token/disk: write token with 0600

CHANGELOG.md

@@ -1,5 +1,9 @@
 ## 0.1.1 (May 2, 2015)
 
+SECURITY CHANGES:
+
+  * token/disk: write the token to disk with 0600 perms
+
 IMPROVEMENTS:
 
   * core: Very verbose error if mlock fails [GH-59]

builtin/token/disk/command.go

@@ -56,7 +56,7 @@ func (c *Command) Run(args []string) int {
 			return 1
 		}
 	case "store":
-		f, err := os.Create(path)
+		f, err := os.OpenFile(path, os.O_CREATE|os.O_TRUNC|os.O_WRONLY, 0600)
 		if err != nil {
 			fmt.Fprintf(os.Stderr, "%s\n", err)
 			return 1