Use secure temporary config files

config/user_config.go

@@ -8,6 +8,7 @@ import (
 	"io/ioutil"
 	"net"
 	"os"
+	"path/filepath"
 	"strconv"
 	"strings"
 	"sync"
@@ -61,15 +62,24 @@ func (c *Config) saveConfigLocked() error {
 	if err != nil {
 		return err
 	}
-	tmp := c.fn + ".tmp"
-	if err := ioutil.WriteFile(tmp, data, 0600); err != nil {
+	file, err := os.CreateTemp(filepath.Dir(c.fn), filepath.Base(c.fn)+".tmp-")
+	if err != nil {
 		return err
 	}
-	if err := os.Rename(tmp, c.fn); err != nil {
-		_ = os.Remove(tmp)
+	tmp := file.Name()
+	defer os.Remove(tmp)
+	if err := file.Chmod(0600); err != nil {
+		file.Close()
 		return err
 	}
-	return nil
+	if _, err := file.Write(data); err != nil {
+		file.Close()
+		return err
+	}
+	if err := file.Close(); err != nil {
+		return err
+	}
+	return os.Rename(tmp, c.fn)
 }
 
 func key(k uiterm.Key) *uiterm.Key {