[security] Make sure the jmxservlet.token file is not world readable on Unix/Linux/macOS systems

Author: adamretter

exist-core/src/main/java/org/exist/management/client/JMXServlet.java

@@ -56,6 +56,9 @@
 import java.nio.file.Files;
 import java.nio.file.Path;
 import java.nio.file.Paths;
+import java.nio.file.attribute.PosixFileAttributes;
+import java.nio.file.attribute.PosixFilePermission;
+import java.nio.file.attribute.PosixFilePermissions;
 import java.util.HashSet;
 import java.util.Properties;
 import java.util.Set;
@@ -338,6 +341,13 @@ private String getToken() {
         // Create and write when needed
         if (!Files.exists(tokenFile) || token == null) {
 
+            final Set<PosixFilePermission> permissions = PosixFilePermissions.fromString("rw-r-----");
+            try {
+                tokenFile = Files.createFile(tokenFile, PosixFilePermissions.asFileAttribute(permissions));
+            } catch (final Throwable t) {
+                LOG.warn("Unable to restrict permissions on: " + tokenFile);
+            }
+
             // Create random token
             token = UUIDGenerator.getUUIDversion4();