From 794eab58d4729066e2b8c79ba0dd65c5895154ef Mon Sep 17 00:00:00 2001
From: Meo597 <197331664+Meo597@users.noreply.github.com>
Date: Tue, 20 Oct 2026 04:12:11 +0800
Subject: [PATCH] TLS/REALITY: Restrict master key log file permissions to 0600

---
 transport/internet/reality/config.go | 2 +-
 transport/internet/tls/config.go     | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/transport/internet/reality/config.go b/transport/internet/reality/config.go
index 6709ae2c8..4e1b625dc 100644
--- a/transport/internet/reality/config.go
+++ b/transport/internet/reality/config.go
@@ -68,7 +68,7 @@ func KeyLogWriterFromConfig(c *Config) io.Writer {
 		return nil
 	}
 
-	writer, err := os.OpenFile(c.MasterKeyLog, os.O_CREATE|os.O_RDWR|os.O_APPEND, 0o644)
+	writer, err := os.OpenFile(c.MasterKeyLog, os.O_CREATE|os.O_RDWR|os.O_APPEND, 0o600)
 	if err != nil {
 		errors.LogErrorInner(context.Background(), err, "failed to open ", c.MasterKeyLog, " as master key log")
 	}
diff --git a/transport/internet/tls/config.go b/transport/internet/tls/config.go
index 6fbe59320..71bd6cec8 100644
--- a/transport/internet/tls/config.go
+++ b/transport/internet/tls/config.go
@@ -466,7 +466,7 @@ func (c *Config) GetTLSConfig(opts ...Option) *tls.Config {
 	}
 
 	if len(c.MasterKeyLog) > 0 && c.MasterKeyLog != "none" {
-		writer, err := os.OpenFile(c.MasterKeyLog, os.O_CREATE|os.O_RDWR|os.O_APPEND, 0o644)
+		writer, err := os.OpenFile(c.MasterKeyLog, os.O_CREATE|os.O_RDWR|os.O_APPEND, 0o600)
 		if err != nil {
 			errors.LogErrorInner(context.Background(), err, "failed to open ", c.MasterKeyLog, " as master key log")
 		} else {