mirrors/arti.git/crates/fs-mistrust/src/imp.rs, branch arti-v0.4.0 mirror of https://gitlab.torproject.org/tpo/core/arti http://git.dilluti0n.com/mirrors/arti.git/atom?h=arti-v0.4.0 2022-05-25T14:27:45Z fs-mistrust: allow symlinks to have any permissions 2022-05-25T14:27:45Z Alex Xu (Hello71) alex_y_xu@yahoo.ca 2022-05-24T20:17:45Z urn:sha1:85b4b5620d294b27cdee01989d4f2a936f6f32f4 fs-mistrust: rename fields 2022-05-24T14:54:02Z Nick Mathewson nickm@torproject.org 2022-05-18T15:52:17Z urn:sha1:baa58daace392eee68f8ff82841631e9114c9918 This renaming will make things slightly simpler for declaring a builder. Loosen checking for readable files within target directories. 2022-05-09T18:40:29Z Nick Mathewson nickm@torproject.org 2022-05-09T16:01:08Z urn:sha1:5c33499f288c298c3db8dfc7725448db13427a36 If the target directory itself is unreadable by untrusted users, then its contents can't be read[*] by them regardless of their permissions. If the target directory _is_ readable, then _it_ will be rejected if we are forbidding readable objects. (And if we aren't we don't care if the contents are readable.) A similar argument would apply to writable objects within an unreadable target directory. We're not making that argument, since such contents are likelier to be a mistake. [*] Unless they're hard-linked; see comments in "Limitations" section. fs-mistrust: write a lot about TOCTOU issues. 2022-05-03T14:03:32Z Nick Mathewson nickm@torproject.org 2022-05-03T13:56:23Z urn:sha1:f35b4881295f52c252236b151764e82dbcb3b332 fs-mistrust: Add a dangerously_trust_everyone method. 2022-05-03T14:03:32Z Nick Mathewson nickm@torproject.org 2022-05-02T15:35:15Z urn:sha1:2087dde3a07a8d31c0625c2d36311e876c07a758 This helps make it possible to use `SecureDir` (name pending) even when we want to disable permissions checks. Otherwise, optional permission checking would require users of this crate to maintain separate code paths for the "check" and "don't check" cases. fs-mistrust: split check_one into two functions. 2022-05-03T14:03:32Z Nick Mathewson nickm@torproject.org 2022-05-02T15:19:22Z urn:sha1:0c01fb97ac3571b927384069ff7ebdbc15dfa856 This will make a "trust_everyone" easier to implement. Add a must_use (suggested by @diziet). 2022-05-03T14:03:32Z Nick Mathewson nickm@torproject.org 2022-04-27T15:25:09Z urn:sha1:c9e17c5aaad8a44218c3fcf9d69aa8067bee39d7 Add a SecureDir API for checked access to directories 2022-05-03T14:03:32Z Nick Mathewson nickm@torproject.org 2022-04-21T15:32:54Z urn:sha1:7f27744ef7b4bc6aafe9b9b1b4cfec3b99f64d23 The only way to get a SecureDir is by having checked a directory. Once you have one, it encourages you to open and create files and directories with the right permissions, and checks them for you. Add functionality to inspect directory content permissions 2022-05-03T14:03:32Z Nick Mathewson nickm@torproject.org 2022-04-19T00:23:23Z urn:sha1:75633109c2a75cef0769983ec1b3d20496d1ee38 Also, explain _why_ this is pretty important. By default, forbid special files. 2022-05-03T14:03:32Z Nick Mathewson nickm@torproject.org 2022-04-18T21:14:30Z urn:sha1:d574afa230cca3dc3603d8786aeb31432640cfd6