fix: improve database file handling

agent/app/service/snapshot_recover.go

@@ -494,6 +494,9 @@ func restartCompose(composePath string, itemHelper *snapRecoverHelper) error {
 func recoverDBData(src string, itemHelper *snapRecoverHelper) error {
 	itemHelper.Task.Log("---------------------- 11 / 11 ----------------------")
 	itemHelper.Task.LogStart(i18n.GetMsgByKey("RecoverDBData"))
+	if err := os.Chmod(src, 0700); err != nil {
+		return err
+	}
 	dbDir := path.Join(global.Dir.DataDir, "db")
 	if err := os.RemoveAll(dbDir); err != nil {
 		itemHelper.Task.LogWithStatus(i18n.GetMsgByKey("RecoverDBData"), err)

agent/app/service/snapshot_rollback.go

@@ -106,6 +106,9 @@ func (u *SnapshotService) SnapshotRollback(req dto.SnapshotRecover) error {
 		taskItem.AddSubTask(
 			i18n.GetWithName("SnapCopy", global.Dir.BaseDir),
 			func(t *task.Task) error {
+				if err := os.Chmod(path.Join(rootDir, "1panel/db"), 0700); err != nil {
+					return err
+				}
 				return FileOp.CopyDir(path.Join(rootDir, "1panel"), global.Dir.BaseDir)
 			},
 			nil,

agent/app/service/website.go

@@ -526,8 +526,10 @@ func (w WebsiteService) CreateWebsite(create request.WebsiteCreate) (err error)
 		website.SiteDir = create.SiteDir
 	}
 
-	createdFiles := &websiteCreateFiles{}
 	configNginx := func(t *task.Task) error {
+		if err = configDefaultNginx(website, domains, appInstall, runtime, create.StreamConfig, initialSSL); err != nil {
+			return err
+		}
 		if create.Type == constant.Static && create.TemplateOutputID > 0 {
 			templateOutput, err := websiteTemplateOutputRepo.GetFirst(repo.WithByID(create.TemplateOutputID))
 			if err != nil {
@@ -539,15 +541,12 @@ func (w WebsiteService) CreateWebsite(create request.WebsiteCreate) (err error)
 			if _, err := os.Stat(templateOutput.OutputPath); err != nil {
 				return buserr.New("ErrFileNotFound")
 			}
-			if err := createdFiles.copyTemplate(templateOutput.OutputPath, GetSitePath(*website, SiteIndexDir)); err != nil {
+			if err := copyDir(templateOutput.OutputPath, GetSitePath(*website, SiteIndexDir)); err != nil {
 				return err
 			}
 		}
-		if err = configDefaultNginx(website, domains, appInstall, runtime, create.StreamConfig, initialSSL, createdFiles); err != nil {
-			return err
-		}
 		if website.Type != constant.Stream {
-			if err = createWafConfig(website, domains, createdFiles); err != nil {
+			if err = createWafConfig(website, domains); err != nil {
 				return err
 			}
 			if create.Type == constant.Runtime {
@@ -556,9 +555,7 @@ func (w WebsiteService) CreateWebsite(create request.WebsiteCreate) (err error)
 					return err
 				}
 				if runtime.Type == constant.RuntimePHP && runtime.Resource == constant.ResourceAppstore {
-					if err := createdFiles.write(path.Join(GetSitePath(*website, SiteIndexDir), ".user.ini"), []byte(fmt.Sprintf("open_basedir=/www/sites/%s/index:/tmp/", website.Alias)), 0644, true); err != nil {
-						return err
-					}
+					createOpenBasedirConfig(website)
 				}
 			}
 		}
@@ -578,19 +575,12 @@ func (w WebsiteService) CreateWebsite(create request.WebsiteCreate) (err error)
 			}
 		}
 
