Class: Cohere::Transcribe::State::BoundDirectory

Inherits:
Object
  • Object
show all
Defined in:
lib/cohere/transcribe/state/io.rb

Overview

A retained directory descriptor is the authority for publication I/O. Path checks alone cannot close a rename/symlink TOCTOU window: after this object opens and verifies the planned inode, every entry operation is performed with the POSIX *at family against that descriptor.

Constant Summary collapse

AT_FUNCTION_SIGNATURES = 
{
  openat: [
    [Fiddle::TYPE_INT, Fiddle::TYPE_VOIDP, Fiddle::TYPE_INT, Fiddle::TYPE_VARIADIC],
    Fiddle::TYPE_INT
  ],
  renameat: [
    [Fiddle::TYPE_INT, Fiddle::TYPE_VOIDP, Fiddle::TYPE_INT, Fiddle::TYPE_VOIDP],
    Fiddle::TYPE_INT
  ],
  unlinkat: [[Fiddle::TYPE_INT, Fiddle::TYPE_VOIDP, Fiddle::TYPE_INT], Fiddle::TYPE_INT],
  mkdirat: [[Fiddle::TYPE_INT, Fiddle::TYPE_VOIDP, Fiddle::TYPE_INT], Fiddle::TYPE_INT]
}.freeze

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(binding, handle, guards) ⇒ BoundDirectory

Returns a new instance of BoundDirectory.



139
140
141
142
143
144
 
# File 'lib/cohere/transcribe/state/io.rb', line 139

def initialize(binding, handle, guards)
  @binding = binding
  @handle = handle
  @guards = guards
  @closed = false
end

Instance Attribute Details

#binding ⇒ Object (readonly)

Returns the value of attribute binding.



137
138
139
 
# File 'lib/cohere/transcribe/state/io.rb', line 137

def binding
  @binding
end

Class Method Details

.ensure_supported! ⇒ Object

Raises:



108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
 
# File 'lib/cohere/transcribe/state/io.rb', line 108

def ensure_supported!
  required_constants = %i[NOFOLLOW]
  missing_constants = required_constants.reject { |name| File.const_defined?(name) }
  missing_functions = AT_FUNCTION_SIGNATURES.keys.reject do |name|
    function(name)
    true
  rescue Fiddle::DLError
    false
  end
  return if missing_constants.empty? && missing_functions.empty?

  details = (missing_constants + missing_functions).join(", ")
  raise TranscriptionRuntimeError,
        "Descriptor-relative publication is unavailable on this platform (missing #{details})"
end

.function(name) ⇒ Object 



124
125
126
127
128
129
130
131
132
133
134
 
# File 'lib/cohere/transcribe/state/io.rb', line 124

def function(name)
  @function_guard ||= Mutex.new
  @functions ||= {}
  @function_guard.synchronize do
    @functions[name] ||= begin
      arguments, result = AT_FUNCTION_SIGNATURES.fetch(name)
      address = Fiddle::Handle::DEFAULT[name.to_s]
      Fiddle::Function.new(address, arguments, result)
    end
  end
end

.open(binding, guards: [binding]) ⇒ Object 



79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
 
# File 'lib/cohere/transcribe/state/io.rb', line 79

def open(binding, guards: [binding])
  ensure_supported!
  succeeded = false
  guards = guards.uniq.freeze
  guards.each(&:verify!)
  flags = File::RDONLY | File::NONBLOCK | File.const_get(:NOFOLLOW)
  descriptor = IO.sysopen(binding.canonical_path.to_s, flags)
  handle = File.new(descriptor, "rb", autoclose: true)
  descriptor = nil
  handle.close_on_exec = true
  stat = handle.stat
  unless stat.directory? && stat.dev == binding.device && stat.ino == binding.inode
    raise TranscriptionRuntimeError,
          "Publication parent changed while it was being opened: #{binding.access_path}"
  end
  guards.each(&:verify!)
  bound = new(binding, handle, guards)
  succeeded = true
  bound
rescue Interrupt, SystemExit
  raise
rescue SystemCallError, ArgumentError => e
  raise TranscriptionRuntimeError,
        "Cannot open planned publication parent #{binding.access_path}: #{e.message}"
ensure
  handle&.close if handle && !succeeded
  IO.new(descriptor).close if descriptor
end

Instance Method Details

#close ⇒ Object 



280
281
282
283
284
285
286
 
# File 'lib/cohere/transcribe/state/io.rb', line 280

def close
  return if @closed

  @handle.close
  @closed = true
  nil
end

#create_temporary(basename, suffix) ⇒ Object

Raises:



146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
 
# File 'lib/cohere/transcribe/state/io.rb', line 146

def create_temporary(basename, suffix)
  validate_entry_name!(basename)
  100.times do
    name = ".#{basename}.#{SecureRandom.hex(12)}#{suffix}"
    begin
      handle = open_entry(
        name,
        File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW,
        0o600,
        mode: "wb"
      )
      return [name.freeze, handle]
    rescue Errno::EEXIST
      next
    end
  end
  raise TranscriptionRuntimeError,
        "Cannot allocate a unique publication temporary for #{basename}"
end

