| 1020 | } |
| 1021 | |
| 1022 | func (secret *execSecretMountInstance) Mount() ([]ctrdmount.Mount, func() error, error) { |
| 1023 | dir, err := os.MkdirTemp("", "dagger-secrets") |
| 1024 | if err != nil { |
| 1025 | return nil, nil, fmt.Errorf("failed to create temp dir: %w", err) |
| 1026 | } |
| 1027 | cleanupDir := func() error { |
| 1028 | return os.RemoveAll(dir) |
| 1029 | } |
| 1030 | |
| 1031 | if err := os.Chmod(dir, 0o711); err != nil { |
| 1032 | _ = cleanupDir() |
| 1033 | return nil, nil, err |
| 1034 | } |
| 1035 | |
| 1036 | var mountOpts []string |
| 1037 | if secret.secret.mode&0o111 == 0 { |
| 1038 | mountOpts = append(mountOpts, "noexec") |
| 1039 | } |
| 1040 | |
| 1041 | tmpMount := ctrdmount.Mount{ |
| 1042 | Type: "tmpfs", |
| 1043 | Source: "tmpfs", |
| 1044 | Options: append([]string{"nodev", "nosuid", fmt.Sprintf("uid=%d,gid=%d", os.Geteuid(), os.Getegid())}, mountOpts...), |
| 1045 | } |
| 1046 | if userns.RunningInUserNS() { |
| 1047 | tmpMount.Options = nil |
| 1048 | } |
| 1049 | |
| 1050 | if err := ctrdmount.All([]ctrdmount.Mount{tmpMount}, dir); err != nil { |
| 1051 | _ = cleanupDir() |
| 1052 | return nil, nil, fmt.Errorf("unable to setup secret mount: %w", err) |
| 1053 | } |
| 1054 | |
| 1055 | cleanup := func() error { |
| 1056 | if err := ctrdmount.Unmount(dir, 0); err != nil { |
| 1057 | return err |
| 1058 | } |
| 1059 | return cleanupDir() |
| 1060 | } |
| 1061 | |
| 1062 | fp := filepath.Join(dir, identity.NewID()) |
| 1063 | if err := os.WriteFile(fp, secret.secret.data, 0o600); err != nil { |
| 1064 | _ = cleanup() |
| 1065 | return nil, nil, err |
| 1066 | } |
| 1067 | |
| 1068 | if err := os.Chown(fp, secret.secret.uid, secret.secret.gid); err != nil { |
| 1069 | _ = cleanup() |
| 1070 | return nil, nil, err |
| 1071 | } |
| 1072 | if err := os.Chmod(fp, secret.secret.mode&0o777); err != nil { |
| 1073 | _ = cleanup() |
| 1074 | return nil, nil, err |
| 1075 | } |
| 1076 | |
| 1077 | return []ctrdmount.Mount{{ |
| 1078 | Type: "bind", |
| 1079 | Source: fp, |