mptyl/ThothII
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix(windows): avoid mutating lifecycle ACL trees

Browse Source
This commit is contained in:
marcopan
2026-08-18 14:21:06 +02:00
parent afb0e21200
commit 824245d285
2 changed files with 13 additions and 85 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/tht/internal/lifecycle/lock.go
+9 -49
View File
@@ -13,7 +13,6 @@ import (
"time"
"github.com/aritmolab/thothii/tools/tht/internal/config"
"github.com/aritmolab/thothii/tools/tht/internal/safeio"
)
var (
@@ -50,36 +49,16 @@ type Transaction struct {
// Acquire obtains the shared lock used by backup, restore, Pi lifecycle and product updates.
func Acquire(installation config.Installation) (*Lock, error) {
directory := installation.ControlDirectory()
parent := filepath.Dir(directory)
// The lifecycle directory is also the restore staging parent. An existing Windows child
// must be protected before its parent: replacing the parent's inheritable ACL first can
// remove the child's inherited owner authority before the child receives its protected DACL.
// For a new installation the parent must instead exist before safe child creation.
controlInfo, controlErr := os.Lstat(directory)
if controlErr == nil {
if !controlInfo.IsDir() || controlInfo.Mode()&os.ModeSymlink != 0 {
return nil, errors.New("lifecycle control directory is not a regular directory")
}
if err := ensurePrivateLifecycleDirectory(directory); err != nil {
return nil, fmt.Errorf("protect lifecycle control directory: %w", err)
}
if err := ensurePrivateLifecycleDirectory(parent); err != nil {
return nil, fmt.Errorf("protect lifecycle control parent: %w", err)
}
} else if errors.Is(controlErr, os.ErrNotExist) {
if err := ensurePrivateLifecycleDirectory(parent); err != nil {
return nil, fmt.Errorf("protect lifecycle control parent: %w", err)
}
if err := ensurePrivateLifecycleDirectory(directory); err != nil {
return nil, fmt.Errorf("protect lifecycle control directory: %w", err)
}
} else {
return nil, errors.New("lifecycle control directory is unavailable")
if err := os.MkdirAll(directory, 0o700); err != nil {
return nil, fmt.Errorf("create lifecycle control directory: %w", err)
}
info, err := os.Lstat(directory)
if err != nil || !info.IsDir() || info.Mode()&os.ModeSymlink != 0 {
return nil, errors.New("lifecycle control directory is not a regular directory")
}
if err := os.Chmod(directory, 0o700); err != nil {
return nil, fmt.Errorf("protect lifecycle control directory: %w", err)
}
tokenBytes := make([]byte, 16)
if _, err := rand.Read(tokenBytes); err != nil {
@@ -87,11 +66,11 @@ func Acquire(installation config.Installation) (*Lock, error) {
}
token := hex.EncodeToString(tokenBytes)
path := filepath.Join(directory, lockFileName)
file, err := safeio.CreateCanonicalNewPrivateFile(path)
file, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o600)
if errors.Is(err, os.ErrExist) {
return nil, ErrLocked
}
if err != nil {
if _, statErr := os.Lstat(path); statErr == nil {
return nil, ErrLocked
}
return nil, fmt.Errorf("acquire lifecycle lock: %w", err)
}
value := owner{Token: token, PID: os.Getpid(), CreatedAt: time.Now().UTC()}
@@ -107,25 +86,6 @@ func Acquire(installation config.Installation) (*Lock, error) {
return &Lock{path: path, token: token}, nil
}
// ensurePrivateLifecycleDirectory repairs an existing directory's protection or creates the
// final missing component with the platform's owner-only primitive. It deliberately does not
// use os.MkdirAll for the security-sensitive path: safeio validates every canonical ancestor.
func ensurePrivateLifecycleDirectory(path string) error {
info, err := os.Lstat(path)
if errors.Is(err, os.ErrNotExist) {
if err := safeio.EnsurePrivateDirectory(path); err != nil {
return err
}
} else if err != nil || !info.IsDir() || info.Mode()&os.ModeSymlink != 0 {
return safeio.ErrUnsafeFile
} else {
if err := safeio.ProtectPrivateDirectory(path); err != nil {
return err
}
}
return safeio.ValidatePrivateDirectory(path)
}
// AcquireTransaction obtains a lifecycle lock and returns the capability required by callers
// that perform nested work inside the same non-reentrant transaction.
func AcquireTransaction(installation config.Installation) (*Transaction, error) {