fix(safeio): retain private file parent handles

tools/tht/internal/safeio/private_unix.go

@@ -5,7 +5,6 @@ package safeio
 import (
 	"errors"
 	"os"
-	"path/filepath"
 
 	"golang.org/x/sys/unix"
 )
@@ -56,22 +55,32 @@ func createPrivateDirectoryAt(parents *unixParentHandles) error {
 
 // ProtectPrivateDirectory sets the private directory mode used for local authentication state.
 func ProtectPrivateDirectory(path string) error {
-	if err := ValidateCanonicalPath(path); err != nil {
-		return err
-	}
-	if err := os.Chmod(path, 0o700); err != nil {
+	parents, descriptor, err := openCanonicalUnixPrivateDirectory(path)
+	if err != nil {
 		return ErrUnsafeFile
 	}
-	return ValidatePrivateDirectory(path)
+	defer parents.Close()
+	defer unix.Close(descriptor)
+	if unix.Fchmod(descriptor, 0o700) != nil {
+		return ErrUnsafeFile
+	}
+	var stat unix.Stat_t
+	if unix.Fstat(descriptor, &stat) != nil || !privateUnixDirectoryStat(&stat) {
+		return ErrUnsafeFile
+	}
+	return nil
 }
 
 // ValidatePrivateDirectory requires a canonical, non-symlinked directory with no group or world access.
 func ValidatePrivateDirectory(path string) error {
-	if err := requireCanonicalDirectory(path); err != nil {
-		return err
+	parents, descriptor, err := openCanonicalUnixPrivateDirectory(path)
+	if err != nil {
+		return ErrUnsafeFile
 	}
-	info, err := os.Lstat(path)
-	if err != nil || !info.IsDir() || info.Mode()&os.ModeSymlink != 0 || !isExactPrivateMode(info.Mode(), 0o700) {
+	defer parents.Close()
+	defer unix.Close(descriptor)
+	var stat unix.Stat_t
+	if unix.Fstat(descriptor, &stat) != nil || !privateUnixDirectoryStat(&stat) {
 		return ErrUnsafeFile
 	}
 	return nil
@@ -79,61 +88,125 @@ func ValidatePrivateDirectory(path string) error {
 
 // ProtectPrivateRegular sets the private file mode used for local authentication files.
 func ProtectPrivateRegular(path string) error {
-	if err := ValidateCanonicalPath(path); err != nil {
-		return err
-	}
-	if err := os.Chmod(path, 0o600); err != nil {
+	parents, descriptor, err := openCanonicalUnixPrivateRegular(path)
+	if err != nil {
 		return ErrUnsafeFile
 	}
-	return ValidatePrivateRegular(path)
-}
-
-func createCanonicalNewPrivateFile(path string, mode os.FileMode) (*os.File, error) {
-	return createCanonicalNewPrivateFileWithFlags(path, mode, os.O_WRONLY)
-}
-
-func createCanonicalNewPrivateFileWithFlags(path string, mode os.FileMode, flags int) (*os.File, error) {
-	file, err := os.OpenFile(path, flags|os.O_CREATE|os.O_EXCL, mode)
-	if err != nil {
-		return nil, err
+	defer parents.Close()
+	defer unix.Close(descriptor)
+	if unix.Fchmod(descriptor, 0o600) != nil {
+		return ErrUnsafeFile
 	}
-	if err := ProtectPrivateRegular(path); err != nil {
-		_ = file.Close()
-		_ = os.Remove(path)
-		return nil, ErrUnsafeFile
-	}
-	return file, nil
-}
-
-func createCanonicalNewPrivateParentFile(path string, mode os.FileMode) (*os.File, error) {
-	if err := ValidatePrivateDirectory(filepath.Dir(path)); err != nil {
-		return nil, ErrUnsafeFile
-	}
-	return createCanonicalNewPrivateFile(path, mode)
-}
-
-func createCanonicalNewPrivateParentReadWriteFile(path string, mode os.FileMode) (*os.File, error) {
-	if err := ValidatePrivateDirectory(filepath.Dir(path)); err != nil {
-		return nil, ErrUnsafeFile
-	}
-	return createCanonicalNewPrivateFileWithFlags(path, mode, os.O_RDWR)
-}
-
-// ValidatePrivateRegular requires a canonical, single-link private regular file.
-func ValidatePrivateRegular(path string) error {
-	if err := ValidateCanonicalPath(path); err != nil {
-		return err
-	}
-	if err := requireCanonicalDirectory(filepath.Dir(path)); err != nil {
-		return err
-	}
-	info, err := os.Lstat(path)
-	if err != nil || !info.Mode().IsRegular() || info.Mode()&os.ModeSymlink != 0 || !hasSingleLink(info) || !isExactPrivateMode(info.Mode(), 0o600) {
+	var stat unix.Stat_t
+	if unix.Fstat(descriptor, &stat) != nil || !privateUnixRegularStat(&stat) {
 		return ErrUnsafeFile
 	}
 	return nil
 }
 
