Refuse inexact production selector authorities

crates/lazaret-prepared-lower/src/transport.rs

@@ -355,15 +355,14 @@ impl LayoutWriter {
                 staging_id,
             } => {
                 let storage = File::from(storage_root.open_authority()?);
-                create_directory(&storage, "image-transports")?;
-                let parent = Arc::new(open_directory(&storage, Path::new("image-transports"))?);
+                let parent = Arc::new(create_directory(&storage, "image-transports")?);
                 let name = hex(&staging_id);
                 mkdirat(&parent, name.as_str(), Mode::from_raw_mode(0o700))?;
                 let root = Arc::new(open_directory(&parent, Path::new(&name))?);
+                require_owned_directory(&root)?;
                 let stat = fstat(&root)?;
-                create_directory(&root, "blobs")?;
-                let blobs = open_directory(&root, Path::new("blobs"))?;
-                create_directory(&blobs, "sha256")?;
+                let blobs = create_directory(&root, "blobs")?;
+                drop(create_directory(&blobs, "sha256")?);
                 write_relative_atomic(
                     &root,
                     Path::new("oci-layout"),
@@ -522,12 +521,21 @@ impl LayoutWriter {
     }
 }
 
-fn create_directory(parent: &File, path: &str) -> Result<()> {
+fn create_directory(parent: &File, path: &str) -> Result<File> {
     match mkdirat(parent, path, Mode::from_raw_mode(0o700)) {
         Ok(()) | Err(rustix::io::Errno::EXIST) => {}
         Err(error) => return Err(error.into()),
     }
-    drop(open_directory(parent, Path::new(path))?);
+    let directory = open_directory(parent, Path::new(path))?;
+    require_owned_directory(&directory)?;
+    Ok(directory)
+}
+
+fn require_owned_directory(directory: &File) -> Result<()> {
+    let stat = fstat(directory)?;
+    if stat.st_uid != rustix::process::getuid().as_raw() || stat.st_mode & 0o7777 != 0o700 {
+        bail!("fixed image-transport directory must be owned by the invoking user with mode 0700");
+    }
     Ok(())
 }
 
@@ -695,11 +703,30 @@ fn hex(bytes: &[u8]) -> String {
 mod tests {
     use std::io::{Read, Write};
     use std::net::TcpListener;
+    use std::os::unix::fs::PermissionsExt;
 
     use oci_client::client::ClientProtocol;
 
     use super::*;
 
+    #[test]
+    fn preexisting_transport_parents_require_exact_private_mode() {
+        for name in ["image-transports", "blobs", "sha256"] {
+            let tree = tempfile::tempdir().unwrap();
+            std::fs::create_dir(tree.path().join(name)).unwrap();
+            std::fs::set_permissions(
+                tree.path().join(name),
+                std::fs::Permissions::from_mode(0o777),
+            )
+            .unwrap();
+            let parent = File::open(tree.path()).unwrap();
+            assert!(
+                create_directory(&parent, name).is_err(),
+                "accepted wrong mode for {name}"
+            );
+        }
+    }
+
     #[test]
     fn refuses_mismatched_and_incomplete_platforms() {
         assert!(