fix: harden GNOME settings recovery

internal/securefs/securefs.go

@@ -55,6 +55,50 @@ type Store struct {
 	Owner       *Owner
 }
 
+type fileLock struct{ file *os.File }
+
+func (l *fileLock) Close() error {
+	unlockErr := unix.Flock(int(l.file.Fd()), unix.LOCK_UN)
+	closeErr := l.file.Close()
+	if unlockErr != nil {
+		return unlockErr
+	}
+	return closeErr
+}
+
+// LockFile acquires an exclusive advisory lock without following symbolic
+// links. The returned closer releases the lock and closes its descriptor.
+func (s Store) LockFile(path string) (io.Closer, error) {
+	directory, base, err := s.openParent(path, true)
+	if err != nil {
+		return nil, err
+	}
+	defer directory.Close()
+	file, err := OpenAt(directory, base, unix.O_CREAT|unix.O_RDWR, 0o600)
+	if err != nil {
+		return nil, err
+	}
+	if err := regular(file); err != nil {
+		_ = file.Close()
+		return nil, err
+	}
+	if s.Owner != nil && (s.Owner.UID != os.Geteuid() || s.Owner.GID != os.Getegid()) {
+		if err := file.Chown(s.Owner.UID, s.Owner.GID); err != nil {
+			_ = file.Close()
+			return nil, err
+		}
+	}
+	if err := file.Chmod(0o600); err != nil {
+		_ = file.Close()
+		return nil, err
+	}
+	if err := unix.Flock(int(file.Fd()), unix.LOCK_EX); err != nil {
+		_ = file.Close()
+		return nil, err
+	}
+	return &fileLock{file: file}, nil
+}
+
 func (s Store) ReadFile(path string) ([]byte, error) {
 	directory, base, err := s.openParent(path, false)
 	if err != nil {