Module bound_file 

Read-only files opened beneath a trusted root without following links.

Functions

copy_file_beneath

Copy a regular file between two trusted roots without resolving a path after its parent has been validated. The destination must not already exist.

create_symlink_beneath

Create a symlink below a trusted root without following or replacing any parent component. The target is stored verbatim and is never resolved.

ensure_directory_beneath

Ensure a directory exists beneath a trusted root without following symlinks in any component.

open_directory_handle

Open an absolute directory as a live handle for operations that must keep using the same directory even if an attacker renames a path component.

open_file_beneath

Open a regular, single-link file through bound directory handles. root must be an absolute, previously resolved trusted root.

open_lock_file_beneath

Open an advisory lock file beneath a trusted root without following symlinks. The caller owns the returned file and can hold an exclusive lock with fs2::FileExt for the duration of a compound filesystem operation.

set_command_working_directory

Make a child process start with its working directory bound to directory. The descriptor remains open through exec, so the fchdir runs before the close-on-exec flag can take effect and avoids a path-based cwd race.

validate_directory_beneath

Validate an existing directory beneath a trusted root without following symlinks in any component.

write_file_beneath

Write a new file beneath a trusted root while directory and file handles remain bound to that root. Existing files (including symlinks) are never replaced.