| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
|
| |
By default we look at `$FS_MISTRUST_DISABLE_PERMISSIONS_CHECKS`.
Optionally, the user can provide another variable as well, or
disable looking at the environment entirely.
|
| |
|
|
| |
Update all lint blocks
|
| | |
|
| |
|
|
|
|
| |
These changes make sure that the errors conform to our preferred
style, and include a description of what exactly we were doing when
something went wrong.
|
| |
|
|
|
|
|
|
|
| |
According to doc/Errors.md, and in keeping with current best
practices, we should not include display an error's `source()` as
part of that error's display method. Instead, we should let the
caller decide to call source() and display that error in turn.
Part of #323.
|
| |\
| |
| |
| |
| | |
fs-mistrust: Improve BadPermission string
See merge request tpo/core/arti!554
|
| | |
| |
| |
| |
| |
| |
| |
| |
| | |
To me, "Incorrect permissions on file or directory /path: g=w o=w"
implies that the current permissions on /path are 022.
Change the message to "Incorrect permissions: /path is
u=rwx,g=rwx,o=rwx; need g-w,o-w", which is closer to chmod syntax and is
more useful in non-interactive environments such as CI and support.
|
| | |
| |
| |
| | |
Next commit adds another parameter to Error::BadPermission.
|
| |\ \
| | |
| | |
| | |
| | |
| | |
| | | |
lints: Make lint blocks consistent and ensure they stay that way
Closes #469
See merge request tpo/core/arti!557
|
| | | |
| | |
| | |
| | |
| | | |
From running add_warning, with manual picking of the right
hunks/lines.
|
| | |/
| |
| |
| |
| |
| | |
This was the result of:
maint/add_warning crates/*/src/{lib,main}.rs
and then manually curating the results.
|
| |/
|
|
|
| |
This allows us to add the proper default example to the arti example
config file.
|
| |\
| |
| |
| |
| |
| |
| | |
fs-mistrust: add getegid() to getgrouplist() output.
Closes #487
See merge request tpo/core/arti!548
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
This fixes a unit test failure in weird environments (like some
containers) where the current effective GID is not included in the
list of current groups.
Closes #487.
Bug reported by @sjm217.
|
| |/
|
|
|
|
|
|
|
|
|
| |
It turns out that the `toml` crate can't handle OsString, since
`toml` doesn't support serialize_newtype_variant, and the `serde`
crate tries to serialize OsString using that method.
In this commit we document that limitation, and test that we can at
least round-trip through json.
Found by inspecting test coverage.
|
| | |
|
| | |
|
| |
|
|
|
|
| |
This change requires a little refactoring of TorClientBuilder: now,
instead of enabling or disabling mistrust, it enables or disables
the decision to _override_ the mistrust in the config.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
We support all of the following (in TOML notation):
```
user = "rose" # by name
user = 413 # by ID
user = false # no user
user = ":current" # A 'special' user.
user = { name: "rose" }
user = { id: 413 }
user = { special: ":none" }
user = { special: ":current" }
```
|
| |
|
|
|
|
| |
The Group and User (de)serialization is pretty ugly, and I can't
vouch for the correcness of MistrustBuilder. I will seek feedback
before I proceed.
|
| |
|
|
|
| |
This will help make the actual configuration more serializable,
I hope.
|
| |
|
|
|
| |
This is an approximately minimal revision to get Builder in place;
subsequent commits will clean up the API.
|
| |
|
|
|
| |
This renaming will make things slightly simpler for declaring a
builder.
|
| |\ |
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
If the target directory itself is unreadable by untrusted users,
then its contents can't be read[*] by them regardless of their
permissions. If the target directory _is_ readable, then _it_ will
be rejected if we are forbidding readable objects. (And if we
aren't we don't care if the contents are readable.)
A similar argument would apply to writable objects within an
unreadable target directory. We're not making that argument, since
such contents are likelier to be a mistake.
[*] Unless they're hard-linked; see comments in "Limitations"
section.
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
This includes:
* a CachedDir::join method.
* functions to read and write from provided filenames in a
CachedDir.
* a method to tell whether a fs-mistrust error is about bad file
permissions, or failure to inspect file permissions or some other
kind of IO problem.
|
| | | |
|
| |/ |
|
| | |
|
| | |
|
| |
|
|
|
|
|
| |
This helps make it possible to use `SecureDir` (name pending) even
when we want to disable permissions checks. Otherwise, optional
permission checking would require users of this crate to maintain
separate code paths for the "check" and "don't check" cases.
|
| |
|
|
| |
This will make a "trust_everyone" easier to implement.
|
| | |
|
| |
|
|
|
| |
Some of our builders put root into gid 0, but getgroups() doesn't
actually give any result.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
This required a bit of poking through the `users` crate, to mess
with the user and group dbs. The original goal was to "trust the
group with the same name as us", but it turned into a bit of a
production, since:
* We want to take our own name from $USER, assuming that matches
our uid. (Otherwise we want to ask getpwuid_r().)
* We only want to trust the group if we are actually a member of
that group.
* We want to cache this information.
* We want to test this code.
|
| |
|
|
|
|
|
|
| |
Previously we would temporarily put self.resolved into an invalid
state by adding a path component that might be a symlink. With this
change, we create a new temporary path object (using Cow to avoid
unnecessary allocations) and only conditionally replace
self.resolved.
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
| |
The only way to get a SecureDir is by having checked a directory.
Once you have one, it encourages you to open and create files and
directories with the right permissions, and checks them for you.
|
| |
|
|
| |
Also, explain _why_ this is pretty important.
|
| | |
|
| | |
|
| | |
|
| | |
|
|
|
This crate is meant to solve #315 by giving a way to make sure that
a file or directory is only accessible by trusted users. I've tried
to explain carefully (in comments and documentation) what this crate
is doing and why, under the assumption that it will someday be read
by another person like me who does _not_ live and breathe unix file
permissions. The crate is still missing some key features, noted in
the TODO section.
It differs from the first version of the crate by taking a more
principled approach to directory checking: it emulates the path
lookup process (reading symlinks and all) one path change at a time,
thus ensuring that we check every directory which could enable
an untrusted user to get to our target file, _or_ which could
enable them to get to any symlink that would get them to the target
file.
The API is also slightly different: It separates the `Mistrust`
object (where you configure what you do or do not trust) from the
`Verifier` (where you set up a check that you want to perform on a
single object). Verifiers are set up to be a bit ephemeral,
so that it is hard to accidentally declare that _every_ object
is meant to be readable when you only mean that _some_ objects
may be readable.
|
