fix: reject profile diagnostic symlink ancestors

2026-07-17 11:41:55 +08:00
parent 6cb4943a54
commit e9ff24e04a
4 changed files with 166 additions and 20 deletions
@@ -40,7 +40,7 @@ func (systemFileOperations) SyncDirectory(directory *os.File) error {
 }

 func NewFileStore(path string) *FileStore {
-	return &FileStore{path: path, operations: systemFileOperations{}}
+	return &FileStore{path: path, trustedRoot: securefs.ExistingTrustedRoot(path), operations: systemFileOperations{}}
 }

 func NewOwnedFileStore(path string, owner UserIdentity) *FileStore {
@@ -52,13 +52,21 @@ func NewOwnedFileStoreAt(path string, owner UserIdentity, trustedRoot string) *F
 }

 func newFileStore(path string, owner *UserIdentity, operations fileOperations) *FileStore {
-	trustedRoot := ""
+	trustedRoot := securefs.ExistingTrustedRoot(path)
 	if owner != nil {
 		trustedRoot = owner.HomeDir
 	}
 	return &FileStore{path: path, owner: owner, trustedRoot: trustedRoot, operations: operations}
 }

+func (s *FileStore) secureStore() securefs.Store {
+	store := securefs.Store{TrustedRoot: s.trustedRoot}
+	if s.owner != nil {
+		store.Owner = &securefs.Owner{UID: s.owner.UID, GID: s.owner.GID}
+	}
+	return store
+}
+
 type UserIdentity struct {
 	Username string
 	HomeDir  string