summaryrefslogtreecommitdiff
path: root/crates/fs-mistrust/src/lib.rs
Commit message (Collapse)AuthorAgeFilesLines
* add opaque ErrorHint API, impl ErrorHint from BadPermissionsShady Katy2023-01-271-1/+1
|
* Allow clippy::unchecked_duration_subtraction in testsNick Mathewson2023-01-271-0/+1
| | | | | This panics on error, and we're fine with a panic on misbehavior in tests.
* Disable clippy::unlinlined-format-argsNick Mathewson2023-01-271-0/+1
| | | | | | | | This warning kind of snuck up on us! (See #748) For now, let's disable it. (I've cleaned it up in a couple of examples, since those are meant to be more idiomatic and user-facing.) Closes #748.
* test lint blocks: Add many many automaticallyIan Jackson2022-12-121-0/+8
| | | | | This is precisely the result of running the rune in maint/adhoc-add-lint-blocks.
* Run add_warnings.Nick Mathewson2022-11-031-0/+1
|
* cargo fmt to remove blank linesIan Jackson2022-10-121-1/+0
| | | | | | | Apparently cargo fmt doesn't like these, which my perl rune didn't delete. This commit is precisely the result of `cargo fmt`.
* Replace all README copies in src/lib.rs with includesIan Jackson2022-10-121-239/+1
| | | | | | | | The feature we want is `#[doc = include_str!("README.md")]`, which is stable since 1.54 and our MSRV is now 1.56. This commit is precisely the result of the following Perl rune: perl -i~ -0777 -pe 's{(^//!(?!.*\@\@).*\n)+}{#![doc = include_str!("../README.md")]\n}m' crates/*/src/lib.rs
* Merge branch 'compact_home_2' into 'main'Nick Mathewson2022-08-311-0/+2
|\ | | | | | | | | | | | | Represent the home directory as ${HOME} or %UserProfile% Closes #555 See merge request tpo/core/arti!700
| * Use anonymize_home() when displaying various messages.Nick Mathewson2022-08-311-2/+2
| | | | | | | | Closes #555
| * fs-mistrust: Add a `anonymize_home` extension fn for Path.Nick Mathewson2022-08-311-0/+2
| | | | | | | | | | | | This function transforms `/home/nickm/.config` to `${HOME}/.config/`, so that we can expose the username less in our logs.
* | Comment out docstring as it fails to compile on Windows.Alexander Færøy2022-08-301-2/+3
| | | | | | | | | | | | | | | | | | | | | | This patch comments out a method call to `trust_group()` as this method is not available on all platforms that Arti builds on right now and thus fails to compile there. I have added a comment that the given call is not available on non-Unix like platforms. See: tpo/core/arti#557.
* | Disable 3 tests in fs-mistrust.Alexander Færøy2022-08-301-0/+3
| | | | | | | | | | | | | | | | This patch disables `readable_ok()`, `multiple_errors()`, and `check_contents()` as they all rely on permission issues on groups being detected properly which is not the case on Windows right now. See: tpo/core/arti#557.
* | Refactor the construction of the `Mistrust` type in tests.Alexander Færøy2022-08-291-97/+39
| | | | | | | | | | | | | | | | | | | | | | | | | | This patch refactors how we construct the `Mistrust` type in the tests found in the fs-mistrust crate such that it is possible to construct an instance of the `Mistrust` type using a set of operations available via the `MistrustBuilder`'s methods. We handle some of the portability issues found while testing this code on Windows in the convenience function `mistrust_build()` instead of having duplicated code in multiple test cases. See: tpo/core/arti#557.
* | Disable fs-mistrust's simple_cases() unit test on non-Unix.Alexander Færøy2022-08-261-1/+5
| | | | | | | | | | | | | | | | This patch disables the simple_cases() test on non-Unix platforms and hides the LinkType type import on non-Unix where we won't be testing symbolic link features. See: tpo/core/arti#557.
