Create private log files

Create new log files with mode 0600 on Unix during logger initialization
and when a missing file is recreated during a later write. Existing log
files are left unchanged.

This keeps peer IDs, channel IDs, payment hashes, and payment amounts
from being readable by other local users when log files are created
under a permissive umask.

Non-Unix platforms retain their existing log file creation behavior.

This commit was created with assistance from Codex.

Author: tankyleo

src/logger.rs

@@ -10,6 +10,8 @@
 use core::fmt;
 use std::fs;
 use std::io::Write;
+#[cfg(unix)]
+use std::os::unix::fs::OpenOptionsExt;
 use std::path::Path;
 use std::sync::Arc;
 
@@ -24,6 +26,14 @@ use log::{Level as LogFacadeLevel, Record as LogFacadeRecord};
 
 use crate::io::utils::create_dir_all_private;
 
+fn open_log_file(file_path: &str) -> std::io::Result<fs::File> {
+	let mut options = fs::OpenOptions::new();
+	options.create(true).append(true);
+	#[cfg(unix)]
+	options.mode(0o600);
+	options.open(file_path)
+}
+
 /// A unit of logging output with metadata to enable filtering `module_path`,
 /// `file`, and `line` to inform on log's source.
 #[cfg(not(feature = "uniffi"))]
@@ -210,10 +220,7 @@ impl LogWriter for Writer {
 					context,
 				);
 
-				fs::OpenOptions::new()
-					.create(true)
-					.append(true)
-					.open(file_path)
+				open_log_file(file_path)
 					.expect("Failed to open log file")
 					.write_all(log.as_bytes())
 					.expect("Failed to write to log file")
@@ -267,10 +274,7 @@ impl Logger {
 				.map_err(|e| eprintln!("ERROR: Failed to create log parent directory: {}", e))?;
 
 			// make sure the file exists.
-			fs::OpenOptions::new()
-				.create(true)
-				.append(true)
-				.open(&file_path)
+			open_log_file(&file_path)
 				.map_err(|e| eprintln!("ERROR: Failed to open log file: {}", e))?;
 		}
 
@@ -310,6 +314,23 @@ mod tests {
 	use std::sync::Mutex;
 
 	use super::*;
+	#[cfg(unix)]
+	use crate::io::test_utils::random_storage_path;
+
+	#[cfg(unix)]
+	#[test]
+	fn creates_private_log_file() {
+		use std::os::unix::fs::PermissionsExt;
+
+		let log_dir = random_storage_path();
+		let log_path = log_dir.join("ldk_node.log");
+		let _logger =
+			Logger::new_fs_writer(log_path.to_str().unwrap().to_string(), LogLevel::Info).unwrap();
+
+		let mode = log_path.metadata().unwrap().permissions().mode();
+		assert_eq!(mode & 0o077, 0);
+		fs::remove_dir_all(log_dir).unwrap();
+	}
 
 	/// A minimal log facade logger that captures log output for testing.
 	struct TestLogger {