boxdd: Fix linux permission

experimental/boxdd/cmd_service_linux.go

@@ -1,8 +1,12 @@
 package main
 
 import (
+	"os"
 	"os/exec"
+	"path/filepath"
+	"strconv"
 	"strings"
+	"syscall"
 
 	"github.com/sagernet/sing-box/log"
 	E "github.com/sagernet/sing/common/exceptions"
@@ -27,8 +31,65 @@ var commandServiceRestart = &cobra.Command{
 	},
 }
 
+var commandServiceSetInsecureMode = &cobra.Command{
+	Use:   "set-insecure-mode <enabled>",
+	Short: "Set whether configurations may use privileges unrelated to networking",
+	Args:  cobra.ExactArgs(1),
+	Run: func(command *cobra.Command, args []string) {
+		err := serviceSetInsecureMode(args[0])
+		if err != nil {
+			log.Fatal(E.Cause(err, "set insecure mode"))
+		}
+	},
+}
+
 func addPlatformServiceCommands() {
 	commandService.AddCommand(commandServiceRestart)
+	commandService.AddCommand(commandServiceSetInsecureMode)
+}
+
+func serviceSetInsecureMode(value string) error {
+	enabled, err := strconv.ParseBool(value)
+	if err != nil {
+		return E.Cause(err, "parse value")
+	}
+	if os.Geteuid() != 0 {
+		return E.New("setting insecure mode requires an elevated process")
+	}
+	directory, err := filepath.Abs(commandServiceFlagWorkingDirectory)
+	if err != nil {
+		return E.Cause(err, "resolve working directory")
+	}
+	err = validateProtectedLinuxDirectory(directory)
+	if err != nil {
+		return E.Cause(err, "validate working directory")
+	}
+	return saveSecuritySettings(directory, securitySettings{InsecureModeEnabled: enabled})
+}
+
+func validateProtectedLinuxDirectory(directory string) error {
+	currentPath := directory
+	for {
+		info, err := os.Lstat(currentPath)
+		if err != nil {
+			return err
+		}
+		if !info.IsDir() || info.Mode()&os.ModeSymlink != 0 {
+			return E.New("protected path is not a directory: ", currentPath)
+		}
+		fileStatus, loaded := info.Sys().(*syscall.Stat_t)
+		if !loaded || fileStatus.Uid != 0 {
+			return E.New("protected path is not owned by root: ", currentPath)
+		}
+		if info.Mode().Perm()&0o022 != 0 {
+			return E.New("protected path is writable by non-root users: ", currentPath)
+		}
+		parentPath := filepath.Dir(currentPath)
+		if parentPath == currentPath {
+			return nil
+		}
+		currentPath = parentPath
+	}
 }
 
 func runSystemctl(arguments ...string) error {