open-source/qinglong
1
0
Fork 0
mirror of https://github.com/whyour/qinglong.git synced 2026-09-22 19:29:13 +08:00
Code Issues Packages Projects Releases Wiki Activity

feat(ql3): prove security administration custody live

Browse Source
This commit is contained in:
whyour
2026-08-25 09:15:40 +08:00
parent 2eb8b29e51
commit c6b9e1504c
14 changed files with 2391 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files
packages/ql3-cluster-admin/src/security-administration/clusterAdministrationKubernetesInputStage.ts
+13 -2
View File
@@ -119,13 +119,23 @@ function sameFileState(
);
}
export function isClusterAdministrationProjectedSourceDirectoryAuthority(
status: Readonly<{ mode: number; uid: number }>,
): boolean {
const permissions = status.mode & 0o1777;
return (
(permissions & 0o002) === 0 ||
(status.uid === 0 && permissions === 0o1777)
);
}
function verifySourceDirectory(sourceDirectory: string): string {
const status = lstatSync(sourceDirectory, { throwIfNoEntry: false });
if (
status === undefined ||
!status.isDirectory() ||
status.isSymbolicLink() ||
(status.mode & 0o002) !== 0
!isClusterAdministrationProjectedSourceDirectoryAuthority(status)
) {
throw new ClusterAdministrationKubernetesInputStageError(
'projected source directory authority is invalid',
@@ -245,7 +255,7 @@ function verifyWritableParent(parent: string, label: string): void {
status === undefined ||
!status.isDirectory() ||
status.isSymbolicLink() ||
(status.mode & 0o002) !== 0
!isClusterAdministrationProjectedSourceDirectoryAuthority(status)
) {
throw new ClusterAdministrationKubernetesInputStageError(
`${label} parent authority is invalid`,
@@ -290,6 +300,7 @@ function createPrivateDirectory(directory: string, label: string): void {
}
function prepareDeliveryDirectory(directory: string): void {
verifyWritableParent(dirname(directory), 'delivery directory');
const existing = lstatSync(directory, { throwIfNoEntry: false });
if (existing === undefined) {
createPrivateDirectory(directory, 'delivery directory');