Class: Cohere::Transcribe::State::BoundDirectory

Inherits:
Object
  • Object
show all
Defined in:
lib/cohere/transcribe/state/io.rb

Overview

A retained directory descriptor is the authority for publication I/O. Path checks alone cannot close a rename/symlink TOCTOU window: after this object opens and verifies the planned inode, every entry operation is performed with the POSIX *at family against that descriptor.

Constant Summary collapse

AT_FUNCTION_SIGNATURES = 
{
  openat: [
    [Fiddle::TYPE_INT, Fiddle::TYPE_VOIDP, Fiddle::TYPE_INT, Fiddle::TYPE_VARIADIC],
    Fiddle::TYPE_INT
  ],
  renameat: [
    [Fiddle::TYPE_INT, Fiddle::TYPE_VOIDP, Fiddle::TYPE_INT, Fiddle::TYPE_VOIDP],
    Fiddle::TYPE_INT
  ],
  unlinkat: [[Fiddle::TYPE_INT, Fiddle::TYPE_VOIDP, Fiddle::TYPE_INT], Fiddle::TYPE_INT],
  mkdirat: [[Fiddle::TYPE_INT, Fiddle::TYPE_VOIDP, Fiddle::TYPE_INT], Fiddle::TYPE_INT]
}.freeze

Instance Attribute Summary collapse

Class Method Summary collapse

Instance Method Summary collapse

Constructor Details

#initialize(binding, handle, guards) ⇒ BoundDirectory

Returns a new instance of BoundDirectory.



141
142
143
144
145
146
 
# File 'lib/cohere/transcribe/state/io.rb', line 141

def initialize(binding, handle, guards)
  @binding = binding
  @handle = handle
  @guards = guards
  @closed = false
end

Instance Attribute Details

#binding ⇒ Object (readonly)

Returns the value of attribute binding.



139
140
141
 
# File 'lib/cohere/transcribe/state/io.rb', line 139

def binding
  @binding
end

Class Method Details

.ensure_supported! ⇒ Object

Raises:



110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
 
# File 'lib/cohere/transcribe/state/io.rb', line 110

def ensure_supported!
  required_constants = %i[NOFOLLOW]
  missing_constants = required_constants.reject { |name| File.const_defined?(name) }
  missing_functions = AT_FUNCTION_SIGNATURES.keys.reject do |name|
    function(name)
    true
  rescue Fiddle::DLError
    false
  end
  return if missing_constants.empty? && missing_functions.empty?

  details = (missing_constants + missing_functions).join(", ")
  raise TranscriptionRuntimeError,
        "Descriptor-relative publication is unavailable on this platform (missing #{details})"
end

.function(name) ⇒ Object 



126
127
128
129
130
131
132
133
134
135
136
 
# File 'lib/cohere/transcribe/state/io.rb', line 126

def function(name)
  @function_guard ||= Mutex.new
  @functions ||= {}
  @function_guard.synchronize do
    @functions[name] ||= begin
      arguments, result = AT_FUNCTION_SIGNATURES.fetch(name)
      address = Fiddle::Handle::DEFAULT[name.to_s]
      Fiddle::Function.new(address, arguments, result)
    end
  end
end

.open(binding, guards: [binding]) ⇒ Object 



80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
 
# File 'lib/cohere/transcribe/state/io.rb', line 80

def open(binding, guards: [binding])
  ensure_supported!
  succeeded = false
  guards = guards.uniq.freeze
  guards.each(&:verify!)
  flags = File::RDONLY | File::NONBLOCK | File.const_get(:NOFOLLOW)
  descriptor = IO.sysopen(binding.canonical_path.to_s, flags)
  handle = File.new(descriptor, "rb", autoclose: true)
  descriptor = nil
  handle.close_on_exec = true
  stat = handle.stat
  unless stat.directory? && stat.dev == binding.device && stat.ino == binding.inode
    raise PublicationDirectoryChangedError,
          "Publication parent changed while it was being opened: #{binding.access_path}"
  end
  guards.each(&:verify!)
  bound = new(binding, handle, guards)
  succeeded = true
  bound
rescue Interrupt, SystemExit
  raise
rescue SystemCallError, ArgumentError => e
  guards&.each(&:verify!)
  raise TranscriptionRuntimeError,
        "Cannot open planned publication parent #{binding.access_path}: #{e.message}"
ensure
  handle&.close if handle && !succeeded
  IO.new(descriptor).close if descriptor
end

Instance Method Details

#close ⇒ Object 



282
283
284
285
286
287
288
289
290
 
# File 'lib/cohere/transcribe/state/io.rb', line 282

def close
  Thread.handle_interrupt(Object => :never) do
    return if @closed

    @handle.close
    @closed = true
  end
  nil
end

#create_temporary(basename, suffix) ⇒ Object

Raises:



148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
 
# File 'lib/cohere/transcribe/state/io.rb', line 148

def create_temporary(basename, suffix)
  validate_entry_name!(basename)
  100.times do
    name = ".#{basename}.#{SecureRandom.hex(12)}#{suffix}"
    begin
      handle = open_entry(
        name,
        File::WRONLY | File::CREAT | File::EXCL | File::NOFOLLOW,
        0o600,
        mode: "wb"
      )
      return [name.freeze, handle]
    rescue Errno::EEXIST
      next
    end
  end
  raise TranscriptionRuntimeError,
        "Cannot allocate a unique publication temporary for #{basename}"
end

