fix(security): harden diagnostics storage boundary

2026-09-07 19:52:11 +05:00
parent af9f476658
commit a3445f79c5
12 changed files with 562 additions and 37 deletions
@@ -1,5 +1,6 @@
 import type { InstallContext } from "../types/context";
 import { runMutating } from "../lib/process";
+import { ensureDiagnosticsStorageRoot } from "../lib/diagnosticsStorage";

 async function userExists(user: string): Promise<boolean> {
  try {
@@ -58,5 +59,6 @@ export async function prepareFilesystem(context: InstallContext): Promise<void>
  await ensureDir(context.config.installDir, "0755", "root:root");
  await ensureDir("/usr/local/lib/hy2xs", "0755", "root:root");
  await ensureDir("/etc/nftables.d", "0755", "root:root");
+  await ensureDiagnosticsStorageRoot();
  await runMutating`chmod -R go-w ${context.config.installDir}`;
 }