.18.0-3-amd64

Enabled extensions:

• Auto-Type
• Browser Integration
• Legacy Browser Integration (KeePassHTTP)
• SSH Agent
• YubiKey