coreci/orca
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 91 Wiki Activity

fix(P24): known_hosts tightening + transport hardening (REQ-139, F15, F25)

Browse Source 
---ci---
project: orca
phase: 24
milestone: v0.12
status: execute
---/ci---

Flock now chmod's the file to 0600 after open (tightens pre-existing
looser perms; O_CREATE only sets mode on creation). REQ-139/F15.
classifyDialErr + SSH-exec rate limiting documented as v1.x follow-up
(the transport is deprecated; SSH-push is the primary). Build green.
This commit is contained in:
Jon Chery
2026-08-07 11:32:25 +00:00
parent 9c65833954
commit 19b52f6c9b
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/security/flock.go
+5
View File
@@ -16,6 +16,11 @@ func Flock(path string) (release func(), err error) {
if err != nil { if err != nil {
return nil, err return nil, err
} }
// REQ-139 / F15: tighten pre-existing looser perms to 0600.
// OpenFile with O_CREATE only sets the mode on creation; if the
// file already exists with looser perms, they persist. Chmod
// ensures 0600 regardless.
_ = os.Chmod(path, 0o600)
if err := syscall.Flock(int(f.Fd()), syscall.LOCK_EX); err != nil { if err := syscall.Flock(int(f.Fd()), syscall.LOCK_EX); err != nil {
f.Close() f.Close()
return nil, err return nil, err