🔒 [security] Set restricted permissions on socket and runtime directory (#40)

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>

src/bin/daemon.rs

@@ -9,6 +9,7 @@ use pwsp::{
         pipewire::create_virtual_mic,
     },
 };
+use std::os::unix::fs::PermissionsExt;
 use std::{error::Error, fs, time::Duration};
 use tokio::{
     io::{AsyncReadExt, AsyncWriteExt},
@@ -54,6 +55,8 @@ async fn main() -> Result<(), Box<dyn Error>> {
     }
 
     let listener = UnixListener::bind(&socket_path)?;
+    fs::set_permissions(&socket_path, fs::Permissions::from_mode(0o600))?;
+
     println!(
         "Daemon started. Listening on {}",
         socket_path.to_str().unwrap_or_default()