-
-
Notifications
You must be signed in to change notification settings - Fork 15.4k
dirfd file operations (2/4) #150679
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: main
Are you sure you want to change the base?
dirfd file operations (2/4) #150679
Changes from all commits
File filter
Filter by extension
Conversations
Jump to
Diff view
Diff view
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,4 +1,4 @@ | ||
| use libc::c_int; | ||
| use libc::{c_int, renameat, unlinkat}; | ||
|
|
||
| cfg_select! { | ||
| not( | ||
|
|
@@ -27,7 +27,7 @@ use crate::sys::fd::FileDesc; | |
| use crate::sys::fs::OpenOptions; | ||
| use crate::sys::fs::unix::{File, FileAttr, debug_path_fd}; | ||
| use crate::sys::helpers::run_path_with_cstr; | ||
| use crate::sys::{AsInner, FromInner, IntoInner, cvt_r}; | ||
| use crate::sys::{AsInner, FromInner, IntoInner, cvt, cvt_r}; | ||
| use crate::{fmt, fs, io}; | ||
|
|
||
| pub struct Dir(OwnedFd); | ||
|
|
@@ -51,6 +51,16 @@ impl Dir { | |
| f.file_attr() | ||
| } | ||
|
|
||
| pub fn remove_file(&self, path: &Path) -> io::Result<()> { | ||
| run_path_with_cstr(path, &|path| self.remove_c(path, false)) | ||
|
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. Should this check somewhere that the passed
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. That seems like a question for all dirfd-relative operations that take a path: should they require the path to be relative, or should they allow absolute paths and do the obvious thing for them? IMO it makes sense to allow absolute paths. That basically lets you use dirfd as a "local working directory" without the downsides of
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. The argument against is that people would like to use dirfd in security relevant contexts. You can build a less secure variant on top of dirfd but not really the other way around (well technically you can but defaulting to the less secure option has historically been a footgun). But in any case, I think this is a question for libs-api.
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. It's unstable, so you can put it on the open questions in the tracking issue? I don't think this needs to be settled immediately. On linux there's
Member
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. The tracking issue explicitly says that this is NOT using O_BENEATH. We also have a fallback implementation that just stores the dir name as a string. So anything security critical seems to be already ruled out. I have added this to #120426. |
||
| } | ||
|
|
||
| pub fn rename(&self, from: &Path, to_dir: &Self, to: &Path) -> io::Result<()> { | ||
| run_path_with_cstr(from, &|from| { | ||
| run_path_with_cstr(to, &|to| self.rename_c(from, to_dir, to)) | ||
| }) | ||
| } | ||
|
|
||
| pub fn open_with_c(path: &CStr, opts: &OpenOptions) -> io::Result<Self> { | ||
| let flags = libc::O_CLOEXEC | ||
| | libc::O_DIRECTORY | ||
|
|
@@ -71,6 +81,24 @@ impl Dir { | |
| })?; | ||
| Ok(File(unsafe { FileDesc::from_raw_fd(fd) })) | ||
| } | ||
|
|
||
| fn remove_c(&self, path: &CStr, remove_dir: bool) -> io::Result<()> { | ||
| cvt(unsafe { | ||
| unlinkat( | ||
| self.0.as_raw_fd(), | ||
| path.as_ptr(), | ||
| if remove_dir { libc::AT_REMOVEDIR } else { 0 }, | ||
| ) | ||
| }) | ||
| .map(|_| ()) | ||
| } | ||
|
|
||
| fn rename_c(&self, from: &CStr, to_dir: &Self, to: &CStr) -> io::Result<()> { | ||
| cvt(unsafe { | ||
| renameat(self.0.as_raw_fd(), from.as_ptr(), to_dir.0.as_raw_fd(), to.as_ptr()) | ||
| }) | ||
| .map(|_| ()) | ||
| } | ||
| } | ||
|
|
||
| impl fmt::Debug for Dir { | ||
|
|
||
Uh oh!
There was an error while loading. Please reload this page.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Miri does not run these tests so it should not be necessary to add these attributes. What motivated you to add them?
View changes since the review