Class: Cohere::Transcribe::State::BoundDirectory

Inherits:
Object
  • Object
show all
Defined in:
lib/cohere/transcribe/state/io.rb

Overview

A retained directory descriptor is the authority for publication I/O. Path checks alone cannot close a rename/symlink TOCTOU window: after this object opens and verifies the planned inode, every entry operation is performed with the POSIX *at family against that descriptor.

Constant Summary collapse

AT_FUNCTION_SIGNATURES = 
{
  openat: [[Fiddle::TYPE_INT, Fiddle::TYPE_VOIDP, Fiddle::TYPE_INT, Fiddle::TYPE_INT], Fiddle::TYPE_INT],
  renameat: [
    [Fiddle::TYPE_INT, Fiddle::TYPE_VOIDP, Fiddle::TYPE_INT, Fiddle::TYPE_VOIDP],
    Fiddle::TYPE_INT
  ],
  unlinkat: [[Fiddle::TYPE_INT, Fiddle::TYPE_VOIDP, Fiddle::TYPE_INT], Fiddle::TYPE_INT],
  mkdirat: [[Fiddle::TYPE_INT, Fiddle::TYPE_VOIDP, Fiddle::TYPE_INT], Fiddle::TYPE_INT]
}.freeze

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(binding, handle, guards) ⇒ BoundDirectory

Returns a new instance of BoundDirectory.



136
137
138
139
140
141
 
# File 'lib/cohere/transcribe/state/io.rb', line 136

def initialize(binding, handle, guards)
  @binding = binding
  @handle = handle
  @guards = guards
  @closed = false
end

Instance Attribute Details

#binding ⇒ Object (readonly)

Returns the value of attribute binding.



134
135
136
 
# File 'lib/cohere/transcribe/state/io.rb', line 134

def binding
  @binding
end

Class Method Details

.ensure_supported! ⇒ Object

Raises:



105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
 
# File 'lib/cohere/transcribe/state/io.rb', line 105

def ensure_supported!
  required_constants = %i[NOFOLLOW]
  missing_constants = required_constants.reject { |name| File.const_defined?(name) }
  missing_functions = AT_FUNCTION_SIGNATURES.keys.reject do |name|
    function(name)
    true
  rescue Fiddle::DLError
    false
  end
  return if missing_constants.empty? && missing_functions.empty?

  details = (missing_constants + missing_functions).join(", ")
  raise TranscriptionRuntimeError,
        "Descriptor-relative publication is unavailable on this platform (missing #{details})"
end

.function(name) ⇒ Object 



121
122
123
124
125
126
127
128
129
130
131
 
# File 'lib/cohere/transcribe/state/io.rb', line 121

def function(name)
  @function_guard ||= Mutex.new
  @functions ||= {}
  @function_guard.synchronize do
    @functions[name] ||= begin
      arguments, result = AT_FUNCTION_SIGNATURES.fetch(name)
      address = Fiddle::Handle::DEFAULT[name.to_s]
      Fiddle::Function.new(address, arguments, result)
    end
  end
end

.open(binding, guards: [binding]) ⇒ Object 



76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
 
# File 'lib/cohere/transcribe/state/io.rb', line 76

def open(binding, guards: [binding])
  ensure_supported!
  succeeded = false
  guards = guards.uniq.freeze
  guards.each(&:verify!)
  flags = File::RDONLY | File::NONBLOCK | File.const_get(:NOFOLLOW)
  descriptor = IO.sysopen(binding.canonical_path.to_s, flags)
  handle = File.new(descriptor, "rb", autoclose: true)
  descriptor = nil
  handle.close_on_exec = true
  stat = handle.stat
  unless stat.directory? && stat.dev == binding.device && stat.ino == binding.inode
    raise TranscriptionRuntimeError,
          "Publication parent changed while it was being opened: #{binding.access_path}"
  end
  guards.each(&:verify!)
  bound = new(binding, handle, guards)
  succeeded = true
  bound
rescue Interrupt, SystemExit
  raise
rescue SystemCallError, ArgumentError => e
  raise TranscriptionRuntimeError,
        "Cannot open planned publication parent #{binding.access_path}: #{e.message}"
ensure
  handle&.close if handle && !succeeded
  IO.new(descriptor).close if descriptor
end

Instance Method Details

#close ⇒ Object 



277
278
279
280
281
282
283
 
# File 'lib/cohere/transcribe/state/io.rb', line 277

def close
  return if @closed

  @handle.close
  @closed = true
  nil
end

#create_temporary(basename, suffix) ⇒ Object

Raises:



143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
 
# File 'lib/cohere/transcribe/state/io.rb', line 143

def create_temporary(basename, suffix)
  validate_entry_name!(basename)
  100.times do
    name = ".#{basename}.#{SecureRandom.hex(12)}#{suffix}"
    begin
      handle = open_entry(
        name,
        File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW,
        0o600,
        mode: "wb"
      )
      return [name.freeze, handle]
    rescue Errno::EEXIST
      next
    end
  end
  raise TranscriptionRuntimeError,
        "Cannot allocate a unique publication temporary for #{basename}"
end