#display_path(name) ⇒ Object 



292
293
294
 
# File 'lib/cohere/transcribe/state/io.rb', line 292

def display_path(name)
  binding.canonical_path.join(name)
end

#fsync ⇒ Object 



275
276
277
278
279
280
 
# File 'lib/cohere/transcribe/state/io.rb', line 275

def fsync
  @handle.fsync
rescue Errno::EACCES, Errno::EBADF, Errno::EINVAL, Errno::EISDIR,
       Errno::ENOTSUP, Errno::EPERM
  nil
end

#mkdir(name, mode = 0o777) ⇒ Object 



216
217
218
219
220
221
222
 
# File 'lib/cohere/transcribe/state/io.rb', line 216

def mkdir(name, mode = 0o777)
  validate_entry_name!(name)
  call_at!(:mkdirat, descriptor, name, mode)
  nil
rescue Errno::EEXIST
  nil
end

#open_child_directory(name, access_path:, canonical_path:) ⇒ Object 



224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
 
# File 'lib/cohere/transcribe/state/io.rb', line 224

def open_child_directory(name, access_path:, canonical_path:)
  validate_entry_name!(name)
  handle = open_entry(
    name,
    File::RDONLY | File::NONBLOCK | File::NOFOLLOW,
    0,
    mode: "rb"
  )
  stat = handle.stat
  unless stat.directory?
    raise TranscriptionRuntimeError,
          "Publication directory component is not a real directory: #{access_path}"
  end
  child_binding = DirectoryBinding.new(
    access_path: Pathname(access_path).freeze,
    canonical_path: Pathname(canonical_path).freeze,
    device: stat.dev,
    inode: stat.ino
  )
  child = self.class.new(child_binding, handle, (@guards + [child_binding]).uniq.freeze)
  child.verify!
  handle = nil
  child
rescue Errno::ELOOP, Errno::EISDIR, Errno::ENXIO => e
  raise TranscriptionRuntimeError,
        "Publication directory component is not a real directory: #{access_path}",
        cause: e
ensure
  handle&.close
end

#open_regular(name, writable: false) ⇒ Object 



168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
 
# File 'lib/cohere/transcribe/state/io.rb', line 168

def open_regular(name, writable: false)
  flags = writable ? File::RDWR : File::RDONLY
  flags |= File::NOFOLLOW | File::NONBLOCK
  handle = open_entry(name, flags, 0, mode: writable ? "r+b" : "rb")
  unless handle.stat.file?
    handle.close
    raise PublicationEntryError,
          "Publication entry is not a regular file: #{display_path(name)}"
  end
  handle
rescue Errno::ELOOP, Errno::EISDIR, Errno::ENXIO => e
  raise PublicationEntryError,
        "Publication entry is not a regular file: #{display_path(name)}",
        cause: e
end

#regular_entry?(name) ⇒ Boolean

Returns:

  • (Boolean) 


184
185
186
187
188
189
190
191
192
193
194
 
# File 'lib/cohere/transcribe/state/io.rb', line 184

def regular_entry?(name)
  handle = nil
  Thread.handle_interrupt(DEFERRED_PUBLICATION_EXCEPTIONS) do
    handle = open_regular(name)
  end
  true
rescue Errno::ENOENT
  false
ensure
  handle&.close
end

#rename(source, destination) ⇒ Object 



209
210
211
212
213
214
 
# File 'lib/cohere/transcribe/state/io.rb', line 209

def rename(source, destination)
  validate_entry_name!(source)
  validate_entry_name!(destination)
  call_at!(:renameat, descriptor, source, descriptor, destination)
  nil
end

#same_regular_entry?(name, expected_stat) ⇒ Boolean

Returns:

  • (Boolean) 


196
197
198
199
200
201
202
203
204
205
206
207
 
# File 'lib/cohere/transcribe/state/io.rb', line 196

def same_regular_entry?(name, expected_stat)
  handle = nil
  Thread.handle_interrupt(DEFERRED_PUBLICATION_EXCEPTIONS) do
    handle = open_regular(name)
  end
  current = handle.stat
  current.dev == expected_stat.dev && current.ino == expected_stat.ino
rescue Errno::ENOENT, PublicationEntryError
  false
ensure
  handle&.close
end

#unlink(name, missing_ok: false) ⇒ Object 



255
256
257
258
259
260
261
262
263
 
# File 'lib/cohere/transcribe/state/io.rb', line 255

def unlink(name, missing_ok: false)
  validate_entry_name!(name)
  call_at!(:unlinkat, descriptor, name, 0)
  nil
rescue Errno::ENOENT
  raise unless missing_ok

  nil
end

#verify! ⇒ Object 



265
266
267
268
269
270
271
272
273
 
# File 'lib/cohere/transcribe/state/io.rb', line 265

def verify!
  stat = @handle.stat
  unless stat.directory? && stat.dev == binding.device && stat.ino == binding.inode
    raise PublicationDirectoryChangedError,
          "Retained publication parent changed identity: #{binding.access_path}"
  end
  @guards.each(&:verify!)
  self
end