summaryrefslogtreecommitdiff
path: root/crates/fs-mistrust
Commit message (Collapse)AuthorAgeFilesLines
...
* | fs-mistrust: Handle windows prefixes specially.Nick Mathewson2022-08-261-11/+50
|/ | | | | | | | | | | | On Windows, paths can have a "prefix", like `C:` or `\\server\share`. Attempts to get metadata for these prefixes appear to fail with `ERROR_INVALID_FUNCTION`, since they are not files. This patch teaches fs-mistrust about prefixes on Windows, and tells it that attempts to find their metadata are allowed to fail. Doing this may solve part of #557.
* Bump toml dependencyIan Jackson2022-08-251-1/+1
| | | | | | | | | | | | We need 60b874308e6792a73cc00517a60bbef60a12e3cc Mixed type arrays (#358) for a test case in tor-config. While we're here, drop the dupe entry in tor-config. (In principle we could make this increase only in tor-config's dev-dependencies, but that seems unnecessarily fiddly.)
* enable doc_auto_cfg feature on every crate when documenting for docs.rstrinity-1686a2022-08-242-0/+4
|
* fix fs-misstrust on androidtrinity-1686a2022-08-083-12/+45
| | | | | | it would fail to link at runtime due to missing getgrnam_r in bionic and then it would fail again because some directory is group writeable
* Now that versions have bumped, remove semver.md files.Nick Mathewson2022-08-011-2/+0
|
* Bump minor versions on all crates that have had breaking changes.Nick Mathewson2022-08-011-1/+1
| | | | | | | | | | | | | | | | | | | | | | Done with these commands: ``` cargo set-version -p fs-mistrust --bump minor cargo set-version -p tor-bytes --bump minor cargo set-version -p tor-socksproto --bump minor cargo set-version -p tor-cert --bump minor cargo set-version -p tor-linkspec --bump minor cargo set-version -p tor-cell --bump minor cargo set-version -p tor-netdir --bump minor cargo set-version -p tor-persist --bump minor cargo set-version -p tor-chanmgr --bump minor cargo set-version -p tor-guardmgr --bump minor cargo set-version -p tor-circmgr --bump minor cargo set-version -p tor-dirclient --bump minor cargo set-version -p tor-dirmgr --bump minor cargo set-version -p arti-client --bump minor cargo set-version -p arti --bump minor ```
* update semver status filetrinity-1686a2022-07-301-0/+1
|
* fix runtime issues on iostrinity-1686a2022-07-301-2/+7
|
* remove dependancy 'users' on iOStrinity-1686a2022-07-303-10/+22
|
* fix nighly clippytrinity-1686a2022-07-231-3/+2
|
* fs-mistrust: accept "n" as "no".Nick Mathewson2022-07-191-2/+2
|
* Semver tweaks from review.Ian Jackson2022-07-191-1/+1
| | | | These aren't user facing comments, but getting them right will help us write better changelogs.
* fs-mistrust: API to disable based on environmentNick Mathewson2022-07-194-5/+218
| | | | | | | By default we look at `$FS_MISTRUST_DISABLE_PERMISSIONS_CHECKS`. Optionally, the user can provide another variable as well, or disable looking at the environment entirely.
* Remove semver.md files now that 0.5.0 is outNick Mathewson2022-06-241-1/+0
|
* Bump crate and dependency versions.Nick Mathewson2022-06-241-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | These were done with the following commands: ``` cargo set-version -p tor-basic-utils --bump patch cargo set-version -p fs-mistrust --bump minor cargo set-version -p tor-error --bump patch cargo set-version -p tor-config --bump patch cargo set-version -p tor-units --bump patch cargo set-version -p tor-rtcompat --bump minor cargo set-version -p tor-llcrypto --bump patch cargo set-version -p tor-bytes --bump minor cargo set-version -p tor-socksproto --bump minor cargo set-version -p tor-cert --bump minor cargo set-version -p tor-cell --bump minor cargo set-version -p tor-proto --bump minor cargo set-version -p tor-netdoc --bump patch cargo set-version -p tor-netdir --bump minor cargo set-version -p tor-persist --bump patch cargo set-version -p tor-chanmgr --bump minor cargo set-version -p tor-guardmgr --bump minor cargo set-version -p tor-circmgr --bump patch cargo set-version -p tor-dirclient --bump patch cargo set-version -p tor-dirmgr --bump minor cargo set-version -p arti-client --bump patch cargo set-version -p arti --bump minor cargo set-version -p arti-bench --bump minor cargo set-version -p arti-testing --bump minor ```
* Run maint/add_warning crates/*/src/{lib,main}.rsIan Jackson2022-06-231-0/+3
| | | | Update all lint blocks
* fs-mistrust: convert Io error variant to a struct.Nick Mathewson2022-06-221-5/+17
|
* Editorial improvements on fs-mistrust errorsNick Mathewson2022-06-224-23/+20
| | | | | | These changes make sure that the errors conform to our preferred style, and include a description of what exactly we were doing when something went wrong.