#display_path(name) ⇒ Object 



288
289
290
 
# File 'lib/cohere/transcribe/state/io.rb', line 288

def display_path(name)
  binding.canonical_path.join(name)
end

#fsync ⇒ Object 



273
274
275
276
277
278
 
# File 'lib/cohere/transcribe/state/io.rb', line 273

def fsync
  @handle.fsync
rescue Errno::EACCES, Errno::EBADF, Errno::EINVAL, Errno::EISDIR,
       Errno::ENOTSUP, Errno::EPERM
  nil
end

#mkdir(name, mode = 0o777) ⇒ Object 



214
215
216
217
218
219
220
 
# File 'lib/cohere/transcribe/state/io.rb', line 214

def mkdir(name, mode = 0o777)
  validate_entry_name!(name)
  call_at!(:mkdirat, descriptor, name, mode)
  nil
rescue Errno::EEXIST
  nil
end

#open_child_directory(name, access_path:, canonical_path:) ⇒ Object 



222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
 
# File 'lib/cohere/transcribe/state/io.rb', line 222

def open_child_directory(name, access_path:, canonical_path:)
  validate_entry_name!(name)
  handle = open_entry(
    name,
    File::RDONLY | File::NONBLOCK | File::NOFOLLOW,
    0,
    mode: "rb"
  )
  stat = handle.stat
  unless stat.directory?
    raise TranscriptionRuntimeError,
          "Publication directory component is not a real directory: #{access_path}"
  end
  child_binding = DirectoryBinding.new(
    access_path: Pathname(access_path).freeze,
    canonical_path: Pathname(canonical_path).freeze,
    device: stat.dev,
    inode: stat.ino
  )
  child = self.class.new(child_binding, handle, (@guards + [child_binding]).uniq.freeze)
  child.verify!
  handle = nil
  child
rescue Errno::ELOOP, Errno::EISDIR, Errno::ENXIO => e
  raise TranscriptionRuntimeError,
        "Publication directory component is not a real directory: #{access_path}",
        cause: e
ensure
  handle&.close
end

#open_regular(name, writable: false) ⇒ Object 



166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
 
# File 'lib/cohere/transcribe/state/io.rb', line 166

def open_regular(name, writable: false)
  flags = writable ? File::RDWR : File::RDONLY
  flags |= File::NOFOLLOW | File::NONBLOCK
  handle = open_entry(name, flags, 0, mode: writable ? "r+b" : "rb")
  unless handle.stat.file?
    handle.close
    raise TranscriptionRuntimeError,
          "Publication entry is not a regular file: #{display_path(name)}"
  end
  handle
rescue Errno::ELOOP, Errno::EISDIR, Errno::ENXIO => e
  raise TranscriptionRuntimeError,
        "Publication entry is not a regular file: #{display_path(name)}",
        cause: e
end

#regular_entry?(name) ⇒ Boolean

Returns:

  • (Boolean) 


182
183
184
185
186
187
188
189
190
191
192
 
# File 'lib/cohere/transcribe/state/io.rb', line 182

def regular_entry?(name)
  handle = nil
  Thread.handle_interrupt(DEFERRED_PUBLICATION_EXCEPTIONS) do
    handle = open_regular(name)
  end
  true
rescue Errno::ENOENT
  false
ensure
  handle&.close
end

#rename(source, destination) ⇒ Object 



207
208
209
210
211
212
 
# File 'lib/cohere/transcribe/state/io.rb', line 207

def rename(source, destination)
  validate_entry_name!(source)
  validate_entry_name!(destination)
  call_at!(:renameat, descriptor, source, descriptor, destination)
  nil
end

#same_regular_entry?(name, expected_stat) ⇒ Boolean

Returns:

  • (Boolean) 


194
195
196
197
198
199
200
201
202
203
204
205
 
# File 'lib/cohere/transcribe/state/io.rb', line 194

def same_regular_entry?(name, expected_stat)
  handle = nil
  Thread.handle_interrupt(DEFERRED_PUBLICATION_EXCEPTIONS) do
    handle = open_regular(name)
  end
  current = handle.stat
  current.dev == expected_stat.dev && current.ino == expected_stat.ino
rescue Errno::ENOENT
  false
ensure
  handle&.close
end

#unlink(name, missing_ok: false) ⇒ Object 



253
254
255
256
257
258
259
260
261
 
# File 'lib/cohere/transcribe/state/io.rb', line 253

def unlink(name, missing_ok: false)
  validate_entry_name!(name)
  call_at!(:unlinkat, descriptor, name, 0)
  nil
rescue Errno::ENOENT
  raise unless missing_ok

  nil
end

#verify! ⇒ Object 



263
264
265
266
267
268
269
270
271
 
# File 'lib/cohere/transcribe/state/io.rb', line 263

def verify!
  stat = @handle.stat
  unless stat.directory? && stat.dev == binding.device && stat.ino == binding.inode
    raise TranscriptionRuntimeError,
          "Retained publication parent changed identity: #{binding.access_path}"
  end
  @guards.each(&:verify!)
  self
end