Bump dependencies

daemon/2server-pidToPath-Readlink.go

@@ -1,4 +1,4 @@
-//go:build linux || freebsd
+//go:build linux || freebsd || solaris || illumos
 
 package daemon
 

daemon/2server.go

@@ -2,6 +2,7 @@ package daemon
 
 import (
 	"crypto/sha256"
+	"errors"
 	"io"
 	"os"
 
@@ -35,10 +36,13 @@ func (h *RCWService) EncryptRequest(decBytes []byte, reply *[]byte) error {
 }
 
 // getFileHash returns the SHA256 hash of the file at the given path.
-func getFileHash(path string) []byte {
-	file, _ := os.Open(path)
+func getFileHash(path string) ([]byte, error) {
+	file, err := os.Open(path)
+	if err != nil {
+		return nil, errors.New("unable to read path (" + path + ") for hashing: " + err.Error())
+	}
 	defer file.Close()
 	hash := sha256.New()
 	io.Copy(hash, file)
-	return hash.Sum(nil)
+	return hash.Sum(nil), nil
 }

daemon/2serverSolaris.go

@@ -0,0 +1,5 @@
+//go:build solaris || illumos
+
+package daemon
+
+const pidPathFile = "path/a.out"

daemon/2serverUNIXGeneric.go

@@ -24,12 +24,16 @@ func Start(password []byte) {
 	globalPassword = password
 
 	// register RCWService with the RPC package
-	if err := rpc.Register(&RCWService{}); err != nil {
+	err := rpc.Register(&RCWService{})
+	if err != nil {
 		log.Fatalf("Error registering RPC service: %v", err)
 	}
 
 	// store the hash of the daemon binary
-	daemonHash = getFileHash(binPath)
+	daemonHash, err = getFileHash(binPath)
+	if err != nil {
+		log.Fatalf("Error hashing daemon binary: %v", err)
+	}
 
 	// listen on the Unix domain socket
 	listener, err := net.Listen("unix", socketPath)
@@ -80,7 +84,15 @@ func handleConn(conn net.Conn, sigChan chan os.Signal) {
 
 	// check if the RPC call is coming from an identical binary and from the same user
 	callingBinPath := pidToPath(ucred.PID)
-	if ucred.UID == strconv.Itoa(os.Getuid()) && bytes.Equal(getFileHash(callingBinPath), daemonHash) {
+	callingBinHash, err := getFileHash(callingBinPath)
+	if err != nil {
+		// calling binary hash failure
+		conn.Close()
+		log.Printf("Failed to hash calling binary: PID(%d), UID(%s), Path(%s) - %v", ucred.PID, ucred.UID, callingBinPath, err)
+		sigChan <- syscall.SIGTERM // this zeroizes globalPassword and triggers os.Exit(0)
+		return                     // explicitly return to avoid race
+	}
+	if ucred.UID == strconv.Itoa(os.Getuid()) && bytes.Equal(callingBinHash, daemonHash) {
 		// valid client; hand off the connection to the RPC server
 		rpc.ServeConn(conn)
 	} else {

daemon/2serverWindows.go

@@ -29,12 +29,16 @@ func Start(password []byte) {
 	globalPassword = password
 
 	// register RCWService with the RPC package
-	if err := rpc.Register(&RCWService{}); err != nil {
+	err := rpc.Register(&RCWService{})
+	if err != nil {
 		log.Fatalf("Error registering RPC service: %v", err)
 	}
 
 	// store the hash of the daemon binary
-	daemonHash = getFileHash(binPath)
+	daemonHash, err = getFileHash(binPath)
+	if err != nil {
+		log.Fatalf("Error hashing daemon binary: %v", err)
+	}
 
 	// configure the named pipe
 	pipeConfig := &winio.PipeConfig{
@@ -104,7 +108,15 @@ func handleConn(conn net.Conn, sigChan chan os.Signal) {
 
 	// check if the RPC call is coming from an identical binary and from the same user
 	callingBinPath := pidToPath(uint32(ucred.PID))
-	if ucred.UID == user.User.Sid.String() && bytes.Equal(getFileHash(callingBinPath), daemonHash) {
+	callingBinHash, err := getFileHash(callingBinPath)
+	if err != nil {
+		// calling binary hash failure
+		conn.Close()
+		log.Printf("Failed to hash calling binary: PID(%d), UID(%s), Path(%s) - %v", ucred.PID, ucred.UID, callingBinPath, err)
+		sigChan <- os.Interrupt // this zeroizes globalPassword and triggers os.Exit(0)
+		return                  // explicitly return to avoid race
+	}
+	if ucred.UID == user.User.Sid.String() && bytes.Equal(callingBinHash, daemonHash) {
 		rpc.ServeConn(conn)
 	} else {
 		// invalid client; close the connection w/o a response,

go.mod

@@ -1,17 +1,17 @@
 module github.com/rwinkhart/rcw
 
-go 1.25.7
+go 1.27.3
 
 require (
-	github.com/Microsoft/go-winio v0.6.2
-	github.com/rwinkhart/go-boilerplate v0.3.0
-	github.com/rwinkhart/peercred-mini v0.1.4
-	golang.org/x/crypto v0.48.0
-	golang.org/x/sys v0.41.0
+	github.com/Microsoft/go-winio v0.6.4
+	github.com/rwinkhart/go-boilerplate v0.4.0
+	github.com/rwinkhart/peercred-mini v0.1.6
+	golang.org/x/crypto v0.58.0
+	golang.org/x/sys v0.49.0
 )
 
