Configuration for file system tools.
== How a path is judged == By where it really is, not by how it is spelled: every symbolic link is replaced by its real target, then the result is compared with each entry, resolved the same way, one path component at a time. isPathAllowed judges the path as given, and a .. after a link is read both ways an OS reads it: physically, as POSIX does (link/.. is the parent of the link's target), and lexically, as Windows does (.. removed as text before links are followed, so link/.. is the directory holding the link). The path is allowed only when both locations are allowed, whatever platform the check runs on; a path whose readings disagree, one inside and one outside, is refused on every OS. The tools first remove . and .. from the path they are given as text (data/link/../x is data/x for them), so the two readings agree, and then judge and open that location, so what they open is what they checked. /srv/data allows /srv/data/x and does not allow /srv/data-secret/x. A symbolic link that cannot be resolved (a dangling link) is refused. The tools open the resolved path, so a link swapped in after the check does not redirect the open; a directory swapped for a link between the resolution and the open is a race this narrows and does not close. A hard link is not contained: a hard link inside an allowed directory to a file elsewhere is that file under an allowed name, and no path check can tell it apart, so do not let untrusted parties create files in an allowed directory.
Value parameters
- allowedPaths
-
Paths that are allowed to be accessed. None means any path. An entry that is itself reached through a symbolic link (such as
/tmpon macOS) is resolved, and so are the paths checked against it. - blockedPaths
-
Paths that are blocked from access (takes precedence over allowedPaths). Matched on the real location too, so blocking
/etcalso blocks/private/etcon macOS, and the default/varalso blocks/private/var, where macOS keeps per-user temporary directories. Matched without regard to case or Unicode normalisation, so/ETC/hostsis blocked by/etc, as it must be on a case-insensitive file system such as the macOS and Windows defaults; on a case-sensitive one this blocks a few more paths than it must, never fewer. The default is FileConfig.DefaultBlockedPaths, the system and credential locations of the platform the JVM runs on. A blocklist is defence in depth: it cannot name every sensitive file, so setallowedPathsto the directories the agent needs. - followSymlinks
-
Whether to follow a symbolic link that is the final component of the path (default: false for security). When
false,read_filereports such a link as not a regular file andfile_infoandlist_directorydescribe the link itself. This does not decide whether a link may lead out of the allowed area: a link anywhere on the path, final or not, is resolved first, and the path is allowed only if its real location is. - maxFileSize
-
Maximum file size to read in bytes (default: 1MB)
Attributes
- Companion
- object
- Graph
-
- Supertypes
-
trait Serializabletrait Producttrait Equalsclass Objecttrait Matchableclass Any