Confine local file installation paths

2026-08-10 17:59:29 +00:00
parent 59f3fe3d1d
commit 18ddf00d3d
20 changed files with 694 additions and 153 deletions
--- a/internal/fileops/directory.go
+++ b/internal/fileops/directory.go
@@ -21,6 +21,13 @@ func PromoteDirectory(src, dst string) error {
 	if err := checkAtomicDirectoryPromotionSupport(); err != nil {
 		return err
 	}
+	parent, _, err := openConfinedParent(dst, false, 0)
+	if err != nil {
+		return fmt.Errorf("open destination parent: %w", err)
+	}
+	if err := parent.Close(); err != nil {
+		return fmt.Errorf("close destination parent: %w", err)
+	}
 	return promoteDirectory(src, dst, renameDirectoryNoReplace)
 }