Setuid/setgid/sticky bits are silently stripped from rewritten files

[dolph]

Summary

rewriteFile calls os.Chmod(tmpName, mode.Perm()) to restore the original mode, but Mode.Perm() only retains the low 9 bits (rwxrwxrwx). The setuid (S_ISUID), setgid (S_ISGID), and sticky (S_ISVTX) bits are discarded.

After rename, those bits are not present on the destination inode either (Linux strips them on rename across uids).

Impact (Security: Low/Medium)

• Setuid binaries rewritten by find-replace silently lose their setuid bit. If a user mistakenly runs find-replace over /usr/local/bin, scripts that depend on setuid stop working.
• Setgid directories — used to enforce group ownership inheritance — lose that bit if accidentally renamed/rewritten through this path. (Directories are not rewritten, but if a setgid bit is on a file, it would be stripped.)

Suggested Fix

Detect the special bits before rewriting and either:

• refuse to rewrite the file (safer default) and record an error, or
• preserve all of Mode() & (Perm | SetUID | SetGID | Sticky) on the temp file, accepting that on Linux the bits will still be stripped on rename when uid changes (so a chown to the original uid is also required, see Atomic rewrite does not preserve owner/group; running as root silently chowns files #17).

Files

• file_handling.go:60-149 (rewriteFile)