anastasis

commit d8d8258d6407a1c39ca5d889f01f27dfa386a197
parent a11a72f2fad227876d2e1523e1bb1b86b8167e6a
Author: Christian Grothoff <christian@grothoff.org>
Date:   Tue,  4 Aug 2026 15:21:08 +0200

document file-based authorization plugin

Diffstat:
M
doc/anastasis.conf.5
 | 
15
+++++++++++++++
M
doc/sphinx/manpages/anastasis.conf.5.rst
 | 
16
++++++++++++++++
M
src/authorization/anastasis_authorization_plugin_file.c
 | 
20
++++++++++++++++++--
M
src/authorization/meson.build
 | 
6
+++++-

4 files changed, 54 insertions(+), 3 deletions(-)
diff --git a/doc/anastasis.conf.5 b/doc/anastasis.conf.5
@@ -144,6 +144,21 @@ Helper command to run to send SMS.
 .B COMMAND
 Helper command to run to send E\-mail.
 .UNINDENT
+.SS File Authorization options
+.sp
+The \fBfile\fP method writes the challenge code to a file instead of sending
+it anywhere.  It is meant for testing and for exercising user interfaces;
+anyone who can read the file can pass the challenge, so it must not be
+enabled on a production provider.
+.INDENT 0.0
+.TP
+.B DIRECTORY
+Directory the challenge files are written to.  The file name is derived from
+the (client\-supplied) truth data, and a name that would escape this directory
+is refused.  Defaults to \fB$TMPDIR/anastasis\-file\-challenges\fP, which is a
+predictable name in a shared directory: on a multi\-user host, set this to a
+directory only the provider can read.
+.UNINDENT
 .SS Post Authorization options
 .INDENT 0.0
 .TP
diff --git a/doc/sphinx/manpages/anastasis.conf.5.rst b/doc/sphinx/manpages/anastasis.conf.5.rst
@@ -139,6 +139,22 @@ COMMAND
   Helper command to run to send E-mail.  The command will be given the e-mail address as its first argument. The message to be transmitted will be passed via STDIN.
 
 
+File Authorization options
+^^^^^^^^^^^^^^^^^^^^^^^^^^
+
+The ``file`` method writes the challenge code to a file instead of sending
+it anywhere.  It is meant for testing and for exercising user interfaces;
+anyone who can read the file can pass the challenge, so it must not be
+enabled on a production provider.
+
+DIRECTORY
+  Directory the challenge files are written to.  The file name is derived from
+  the (client-supplied) truth data, and a name that would escape this
+  directory is refused.  Defaults to ``$TMPDIR/anastasis-file-challenges``,
+  which is a predictable name in a shared directory: on a multi-user host, set
+  this to a directory only the provider can read.
+
+
 Post Authorization options
 ^^^^^^^^^^^^^^^^^^^^^^^^^^
 
diff --git a/src/authorization/anastasis_authorization_plugin_file.c b/src/authorization/anastasis_authorization_plugin_file.c
@@ -268,10 +268,22 @@ file_challenge (struct ANASTASIS_AUTHORIZATION_State *as,
   if (NULL == lang)
     lang = "en";
   {
-    FILE *f = fopen (as->filename, "w");
-
+    FILE *f;
+    int fd;
+
+    /* The challenge code is a secret, and the default directory sits in a
+       world-writable /tmp: refuse to follow a symlink someone else planted
+       there, and do not let anyone else read the code back. */
+    fd = open (as->filename,
+               O_WRONLY | O_CREAT | O_TRUNC | O_NOFOLLOW,
+               S_IRUSR | S_IWUSR);
+    f = (-1 == fd)
+        ? NULL
+        : fdopen (fd, "w");
     if (NULL == f)
     {
+      if (-1 != fd)
+        GNUNET_break (0 == close (fd));
       struct MHD_Response *resp;
       enum MHD_Result mres;
 
@@ -405,6 +417,10 @@ libanastasis_plugin_authorization_file_init (void *cls)
   }
   ctx = GNUNET_new (struct FileContext);
   ctx->ac = ac;
+  /* The default lands in a shared /tmp under a predictable name, so a local
+     user can pre-create it and read every challenge code that follows.  That
+     is tolerable only because this plugin exists for testing; an operator who
+     points DIRECTORY somewhere private gets a private directory. */
   /* filename_ok() relies on the trailing '/' to tell "inside the directory"
      from "a sibling whose name merely starts the same way". */
   GNUNET_asprintf (&ctx->directory,
diff --git a/src/authorization/meson.build b/src/authorization/meson.build
@@ -1,5 +1,9 @@
 # This file is in the public domain
-install_data('authorization-email.conf', install_dir: pkgcfgdir)
+install_data(
+    'authorization-email.conf',
+    'authorization-file.conf',
+    install_dir: pkgcfgdir,
+)
 
 subdir('libanastasiseufin')