姚章浩
910c0fcd76
build / build (push) Failing after 16s
- libraryagent：0700 目录内 0600 unix socket + SO_PEERCRED 同 uid， 固定 binary/归档/日志/项目/写入者声明，请求只能选范围与作业号 - API：POST/GET /api/v1/library/captures（入队 library.capture + 读队列状态） - worker：library.capture handler 走 socket；启动先 recover；不挂 Docker socket、 不持有来源凭据 - web：整库版本页显示真实作业状态并可发起封存（未接线/无权限给出原因） - scripts/library-agent-install.sh：构建、安装 systemd user 服务并读回权限
38 lines
1.1 KiB
Go
38 lines
1.1 KiB
Go
package libraryagent
|
|
|
|
import (
|
|
"errors"
|
|
"net"
|
|
"os"
|
|
"syscall"
|
|
)
|
|
|
|
// peerAllowed enforces that the connecting process runs as the same uid as the
|
|
// agent. File mode 0600 already limits connect() to that uid; the credential
|
|
// check makes the boundary explicit and fails closed if the socket is ever
|
|
// reached another way (bind mount into a container with a different uid).
|
|
func peerAllowed(conn net.Conn) error {
|
|
unixConn, ok := conn.(*net.UnixConn)
|
|
if !ok {
|
|
return errors.New("unsupported transport")
|
|
}
|
|
raw, err := unixConn.SyscallConn()
|
|
if err != nil {
|
|
return errors.New("peer credentials unavailable")
|
|
}
|
|
var credential *syscall.Ucred
|
|
var controlErr error
|
|
if err = raw.Control(func(fd uintptr) {
|
|
credential, controlErr = syscall.GetsockoptUcred(int(fd), syscall.SOL_SOCKET, syscall.SO_PEERCRED)
|
|
}); err != nil {
|
|
return errors.New("peer credentials unavailable")
|
|
}
|
|
if controlErr != nil || credential == nil {
|
|
return errors.New("peer credentials unavailable")
|
|
}
|
|
if credential.Uid != uint32(os.Geteuid()) {
|
|
return errors.New("peer uid is not allowed")
|
|
}
|
|
return nil
|
|
}
|