mirror of
https://github.com/Twigpine/zero.git
synced 2026-11-09 18:08:31 -10:00
KRATOS
90014210d2
* fix(daemon): publish status files atomically * fix(daemon): bind status publication to directory handle * fix(daemon): validate status directory access * fix(daemon): accept current token directory owner * fix(daemon): migrate owned runtime directories safely * fix(daemon): open Windows security handle relatively * fix(daemon): use current NT directory object * fix(observability): harden existing crash directories * fix(security): bind crash report creation to private root * fix(observability): atomically publish crash reports * fix(observability): preserve committed crash reports * fix(observability): revalidate committed crash path * fix(daemon): secure runtime lifecycle boundaries * fix(daemon): bind status ownership through cleanup * fix(daemon): preserve Windows status security * fix(daemon): retain trusted runtime root for lifecycle * fix(daemon): roll back redirected socket binds * fix(daemon): address status publication review
14 lines
480 B
Go
14 lines
480 B
Go
//go:build windows
|
|
|
|
package daemon
|
|
|
|
import "os"
|
|
|
|
// hardenSocketFile is a no-op on Windows: AF_UNIX socket files do not honor POSIX
|
|
// mode bits, and the daemon places the socket under the per-user profile
|
|
// directory, which is already ACL-restricted to the owner. A dedicated restricted
|
|
// ACL (or a named pipe with an explicit DACL) is a documented follow-up.
|
|
func hardenSocketFile(string) error { return nil }
|
|
|
|
func hardenSocketFileRoot(*os.Root, string) error { return nil }
|