@@ -14,7 +14,6 @@ import (
1414 "github.com/containerd/containerd/v2/pkg/namespaces"
1515 "github.com/containerd/nerdctl/v2/pkg/api/types"
1616 "github.com/containerd/nerdctl/v2/pkg/config"
17- "github.com/gofrs/flock"
1817 toml "github.com/pelletier/go-toml/v2"
1918 "github.com/runfinch/finch-daemon/api/router"
2019 "github.com/runfinch/finch-daemon/internal/backend"
@@ -29,7 +28,6 @@ import (
2928 "github.com/runfinch/finch-daemon/pkg/archive"
3029 "github.com/runfinch/finch-daemon/pkg/ecc"
3130 "github.com/runfinch/finch-daemon/pkg/flog"
32- "github.com/sirupsen/logrus"
3331 "github.com/spf13/afero"
3432)
3533
@@ -94,45 +92,6 @@ func createContainerdClient(conf *config.Config) (*backend.ContainerdClientWrapp
9492 return backend .NewContainerdClientWrapper (client ), nil
9593}
9694
97- // sanitizeRegoFile validates and prepares the Rego policy file for use.
98- // It checks validates the file, acquires a file lock,
99- // and sets rego file to be read-only.
100- func sanitizeRegoFile (options * DaemonOptions ) (string , error ) {
101- if options .regoFilePath != "" {
102- if ! options .enableMiddleware {
103- return "" , fmt .Errorf ("rego file path was provided without the --enable-middleware flag, please provide the --enable-middleware flag" ) // todo, can we default to setting this flag ourselves is this better UX?
104- }
105-
106- if err := checkRegoFileValidity (options .regoFilePath ); err != nil {
107- return "" , err
108- }
109- }
110-
111- if options .enableMiddleware && options .regoFilePath == "" {
112- return "" , fmt .Errorf ("rego file path not provided, please provide the policy file path using the --rego-file flag" )
113- }
114-
115- fileLock := flock .New (options .regoFilePath )
116-
117- locked , err := fileLock .TryLock ()
118- if err != nil {
119- return "" , fmt .Errorf ("error acquiring lock on rego file: %v" , err )
120- }
121- if ! locked {
122- return "" , fmt .Errorf ("unable to acquire lock on rego file, it may be in use by another process" )
123- }
124-
125- // Change file permissions to read-only
126- err = os .Chmod (options .regoFilePath , 0400 )
127- if err != nil {
128- fileLock .Unlock ()
129- return "" , fmt .Errorf ("error changing rego file permissions: %v" , err )
130- }
131- options .regoFileLock = fileLock
132-
133- return options .regoFilePath , nil
134- }
135-
13695// createRouterOptions creates router options by initializing all required services.
13796func createRouterOptions (
13897 conf * config.Config ,
@@ -160,39 +119,37 @@ func createRouterOptions(
160119 }
161120}
162121
163- // checkRegoFileValidity verifies that the given rego file exists and has the right file extension .
164- func checkRegoFileValidity ( regoFilePath string ) error {
165- fmt . Println ( "filepath in checkRegoFileValidity = " , regoFilePath )
166- if _ , err := os . Stat ( regoFilePath ); os . IsNotExist ( err ) {
167- return fmt .Errorf ("provided Rego file path does not exist: %s" , regoFilePath )
122+ // checkRegoFileValidity validates and prepares the Rego policy file for use .
123+ // It verifies that the file exists, has the right extension (.rego), and has appropriate permissions.
124+ func checkRegoFileValidity ( options * DaemonOptions , logger * flog. Logrus ) ( string , error ) {
125+ if options . regoFilePath == "" {
126+ return "" , fmt .Errorf ("rego file path not provided, please provide the policy file path using the --rego-file flag" )
168127 }
169128
170- // Check if the file has a valid extension (.rego)
171- fileExt := strings .ToLower (filepath .Ext (regoFilePath ))
172-
173- fmt .Println ("fileExt = " , fileExt )
174- if fileExt != ".rego" {
175- return fmt .Errorf ("invalid file extension for Rego file. Only .rego files are supported" )
129+ if _ , err := os .Stat (options .regoFilePath ); os .IsNotExist (err ) {
130+ return "" , fmt .Errorf ("provided Rego file path does not exist: %s" , options .regoFilePath )
176131 }
177132
178- return nil
179- }
133+ // Check if the file has a valid extension (.rego)
134+ fileExt := strings . ToLower ( filepath . Ext ( options . regoFilePath ))
180135
181- func cleanupRegoFile (options * DaemonOptions , logger * flog.Logrus ) {
182- if options .regoFileLock == nil {
183- return // Already cleaned up or nothing to clean
136+ if fileExt != ".rego" {
137+ return "" , fmt .Errorf ("invalid file extension for Rego file. Only .rego files are supported" )
184138 }
185139
186- // unlock the rego file
187- if err := options . regoFileLock . Unlock (); err != nil {
188- logrus . Errorf ( "failed to unlock Rego file: %v" , err )
189- }
190- logger . Infof ( "rego file unlocked" )
140+ if ! options . skipRegoPermCheck {
141+ fileInfo , err := os . Stat ( options . regoFilePath )
142+ if err != nil {
143+ return "" , fmt . Errorf ( "error checking rego file permissions: %v" , err )
144+ }
191145
192- // make rego file editable
193- if err := os .Chmod (options .regoFilePath , 0600 ); err != nil {
194- logrus .Errorf ("failed to change file permissions of rego file: %v" , err )
146+ if fileInfo .Mode ().Perm ()& 0177 != 0 {
147+ return "" , fmt .Errorf ("rego file permissions %o are too permissive (maximum allowable permissions: 0600)" , fileInfo .Mode ().Perm ())
148+ }
149+ logger .Debugf ("rego file permissions check passed: %o" , fileInfo .Mode ().Perm ())
150+ } else {
151+ logger .Warnf ("skipping rego file permission check - file may have permissions more permissive than 0600" )
195152 }
196153
197- options .regoFileLock = nil
154+ return options .regoFilePath , nil
198155}
0 commit comments