Download this file
| 1 | //go:build linux |
| 2 | |
| 3 | package instancectl |
| 4 | |
| 5 | import ( |
| 6 | "errors" |
| 7 | "github.com/carlosframework/platform/internal/safefile" |
| 8 | "golang.org/x/sys/unix" |
| 9 | "os" |
| 10 | "path/filepath" |
| 11 | ) |
| 12 | |
| 13 | func claimRootDir(dir string) error { |
| 14 | parent, err := safefile.OpenDir(filepath.Dir(dir)) |
| 15 | if err != nil { |
| 16 | return err |
| 17 | } |
| 18 | defer parent.Close() |
| 19 | if err := unix.Mkdirat(int(parent.Fd()), filepath.Base(dir), 0700); err != nil && !errors.Is(err, os.ErrExist) { |
| 20 | return err |
| 21 | } |
| 22 | fd, err := unix.Openat2(int(parent.Fd()), filepath.Base(dir), &unix.OpenHow{Flags: unix.O_DIRECTORY | unix.O_RDONLY | unix.O_CLOEXEC, Resolve: unix.RESOLVE_NO_SYMLINKS | unix.RESOLVE_NO_MAGICLINKS}) |
| 23 | if err != nil { |
| 24 | return err |
| 25 | } |
| 26 | defer unix.Close(fd) |
| 27 | var st unix.Stat_t |
| 28 | if err := unix.Fstat(fd, &st); err != nil { |
| 29 | return err |
| 30 | } |
| 31 | if st.Uid != uint32(os.Geteuid()) || st.Mode&0022 != 0 { |
| 32 | return ErrClaimUnit |
| 33 | } |
| 34 | return nil |
| 35 | } |
| 36 | |
amadan