Download this file
| 1 | //go:build linux || darwin |
| 2 | |
| 3 | package rootaws |
| 4 | |
| 5 | import ( |
| 6 | "fmt" |
| 7 | "io" |
| 8 | |
| 9 | "github.com/aws/aws-sdk-go-v2/aws" |
| 10 | "golang.org/x/sys/unix" |
| 11 | ) |
| 12 | |
| 13 | func readStaticCredentials(path string) (aws.Credentials, error) { |
| 14 | f, err := openCredentials(path) |
| 15 | if err != nil { |
| 16 | return aws.Credentials{}, err |
| 17 | } |
| 18 | defer f.Close() |
| 19 | var st unix.Stat_t |
| 20 | if err := unix.Fstat(int(f.Fd()), &st); err != nil { |
| 21 | return aws.Credentials{}, err |
| 22 | } |
| 23 | if st.Mode&unix.S_IFMT != unix.S_IFREG || st.Nlink != 1 || st.Uid != 0 || st.Mode&0o022 != 0 { |
| 24 | return aws.Credentials{}, fmt.Errorf("credentials must be root-owned, single-link regular and not group- or other-writable") |
| 25 | } |
| 26 | body, err := io.ReadAll(io.LimitReader(f, MaxCredentialsSize+1)) |
| 27 | if err != nil { |
| 28 | return aws.Credentials{}, err |
| 29 | } |
| 30 | return ParseStaticCredentials(body) |
| 31 | } |
| 32 | |
amadan