-		if err := tx.Commit().Error; err != nil {
-			return err
-		}
+		tx.Commit()
 		return nil
 	}
 
 	deleteWebsite := func(t *task.Task) {
-		if rollbackErr := createdFiles.rollback(); rollbackErr != nil {
-			t.Log(fmt.Sprintf("website file rollback: %v", rollbackErr))
-		}
-		if reloadErr := opNginx(nginxInstall.ContainerName, constant.NginxReload); reloadErr != nil {
-			t.Log(fmt.Sprintf("reload OpenResty after rollback: %v", reloadErr))
-		}
+		_ = deleteWebsiteFolder(website)
 	}
 
 	createTask.AddSubTask(i18n.GetMsgByKey("ConfigOpenresty"), configNginx, deleteWebsite)

agent/app/service/website_utils.go

@@ -1,7 +1,6 @@
 package service
 
 import (
-	"bytes"
 	"context"
 	"crypto/x509"
 	"encoding/json"
@@ -15,7 +14,6 @@ import (
 	"sort"
 	"strconv"
 	"strings"
-	"sync"
 	"syscall"
 	"time"
 
@@ -126,255 +124,7 @@ func applyLocationProxyPass(location *components.Location, proxyPass string, sni
 	location.UpdateDirective("proxy_ssl_name", []string{sslName})
 }
 
