fix: improve socket security and refactor hook execution

1. Move package manager socket to dedicated directory /tmp/linglong/
2. Set socket file permissions to 0700 (owner read/write only)
3. Clean up stale socket files from previous crashes on startup
4. Improve error logging to include socket path in failure messages
5. Refactor hook command execution to use Cmd class instead of
std::system()
6. Remove custom shell escaping logic in favor of Cmd::exec() method

Influence:
1. Test package manager daemon startup in no-dbus mode
2. Verify socket directory creation with correct permissions
3. Verify socket file has 0600 permissions after creation
4. Test daemon restart after crash to verify stale socket cleanup
5. Test package installation with pre/post install hooks
6. Verify hook commands execute correctly with environment variables
7. Test hook execution failure handling and error reporting
8. Verify socket cleanup on normal daemon shutdown

Author: dengbo11

apps/ll-package-manager/src/main.cpp

@@ -14,17 +14,25 @@
 #include "linglong/repo/ostree_repo.h"
 #include "linglong/utils/error/error.h"
 #include "linglong/utils/file.h"
+#include "linglong/utils/finally/finally.h"
+#include "linglong/utils/log/log.h"
 #include "ocppi/cli/CLI.hpp"
 #include "ocppi/cli/crun/Crun.hpp"
 
 #include <CLI/CLI.hpp>
 
 #include <QCoreApplication>
 
+#include <cerrno>
+#include <cstring>
 #include <filesystem>
 #include <memory>
 #include <string>
 
+#include <fcntl.h>
+#include <sys/stat.h>
+#include <unistd.h>
+
 namespace {
 
 struct CommandLineOptions
@@ -162,18 +170,69 @@ auto runDaemonMode(ocppi::cli::CLI &cli, const CommandLineOptions &options) -> i
     } else {
         LogI("Running linglong package manager without dbus daemon...");
 
-        auto *server = new QDBusServer("unix:path=/tmp/linglong-package-manager.socket",
+        auto socketDir = std::filesystem::path("/tmp/linglong");
+
+        if (mkdir(socketDir.c_str(), S_IRWXU) != 0) {
+            if (errno == EEXIST) {
+                int fd = open(socketDir.c_str(), O_RDONLY | O_DIRECTORY | O_NOFOLLOW | O_CLOEXEC);
+                if (fd < 0) {
+                    LogE("Failed to open /tmp/linglong safely: {}", strerror(errno));
+                    return -1;
+                }
+                struct stat st;
+                if (fstat(fd, &st) != 0) {
+                    LogE("Failed to fstat /tmp/linglong: {}", strerror(errno));
+                    return -1;
+                }
+                if (st.st_uid != getuid()) {
+                    LogE(
+                      "Failed to create /tmp/linglong: owner mismatch (expected uid {}, got {}).",
+                      getuid(),
+                      st.st_uid);
+                    return -1;
+                }
+                if (fchmod(fd, S_IRWXU) != 0) {
+                    LogE("Failed to set permissions on /tmp/linglong: {}", strerror(errno));
+                    return -1;
+                }
+
+                auto close_fd = linglong::utils::finally::finally([fd] {
+                    close(fd);
+                });
+            } else {
+                LogE("Failed to create /tmp/linglong: {}", strerror(errno));
+                return -1;
+            }
+        }
+
+        auto socketPath = socketDir / "linglong-package-manager.socket";
+
+        // Clean up stale socket from previous crash
+        std::error_code ec;
+        std::filesystem::remove(socketPath, ec);
+
+        auto *server = new QDBusServer(QString("unix:path=%1").arg(socketPath.c_str()),
                                        QCoreApplication::instance());
         if (!server->isConnected()) {
-            LogE("listen on socket: {}", server->lastError().message().toStdString());
+            LogE("listen on socket {}: {}",
+                 socketPath.c_str(),
+                 server->lastError().message().toStdString());
             return -1;
         }
-        QObject::connect(QCoreApplication::instance(), &QCoreApplication::aboutToQuit, []() {
-            if (QDir::root().remove("/tmp/linglong-package-manager.socket")) {
-                return;
-            }
-            LogE("failed to remove /tmp/linglong-package-manager.socket.");
-        });
+
+        // Set socket file permissions: only owner can read/write (0600)
+        if (chmod(socketPath.c_str(), S_IRUSR | S_IWUSR) != 0) {
+            LogE("Failed to set socket permissions: {}", strerror(errno));
+            return -1;
+        }
+
+        // Clean up on exit
+        QObject::connect(QCoreApplication::instance(),
+                         &QCoreApplication::aboutToQuit,
+                         [socketPath]() {
+                             std::error_code ec;
+                             std::filesystem::remove(socketPath, ec);
+                         });
 