* | Fix compilation of tests for Windows.Alexander Færøy2022-08-261-13/+49
|/ | | | | | | This patch allows us to compile the fs-mistrust tests on Windows where the `trust_no_group_id()` method is unavailable. See: tpo/core/arti#557.
* enable doc_auto_cfg feature on every crate when documenting for docs.rstrinity-1686a2022-08-241-0/+1
|
* fix fs-misstrust on androidtrinity-1686a2022-08-081-6/+30
| | | | | | it would fail to link at runtime due to missing getgrnam_r in bionic and then it would fail again because some directory is group writeable
* remove dependancy 'users' on iOStrinity-1686a2022-07-301-6/+6
|
* fix nighly clippytrinity-1686a2022-07-231-3/+2
|
* fs-mistrust: API to disable based on environmentNick Mathewson2022-07-191-3/+93
| | | | | | | By default we look at `$FS_MISTRUST_DISABLE_PERMISSIONS_CHECKS`. Optionally, the user can provide another variable as well, or disable looking at the environment entirely.
* Run maint/add_warning crates/*/src/{lib,main}.rsIan Jackson2022-06-231-0/+3
| | | | Update all lint blocks
* Merge branch 'better-fs-mistrust-badpermissions-string' into 'main'Ian Jackson2022-06-021-7/+7
|\ | | | | | | | | fs-mistrust: Improve BadPermission string See merge request tpo/core/arti!554
| * fs-mistrust: Improve BadPermission stringAlex Xu (Hello71)2022-05-311-1/+1
| | | | | | | | | | | | | | | | | | To me, "Incorrect permissions on file or directory /path: g=w o=w" implies that the current permissions on /path are 022. Change the message to "Incorrect permissions: /path is u=rwx,g=rwx,o=rwx; need g-w,o-w", which is closer to chmod syntax and is more useful in non-interactive environments such as CI and support.
| * fs-mistrust: BadPermission(_, _) -> BadPermission(..)Alex Xu (Hello71)2022-05-311-6/+6
| | | | | | | | Next commit adds another parameter to Error::BadPermission.
* | Merge branch 'lint' into 'main'Ian Jackson2022-05-311-0/+3
|\ \ | | | | | | | | | | | | | | | | | | lints: Make lint blocks consistent and ensure they stay that way Closes #469 See merge request tpo/core/arti!557
| * | lints: Add let_unit_value allow to all cratesIan Jackson2022-05-311-0/+1
| | | | | | | | | | | | | | | From running add_warning, with manual picking of the right hunks/lines.
| * | lints: Add lint block delimiters to every crateIan Jackson2022-05-311-0/+2
| |/ | | | | | | | | | | This was the result of: maint/add_warning crates/*/src/{lib,main}.rs and then manually curating the results.
* / mistrust: Canonicalise prefix from Some("") to NoneIan Jackson2022-05-301-0/+1
|/ | | | | This allows us to add the proper default example to the arti example config file.
* fs-mistrust: allow symlinks to have any permissionsAlex Xu (Hello71)2022-05-251-1/+4
|
* Make fs-mistrust configurable from the top level.Nick Mathewson2022-05-241-1/+1
| | | | | | This change requires a little refactoring of TorClientBuilder: now, instead of enabling or disabling mistrust, it enables or disables the decision to _override_ the mistrust in the config.
* Add serde derives for MistrustBuilder.Nick Mathewson2022-05-241-0/+5
| | | | | | The Group and User (de)serialization is pretty ugly, and I can't vouch for the correcness of MistrustBuilder. I will seek feedback before I proceed.
* fs-mistrust: Add Group and User types.Nick Mathewson2022-05-241-5/+14
| | | | | This will help make the actual configuration more serializable, I hope.
* fs-mistrust: make Mistrust have a corresponding Builder type.Nick Mathewson2022-05-241-122/+168
| | | | | This is an approximately minimal revision to get Builder in place; subsequent commits will clean up the API.