-require golang.org/x/term v0.40.0 // indirect
+require golang.org/x/term v0.47.0 // indirect
 
-replace golang.org/x/sys => github.com/rwinkhart/sys v0.41.0
+replace golang.org/x/sys => github.com/rwinkhart/sys v0.49.0
 
-replace github.com/Microsoft/go-winio => github.com/rwinkhart/go-winio v0.1.1
+replace github.com/Microsoft/go-winio => github.com/rwinkhart/go-winio v0.6.4

go.sum

@@ -1,12 +1,12 @@
-github.com/rwinkhart/go-boilerplate v0.3.0 h1:dwlm1mZya1xrATkvm2pHbTIFNb5WRjIc7A3a4Ep2aAM=
-github.com/rwinkhart/go-boilerplate v0.3.0/go.mod h1:ES13A2r9fnCVfyezwMBgY/RgA4pOIudOUXz3Jk/ikes=
-github.com/rwinkhart/go-winio v0.1.1 h1:kAJKiqneR7cUR01Wn5/doAAV4kOGTEGPug4oinXc5N4=
-github.com/rwinkhart/go-winio v0.1.1/go.mod h1:ZWa7ssZJT30CCDGJ7fk/2SBTq9BIQrrVjrcss0UW2s0=
-github.com/rwinkhart/peercred-mini v0.1.4 h1:93+phjLknvJadEd2cu/ZPPWdfRSPOwFJzDBEn4ZtWVc=
-github.com/rwinkhart/peercred-mini v0.1.4/go.mod h1:E8eApo/izzmq4nGGR+kpJ0ZLAXjofnVRMGCeVMPQ/Ik=
-github.com/rwinkhart/sys v0.41.0 h1:pHB6HphVC132UXYZ6yeOk62abqgl+pyl5ZZnsk4iUKg=
-github.com/rwinkhart/sys v0.41.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
-golang.org/x/crypto v0.48.0 h1:/VRzVqiRSggnhY7gNRxPauEQ5Drw9haKdM0jqfcCFts=
-golang.org/x/crypto v0.48.0/go.mod h1:r0kV5h3qnFPlQnBSrULhlsRfryS2pmewsg+XfMgkVos=
-golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
-golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
+github.com/rwinkhart/go-boilerplate v0.4.0 h1:GQSX1HbTpTKM5gqXjnI+F5HNP4TnffhezP47Ll5DHbk=
+github.com/rwinkhart/go-boilerplate v0.4.0/go.mod h1:BosFltJPFXXuRAbz5akfr1K0tUCClVaQDq5Qe00SXrA=
+github.com/rwinkhart/go-winio v0.6.4 h1:uWHfhZubLGQMoLLIbIdGxjsmmCGP3PLh9XaTquuq9Vg=
+github.com/rwinkhart/go-winio v0.6.4/go.mod h1:1xl5JXG4ze/m74GH6Dc4Mwxfc3VL5siRVQjIAlHH07U=
+github.com/rwinkhart/peercred-mini v0.1.6 h1:I4DXr2T1ys3gAcUjrlcaOEJDFUHcegi+citVqmuZi8w=
+github.com/rwinkhart/peercred-mini v0.1.6/go.mod h1:51AkZl3i/slo9xN77QR3cwvFznOrAD8b0gTqGTZk5LI=
+github.com/rwinkhart/sys v0.49.0 h1:0no5KhQ6ugg2kcnI82BRiXUnt/Jb7M7E5tE4KL/MBtE=
+github.com/rwinkhart/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og=
+golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54=
+golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w=
+golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM=
+golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY=

wrappers/sanityCheck.go

@@ -20,7 +20,7 @@ func GenSanityCheck(path string, password []byte, zeroizePassword bool) error {
 func RunSanityCheck(path string, password []byte) error {
 	encBytes, err := os.ReadFile(path)
 	if err != nil {
-		return errors.New("Failed to read sanity check file (" + path + ")")
+		return errors.New("unable to read sanity check file (" + path + "): " + err.Error())
 	}
 	decBytes, err := Decrypt(encBytes, password, false)
 	if err == nil {