Add runtime store writability preflight

daemon/runtime.go

@@ -64,6 +64,8 @@ type RuntimeStore struct {
 	Prefix string
 }
 
+const runtimeWriteCheckPattern = ".%s.write-check-*"
+
 func (s RuntimeStore) prefix() string {
 	if s.Prefix == "" {
 		return "daemon"
@@ -94,6 +96,32 @@ func (s RuntimeStore) prepareDir() error {
 	return nil
 }
 
+// CheckWritable verifies that the calling process can create and remove a file
+// in the runtime directory. It is an advisory preflight: it does not guarantee
+// future access or that a child process has the same permissions.
+func (s RuntimeStore) CheckWritable() error {
+	prefix, err := s.validatePrefix()
+	if err != nil {
+		return err
+	}
+	if err := s.prepareDir(); err != nil {
+		return err
+	}
+	probe, err := os.CreateTemp(s.Dir, fmt.Sprintf(runtimeWriteCheckPattern, prefix))
+	if err != nil {
+		return fmt.Errorf("create runtime write check: %w", err)
+	}
+	probePath := probe.Name()
+	if err := probe.Close(); err != nil {
+		_ = os.Remove(probePath)
+		return fmt.Errorf("close runtime write check: %w", err)
+	}
+	if err := os.Remove(probePath); err != nil {
+		return fmt.Errorf("remove runtime write check: %w", err)
+	}
+	return nil
+}
+
 // Path returns the runtime file path for pid.
 func (s RuntimeStore) Path(pid int) (string, error) {
 	prefix, err := s.validatePrefix()

daemon/runtime_internal_test.go

@@ -0,0 +1,35 @@
+package daemon
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func TestRuntimeStoreWriteCheckStaysOutsideDiscoveryNamespaces(t *testing.T) {
+	assert := assert.New(t)
+	require := require.New(t)
+
+	store := RuntimeStore{Dir: t.TempDir(), Prefix: "tool"}
+	prefix, err := store.validatePrefix()
+	require.NoError(err)
+	probe, err := os.CreateTemp(store.Dir, fmt.Sprintf(runtimeWriteCheckPattern, prefix))
+	require.NoError(err)
+	t.Cleanup(func() {
+		_ = probe.Close()
+		_ = os.Remove(probe.Name())
+	})
+
+	records, err := store.List()
+	require.NoError(err)
+	assert.Empty(records)
+	name := filepath.Base(probe.Name())
+	_, isRecord := pidFromName(prefix, name)
+	assert.False(isRecord)
+	assert.NotEqual(prefix+".lock", name)
+	assert.NotEqual(prefix+".listen.lock", name)
+}

daemon/runtime_test.go

@@ -127,3 +127,31 @@ func TestRuntimeStoreListenLockPathIsSeparateFromStartLock(t *testing.T) {
 	assert.Equal(filepath.Join(store.Dir, "kata.lock"), startLock)
 	assert.Equal(filepath.Join(store.Dir, "kata.listen.lock"), listenLock)
 }
+
+func TestRuntimeStoreCheckWritableLeavesNoFiles(t *testing.T) {
+	require := require.New(t)
+
+	dir := t.TempDir()
+	store := daemon.RuntimeStore{Dir: dir}
+
+	require.NoError(store.CheckWritable())
+	entries, err := os.ReadDir(dir)
+	require.NoError(err)
+	require.Empty(entries)
+	records, err := store.List()
+	require.NoError(err)
+	require.Empty(records)
+}
+
+func TestRuntimeStoreCheckWritableRejectsNonDirectory(t *testing.T) {
+	assert := assert.New(t)
+	require := require.New(t)
+
+	path := filepath.Join(t.TempDir(), "runtime-file")
+	require.NoError(os.WriteFile(path, []byte("not a directory"), 0o600))
+
+	err := (daemon.RuntimeStore{Dir: path}).CheckWritable()
+
+	require.Error(err)
+	assert.Contains(err.Error(), "prepare runtime dir")
+}

daemon/runtime_unix_test.go

@@ -60,6 +60,21 @@ func TestRuntimeStoreRepairsPrivateUnusableDir(t *testing.T) {
 	require.Equal(os.FileMode(0o700), info.Mode().Perm())
 }
 
+func TestRuntimeStoreCheckWritablePreservesPermissionError(t *testing.T) {
+	if os.Geteuid() == 0 {
+		t.Skip("root can write through directory mode restrictions")
+	}
+	require := require.New(t)
+
+	parent := t.TempDir()
+	require.NoError(os.Chmod(parent, 0o500))
+	t.Cleanup(func() { require.NoError(os.Chmod(parent, 0o700)) })
+
+	err := (daemon.RuntimeStore{Dir: filepath.Join(parent, "runtime")}).CheckWritable()
+
+	require.ErrorIs(err, os.ErrPermission)
+}
+
 func TestRuntimeStoreRejectsSymlinkDir(t *testing.T) {
 	require := require.New(t)