Expand description
The local allowlist. The model sees the local filesystem only through
this module, and this module only ever resolves paths inside the
directories the user listed in local.allowed_dirs.
A path is checked once, when it is resolved, and then reached from a
handle on its allowed root one component at a time without following a
symlink (openat with O_NOFOLLOW). Something that swaps a symlink in
between the check and the access — a sync tool, an editor, another
process — gets a refusal, not a file outside the allowlist.
Structs§
- Local
Entry - Local
Scope - Part
File - A download in progress: a temporary file in its destination folder,
held by a handle on that folder. Dropped without
commit, it is removed.