From f6c935a4d718f56a053e69f33b5416eea45ae748 Mon Sep 17 00:00:00 2001
From: smail <likb_blue@163.com>
Date: Tue, 29 Sep 2026 19:15:43 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BF=AE=E5=A4=8DLinux=E6=8F=92=E4=BB=B6?=
 =?UTF-8?q?=E9=9A=94=E7=A6=BB=E6=96=87=E4=BB=B6=E5=85=B3=E9=97=AD=E9=A1=BA?=
 =?UTF-8?q?=E5=BA=8F?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/hooks/plugin_isolation_linux.go | 23 ++++++++++++++++-------
 1 file changed, 16 insertions(+), 7 deletions(-)

diff --git a/backend/hooks/plugin_isolation_linux.go b/backend/hooks/plugin_isolation_linux.go
index 975738c..2a1beac 100644
--- a/backend/hooks/plugin_isolation_linux.go
+++ b/backend/hooks/plugin_isolation_linux.go
@@ -145,20 +145,24 @@ func copyPluginFile(sourcePath, targetPath string, uid, gid int, mode os.FileMod
 		_ = os.Remove(targetPath)
 		return fmt.Errorf("copy plugin configuration: %w", err)
 	}
-	if err := target.Close(); err != nil {
-		_ = os.Remove(targetPath)
-		return fmt.Errorf("close sandbox plugin configuration: %w", err)
-	}
 	if written > maxPluginConfigBytes {
 		_ = os.Remove(targetPath)
 		return errors.New("plugin configuration exceeds the allowed size")
 	}
 	if err := target.Chmod(mode); err != nil {
+		_ = target.Close()
+		_ = os.Remove(targetPath)
 		return fmt.Errorf("secure sandbox plugin configuration: %w", err)
 	}
 	if err := target.Chown(uid, gid); err != nil {
+		_ = target.Close()
+		_ = os.Remove(targetPath)
 		return fmt.Errorf("assign sandbox plugin configuration identity: %w", err)
 	}
+	if err := target.Close(); err != nil {
+		_ = os.Remove(targetPath)
+		return fmt.Errorf("close sandbox plugin configuration: %w", err)
+	}
 	return nil
 }
 
@@ -219,15 +223,20 @@ func copyPluginExecutable(sourcePath, targetPath string, uid, gid int) error {
 		_ = target.Close()
 		return fmt.Errorf("sync sandbox plugin executable: %w", err)
 	}
-	if err := target.Close(); err != nil {
-		return fmt.Errorf("close sandbox plugin executable: %w", err)
-	}
 	if err := target.Chmod(0700); err != nil {
+		_ = target.Close()
+		_ = os.Remove(targetPath)
 		return fmt.Errorf("secure sandbox plugin executable: %w", err)
 	}
 	if err := target.Chown(uid, gid); err != nil {
+		_ = target.Close()
+		_ = os.Remove(targetPath)
 		return fmt.Errorf("assign sandbox plugin identity: %w", err)
 	}
+	if err := target.Close(); err != nil {
+		_ = os.Remove(targetPath)
+		return fmt.Errorf("close sandbox plugin executable: %w", err)
+	}
 	return nil
 }