fix: keep the replaced binary executable during update - #29
Merged
Conversation
update stages the new binary in an os.CreateTemp file (created 0600) and copies into it with OpenFile(..., 0o755). But OpenFile ignores the mode for a file that already exists, so the temp — and, after the rename, the installed binary — stayed 0600. The binary was left non-executable and update's follow-up `setup` failed with "fork/exec ...: permission denied", leaving the service on its old inode. Force the mode with an explicit chmod after the copy. Adds a regression test that replaces an existing file and asserts the result stays 0755. Signed-off-by: Vyncint Ng <vyncint@users.noreply.github.com>
vyncint
added a commit
that referenced
this pull request
Aug 2, 2026
Fixes the v0.2.4 regression where `update` left the replaced binary non-executable (#29). Signed-off-by: Vyncint Ng <vyncint@users.noreply.github.com> Co-authored-by: Vyncint Ng <vyncint@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The bug (shipped in v0.2.4)
Running
openshell-driver-applecontainer updatedownloaded and checksum-verified the new release correctly, then left the installed binary non-executable (-rw-------), so the follow-upsetupfailed:replaceBinarystages the new binary in anos.CreateTempfile — which is created0600— and copies into it withos.OpenFile(dst, O_CREATE|O_WRONLY|O_TRUNC, 0o755).OpenFileignores the mode argument when the file already exists, so the0755was dropped, the temp stayed0600, and the atomic rename carried0600onto the installed binary. The running service kept working on its old inode, but the on-disk binary was unexecutable (and a later service restart would have failed).The fix
copyFilenow forces the mode with an explicitChmodafter the copy, so the exec bit survives regardless of the pre-existing temp file's permissions.Verification
TestReplaceBinaryKeepsExecBitreplaces an existing file and asserts the result is0755with the new content — it fails on the old code (result0600) and passes now.go test -race,golangci-lint(0 issues),make secall clean.updateleft the binary0600;chmod 0755+setuprecovered the machine to a healthy 0.2.4 with the gateway Connected. This PR prevents the recurrence; a follow-up v0.2.5 release will carry the fixedupdate.