urma-io 0.3.3

Bounded file reads and atomic writes for URMA
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126

use crate::{Access, Error, files::read_into};
use std::{
    fs::{File, OpenOptions},
    io,
    os::unix::fs::{DirBuilderExt, OpenOptionsExt, PermissionsExt},
    path::Path,
};
use zeroize::Zeroizing;

pub fn create_private_directory(path: &Path) -> Result<(), io::Error> {
    std::fs::DirBuilder::new().mode(0o700).create(path)
}

pub fn create_file(path: &Path, access: Access) -> Result<File, io::Error> {
    let mode = match access {
        Access::Private => 0o600,
        Access::Shared => 0o640,
    };
    OpenOptions::new()
        .write(true)
        .create_new(true)
        .mode(mode)
        .custom_flags(libc::O_NOFOLLOW)
        .open(path)
}

fn open_regular(path: &Path) -> Result<File, Error> {
    let file = OpenOptions::new()
        .read(true)
        .custom_flags(libc::O_NOFOLLOW | libc::O_NONBLOCK)
        .open(path)?;
    if !file.metadata()?.is_file() {
        return Err(io::Error::new(
            io::ErrorKind::InvalidInput,
            "only regular input files are supported",
        )
        .into());
    }
    Ok(file)
}

pub fn read_regular(path: &Path, limit: usize) -> Result<Zeroizing<Vec<u8>>, Error> {
    let file = open_regular(path)?;
    let mut bytes = Zeroizing::new(Vec::new());
    read_into(file, limit, &mut bytes)?;
    Ok(bytes)
}

pub fn read_private(path: &Path, limit: usize) -> Result<Zeroizing<Vec<u8>>, Error> {
    let file = File::open(path)?;
    if file.metadata()?.permissions().mode() & 0o077 != 0 {
        return Err(Error::PrivatePermissions);
    }
    let mut bytes = Zeroizing::new(Vec::new());
    read_into(file, limit, &mut bytes)?;
    Ok(bytes)
}

fn admin_owned(metadata: &std::fs::Metadata) -> Result<(), Error> {
    use std::os::unix::fs::MetadataExt;
    // SAFETY: geteuid has no preconditions and cannot fail.
    let owner_trusted = metadata.uid() == 0 || metadata.uid() == unsafe { libc::geteuid() };
    match owner_trusted && metadata.mode() & 0o022 == 0 {
        true => Ok(()),
        false => Err(Error::PrivatePermissions),
    }
}

pub fn open_private_append(path: &Path) -> Result<File, Error> {
    use std::os::{fd::AsRawFd, unix::fs::MetadataExt};
    let file = OpenOptions::new()
        .append(true)
        .custom_flags(libc::O_NOFOLLOW | libc::O_NONBLOCK)
        .open(path)?;
    let metadata = file.metadata()?;
    if !metadata.is_file() {
        return Err(io::Error::new(
            io::ErrorKind::InvalidInput,
            "only regular private files can be appended to",
        )
        .into());
    }
    // SAFETY: geteuid has no preconditions and cannot fail.
    let owned = metadata.uid() == unsafe { libc::geteuid() };
    if metadata.nlink() != 1 || !owned || metadata.mode() & 0o077 != 0 {
        return Err(Error::PrivatePermissions);
    }
    let fd = file.as_raw_fd();
    // SAFETY: `fd` is open for the life of `file`; F_GETFL/F_SETFL only touch its flags.
    let flags = unsafe { libc::fcntl(fd, libc::F_GETFL) };
    // SAFETY: as above.
    if flags < 0 || unsafe { libc::fcntl(fd, libc::F_SETFL, flags & !libc::O_NONBLOCK) } < 0 {
        return Err(io::Error::last_os_error().into());
    }
    Ok(file)
}

pub fn read_admin(path: &Path, limit: usize) -> Result<Zeroizing<Vec<u8>>, Error> {
    let file = open_regular(path)?;
    admin_owned(&file.metadata()?)?;
    let mut bytes = Zeroizing::new(Vec::new());
    read_into(file, limit, &mut bytes)?;
    Ok(bytes)
}

pub fn check_admin(path: &Path) -> Result<(), Error> {
    let metadata = std::fs::symlink_metadata(path)?;
    if metadata.file_type().is_symlink() {
        return Err(io::Error::new(
            io::ErrorKind::InvalidInput,
            "administrator-owned paths must not be symlinks",
        )
        .into());
    }
    admin_owned(&metadata)
}

pub fn read_shared(path: &Path, limit: usize) -> Result<Zeroizing<Vec<u8>>, Error> {
    let file = open_regular(path)?;
    if file.metadata()?.permissions().mode() & 0o027 != 0 {
        return Err(Error::PrivatePermissions);
    }
    let mut bytes = Zeroizing::new(Vec::new());
    read_into(file, limit, &mut bytes)?;
    Ok(bytes)
}