summaryrefslogtreecommitdiff
path: root/crates/fs-mistrust/src
Commit message (Collapse)AuthorAgeFilesLines
* fs_mistrust: Provide CheckedDir::make_secure_dirIan Jackson2024-01-291-0/+18
| | | | | | state_dir wants this, to descend into subdirectories. I think the implementation could be improved - see the TODO.
* fs_mistrust: Expose CheckedDir::verifierIan Jackson2024-01-251-2/+2
| | | | | | | | | I'm not sure why this isn't public. It seems like an obviously reasonable transformation. If I as author of !1927 had been an external contributor, I could have worked around the lack of .make_secure_directory() if .verifier() had existed. So I think exposing it would be useful.
* fs-mistrust: Explain where a Verifier comes fromIan Jackson2023-12-131-0/+2
|
* fs-mistrust: Add read_directory and remove_file to CheckedDir.Nick Mathewson2023-11-271-0/+142
| | | | Closes #1117.
* Run maint/add_warning to add lint block everywhereIan Jackson2023-08-238-0/+8
|
* Run add_warnings on all files.Nick Mathewson2023-08-041-2/+2
|
* Run cargo +nightly fmt to format many let ... else ...Ian Jackson2023-07-241-4/+9
| | | | | | | | | | | rustfmt has grown opinions about how let ... else ... ought to be formatted. They don't always agree with our previous manual decisions. I think our policy is to always insist on rustfmt. When that version of rustfmt hits stable, our CI will start to fail for everyone. (Right now this discrepancy just causes trouble for contributors who are using nightly by default.)
* fs-mistrust: Run rustfmt to apply deferred formatting churnIan Jackson2023-07-141-10/+10
|
* fs-mistrust: In a test, simplify env var handlingIan Jackson2023-07-141-17/+10
|
* fs-mistrust: users: Use OsStr and OsString a lot lessIan Jackson2023-07-141-13/+23
| | | | | | | | We don't use OsString now except where it appears in our public API, or where we get it from std::env. Moving the `use` statements into the use sites enabled me to see that I had found all the places I wanted to change.
* fs-mistrust: Remove a now-unneeded suppressionIan Jackson2023-07-141-1/+0
| | | | This function is actually (properly) fallible now.
* fs-mistrust: forbid unsafe codeIan Jackson2023-07-141-0/+8
|
* fs-mistrust: Replace a direct libc call in a testIan Jackson2023-07-141-1/+1
|
* fs-mistruct: Abolish some now-unneeded mutsIan Jackson2023-07-141-26/+25
| | | | | MockPwdGrpProvider has internal mutability and is Sync, so its add functions take &self.
* fs-mistrust: Use pwd-grp's getgroups functionIan Jackson2023-07-141-24/+1
| | | | | This gets rid of some unsafe code here, with doubtful error handling, in favour of the unit-tested version in pwd-grp.
* fs-mistruct: switch from users to pwd-grpIan Jackson2023-07-141-41/+83
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | users is unmaintained. pwd-grp is the crate I have just written to replace it. In this commit: Change the cargo dependency and imports. Replace the cacheing arrangements. users has a built-in cache; pwd-grp doesn't. Now, instead of cashing individual lookups, we cache the trusted user and trusted gid calculation results. This saves on some syscalls, and is also more convenient to write. (Mocking is still done via the dependency.) Many systematic consequential changes of details: * The entrypoint names to the library are different: pwd-grp uses the names of the corresponding Unix functions. * pwd-grp's returned structs are transparent, so we don't call accessors for .uid(), .name(), etc. * pwd-grp's methods are much more often fallible (returning io::Result<Option<...>) * We're using the non-UTF-8 pwd-grp API, which means we must use turbofish syntax in some places. * The mocking API is a bit different.
* fs-mistrust: Introduce tempoary PwdGrpProvider aliasIan Jackson2023-07-141-4/+8
| | | | | This allows us to change a number of trait bounds in advance, reducing noise in the next commit.
