cockpit: support setting owner/group in fsreplace1

doc/protocol.md

@@ -1100,6 +1100,14 @@ The following options can be specified in the "open" control message:
    you don't set this field, the actual tag will not be checked.  To
    express that you expect the file to not exist, use "-" as the tag.
 
+* "uid": The expected uid of the file.  If set, fsreplace1 chowns the
+  file to the given uid, and optionally gid if set.  This requires
+  superuser privileges to be available
+
+* "gid": The expected gid of the file.  If set, fsreplace chowns the
+  file to the given gid if the uid is also set.  This requires
+  superuser privileges to be available
+
 You should write the new content to the channel as one or more
 messages.  To indicate the end of the content, send a "done" message.
 

src/cockpit/channels/filesystem.py

@@ -168,10 +168,18 @@ def delete(self, path: str, tag: 'str | None') -> str:
             os.unlink(path)
         return '-'
 
-    async def set_contents(self, path: str, tag: 'str | None', data: 'bytes | None', size: 'int | None') -> str:
+    async def set_contents(self, path: str, tag: 'str | None', data: 'bytes | None', size: 'int | None',
+                           uid: 'int | None', gid: 'int | None') -> str:
         dirname, basename = os.path.split(path)
         tmpname: str | None
         fd, tmpname = tempfile.mkstemp(dir=dirname, prefix=f'.{basename}-')
+
+        def chown_if_required(fd: 'int'):
+            if uid is not None and gid is not None:
+                os.fchown(fd, uid, gid)
+            elif uid is not None:
+                os.fchown(fd, uid, uid)
+
         try:
             if size is not None:
                 logger.debug('fallocate(%s.tmp, %d)', path, size)
@@ -195,12 +203,14 @@ async def set_contents(self, path: str, tag: 'str | None', data: 'bytes | None',
                 # no preconditions about what currently exists or not
                 # calculate the file mode from the umask
                 os.fchmod(fd, 0o666 & ~my_umask())
+                chown_if_required(fd)
                 os.rename(tmpname, path)
                 tmpname = None
 
             elif tag == '-':
                 # the file must not exist.  file mode from umask.
                 os.fchmod(fd, 0o666 & ~my_umask())
+                chown_if_required(fd)
                 os.link(tmpname, path)  # will fail if file exists
 
             else:
@@ -225,22 +235,27 @@ async def run(self, options: JsonObject) -> JsonObject:
         path = get_str(options, 'path')
         size = get_int(options, 'size', None)
         tag = get_str(options, 'tag', None)
+        uid = get_int(options, 'owner', None)
+        gid = get_int(options, 'group', None)
+
+        if gid is not None and uid is None:
+            raise ChannelError('cannot provide a gid without a uid')
 
         try:
             # In the `size` case, .set_contents() sends the ready only after
             # it knows that the allocate was successful.  In the case without
             # `size`, we need to send the ready() up front in order to
             # receive the first frame and decide if we're creating or deleting.
             if size is not None:
-                tag = await self.set_contents(path, tag, b'', size)
+                tag = await self.set_contents(path, tag, b'', size, uid, gid)
             else:
                 self.ready()
                 data = await self.read()
                 # if we get EOF right away, that's a request to delete
                 if data is None:
                     tag = self.delete(path, tag)
                 else:
-                    tag = await self.set_contents(path, tag, data, None)
+                    tag = await self.set_contents(path, tag, data, None, uid, gid)
 
             self.done()
             return {'tag': tag}