50 lines
1.4 KiB
Go
50 lines
1.4 KiB
Go
package tenantstore
|
|
|
|
import (
|
|
"fmt"
|
|
"os"
|
|
)
|
|
|
|
const privateDatabaseMode os.FileMode = 0o600
|
|
|
|
func preparePrivateDatabase(dbPath string) error {
|
|
if info, err := os.Lstat(dbPath); err == nil {
|
|
if info.Mode()&os.ModeSymlink != 0 || !info.Mode().IsRegular() {
|
|
return fmt.Errorf("sqlite database must be a regular file")
|
|
}
|
|
} else if !os.IsNotExist(err) {
|
|
return fmt.Errorf("inspect sqlite database: %w", err)
|
|
}
|
|
file, err := os.OpenFile(dbPath, os.O_CREATE|os.O_RDWR, privateDatabaseMode)
|
|
if err != nil {
|
|
return fmt.Errorf("open private sqlite database: %w", err)
|
|
}
|
|
if err := file.Chmod(privateDatabaseMode); err != nil {
|
|
_ = file.Close()
|
|
return fmt.Errorf("secure sqlite database: %w", err)
|
|
}
|
|
if err := file.Close(); err != nil {
|
|
return fmt.Errorf("close private sqlite database: %w", err)
|
|
}
|
|
return tightenPrivateDatabaseArtifacts(dbPath)
|
|
}
|
|
|
|
func tightenPrivateDatabaseArtifacts(dbPath string) error {
|
|
for _, path := range []string{dbPath, dbPath + "-wal", dbPath + "-shm"} {
|
|
if info, err := os.Lstat(path); err == nil {
|
|
if info.Mode()&os.ModeSymlink != 0 || !info.Mode().IsRegular() {
|
|
return fmt.Errorf("sqlite artifact must be a regular file")
|
|
}
|
|
} else if !os.IsNotExist(err) {
|
|
return fmt.Errorf("inspect sqlite artifact: %w", err)
|
|
}
|
|
if err := os.Chmod(path, privateDatabaseMode); err != nil {
|
|
if os.IsNotExist(err) {
|
|
continue
|
|
}
|
|
return fmt.Errorf("secure sqlite artifact: %w", err)
|
|
}
|
|
}
|
|
return nil
|
|
}
|