-// websiteCreateFiles owns only paths actually created by this attempt.
-// Never recursively remove a reused directory (or a newly populated one).
-type websiteCreateFiles struct {
-	mu         sync.Mutex
-	entries    []websiteCreatedPath
-	rolledBack bool
-	restores   []func() error
-}
-type websiteCreatedPath struct {
-	path string
-	info os.FileInfo
-}
-
-func (f *websiteCreateFiles) mkdir(name string) error {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	if f.rolledBack {
-		return fmt.Errorf("website creation already rolled back")
-	}
-	return f.mkdirLocked(filepath.Clean(name))
-}
-
-func (f *websiteCreateFiles) mkdirLocked(name string) error {
-	info, err := os.Lstat(name)
-	if err == nil {
-		if !info.IsDir() {
-			return fmt.Errorf("website path is not a directory: %s", name)
-		}
-		return nil
-	}
-	if !os.IsNotExist(err) {
-		return err
-	}
-	if err = f.mkdirLocked(filepath.Dir(name)); err != nil {
-		return err
-	}
-	if err = os.Mkdir(name, constant.DirPerm); err != nil {
-		if os.IsExist(err) {
-			return f.mkdirLocked(name)
-		}
-		return err
-	}
-	info, err = os.Lstat(name)
-	if err != nil {
-		return err
-	}
-	f.entries = append(f.entries, websiteCreatedPath{name, info})
-	return nil
-}
-
-// preserveExisting is for user content and logs; generated configuration must
-// fail on collision. Exclusive creation also protects against concurrent writes.
-func (f *websiteCreateFiles) write(name string, data []byte, mode os.FileMode, preserveExisting bool) error {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	if f.rolledBack {
-		return fmt.Errorf("website creation already rolled back")
-	}
-	if err := f.mkdirLocked(filepath.Dir(name)); err != nil {
-		return err
-	}
-	file, err := os.OpenFile(name, os.O_WRONLY|os.O_CREATE|os.O_EXCL, mode)
-	if os.IsExist(err) && preserveExisting {
-		info, statErr := os.Lstat(name)
-		if statErr != nil {
-			return statErr
-		}
-		if !info.Mode().IsRegular() {
-			return fmt.Errorf("website path is not a regular file: %s", name)
-		}
-		return nil
-	}
-	if err != nil {
-		return fmt.Errorf("create website file %s: %w", name, err)
-	}
-	info, err := file.Stat()
-	if err != nil {
-		_ = file.Close()
-		return err
-	}
-	f.entries = append(f.entries, websiteCreatedPath{name, info})
-	_, err = file.Write(data)
-	closeErr := file.Close()
-	if err != nil {
-		return err
-	}
-	return closeErr
-}
-
-func (f *websiteCreateFiles) rollback() error {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	f.rolledBack = true
-	var firstErr error
-	for i := len(f.restores) - 1; i >= 0; i-- {
-		if err := f.restores[i](); err != nil && firstErr == nil {
-			firstErr = err
-		}
-	}
-	f.restores = nil
-	for i := len(f.entries) - 1; i >= 0; i-- {
-		entry := f.entries[i]
-		info, err := os.Lstat(entry.path)
-		if os.IsNotExist(err) {
-			continue
-		}
-		if err != nil {
-			if firstErr == nil {
-				firstErr = err
-			}
-			continue
-		}
-		if !os.SameFile(entry.info, info) {
-			continue
-		}
-		// os.Remove refuses non-empty directories, preserving untracked content.
-		if err = os.Remove(entry.path); err != nil && firstErr == nil {
-			firstErr = err
-		}
-	}
-	return firstErr
-}
-
-func (f *websiteCreateFiles) copyTemplate(src, dst string) error {
-	// Check the entire template before copying any files. Reject symlinks and
-	// collisions rather than truncating existing content.
-	err := filepath.Walk(src, func(name string, info os.FileInfo, err error) error {
-		if err != nil {
-			return err
-		}
-		rel, err := filepath.Rel(src, name)
-		if err != nil {
-			return err
-		}
-		target := filepath.Join(dst, rel)
-		if !info.IsDir() && !info.Mode().IsRegular() {
-			return fmt.Errorf("unsupported template file: %s", name)
-		}
-		existing, err := os.Lstat(target)
-		if os.IsNotExist(err) {
-			return nil
-		}
-		if err != nil {
-			return err
-		}
-		if info.IsDir() && existing.IsDir() {
-			return nil
-		}
-		return fmt.Errorf("website template path already exists: %s", target)
-	})
-	if err != nil {
-		return err
-	}
-	return filepath.Walk(src, func(name string, info os.FileInfo, err error) error {
-		if err != nil {
-			return err
-		}
-		rel, err := filepath.Rel(src, name)
-		if err != nil {
-			return err
-		}
-		target := filepath.Join(dst, rel)
-		if info.IsDir() {
-			return f.mkdir(target)
-		}
-		if !info.Mode().IsRegular() {
-			return fmt.Errorf("unsupported template file: %s", name)
-		}
-		data, err := os.ReadFile(name)
-		if err != nil {
-			return err
-		}
-		return f.write(target, data, constant.FilePerm, false)
-	})
-}
-
-// Only change ownership on files created by this attempt, never recursively on
-// an existing document root.
-func (f *websiteCreateFiles) chownNew(root string) error {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	if f.rolledBack {
-		return fmt.Errorf("website creation already rolled back")
-	}
-	for _, entry := range f.entries {
-		rel, err := filepath.Rel(root, entry.path)
-		if err != nil {
-			return err
-		}
-		if rel == ".." || filepath.IsAbs(rel) || (len(rel) > 3 && rel[:3] == "../") {
-			continue
-		}
-		info, err := os.Lstat(entry.path)
-		if err != nil {
-			return err
-		}
-		if !os.SameFile(entry.info, info) {
-			continue
-		}
-		if err := os.Chown(entry.path, constant.WebsiteUID, constant.WebsiteGID); err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
-// Shared WAF metadata is restored only while it still contains our exact write.
-// Never restore a stale snapshot over changes made by another operation.
-func (f *websiteCreateFiles) replaceShared(name string, before, after []byte) error {
-	f.mu.Lock()
-	defer f.mu.Unlock()
-	if f.rolledBack {
-		return fmt.Errorf("website creation already rolled back")
-	}
-	info, err := os.Lstat(name)
-	if err != nil {
-		return err
-	}
-	if !info.Mode().IsRegular() {
-		return fmt.Errorf("website config is not a regular file: %s", name)
-	}
-	current, err := os.ReadFile(name)
-	if err != nil {
-		return err
-	}
-	if !bytes.Equal(current, before) {
-		return fmt.Errorf("website config changed during creation: %s", name)
-	}
-	f.restores = append(f.restores, func() error {
-		now, err := os.Lstat(name)
-		if err != nil {
-			return err
-		}
-		if !os.SameFile(info, now) {
-			return fmt.Errorf("website config replaced; skipping rollback: %s", name)
-		}
-		data, err := os.ReadFile(name)
-		if err != nil {
-			return err
-		}
-		if !bytes.Equal(data, after) {
-			return fmt.Errorf("website config changed; skipping rollback: %s", name)
-		}
-		return os.WriteFile(name, before, info.Mode().Perm())
-	})
-	return os.WriteFile(name, after, info.Mode().Perm())
-}
-
-func createIndexFile(website *model.Website, runtime *model.Runtime, created *websiteCreateFiles) error {
+func createIndexFile(website *model.Website, runtime *model.Runtime) error {
 	var (
 		indexPath      string
 		indexContent   string
@@ -395,23 +145,49 @@ func createIndexFile(website *model.Website, runtime *model.Runtime, created *we
 		}
 	}
 
