fix: harden operations and configuration recovery

cmd/proxyctl/main.go

@@ -103,7 +103,16 @@ func runWithEnvironmentAndTargets(args []string, input io.Reader, output io.Writ
 	}
 	targets := append([]target.Target{shellTarget}, systemTargets...)
 	stateDirectory := filepath.Dir(shellConfiguration.RecoveryFile)
-	mutationLock := operationlock.NewOwned(filepath.Join(stateDirectory, "operation.lock"), profileConfiguration.Owner.UID, profileConfiguration.Owner.GID)
+	userMutationLock := operationlock.NewOwned(filepath.Join(stateDirectory, "operation.lock"), profileConfiguration.Owner.UID, profileConfiguration.Owner.GID)
+	var mutationLock app.MutationLock = userMutationLock
+	if os.Geteuid() == 0 {
+		// Every elevated process also takes a root-owned lock that the invoking
+		// user cannot replace while a system Target mutation is in flight.
+		mutationLock = operationlock.NewGroup(
+			operationlock.New("/run/lock/proxyctl/operation.lock"),
+			userMutationLock,
+		)
+	}
 	logger := oplog.NewOwned(filepath.Join(stateDirectory, "operations.log"), 64*1024, 3, profileConfiguration.Owner.UID, profileConfiguration.Owner.GID)
 	store := profile.NewOwnedFileStoreAt(profileConfiguration.Path, profileConfiguration.Owner, profileConfiguration.TrustedRoot)
 
@@ -130,9 +139,12 @@ func runWithEnvironmentAndTargets(args []string, input io.Reader, output io.Writ
 			if operationErr != nil {
 				result, detail = "failure", operationErr.Error()
 			}
-			_ = logger.Write(app.LogEntry{Operation: operation, Target: shellTarget.ID(), Result: result, Detail: detail})
+			logErr := logger.Write(app.LogEntry{Operation: operation, Target: shellTarget.ID(), Result: result, Detail: detail})
 			if operationErr != nil {
-				return operationErr
+				return errors.Join(operationErr, logErr)
+			}
+			if logErr != nil {
+				return fmt.Errorf("Shell integration changed but the operation log could not be written: %w", logErr)
 			}
 			if args[1] == "install" {
 				fmt.Fprintln(output, "Shell integration installed; restart or source your Shell startup file once.")