Documentation
¶
Overview ¶
Package sharedfile hardens the standard Unix pattern of coordinating between processes running as different users through a world-writable file in a shared, trusted location (e.g. /tmp) — the same idea behind /tmp/.X11-unix or /var/run/utmp. A devsy container runs commands over SSH sessions authenticated as either root or the workspace's remoteUser (pkg/ssh/server/ssh_container.go sets the process credential directly from the authenticated session user), so any file two of those sessions both touch needs its permissions to survive being created by either one.
The pattern has two failure modes this package exists to close:
- Whichever process creates the file first can lock every other user out, because file creation is subject to the process umask.
- A symlink planted at the file's path redirects Chmod onto an arbitrary target, since Chmod follows symlinks — dangerous for a fixed, predictable, world-writable path any container user can pre-create.
Index ¶
- func EnsureMode(path string, mode os.FileMode) error
- func ReadFile(path string) ([]byte, error)
- func WidenIfNeeded(path string, mode os.FileMode) error
- func WidenWithSudoFallback(ctx context.Context, path string, mode os.FileMode) error
- func WriteFile(path string, data []byte, mode os.FileMode) (err error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func EnsureMode ¶
EnsureMode ensures path exists with exactly mode permissions, creating it if absent. Skips the chmod when the file's mode already matches: chmod requires ownership (or root) even when the requested mode would not change, so skipping it when unnecessary avoids EPERM for a non-owning acquirer of an already-correctly-moded file.
Rejects a path that resolves to a symlink rather than following it.
func ReadFile ¶
ReadFile reads path the same way os.ReadFile does, but refuses to follow a symlink or block on a FIFO planted at path.
func WidenIfNeeded ¶
WidenIfNeeded chmods path to mode if its current mode differs, skipping the chmod entirely when it is already correct. Opens path without following a symlink and chmods the resulting descriptor rather than the path, so a symlink swapped in after a check-then-chmod by path could not redirect the chmod onto an arbitrary target.
func WidenWithSudoFallback ¶
WidenWithSudoFallback behaves like WidenIfNeeded, but on EPERM (path exists at the wrong mode and this process does not own it) falls back to re-execing `<self> internal widen-shared-file` under a non-interactive sudo, so the escalated mode change still goes through WidenIfNeeded's O_NOFOLLOW open rather than a plain `sudo chmod <path>` — chmod(1) has no way to refuse following a symlink at its target path. The fallback's failure is logged, not returned: this is a best-effort repair, and the caller's own lock acquisition will surface the real permission error if the repair fails.
func WriteFile ¶
WriteFile writes data to path at mode the same way os.WriteFile does, creating path if absent, but refuses to follow a symlink or block on a FIFO already at path. O_NOFOLLOW still applies when O_CREATE is also set: an existing symlink is rejected rather than followed, while a genuinely missing path is created as a fresh regular file.
Types ¶
This section is empty.
Source Files