-	if err := created.write(indexPath, []byte(indexContent), constant.FilePerm, true); err != nil {
-		return err
+	fileOp := files.NewFileOp()
+	if !fileOp.Stat(indexFolder) {
+		if err := fileOp.CreateDir(indexFolder, constant.DirPerm); err != nil {
+			return err
+		}
 	}
-	html404, _ := websiteService.GetDefaultHtml("404")
-	if err := created.write(path.Join(indexFolder, "404.html"), []byte(html404.Content), constant.FilePerm, true); err != nil {
-		return err
+	if !fileOp.Stat(indexPath) {
+		if err := fileOp.CreateFile(indexPath); err != nil {
+			return err
+		}
 	}
 	if website.Type == constant.Runtime && runtime.Resource == constant.ResourceAppstore {
-		return created.chownNew(indexFolder)
+		if err := chownRootDir(indexFolder); err != nil {
+			return err
+		}
+	}
+	if err := fileOp.WriteFile(indexPath, strings.NewReader(indexContent), constant.DirPerm); err != nil {
+		return err
+	}
+
+	html404, _ := websiteService.GetDefaultHtml("404")
+	path404 := path.Join(indexFolder, "404.html")
+	if err := fileOp.WriteFile(path404, strings.NewReader(html404.Content), constant.DirPerm); err != nil {
+		return err
 	}
 
 	return nil
 }
 
-func createProxyFile(website *model.Website, created *websiteCreateFiles) error {
+func createProxyFile(website *model.Website) error {
 	proxyFolder := GetSitePath(*website, SiteProxyDir)
 	filePath := path.Join(proxyFolder, "root.conf")
+	fileOp := files.NewFileOp()
+	if !fileOp.Stat(proxyFolder) {
+		if err := fileOp.CreateDir(proxyFolder, constant.DirPerm); err != nil {
+			return err
+		}
+	}
+	if !fileOp.Stat(filePath) {
+		if err := fileOp.CreateFile(filePath); err != nil {
+			return err
+		}
+	}
 	config, err := parser.NewStringParser(string(nginx_conf.Proxy)).Parse()
 	if err != nil {
 		return err
@@ -425,40 +201,57 @@ func createProxyFile(website *model.Website, created *websiteCreateFiles) error
 	location.ChangePath("^~", "/")
 	applyLocationProxyPass(location, website.Proxy, nil, "")
 	location.UpdateDirective("proxy_set_header", []string{"Host", "$host"})
-	if err := created.write(filePath, []byte(nginx.DumpConfig(config, nginx.IndentedStyle)), constant.FilePerm, false); err != nil {
+	if err := nginx.WriteConfig(config, nginx.IndentedStyle); err != nil {
 		return buserr.WithErr("ErrUpdateBuWebsite", err)
 	}
 	return nil
 }
 
