Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add safe.directories config #10736

Open
wants to merge 9 commits into
base: master
Choose a base branch
from
Open

Add safe.directories config #10736

Changes from 1 commit
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
fb68ae4
Add metadata and symlink_metadata functions to cargo_util::paths
ehuss Jun 10, 2022
2189462
Add ownership validation to cargo_util.
ehuss Jun 10, 2022
bbd41a4
Rework how workspace roots are discovered.
ehuss Jun 10, 2022
b2d8a44
Rework config walk_tree in preparation for safe_directories
ehuss Jun 10, 2022
fe72b8b
Add OwnershipError converter.
ehuss Jun 10, 2022
a31c16f
Load safe.directories config and check it for config.
ehuss Jun 10, 2022
a9e8556
Check ownership during Cargo.toml discovery.
ehuss Jun 10, 2022
25a21df
Add safe.directories testsuite.
ehuss Jun 10, 2022
e966aa7
Add documentation for safe.directories.
ehuss Jun 10, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 30 additions & 1 deletion src/doc/src/reference/unstable.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -103,6 +103,8 @@ Each new feature described below should explain how to use it.
* [credential-process](#credential-process) — Adds support for fetching registry tokens from an external authentication program.
* [`cargo logout`](#cargo-logout) — Adds the `logout` command to remove the currently saved registry token.
* [http-registry](#http-registry) — Adds support for fetching from http registries (`sparse+`)
* Misc
* [safe-directories](#safe-directories) — Adds a security check for file discovery.

### allow-features

Expand Down Expand Up @@ -1417,6 +1419,33 @@ dep-dev.workspace = true
[specifying-dependencies]: specifying-dependencies.md
[renaming-dependencies-in-cargotoml]: specifying-dependencies.md#renaming-dependencies-in-cargotoml

### safe-directories
* Tracking Issue: TODO
* RFC: [#3279](https://github.com/rust-lang/rfcs/pull/3279)

The `CARGO_UNSTABLE_SAFE_DIRECTORIES=true` environment variable enables a mode where Cargo will check the ownership of `Cargo.toml` and `config.toml` files.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Once this is merged, should we do a Call for Testing in TWiR?

If the files are owned by a user different from the current user,
then Cargo will generate an error.
This is a security mechanism to ensure that a malicious user doesn't add one of those files in a parent directory of wherever you run `cargo`.
See the RFC for more details.

The ownership check can be overridden with the `safe.directories` configuration setting.
This is an array of paths that you explicitly trust even if they are owned by another user.

```toml
[safe]
directories = ["/path/to/project"]
```

This config setting may only be set in the [Cargo home directory](../guide/cargo-home.md).
Other file locations are not allowed.

This config option can also be set with the `CARGO_SAFE_DIRECTORIES` or `RUSTUP_SAFE_DIRECTORIES` environment variables.
Multiple paths may be separated with `:` on Unix-like environments or `;` for Windows environments.

An entry of an asterisk (such as `CARGO_SAFE_DIRECTORIES=*`) entirely disables the ownership check for all paths.


## Stabilized and removed features

### Compile progress
Expand Down Expand Up @@ -1597,4 +1626,4 @@ See the [Features chapter](features.md#dependency-features) for more information

The `-Ztimings` option has been stabilized as `--timings` in the 1.60 release.
(`--timings=html` and the machine-readable `--timings=json` output remain
unstable and require `-Zunstable-options`.)
unstable and require `-Zunstable-options`.)