cabbage/rvbox
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: harden generated Windows wrapper ACLs

Browse Source
This commit is contained in:
cabbage
2026-09-06 14:04:51 +00:00
parent 4e75524efa
commit 09e8a9df9e
2 changed files with 60 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/client/supervisor/windows/native_exec.go
+8 -2
View File
@@ -252,7 +252,7 @@ func (process *execProcess) startReaders(maxChunk uint64, remove func()) {
}()
}
func materializeWrapper(directory string, wrapper Wrapper, now time.Time) (string, func(), error) {
func materializeWrapper(directory string, wrapper Wrapper, now time.Time, secure func(string) error) (string, func(), error) {
if directory == "" {
return "", nil, ErrInvalidWorkingDirectory
}
@@ -272,6 +272,12 @@ func materializeWrapper(directory string, wrapper Wrapper, now time.Time) (strin
cleanup()
return "", nil, err
}
if secure != nil {
if err := secure(temporaryName); err != nil {
cleanup()
return "", nil, err
}
}
if _, err := temporary.Write(wrapper.Bytes); err != nil {
cleanup()
return "", nil, err
@@ -379,7 +385,7 @@ func (manager *execSupervisor) startPortable(ctx context.Context, spec superviso
if err != nil {
return nil, err
}
wrapperPath, cleanup, err = materializeWrapper(spec.WorkingDirectory, wrapper, manager.options.Now())
wrapperPath, cleanup, err = materializeWrapper(spec.WorkingDirectory, wrapper, manager.options.Now(), nil)
if err != nil {
return nil, err
}