收紧证书与配置状态文件访问

backend/config/ssl_custom.go

@@ -7,6 +7,8 @@ import (
 	"path/filepath"
 	"strings"
 
+	securefile "git.pcux.cn/xuans/Smail/utils/file"
+
 	"git.pcux.cn/xuans/Smail/utils/runtimepath"
 )
 
@@ -146,7 +148,7 @@ func readExternalSSLFile(path string, privateKey bool) ([]byte, error) {
 	if privateKey && info.Mode().Perm()&0077 != 0 && runtimeSupportsPermissionCheck() {
 		return nil, ErrSSLPrivateKeyPermission
 	}
-	file, err := os.Open(path)
+	file, err := securefile.OpenRegularFile(path, os.O_RDONLY, 0)
 	if err != nil {
 		return nil, ErrSSLFileUnavailable
 	}

backend/config/ssl_lease_unix.go

@@ -2,8 +2,21 @@
 
 package config
 
-import "os"
+import (
+	"os"
+	"path/filepath"
+)
 
 func openSSLLease(path string) (*os.File, error) {
-	return os.OpenFile(path, os.O_RDWR, 0600)
+	absolute, err := filepath.Abs(filepath.Clean(path))
+	if err != nil {
+		return nil, err
+	}
+	root, err := os.OpenRoot(filepath.Dir(absolute))
+	if err != nil {
+		return nil, err
+	}
+	file, err := root.OpenFile(filepath.Base(absolute), os.O_RDWR, 0600)
+	_ = root.Close()
+	return file, err
 }

backend/config/state_store.go

@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"git.pcux.cn/xuans/Smail/utils/atomicfile"
+	fileutil "git.pcux.cn/xuans/Smail/utils/file"
 	"git.pcux.cn/xuans/Smail/utils/runtimepath"
 )
 
@@ -31,7 +32,7 @@ func (s *TransactionStore) lockState() (func(), error) {
 	} else if err != nil && !os.IsNotExist(err) {
 		return nil, err
 	}
-	file, err := os.OpenFile(filename, os.O_CREATE|os.O_RDWR, 0600)
+	file, err := fileutil.OpenRegularFile(filename, os.O_CREATE|os.O_RDWR, 0600)
 	if err != nil {
 		return nil, err
 	}