secret/internal/vault/lock.go

package vault

import (
	"errors"
	"fmt"
	"os"
	"path/filepath"
	"sync"
	"syscall"

	"git.eeqj.de/sneak/secret/internal/secret"
	"github.com/spf13/afero"
)

// lockFileName is the file in the state directory that LockStateDir locks.
const lockFileName = "lock"

// memFsLock stands in for the lock file on the in-memory filesystem, which
// has no file locks. Every in-memory filesystem in the process shares it.
//
//nolint:gochecknoglobals // must outlive the call that takes it
var memFsLock sync.Mutex

// LockStateDir takes the lock that a command changing anything under
// stateDir holds until it returns, and returns the function that releases
// it. While one command holds it, the next one waits here. Reads take no
// lock: each file or directory a command changes is replaced in a single
// rename, so a reader finds it as it was before or after, never half-made.
// Once it holds the lock, it deletes the temporary files and directories
// that commands killed part-way left behind, since no command still using
// them can be running.
//
// On the real filesystem the lock is flock(2) on the file "lock" in
// stateDir, which the kernel releases when the process dies, so a killed
// command never leaves the tool locked. The in-memory filesystem the tests
// use has no file locks, so a process-wide mutex stands in for flock there.
// Any other filesystem is refused rather than left unlocked.
func LockStateDir(fs afero.Fs, stateDir string) (func(), error) {
	var release func()

	switch fs.(type) {
	case *afero.OsFs:
		var err error

		release, err = flockStateDir(stateDir)
		if err != nil {
			return nil, err
		}
	case *afero.MemMapFs:
		memFsLock.Lock()

		release = memFsLock.Unlock
	default:
		return nil, fmt.Errorf("%w %T", ErrNoLockForFilesystem, fs)
	}

	removeLeftovers(fs, stateDir)

	return release, nil
}

// removeLeftovers deletes the temporary files and directories that commands
// killed part-way left in each directory where secret.WriteFileAtomic and
// secret.TempDirFor make them: the state directory, each vault, each secret
// and each version. Unlocker directories are written whole by
// secret.WriteDir and never changed after, so they hold none. A failure is
// only warned about; the command goes on, and the next one tries again.
func removeLeftovers(fs afero.Fs, stateDir string) {
	dirs := []string{stateDir}

	for _, vaultDir := range subdirs(fs, filepath.Join(stateDir, "vaults.d")) {
		dirs = append(dirs, vaultDir)

		for _, secretDir := range subdirs(fs, filepath.Join(vaultDir, "secrets.d")) {
			dirs = append(dirs, secretDir)
			dirs = append(dirs, subdirs(fs, filepath.Join(secretDir, "versions"))...)
		}
	}

	for _, dir := range dirs {
		err := secret.RemoveLeftovers(fs, dir)
		if err != nil {
			secret.Warn("Failed to remove what an interrupted command left",
				"error", err)
		}
	}
}

// subdirs returns the directories in dir: none if dir does not exist, and
// none, with a warning, if it cannot be read.
func subdirs(fs afero.Fs, dir string) []string {
	entries, err := afero.ReadDir(fs, dir)
	if err != nil {
		if !errors.Is(err, os.ErrNotExist) {
			secret.Warn("Failed to look for what an interrupted command left",
				"directory", dir, "error", err)
		}

		return nil
	}

	var dirs []string

	for _, entry := range entries {
		if entry.IsDir() {
			dirs = append(dirs, filepath.Join(dir, entry.Name()))
		}
	}

	return dirs
}

// flockStateDir takes flock(2) on the lock file in stateDir, creating the
// directory and the file if needed. Go opens files close-on-exec, so
// programs the command runs, such as gpg, do not inherit the lock.
func flockStateDir(stateDir string) (func(), error) {
	err := os.MkdirAll(stateDir, secret.DirPerms)
	if err != nil {
		return nil, fmt.Errorf("failed to create state directory: %w", err)
	}

	lockPath := filepath.Join(stateDir, lockFileName)

	//nolint:gosec // G304: the path is the lock file in the state directory
	file, err := os.OpenFile(lockPath, os.O_RDWR|os.O_CREATE, secret.FilePerms)
	if err != nil {
		return nil, fmt.Errorf("failed to open lock file: %w", err)
	}

	err = syscall.Flock(int(file.Fd()), syscall.LOCK_EX)
	if err != nil {
		_ = file.Close()

		return nil, fmt.Errorf("failed to lock %s: %w", lockPath, err)
	}

	// Closing the file releases the lock.
	return func() { _ = file.Close() }, nil
}