From bc8f50dbdadfcd91991992f5e993ba67660fc55b Mon Sep 17 00:00:00 2001 From: "Theodor S. Midtlien" Date: Tue, 15 Sep 2026 15:34:41 +0200 Subject: [PATCH] Move known check to inside stamp owner --- client/internal/profilemanager/service.go | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/client/internal/profilemanager/service.go b/client/internal/profilemanager/service.go index aa0e7f53d..4d4844f1a 100644 --- a/client/internal/profilemanager/service.go +++ b/client/internal/profilemanager/service.go @@ -618,7 +618,7 @@ var ( func (s *ServiceManager) claimLegacyProfiles(profiles []Profile, id ipcauth.Identity) { // A privileged caller reaches every profile already and an internal load // has no caller, so neither should leave an owner behind. - if !id.Known() || ipcauth.IsPrivilegedCaller(id) { + if ipcauth.IsPrivilegedCaller(id) { return } @@ -890,6 +890,9 @@ func readProfileOwners(path string) ([]ipcauth.Principal, error) { // StampOwner records a caller as a profile's owner, replacing whoever is // recorded now. func StampOwner(path string, owner ipcauth.Identity) error { + if !owner.Known() { + return fmt.Errorf("cannot stamp owner that is verified by the kernel") + } return stampPrincipal(path, ipcauth.OwnerPrincipalForIdentity(owner)) }