* Do not include error source() in display() format.Nick Mathewson2022-06-211-1/+1
| | | | | | | | | According to doc/Errors.md, and in keeping with current best practices, we should not include display an error's `source()` as part of that error's display method. Instead, we should let the caller decide to call source() and display that error in turn. Part of #323.
* Merge branch 'better-fs-mistrust-badpermissions-string' into 'main'Ian Jackson2022-06-024-29/+43
|\ | | | | | | | | fs-mistrust: Improve BadPermission string See merge request tpo/core/arti!554
| * fs-mistrust: Improve BadPermission stringAlex Xu (Hello71)2022-05-313-17/+31
| | | | | | | | | | | | | | | | | | To me, "Incorrect permissions on file or directory /path: g=w o=w" implies that the current permissions on /path are 022. Change the message to "Incorrect permissions: /path is u=rwx,g=rwx,o=rwx; need g-w,o-w", which is closer to chmod syntax and is more useful in non-interactive environments such as CI and support.
| * fs-mistrust: BadPermission(_, _) -> BadPermission(..)Alex Xu (Hello71)2022-05-313-12/+12
| | | | | | | | Next commit adds another parameter to Error::BadPermission.
* | Merge branch 'lint' into 'main'Ian Jackson2022-05-311-0/+3
|\ \ | | | | | | | | | | | | | | | | | | lints: Make lint blocks consistent and ensure they stay that way Closes #469 See merge request tpo/core/arti!557
| * | lints: Add let_unit_value allow to all cratesIan Jackson2022-05-311-0/+1
| | | | | | | | | | | | | | | From running add_warning, with manual picking of the right hunks/lines.
| * | lints: Add lint block delimiters to every crateIan Jackson2022-05-311-0/+2
| |/ | | | | | | | | | | This was the result of: maint/add_warning crates/*/src/{lib,main}.rs and then manually curating the results.
* / mistrust: Canonicalise prefix from Some("") to NoneIan Jackson2022-05-301-0/+1
|/ | | | | This allows us to add the proper default example to the arti example config file.
* Merge branch 'bug487' into 'main'Ian Jackson2022-05-301-0/+6
|\ | | | | | | | | | | | | fs-mistrust: add getegid() to getgrouplist() output. Closes #487 See merge request tpo/core/arti!548
| * fs-mistrust: add getegid() to getgrouplist() output.Nick Mathewson2022-05-271-0/+6
| | | | | | | | | | | | | | | | | | | | This fixes a unit test failure in weird environments (like some containers) where the current effective GID is not included in the list of current groups. Closes #487. Bug reported by @sjm217.
* | Merge branch 'chore/integrate_cargo_sort' into 'main'Ian Jackson2022-05-301-1/+1
|\ \ | | | | | | | | | | | | | | | | | | Lexically sort Cargo.toml dependencies Closes #490 See merge request tpo/core/arti!549
| * | Lexically sort Cargo.toml dependenciesOrhun Parmaksız2022-05-281-1/+1
| |/ | | | | | | | | | | Utilize cargo-sort: https://github.com/DevinR528/cargo-sort Signed-off-by: Orhun Parmaksız <[email protected]>
* | Merge branch 'mistrust_osstring_limitation' into 'main'Ian Jackson2022-05-302-4/+13
|\ \ | |/ |/| | | | | fs-mistrust: Document problems with non-UTF8 OsString in toml See merge request tpo/core/arti!538
| * fs-mistrust: Document problems with non-UTF8 OsString in tomlNick Mathewson2022-05-262-4/+13
| | | | | | | | | | | | | | | | | | | | | | It turns out that the `toml` crate can't handle OsString, since `toml` doesn't support serialize_newtype_variant, and the `serde` crate tries to serialize OsString using that method. In this commit we document that limitation, and test that we can at least round-trip through json. Found by inspecting test coverage.
