pavel/box
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

permissions are hard

Browse source
This commit is contained in:
pavel 2026-05-14 20:13:28 +02:00
commit 19a1e3916f
1 changed files with 31 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

31
internal/app/systemd_service.go
View file

@ -52,6 +52,15 @@ func (a *App) renderSystemdForProject(ctx context.Context, p Project) error {
if err := os.WriteFile(envPath, []byte(b.String()), 0o600); err != nil {
return err
}
if err := ensureOwnedByUnixUser(projectDir, p.UnixUser, 0o755); err != nil {
return err
}
if err := ensureOwnedByUnixUser(dataDir, p.UnixUser, 0o755); err != nil {
return err
}
if err := ensureOwnedByUnixUser(envPath, p.UnixUser, 0o600); err != nil {
return err
}
unit := fmt.Sprintf(`[Unit]
Description=Project %s
@ -81,6 +90,9 @@ WantedBy=default.target
if err := os.WriteFile(servicePath, []byte(unit), 0o644); err != nil {
return err
}
if err := ensureOwnedByUnixUser(servicePath, p.UnixUser, 0o644); err != nil {
return err
}
_ = runSystemctlUser(p.UnixUser, "daemon-reload")
_ = runSystemctlUser(p.UnixUser, "enable", "--now", p.ServiceName)
return nil
@ -97,6 +109,25 @@ func homeForUnixUser(username string) (string, error) {
return u.HomeDir, nil
}
func ensureOwnedByUnixUser(path, username string, mode os.FileMode) error {
u, err := user.Lookup(username)
if err != nil {
return fmt.Errorf("lookup unix user %q failed: %w", username, err)
}
uid, err := strconv.Atoi(u.Uid)
if err != nil {
return fmt.Errorf("invalid uid for %q: %w", username, err)
}
gid, err := strconv.Atoi(u.Gid)
if err != nil {
return fmt.Errorf("invalid gid for %q: %w", username, err)
}
if err := os.Chown(path, uid, gid); err != nil {
return err
}
return os.Chmod(path, mode)
}
func userRuntimeEnv(username string) (string, string, error) {
u, err := user.Lookup(username)
if err != nil {