Suricata

We generally use a simple fopen pattern when creating files. This is considered to be unsafe as it might create files with permissions that too broad.

There is a workaround, which is to set the umask config option the yaml. This should probably be enabled by default.

Github/CodeQL suggests a more explicit pattern of using open with explicit permission flags followed by fdopen to get a FILE pointer. This is fairly easy for C, but needs a bit more thought for Rust as there we'd need to add Unix specific logic.