Harden filesystem analysis boundaries

Author: eldryoth

CHANGELOG.md

@@ -89,6 +89,8 @@ behavior when the change improves security or project direction.
 - Fail malformed `Accept-Encoding` negotiation closed, honor explicit coding
   rejection over wildcard acceptance, and treat qualified `private` cache
   directives as compression-blocking security policy.
+- Move config trust traversal to no-follow `statat` inspection and remove the
+  environment-derived marker-file write from storage-lease subprocess tests.
 
 ### Fixed
 

crates/fluxheim-config/Cargo.toml

@@ -34,7 +34,7 @@ fluxheim-protocol = { path = "../fluxheim-protocol" }
 fluxheim-wasm = { path = "../fluxheim-wasm", optional = true }
 log = "0.4.33"
 regex = "1.13.0"
-rustix = { version = "1.1.4", features = ["process"] }
+rustix = { version = "1.1.4", features = ["fs", "process"] }
 serde = { version = "1.0.228", features = ["derive"] }
 toml = "1.1.2"
 

crates/fluxheim-config/src/fs_trust.rs

@@ -37,7 +37,7 @@ fn existing_path_has_insecure_write_permissions(current: &Path) -> std::io::Resu
     let mut inspected_depth = 0usize;
     loop {
         check_inspection_depth(&mut inspected_depth)?;
-        match std::fs::symlink_metadata(&current) {
+        match path_stat_no_follow(&current) {
             Ok(_) => break,
             Err(error) if error.kind() == std::io::ErrorKind::NotFound => {
                 if !current.pop() {
@@ -51,11 +51,13 @@ fn existing_path_has_insecure_write_permissions(current: &Path) -> std::io::Resu
         }
     }
 
+    let process_uid = rustix::process::geteuid().as_raw();
+    let root_uid = path_stat_no_follow(Path::new("/"))?.st_uid;
     loop {
         check_inspection_depth(&mut inspected_depth)?;
-        let metadata = std::fs::symlink_metadata(&current)?;
-        if metadata.file_type().is_symlink()
-            || metadata_has_insecure_owner_or_write_permissions(&metadata)?
+        let stat = path_stat_no_follow(&current)?;
+        if rustix::fs::FileType::from_raw_mode(stat.st_mode).is_symlink()
+            || stat_has_insecure_owner_or_write_permissions(&stat, process_uid, root_uid)
         {
             return Ok(true);
         }
@@ -65,14 +67,30 @@ fn existing_path_has_insecure_write_permissions(current: &Path) -> std::io::Resu
     }
 }
 
+#[cfg(unix)]
+fn path_stat_no_follow(path: &Path) -> std::io::Result<rustix::fs::Stat> {
+    rustix::fs::statat(rustix::fs::CWD, path, rustix::fs::AtFlags::SYMLINK_NOFOLLOW)
+        .map_err(std::io::Error::from)
+}
+
+#[cfg(unix)]
+fn stat_has_insecure_owner_or_write_permissions(
+    stat: &rustix::fs::Stat,
+    process_uid: u32,
+    root_uid: u32,
+) -> bool {
+    (stat.st_uid != 0 && stat.st_uid != process_uid && stat.st_uid != root_uid)
+        || stat.st_mode & 0o022 != 0
+}
+
 #[cfg(unix)]
 pub(crate) fn metadata_has_insecure_owner_or_write_permissions(
     metadata: &std::fs::Metadata,
 ) -> std::io::Result<bool> {
     use std::os::unix::fs::{MetadataExt as _, PermissionsExt as _};
 
     let process_uid = rustix::process::geteuid().as_raw();
-    let root_uid = std::fs::symlink_metadata(Path::new("/"))?.uid();
+    let root_uid = path_stat_no_follow(Path::new("/"))?.st_uid;
     Ok(
         (metadata.uid() != 0 && metadata.uid() != process_uid && metadata.uid() != root_uid)
             || metadata.permissions().mode() & 0o022 != 0,

crates/fluxheim-server/src/native_http1_cache_tests.rs

@@ -322,50 +322,46 @@ fn live_cache_inspection_uses_registered_allocator_during_inserts() {
 }
 
 const STORAGE_BIN_LEASE_CHILD_ROOT: &str = "FLUXHEIM_STORAGE_BIN_LEASE_CHILD_ROOT";
-const STORAGE_BIN_LEASE_CHILD_MARKER: &str = "FLUXHEIM_STORAGE_BIN_LEASE_CHILD_MARKER";
 const STORAGE_BIN_LEASE_CHILD_MAX_BYTES: &str = "FLUXHEIM_STORAGE_BIN_LEASE_CHILD_MAX_BYTES";
+const STORAGE_BIN_LEASE_CHILD_CONFIRMED: &str = "fluxheim-storage-bin-lease-child-confirmed";
 
