129 lines
3.7 KiB
Go
129 lines
3.7 KiB
Go
//go:build !windows
|
|
|
|
package safeio
|
|
|
|
import (
|
|
"errors"
|
|
"os"
|
|
"path/filepath"
|
|
|
|
"golang.org/x/sys/unix"
|
|
)
|
|
|
|
func createPrivateDirectory(path string) error {
|
|
return createPrivateDirectoryAfterParentOpen(path, nil)
|
|
}
|
|
|
|
func createPrivateDirectoryAfterParentOpen(path string, afterOpen func()) error {
|
|
parents, err := openCanonicalUnixParent(path)
|
|
if err != nil {
|
|
return ErrUnsafeFile
|
|
}
|
|
defer parents.Close()
|
|
if afterOpen != nil {
|
|
afterOpen()
|
|
}
|
|
return createPrivateDirectoryAt(parents)
|
|
}
|
|
|
|
// createPrivateDirectoryAt performs every mutating operation relative to the already-opened
|
|
// parent. An attacker can rename or replace any lexical ancestor after the open without
|
|
// redirecting mkdir or chmod into a different directory tree.
|
|
func createPrivateDirectoryAt(parents *unixParentHandles) error {
|
|
if parents == nil || parents.parent < 0 || parents.target == "" {
|
|
return ErrUnsafeFile
|
|
}
|
|
if err := unix.Mkdirat(parents.parent, parents.target, 0o700); err != nil {
|
|
if errors.Is(err, unix.EEXIST) {
|
|
return os.ErrExist
|
|
}
|
|
return ErrUnsafeFile
|
|
}
|
|
descriptor, err := unix.Openat(parents.parent, parents.target, unix.O_RDONLY|unix.O_CLOEXEC|unix.O_DIRECTORY|unix.O_NOFOLLOW, 0)
|
|
if err != nil {
|
|
return ErrUnsafeFile
|
|
}
|
|
defer unix.Close(descriptor)
|
|
if unix.Fchmod(descriptor, 0o700) != nil {
|
|
return ErrUnsafeFile
|
|
}
|
|
var stat unix.Stat_t
|
|
if unix.Fstat(descriptor, &stat) != nil || !privateUnixDirectoryStat(&stat) {
|
|
return ErrUnsafeFile
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// ProtectPrivateDirectory sets the private directory mode used for local authentication state.
|
|
func ProtectPrivateDirectory(path string) error {
|
|
if err := ValidateCanonicalPath(path); err != nil {
|
|
return err
|
|
}
|
|
if err := os.Chmod(path, 0o700); err != nil {
|
|
return ErrUnsafeFile
|
|
}
|
|
return ValidatePrivateDirectory(path)
|
|
}
|
|
|
|
// ValidatePrivateDirectory requires a canonical, non-symlinked directory with no group or world access.
|
|
func ValidatePrivateDirectory(path string) error {
|
|
if err := requireCanonicalDirectory(path); err != nil {
|
|
return err
|
|
}
|
|
info, err := os.Lstat(path)
|
|
if err != nil || !info.IsDir() || info.Mode()&os.ModeSymlink != 0 || !isExactPrivateMode(info.Mode(), 0o700) {
|
|
return ErrUnsafeFile
|
|
}
|
|
return nil
|
|
}
|
|
|
|
// ProtectPrivateRegular sets the private file mode used for local authentication files.
|
|
func ProtectPrivateRegular(path string) error {
|
|
if err := ValidateCanonicalPath(path); err != nil {
|
|
return err
|
|
}
|
|
if err := os.Chmod(path, 0o600); err != nil {
|
|
return ErrUnsafeFile
|
|
}
|
|
return ValidatePrivateRegular(path)
|
|
}
|
|
|
|
func createCanonicalNewPrivateFile(path string, mode os.FileMode) (*os.File, error) {
|
|
file, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_EXCL, mode)
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
if err := ProtectPrivateRegular(path); err != nil {
|
|
_ = file.Close()
|
|
_ = os.Remove(path)
|
|
return nil, ErrUnsafeFile
|
|
}
|
|
return file, nil
|
|
}
|
|
|
|
func createCanonicalNewPrivateParentFile(path string, mode os.FileMode) (*os.File, error) {
|
|
if err := ValidatePrivateDirectory(filepath.Dir(path)); err != nil {
|
|
return nil, ErrUnsafeFile
|
|
}
|
|
return createCanonicalNewPrivateFile(path, mode)
|
|
}
|
|
|
|
// ValidatePrivateRegular requires a canonical, single-link private regular file.
|
|
func ValidatePrivateRegular(path string) error {
|
|
if err := ValidateCanonicalPath(path); err != nil {
|
|
return err
|
|
}
|
|
if err := requireCanonicalDirectory(filepath.Dir(path)); err != nil {
|
|
return err
|
|
}
|
|
info, err := os.Lstat(path)
|
|
if err != nil || !info.Mode().IsRegular() || info.Mode()&os.ModeSymlink != 0 || !hasSingleLink(info) || !isExactPrivateMode(info.Mode(), 0o600) {
|
|
return ErrUnsafeFile
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func isExactPrivateMode(mode os.FileMode, permissions os.FileMode) bool {
|
|
return mode.Perm() == permissions && mode&(os.ModeSetuid|os.ModeSetgid|os.ModeSticky) == 0
|
|
}
|