Elektra 0.8.26
|
This plugin checks whether the value of a key is a valid file system path and optionally if correct permissions are set for a certain user.
The motivation to write this plugin is given by the two paths that exist in /etc/fstab: the device file and the mountpoint. A missing file is not necessarily an error, because the device file may appear later when a device is plugged in and the mountpoint may be there when another subsequent mount was executed. So only warnings are yielded in that case. One situation, however, presents an error: Only an absolute path is allowed to occur for both device and mountpoint. When checking for relative files, it is not enough to look at the first character if it is a /
, because remote file systems and some special names are valid, too.
If check/path/mode = <permission>
is also present it will check for the correct permissions of the file/directory. Optionally, you can also add check/path/user = <user>"</tt> which then checks the permissions
for the given user. When calling <tt>kdb set</tt> on the actual key, you have to run as <tt>root</tt> user
or the file permissions cannot be checked (you will receive an error message). It is also possible to leave the
<tt>check/path/user</tt> empty (just provide an empty string) which then takes the executing user as target to check.
So for example <tt>sudo kdb set ...</tt> will check if <tt>root</tt> can access the target file/directory whereas <tt>kdb set ...</tt>
will take the current executing process/user. If <tt>check/path/user</tt> is not given at all, the plugin
will check accessibility for the <tt>root</tt> user only (which again requires <tt>sudo</tt>)
<tt>check/path/mode = rw</tt> and <tt>check/path/user = tomcat</tt> for example will check if the user
<tt>tomcat</tt> has read and write access to the path which was set for the key. Please note that the file has to exist already
and it is not checked if the user has the right to create a file in the directory.
Permissions available:
- <tt>r</tt>: **R**ead
- <tt>w</tt>: **W**rite
- <tt>x</tt>: e**X**ecute
@section autotoc_md357 Usage
If the metakey <tt>check/path</tt> is present, it is checked if the value is a
valid absolute file system path. If a metavalue is present, an additional
check will be done if it is a directory or device file.
@section autotoc_md358 Examples
An example on which the user should have no permission at all for the root directory.
@code
sudo kdb mount test.dump user/tests path dump
sudo kdb set user/tests/path "$HOME"
sudo kdb setmeta user/tests/path check/path ""
sudo kdb setmeta user/tests/path check/path/user ""
sudo kdb setmeta user/tests/path check/path/mode "rw"
# Standard users should not be able to read/write the root folder
kdb set user/tests/path "/root"
# ERROR:210
# Set something which the current user can access for sure
kdb set user/tests/path "$HOME"
# STDOUT-REGEX: .*Set string to "/.*".*
#cleanup
sudo kdb rm -r user/tests
sudo kdb umount user/tests
@endcode
An example where part of the permissions are missing for a tmp file
@code
sudo kdb mount test.dump user/tests path dump
sudo kdb set user/tests/path "$HOME"
sudo kdb setmeta user/tests/path check/path ""
sudo kdb setmeta user/tests/path check/path/user ""
sudo kdb setmeta user/tests/path check/path/mode "rwx"
# Standard users should not be able to read/write the root folder
kdb set user/tests/path/tempfile $(mktemp)
chmod +rw `kdb get user/tests/path/tempfile`
kdb set user/tests/path `kdb get user/tests/path/tempfile`
# ERROR:210
# Set something which the current user can access for sure
chmod +x `kdb get user/tests/path/tempfile`
kdb set user/tests/path `kdb get user/tests/path/tempfile`
# STDOUT-REGEX: Set string to "/.*".*
#cleanup sudo rm -rf `kdb get user/tests/path/tempfile` sudo kdb rm -r user/tests sudo kdb umount user/tests
Add a check which ensures that the given path is a file/directory/symbolic link/hard link/etc.