 #[test]
 fn storage_bin_lease_child_process() {
     let Some(root) = std::env::var_os(STORAGE_BIN_LEASE_CHILD_ROOT) else {
         return;
     };
-    let marker = std::env::var_os(STORAGE_BIN_LEASE_CHILD_MARKER).unwrap();
     let mut config = storage_bin_config(std::path::Path::new(&root));
     if let Ok(max_bytes) = std::env::var(STORAGE_BIN_LEASE_CHILD_MAX_BYTES) {
         config.disk.max_size_bytes = ByteSize::from_bytes(max_bytes.parse().unwrap());
     }
 
     let error = NativeDiskCacheBackend::from_config(&config).unwrap_err();
     assert_eq!(error.kind(), std::io::ErrorKind::AlreadyExists);
-    std::fs::write(marker, b"locked").unwrap();
+    println!("{STORAGE_BIN_LEASE_CHILD_CONFIRMED}");
 }
 
 #[test]
 fn storage_bin_lease_rejects_second_process() {
     let directory = tempfile::tempdir().unwrap();
     let root = directory.path().join("cache");
-    let marker = directory.path().join("child-confirmed");
     let config = storage_bin_config(&root);
     let _cache = NativeDiskCache::from_config(&config).unwrap();
-    let status = std::process::Command::new(std::env::current_exe().unwrap())
+    let output = std::process::Command::new(std::env::current_exe().unwrap())
         .arg("--exact")
         .arg("native_http1_cache::tests::storage_bin_lease_child_process")
         .arg("--nocapture")
         .env(STORAGE_BIN_LEASE_CHILD_ROOT, &root)
-        .env(STORAGE_BIN_LEASE_CHILD_MARKER, &marker)
-        .status()
+        .output()
         .unwrap();
 
-    assert!(status.success());
-    assert_eq!(std::fs::read(marker).unwrap(), b"locked");
+    assert!(output.status.success());
+    assert!(String::from_utf8_lossy(&output.stdout).contains(STORAGE_BIN_LEASE_CHILD_CONFIRMED));
 }
 
 #[test]
 fn storage_bin_loser_cannot_mutate_winner_layout() {
     let directory = tempfile::tempdir().unwrap();
     let configured_root = directory.path().join("cache");
-    let marker = directory.path().join("child-confirmed");
     let winner_config = storage_bin_config(&configured_root);
     let root = super::prepare_native_storage_bin_root_for_lease(&winner_config).unwrap();
     let _lease = acquire_native_storage_bin_lease(&root).unwrap();
@@ -376,20 +372,19 @@ fn storage_bin_loser_cannot_mutate_winner_layout() {
     let manifest_path = root.join(".fluxheim-storage-bin-v1");
     let winning_manifest = std::fs::read(&manifest_path).unwrap();
 
-    let status = std::process::Command::new(std::env::current_exe().unwrap())
+    let output = std::process::Command::new(std::env::current_exe().unwrap())
         .arg("--exact")
         .arg("native_http1_cache::tests::storage_bin_lease_child_process")
         .arg("--nocapture")
         .env(STORAGE_BIN_LEASE_CHILD_ROOT, &root)
-        .env(STORAGE_BIN_LEASE_CHILD_MARKER, &marker)
         .env(
             STORAGE_BIN_LEASE_CHILD_MAX_BYTES,
             (2 * 1024 * 1024).to_string(),
         )
-        .status()
+        .output()
         .unwrap();
 
-    assert!(status.success());
-    assert_eq!(std::fs::read(marker).unwrap(), b"locked");
+    assert!(output.status.success());
+    assert!(String::from_utf8_lossy(&output.stdout).contains(STORAGE_BIN_LEASE_CHILD_CONFIRMED));
     assert_eq!(std::fs::read(manifest_path).unwrap(), winning_manifest);
 }

release-notes/RELEASE_NOTES_1.7.7.md

@@ -100,6 +100,9 @@ deterministic unsupported-call rejection.
 - Fail response compression closed for malformed `Accept-Encoding` fields,
   honor explicit coding rejection over wildcard acceptance, and suppress
   compression for qualified `Cache-Control: private="..."` responses.
+- Perform config ownership, permission, and symlink traversal checks through
+  no-follow `statat` metadata inspection, and remove environment-derived
+  filesystem writes from storage-lease subprocess coverage.
 
 ## Changed