Documentation
¶
Overview ¶
Package safeio centralizes every variable-path file open in gapi. All operator-supplied and discovered paths funnel through here: paths are cleaned and made absolute, and the *Under variants refuse to escape their root. This is the audited chokepoint for path-traversal (CWE-22) concerns; open a file through this package, not os, whenever the path is not a literal.
Index ¶
- func Create(path string) (*os.File, error)
- func Open(path string) (*os.File, error)
- func OpenUnder(root, path string) (*os.File, error)
- func ReadFile(path string) ([]byte, error)
- func ReadFileUnder(root, path string) ([]byte, error)
- func ReplaceOwnerOnly(path string, data []byte) error
- func Resolve(path string) (string, error)
- func ResolveUnder(root, path string) (string, error)
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ReadFileUnder ¶
ReadFileUnder reads path after confining it to root.
func ReplaceOwnerOnly ¶
ReplaceOwnerOnly atomically replaces path with data, and the result is readable only by its owner. Use it for key material and anything else where the mode is part of the contract.
The bytes go to a temporary file in the destination's own directory - same directory because rename is only atomic within a filesystem - which is then renamed over path. os.CreateTemp opens with O_EXCL at 0600, and umask can only clear permission bits, never add them, so the data is owner-only from the instant it exists.
Replacing rather than writing through is the load-bearing part. A create mode applies only when the file does not already exist, and a trailing chmod runs after the bytes are on disk; either way an overwrite leaves the secret at the old file's mode for the duration of the write. A replaced destination has no old mode to inherit.
func Resolve ¶
Resolve cleans path and makes it absolute against the process working directory. Empty paths are rejected.
func ResolveUnder ¶
ResolveUnder resolves path and rejects it unless the result stays at or under root. The check is lexical: symlinks inside an operator-owned root are the operator's to manage.
Types ¶
This section is empty.
Source Files