[468] Set persistence file to only be readable by owner.

Not implemented on Windows.

Thanks to Moshe Zioni.

Bug: https://github.com/eclipse/mosquitto/issues/468

ChangeLog.txt

@@ -2,6 +2,8 @@ Broker:
 - Fix for poor websockets performance.
 - Fix lazy bridges not timing out for idle_timeout. Closes #417.
 - Fix problems with large retained messages over websockets. Closes #427.
+- Set persistence file to only be readable by owner, except on Windows. Closes
+  #468.
 
 Clients:
 - Don't use / in auto-generated client ids.

src/persist.c

@@ -402,6 +402,9 @@ int mqtt3_db_backup(struct mosquitto_db *db, bool shutdown)
 			goto error;
 		}
 	}
+
+	/* Set permissions to -rw------- */
+	umask(0077);
 #endif
 
 	db_fptr = _mosquitto_fopen(outfile, "wb");