//go:build unix

package activator

import (
	"errors"
	"os"
	"syscall"

	"golang.org/x/sys/unix"
)

// openOwnEnvNoFollow opens a flat row's own env file (<host>.env, or its
// sibling <host>.config.env) and refuses, in the open itself, what a
// same-uid sibling (spec §7.2) could have planted at the name: a symlink,
// by O_NOFOLLOW; and a FIFO or a device, by opening O_NONBLOCK (so the open
// never waits for a writer that will not come) and then accepting only a
// regular file from fstat. There is no window between a check and the
// open. A refused link is the bare errOwnEnvSymlink and a refused non-file
// the bare errOwnEnvNotRegular: the caller names the path, once. The
// descriptor is handed back blocking: a regular file never blocks, and the
// appends and fsyncs that follow want ordinary semantics. A nested row's
// file needs none of this: instancefs.OpenBeneath does the same with
// openat2.
func openOwnEnvNoFollow(path string, flag int, perm os.FileMode) (*os.File, error) {
	f, err := os.OpenFile(path, flag|unix.O_NOFOLLOW|unix.O_NONBLOCK, perm)
	if errors.Is(err, unix.ELOOP) {
		return nil, errOwnEnvSymlink
	}
	if err != nil {
		return nil, err
	}
	st, err := f.Stat()
	if err != nil {
		f.Close()
		return nil, err
	}
	if !st.Mode().IsRegular() {
		f.Close()
		return nil, errOwnEnvNotRegular
	}
	if err := syscall.SetNonblock(int(f.Fd()), false); err != nil {
		f.Close()
		return nil, err
	}
	return f, nil
}