sneak
4d999fbc7e
check / check (push) Waiting to run
A hard link in /data shares its owner with a file that can be anywhere on the same filesystem, so chowning it gave that file to the netwatch user. A file with more than one name now keeps its owner and its path is logged. Owners are now set on the opened directory, file or link after checking it, as chmodDir sets modes, so a hard link swapped in afterwards is caught. Every other file is opened without following it; a symbolic link is given to the netwatch user itself, and devices, named pipes and sockets keep their owner. This needs Linux, the image's system; elsewhere it returns an error. A failed owner change names the file. Model: opus-5-5
65 lines
1.9 KiB
Go
65 lines
1.9 KiB
Go
//go:build linux
|
|
|
|
package reportbuf
|
|
|
|
import (
|
|
"io/fs"
|
|
"log/slog"
|
|
"os"
|
|
"syscall"
|
|
|
|
"golang.org/x/sys/unix"
|
|
)
|
|
|
|
// chownFile gives name, a file inside root that is not a directory, to
|
|
// uid and gid if it is a regular file or symbolic link with one name.
|
|
// It leaves, and logs, a file of any kind with a second name (hard
|
|
// link): all the names of a file share its owner, and the other could
|
|
// be outside root. It leaves any other file with one name, such as a
|
|
// device, named pipe or socket: the server needs to own none of them.
|
|
// It opens name through root with O_PATH, which reads nothing from the
|
|
// file, so opening a device or named pipe neither waits nor acts on
|
|
// it; os.Root adds O_NOFOLLOW, and the two together open a symbolic
|
|
// link itself, never what it points to. It reads the kind of file and
|
|
// its number of names from the open file and gives that file to them,
|
|
// so a hard link swapped in at name is caught too.
|
|
//
|
|
// This file is built only on Linux, because O_PATH and AT_EMPTY_PATH
|
|
// exist only there; prepare-data-dir runs only in the Linux image. On
|
|
// any other system chownFile returns an error (see datadir_other.go).
|
|
func chownFile(root *os.Root, name string, uid, gid int) error {
|
|
file, err := root.OpenFile(name, unix.O_PATH, 0)
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
defer func() { _ = file.Close() }()
|
|
|
|
info, err := file.Stat()
|
|
if err != nil {
|
|
return err
|
|
}
|
|
|
|
stat, ok := info.Sys().(*syscall.Stat_t)
|
|
if !ok || stat.Nlink > 1 {
|
|
slog.Warn("owner not changed: file has a second name (hard link)",
|
|
"path", file.Name())
|
|
|
|
return nil
|
|
}
|
|
|
|
if !info.Mode().IsRegular() && info.Mode().Type() != fs.ModeSymlink {
|
|
return nil
|
|
}
|
|
|
|
// File.Chown would fail: fchown refuses a file opened with O_PATH.
|
|
// Fchownat with an empty name and AT_EMPTY_PATH acts on the open
|
|
// file instead.
|
|
err = unix.Fchownat(int(file.Fd()), "", uid, gid, unix.AT_EMPTY_PATH)
|
|
if err != nil {
|
|
return &fs.PathError{Op: "chown", Path: file.Name(), Err: err}
|
|
}
|
|
|
|
return nil
|
|
}
|