Skip to content

Commit 9245db3

Browse files
LeChatPLeChatP
committed
fmt: cargo fmt
1 parent 5483732 commit 9245db3

File tree

5 files changed

+98
-54
lines changed

5 files changed

+98
-54
lines changed

‎src/sr/finder/api/landlock.rs‎

Lines changed: 18 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,10 @@
11
use std::{collections::HashMap, path::PathBuf};
22

3-
use landlock::{Access, AccessFs, PathBeneath, PathFd, Ruleset, RulesetAttr, RulesetCreatedAttr, ABI};
4-
use serde::{Deserialize, Serialize};
53
use bitflags::bitflags;
4+
use landlock::{
5+
Access, AccessFs, PathBeneath, PathFd, Ruleset, RulesetAttr, RulesetCreatedAttr, ABI,
6+
};
7+
use serde::{Deserialize, Serialize};
68

79
use crate::{
810
error::{SrError, SrResult},
@@ -81,7 +83,8 @@ impl<'de> Deserialize<'de> for FAccess {
8183
where
8284
E: serde::de::Error,
8385
{
84-
FAccess::from_bits(v).ok_or_else(|| E::custom(format!("invalid access bitmask: {}", v)))
86+
FAccess::from_bits(v)
87+
.ok_or_else(|| E::custom(format!("invalid access bitmask: {}", v)))
8588
}
8689
}
8790

@@ -104,29 +107,35 @@ fn pre_exec(event: &mut ApiEvent) -> SrResult<()> {
104107
whitelist.insert(PathBuf::from(key), access);
105108
}
106109
}
107-
110+
108111
let mut ruleset = Ruleset::default()
109112
.handle_access(AccessFs::from_all(VERSION))
110113
.map_err(|_| SrError::ConfigurationError)?
111114
.create()
112115
.map_err(|_| SrError::ConfigurationError)?;
113-
116+
114117
for (path, access) in whitelist.iter() {
115118
let landlock_access = match *access {
116119
FAccess::RWX | FAccess::RX => AccessFs::from_all(VERSION),
117120
FAccess::WX => AccessFs::from_write(VERSION) | AccessFs::Execute,
118-
FAccess::RW => AccessFs::from_read(VERSION) | AccessFs::from_write(VERSION) & !AccessFs::Execute,
121+
FAccess::RW => {
122+
AccessFs::from_read(VERSION)
123+
| AccessFs::from_write(VERSION) & !AccessFs::Execute
124+
}
119125
FAccess::R => AccessFs::from_read(VERSION) & !AccessFs::Execute,
120126
FAccess::W => AccessFs::from_write(VERSION),
121127
FAccess::X => AccessFs::from_read(VERSION),
122128
_ => !AccessFs::from_all(VERSION),
123129
};
124130
let path_fd = PathFd::new(path).map_err(|_| SrError::ConfigurationError)?;
125-
ruleset = ruleset.add_rule(PathBeneath::new(path_fd, landlock_access))
131+
ruleset = ruleset
132+
.add_rule(PathBeneath::new(path_fd, landlock_access))
126133
.map_err(|_| SrError::ConfigurationError)?;
127134
}
128-
129-
ruleset.restrict_self().map_err(|_| SrError::ConfigurationError)?;
135+
136+
ruleset
137+
.restrict_self()
138+
.map_err(|_| SrError::ConfigurationError)?;
130139
}
131140
}
132141
Ok(())

‎src/sr/finder/api/mod.rs‎

Lines changed: 3 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -17,10 +17,10 @@ use super::{
1717
mod hashchecker;
1818
#[cfg(feature = "hierarchy")]
1919
mod hierarchy;
20-
#[cfg(feature = "ssd")]
21-
mod ssd;
2220
#[cfg(feature = "landlock")]
2321
mod landlock;
22+
#[cfg(feature = "ssd")]
23+
mod ssd;
2424

2525
thread_local! {
2626
static API: Lazy<UnsafeCell<Api>> = Lazy::new(|| UnsafeCell::new(Api::new()));
@@ -80,10 +80,7 @@ pub enum ApiEvent<'a, 't, 'c, 'f, 'g, 'h, 'i, 'j, 'k> {
8080
&'g mut BestExecSettings,
8181
&'h mut bool,
8282
),
83-
PreExec(
84-
&'f Cli,
85-
&'h BestExecSettings,
86-
),
83+
PreExec(&'f Cli, &'h BestExecSettings),
8784
}
8885