-func isExactPrivateMode(mode os.FileMode, permissions os.FileMode) bool {
-	return mode.Perm() == permissions && mode&(os.ModeSetuid|os.ModeSetgid|os.ModeSticky) == 0
+func createCanonicalNewPrivateFile(path string, mode os.FileMode) (*os.File, error) {
+	return createCanonicalNewPrivateFileWithFlags(path, mode, os.O_WRONLY, false)
+}
+
+func createCanonicalNewPrivateParentFile(path string, mode os.FileMode) (*os.File, error) {
+	return createCanonicalNewPrivateFileWithFlags(path, mode, os.O_WRONLY, true)
+}
+
+func createCanonicalNewPrivateParentReadWriteFile(path string, mode os.FileMode) (*os.File, error) {
+	return createCanonicalNewPrivateFileWithFlags(path, mode, os.O_RDWR, true)
+}
+
+// createCanonicalNewPrivateFileWithFlags resolves and validates every parent once, then creates
+// the final name through that retained parent descriptor. No later lexical ancestor replacement
+// can redirect the create, mode repair, metadata check, or failure cleanup.
+func createCanonicalNewPrivateFileWithFlags(path string, mode os.FileMode, flags int, requirePrivateParent bool) (*os.File, error) {
+	parents, err := openCanonicalUnixParent(path)
+	if err != nil {
+		return nil, ErrUnsafeFile
+	}
+	defer parents.Close()
+	if requirePrivateParent {
+		var parentStat unix.Stat_t
+		if unix.Fstat(parents.parent, &parentStat) != nil || !privateUnixDirectoryStat(&parentStat) {
+			return nil, ErrUnsafeFile
+		}
+	}
+	NotifyPrivateDirectoryTestHookForTest("after-canonical-private-file-parent-open")
+
+	// The final 0600 is applied with fchmod rather than trusting process umask or a path lookup.
+	// mode remains accepted for the existing helper contract; private files are always exactly 0600.
+	_ = mode
+	descriptor, err := unix.Openat(parents.parent, parents.target,
+		flags|unix.O_CREAT|unix.O_EXCL|unix.O_CLOEXEC|unix.O_NOFOLLOW, 0o600)
+	if err != nil {
+		return nil, err
+	}
+	failed := true
+	defer func() {
+		if failed {
+			_ = unix.Close(descriptor)
+			_ = unix.Unlinkat(parents.parent, parents.target, 0)
+		}
+	}()
+	if unix.Fchmod(descriptor, 0o600) != nil {
+		return nil, ErrUnsafeFile
+	}
+	var stat unix.Stat_t
+	if unix.Fstat(descriptor, &stat) != nil || !privateUnixRegularStat(&stat) {
+		return nil, ErrUnsafeFile
+	}
+	file := os.NewFile(uintptr(descriptor), "tht-safeio-private")
+	if file == nil {
+		return nil, ErrUnsafeFile
+	}
+	failed = false
+	return file, nil
+}
+
+// ValidatePrivateRegular requires a canonical, single-link private regular file.
+func ValidatePrivateRegular(path string) error {
+	parents, descriptor, err := openCanonicalUnixPrivateRegular(path)
+	if err != nil {
+		return ErrUnsafeFile
+	}
+	defer parents.Close()
+	defer unix.Close(descriptor)
+	var stat unix.Stat_t
+	if unix.Fstat(descriptor, &stat) != nil || !privateUnixRegularStat(&stat) {
+		return ErrUnsafeFile
+	}
+	return nil
+}
+
+func openCanonicalUnixPrivateDirectory(path string) (*unixParentHandles, int, error) {
+	parents, err := openCanonicalUnixParent(path)
+	if err != nil {
+		return nil, -1, ErrUnsafeFile
+	}
+	descriptor, err := unix.Openat(parents.parent, parents.target,
+		unix.O_RDONLY|unix.O_CLOEXEC|unix.O_DIRECTORY|unix.O_NOFOLLOW, 0)
+	if err != nil {
+		parents.Close()
+		return nil, -1, ErrUnsafeFile
+	}
+	return parents, descriptor, nil
+}
+
+func openCanonicalUnixPrivateRegular(path string) (*unixParentHandles, int, error) {
+	parents, err := openCanonicalUnixParent(path)
+	if err != nil {
+		return nil, -1, ErrUnsafeFile
+	}
+	descriptor, err := unix.Openat(parents.parent, parents.target,
+		unix.O_RDONLY|unix.O_CLOEXEC|unix.O_NOFOLLOW|unix.O_NONBLOCK, 0)
+	if err != nil {
+		parents.Close()
+		return nil, -1, ErrUnsafeFile
+	}
+	return parents, descriptor, nil
+}
+
+func privateUnixRegularStat(stat *unix.Stat_t) bool {
+	return stat != nil && stat.Mode&unix.S_IFMT == unix.S_IFREG && stat.Nlink == 1 &&
+		stat.Uid == uint32(os.Geteuid()) && stat.Mode&0o7777 == 0o600
 }