mptyl/ThothII
1
0
Fork 0
Code Issues 25 Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix Task1 publication and secret preflight

Browse Source
This commit is contained in:
marcopan
2026-08-11 04:06:23 +02:00
parent fcc45520ad
commit c7f7a6e1b0
8 changed files with 324 additions and 215 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/thothctl/internal/safeio/files_unix.go
+36 -55
View File
@@ -80,6 +80,11 @@ func closeUnixDescriptors(descriptors []int) {
}
}
// Darwin uses a named stage because it has no relinkable O_TMPFILE equivalent.
// The caller must provide a trusted parent namespace: same-UID namespace mutation
// (including stage hard-link/replacement races and ancestor replacement) is outside
// this mode's threat model. Under that precondition renameatx_np(RENAME_EXCL) is the
// final fallible no-replace commit and removes the stage atomically.
func writeCanonicalExclusive(path string, contents []byte, mode fs.FileMode) error {
if err := ValidateCanonicalPath(path); err != nil || len(contents) > 16<<20 || mode.Perm() != 0o600 {
return ErrUnsafeFile
@@ -92,24 +97,18 @@ func writeCanonicalExclusive(path string, contents []byte, mode fs.FileMode) err
if err != nil {
return ErrUnsafeFile
}
// Close the descriptor that owns the final retained parent. The traversal
// closes each superseded descriptor explicitly; evaluating unix.Close(dir)
// at defer time would close only the original root descriptor.
defer func() { _ = unix.Close(dir) }()
for _, component := range components[:len(components)-1] {
next, openErr := unix.Openat(dir, component, unix.O_RDONLY|unix.O_DIRECTORY|unix.O_CLOEXEC|unix.O_NOFOLLOW, 0)
if openErr != nil {
return ErrUnsafeFile
}
unix.Close(dir)
_ = unix.Close(dir)
dir = next
}
if !recheckUnixParentPath(components[:len(components)-1], dir) {
return ErrUnsafeFile
}
// Build the candidate under a private, same-parent name. Only after it is fully
// written, synced, and identity-checked do we link it into the requested leaf.
stage, err := privateStageName()
if err != nil {
return ErrUnsafeFile
@@ -120,90 +119,72 @@ func writeCanonicalExclusive(path string, contents []byte, mode fs.FileMode) err
}
stageFile := os.NewFile(uintptr(stageFD), "thothctl-safeio-stage")
if stageFile == nil {
unix.Close(stageFD)
_ = unix.Close(stageFD)
_ = unix.Unlinkat(dir, stage, 0)
return ErrUnsafeFile
}
stageCreated := true
closed := false
closeStage := func() error {
if closed {
return nil
}
closed = true
return stageFile.Close()
}
defer func() { _ = closeStage() }()
var staged unix.Stat_t
if err := unix.Fstat(stageFD, &staged); err != nil || staged.Nlink != 1 || staged.Mode&unix.S_IFMT != unix.S_IFREG {
_ = stageFile.Close()
_ = closeStage()
_ = unix.Unlinkat(dir, stage, 0)
return ErrUnsafeFile
}
published := false
// Keep the inode identity immutable across every check and cleanup path.
var publishedIdentity = staged
cleanup := func() {
if published {
var current unix.Stat_t
if unix.Fstatat(dir, components[len(components)-1], &current, unix.AT_SYMLINK_NOFOLLOW) == nil &&
current.Ino == publishedIdentity.Ino && current.Dev == publishedIdentity.Dev {
_ = unix.Unlinkat(dir, components[len(components)-1], 0)
}
}
if stageCreated {
var current unix.Stat_t
if unix.Fstatat(dir, stage, &current, unix.AT_SYMLINK_NOFOLLOW) == nil &&
current.Ino == staged.Ino && current.Dev == staged.Dev {
_ = unix.Unlinkat(dir, stage, 0)
}
// Trusted-parent mode makes this identity check + unlink pre-commit safe;
// never unlink a replacement observed at the stage name.
var current unix.Stat_t
if unix.Fstatat(dir, stage, &current, unix.AT_SYMLINK_NOFOLLOW) == nil && current.Ino == staged.Ino && current.Dev == staged.Dev {
_ = unix.Unlinkat(dir, stage, 0)
}
}
fail := func() error {
_ = stageFile.Close()
cleanup()
return ErrUnsafeFile
}
fail := func() error { _ = closeStage(); cleanup(); return ErrUnsafeFile }
if err := stageFile.Chmod(mode); err != nil {
return fail()
}
n, err := stageFile.Write(contents)
if err != nil || n != len(contents) {
if n, err := stageFile.Write(contents); err != nil || n != len(contents) {
return fail()
}
if err := stageFile.Sync(); err != nil {
return fail()
}
// On platforms without O_TMPFILE, a same-user actor can hard-link the
// nameable stage. Extra links are therefore not a post-write rejection:
// once observed, the bytes are already public and rejecting would leave the
// attacker's link behind. Cleanup still uses the immutable inode identity.
var afterWrite unix.Stat_t
if err := unix.Fstat(stageFD, &afterWrite); err != nil || afterWrite.Nlink < 1 || afterWrite.Mode&unix.S_IFMT != unix.S_IFREG || afterWrite.Size != int64(len(contents)) {
var after unix.Stat_t
if err := unix.Fstat(stageFD, &after); err != nil || after.Nlink != 1 || after.Mode&unix.S_IFMT != unix.S_IFREG || after.Size != int64(len(contents)) {
return fail()
}
if err := stageFile.Close(); err != nil {
cleanup()
return ErrUnsafeFile
}
stageCreated = true
if !recheckUnixParentPath(components[:len(components)-1], dir) {
return fail()
}
if err := unix.Linkat(dir, stage, dir, components[len(components)-1], 0); err != nil {
// Verify the named stage and its retained handle immediately before commit.
var named unix.Stat_t
if err := unix.Fstatat(dir, stage, &named, unix.AT_SYMLINK_NOFOLLOW); err != nil || named.Ino != staged.Ino || named.Dev != staged.Dev || named.Nlink != 1 {
return fail()
}
published = true
var linked unix.Stat_t
if err := unix.Fstatat(dir, components[len(components)-1], &linked, unix.AT_SYMLINK_NOFOLLOW); err != nil ||
linked.Ino != staged.Ino || linked.Dev != staged.Dev || linked.Nlink < 2 {
if err := unix.Fstat(stageFD, &after); err != nil || after.Ino != staged.Ino || after.Dev != staged.Dev || after.Nlink != 1 {
return fail()
}
if err := unix.Unlinkat(dir, stage, 0); err != nil {
if err := unix.Fsync(dir); err != nil {
return fail()
}
stageCreated = false
var finalIdentity unix.Stat_t
if err := unix.Fstatat(dir, components[len(components)-1], &finalIdentity, unix.AT_SYMLINK_NOFOLLOW); err != nil || finalIdentity.Ino != publishedIdentity.Ino || finalIdentity.Dev != publishedIdentity.Dev || finalIdentity.Nlink < 1 {
if !recheckUnixParentPath(components[:len(components)-1], dir) {
return fail()
}
if err := unix.Fsync(dir); err != nil || !recheckUnixParentPath(components[:len(components)-1], dir) {
if err := unix.RenameatxNp(dir, stage, dir, components[len(components)-1], unix.RENAME_EXCL); err != nil {
return fail()
}
// renameatx_np is the final commit. Closing the still-open handle is ignored
// after success and never triggers pathname cleanup or a false failure.
_ = closeStage()
return nil
}
func privateStageName() (string, error) {
var random [16]byte
if _, err := rand.Read(random[:]); err != nil {