jschoubben
e3c3bb37d0
A mesh directory outside every home was chmodded and chowned by path, so a parent turned into a link between two applies carried root's chmod and chown to the link's target. It is now made and changed through the descriptor of the walk from / that follows a link only root alone could have made. A directory that walk refuses is a refusal like the placement guard's (review 47): judged before anything is applied, and again when the directory is applied, used as found or not; refused at either point it gates its module and refuses what is below it, so no file is written into the link's target and the report does not say everything was attempted.
85 lines
2.7 KiB
Go
85 lines
2.7 KiB
Go
//go:build !linux
|
|
|
|
package apply
|
|
|
|
// Where there is no openat with O_NOFOLLOW to rely on, the check before use is all: a link below a home is
|
|
// refused, and the call is made by path. The node-engine runs on Linux; this keeps the package building.
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
|
|
"github.com/novox/mesh-host/internal/declaration"
|
|
)
|
|
|
|
func chmodUnder(home, path string, mode os.FileMode) error {
|
|
if err := refuseLinksUnderHome(path); err != nil {
|
|
return err
|
|
}
|
|
return os.Chmod(path, mode)
|
|
}
|
|
|
|
func chmodUnderAs(home, path string, mode os.FileMode, _ int) error {
|
|
return chmodUnder(home, path, mode)
|
|
}
|
|
|
|
const kindDir = 1
|
|
|
|
func chownUnder(home, path string, uid, gid int) error {
|
|
if err := refuseLinksUnderHome(path); err != nil {
|
|
return err
|
|
}
|
|
return os.Lchown(path, uid, gid)
|
|
}
|
|
|
|
func readUnder(home, path string) ([]byte, error) {
|
|
if err := refuseLinksUnderHome(path); err != nil {
|
|
return nil, err
|
|
}
|
|
return os.ReadFile(path)
|
|
}
|
|
|
|
func mkdirAllUnder(home, dir string, mode os.FileMode) ([]string, error) {
|
|
if err := refuseLinksUnderHome(dir); err != nil {
|
|
return nil, err
|
|
}
|
|
var made []string
|
|
for d := filepath.Clean(dir); d != home; d = filepath.Dir(d) {
|
|
if _, err := os.Lstat(d); err == nil {
|
|
break
|
|
}
|
|
made = append(made, d)
|
|
}
|
|
return made, os.MkdirAll(dir, mode)
|
|
}
|
|
|
|
func writeUnder(home, path string, content []byte, mode os.FileMode) error {
|
|
if err := refuseLinksUnderHome(path); err != nil {
|
|
return err
|
|
}
|
|
return writeAtomicallyByPath(path, content, mode)
|
|
}
|
|
|
|
// giveHandedOver is refused where there is no openat with O_NOFOLLOW: a handed-over directory is never changed by
|
|
// path (novox/hq issue 356). The node-engine runs on Linux.
|
|
func giveHandedOver(path string, _ os.FileMode, _, _ int, _ bool) (os.FileMode, int, int, error) {
|
|
return 0, 0, 0, &PlacementRefusedError{Path: path, Why: "a handed-over directory is changed only through a " +
|
|
"descriptor that followed no link, which this system cannot open"}
|
|
}
|
|
|
|
// judgeMeshDir refuses where there is no openat with O_NOFOLLOW (novox/hq issue 358). The node-engine runs on
|
|
// Linux.
|
|
func judgeMeshDir(path string) error {
|
|
return &PlacementRefusedError{Path: path, Why: "a mesh directory is judged only by a walk that follows no link " +
|
|
"another account could make, which this system cannot do"}
|
|
}
|
|
|
|
// meshDirsByDescriptor is false where there is no openat with O_NOFOLLOW: a mesh directory is changed by path, as
|
|
// before novox/hq issue 358. The node-engine runs on Linux.
|
|
const meshDirsByDescriptor = false
|
|
|
|
func applyMeshDirectory(r *declaration.Directory, out Outcome, _ os.FileMode, _ bool) (Outcome, error) {
|
|
return out, &PlacementRefusedError{Path: r.Path, Why: "a mesh directory is changed only through a descriptor " +
|
|
"that followed no link another account could make, which this system cannot open"}
|
|
}
|