-func createWebsiteFolder(website *model.Website, runtime *model.Runtime, created *websiteCreateFiles) error {
+func createWebsiteFolder(website *model.Website, runtime *model.Runtime) error {
 	siteFolder := GetSiteDir(website.Alias)
-	dirs := []string{siteFolder, path.Join(siteFolder, "log")}
-	if website.Type != constant.Stream {
-		dirs = append(dirs, path.Join(siteFolder, "index"), path.Join(siteFolder, "ssl"))
-	}
-	for _, dir := range dirs {
-		if err := created.mkdir(dir); err != nil {
+	fileOp := files.NewFileOp()
+	if !fileOp.Stat(siteFolder) {
+		if err := fileOp.CreateDir(siteFolder, constant.DirPerm); err != nil {
 			return err
 		}
-	}
-	for _, name := range []string{"access.log", "error.log"} {
-		if err := created.write(path.Join(siteFolder, "log", name), nil, constant.FilePerm, true); err != nil {
+		if err := fileOp.CreateDir(path.Join(siteFolder, "log"), constant.DirPerm); err != nil {
 			return err
 		}
-	}
-	if website.Type == constant.Runtime && runtime.Type == constant.RuntimePHP && runtime.Resource == constant.ResourceLocal {
-		if err := created.write(path.Join(siteFolder, "php-pool", "php-fpm.sock"), nil, constant.FilePerm, true); err != nil {
+		if err := fileOp.CreateFile(path.Join(siteFolder, "log", "access.log")); err != nil {
 			return err
 		}
-	}
-	if website.Type == constant.Static || (website.Type == constant.Runtime && runtime.Type == constant.RuntimePHP) {
-		if err := createIndexFile(website, runtime, created); err != nil {
+		if err := fileOp.CreateFile(path.Join(siteFolder, "log", "error.log")); err != nil {
 			return err
 		}
-	}
-	if website.Type == constant.Proxy {
-		return createProxyFile(website, created)
+		if website.Type != constant.Stream {
+			if err := fileOp.CreateDir(path.Join(siteFolder, "index"), constant.DirPerm); err != nil {
+				return err
+			}
+			if err := fileOp.CreateDir(path.Join(siteFolder, "ssl"), constant.DirPerm); err != nil {
+				return err
+			}
+		}
+		if website.Type == constant.Runtime {
+			if runtime.Type == constant.RuntimePHP && runtime.Resource == constant.ResourceLocal {
+				phpPoolDir := path.Join(siteFolder, "php-pool")
+				if err := fileOp.CreateDir(phpPoolDir, constant.DirPerm); err != nil {
+					return err
+				}
+				if err := fileOp.CreateFile(path.Join(phpPoolDir, "php-fpm.sock")); err != nil {
+					return err
+				}
+			}
+		}
+		if website.Type == constant.Static || (website.Type == constant.Runtime && runtime.Type == constant.RuntimePHP) {
+			if err := createIndexFile(website, runtime); err != nil {
+				return err
+			}
+		}
+		if website.Type == constant.Proxy {
+			if err := createProxyFile(website); err != nil {
+				return err
+			}
+		}
 	}
 	return nil
 }
@@ -468,12 +261,12 @@ type websiteInitialSSL struct {
 	request     request.WebsiteHTTPSOp
 }
 
