vault noe preserves permissions on edit and rekey and sets a restricitve default umask for all other cases

lib/ansible/cli/vault.py

@@ -86,6 +86,9 @@ class VaultCLI(CLI):
         super(VaultCLI, self).run()
         loader = DataLoader()
 
+        # set default restrictive umask
+        old_umask = os.umask(0o077)
+
         if self.options.vault_password_file:
             # read vault_pass from a file
             self.vault_pass = CLI.read_vault_password_file(self.options.vault_password_file, loader)
@@ -108,6 +111,9 @@ class VaultCLI(CLI):
 
         self.execute()
 
+        # and restore umask
+        os.umask(old_umask)
+
     def execute_encrypt(self):
 
         if len(self.args) == 0 and sys.stdin.isatty():