8986
impl ApiEvent<'_, '_, '_, '_, '_, '_, '_, '_, '_> {

‎src/sr/finder/de.rs‎

Lines changed: 30 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -786,7 +786,16 @@ impl<'de: 'a, 'a> DeserializeSeed<'de> for CredFinderDeserializerReturn<'a> {
786786
}
787787
}
788788
debug!("CredFinderVisitor: end");
789-
Ok(CredResult{cred: CredData {setuid, setgroups, caps, extra_values}, score, ok})
789+
Ok(CredResult {
790+
cred: CredData {
791+
setuid,
792+
setgroups,
793+
caps,
794+
extra_values,
795+
},
796+
score,
797+
ok,
798+
})
790799
}
791800
}
792801
const FIELDS: &[&str] = &["setuid", "setgroups", "capabilities", "0", "1", "2"];
@@ -2108,9 +2117,18 @@ mod tests {
21082117
let result = result.unwrap();
21092118
assert!(result.ok);
21102119
assert_eq!(result.cred.setuid, Some("root".into()));
2111-
assert_eq!(result.cred.setgroups, Some(DGroups::from(vec!["root".into()])));
2112-
assert_eq!(result.cred.caps, Some(CapSet::from_iter(vec![Cap::SYS_ADMIN])));
2113-
assert_eq!(result.score.setuser_min.uid, Some(SetuidMin::from(&"root".into())));
2120+
assert_eq!(
2121+
result.cred.setgroups,
2122+
Some(DGroups::from(vec!["root".into()]))
2123+
);
2124+
assert_eq!(
2125+
result.cred.caps,
2126+
Some(CapSet::from_iter(vec![Cap::SYS_ADMIN]))
2127+
);
2128+
assert_eq!(
2129+
result.score.setuser_min.uid,
2130+
Some(SetuidMin::from(&"root".into()))
2131+
);
21142132
assert_eq!(
21152133
result.score.setuser_min.gid,
21162134
Some(SetgidMin::from(&Into::<DGroupType<'_>>::into("root")))
@@ -2129,7 +2147,10 @@ mod tests {
21292147
assert_eq!(result.cred.setuid, Some(uid.into()));
21302148
assert_eq!(result.cred.setgroups, Some(DGroups::from(vec![gid.into()])));
21312149
assert_eq!(result.cred.caps, None);
2132-
assert_eq!(result.score.setuser_min.uid, Some(SetuidMin::from(&uid.into())));
2150+
assert_eq!(
2151+
result.score.setuser_min.uid,
2152+
Some(SetuidMin::from(&uid.into()))
2153+
);
21332154
assert_eq!(
21342155
result.score.setuser_min.gid,
21352156
Some(SetgidMin::from(&Into::<DGroupType<'_>>::into(uid)))
@@ -2148,7 +2169,10 @@ mod tests {
21482169
assert_eq!(result.cred.setuid, Some(uid.into()));
21492170
assert_eq!(result.cred.setgroups, Some(DGroups::from(vec![gid.into()])));
21502171
assert_eq!(result.cred.caps, None);
2151-
assert_eq!(result.score.setuser_min.uid, Some(SetuidMin::from(&uid.into())));
2172+
assert_eq!(
2173+
result.score.setuser_min.uid,
2174+
Some(SetuidMin::from(&uid.into()))
2175+
);
21522176
assert_eq!(
21532177
result.score.setuser_min.gid,
21542178
Some(SetgidMin::from(&Into::<DGroupType<'_>>::into(uid)))

‎src/sr/finder/mod.rs‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,9 @@ use rar_common::{
2424
use serde::de::DeserializeSeed;
2525

2626
use crate::{
27-
error::{SrError, SrResult}, finder::de::{CredOwnedData}, Cli
27+
error::{SrError, SrResult},
28+
finder::de::CredOwnedData,
29+
Cli,
2830
};
2931

3032
pub(crate) mod api;
@@ -64,7 +66,7 @@ pub fn find_best_exec_settings<'de: 'a, 'a, P>(
6466
cred: &'a Cred,
6567
path: &'a P,
6668
env_vars: impl IntoIterator<Item = (impl Into<String>, impl Into<String>)>,
67-
env_path: & [&str],
69+
env_path: &[&str],
6870
) -> SrResult<BestExecSettings>
6971
where
7072
P: AsRef<Path>,
@@ -160,8 +162,7 @@ impl BestExecSettings {
160162
env_vars,
161163
opt_stack.calc_path(env_path),
162164
cred,
163-
&result
164-
.cred.setuid,
165+
&result.cred.setuid,
165166
format!(
166167
"{}{}",
167168
cli.cmd_path.display(),

