Commit 6171338

chore: ensure robust daemon

This is mostly for posterity: we setup the daemon process to chdir to "/" and
set the umask to 0. This ensures the daemon is not on a dir that could be
unmounted and then the unmount would fail (like a usb drive) and we reset the
umask so the daemon doesn't unherit an unpredictable umask.

 1@@ -161,6 +161,20 @@ pub fn daemonize(sesh_name: []const u8, cmd: Cmd, keep_fds_open: []i32) !PtyInfo
 2     // becomes the session leader and detaches process from its controlling terminal
 3     _ = try lib_posix.setsid();
 4 
 5+    // If the daemon was launched from a mounted filesystem (e.g., a USB drive
 6+    // at /mnt/usb), keeping that directory as the working directory pins the
 7+    // mount which means it can't be unmounted while the daemon holds it.
 8+    // chdir("/") moves to the root filesystem, which is never unmounted.
 9+    const dir_path_c = try lib_posix.toPosixPath("/");
10+    try lib_posix.chdirZ(&dir_path_c);
11+
12+    // The parent may have had a restrictive umask (e.g., 0077) that would
13+    // prevent the daemon from creating files with the intended permissions.
14+    // Setting umask(0) lets the daemon explicitly control permissions via
15+    // open()/creat() mode arguments, rather than inheriting an unpredictable
16+    // mask.
17+    _ = std.c.umask(0); // requires libc on linux
18+
19     // Redirect stdin/stdout/stderr to /dev/null. The daemon
20     // communicates via its unix socket, not stdio. Without
21     // this, any pipe on FDs 0-2 (e.g. from bats' `run`

 1@@ -1260,8 +1260,35 @@ const unexpected_error_tracing = builtin.mode == .Debug and switch (builtin.zig_
 2     else => false,
 3 };
 4 
 5+const ChangeCurDirError = error{
 6+    AccessDenied,
 7+    FileSystem,
 8+    SymLinkLoop,
 9+    NameTooLong,
10+    FileNotFound,
11+    SystemResources,
12+    NotDir,
13+    BadPathName,
14+} || UnexpectedError;
15+
16+pub fn chdirZ(dir_path: [*:0]const u8) ChangeCurDirError!void {
17+    switch (errno(system.chdir(dir_path))) {
18+        .SUCCESS => return,
19+        .ACCES => return error.AccessDenied,
20+        .FAULT => unreachable,
21+        .IO => return error.FileSystem,
22+        .LOOP => return error.SymLinkLoop,
23+        .NAMETOOLONG => return error.NameTooLong,
24+        .NOENT => return error.FileNotFound,
25+        .NOMEM => return error.SystemResources,
26+        .NOTDIR => return error.NotDir,
27+        .ILSEQ => |err| return unexpectedErrno(err),
28+        else => |err| return unexpectedErrno(err),
29+    }
30+}
31+
32 /// Used to convert a slice to a null terminated slice on the stack.
33-fn toPosixPath(file_path: []const u8) error{NameTooLong}![PATH_MAX - 1:0]u8 {
34+pub fn toPosixPath(file_path: []const u8) error{NameTooLong}![PATH_MAX - 1:0]u8 {
35     if (std.debug.runtime_safety) assert(mem.indexOfScalar(u8, file_path, 0) == null);
36     var path_with_null: [PATH_MAX - 1:0]u8 = undefined;
37     // >= rather than > to make room for the null byte