bastion 0.55.3

client-go/runguard_darwin.go

@@ -5,11 +5,14 @@ package main
 import (
 	"fmt"
 	"os"
+	"sync/atomic"
 )
 
 // runGuardFile holds the run lock for the life of the process; the kernel
-// releases it when the process ends.
-var runGuardFile *os.File
+// releases it when the process ends. It is a package-level holder so the
+// handle is never collected (a collected *os.File is closed, which would
+// release the lock while we are still serving).
+var runGuardFile atomic.Pointer[os.File]
 
 // guardSingleRun on macOS: the rule is guardRunBesideService (runlock_unix.go).
 // The launchd daemon takes the lock first, so an administrator's `run` beside
@@ -19,7 +22,7 @@ func guardSingleRun() error {
 	if err != nil {
 		return err
 	}
-	runGuardFile = f
+	runGuardFile.Store(f)
 	// The daemon, holding the lock, keeps its log in bounds. launchd has no
 	// size limit of its own for it.
 	if systemService.installed && processIsRoot() {