Documentation
¶
Overview ¶
Package owneronly validates security-sensitive files through their open descriptors, so path replacement cannot invalidate the result.
Index ¶
- Variables
- func IsSymlinkLoop(err error) bool
- func MkdirAt(parent *os.File, name string, perm os.FileMode) error
- func OpenAtNoFollow(directory *os.File, name string, flag int, perm os.FileMode) (*os.File, error)
- func OpenDirectoryAtNoFollow(parent *os.File, name string) (*os.File, error)
- func OpenDirectoryNoFollow(path string) (*os.File, error)
- func OpenDirectoryPath(path string, create bool, policy DirectoryPolicy, label string) (*os.File, bool, error)
- func OpenDirectoryPathDurable(path string, create bool, policy DirectoryPolicy, label string) (*os.File, bool, error)
- func OpenNoFollow(path string, flag int, perm os.FileMode) (*os.File, error)
- func ReadTrustedSymlinkAt(parent *os.File, name string) (string, error)
- func RenameAt(directory *os.File, oldName, newName string) error
- func UnlinkAt(directory *os.File, name string) error
- func Validate(file *os.File, kind Kind, label string) (os.FileInfo, error)
- func ValidateAncestor(file *os.File, label string) (os.FileInfo, error)
- func ValidateOwnerControlledDirectory(file *os.File, label string) (os.FileInfo, error)
- type DirectoryPolicy
- type Kind
Constants ¶
This section is empty.
Variables ¶
var ErrNotSymlink = errors.New("path entry is not a symbolic link")
ErrNotSymlink indicates that a descriptor-relative entry exists but is not a symbolic link.
Functions ¶
func IsSymlinkLoop ¶
IsSymlinkLoop reports the platform error returned when O_NOFOLLOW reaches a symbolic link.
func OpenAtNoFollow ¶
OpenAtNoFollow opens one name relative to an already-open directory. Names containing separators are rejected so every lookup remains descriptor-bound.
func OpenDirectoryAtNoFollow ¶
OpenDirectoryAtNoFollow opens one directory entry relative to a held parent.
func OpenDirectoryNoFollow ¶
OpenDirectoryNoFollow opens the final directory itself without following a symlink. Subsequent file access should use OpenAtNoFollow with this handle.
func OpenDirectoryPath ¶
func OpenDirectoryPath(path string, create bool, policy DirectoryPolicy, label string) (*os.File, bool, error)
OpenDirectoryPath walks an absolute directory path from the filesystem root through held no-follow descriptors. Every ancestor is validated before the next lookup. Missing components are created relative to the validated parent when create is true. It performs no durability sync; mutation and recovery callers must use OpenDirectoryPathDurable.
func OpenDirectoryPathDurable ¶
func OpenDirectoryPathDurable(path string, create bool, policy DirectoryPolicy, label string) (*os.File, bool, error)
OpenDirectoryPathDurable walks and validates a directory path, fsyncing each traversed directory and its containing parent. It recovers directory-entry durability after an interrupted prior create or rename.
func OpenNoFollow ¶
OpenNoFollow opens a path without following its final symbolic link.
func ReadTrustedSymlinkAt ¶
ReadTrustedSymlinkAt resolves a symlink entry only when root or the current user owns the link. The containing directory must already have passed ValidateAncestor, which prevents an unprivileged replacement race.
func RenameAt ¶
RenameAt atomically renames one entry within a held directory, replacing a destination entry according to the host rename(2) semantics.
func Validate ¶
Validate requires an owner-only regular file or directory owned by the effective user, with no extended access or inherited ACL.
func ValidateAncestor ¶
ValidateAncestor requires an ancestor that an unprivileged sibling cannot use to rename or replace the next path component. Root and the effective user are trusted owners. Group/other-writable ancestors are accepted only with sticky-directory semantics, and ACL allow entries fail closed.
func ValidateOwnerControlledDirectory ¶
ValidateOwnerControlledDirectory permits group/other read and traversal but rejects every non-owner write path and every extended ACL. It is intended for a configuration parent that may conventionally be 0755.
Types ¶
type DirectoryPolicy ¶
type DirectoryPolicy uint8
DirectoryPolicy selects validation for the final directory descriptor.
const ( // DirectoryOwnerOnly requires no group/other permissions. DirectoryOwnerOnly DirectoryPolicy = iota // DirectoryOwnerControlled permits group/other read and traversal, but not // write access. Extended ACLs remain forbidden. DirectoryOwnerControlled )
Source Files