aboutsummaryrefslogtreecommitdiff
path: root/crates/fs-mistrust/src/err.rs
Commit message (Collapse)AuthorAgeFilesLines
* Use "extend" for fs-mistrust's PathExtIan Jackson2026-07-161-5/+2
|
* maint: Run maint/add_warning to deny string slicesClara Engler2026-06-091-0/+1
| | | | | | | | | | | | This commit executes maint/add_warning with the just added change to deny string slices except in tests. I recommend auditing this by checking out the previous commit followed by running the script yourself and then verifying that the diff is identical to this commit. This commit makes cargo clippy fail. We will add exceptions in the next commit.
* fs-mistrust: Quote filenames in error messages.Nick Mathewson2025-11-241-9/+9
| | | | | | | | | | | This will help a lot when people try to create files with names like `""` and `" "` and `"foo "` and `"foo! Unless"`. It won't help as much with files that have names like `"filename\". To solve this problem, run install-trojan-now ; \""`. Fortunately, we don't let adversaries choose filenames. Closes #2266.
* Fix name of clippy lint to unchecked_time_subtraction (2)Ian Jackson2025-11-061-1/+1
| | | | Run maint/add_warning
* fs-mistrust: Remove outdated thiserror syntaxClara Engler2024-11-121-1/+1
| | | | | | This commit removes an outdated syntax in a `thiserror` macro which will be removed in `thiserror` version 2. The change this commit makes is backwards compatible in itself.
* Fix a couple of lifetime warnings from nightly.Nick Mathewson2024-10-011-1/+1
| | | | | | | | | Nightly rustdoc, under some circumstances, issues a warning when you have an elided lifetime that matches a lifetime with a name. (It would prefer that you name the lifetime explicitly.) This does not change the actual lifetime of anything; it only makes some formerly elided lifetimes explicit.
* fs-mistrust: Make fake PathExt return impl DisplayIan Jackson2024-08-191-3/+4
| | | | Otherwise it doesn't compile when actually used.
* fs-mistrust: Make a comment into a docIan Jackson2024-08-191-2/+2
| | | | Placates clippy.
* fs-mistrust: Decorate some items with missing walkdir cfgIan Jackson2024-08-191-1/+4
|
* fs-mistrust: Explain that Error might not be a permissions errorIan Jackson2024-07-101-0/+7
|
* fs-mistrust: Fix a formatting botchIan Jackson2024-07-101-2/+3
| | | | rustfmt didn't want to fix this, for some reason.
* Run maint/add_warning.Nick Mathewson2024-03-131-0/+1
|
* Run maint/add_warning to add lint block everywhereIan Jackson2023-08-231-0/+1
|
* fs-mistrust: users: Make several functions fallibleIan Jackson2023-07-141-1/+7
| | | | | | | | | The actual underlying operations here *are* fallible. The `users` crate hides those errors in several cases. (Failures are very rare (at least unless NIS is involved), so this is not of much practical import, but it's going to be necessary when we use the more careful pwd-grp crate.
* Run maint/add_warning to actually apply new lint allowsIan Jackson2023-07-101-0/+1
|
* add opaque ErrorHint API, impl ErrorHint from BadPermissionsShady Katy2023-01-271-1/+1
|
* Allow clippy::unchecked_duration_subtraction in testsNick Mathewson2023-01-271-0/+1
| | | | | This panics on error, and we're fine with a panic on misbehavior in tests.
* test lint blocks: Add many many automaticallyIan Jackson2022-12-121-0/+9
| | | | | This is precisely the result of running the rune in maint/adhoc-add-lint-blocks.
* Use anonymize_home() when displaying various messages.Nick Mathewson2022-08-311-6/+24
| | | | Closes #555
* fs-mistrust: convert Io error variant to a struct.Nick Mathewson2022-06-221-5/+17
|
* Editorial improvements on fs-mistrust errorsNick Mathewson2022-06-221-18/+11
| | | | | | These changes make sure that the errors conform to our preferred style, and include a description of what exactly we were doing when something went wrong.
* Do not include error source() in display() format.Nick Mathewson2022-06-211-1/+1
| | | | | | | | | According to doc/Errors.md, and in keeping with current best practices, we should not include display an error's `source()` as part of that error's display method. Instead, we should let the caller decide to call source() and display that error in turn. Part of #323.
* fs-mistrust: Improve BadPermission stringAlex Xu (Hello71)2022-05-311-15/+25
| | | | | | | | | To me, "Incorrect permissions on file or directory /path: g=w o=w" implies that the current permissions on /path are 022. Change the message to "Incorrect permissions: /path is u=rwx,g=rwx,o=rwx; need g-w,o-w", which is closer to chmod syntax and is more useful in non-interactive environments such as CI and support.
* fs-mistrust: BadPermission(_, _) -> BadPermission(..)Alex Xu (Hello71)2022-05-311-2/+2
| | | | Next commit adds another parameter to Error::BadPermission.
* fs-mistrust: Add Group and User types.Nick Mathewson2022-05-241-1/+13
| | | | | This will help make the actual configuration more serializable, I hope.
* fs-mistrust: make Mistrust have a corresponding Builder type.Nick Mathewson2022-05-241-1/+8
| | | | | This is an approximately minimal revision to get Builder in place; subsequent commits will clean up the API.
* fs-mistrust: add various methods.Nick Mathewson2022-05-091-3/+46
| | | | | | | | | | | This includes: * a CachedDir::join method. * functions to read and write from provided filenames in a CachedDir. * a method to tell whether a fs-mistrust error is about bad file permissions, or failure to inspect file permissions or some other kind of IO problem.
* fs-mistrust: Rename SecureDir to CheckedDir.Nick Mathewson2022-05-031-3/+3
|
* Add a SecureDir API for checked access to directoriesNick Mathewson2022-05-031-0/+7
| | | | | | The only way to get a SecureDir is by having checked a directory. Once you have one, it encourages you to open and create files and directories with the right permissions, and checks them for you.
* Add functionality to inspect directory content permissionsNick Mathewson2022-05-031-0/+13
| | | | Also, explain _why_ this is pretty important.
* Support for "create missing directory".Nick Mathewson2022-05-031-0/+5
|
* Second cut at a fs-mistrust crate.Nick Mathewson2022-05-031-0/+173
This crate is meant to solve #315 by giving a way to make sure that a file or directory is only accessible by trusted users. I've tried to explain carefully (in comments and documentation) what this crate is doing and why, under the assumption that it will someday be read by another person like me who does _not_ live and breathe unix file permissions. The crate is still missing some key features, noted in the TODO section. It differs from the first version of the crate by taking a more principled approach to directory checking: it emulates the path lookup process (reading symlinks and all) one path change at a time, thus ensuring that we check every directory which could enable an untrusted user to get to our target file, _or_ which could enable them to get to any symlink that would get them to the target file. The API is also slightly different: It separates the `Mistrust` object (where you configure what you do or do not trust) from the `Verifier` (where you set up a check that you want to perform on a single object). Verifiers are set up to be a bit ephemeral, so that it is hard to accidentally declare that _every_ object is meant to be readable when you only mean that _some_ objects may be readable.
generated by cgit v1.2.3 (git 2.46.0) at 2026-08-26 20:08:35 +0000