Atomic rewrite does not preserve owner/group; running as root silently chowns files

[dolph]

Summary

rewriteFile writes content to a temp file owned by the running process and then os.Renames it over the original. This breaks ownership preservation: the new inode is owned by the user/group running find-replace. When run as root over files owned by other users (e.g. /etc/*, a checked-out source tree shared with a CI user), every rewritten file silently becomes root-owned.

Impact (Reliability/Security: Medium)

• Surprising privilege change for files the user does not "own" semantically.
• Can break tools that gate on chown/stat (web servers refusing to run with mismatched perms, package-manager file lists, etc.).

Suggested Fix

Before the final rename, os.Chown the temp file to the original file's Uid/Gid (via info.Sys().(*syscall.Stat_t) on Unix). On platforms where Chown isn't available or fails (Windows), document the limitation. Skip the chown silently if the running uid lacks CAP_CHOWN rather than failing, but record a warning.

Files

• file_handling.go:60-149 (rewriteFile)