15 Commits

Author SHA1 Message Date
Morten Linderud
0dcec78956 sign: ensure we are getting RW/RO access for the files
Signed-off-by: Morten Linderud <morten@linderud.pw>
2024-08-02 21:49:57 +02:00
Morten Linderud
34544d737d lsm: Implement TruncFile
We need RWFile access + O_TRUNC access

Signed-off-by: Morten Linderud <morten@linderud.pw>
2024-08-01 12:53:03 +02:00
Morten Linderud
89dd1a2376 database: ensure we landlock files with O_TRUNC permissions
Signed-off-by: Morten Linderud <morten@linderud.pw>
2024-07-31 00:08:28 +02:00
Morten Linderud
c9d25391a9 sbctl: implement landlock sandboxing
Signed-off-by: Morten Linderud <morten@linderud.pw>
2024-07-29 21:30:46 +02:00
Morten Linderud
71024417a3 Rework sbctl backend
Signed-off-by: Morten Linderud <morten@linderud.pw>
2024-07-24 21:15:29 +02:00
Morten Linderud
e1ce225d88 Implement fs package and remove all direct filesystem calls 2023-02-17 19:19:26 +01:00
Morten Linderud
22cbf4d1e5 Read*Database: don't fail on empty file
If we have a newly created and empty file then the json parsing fails.
We should allow this and return an empty map/slice instead.

Signed-off-by: Morten Linderud <morten@linderud.pw>
2022-10-31 22:31:22 +01:00
Hugo Osvaldo Barrera
3f9d1d926c Check returned errors
Check a few errors that were not being handled properly.

Co-authored-by: Morten Linderud <morten@linderud.pw>
2022-07-07 19:59:15 +02:00
Morten Linderud
fe514e1af7 Added errors to WriteFileDatabase
Signed-off-by: Morten Linderud <morten@linderud.pw>
2021-05-30 14:46:38 +02:00
Morten Linderud
3d7f094988 Added an iter function
Signed-off-by: Morten Linderud <morten@linderud.pw>
2021-05-30 14:43:05 +02:00
igo95862
d3feae2791 Remove ioutil
Deprecated in GO 1.16
2021-05-16 21:14:42 +03:00
Érico Rolim
cc55d6e443 Add ReadOrCreateFile utility function.
This function will try to read a file into a byte buffer, and, if the
file doesn't exist, create its containing directory and the file itself.
If any of those actions fail due to permissions, the function will print
a warning about running the tool as root.

Reading from the file and bundle databases works like this, so the error
checking should be implemented in a single place.

Also, use the new function in ReadFileDatabase().

Signed-off-by: Érico Rolim <erico.erc@gmail.com>
2021-01-11 00:49:45 -03:00
Érico Rolim
92bb91172d Improve error propagation and permission checking.
- Introduces dependency on sys/unix for unix.Access. This is necessary
only in keys.go, since we run 'sbsign' as a command and can't check if
it failed due to permissions.

- Allows removing special casing in main.go for commands that don't
require root permissions.

- ReadFileDatabase() can now return errors due to the multiple ways in
which it can fail; it also warns the user about possibly requiring root.

- ReadFileDatabase() was using the global DBPath instead of its dbpath
parameter in multiple places. This has been fixed.

- VerifyESP() can now run without root.

- SignFile() checks if it can read the DB key before running sbsign.

Signed-off-by: Érico Rolim <erico.erc@gmail.com>
2021-01-11 00:49:45 -03:00
Morten Linderud
d03440ae4c sbctl: Add original file checksums so we know when they changed
Signed-off-by: Morten Linderud <morten@linderud.pw>
2020-07-09 16:07:53 +02:00
Morten Linderud
0b5d4a46ea Init
Signed-off-by: Morten Linderud <morten@linderud.pw>
2020-05-03 19:41:09 +02:00