mirrors/arti.git/crates/fs-mistrust/src/walk.rs, branch arti-v0.6.0 mirror of https://gitlab.torproject.org/tpo/core/arti http://git.dilluti0n.com/mirrors/arti.git/atom?h=arti-v0.6.0 2022-05-03T14:03:32Z fs-mistrust: write a lot about TOCTOU issues. 2022-05-03T14:03:32Z Nick Mathewson nickm@torproject.org 2022-05-03T13:56:23Z urn:sha1:f35b4881295f52c252236b151764e82dbcb3b332 fs-mistrust: refactor ResolvePath to avoid temporary changes. 2022-05-03T14:03:32Z Nick Mathewson nickm@torproject.org 2022-04-27T15:58:30Z urn:sha1:c09a613590a0e2b8b6e3fcea601f6dfddab7b60a Previously we would temporarily put self.resolved into an invalid state by adding a path component that might be a symlink. With this change, we create a new temporary path object (using Cow to avoid unnecessary allocations) and only conditionally replace self.resolved. fs-mistrust: clarify and test behavior for ".." past the fs root. 2022-05-03T14:03:32Z Nick Mathewson nickm@torproject.org 2022-04-27T15:36:49Z urn:sha1:8e25954c49aff0b1fc64fea0b7457e029b1c805d Add functionality to inspect directory content permissions 2022-05-03T14:03:32Z Nick Mathewson nickm@torproject.org 2022-04-19T00:23:23Z urn:sha1:75633109c2a75cef0769983ec1b3d20496d1ee38 Also, explain _why_ this is pretty important. Second cut at a fs-mistrust crate. 2022-05-03T14:03:32Z Nick Mathewson nickm@torproject.org 2022-04-13T15:32:23Z urn:sha1:c4a5a49b55ef367afd45ca5855591e28e5f227f4 This crate is meant to solve #315 by giving a way to make sure that a file or directory is only accessible by trusted users. I've tried to explain carefully (in comments and documentation) what this crate is doing and why, under the assumption that it will someday be read by another person like me who does _not_ live and breathe unix file permissions. The crate is still missing some key features, noted in the TODO section. It differs from the first version of the crate by taking a more principled approach to directory checking: it emulates the path lookup process (reading symlinks and all) one path change at a time, thus ensuring that we check every directory which could enable an untrusted user to get to our target file, _or_ which could enable them to get to any symlink that would get them to the target file. The API is also slightly different: It separates the `Mistrust` object (where you configure what you do or do not trust) from the `Verifier` (where you set up a check that you want to perform on a single object). Verifiers are set up to be a bit ephemeral, so that it is hard to accidentally declare that _every_ object is meant to be readable when you only mean that _some_ objects may be readable.