-func configDefaultNginx(website *model.Website, domains []model.WebsiteDomain, appInstall *model.AppInstall, runtime *model.Runtime, streamConfig request.StreamConfig, initialSSL *websiteInitialSSL, created *websiteCreateFiles) error {
+func configDefaultNginx(website *model.Website, domains []model.WebsiteDomain, appInstall *model.AppInstall, runtime *model.Runtime, streamConfig request.StreamConfig, initialSSL *websiteInitialSSL) error {
 	nginxInstall, err := getAppInstallByKey(constant.AppOpenresty)
 	if err != nil {
 		return err
 	}
-	if err = createWebsiteFolder(website, runtime, created); err != nil {
+	if err = createWebsiteFolder(website, runtime); err != nil {
 		return err
 	}
 	var (
@@ -541,10 +334,7 @@ func configDefaultNginx(website *model.Website, domains []model.WebsiteDomain, a
 		if initialSSL != nil {
 			plan := buildWebsiteTLSPlan(domains, nginxInstall.HttpPort, nginxInstall.HttpsPort)
 			applyWebsiteSSLConfig(server, *website, plan, initialSSL.request)
-			if err = created.write(path.Join(GetSitePath(*website, SiteSSLDir), "fullchain.pem"), []byte(initialSSL.certificate.Pem), constant.FilePerm, false); err != nil {
-				return err
-			}
-			if err = created.write(path.Join(GetSitePath(*website, SiteSSLDir), "privkey.pem"), []byte(initialSSL.certificate.PrivateKey), 0600, false); err != nil {
+			if err = createPemFile(*website, initialSSL.certificate); err != nil {
 				return err
 			}
 		}
@@ -614,7 +404,7 @@ func configDefaultNginx(website *model.Website, domains []model.WebsiteDomain, a
 		}
 	}
 	config.FilePath = configPath
-	if err = created.write(configPath, []byte(nginx.DumpConfig(config, nginx.IndentedStyle)), constant.FilePerm, false); err != nil {
+	if err = nginx.WriteConfig(config, nginx.IndentedStyle); err != nil {
 		return err
 	}
 	if err = opNginx(nginxInstall.ContainerName, constant.NginxCheck); err != nil {
@@ -709,7 +499,7 @@ func createOpenBasedirConfig(website *model.Website) {
 	_ = fileOp.SaveFile(userIniPath, fmt.Sprintf("open_basedir=/www/sites/%s/index:/tmp/", website.Alias), 0644)
 }
 
-func createWafConfig(website *model.Website, domains []model.WebsiteDomain, created *websiteCreateFiles) error {
+func createWafConfig(website *model.Website, domains []model.WebsiteDomain) error {
 	nginxInstall, err := getAppInstallByKey(constant.AppOpenresty)
 	if err != nil {
 		return err
@@ -730,11 +520,6 @@ func createWafConfig(website *model.Website, domains []model.WebsiteDomain, crea
 			return err
 		}
 	}
-	for _, existing := range websitesArray {
-		if existing.Key == website.Alias {
-			return fmt.Errorf("WAF website already exists: %s", website.Alias)
-		}
-	}
 	wafWebsite := request.WafWebsite{
 		Key:     website.Alias,
 		Domains: make([]string, 0),
@@ -750,6 +535,9 @@ func createWafConfig(website *model.Website, domains []model.WebsiteDomain, crea
 	if err != nil {
 		return err
 	}
+	if err := fileOp.SaveFileWithByte(websitesConfigPath, websitesContent, constant.DirPerm); err != nil {
+		return err
+	}
 
 	var (
 		sitesDir          = path.Join(wafDataPath, "sites")
@@ -763,25 +551,13 @@ func createWafConfig(website *model.Website, domains []model.WebsiteDomain, crea
 		return err
 	}
 
-	if err := created.write(path.Join(websiteDir, "config.json"), defaultConfigContent, constant.FilePerm, false); err != nil {
-		return err
-	}
-	if err := created.mkdir(path.Join(websiteDir, "rules")); err != nil {
-		return err
-	}
-	for _, name := range []string{"acl", "args", "cookie", "defaultUaBlack", "defaultUrlBlack", "fileExt", "header", "methodWhite", "cdn"} {
-		data, err := os.ReadFile(path.Join(defaultRuleDir, name+".json"))
-		if os.IsNotExist(err) {
-			continue
-		}
+	defer func() {
 		if err != nil {
-			return err
+			_ = fileOp.DeleteDir(websiteDir)
 		}
-		if err := created.write(path.Join(websiteDir, "rules", name+".json"), data, constant.FilePerm, false); err != nil {
-			return err
-		}
-	}
-	if err := created.replaceShared(websitesConfigPath, content, websitesContent); err != nil {
+	}()
+
+	if err := moveDefaultWafConfig(websiteDir, defaultConfigContent, defaultRuleDir, fileOp); err != nil {
 		return err
 	}
 

agent/utils/common/sqlite.go

@@ -7,43 +7,20 @@ import (
 	"path"
 	"time"
 
