Merge branch 'use-fs-mistrust' (4262e9d0) · Commits · The Tor Project / Core / Arti

.gitlab-ci.yml

+3 −0

Original line number	Diff line number	Diff line
		@@ -132,6 +132,9 @@ build-repro:
		integration:
		stage: test
		image: debian:stable-slim
		variables:
		# The build environment here runs as root and seems to have umask 000.
		ARTI_FS_DISABLE_PERMISSION_CHECKS: "true"
		script:
		- apt update
		- apt install -y tor git python3 curl dnsutils

Cargo.lock

+4 −0

Original line number	Diff line number	Diff line
		@@ -81,6 +81,7 @@ dependencies = [
		"clap",
		"config",
		"derive_builder_fork_arti",
		"fs-mistrust",
		"futures",
		"libc",
		"notify",
		@@ -131,6 +132,7 @@ dependencies = [
		"derive_more",
		"directories",
		"educe",
		"fs-mistrust",
		"futures",
		"humantime-serde",
		"once_cell",
		@@ -3470,6 +3472,7 @@ dependencies = [
		"educe",
		"event-listener",
		"float_eq",
		"fs-mistrust",
		"fslock",
		"futures",
		"futures-await-test",
		@@ -3663,6 +3666,7 @@ dependencies = [
		name = "tor-persist"
		version = "0.3.0"
		dependencies = [
		"fs-mistrust",
		"fslock",
		"sanitize-filename",
		"serde",

crates/arti-client/Cargo.toml

+1 −0

Original line number	Diff line number	Diff line
		@@ -31,6 +31,7 @@ error_detail = []
		experimental-api = []

		[dependencies]
		fs-mistrust = { path = "../fs-mistrust", version = "0.1.0" }
		safelog = { path = "../safelog", version = "0.1.0" }
		tor-basic-utils = { path = "../tor-basic-utils", version = "0.3.0"}
		tor-circmgr = { path = "../tor-circmgr", version = "0.3.0"}

crates/arti-client/src/builder.rs

+30 −0

Original line number	Diff line number	Diff line
		@@ -51,6 +51,8 @@ pub struct TorClientBuilder<R: Runtime> {
		/// How the client should behave when it is asked to do something on the Tor
		/// network before `bootstrap()` is called.
		bootstrap_behavior: BootstrapBehavior,
		/// How the client should decide which file permissions to trust.
		fs_mistrust: Option<fs_mistrust::Mistrust>,
		/// Optional object to construct a DirProvider.
		///
		/// Wrapped in an Arc so that we don't need to force DirProviderBuilder to
		@@ -70,6 +72,7 @@ impl<R: Runtime> TorClientBuilder<R> {
		runtime,
		config: TorClientConfig::default(),
		bootstrap_behavior: BootstrapBehavior::default(),
		fs_mistrust: None,
		dirmgr_builder: Arc::new(DirMgrBuilder {}),
		#[cfg(feature = "dirfilter")]
		dirfilter: None,
		@@ -93,6 +96,31 @@ impl<R: Runtime> TorClientBuilder<R> {
		self
		}

		/// Build an [`TorClient`] that will not validate permissions and
		/// ownership on the filesystem.
		///
		/// By default, these checks are enabled, unless the
		/// `ARTI_FS_DISABLE_PERMISSION_CHECKS` environment variable has been set or
		/// this method has been called.
		pub fn disable_fs_permission_checks(mut self) -> Self {
		let mut mistrust = fs_mistrust::Mistrust::new();
		mistrust.dangerously_trust_everyone();
		self.fs_mistrust = Some(mistrust);
		self
		}

		/// Build an [`TorClient`] that will always validate permissions and
		/// ownership on the filesystem.
		///
		/// By default, these checks are enabled, unless the
		/// `ARTI_FS_DISABLE_PERMISSION_CHECKS` environment variable has been set or
		/// [`disable_fs_permission_checks`](Self::disable_fs_permission_checks)
		/// method has been called.
		pub fn enable_fs_permission_checks(mut self) -> Self {
		self.fs_mistrust = Some(fs_mistrust::Mistrust::new());
		self
		}

		/// Override the default function used to construct the directory provider.
		///
		/// Only available when compiled with the `experimental-api` feature: this
		@@ -146,6 +174,8 @@ impl<R: Runtime> TorClientBuilder<R> {
		self.runtime,
		self.config,
		self.bootstrap_behavior,
		self.fs_mistrust
		.unwrap_or_else(crate::config::default_fs_mistrust),
		self.dirmgr_builder.as_ref(),
		dirmgr_extensions,
		)

crates/arti-client/src/client.rs

+11 −3

Original line number	Diff line number	Diff line
		@@ -88,6 +88,9 @@ pub struct TorClient<R: Runtime> {

		/// Shared boolean for whether we're currently in "dormant mode" or not.
		dormant: Arc<AtomicBool>,

		/// Settings for how we perform permissions checks on the filesystem.
		fs_mistrust: fs_mistrust::Mistrust,
		}

		/// Preferences for whether a [`TorClient`] should bootstrap on its own or not.
		@@ -350,15 +353,17 @@ impl<R: Runtime> TorClient<R> {
		runtime: R,
		config: TorClientConfig,
		autobootstrap: BootstrapBehavior,
		mistrust: fs_mistrust::Mistrust,
		dirmgr_builder: &dyn crate::builder::DirProviderBuilder<R>,
		dirmgr_extensions: tor_dirmgr::config::DirMgrExtensions,
		) -> StdResult<Self, ErrorDetail> {
		let dir_cfg = {
		let mut c: tor_dirmgr::DirMgrConfig = (&config).try_into()?;
		let mut c: tor_dirmgr::DirMgrConfig = config.dir_mgr_config(mistrust.clone())?;
		c.extensions = dirmgr_extensions;
		c
		};
		let statemgr = FsStateMgr::from_path(config.storage.expand_state_dir()?)?;
		let statemgr =
		FsStateMgr::from_path_and_mistrust(config.storage.expand_state_dir()?, &mistrust)?;
		let addr_cfg = config.address_filter.clone();

		let (status_sender, status_receiver) = postage::watch::channel();
		@@ -415,6 +420,7 @@ impl<R: Runtime> TorClient<R> {
		should_bootstrap: autobootstrap,
		periodic_task_handles,
		dormant: Arc::new(AtomicBool::new(false)),
		fs_mistrust: mistrust,
		})
		}

		@@ -543,7 +549,9 @@ impl<R: Runtime> TorClient<R> {
		_ => {}
		}

		let dir_cfg = new_config.try_into().map_err(wrap_err)?;
		let dir_cfg = new_config
		.dir_mgr_config(self.fs_mistrust.clone())
		.map_err(wrap_err)?;
		let state_cfg = new_config.storage.expand_state_dir().map_err(wrap_err)?;
		let addr_cfg = &new_config.address_filter;
		let timeout_cfg = &new_config.stream_timeouts;