         QObject::connect(server,
                          &QDBusServer::newConnection,

libs/linglong/src/linglong/cli/cli.cpp

@@ -470,7 +470,8 @@ utils::error::Result<api::dbus::v1::PackageManager *> Cli::getPkgMan()
         }
 
         LogW("some subcommands will failed in --no-dbus mode.");
-        const auto pkgManAddress = QString("unix:path=/tmp/linglong-package-manager.socket");
+        const auto pkgManAddress =
+          QString("unix:path=/tmp/linglong/linglong-package-manager.socket");
         QProcess::startDetached("sudo",
                                 { "--user",
                                   LINGLONG_USERNAME,

libs/utils/src/linglong/utils/hooks.cpp

@@ -1,22 +1,21 @@
 /*
- * SPDX-FileCopyrightText: 2025 UnionTech Software Technology Co., Ltd.
+ * SPDX-FileCopyrightText: 2025 - 2026 UnionTech Software Technology Co., Ltd.
  *
  * SPDX-License-Identifier: LGPL-3.0-or-later
  */
 
 #include "hooks.h"
 
+#include "cmd.h"
 #include "configure.h"
 #include "linglong/common/error.h"
-#include "linglong/utils/env.h"
 #include "linglong/utils/error/error.h"
 #include "linglong/utils/log/log.h"
 
 #include <fmt/format.h>
 
 #include <array>
 #include <climits>
-#include <cstdlib>
 #include <cstring>
 #include <filesystem>
 #include <fstream>
@@ -33,58 +32,24 @@ constexpr std::string_view PRE_INSTALL_ACTION_PREFIX = "ll-pre-install=";
 constexpr std::string_view POST_INSTALL_ACTION_PREFIX = "ll-post-install=";
 constexpr std::string_view POST_UNINSTALL_ACTION_PREFIX = "ll-post-uninstall=";
 
-// This function ensures the command string is safely wrapped for 'sh -c'.
-static std::string escapeAndWrapCommandForShell(const std::string &command)
-{
-    std::string escapedCommand = command;
-    size_t pos = 0;
-    // Replace ' with '\'' (close current quote, add literal single quote, open new quote)
-    while ((pos = escapedCommand.find('\'', pos)) != std::string::npos) {
-        escapedCommand.replace(pos, 1, "'\\''");
-        pos += 4;
-    }
-
-    return "sh -c " + escapedCommand;
-}
-
 using CommandList = const std::vector<std::string> &;
 
 utils::error::Result<void> executeHookCommands(
   CommandList commands, const std::vector<std::pair<std::string, std::string>> &envVars) noexcept
 {
-    LINGLONG_TRACE("Executing command");
+    LINGLONG_TRACE("Executing hook commands");
 
-    std::vector<std::unique_ptr<EnvironmentVariableGuard>> envVarGuards;
-    envVarGuards.reserve(envVars.size());
-    for (const auto &pair : envVars) {
-        envVarGuards.emplace_back(
-          std::make_unique<EnvironmentVariableGuard>(pair.first, pair.second));
-    }
+    for (const auto &command : commands) {
+        Cmd cmd("/bin/sh");
 
-    for (const auto &command_raw : commands) {
-        std::string fullCommand = escapeAndWrapCommandForShell(command_raw);
-
-        int ret = std::system(fullCommand.c_str());
-
-        if (ret == -1) {
-            return LINGLONG_ERR(fmt::format("Failed to execute command: '{}'. System error: {}.",
-                                            fullCommand,
-                                            common::error::errorString(errno)));
+        for (const auto &[name, value] : envVars) {
+            cmd.setEnv(name, value);
         }
 
-        if (!WIFEXITED(ret)) {
-            int signalNum = WTERMSIG(ret);
-            return LINGLONG_ERR(fmt::format("Command '{}' terminated by signal {} ({}).",
-                                            fullCommand,
-                                            signalNum,
-                                            strsignal(signalNum)));
-        }
-
-        int exitStatus = WEXITSTATUS(ret);
-        if (exitStatus != 0) {
-            return LINGLONG_ERR(fmt::format("Command '{}' exited with non-zero status: {}.",
-                                            fullCommand,
-                                            exitStatus));
+        auto result = cmd.exec({ "-c", command });
+        if (!result.has_value()) {
+            return LINGLONG_ERR(
+              fmt::format("Hook command '{}' failed: {}.", command, result.error()));
         }
     }
     return LINGLONG_OK;