On macOS, release builds log to /tmp/Moonlight-<epoch>.log. /tmp is
shared by all users and the file name is predictable, so another local
user could plant symlinks at upcoming log names and have Moonlight
truncate and overwrite any file the victim can write to. The log was
also created world-readable.
Open the log with QIODevice::NewOnly (O_CREAT|O_EXCL) so an existing
file or symlink is never opened, and create it readable only by the
owner on Qt 6.3+. If the open fails we keep logging to stderr, as we
already did for any other open failure.
Chris
8f2e52e540
