Module secure_fs 

Creating report files and directories that only their owner can read, and refusing artifact names that could escape the report directory.

Why a report is owner-only

A report is a forensic artifact. Redaction removes user content from the strings, but the things travelling beside them are not redactable and were never meant to be: a preserved artifact is a verbatim copy of the adopter’s store, and a minidump is the crashed process’s entire address space — encryption keys, session tokens, and whatever the user was working on, all of it live in memory at the moment of the fault.

Left at the process umask, those land at 0644 inside a 0755 directory, which on any multi-user host means every local account can read them. So the recorder creates its own directories at 0700 and its own files at 0600, and never widens either.

Why temporary files are created exclusively

Every durable write goes through a temporary sibling. File::create on a predictable name follows a symlink planted there first, so an attacker who can write to the reports directory could redirect the recorder’s own write — running as the reporting process — into a file of their choosing.

create_new(true) is O_CREAT | O_EXCL, which POSIX requires to fail on a symlink, so the plant is refused rather than followed. The names are also unpredictable, so squatting them to deny service is guesswork rather than arithmetic.

Platform coverage

The mode bits are a unix mechanism, and that is where this is enforced. On Windows a created file or directory takes the inherited ACL of its parent, and this crate does not set an explicit DACL — so on Windows the reports directory is exactly as private as the location the adopter chose for it. Under a user profile (%LOCALAPPDATA%) that is already per-user; somewhere world-writable it is not, and no code here changes that.

Exclusive creation, and therefore the symlink-plant refusal, applies on every platform.

Constants

TEMP_INFIX

The infix marking a path as one of the recorder’s own temporaries.

Functions

validate_artifact_name

Validate an artifact name supplied by the adopter.