Merge pull request #100 from fly-apps/fix-lock-perms

Fix lock file perms

Author: davissp14

internal/flypg/readonly.go

@@ -8,6 +8,7 @@ import (
 	"time"
 
 	"github.com/fly-apps/postgres-flex/internal/flypg/admin"
+	"github.com/fly-apps/postgres-flex/internal/utils"
 )
 
 const (
@@ -101,6 +102,15 @@ func writeReadOnlyLock() error {
 		return err
 	}
 
+	pgUID, pgGID, err := utils.SystemUserIDs("postgres")
+	if err != nil {
+		return err
+	}
+
+	if err := os.Chown(readOnlyLockFile, pgUID, pgGID); err != nil {
+		return fmt.Errorf("failed to set readonly.lock owner: %s", err)
+	}
+
 	return nil
 }
 

internal/flypg/zombie.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"os"
 
+	"github.com/fly-apps/postgres-flex/internal/utils"
 	"github.com/jackc/pgx/v5"
 )
 
@@ -21,32 +22,43 @@ var (
 	ErrZombieDiagnosisUndecided = errors.New("unable to confirm we are the true primary")
 )
 
+const zombieLockFile = "/data/zombie.lock"
+
 func ZombieLockExists() bool {
-	_, err := os.Stat("/data/zombie.lock")
+	_, err := os.Stat(zombieLockFile)
 	if os.IsNotExist(err) {
 		return false
 	}
 	return true
 }
 
 func writeZombieLock(hostname string) error {
-	if err := os.WriteFile("/data/zombie.lock", []byte(hostname), 0644); err != nil {
+	if err := os.WriteFile(zombieLockFile, []byte(hostname), 0644); err != nil {
 		return err
 	}
 
+	pgUID, pgGID, err := utils.SystemUserIDs("postgres")
+	if err != nil {
+		return err
+	}
+
+	if err := os.Chown(zombieLockFile, pgUID, pgGID); err != nil {
+		return fmt.Errorf("failed to set zombie.lock owner: %s", err)
+	}
+
 	return nil
 }
 
 func RemoveZombieLock() error {
-	if err := os.Remove("/data/zombie.lock"); err != nil {
+	if err := os.Remove(zombieLockFile); err != nil {
 		return err
 	}
 
 	return nil
 }
 
 func ReadZombieLock() (string, error) {
-	body, err := os.ReadFile("/data/zombie.lock")
+	body, err := os.ReadFile(zombieLockFile)
 	if err != nil {
 		return "", err
 	}

internal/utils/shell.go

@@ -8,22 +8,31 @@ import (
 )
 
 func RunCommand(cmdStr string) error {
-	pgUser, err := user.Lookup("postgres")
+	pgUID, pgGID, err := SystemUserIDs("postgres")
 	if err != nil {
 		return err
 	}
+
+	cmd := exec.Command("sh", "-c", cmdStr)
+	cmd.SysProcAttr = &syscall.SysProcAttr{}
+	cmd.SysProcAttr.Credential = &syscall.Credential{Uid: uint32(pgUID), Gid: uint32(pgGID)}
+	_, err = cmd.Output()
+	return err
+}
+
+func SystemUserIDs(usr string) (int, int, error) {
+	pgUser, err := user.Lookup(usr)
+	if err != nil {
+		return 0, 0, err
+	}
 	pgUID, err := strconv.Atoi(pgUser.Uid)
 	if err != nil {
-		return err
+		return 0, 0, err
 	}
 	pgGID, err := strconv.Atoi(pgUser.Gid)
 	if err != nil {
-		return err
+		return 0, 0, err
 	}
 
-	cmd := exec.Command("sh", "-c", cmdStr)
-	cmd.SysProcAttr = &syscall.SysProcAttr{}
-	cmd.SysProcAttr.Credential = &syscall.Credential{Uid: uint32(pgUID), Gid: uint32(pgGID)}
-	_, err = cmd.Output()
-	return err
+	return pgUID, pgGID, nil
 }