* fs-mistrust: impl Hash for TrustedUser and TrustedGroup (config)Ian Jackson2023-07-141-2/+2
|
* fs-mistrust: users: tests: Introduce mock_users etc.Ian Jackson2023-07-141-25/+36
| | | | | | | | | | Add some wrapper functions for convenience. The pwd-grp crate has a richer and more faithful, but not so convenient, way of creating dummy user/group entries. Also the type names are all going to change. Doing this now reduces churn.
* fs-mistrust: users: Make several functions fallibleIan Jackson2023-07-142-26/+41
| | | | | | | | | The actual underlying operations here *are* fallible. The `users` crate hides those errors in several cases. (Failures are very rare (at least unless NIS is involved), so this is not of much practical import, but it's going to be necessary when we use the more careful pwd-grp crate.
* Run maint/add_warning to actually apply new lint allowsIan Jackson2023-07-108-0/+9
|
* Run add_warning to remove `missing_panics_doc` deny.Nick Mathewson2023-07-061-1/+0
| | | | Closes #950.
* lints: Run maint/add_warning to actually apply new lintsIan Jackson2023-06-211-0/+2
|
* add opaque ErrorHint API, impl ErrorHint from BadPermissionsShady Katy2023-01-272-2/+2
|
* Allow clippy::unchecked_duration_subtraction in testsNick Mathewson2023-01-278-0/+8
| | | | | This panics on error, and we're fine with a panic on misbehavior in tests.
* Disable clippy::unlinlined-format-argsNick Mathewson2023-01-271-0/+1
| | | | | | | | This warning kind of snuck up on us! (See #748) For now, let's disable it. (I've cleaned it up in a couple of examples, since those are meant to be more idiomatic and user-facing.) Closes #748.
* test lint blocks: Add many many automaticallyIan Jackson2022-12-128-0/+67
| | | | | This is precisely the result of running the rune in maint/adhoc-add-lint-blocks.
* Run add_warnings.Nick Mathewson2022-11-031-0/+1
|
* cargo fmt to remove blank linesIan Jackson2022-10-121-1/+0
| | | | | | | Apparently cargo fmt doesn't like these, which my perl rune didn't delete. This commit is precisely the result of `cargo fmt`.
* Replace all README copies in src/lib.rs with includesIan Jackson2022-10-121-239/+1
| | | | | | | | The feature we want is `#[doc = include_str!("README.md")]`, which is stable since 1.54 and our MSRV is now 1.56. This commit is precisely the result of the following Perl rune: perl -i~ -0777 -pe 's{(^//!(?!.*\@\@).*\n)+}{#![doc = include_str!("../README.md")]\n}m' crates/*/src/lib.rs
* fix clippy::needless_borrowtrinity-1686a2022-09-101-15/+12
|
* Fix broken build and tests after arti!700.Alexander Færøy2022-08-311-3/+4
| | | | | | | | | | | | | This patch fixes a minor build error where we would call `compact_home()` on Windows instead of `anonymize_home()` on our PathBuf instance. Additionally we change how the `arti_conf` path is constructed such that we join the individual path components to ensure that no "/" ends up being present on Windows where path's are separated by "\". See: tpo/core/arti#555. See: tpo/core/arti!700.
* Merge branch 'compact_home_2' into 'main'Nick Mathewson2022-08-314-7/+179
|\ | | | | | | | | | | | | Represent the home directory as ${HOME} or %UserProfile% Closes #555 See merge request tpo/core/arti!700
| * Use anonymize_home() when displaying various messages.Nick Mathewson2022-08-312-8/+26
| | | | | | | | Closes #555
| * fs-mistrust: Add a `anonymize_home` extension fn for Path.Nick Mathewson2022-08-313-1/+155
| | | | | | | | | | | | This function transforms `/home/nickm/.config` to `${HOME}/.config/`, so that we can expose the username less in our logs.
* | Comment out docstring as it fails to compile on Windows.Alexander Færøy2022-08-301-2/+3
| | | | | | | | | | | | | | | | | | | | | | This patch comments out a method call to `trust_group()` as this method is not available on all platforms that Arti builds on right now and thus fails to compile there. I have added a comment that the given call is not available on non-Unix like platforms. See: tpo/core/arti#557.
