gitea-admin/proxy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: make daemon reset conflict safe

Browse Source
This commit is contained in:
proxyctl coordinator
2026-07-17 11:11:56 +08:00
parent 613fe56540
commit 9e2418f45e
6 changed files with 283 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/proxyctl/main.go
+10 -33
View File
@@ -12,7 +12,6 @@ import (
"syscall"
tea "github.com/charmbracelet/bubbletea"
"golang.org/x/sys/unix"
"proxyctl/internal/app"
"proxyctl/internal/apt"
@@ -244,44 +243,22 @@ func diagnosticChecks(configuration profile.Configuration) []target.Check {
}
func storagePermissions(configuration profile.Configuration) (bool, string) {
ok, evidence := writableLocation(configuration.Path)
info, err := os.Stat(configuration.Path)
authority := target.ReadOnlyWriteAuthority(configuration.Path)
if !authority.OK {
return false, authority.Evidence
}
info, err := os.Lstat(configuration.Path)
if os.IsNotExist(err) {
return ok, evidence + "; Profile configuration does not exist yet"
return true, authority.Evidence + "; Profile configuration does not exist yet"
}
if err != nil {
return false, evidence + "; Profile configuration cannot be inspected: " + err.Error()
return false, authority.Evidence + "; Profile configuration cannot be inspected: " + err.Error()
}
if info.Mode().Perm() != 0o600 {
return false, fmt.Sprintf("%s; Profile configuration mode is %o, want 600", evidence, info.Mode().Perm())
return false, fmt.Sprintf("%s; Profile configuration mode is %o, want 600", authority.Evidence, info.Mode().Perm())
}
if stat, present := info.Sys().(*syscall.Stat_t); present && int(stat.Uid) != configuration.Owner.UID {
return false, fmt.Sprintf("%s; Profile configuration owner uid is %d, want %d", evidence, stat.Uid, configuration.Owner.UID)
}
return ok, evidence + "; Profile configuration is owner-only"
}
// writableLocation observes current authority without creating or changing files.
func writableLocation(path string) (bool, string) {
candidate := path
for {
info, err := os.Stat(candidate)
if err == nil {
if !info.IsDir() {
candidate = filepath.Dir(candidate)
}
if err := unix.Access(candidate, unix.W_OK); err != nil {
return false, candidate + " is not writable: " + err.Error()
}
return true, candidate + " is writable"
}
if !os.IsNotExist(err) {
return false, candidate + " cannot be inspected: " + err.Error()
}
parent := filepath.Dir(candidate)
if parent == candidate {
return false, path + " has no writable existing ancestor"
}
candidate = parent
return false, fmt.Sprintf("%s; Profile configuration owner uid is %d, want %d", authority.Evidence, stat.Uid, configuration.Owner.UID)
}
return true, authority.Evidence + "; Profile configuration is owner-only"
}