summaryrefslogtreecommitdiff
path: root/crates/fs-mistrust
Commit message (Collapse)AuthorAgeFilesLines
* Bump crate and dependency versions.Nick Mathewson2022-06-241-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | These were done with the following commands: ``` cargo set-version -p tor-basic-utils --bump patch cargo set-version -p fs-mistrust --bump minor cargo set-version -p tor-error --bump patch cargo set-version -p tor-config --bump patch cargo set-version -p tor-units --bump patch cargo set-version -p tor-rtcompat --bump minor cargo set-version -p tor-llcrypto --bump patch cargo set-version -p tor-bytes --bump minor cargo set-version -p tor-socksproto --bump minor cargo set-version -p tor-cert --bump minor cargo set-version -p tor-cell --bump minor cargo set-version -p tor-proto --bump minor cargo set-version -p tor-netdoc --bump patch cargo set-version -p tor-netdir --bump minor cargo set-version -p tor-persist --bump patch cargo set-version -p tor-chanmgr --bump minor cargo set-version -p tor-guardmgr --bump minor cargo set-version -p tor-circmgr --bump patch cargo set-version -p tor-dirclient --bump patch cargo set-version -p tor-dirmgr --bump minor cargo set-version -p arti-client --bump patch cargo set-version -p arti --bump minor cargo set-version -p arti-bench --bump minor cargo set-version -p arti-testing --bump minor ```
* Run maint/add_warning crates/*/src/{lib,main}.rsIan Jackson2022-06-231-0/+3
| | | | Update all lint blocks
* fs-mistrust: convert Io error variant to a struct.Nick Mathewson2022-06-221-5/+17
|
* Editorial improvements on fs-mistrust errorsNick Mathewson2022-06-224-23/+20
| | | | | | These changes make sure that the errors conform to our preferred style, and include a description of what exactly we were doing when something went wrong.
* Do not include error source() in display() format.Nick Mathewson2022-06-211-1/+1
| | | | | | | | | According to doc/Errors.md, and in keeping with current best practices, we should not include display an error's `source()` as part of that error's display method. Instead, we should let the caller decide to call source() and display that error in turn. Part of #323.
* Merge branch 'better-fs-mistrust-badpermissions-string' into 'main'Ian Jackson2022-06-024-29/+43
|\ | | | | | | | | fs-mistrust: Improve BadPermission string See merge request tpo/core/arti!554
| * fs-mistrust: Improve BadPermission stringAlex Xu (Hello71)2022-05-313-17/+31
| | | | | | | | | | | | | | | | | | To me, "Incorrect permissions on file or directory /path: g=w o=w" implies that the current permissions on /path are 022. Change the message to "Incorrect permissions: /path is u=rwx,g=rwx,o=rwx; need g-w,o-w", which is closer to chmod syntax and is more useful in non-interactive environments such as CI and support.
| * fs-mistrust: BadPermission(_, _) -> BadPermission(..)Alex Xu (Hello71)2022-05-313-12/+12
| | | | | | | | Next commit adds another parameter to Error::BadPermission.
* | Merge branch 'lint' into 'main'Ian Jackson2022-05-311-0/+3
|\ \ | | | | | | | | | | | | | | | | | | lints: Make lint blocks consistent and ensure they stay that way Closes #469 See merge request tpo/core/arti!557
| * | lints: Add let_unit_value allow to all cratesIan Jackson2022-05-311-0/+1
| | | | | | | | | | | | | | | From running add_warning, with manual picking of the right hunks/lines.
| * | lints: Add lint block delimiters to every crateIan Jackson2022-05-311-0/+2
| |/ | | | | | | | | | | This was the result of: maint/add_warning crates/*/src/{lib,main}.rs and then manually curating the results.
* / mistrust: Canonicalise prefix from Some("") to NoneIan Jackson2022-05-301-0/+1
|/ | | | | This allows us to add the proper default example to the arti example config file.
* Merge branch 'bug487' into 'main'Ian Jackson2022-05-301-0/+6
|\ | | | | | | | | | | | | fs-mistrust: add getegid() to getgrouplist() output. Closes #487 See merge request tpo/core/arti!548
| * fs-mistrust: add getegid() to getgrouplist() output.Nick Mathewson2022-05-271-0/+6
| | | | | | | | | | | | | | | | | | | | This fixes a unit test failure in weird environments (like some containers) where the current effective GID is not included in the list of current groups. Closes #487. Bug reported by @sjm217.
