mirrors/arti.git/crates/fs-mistrust/src/lib.rs, branch arti-v0.4.0 mirror of https://gitlab.torproject.org/tpo/core/arti http://git.dilluti0n.com/mirrors/arti.git/atom?h=arti-v0.4.0 2022-05-25T14:27:45Z fs-mistrust: allow symlinks to have any permissions 2022-05-25T14:27:45Z Alex Xu (Hello71) alex_y_xu@yahoo.ca 2022-05-24T20:17:45Z urn:sha1:85b4b5620d294b27cdee01989d4f2a936f6f32f4 Make fs-mistrust configurable from the top level. 2022-05-24T14:54:02Z Nick Mathewson nickm@torproject.org 2022-05-23T15:31:47Z urn:sha1:b1fc4bd03bb4024cd5a467ccb682e88adf30bac7 This change requires a little refactoring of TorClientBuilder: now, instead of enabling or disabling mistrust, it enables or disables the decision to _override_ the mistrust in the config. Add serde derives for MistrustBuilder. 2022-05-24T14:54:02Z Nick Mathewson nickm@torproject.org 2022-05-18T20:29:23Z urn:sha1:9dd7b99de1b8bf8625cf6de93770dda25fe2823b The Group and User (de)serialization is pretty ugly, and I can't vouch for the correcness of MistrustBuilder. I will seek feedback before I proceed. fs-mistrust: Add Group and User types. 2022-05-24T14:54:02Z Nick Mathewson nickm@torproject.org 2022-05-18T18:36:24Z urn:sha1:330582a142e30a80fe5f62af043955ca7373b7e7 This will help make the actual configuration more serializable, I hope. fs-mistrust: make Mistrust have a corresponding Builder type. 2022-05-24T14:54:02Z Nick Mathewson nickm@torproject.org 2022-05-18T17:26:01Z urn:sha1:95200383b52d1644d4de357c2a8a50d91fdc1021 This is an approximately minimal revision to get Builder in place; subsequent commits will clean up the API. fs-mistrust: rename fields 2022-05-24T14:54:02Z Nick Mathewson nickm@torproject.org 2022-05-18T15:52:17Z urn:sha1:baa58daace392eee68f8ff82841631e9114c9918 This renaming will make things slightly simpler for declaring a builder. Loosen checking for readable files within target directories. 2022-05-09T18:40:29Z Nick Mathewson nickm@torproject.org 2022-05-09T16:01:08Z urn:sha1:5c33499f288c298c3db8dfc7725448db13427a36 If the target directory itself is unreadable by untrusted users, then its contents can't be read[*] by them regardless of their permissions. If the target directory _is_ readable, then _it_ will be rejected if we are forbidding readable objects. (And if we aren't we don't care if the contents are readable.) A similar argument would apply to writable objects within an unreadable target directory. We're not making that argument, since such contents are likelier to be a mistake. [*] Unless they're hard-linked; see comments in "Limitations" section. fs-mistrust: write a lot about TOCTOU issues. 2022-05-03T14:03:32Z Nick Mathewson nickm@torproject.org 2022-05-03T13:56:23Z urn:sha1:f35b4881295f52c252236b151764e82dbcb3b332 fs-mistrust: Rename SecureDir to CheckedDir. 2022-05-03T14:03:32Z Nick Mathewson nickm@torproject.org 2022-05-03T13:00:50Z urn:sha1:2f467245ca6925f8573ab2d4aadb1f9c874352f4 fs-mistrust: Add a dangerously_trust_everyone method. 2022-05-03T14:03:32Z Nick Mathewson nickm@torproject.org 2022-05-02T15:35:15Z urn:sha1:2087dde3a07a8d31c0625c2d36311e876c07a758 This helps make it possible to use `SecureDir` (name pending) even when we want to disable permissions checks. Otherwise, optional permission checking would require users of this crate to maintain separate code paths for the "check" and "don't check" cases.