The_Great_Archive/ArchiveBox
1
0
Fork 0
mirror of https://github.com/ArchiveBox/ArchiveBox.git synced 2026-09-14 11:06:13 +05:00
Code Issues Actions Packages Projects Releases Wiki Activity

Repair copied collection ownership boundaries

Browse Source
This commit is contained in:
Nick Sweeting 2026-08-02 05:22:43 -07:00
parent 7a30b8a8bb
commit 8437e44587
No known key found for this signature in database
2 changed files with 17 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
archivebox/config/permissions.py
View File

@ -186,8 +186,15 @@ def root_data_dir_handoff_paths(data_dir: Path, argv: list[str]) -> tuple[Path,
return (data_dir, *(data_dir / name for name in ROOT_HANDOFF_NAMES if (data_dir / name).exists()))
def root_should_handoff_data_dir(*, is_root: bool, data_dir_uid: int, account_uid: int | None) -> bool:
"""Allow bounded handoff only for root or archivebox-owned collection roots."""
return is_root and account_uid is not None and data_dir_uid in (0, account_uid)
def handoff_root_owned_data_dir() -> None:
if not (IS_ROOT and DATA_DIR_UID == 0 and ARCHIVEBOX_ACCOUNT is not None):
account_uid = ARCHIVEBOX_ACCOUNT.pw_uid if ARCHIVEBOX_ACCOUNT is not None else None
if not root_should_handoff_data_dir(is_root=IS_ROOT, data_dir_uid=DATA_DIR_UID, account_uid=account_uid):
return
for path in root_data_dir_handoff_paths(DATA_DIR, sys.argv):

10
archivebox/tests/test_permissions.py
View File

@ -1,6 +1,6 @@
from pathlib import Path
from archivebox.config.permissions import is_root_identity, select_archivebox_user
from archivebox.config.permissions import is_root_identity, root_should_handoff_data_dir, select_archivebox_user
def test_root_identity_includes_real_or_effective_root():
@ -70,6 +70,14 @@ def test_effective_root_drops_back_to_real_user():
) == (1001, 1002)
def test_root_hands_off_root_or_archivebox_owned_collection_boundaries():
assert root_should_handoff_data_dir(is_root=True, data_dir_uid=0, account_uid=911)
assert root_should_handoff_data_dir(is_root=True, data_dir_uid=911, account_uid=911)
assert not root_should_handoff_data_dir(is_root=True, data_dir_uid=1001, account_uid=911)
assert not root_should_handoff_data_dir(is_root=False, data_dir_uid=911, account_uid=911)
assert not root_should_handoff_data_dir(is_root=True, data_dir_uid=911, account_uid=None)
def test_root_init_hands_off_only_an_empty_data_dir(tmp_path):
from archivebox.config.permissions import root_data_dir_handoff_paths