| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| | |
|
| | |
|
| |
|
|
|
| |
This panics on error, and we're fine with a panic on misbehavior in
tests.
|
| |
|
|
|
|
|
|
| |
This warning kind of snuck up on us! (See #748) For now, let's
disable it. (I've cleaned it up in a couple of examples, since
those are meant to be more idiomatic and user-facing.)
Closes #748.
|
| |
|
|
|
| |
This is precisely the result of running the rune in
maint/adhoc-add-lint-blocks.
|
| | |
|
| |
|
|
|
|
|
| |
Apparently cargo fmt doesn't like these, which my perl rune didn't
delete.
This commit is precisely the result of `cargo fmt`.
|
| |
|
|
|
|
|
|
| |
The feature we want is `#[doc = include_str!("README.md")]`, which is
stable since 1.54 and our MSRV is now 1.56.
This commit is precisely the result of the following Perl rune:
perl -i~ -0777 -pe 's{(^//!(?!.*\@\@).*\n)+}{#![doc = include_str!("../README.md")]\n}m' crates/*/src/lib.rs
|
| |\
| |
| |
| |
| |
| |
| | |
Represent the home directory as ${HOME} or %UserProfile%
Closes #555
See merge request tpo/core/arti!700
|
| | |
| |
| |
| | |
Closes #555
|
| | |
| |
| |
| |
| |
| | |
This function transforms `/home/nickm/.config` to
`${HOME}/.config/`, so that we can expose the username less in our
logs.
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
This patch comments out a method call to `trust_group()` as this method
is not available on all platforms that Arti builds on right now and thus
fails to compile there.
I have added a comment that the given call is not available on non-Unix
like platforms.
See: tpo/core/arti#557.
|
| | |
| |
| |
| |
| |
| |
| |
| | |
This patch disables `readable_ok()`, `multiple_errors()`, and
`check_contents()` as they all rely on permission issues on groups being
detected properly which is not the case on Windows right now.
See: tpo/core/arti#557.
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
This patch refactors how we construct the `Mistrust` type in the tests
found in the fs-mistrust crate such that it is possible to construct an
instance of the `Mistrust` type using a set of operations available via
the `MistrustBuilder`'s methods.
We handle some of the portability issues found while testing this code
on Windows in the convenience function `mistrust_build()` instead of
having duplicated code in multiple test cases.
See: tpo/core/arti#557.
|
| | |
| |
| |
| |
| |
| |
| |
| | |
This patch disables the simple_cases() test on non-Unix platforms and
hides the LinkType type import on non-Unix where we won't be testing
symbolic link features.
See: tpo/core/arti#557.
|
| |/
|
|
|
|
|
| |
This patch allows us to compile the fs-mistrust tests on Windows where
the `trust_no_group_id()` method is unavailable.
See: tpo/core/arti#557.
|
| | |
|
| |
|
|
|
|
| |
it would fail to link at runtime due to missing getgrnam_r in bionic
and then it would fail again because some directory is group writeable
|
| | |
|
| | |
|
| |
|
|
|
|
|
| |
By default we look at `$FS_MISTRUST_DISABLE_PERMISSIONS_CHECKS`.
Optionally, the user can provide another variable as well, or
disable looking at the environment entirely.
|
| |
|
|
| |
Update all lint blocks
|
| |\
| |
| |
| |
| | |
fs-mistrust: Improve BadPermission string
See merge request tpo/core/arti!554
|
| | |
| |
| |
| |
| |
| |
| |
| |
| | |
To me, "Incorrect permissions on file or directory /path: g=w o=w"
implies that the current permissions on /path are 022.
Change the message to "Incorrect permissions: /path is
u=rwx,g=rwx,o=rwx; need g-w,o-w", which is closer to chmod syntax and is
more useful in non-interactive environments such as CI and support.
|
| | |
| |
| |
| | |
Next commit adds another parameter to Error::BadPermission.
|
| |\ \
| | |
| | |
| | |
| | |
| | |
| | | |
lints: Make lint blocks consistent and ensure they stay that way
Closes #469
See merge request tpo/core/arti!557
|
| | | |
| | |
| | |
| | |
| | | |
From running add_warning, with manual picking of the right
hunks/lines.
|
| | |/
| |
| |
| |
| |
| | |
This was the result of:
maint/add_warning crates/*/src/{lib,main}.rs
and then manually curating the results.
|
| |/
|
|
|
| |
This allows us to add the proper default example to the arti example
config file.
|
| | |
|
| |
|
|
|
|
| |
This change requires a little refactoring of TorClientBuilder: now,
instead of enabling or disabling mistrust, it enables or disables
the decision to _override_ the mistrust in the config.
|
| |
|
|
|
|
| |
The Group and User (de)serialization is pretty ugly, and I can't
vouch for the correcness of MistrustBuilder. I will seek feedback
before I proceed.
|
| |
|
|
|
| |
This will help make the actual configuration more serializable,
I hope.
|
| |
|
|
|
| |
This is an approximately minimal revision to get Builder in place;
subsequent commits will clean up the API.
|
| |
|
|
|
| |
This renaming will make things slightly simpler for declaring a
builder.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
If the target directory itself is unreadable by untrusted users,
then its contents can't be read[*] by them regardless of their
permissions. If the target directory _is_ readable, then _it_ will
be rejected if we are forbidding readable objects. (And if we
aren't we don't care if the contents are readable.)
A similar argument would apply to writable objects within an
unreadable target directory. We're not making that argument, since
such contents are likelier to be a mistake.
[*] Unless they're hard-linked; see comments in "Limitations"
section.
|
| | |
|
| | |
|
| |
|
|
|
|
|
| |
This helps make it possible to use `SecureDir` (name pending) even
when we want to disable permissions checks. Otherwise, optional
permission checking would require users of this crate to maintain
separate code paths for the "check" and "don't check" cases.
|
| | |
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
This required a bit of poking through the `users` crate, to mess
with the user and group dbs. The original goal was to "trust the
group with the same name as us", but it turned into a bit of a
production, since:
* We want to take our own name from $USER, assuming that matches
our uid. (Otherwise we want to ask getpwuid_r().)
* We only want to trust the group if we are actually a member of
that group.
* We want to cache this information.
* We want to test this code.
|
| | |
|
| |
|
|
|
|
| |
The only way to get a SecureDir is by having checked a directory.
Once you have one, it encourages you to open and create files and
directories with the right permissions, and checks them for you.
|
| |
|
|
| |
Also, explain _why_ this is pretty important.
|
| | |
|
| | |
|
| | |
|
| | |
|
|
|
This crate is meant to solve #315 by giving a way to make sure that
a file or directory is only accessible by trusted users. I've tried
to explain carefully (in comments and documentation) what this crate
is doing and why, under the assumption that it will someday be read
by another person like me who does _not_ live and breathe unix file
permissions. The crate is still missing some key features, noted in
the TODO section.
It differs from the first version of the crate by taking a more
principled approach to directory checking: it emulates the path
lookup process (reading symlinks and all) one path change at a time,
thus ensuring that we check every directory which could enable
an untrusted user to get to our target file, _or_ which could
enable them to get to any symlink that would get them to the target
file.
The API is also slightly different: It separates the `Mistrust`
object (where you configure what you do or do not trust) from the
`Verifier` (where you set up a check that you want to perform on a
single object). Verifiers are set up to be a bit ephemeral,
so that it is hard to accidentally declare that _every_ object
is meant to be readable when you only mean that _some_ objects
may be readable.
|
