File permissions are lost whenever a journal file is written to
When creating the temporary files to write new changes, no attention seems to be payed to properly re-creating the permissions of the old file. And once the temp file is moved over, those permissions are gone.
Can you just rely on directory permissions instead?
On Windows, maybe. But on *nix, permissions don't inherit like that.
The files are created with mode 0o700. No matter what the directory permissions are, the group won't be able to read or write to that file.
And while a workaround is to change the umask, that's for the whole process and the same for all files. I'd rather be able to keep the (potentially different) permissions of each individual file.
Just ran into this. I am running beancount-import as a dedicated user _falsifian_beancount (hoping to gain a bit of security), and was surprised to find my .beancount files change to owner: _falsifian_beancount, mode: 600. My umask is 022 so I would expect the mode of new files to be 644 by default.
Possibly related to https://github.com/untitaker/python-atomicwrites/issues/42