clawbot
fd32f348b7
check / check (push) Waiting to run
A hard link in /data shares its owner with a file that can be anywhere on the same filesystem, so chowning it gave that file to the netwatch user. A file with more than one name now keeps its owner and its path is logged. Owners are now set on the opened directory, file or link after checking it, as chmodDir sets modes, so a hard link swapped in afterwards is caught. Every other file is opened without following it; a symbolic link is given to the netwatch user itself, and devices, named pipes and sockets keep their owner. This is built only for Linux: prepare-data-dir runs only in the Linux image, and macOS has neither O_PATH nor AT_EMPTY_PATH; elsewhere it returns an error. A failed owner change names the file. Model: opus-5-5
22 lines
723 B
Go
22 lines
723 B
Go
//go:build !linux
|
|
|
|
package reportbuf
|
|
|
|
import (
|
|
"errors"
|
|
"io/fs"
|
|
"os"
|
|
)
|
|
|
|
// chownFile returns an error on every system but Linux. Opening a file
|
|
// that is not a directory without reading it or following it, and
|
|
// giving it to a user on the open file, never by name, is built only
|
|
// for Linux (see datadir_linux.go): prepare-data-dir runs only in the
|
|
// Linux image, and macOS, where the backend is also built for
|
|
// development, has neither O_PATH nor AT_EMPTY_PATH. This file lets
|
|
// the package build elsewhere, such as on macOS, where a developer
|
|
// runs make build and make run.
|
|
func chownFile(_ *os.Root, name string, _, _ int) error {
|
|
return &fs.PathError{Op: "chown", Path: name, Err: errors.ErrUnsupported}
|
|
}
|