security(config): preserve restrictive permissions during atomic geo-filter saves #340

Context

Identified by a static comparison on 2026-10-07 against dborup/CoreScope master 6444294d938083f6d935d0445c27bc6a7bbf360e. This is follow-up work for evaluation and implementation, not a claim of an observed production incident. Recheck current master before implementation. No deployment is authorized by this issue alone.

Upstream reference: Kpa-clawbot fork, PR 2126 (reference only; intentionally not linked to avoid upstream notifications)

Benefit and existing coverage

SaveGeoFilter in cmd/server/config.go writes config.json.tmp with mode 0644 and renames it over config.json. A config deliberately restricted to 0600 can therefore become more broadly readable, subject to umask. Config may contain credentials. No equivalent preservation is present in the reviewed master.

Required work / acceptance criteria

• Preserve existing restrictive permissions and handle metadata/read failures safely rather than silently choosing permissive defaults.
• Create a unique secure temporary file in the destination directory and preserve atomic replacement.
• Do not simply copy upstream's WriteFile mode argument: it does not change the permissions of an already existing .tmp file.
• Avoid following a pre-existing temporary-file symlink/hard link; keep cleanup scoped to files created by this operation.
• Test 0600 and 0644 inputs, pre-existing temporary files, write/rename failures and supported config lookup locations.
• Preserve unrelated config fields and evaluate owner/group behavior, including the proposed non-root container migration.

Suggested priority: high. Do not expose real credentials in tests or issue output.