console assets fetch looks subject to races

[davepacheco]

I think there's some time-of-check-to-time-of-use issues with the way we serve console asset files. In particular, if you had a/b/c/d, and the code got to "b" and confirmed it wasn't a symlink, and then you changed it to be a symlink to something completely different, I think we'd follow it to some/other/path/c/d.

[david-crespo]

I haven't dealt with something like this before. I'm guessing you can't lock down the files so they don't change, but rather make sure when you're pulling a/b/c/d that a, a/b, and a/b/c are not symlinks? I have a hard time picturing how to do this in a way that doesn't leave a tiny window of time where a file could change to a symlink.

For future reference to the fixer, here is the relevant code:

omicron/nexus/src/external_api/console_api.rs

Lines 358 to 377 in f91a12b

	let mut current = root_dir.to_owned(); // start from `root_dir`
	for segment in &path {
	// If we hit a non-directory thing already and we still have segments
	// left in the path, bail. We have nowhere to go.
	if !current.is_dir() {
	return Err(not_found("expected a directory"));
	}
	current.push(segment);
	// Don't follow symlinks.
	// Error means either the user doesn't have permission to pull
	// metadata or the path doesn't exist.
	let m = current
	.symlink_metadata()
	.map_err(|_| not_found("failed to get file metadata"))?;
	if m.file_type().is_symlink() {
	return Err(not_found("attempted to follow a symlink"));
	}
	}

[davepacheco]

Yeah. There's some discussion on oxidecomputer/dropshot#327. I think this is basically why the openat family of functions exist -- you open the root, then openat the first directory component within the root, fstat it to see if it's a symlink, then openat the next component, etc. There's no opportunity for something you've checked whether it's a symlink to suddenly become something else because you're never referencing it (by name) twice. You're always getting an fd, check that for being a symlink, then opening something relative to the fd instead of an absolute path.