fix: fail closed on authorization setup failure

src/server/server.c

@@ -38,7 +38,13 @@ static bool __attribute__((unused)) configure_authorization(const char* root) {
     authorized_root = NULL;
     return false;
   }
-  file_set_authorized_root(authorized_root_fd, authorized_root);
+  if (!file_set_authorized_root(authorized_root_fd, authorized_root)) {
+    close(authorized_root_fd);
+    authorized_root_fd = -1;
+    free(authorized_root);
+    authorized_root = NULL;
+    return false;
+  }
   utils_set_authorized_root_fd(authorized_root_fd);
   return true;
 }

src/shared/file.c

@@ -154,8 +154,8 @@ bool file_send_single_calls(File* file, int file_descriptor, bool use_metadata,
   return true;
 }
 
-void file_set_authorized_root(int fd, const char* canonical_path) {
+bool file_set_authorized_root(int fd, const char* canonical_path) {
-  file_store_set_authorized_root(fd, canonical_path);
+  return file_store_set_authorized_root(fd, canonical_path);
 }
 
 static bool path_is_within_root(const char* root, const char* path) {

src/shared/file.h

@@ -38,7 +38,7 @@ void file_metadata_destroy(void* metadata);
 bool to_disk(const char* path, const void* data, unsigned long long data_size, bool inplace,
              bool sparse);
 bool file_save_to_disk(const char* root_directory, const File* file, const Config* config);
-void file_set_authorized_root(int fd, const char* canonical_path);
+bool file_set_authorized_root(int fd, const char* canonical_path);
 File* receive_incremental_check(int fd, const Config* config, bool* skipped);
 int receive_manifest(int fd, const Config* config, int* next_status);
 

src/shared/file_store.c

@@ -20,10 +20,14 @@ static bool path_is_within_root(const char* root, const char* path) {
          (path[root_length] == '\0' || path[root_length] == '/');
 }
 
-void file_store_set_authorized_root(int fd, const char* canonical_path) {
+bool file_store_set_authorized_root(int fd, const char* canonical_path) {
-  authorized_root_fd = fd;
+  char* new_path = canonical_path ? str_dup(canonical_path) : NULL;
+  if (canonical_path && !new_path)
+    return false;
   free(authorized_root_path);
-  authorized_root_path = canonical_path ? str_dup(canonical_path) : NULL;
+  authorized_root_path = new_path;
+  authorized_root_fd = fd;
+  return true;
 }
 
 int file_store_open_secure_parent(const char* path, char** leaf_out) {

src/shared/file_store.h

@@ -4,7 +4,7 @@
 #include "file.h"
 #include <stdbool.h>
 
-void file_store_set_authorized_root(int fd, const char* canonical_path);
+bool file_store_set_authorized_root(int fd, const char* canonical_path);
 int file_store_open_secure_parent(const char* path, char** leaf_out);
 bool file_store_rename_secure(const char* old_path, const char* new_path);
 bool file_store_write_secure(const char* path, const void* data, unsigned long long data_size,