| Commit message (Collapse) | Author | Age | Files | Lines |
|---|
| ... | |
| | |
| |
| |
| | |
See: tpo/core/art#557.
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
We have a test that tries to check that our outputs are the same as
those from `std::fs::canonicalize`. But on Windows, they aren't:
There, `canonicalize` also puts path prefixes into a "Verbatim"
form.
This patch tries to replicate that behavior for the test only. If
we find that it's unreliable, though, our best bet is probably to
revise or disable this check on Windows, rather than chasing
compatibility with `GetFinalPathNameByHandle`.
Should fix part of #557.
|
| | | |
|
| |/
|
|
|
|
|
|
|
|
|
|
| |
On Windows, paths can have a "prefix", like `C:` or
`\\server\share`. Attempts to get metadata for these prefixes
appear to fail with `ERROR_INVALID_FUNCTION`, since they are not
files.
This patch teaches fs-mistrust about prefixes on Windows, and tells
it that attempts to find their metadata are allowed to fail.
Doing this may solve part of #557.
|
| | |
|
| |
|
|
|
|
| |
it would fail to link at runtime due to missing getgrnam_r in bionic
and then it would fail again because some directory is group writeable
|
| | |
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
|
| |
By default we look at `$FS_MISTRUST_DISABLE_PERMISSIONS_CHECKS`.
Optionally, the user can provide another variable as well, or
disable looking at the environment entirely.
|
| |
|
|
| |
Update all lint blocks
|
| | |
|
| |
|
|
|
|
| |
These changes make sure that the errors conform to our preferred
style, and include a description of what exactly we were doing when
something went wrong.
|
| |
|
|
|
|
|
|
|
| |
According to doc/Errors.md, and in keeping with current best
practices, we should not include display an error's `source()` as
part of that error's display method. Instead, we should let the
caller decide to call source() and display that error in turn.
Part of #323.
|
| |\
| |
| |
| |
| | |
fs-mistrust: Improve BadPermission string
See merge request tpo/core/arti!554
|
| | |
| |
| |
| |
| |
| |
| |
| |
| | |
To me, "Incorrect permissions on file or directory /path: g=w o=w"
implies that the current permissions on /path are 022.
Change the message to "Incorrect permissions: /path is
u=rwx,g=rwx,o=rwx; need g-w,o-w", which is closer to chmod syntax and is
more useful in non-interactive environments such as CI and support.
|
| | |
| |
| |
| | |
Next commit adds another parameter to Error::BadPermission.
|
| |\ \
| | |
| | |
| | |
| | |
| | |
| | | |
lints: Make lint blocks consistent and ensure they stay that way
Closes #469
See merge request tpo/core/arti!557
|
| | | |
| | |
| | |
| | |
| | | |
From running add_warning, with manual picking of the right
hunks/lines.
|
| | |/
| |
| |
| |
| |
| | |
This was the result of:
maint/add_warning crates/*/src/{lib,main}.rs
and then manually curating the results.
|
| |/
|
|
|
| |
This allows us to add the proper default example to the arti example
config file.
|
| |\
| |
| |
| |
| |
| |
| | |
fs-mistrust: add getegid() to getgrouplist() output.
Closes #487
See merge request tpo/core/arti!548
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
This fixes a unit test failure in weird environments (like some
containers) where the current effective GID is not included in the
list of current groups.
Closes #487.
Bug reported by @sjm217.
|
| |/
|
|
|
|
|
|
|
|
|
| |
It turns out that the `toml` crate can't handle OsString, since
`toml` doesn't support serialize_newtype_variant, and the `serde`
crate tries to serialize OsString using that method.
In this commit we document that limitation, and test that we can at
least round-trip through json.
Found by inspecting test coverage.
|
| | |
|
| | |
|
| |
|
|
|
|
| |
This change requires a little refactoring of TorClientBuilder: now,
instead of enabling or disabling mistrust, it enables or disables
the decision to _override_ the mistrust in the config.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
| |
We support all of the following (in TOML notation):
```
user = "rose" # by name
user = 413 # by ID
user = false # no user
user = ":current" # A 'special' user.
user = { name: "rose" }
user = { id: 413 }
user = { special: ":none" }
user = { special: ":current" }
```
|
| |
|
|
|
|
| |
The Group and User (de)serialization is pretty ugly, and I can't
vouch for the correcness of MistrustBuilder. I will seek feedback
before I proceed.
|
| |
|
|
|
| |
This will help make the actual configuration more serializable,
I hope.
|
| |
|
|
|
| |
This is an approximately minimal revision to get Builder in place;
subsequent commits will clean up the API.
|
| |
|
|
|
| |
This renaming will make things slightly simpler for declaring a
builder.
|
| |\ |
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
If the target directory itself is unreadable by untrusted users,
then its contents can't be read[*] by them regardless of their
permissions. If the target directory _is_ readable, then _it_ will
be rejected if we are forbidding readable objects. (And if we
aren't we don't care if the contents are readable.)
A similar argument would apply to writable objects within an
unreadable target directory. We're not making that argument, since
such contents are likelier to be a mistake.
[*] Unless they're hard-linked; see comments in "Limitations"
section.
|
| | |
| |
| |
| |
| |
| |
| |
| |
| |
| |
| | |
This includes:
* a CachedDir::join method.
* functions to read and write from provided filenames in a
CachedDir.
* a method to tell whether a fs-mistrust error is about bad file
permissions, or failure to inspect file permissions or some other
kind of IO problem.
|
| | | |
|
| |/ |
|
| | |
|
| | |
|
| |
|
|
|
|
|
| |
This helps make it possible to use `SecureDir` (name pending) even
when we want to disable permissions checks. Otherwise, optional
permission checking would require users of this crate to maintain
separate code paths for the "check" and "don't check" cases.
|
| |
|
|
| |
This will make a "trust_everyone" easier to implement.
|
| | |
|
| |
|
|
|
| |
Some of our builders put root into gid 0, but getgroups() doesn't
actually give any result.
|
| |
|
|
|
|
|
|
|
|
|
|
|
|
| |
This required a bit of poking through the `users` crate, to mess
with the user and group dbs. The original goal was to "trust the
group with the same name as us", but it turned into a bit of a
production, since:
* We want to take our own name from $USER, assuming that matches
our uid. (Otherwise we want to ask getpwuid_r().)
* We only want to trust the group if we are actually a member of
that group.
* We want to cache this information.
* We want to test this code.
|
| |
|
|
|
|
|
|
| |
Previously we would temporarily put self.resolved into an invalid
state by adding a path component that might be a symlink. With this
change, we create a new temporary path object (using Cow to avoid
unnecessary allocations) and only conditionally replace
self.resolved.
|
| | |
|
| | |
|
| | |
|
| |
|
|
|
|
| |
The only way to get a SecureDir is by having checked a directory.
Once you have one, it encourages you to open and create files and
directories with the right permissions, and checks them for you.
|
