From 23b4c833a4e1c0dd38b649dc5791c12cac91b403 Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@amutable.com>
Date: Mon, 9 Mar 2026 13:06:42 +0100
Subject: [PATCH] fileio: add WRITE_DATA_FILE_MODE_0400 mode

---
 src/basic/fileio.c | 2 +-
 src/basic/fileio.h | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/basic/fileio.c b/src/basic/fileio.c
index 66d06484dc..7edf54edf3 100644
--- a/src/basic/fileio.c
+++ b/src/basic/fileio.c
@@ -1706,7 +1706,7 @@ int write_data_file_atomic_at(
                         return r;
         }
 
-        r = fchmod_umask(fd, 0644);
+        r = fchmod_umask(fd, FLAGS_SET(flags, WRITE_DATA_FILE_MODE_0400) ? 0400 : 0644);
         if (r < 0)
                 return r;
 
diff --git a/src/basic/fileio.h b/src/basic/fileio.h
index 3e2372c4dd..274fdfbd7c 100644
--- a/src/basic/fileio.h
+++ b/src/basic/fileio.h
@@ -166,6 +166,7 @@ int fopen_mode_to_flags(const char *mode);
 
 typedef enum WriteDataFileFlags {
         WRITE_DATA_FILE_MKDIR_0755 = 1 << 0,
+        WRITE_DATA_FILE_MODE_0400  = 1 << 1,
 } WriteDataFileFlags;
 
 int write_data_file_atomic_at(int dir_fd, const char *path, const struct iovec *iovec, WriteDataFileFlags flags);