safedir.go RawHistoryFolder

1// Package safedir creates private directories and refuses to trust
2// pre-existing ones that another user could control.
3package safedir
4
5import (
6	"fmt"
7	"os"
8	"syscall"
9)
10
11// EnsurePrivate creates dir with mode 0700 if missing, then verifies it is a
12// real directory (not a symlink) owned by the current user and has exact 0700
13// permissions. It returns an error describing the violation otherwise.
14func EnsurePrivate(dir string) error {
15	if err := os.MkdirAll(dir, 0o700); err != nil {
16		return err
17	}
18	fi, err := os.Lstat(dir)
19	if err != nil {
20		return err
21	}
22	if fi.Mode()&os.ModeSymlink != 0 {
23		return fmt.Errorf("safedir: %s is a symlink", dir)
24	}
25	if !fi.IsDir() {
26		return fmt.Errorf("safedir: %s is not a directory", dir)
27	}
28	st, ok := fi.Sys().(*syscall.Stat_t)
29	if !ok {
30		return fmt.Errorf("safedir: cannot stat %s", dir)
31	}
32	if int(st.Uid) != os.Getuid() {
33		return fmt.Errorf("safedir: %s is owned by uid %d, not current uid %d — refusing to use it", dir, st.Uid, os.Getuid())
34	}
35	if perm := fi.Mode().Perm(); perm != 0o700 {
36		return fmt.Errorf("safedir: %s has permissions %04o, want 0700 — refusing to use it", dir, perm)
37	}
38	return nil
39}