‎src/sr/main.rs‎

Lines changed: 42 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -356,13 +356,7 @@ fn main_inner() -> SrResult<()> {
356356
print!(" and group(s): ");
357357
let groups = gids
358358
.iter()
359-
.map(|g| {
360-
format!(
361-
"{} ({})",
362-
g.name,
363-
g.gid
364-
)
365-
})
359+
.map(|g| format!("{} ({})", g.name, g.gid))
366360
.collect::<Vec<_>>()
367361
.join(", ");
368362
println!("{}", groups);
@@ -413,22 +407,24 @@ fn main_inner() -> SrResult<()> {
413407
let cargs = args.cmd_args.clone();
414408
let cfinal_path = execcfg.final_path.clone();
415409
let cfinal_env = execcfg.env.clone();
416-
let command = unsafe { Command::new(&execcfg.final_path)
417-
.pre_exec(move || {
418-
use crate::finder::api::{Api, ApiEvent};
419-
Api::notify(ApiEvent::PreExec(&args, &execcfg)).map_err(|e| {
420-
error!("Failed to notify pre-exec event: {}", e);
421-
std::io::Error::new(std::io::ErrorKind::Other, "Failed to notify pre-exec")
422-
})?;
423-
Ok(())
424-
})
425-
.args(cargs.iter())
426-
.env_clear()
427-
.envs(cfinal_env)
428-
.stdin(std::process::Stdio::inherit())
429-
.stdout(std::process::Stdio::inherit())
430-
.stderr(std::process::Stdio::inherit())
431-
.spawn(&pty.pts().expect("Failed to get pts")) };
410+
let command = unsafe {
411+
Command::new(&execcfg.final_path)
412+
.pre_exec(move || {
413+
use crate::finder::api::{Api, ApiEvent};
414+
Api::notify(ApiEvent::PreExec(&args, &execcfg)).map_err(|e| {
415+
error!("Failed to notify pre-exec event: {}", e);
416+
std::io::Error::new(std::io::ErrorKind::Other, "Failed to notify pre-exec")
417+
})?;
418+
Ok(())
419+
})
420+
.args(cargs.iter())
421+
.env_clear()
422+
.envs(cfinal_env)
423+
.stdin(std::process::Stdio::inherit())
424+
.stdout(std::process::Stdio::inherit())
425+
.stderr(std::process::Stdio::inherit())
426+
.spawn(&pty.pts().expect("Failed to get pts"))
427+
};
432428
let mut command = match command {
433429
Ok(command) => command,
434430
Err(e) => {
@@ -482,11 +478,23 @@ fn set_capabilities(execcfg: &BestExecSettings) -> SrResult<()> {
482478
}
483479

484480
fn setuid_setgid(execcfg: &BestExecSettings) -> SrResult<()> {
485-
let gid = execcfg.cred.setgroups.as_ref().and_then(|g| g.first().cloned()).map(|g| g.gid.as_raw());
481+
let gid = execcfg
482+
.cred
483+
.setgroups
484+
.as_ref()
485+
.and_then(|g| g.first().cloned())
486+
.map(|g| g.gid.as_raw());
486487
with_privileges(&[Cap::SETUID, Cap::SETGID], || {
487-
capctl::cap_set_ids(execcfg.cred.setuid.as_ref().map(|u| u.uid.as_raw()), gid, execcfg.cred.setgroups.as_ref().map(
488-
|g| g.iter().map(|g| g.gid.as_raw()).collect::<Vec<_>>(),
489-
).as_deref())?;
488+
capctl::cap_set_ids(
489+
execcfg.cred.setuid.as_ref().map(|u| u.uid.as_raw()),
490+
gid,
491+
execcfg
492+
.cred
493+
.setgroups
494+
.as_ref()
495+
.map(|g| g.iter().map(|g| g.gid.as_raw()).collect::<Vec<_>>())
496+
.as_deref(),
497+
)?;
490498
Ok(())
491499
})
492500
.map_err(|e| {
@@ -497,11 +505,11 @@ fn setuid_setgid(execcfg: &BestExecSettings) -> SrResult<()> {
497505

498506
#[cfg(test)]
499507
mod tests {
508+
use super::finder::de::CredOwnedData;
500509
use capctl::{Cap, CapSet};
501510
use libc::getgid;
502511
use nix::unistd::{getgroups, getuid, Group, Pid, User};
503512
use rar_common::database::options::SBounding;
504-
use super::finder::de::CredOwnedData;
505513

506514
use super::*;
507515

@@ -563,7 +571,12 @@ mod tests {
563571
capset.effective.add(Cap::SETGID);
564572
capset.set_current().unwrap();
565573
let execcfg = BestExecSettings::builder()
566-
.cred(CredOwnedData::builder().setuid(User::from_uid(1000.into()).unwrap().unwrap()).setgroups(vec![Group::from_gid(1000.into()).unwrap().unwrap()]).build())
574+
.cred(
575+
CredOwnedData::builder()
576+
.setuid(User::from_uid(1000.into()).unwrap().unwrap())
577+
.setgroups(vec![Group::from_gid(1000.into()).unwrap().unwrap()])
578+
.build(),
579+
)
567580
.build();
568581
setuid_setgid(&execcfg).unwrap();
569582
assert_eq!(getuid(), execcfg.cred.setuid.unwrap().uid);

0 commit comments

Comments
 (0)