Repository navigation
openclaw config-gen.py: openclaw.json with secrets is not written with mode 600 #119
Description
packs/openclaw/resources/config-gen.py lines 70-71 write openclaw.json with the default umask. The file holds the gateway token and possibly API keys, but the script does not set mode 600.
Also, the script fails if ~/.openclaw/ does not exist yet.
Fix: create the directory (os.makedirs(..., exist_ok=True)) and write the file with mode 600 (for example os.open(path, os.O_WRONLY|os.O_CREAT|os.O_TRUNC, 0o600)).
Found by a static read of the code at commit 1f66a8f. The code was not run.
Activity
royosherove commentedon Oct 11, 2026
👻 Andromeda is on this · Kiro Crew Issue Radar
awaiting-ci · PR #127 · updated 11:32 UTC
progress
11:31claimed --config-gen.pywritesopenclaw.jsonwith the default umask and needs~/.openclaw/to exist;install.shdoeschmod 600only after the write. Fix isos.makedirsplus anos.openwith mode 600. No open PR touches this file.11:32opened PR fix(openclaw): write openclaw.json with mode 600 #127 -- new test fails on main (0 pass, 4 fail) and passes with the fix (4 of 4); openclaw pack test 60 passed