From f4282aa6fdf87cf89a3518d91d42f5bc4776af50 Mon Sep 17 00:00:00 2001 From: Michael Eischer Date: Tue, 6 Oct 2020 18:46:19 +0200 Subject: [PATCH] local: mark repository files as read-only This is intended to prevent accidental modifications of data files. Marking the files as read-only was accidentally removed in #1258. --- internal/backend/local/local.go | 3 ++- internal/backend/local/local_unix.go | 4 ++-- internal/backend/local/local_windows.go | 2 +- 3 files changed, 5 insertions(+), 4 deletions(-) diff --git a/internal/backend/local/local.go b/internal/backend/local/local.go index 675c4a08d..34ac3a20e 100644 --- a/internal/backend/local/local.go +++ b/internal/backend/local/local.go @@ -130,9 +130,10 @@ func (b *Local) Save(ctx context.Context, h restic.Handle, rd restic.RewindReade return errors.Wrap(err, "Close") } + // try to mark file as read-only to avoid accidential modifications // ignore if the operation fails as some filesystems don't allow the chmod call // e.g. exfat and network file systems with certain mount options - err = setNewFileMode(filename, backend.Modes.File) + err = setFileReadonly(filename, backend.Modes.File) if err != nil && !os.IsPermission(err) { return errors.Wrap(err, "Chmod") } diff --git a/internal/backend/local/local_unix.go b/internal/backend/local/local_unix.go index 74fb47bf4..cc99d4a0b 100644 --- a/internal/backend/local/local_unix.go +++ b/internal/backend/local/local_unix.go @@ -9,6 +9,6 @@ import ( ) // set file to readonly -func setNewFileMode(f string, mode os.FileMode) error { - return fs.Chmod(f, mode) +func setFileReadonly(f string, mode os.FileMode) error { + return fs.Chmod(f, mode&^0222) } diff --git a/internal/backend/local/local_windows.go b/internal/backend/local/local_windows.go index be8f62d96..ccf788072 100644 --- a/internal/backend/local/local_windows.go +++ b/internal/backend/local/local_windows.go @@ -7,6 +7,6 @@ import ( // We don't modify read-only on windows, // since it will make us unable to delete the file, // and this isn't common practice on this platform. -func setNewFileMode(f string, mode os.FileMode) error { +func setFileReadonly(f string, mode os.FileMode) error { return nil }