fix: Restore authorized_keys atomically so an interrupt cannot empty it - #311
Draft
lauri-amd wants to merge 1 commit into
Draft
fix: Restore authorized_keys atomically so an interrupt cannot empty it#311lauri-amd wants to merge 1 commit into
lauri-amd wants to merge 1 commit into
Conversation
Cleanup restored the user's authorized_keys with an O_TRUNC copy, leaving the file empty for the duration of the write. Interrupting bloom during that window made the truncation permanent and could lock an operator out of the node. Observed in the field. Restore (and install) now write a temp file in the same directory and rename it into place, so a reader only ever sees the old or new content. Cleanup takes a mutex, since interrupt handling gives it three concurrent callers, and a failed restore now returns an error instead of nil so the caller stops reporting success over a file it did not restore.
pre
reviewed
Aug 25, 2026
| // that window makes the truncation permanent, and for authorized_keys that | ||
| // locks the operator out of the node. Pass uid/gid as -1 to leave ownership to | ||
| // the caller. | ||
| func writeFileAtomically(path string, content []byte, mode os.FileMode, uid, gid int) error { |
Contributor
There was a problem hiding this comment.
atomicWriteFile already exists in pkg/ansible/runtime/fstab.go - perhaps combine the implementation in one place?
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Cleanup restored the user's authorized_keys with an O_TRUNC copy, leaving the file empty for the duration of the write. Interrupting bloom during that window made the truncation permanent and could lock an operator out of the node. Observed in the field.
Restore (and install) now write a temp file in the same directory and rename it into place, so a reader only ever sees the old or new content. Cleanup takes a mutex, since interrupt handling gives it three concurrent callers, and a failed restore now returns an error instead of nil so the caller stops reporting success over a file it did not restore.