* | Merge branch 'chore/integrate_cargo_sort' into 'main'Ian Jackson2022-05-301-1/+1
|\ \ | | | | | | | | | | | | | | | | | | Lexically sort Cargo.toml dependencies Closes #490 See merge request tpo/core/arti!549
| * | Lexically sort Cargo.toml dependenciesOrhun Parmaksız2022-05-281-1/+1
| |/ | | | | | | | | | | Utilize cargo-sort: https://github.com/DevinR528/cargo-sort Signed-off-by: Orhun Parmaksız <[email protected]>
* | Merge branch 'mistrust_osstring_limitation' into 'main'Ian Jackson2022-05-302-4/+13
|\ \ | |/ |/| | | | | fs-mistrust: Document problems with non-UTF8 OsString in toml See merge request tpo/core/arti!538
| * fs-mistrust: Document problems with non-UTF8 OsString in tomlNick Mathewson2022-05-262-4/+13
| | | | | | | | | | | | | | | | | | | | | | It turns out that the `toml` crate can't handle OsString, since `toml` doesn't support serialize_newtype_variant, and the `serde` crate tries to serialize OsString using that method. In this commit we document that limitation, and test that we can at least round-trip through json. Found by inspecting test coverage.
* | Semantic version changes for Arti 0.4.0 releaseNick Mathewson2022-05-271-1/+1
|/ | | | | | | | | | | | | | | | | | | | | | | | | | I followed the following procedure to make these changes: * I used maint/changed_crates to find out which crates had changed since 0.3.0. * I used grep and maint/list_crates to sort those crates in topological (dependency) order. * I looked through semver_status to find which crates were listed as having semver-relevant changes (new APIs and breaking changes). * I scanned through the git logs of the crates with no semver-relevant changes listed to confirm that, indeed, they had no changes. For those crates, I incremented their patch-level version _without_ changing the version that other crates depend on. * I scanned through the git logs of the crates with no semver-relevant changes listed to confirm that, indeed, they had no obvious breaking changes. * I treated all crates that depend on `arti` and/or `arti-client` as having breaking changes. * I identified crates that depend on crates that have changed, even if they have not changed themselves, and identified them as having a non-breaking change. * For all of the crates, I used `cargo set-version -p $CRATE --bump $STATUS` (where `STATUS` is `patch` or `minor`) to update the versions, and the depended-upon versions.
* Merge branch 'standardise-shell' into 'main'Nick Mathewson2022-05-261-7/+17
|\ | | | | | | | | | | | | Standardise shell Closes #425 See merge request tpo/core/arti!533
| * update readmestrinity-1686a2022-05-251-7/+17
| |
* | fs-mistrust: allow symlinks to have any permissionsAlex Xu (Hello71)2022-05-252-1/+12
|/
* Use serde attrs instead of manual implsNick Mathewson2022-05-242-28/+14
|
* Make fs-mistrust configurable from the top level.Nick Mathewson2022-05-241-1/+1
| | | | | | This change requires a little refactoring of TorClientBuilder: now, instead of enabling or disabling mistrust, it enables or disables the decision to _override_ the mistrust in the config.
* Write custom serde impls for Trusted{User,Group}Nick Mathewson2022-05-243-11/+322
| | | | | | | | | | | | | | | | We support all of the following (in TOML notation): ``` user = "rose" # by name user = 413 # by ID user = false # no user user = ":current" # A 'special' user. user = { name: "rose" } user = { id: 413 } user = { special: ":none" } user = { special: ":current" } ```
* Add serde derives for MistrustBuilder.Nick Mathewson2022-05-243-0/+17
| | | | | | The Group and User (de)serialization is pretty ugly, and I can't vouch for the correcness of MistrustBuilder. I will seek feedback before I proceed.
* fs-mistrust: Add Group and User types.Nick Mathewson2022-05-244-24/+196
| | | | | This will help make the actual configuration more serializable, I hope.
* fs-mistrust: make Mistrust have a corresponding Builder type.Nick Mathewson2022-05-245-130/+198
| | | | | This is an approximately minimal revision to get Builder in place; subsequent commits will clean up the API.