-	"github.com/1Panel-dev/1Panel/agent/global"
 	"github.com/glebarez/sqlite"
 	"gorm.io/gorm"
 	"gorm.io/gorm/logger"
 )
 
 func LoadDBConnByPath(fullPath, dbName string) *gorm.DB {
-	if _, err := createDirWhenNotExist(true, path.Dir(fullPath)); err != nil {
-		panic(fmt.Errorf("init db dir failed, err: %v", err))
-	}
-	if _, err := os.Stat(fullPath); err != nil {
-		f, err := os.Create(fullPath)
-		if err != nil {
-			panic(fmt.Errorf("init %s db file failed, err: %v", dbName, err))
-		}
-		_ = f.Close()
-	}
-
 	db, err := GetDBWithPath(fullPath)
 	if err != nil {
-		panic(err)
+		panic(fmt.Errorf("init %s db failed, err: %w", dbName, err))
 	}
 	return db
 }
 
 func LoadDBConnByPathWithErr(fullPath, dbName string) (*gorm.DB, error) {
-	if _, err := createDirWhenNotExist(true, path.Dir(fullPath)); err != nil {
-		return nil, fmt.Errorf("init db dir failed, err: %v", err)
-	}
-	if _, err := os.Stat(fullPath); err != nil {
-		f, err := os.Create(fullPath)
-		if err != nil {
-			return nil, fmt.Errorf("init %s db file failed, err: %v", dbName, err)
-		}
-		_ = f.Close()
-	}
-
 	db, err := GetDBWithPath(fullPath)
 	if err != nil {
 		return nil, fmt.Errorf("init %s db failed, err: %v", dbName, err)
@@ -60,6 +37,30 @@ func CloseDB(db *gorm.DB) {
 }
 
 func GetDBWithPath(dbPath string) (*gorm.DB, error) {
+	dbDir := path.Dir(dbPath)
+	if err := os.MkdirAll(dbDir, 0700); err != nil {
+		return nil, fmt.Errorf("init db dir failed, err: %w", err)
+	}
+	if err := os.Chmod(dbDir, 0700); err != nil {
+		return nil, fmt.Errorf("set db dir permissions failed, err: %w", err)
+	}
+	file, err := os.OpenFile(dbPath, os.O_CREATE|os.O_RDWR, 0600)
+	if err != nil {
+		return nil, fmt.Errorf("init db file failed, err: %w", err)
+	}
+	if err := file.Chmod(0600); err != nil {
+		_ = file.Close()
+		return nil, fmt.Errorf("set db file permissions failed, err: %w", err)
+	}
+	if err := file.Close(); err != nil {
+		return nil, err
+	}
+	for _, suffix := range []string{"-wal", "-shm", "-journal"} {
+		if err := os.Chmod(dbPath+suffix, 0600); err != nil && !os.IsNotExist(err) {
+			return nil, fmt.Errorf("set db sidecar permissions failed, err: %w", err)
+		}
+	}
+
 	db, err := gorm.Open(sqlite.Open(dbPath), &gorm.Config{
 		DisableForeignKeyConstraintWhenMigrating: true,
 		Logger:                                   newLogger(),
@@ -104,17 +105,3 @@ func newLogger() logger.Interface {
 		},
 	)
 }
-
-func createDirWhenNotExist(isDir bool, pathItem string) (string, error) {
-	checkPath := pathItem
-	if !isDir {
-		checkPath = path.Dir(pathItem)
-	}
-	if _, err := os.Stat(checkPath); err != nil && os.IsNotExist(err) {
-		if err = os.MkdirAll(checkPath, os.ModePerm); err != nil {
-			global.LOG.Errorf("mkdir %s failed, err: %v", checkPath, err)
-			return pathItem, err
-		}
-	}
-	return pathItem, nil
-}