* | Disable 3 tests in fs-mistrust.Alexander Færøy2022-08-301-0/+3
| | | | | | | | | | | | | | | | This patch disables `readable_ok()`, `multiple_errors()`, and `check_contents()` as they all rely on permission issues on groups being detected properly which is not the case on Windows right now. See: tpo/core/arti#557.
* | Use `expect()` instead of `unwrap()` in `mistrust_build()`.Alexander Færøy2022-08-291-1/+1
| | | | | | | | See: tpo/core/arti#557.
* | Refactor the construction of the `Mistrust` type in tests.Alexander Færøy2022-08-292-97/+93
| | | | | | | | | | | | | | | | | | | | | | | | | | This patch refactors how we construct the `Mistrust` type in the tests found in the fs-mistrust crate such that it is possible to construct an instance of the `Mistrust` type using a set of operations available via the `MistrustBuilder`'s methods. We handle some of the portability issues found while testing this code on Windows in the convenience function `mistrust_build()` instead of having duplicated code in multiple test cases. See: tpo/core/arti#557.
* | Document in link_rel() why we do not support symlinks on Windows.Alexander Færøy2022-08-291-0/+4
| | | | | | | | | | | | | | This patch adds a comment to the `link_rel()` function in fs-mistrust to explain why we ignore symlink creation on the Windows platform. See: tpo/core/arti#557.
* | Disable fs-mistrust's simple_cases() unit test on non-Unix.Alexander Færøy2022-08-261-1/+5
| | | | | | | | | | | | | | | | This patch disables the simple_cases() test on non-Unix platforms and hides the LinkType type import on non-Unix where we won't be testing symbolic link features. See: tpo/core/arti#557.
* | Fix compilation of tests for Windows.Alexander Færøy2022-08-261-13/+49
| | | | | | | | | | | | | | This patch allows us to compile the fs-mistrust tests on Windows where the `trust_no_group_id()` method is unavailable. See: tpo/core/arti#557.
* | Mark fs-mistrust's link_rel() and link_abs() as Unix-only.Alexander Færøy2022-08-261-10/+3
| | | | | | | | | | | | | | Since we are not going to test symlink creation on Windows we remove this code from the testing module. See: tpo/core/arti#557.
* | Mark the repeats and looping tests in fs-mistrust as Unix-only.Alexander Færøy2022-08-261-1/+6
| | | | | | | | See: tpo/core/art#557.
* | fs-mistrust: Try to handle verbatim prefixes in test.Nick Mathewson2022-08-261-0/+31
| | | | | | | | | | | | | | | | | | | | | | | | | | | | We have a test that tries to check that our outputs are the same as those from `std::fs::canonicalize`. But on Windows, they aren't: There, `canonicalize` also puts path prefixes into a "Verbatim" form. This patch tries to replicate that behavior for the test only. If we find that it's unreliable, though, our best bet is probably to revise or disable this check on Windows, rather than chasing compatibility with `GetFinalPathNameByHandle`. Should fix part of #557.
* | fs-mistrust: Clarify comment on `stack`Ian Jackson2022-08-261-0/+2
| |
* | fs-mistrust: Handle windows prefixes specially.Nick Mathewson2022-08-261-11/+50
|/ | | | | | | | | | | | On Windows, paths can have a "prefix", like `C:` or `\\server\share`. Attempts to get metadata for these prefixes appear to fail with `ERROR_INVALID_FUNCTION`, since they are not files. This patch teaches fs-mistrust about prefixes on Windows, and tells it that attempts to find their metadata are allowed to fail. Doing this may solve part of #557.
* enable doc_auto_cfg feature on every crate when documenting for docs.rstrinity-1686a2022-08-241-0/+1
|
* fix fs-misstrust on androidtrinity-1686a2022-08-082-11/+44
| | | | | | it would fail to link at runtime due to missing getgrnam_r in bionic and then it would fail again because some directory is group writeable
* fix runtime issues on iostrinity-1686a2022-07-301-2/+7
|
generated by cgit v1.2.3 (git 2.46.0) at 2026-08-26 23:33:49 +0000