* fs-mistrust: rename fieldsNick Mathewson2022-05-242-15/+15
| | | | | This renaming will make things slightly simpler for declaring a builder.
* Merge branch 'use-fs-mistrust'Nick Mathewson2022-05-094-21/+205
|\
| * Loosen checking for readable files within target directories.Nick Mathewson2022-05-092-14/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If the target directory itself is unreadable by untrusted users, then its contents can't be read[*] by them regardless of their permissions. If the target directory _is_ readable, then _it_ will be rejected if we are forbidding readable objects. (And if we aren't we don't care if the contents are readable.) A similar argument would apply to writable objects within an unreadable target directory. We're not making that argument, since such contents are likelier to be a mistake. [*] Unless they're hard-linked; see comments in "Limitations" section.
| * fs-mistrust: add various methods.Nick Mathewson2022-05-092-7/+174
| | | | | | | | | | | | | | | | | | | | | | This includes: * a CachedDir::join method. * functions to read and write from provided filenames in a CachedDir. * a method to tell whether a fs-mistrust error is about bad file permissions, or failure to inspect file permissions or some other kind of IO problem.
| * Derive Clone and Debug for CheckedDir.Nick Mathewson2022-05-051-0/+1
| |
* | Update README.md files (automated).Nick Mathewson2022-05-061-2/+223
| |
* | Fix typos (using the typos-cli tool).Nick Mathewson2022-05-041-1/+1
|/
* fs-mistrust: write a lot about TOCTOU issues.Nick Mathewson2022-05-034-22/+70
|
* fs-mistrust: Rename SecureDir to CheckedDir.Nick Mathewson2022-05-033-24/+24
|
* fs-mistrust: Add a dangerously_trust_everyone method.Nick Mathewson2022-05-032-1/+59
| | | | | | | This helps make it possible to use `SecureDir` (name pending) even when we want to disable permissions checks. Otherwise, optional permission checking would require users of this crate to maintain separate code paths for the "check" and "don't check" cases.
* fs-mistrust: split check_one into two functions.Nick Mathewson2022-05-031-46/+64
| | | | This will make a "trust_everyone" easier to implement.
* fs-mistrust: Make self-named groups trusted by default.Nick Mathewson2022-05-031-23/+32
|
* Work around CI config weirdness.Nick Mathewson2022-05-031-0/+5
| | | | | Some of our builders put root into gid 0, but getgroups() doesn't actually give any result.
* fs-mistrust: Add code to make a self-named group "trusted".Nick Mathewson2022-05-033-0/+225
| | | | | | | | | | | | | | This required a bit of poking through the `users` crate, to mess with the user and group dbs. The original goal was to "trust the group with the same name as us", but it turned into a bit of a production, since: * We want to take our own name from $USER, assuming that matches our uid. (Otherwise we want to ask getpwuid_r().) * We only want to trust the group if we are actually a member of that group. * We want to cache this information. * We want to test this code.
* fs-mistrust: refactor ResolvePath to avoid temporary changes.Nick Mathewson2022-05-031-36/+31
| | | | | | | | Previously we would temporarily put self.resolved into an invalid state by adding a path component that might be a symlink. With this change, we create a new temporary path object (using Cow to avoid unnecessary allocations) and only conditionally replace self.resolved.
* fs-mistrust: clarify and test behavior for ".." past the fs root.Nick Mathewson2022-05-031-1/+31
|
* Add a must_use (suggested by @diziet).Nick Mathewson2022-05-031-0/+1
|
* fs-mistrust: more examples, documentation.Nick Mathewson2022-05-032-6/+112
|
* Add a SecureDir API for checked access to directoriesNick Mathewson2022-05-034-3/+266
| | | | | | The only way to get a SecureDir is by having checked a directory. Once you have one, it encourages you to open and create files and directories with the right permissions, and checks them for you.
* Add functionality to inspect directory content permissionsNick Mathewson2022-05-035-29/+133
| | | | Also, explain _why_ this is pretty important.
* By default, forbid special files.Nick Mathewson2022-05-032-17/+40
|
* Support for "create missing directory".Nick Mathewson2022-05-032-2/+87
|
generated by cgit v1.2.3 (git 2.46.0) at 2026-08-27 04:07:43 +0000