fix: harden security resource lifecycles

internal/leviathan/binsnoop/binsnoop.go

@@ -134,11 +134,11 @@ func CarveResult(data []byte, result SignatureResult, outputDir string) error {
 	if result.Offset < 0 || result.Offset+result.Size > len(data) {
 		return fmt.Errorf("binsnoop: result offset/size exceeds data bounds")
 	}
-	if err := os.MkdirAll(outputDir, 0755); err != nil {
+	if err := os.MkdirAll(outputDir, 0700); err != nil {
 		return fmt.Errorf("binsnoop: mkdir: %w", err)
 	}
 	outPath := filepath.Join(outputDir, fmt.Sprintf("%x_%s.bin", result.Offset, result.Name))
-	return os.WriteFile(outPath, data[result.Offset:result.Offset+result.Size], 0644)
+	return os.WriteFile(outPath, data[result.Offset:result.Offset+result.Size], 0600)
 }
 
 // SignatureCount returns the number of loaded signatures.

internal/leviathan/binsnoop/common_test.go

@@ -3,6 +3,7 @@ package binsnoop
 import (
 	"os"
 	"path/filepath"
+	"runtime"
 	"strings"
 	"testing"
 )
@@ -20,3 +21,27 @@ func TestReadFileLimitedRejectsOversizedFile(t *testing.T) {
 		t.Fatalf("unexpected error: %v", err)
 	}
 }
+
+func TestCarveUsesPrivatePermissions(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("POSIX permission bits are not enforced on Windows")
+	}
+	path := filepath.Join(t.TempDir(), "private", "carved.bin")
+	if err := Carve(path, []byte("secret"), 0, 6); err != nil {
+		t.Fatal(err)
+	}
+	info, err := os.Stat(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := info.Mode().Perm(); got != 0600 {
+		t.Fatalf("carved file permissions = %04o, want 0600", got)
+	}
+	dirInfo, err := os.Stat(filepath.Dir(path))
+	if err != nil {
+		t.Fatal(err)
+	}
+	if got := dirInfo.Mode().Perm(); got != 0700 {
+		t.Fatalf("carve directory permissions = %04o, want 0700", got)
+	}
+}

internal/leviathan/binsnoop/extract.go

@@ -14,10 +14,10 @@ func Carve(outputPath string, data []byte, offset, size int) error {
 		return fmt.Errorf("carve: offset %d + size %d exceeds data length %d", offset, size, len(data))
 	}
 	dir := filepath.Dir(outputPath)
-	if err := os.MkdirAll(dir, 0755); err != nil {
+	if err := os.MkdirAll(dir, 0700); err != nil {
 		return fmt.Errorf("carve: mkdir: %w", err)
 	}
-	return os.WriteFile(outputPath, data[offset:offset+size], 0644)
+	return os.WriteFile(outputPath, data[offset:offset+size], 0600)
 }
 
 // executeExternal runs an external extraction tool.
@@ -27,7 +27,7 @@ func executeExternal(ext *Extractor, carvedFilePath, outputDir string) *Extracti
 		OutputDirectory: outputDir,
 	}
 
-	if err := os.MkdirAll(outputDir, 0755); err != nil {
+	if err := os.MkdirAll(outputDir, 0700); err != nil {
 		return result
 	}
 
@@ -100,7 +100,7 @@ func ExecuteExtraction(data []byte, filePath string, sig *SignatureResult, ext *
 
 	case ExtractorTypeExternal:
 		// Carve data to a temp file for external tools
-		if err := os.MkdirAll(outputDir, 0755); err != nil {
+		if err := os.MkdirAll(outputDir, 0700); err != nil {
 			return &ExtractionResult{OutputDirectory: outputDir}
 		}
 
@@ -109,7 +109,7 @@ func ExecuteExtraction(data []byte, filePath string, sig *SignatureResult, ext *
 		if endOffset > len(data) {
 			endOffset = len(data)
 		}
-		if err := os.WriteFile(carvedFile, data[sig.Offset:endOffset], 0644); err != nil {
+		if err := os.WriteFile(carvedFile, data[sig.Offset:endOffset], 0600); err != nil {
 			return &ExtractionResult{OutputDirectory: outputDir}
 		}