Documentation
¶
Overview ¶
Package safewrite provides a hardened file-write helper that protects against common symlink and permission attacks.
The function in this package — WriteFile — performs the same hardened atomic write security checks:
- Refuses to follow symlinks (O_NOFOLLOW).
- Writes to a temporary file in the same directory first.
- Sets the new file's mode to 0600 (owner read/write only).
- Atomically renames the temp file to the final path (os.Rename on POSIX, which is atomic for same-filesystem).
- Refuses to operate on paths that already exist as symlinks pointing elsewhere (TOCTOU-resistant).
GrayCode native implementation. bin/install.js (safeWriteFlag). Ported to native Go.
This is a low-level utility intended for hooks and other code that writes to disk on behalf of the agent. Callers that need more elaborate behavior (e.g. preserving existing mode bits) should use os.WriteFile directly with their own audit trail.
Index ¶
Constants ¶
This section is empty.
Variables ¶
var ErrPathEscape = errors.New("safewrite: path escapes parent directory")
ErrPathEscape is returned when the resolved path tries to escape the parent directory (e.g. via "..").
var ErrSymlinkTarget = errors.New("safewrite: destination is a symlink")
ErrSymlinkTarget is returned when the destination path already exists as a symlink. The caller should remove the symlink first or use a different path.
Functions ¶
func WriteFile ¶
WriteFile writes data to path atomically with strict security guarantees:
- If path already exists and is a symlink, returns ErrSymlinkTarget.
- Writes to path.tmp.<pid> in the same directory, then renames.
- The final file is mode 0600.
- The temp file is opened with O_NOFOLLOW|O_WRONLY|O_CREATE|O_TRUNC.
- The parent directory must already exist; it is not created.
On success, the destination file exists with the requested contents and mode 0600. On failure, the destination file is unchanged and any temp file left behind is cleaned up.
Types ¶
This section is empty.
Source Files