* fs-mistrust: rename fieldsNick Mathewson2022-05-241-11/+11
| | | | | This renaming will make things slightly simpler for declaring a builder.
* Loosen checking for readable files within target directories.Nick Mathewson2022-05-091-4/+17
| | | | | | | | | | | | | | | If the target directory itself is unreadable by untrusted users, then its contents can't be read[*] by them regardless of their permissions. If the target directory _is_ readable, then _it_ will be rejected if we are forbidding readable objects. (And if we aren't we don't care if the contents are readable.) A similar argument would apply to writable objects within an unreadable target directory. We're not making that argument, since such contents are likelier to be a mistake. [*] Unless they're hard-linked; see comments in "Limitations" section.
* fs-mistrust: write a lot about TOCTOU issues.Nick Mathewson2022-05-031-9/+35
|
* fs-mistrust: Rename SecureDir to CheckedDir.Nick Mathewson2022-05-031-13/+13
|
* fs-mistrust: Add a dangerously_trust_everyone method.Nick Mathewson2022-05-031-0/+45
| | | | | | | This helps make it possible to use `SecureDir` (name pending) even when we want to disable permissions checks. Otherwise, optional permission checking would require users of this crate to maintain separate code paths for the "check" and "don't check" cases.
* fs-mistrust: Make self-named groups trusted by default.Nick Mathewson2022-05-031-23/+32
|
* fs-mistrust: Add code to make a self-named group "trusted".Nick Mathewson2022-05-031-0/+21
| | | | | | | | | | | | | | This required a bit of poking through the `users` crate, to mess with the user and group dbs. The original goal was to "trust the group with the same name as us", but it turned into a bit of a production, since: * We want to take our own name from $USER, assuming that matches our uid. (Otherwise we want to ask getpwuid_r().) * We only want to trust the group if we are actually a member of that group. * We want to cache this information. * We want to test this code.
* fs-mistrust: more examples, documentation.Nick Mathewson2022-05-031-4/+109
|
* Add a SecureDir API for checked access to directoriesNick Mathewson2022-05-031-2/+24
| | | | | | The only way to get a SecureDir is by having checked a directory. Once you have one, it encourages you to open and create files and directories with the right permissions, and checks them for you.
* Add functionality to inspect directory content permissionsNick Mathewson2022-05-031-4/+58
| | | | Also, explain _why_ this is pretty important.
* By default, forbid special files.Nick Mathewson2022-05-031-6/+20
|
* Support for "create missing directory".Nick Mathewson2022-05-031-2/+82
|
* Add support for trusted group IDs.Nick Mathewson2022-05-031-2/+53
|
* Implement support for the Sticky Bit.Nick Mathewson2022-05-031-0/+27
|
* Second cut at a fs-mistrust crate.Nick Mathewson2022-05-031-0/+508
This crate is meant to solve #315 by giving a way to make sure that a file or directory is only accessible by trusted users. I've tried to explain carefully (in comments and documentation) what this crate is doing and why, under the assumption that it will someday be read by another person like me who does _not_ live and breathe unix file permissions. The crate is still missing some key features, noted in the TODO section. It differs from the first version of the crate by taking a more principled approach to directory checking: it emulates the path lookup process (reading symlinks and all) one path change at a time, thus ensuring that we check every directory which could enable an untrusted user to get to our target file, _or_ which could enable them to get to any symlink that would get them to the target file. The API is also slightly different: It separates the `Mistrust` object (where you configure what you do or do not trust) from the `Verifier` (where you set up a check that you want to perform on a single object). Verifiers are set up to be a bit ephemeral, so that it is hard to accidentally declare that _every_ object is meant to be readable when you only mean that _some_ objects may be readable.
generated by cgit v1.2.3 (git 2.46.0) at 2026-08-27 08:04:02 +0000