Download this file
| 1 | //go:build linux |
| 2 | |
| 3 | package host |
| 4 | |
| 5 | import ( |
| 6 | "context" |
| 7 | "errors" |
| 8 | "os" |
| 9 | "path/filepath" |
| 10 | |
| 11 | "github.com/carlosframework/platform/internal/hostbox" |
| 12 | "golang.org/x/sys/unix" |
| 13 | ) |
| 14 | |
| 15 | // Physical identities only restrict the root inventory. Missing or intended |
| 16 | // payloads remain unresolved; this reader never settles or rewrites them. |
| 17 | func generationPayloadFiles(ctx context.Context, root string, payloads []hostbox.GenerationPayload) error { |
| 18 | count := 0 |
| 19 | for _, p := range payloads { |
| 20 | for _, e := range p.Inventory.Entries { |
| 21 | if err := ctx.Err(); err != nil { |
| 22 | return err |
| 23 | } |
| 24 | count++ |
| 25 | if count > 8192 { |
| 26 | return os.ErrPermission |
| 27 | } |
| 28 | if e.Kind == "route" || e.Kind == "timer" { |
| 29 | continue |
| 30 | } |
| 31 | if e.Kind != "path" || e.ManagedRoot != "data" || e.Materialization != "materialized" || !filepath.IsLocal(e.RelativePath) || filepath.Clean(e.RelativePath) != e.RelativePath || e.RelativePath == "." || e.Device == 0 || e.Inode == 0 || (e.Type != unix.S_IFDIR && e.Type != unix.S_IFREG) { |
| 32 | return os.ErrPermission |
| 33 | } |
| 34 | err := hostbox.VerifyInventoryIdentity(root, e) |
| 35 | if errors.Is(err, os.ErrPermission) { |
| 36 | if uid, ok := lookupUID(serviceUser); ok && uid > 0 { |
| 37 | err = hostbox.VerifyInventoryIdentityForOwner(root, e, uint32(uid)) |
| 38 | } |
| 39 | } |
| 40 | if err != nil { |
| 41 | return err |
| 42 | } |
| 43 | |
| 44 | } |
| 45 | } |
| 46 | return ctx.Err() |
| 47 | } |
| 48 | |
amadan