jschoubben
b92fb68116
mesh/merge-gate pass: builds mesh-host → ace, g14, novox, shanks; no bus step; every machine composes with the change as it did without (4 of 4 compose)
mesh/repo-check pass: its merge-check.sh passed
mesh/delivery delivered
mesh/delivery-group group fix/358-judge-directories-read-only delivered: every member is delivered
Once a mesh directory's mode and owner go only through a walk that follows no link another account could make, a directory behind such a link is refused and its module gated: on the control-node that could stop the controller. The operator is to be told which directories that walk would refuse on every node before it lands. So the engine judges the declaration it keeps with the same walk, making and changing nothing: on a signed ask from the controller (mesh.node.<node>.ask.judge-directories, held to the hand-over's checks) and as `nox-mesh-host judge-directories` at the machine.
74 lines
2.2 KiB
Go
74 lines
2.2 KiB
Go
//go:build !linux
|
|
|
|
package apply
|
|
|
|
// Where there is no openat with O_NOFOLLOW to rely on, the check before use is all: a link below a home is
|
|
// refused, and the call is made by path. The node-engine runs on Linux; this keeps the package building.
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
)
|
|
|
|
func chmodUnder(home, path string, mode os.FileMode) error {
|
|
if err := refuseLinksUnderHome(path); err != nil {
|
|
return err
|
|
}
|
|
return os.Chmod(path, mode)
|
|
}
|
|
|
|
func chmodUnderAs(home, path string, mode os.FileMode, _ int) error {
|
|
return chmodUnder(home, path, mode)
|
|
}
|
|
|
|
const kindDir = 1
|
|
|
|
func chownUnder(home, path string, uid, gid int) error {
|
|
if err := refuseLinksUnderHome(path); err != nil {
|
|
return err
|
|
}
|
|
return os.Lchown(path, uid, gid)
|
|
}
|
|
|
|
func readUnder(home, path string) ([]byte, error) {
|
|
if err := refuseLinksUnderHome(path); err != nil {
|
|
return nil, err
|
|
}
|
|
return os.ReadFile(path)
|
|
}
|
|
|
|
func mkdirAllUnder(home, dir string, mode os.FileMode) ([]string, error) {
|
|
if err := refuseLinksUnderHome(dir); err != nil {
|
|
return nil, err
|
|
}
|
|
var made []string
|
|
for d := filepath.Clean(dir); d != home; d = filepath.Dir(d) {
|
|
if _, err := os.Lstat(d); err == nil {
|
|
break
|
|
}
|
|
made = append(made, d)
|
|
}
|
|
return made, os.MkdirAll(dir, mode)
|
|
}
|
|
|
|
func writeUnder(home, path string, content []byte, mode os.FileMode) error {
|
|
if err := refuseLinksUnderHome(path); err != nil {
|
|
return err
|
|
}
|
|
return writeAtomicallyByPath(path, content, mode)
|
|
}
|
|
|
|
// giveHandedOver is refused where there is no openat with O_NOFOLLOW: a handed-over directory is never changed by
|
|
// path (novox/hq issue 356). The node-engine runs on Linux.
|
|
func giveHandedOver(path string, _ os.FileMode, _, _ int, _ bool) (os.FileMode, int, int, error) {
|
|
return 0, 0, 0, &PlacementRefusedError{Path: path, Why: "a handed-over directory is changed only through a " +
|
|
"descriptor that followed no link, which this system cannot open"}
|
|
}
|
|
|
|
// judgeMeshDir refuses where there is no openat with O_NOFOLLOW (novox/hq issue 358). The node-engine runs on
|
|
// Linux.
|
|
func judgeMeshDir(path string) error {
|
|
return &PlacementRefusedError{Path: path, Why: "a mesh directory is judged only by a walk that follows no link " +
|
|
"another account could make, which this system cannot do"}
|
|
}
|