fix restore preserve Unix file ownership

tools/tht/internal/backup/restore_file_unix.go

@@ -19,6 +19,8 @@ type restoreTargetIdentity struct {
 	exists bool
 	device uint64
 	inode  uint64
+	uid    uint32
+	gid    uint32
 }
 
 func replaceRestoreFile(target string, contents []byte, mode os.FileMode) error {
@@ -47,7 +49,11 @@ func replaceRestoreFile(target string, contents []byte, mode os.FileMode) error
 	if err != nil {
 		return safeio.ErrUnsafeFile
 	}
-	temporary, err := writeRestoreTemporaryAt(directory, contents, mode.Perm())
+	uid, gid, err := restoreTargetOwnerAt(directory, identity)
+	if err != nil {
+		return safeio.ErrUnsafeFile
+	}
+	temporary, err := writeRestoreTemporaryAt(directory, contents, mode.Perm(), uid, gid)
 	if err != nil {
 		return safeio.ErrUnsafeFile
 	}
@@ -75,10 +81,27 @@ func inspectRestoreTargetAt(directory int, name string) (restoreTargetIdentity,
 	if err != nil || status.Mode&unix.S_IFMT != unix.S_IFREG || status.Nlink != 1 {
 		return restoreTargetIdentity{}, safeio.ErrUnsafeFile
 	}
-	return restoreTargetIdentity{exists: true, device: uint64(status.Dev), inode: status.Ino}, nil
+	return restoreTargetIdentity{
+		exists: true,
+		device: uint64(status.Dev),
+		inode:  status.Ino,
+		uid:    status.Uid,
+		gid:    status.Gid,
+	}, nil
 }
 
-func writeRestoreTemporaryAt(directory int, contents []byte, mode os.FileMode) (string, error) {
+func restoreTargetOwnerAt(directory int, identity restoreTargetIdentity) (uint32, uint32, error) {
+	if identity.exists {
+		return identity.uid, identity.gid, nil
+	}
+	var status unix.Stat_t
+	if err := unix.Fstat(directory, &status); err != nil || status.Mode&unix.S_IFMT != unix.S_IFDIR {
+		return 0, 0, safeio.ErrUnsafeFile
+	}
+	return status.Uid, status.Gid, nil
+}
+
+func writeRestoreTemporaryAt(directory int, contents []byte, mode os.FileMode, uid, gid uint32) (string, error) {
 	for attempt := 0; attempt < 16; attempt++ {
 		random := make([]byte, 8)
 		if _, err := rand.Read(random); err != nil {
@@ -97,7 +120,10 @@ func writeRestoreTemporaryAt(directory int, contents []byte, mode os.FileMode) (
 			unix.Close(descriptor)
 			return "", safeio.ErrUnsafeFile
 		}
-		if err := file.Chmod(mode); err == nil {
+		if err := file.Chown(int(uid), int(gid)); err == nil {
+			err = file.Chmod(mode)
+		}
+		if err == nil {
 			var written int
 			written, err = file.Write(contents)
 			if err == nil && written != len(contents) {