fix: harden Shell Target recovery and storage

internal/profile/store.go

@@ -1,8 +1,6 @@
 package profile
 
 import (
-	"crypto/rand"
-	"encoding/hex"
 	"encoding/json"
 	"errors"
 	"fmt"
@@ -15,6 +13,8 @@ import (
 	"strings"
 
 	"golang.org/x/sys/unix"
+
+	"proxyctl/internal/securefs"
 )
 
 type FileStore struct {
@@ -230,19 +230,11 @@ func (s *FileStore) Mutate(change func(State) (State, error)) (State, error) {
 }
 
 func openNoFollow(path string, flags int, mode uint32) (*os.File, error) {
-	fd, err := unix.Open(path, flags|unix.O_CLOEXEC|unix.O_NOFOLLOW, mode)
-	if err != nil {
-		return nil, err
-	}
-	return os.NewFile(uintptr(fd), path), nil
+	return securefs.OpenNoFollow(path, flags, mode)
 }
 
 func openAt(directory *os.File, name string, flags int, mode uint32) (*os.File, error) {
-	fd, err := unix.Openat(int(directory.Fd()), name, flags|unix.O_CLOEXEC|unix.O_NOFOLLOW, mode)
-	if err != nil {
-		return nil, err
-	}
-	return os.NewFile(uintptr(fd), filepath.Join(directory.Name(), name)), nil
+	return securefs.OpenAt(directory, name, flags, mode)
 }
 
 func (s *FileStore) load() (State, error) {
@@ -465,17 +457,5 @@ func (s *FileStore) save(state State, directory *os.File) (bool, error) {
 }
 
 func createTemporaryAt(directory *os.File) (*os.File, string, error) {
-	for range 100 {
-		bytes := make([]byte, 8)
-		if _, err := rand.Read(bytes); err != nil {
-			return nil, "", err
-		}
-		name := ".profiles-" + hex.EncodeToString(bytes)
-		file, err := openAt(directory, name, unix.O_CREAT|unix.O_EXCL|unix.O_RDWR, 0o600)
-		if errors.Is(err, fs.ErrExist) {
-			continue
-		}
-		return file, name, err
-	}
-	return nil, "", errors.New("could not allocate a unique temporary Profile configuration name")
+	return securefs.CreateTemporaryAt(directory, ".profiles-")
 }