* | Semantic version changes for Arti 0.4.0 releaseNick Mathewson2022-05-271-1/+1
|/ | | | | | | | | | | | | | | | | | | | | | | | | | I followed the following procedure to make these changes: * I used maint/changed_crates to find out which crates had changed since 0.3.0. * I used grep and maint/list_crates to sort those crates in topological (dependency) order. * I looked through semver_status to find which crates were listed as having semver-relevant changes (new APIs and breaking changes). * I scanned through the git logs of the crates with no semver-relevant changes listed to confirm that, indeed, they had no changes. For those crates, I incremented their patch-level version _without_ changing the version that other crates depend on. * I scanned through the git logs of the crates with no semver-relevant changes listed to confirm that, indeed, they had no obvious breaking changes. * I treated all crates that depend on `arti` and/or `arti-client` as having breaking changes. * I identified crates that depend on crates that have changed, even if they have not changed themselves, and identified them as having a non-breaking change. * For all of the crates, I used `cargo set-version -p $CRATE --bump $STATUS` (where `STATUS` is `patch` or `minor`) to update the versions, and the depended-upon versions.
* Merge branch 'standardise-shell' into 'main'Nick Mathewson2022-05-261-7/+17
|\ | | | | | | | | | | | | Standardise shell Closes #425 See merge request tpo/core/arti!533
| * update readmestrinity-1686a2022-05-251-7/+17
| |
* | fs-mistrust: allow symlinks to have any permissionsAlex Xu (Hello71)2022-05-252-1/+12
|/
* Use serde attrs instead of manual implsNick Mathewson2022-05-242-28/+14
|
* Make fs-mistrust configurable from the top level.Nick Mathewson2022-05-241-1/+1
| | | | | | This change requires a little refactoring of TorClientBuilder: now, instead of enabling or disabling mistrust, it enables or disables the decision to _override_ the mistrust in the config.
* Write custom serde impls for Trusted{User,Group}Nick Mathewson2022-05-243-11/+322
| | | | | | | | | | | | | | | | We support all of the following (in TOML notation): ``` user = "rose" # by name user = 413 # by ID user = false # no user user = ":current" # A 'special' user. user = { name: "rose" } user = { id: 413 } user = { special: ":none" } user = { special: ":current" } ```
* Add serde derives for MistrustBuilder.Nick Mathewson2022-05-243-0/+17
| | | | | | The Group and User (de)serialization is pretty ugly, and I can't vouch for the correcness of MistrustBuilder. I will seek feedback before I proceed.
* fs-mistrust: Add Group and User types.Nick Mathewson2022-05-244-24/+196
| | | | | This will help make the actual configuration more serializable, I hope.
* fs-mistrust: make Mistrust have a corresponding Builder type.Nick Mathewson2022-05-245-130/+198
| | | | | This is an approximately minimal revision to get Builder in place; subsequent commits will clean up the API.
* fs-mistrust: rename fieldsNick Mathewson2022-05-242-15/+15
| | | | | This renaming will make things slightly simpler for declaring a builder.
* Merge branch 'use-fs-mistrust'Nick Mathewson2022-05-094-21/+205
|\
| * Loosen checking for readable files within target directories.Nick Mathewson2022-05-092-14/+30
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | If the target directory itself is unreadable by untrusted users, then its contents can't be read[*] by them regardless of their permissions. If the target directory _is_ readable, then _it_ will be rejected if we are forbidding readable objects. (And if we aren't we don't care if the contents are readable.) A similar argument would apply to writable objects within an unreadable target directory. We're not making that argument, since such contents are likelier to be a mistake. [*] Unless they're hard-linked; see comments in "Limitations" section.
| * fs-mistrust: add various methods.Nick Mathewson2022-05-092-7/+174
| | | | | | | | | | | | | | | | | | | | | | This includes: * a CachedDir::join method. * functions to read and write from provided filenames in a CachedDir. * a method to tell whether a fs-mistrust error is about bad file permissions, or failure to inspect file permissions or some other kind of IO problem.
| * Derive Clone and Debug for CheckedDir.Nick Mathewson2022-05-051-0/+1
| |
* | Update README.md files (automated).Nick Mathewson2022-05-061-2/+223
| |
* | Fix typos (using the typos-cli tool).Nick Mathewson2022-05-041-1/+1
|/
* fs-mistrust: write a lot about TOCTOU issues.Nick Mathewson2022-05-034-22/+70
|
generated by cgit v1.2.3 (git 2.46.0) at 2026-08-28 01:58:38 +0000