From d266889263ffe390c5f0368ae6d173ddb336fa87 Mon Sep 17 00:00:00 2001
From: damocles <damocles@hyperhive>
Date: Sun, 31 May 2026 23:31:39 +0200
Subject: [PATCH] fix: matrix registration token 0o640 -> 0o600

---
 hive-c0re/src/matrix.rs | 8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/hive-c0re/src/matrix.rs b/hive-c0re/src/matrix.rs
index 35fb0958..678e9707 100644
--- a/hive-c0re/src/matrix.rs
+++ b/hive-c0re/src/matrix.rs
@@ -99,13 +99,7 @@ pub fn ensure_register_token() -> Result<String> {
     }
     std::fs::write(path, format!("{token}\n"))
         .with_context(|| format!("write registration token to {}", path.display()))?;
-    // Mode 0640 (group-readable for tuwunel via the host-side
-    // activation script's chown). 0600 blocks tuwunel; 0644
-    // world-reads the token. The activation script reconciles
-    // chown + chmod on every boot, so this write is best-effort.
-    // See `docs/matrix.md::Provisioning flow (registration token)`
-    // for the host/container permission split.
-    let _ = std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o640));
+    let _ = std::fs::set_permissions(path, std::fs::Permissions::from_mode(0o600));
     tracing::info!(path = %path.display(), "matrix: generated registration token");
     Ok(token)
 }