Improve temporary directory handling #336
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
deeplow
requested changes
Feb 9, 2023
apyrgio
force-pushed
the
335-mount
branch
2 times, most recently
from
ddf9f5a to
303749d
Compare
|
I have updated this branch with the changes we discussed. The commits that are of more interest are the following:
If you're ok with those, I can squash them and merge. |
deeplow
approved these changes
Feb 16, 2023
Do not store temporary directories in the Dangerzone's config directory. There are two reasons for that: 1. They are ephemeral, and they need a temporary place to be stored, preferably RAM-backed. 2. We need to set them while running our CI tests.
Run each CLI command in a separate config/cache dir, to avoid leaks between tests. Moreover, this way we are able to check the contents of the config/cache dirs for a single CLI run.
Do not leave stale temporary directories when conversion fails unexpectedly. Instead, wrap the conversion operation in a context manager that wipes the temporary dir afterwards. Fixes #317
Take SELinux labels into account when mounting a file to the Dangerzone container. Use the `:Z` flag (which is a no-op in non-SELinux systems) to clear the existing SELinux label for a file, and apply one that matches the container's. Refs #335
Copy input files in a temporary dir before mounting them, thereby changing their permissions, without affecting the original files. This way, we can avoid cases where a file is accessible to the user only due to a supplemental user group, which does not work for containers. Fixes #157 Fixes #260 Fixes #335
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR fixes several issues that have to do with, or are tangent to, temporary directory handling in Dangerzone. Briefly, this PR fixes the following issues:
Fixes #157
Fixes #260
Fixes #317
Fixes #335