From 200a399b4d2de9070879f4ce779188b905b319e3 Mon Sep 17 00:00:00 2001
From: smail <likb_blue@163.com>
Date: Tue, 22 Sep 2026 03:35:32 +0800
Subject: [PATCH] =?UTF-8?q?=E6=94=B6=E7=B4=A7=E8=AF=81=E4=B9=A6=E4=B8=8E?=
 =?UTF-8?q?=E9=85=8D=E7=BD=AE=E7=8A=B6=E6=80=81=E6=96=87=E4=BB=B6=E8=AE=BF?=
 =?UTF-8?q?=E9=97=AE?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/config/ssl_custom.go     |  4 +++-
 backend/config/ssl_lease_unix.go | 17 +++++++++++++++--
 backend/config/state_store.go    |  3 ++-
 3 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/backend/config/ssl_custom.go b/backend/config/ssl_custom.go
index 6261443..d5318fd 100644
--- a/backend/config/ssl_custom.go
+++ b/backend/config/ssl_custom.go
@@ -7,6 +7,8 @@ import (
 	"path/filepath"
 	"strings"
 
+	securefile "git.pcux.cn/xuans/Smail/utils/file"
+
 	"git.pcux.cn/xuans/Smail/utils/runtimepath"
 )
 
@@ -146,7 +148,7 @@ func readExternalSSLFile(path string, privateKey bool) ([]byte, error) {
 	if privateKey && info.Mode().Perm()&0077 != 0 && runtimeSupportsPermissionCheck() {
 		return nil, ErrSSLPrivateKeyPermission
 	}
-	file, err := os.Open(path)
+	file, err := securefile.OpenRegularFile(path, os.O_RDONLY, 0)
 	if err != nil {
 		return nil, ErrSSLFileUnavailable
 	}
diff --git a/backend/config/ssl_lease_unix.go b/backend/config/ssl_lease_unix.go
index 99db724..f0fb51d 100644
--- a/backend/config/ssl_lease_unix.go
+++ b/backend/config/ssl_lease_unix.go
@@ -2,8 +2,21 @@
 
 package config
 
-import "os"
+import (
+	"os"
+	"path/filepath"
+)
 
 func openSSLLease(path string) (*os.File, error) {
-	return os.OpenFile(path, os.O_RDWR, 0600)
+	absolute, err := filepath.Abs(filepath.Clean(path))
+	if err != nil {
+		return nil, err
+	}
+	root, err := os.OpenRoot(filepath.Dir(absolute))
+	if err != nil {
+		return nil, err
+	}
+	file, err := root.OpenFile(filepath.Base(absolute), os.O_RDWR, 0600)
+	_ = root.Close()
+	return file, err
 }
diff --git a/backend/config/state_store.go b/backend/config/state_store.go
index 9745e53..b891e55 100644
--- a/backend/config/state_store.go
+++ b/backend/config/state_store.go
@@ -9,6 +9,7 @@ import (
 	"time"
 
 	"git.pcux.cn/xuans/Smail/utils/atomicfile"
+	fileutil "git.pcux.cn/xuans/Smail/utils/file"
 	"git.pcux.cn/xuans/Smail/utils/runtimepath"
 )
 
@@ -31,7 +32,7 @@ func (s *TransactionStore) lockState() (func(), error) {
 	} else if err != nil && !os.IsNotExist(err) {
 		return nil, err
 	}
-	file, err := os.OpenFile(filename, os.O_CREATE|os.O_RDWR, 0600)
+	file, err := fileutil.OpenRegularFile(filename, os.O_CREATE|os.O_RDWR, 0600)
 	if err != nil {
 		return nil, err
 	}