#display_path(name) ⇒ Object 



285
286
287
 
# File 'lib/cohere/transcribe/state/io.rb', line 285

def display_path(name)
  binding.canonical_path.join(name)
end

#fsync ⇒ Object 



270
271
272
273
274
275
 
# File 'lib/cohere/transcribe/state/io.rb', line 270

def fsync
  @handle.fsync
rescue Errno::EACCES, Errno::EBADF, Errno::EINVAL, Errno::EISDIR,
       Errno::ENOTSUP, Errno::EPERM
  nil
end

#mkdir(name, mode = 0o777) ⇒ Object 



211
212
213
214
215
216
217
 
# File 'lib/cohere/transcribe/state/io.rb', line 211

def mkdir(name, mode = 0o777)
  validate_entry_name!(name)
  call_at!(:mkdirat, descriptor, name, mode)
  nil
rescue Errno::EEXIST
  nil
end

#open_child_directory(name, access_path:, canonical_path:) ⇒ Object 



219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
 
# File 'lib/cohere/transcribe/state/io.rb', line 219

def open_child_directory(name, access_path:, canonical_path:)
  validate_entry_name!(name)
  handle = open_entry(
    name,
    File::RDONLY | File::NONBLOCK | File::NOFOLLOW,
    0,
    mode: "rb"
  )
  stat = handle.stat
  unless stat.directory?
    raise TranscriptionRuntimeError,
          "Publication directory component is not a real directory: #{access_path}"
  end
  child_binding = DirectoryBinding.new(
    access_path: Pathname(access_path).freeze,
    canonical_path: Pathname(canonical_path).freeze,
    device: stat.dev,
    inode: stat.ino
  )
  child = self.class.new(child_binding, handle, (@guards + [child_binding]).uniq.freeze)
  child.verify!
  handle = nil
  child
rescue Errno::ELOOP, Errno::EISDIR, Errno::ENXIO => e
  raise TranscriptionRuntimeError,
        "Publication directory component is not a real directory: #{access_path}",
        cause: e
ensure
  handle&.close
end

#open_regular(name, writable: false) ⇒ Object 



163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
 
# File 'lib/cohere/transcribe/state/io.rb', line 163

def open_regular(name, writable: false)
  flags = writable ? File::RDWR : File::RDONLY
  flags |= File::NOFOLLOW | File::NONBLOCK
  handle = open_entry(name, flags, 0, mode: writable ? "r+b" : "rb")
  unless handle.stat.file?
    handle.close
    raise TranscriptionRuntimeError,
          "Publication entry is not a regular file: #{display_path(name)}"
  end
  handle
rescue Errno::ELOOP, Errno::EISDIR, Errno::ENXIO => e
  raise TranscriptionRuntimeError,
        "Publication entry is not a regular file: #{display_path(name)}",
        cause: e
end

#regular_entry?(name) ⇒ Boolean

Returns:

  • (Boolean) 


179
180
181
182
183
184
185
186
187
188
189
 
# File 'lib/cohere/transcribe/state/io.rb', line 179

def regular_entry?(name)
  handle = nil
  Thread.handle_interrupt(DEFERRED_PUBLICATION_EXCEPTIONS) do
    handle = open_regular(name)
  end
  true
rescue Errno::ENOENT
  false
ensure
  handle&.close
end

#rename(source, destination) ⇒ Object 



204
205
206
207
208
209
 
# File 'lib/cohere/transcribe/state/io.rb', line 204

def rename(source, destination)
  validate_entry_name!(source)
  validate_entry_name!(destination)
  call_at!(:renameat, descriptor, source, descriptor, destination)
  nil
end

#same_regular_entry?(name, expected_stat) ⇒ Boolean

Returns:

  • (Boolean) 


191
192
193
194
195
196
197
198
199
200
201
202
 
# File 'lib/cohere/transcribe/state/io.rb', line 191

def same_regular_entry?(name, expected_stat)
  handle = nil
  Thread.handle_interrupt(DEFERRED_PUBLICATION_EXCEPTIONS) do
    handle = open_regular(name)
  end
  current = handle.stat
  current.dev == expected_stat.dev && current.ino == expected_stat.ino
rescue Errno::ENOENT
  false
ensure
  handle&.close
end

#unlink(name, missing_ok: false) ⇒ Object 



250
251
252
253
254
255
256
257
258
 
# File 'lib/cohere/transcribe/state/io.rb', line 250

def unlink(name, missing_ok: false)
  validate_entry_name!(name)
  call_at!(:unlinkat, descriptor, name, 0)
  nil
rescue Errno::ENOENT
  raise unless missing_ok

  nil
end

#verify! ⇒ Object 



260
261
262
263
264
265
266
267
268
 
# File 'lib/cohere/transcribe/state/io.rb', line 260

def verify!
  stat = @handle.stat
  unless stat.directory? && stat.dev == binding.device && stat.ino == binding.inode
    raise TranscriptionRuntimeError,
          "Retained publication parent changed identity: #{binding.access_path}"
  end
  @guards.each(&:verify!)
  self
end