core/app/service/upgrade.go

@@ -495,7 +495,9 @@ func (u *UpgradeService) handleRollback(originalDir string, errStep int, svcInfo
 	_ = settingRepo.Update("SystemStatus", "Free")
 	dbPath := path.Join(global.CONF.Base.InstallDir, "1panel")
 	if _, err := os.Stat(path.Join(originalDir, "db")); err == nil {
-		if err := files.CopyItem(true, true, path.Join(originalDir, "db"), dbPath); err != nil {
+		if err := os.Chmod(path.Join(originalDir, "db"), 0700); err != nil {
+			global.LOG.Errorf("set rollback db dir permissions failed, err: %v", err)
+		} else if err := files.CopyItem(true, true, path.Join(originalDir, "db"), dbPath); err != nil {
 			global.LOG.Errorf("rollback 1panel db failed, err: %v", err)
 		}
 	}

core/cmd/server/cmd/restore.go

@@ -91,6 +91,9 @@ var restoreCmd = &cobra.Command{
 		}
 		fmt.Println(i18n.GetMsgByKeyForCmd("RestoreStep4"))
 		if _, err := os.Stat(path.Join(tmpPath, "db")); err == nil {
+			if err := os.Chmod(path.Join(tmpPath, "db"), 0700); err != nil {
+				return err
+			}
 			dbPath := path.Join(baseDir, "1panel")
 			targetDBDir := path.Join(dbPath, "db")
 			if err := os.RemoveAll(targetDBDir); err != nil {

core/utils/common/sqlite.go

@@ -13,20 +13,9 @@ import (
 )
 
 func LoadDBConnByPath(fullPath, dbName string) *gorm.DB {
-	if _, err := CreateDirWhenNotExist(true, path.Dir(fullPath)); err != nil {
-		panic(fmt.Errorf("init db dir failed, err: %v", err))
-	}
-	if _, err := os.Stat(fullPath); err != nil {
-		f, err := os.Create(fullPath)
-		if err != nil {
-			panic(fmt.Errorf("init %s db file failed, err: %v", dbName, err))
-		}
-		_ = f.Close()
-	}
-
 	db, err := GetDBWithPath(fullPath)
 	if err != nil {
-		panic(err)
+		panic(fmt.Errorf("init %s db failed, err: %w", dbName, err))
 	}
 	return db
 }
@@ -40,6 +29,30 @@ func CloseDB(db *gorm.DB) {
 }
 
 func GetDBWithPath(dbPath string) (*gorm.DB, error) {
+	dbDir := path.Dir(dbPath)
+	if err := os.MkdirAll(dbDir, 0700); err != nil {
+		return nil, fmt.Errorf("init db dir failed, err: %w", err)
+	}
+	if err := os.Chmod(dbDir, 0700); err != nil {
+		return nil, fmt.Errorf("set db dir permissions failed, err: %w", err)
+	}
+	file, err := os.OpenFile(dbPath, os.O_CREATE|os.O_RDWR, 0600)
+	if err != nil {
+		return nil, fmt.Errorf("init db file failed, err: %w", err)
+	}
+	if err := file.Chmod(0600); err != nil {
+		_ = file.Close()
+		return nil, fmt.Errorf("set db file permissions failed, err: %w", err)
+	}
+	if err := file.Close(); err != nil {
+		return nil, err
+	}
+	for _, suffix := range []string{"-wal", "-shm", "-journal"} {
+		if err := os.Chmod(dbPath+suffix, 0600); err != nil && !os.IsNotExist(err) {
+			return nil, fmt.Errorf("set db sidecar permissions failed, err: %w", err)
+		}
+	}
+
 	db, err := gorm.Open(sqlite.Open(dbPath), &gorm.Config{
 		DisableForeignKeyConstraintWhenMigrating: true,
 		Logger:                                   newLogger(),