1. The state directory was created too late and never verified.
ensure_state_dir only ran when the ownership record was written, well after
assert_swap_path_is_safe had already required every parent of swap.path to exist. On a
clean host that meant a perfectly legal /var/lib/awg2-harness/swapfile was rejected
because the directory this package is supposed to create did not exist yet.
Worse, when the directory did exist the check only confirmed it was a directory. A
pre-existing /var/lib/awg2-harness that was group- or world-writable defeated the whole
point of restricting swap.path to root-owned roots: another user could still swap the
swapfile out from under a root-owned fallocate or mkswap.
ensure_state_dir now runs first in ensure_swap and asserts what the restriction actually
depends on: the parent is a real directory and not a symlink, the state directory itself
is not a symlink, it is owned by uid 0, and it is not writable by group or others. A
mode that is merely narrower than 0700 is tightened rather than rejected; anything
group- or world-writable is a hard error, because the safety argument for the whole
allow-list rests on it.
The units also declare StateDirectory=awg2-harness with mode 0700 and
RuntimeDirectory=awg2-harness, so in the common case systemd creates and owns both and
the binary only has to verify. The runtime checks stay regardless: the CLI subcommands
run outside the service lifecycle.
2. The fstab copies could be more permissive than the file they mirror.
The backup and pristine copies were written at a hardcoded 0644 with a comment claiming
they must not be wider than the original. On a host where /etc/fstab is 0600 they were,
and the rollback then handed that wider mode to the live file too. FstabTransaction now
captures the live mode when it opens and uses it for the backup, the pristine copy, the
candidate and the rollback.
One test added, unix-only since it asserts a mode: a 0600 fstab produces 0600 copies and
stays 0600 after the commit.
cargo test --workspace: 180 + 4 passed. clippy -D warnings clean. Unit files not verified
here - no systemd on this host; tools/build.sh runs systemd-analyze verify on the build
machine.
founder
fa44ffbb24