fix: run DWH verification with read-only registry access

tools/dwh-auth/internal/service/service.go

@@ -48,6 +48,18 @@ var socketOwner = func(path string) (uint32, error) {
 	return stat.Uid, nil
 }
 
+var socketParentOwner = func(path string) (uint32, error) {
+	info, err := os.Lstat(path)
+	if err != nil {
+		return 0, err
+	}
+	stat, ok := info.Sys().(*syscall.Stat_t)
+	if !ok {
+		return 0, fmt.Errorf("socket parent owner is unavailable")
+	}
+	return stat.Uid, nil
+}
+
 // New returns the HTTP verifier. It has no network listener and is safe to use
 // with an httptest server only for synthetic test registries.
 func New(store *registry.Store, logger *log.Logger, now func() time.Time) http.Handler {
@@ -101,7 +113,7 @@ func ListenAndServe(ctx context.Context, config Config) error {
 	if err := validateSocketParent(config.Socket); err != nil {
 		return err
 	}
-	store, err := registry.Open(config.RegistryRoot)
+	store, err := registry.OpenReadOnly(config.RegistryRoot)
 	if err != nil {
 		return err
 	}
@@ -164,6 +176,20 @@ func validateSocketParent(socket string) error {
 	if !info.IsDir() || info.Mode()&os.ModeSymlink != 0 {
 		return errors.New("socket parent is not a directory")
 	}
+	if info.Mode().Perm()&0o022 != 0 {
+		return errors.New("socket parent is group or world writable")
+	}
+	stat, ok := info.Sys().(*syscall.Stat_t)
+	if !ok {
+		return errors.New("socket parent owner is unavailable")
+	}
+	owner, err := socketParentOwner(parent)
+	if err != nil {
+		return err
+	}
+	if stat.Uid != uint32(os.Geteuid()) || owner != stat.Uid {
+		return errors.New("socket parent owner mismatch")
+	}
 	resolved, err := filepath.EvalSymlinks(parent)
 	if err != nil || resolved != parent {
 		return errors.New("socket parent is not canonical")