aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authornetworkException <git@nwex.de>2023-10-19 03:29:48 +0200
committernetworkException <git@nwex.de>2023-10-19 03:29:48 +0200
commitc99cb58d712fcfdcc9ec03095c0cac25e0c2b934 (patch)
tree1cc7f0a048372a9a59623f977978974931b2fb68
parent5feb6a1f64aaede10f8172c37645da18a96b419c (diff)
downloadgarage-c99cb58d712fcfdcc9ec03095c0cac25e0c2b934.tar.gz
garage-c99cb58d712fcfdcc9ec03095c0cac25e0c2b934.zip
util: move reading secret file into seperate helper
this patch moves the logic to read a secret file (and check for correct permissions) from `secret_from_file` into a new `read_secret_file` helper.
-rw-r--r--src/util/config.rs35
1 files changed, 19 insertions, 16 deletions
diff --git a/src/util/config.rs b/src/util/config.rs
index ebcb5fbe..756f7ec5 100644
--- a/src/util/config.rs
+++ b/src/util/config.rs
@@ -238,6 +238,24 @@ pub fn read_config(config_file: PathBuf) -> Result<Config, Error> {
Ok(parsed_config)
}
+pub fn read_secret_file(file_path: &String) -> Result<String, Error> {
+ #[cfg(unix)]
+ if std::env::var("GARAGE_ALLOW_WORLD_READABLE_SECRETS").as_deref() != Ok("true") {
+ use std::os::unix::fs::MetadataExt;
+ let metadata = std::fs::metadata(file_path)?;
+ if metadata.mode() & 0o077 != 0 {
+ return Err(format!("File {} is world-readable! (mode: 0{:o}, expected 0600)\nRefusing to start until this is fixed, or environment variable GARAGE_ALLOW_WORLD_READABLE_SECRETS is set to true.", file_path, metadata.mode()).into());
+ }
+ }
+ let mut file = std::fs::OpenOptions::new().read(true).open(file_path)?;
+ let mut secret_buf = String::new();
+ file.read_to_string(&mut secret_buf)?;
+
+ // trim_end: allows for use case such as `echo "$(openssl rand -hex 32)" > somefile`.
+ // also editors sometimes add a trailing newline
+ Ok(String::from(secret_buf.trim_end()))
+}
+
fn secret_from_file(
secret: &mut Option<String>,
secret_file: &Option<String>,
@@ -250,22 +268,7 @@ fn secret_from_file(
(Some(_), Some(_)) => {
return Err(format!("only one of `{}` and `{}_file` can be set", name, name).into());
}
- (None, Some(file_path)) => {
- #[cfg(unix)]
- if std::env::var("GARAGE_ALLOW_WORLD_READABLE_SECRETS").as_deref() != Ok("true") {
- use std::os::unix::fs::MetadataExt;
- let metadata = std::fs::metadata(file_path)?;
- if metadata.mode() & 0o077 != 0 {
- return Err(format!("File {} is world-readable! (mode: 0{:o}, expected 0600)\nRefusing to start until this is fixed, or environment variable GARAGE_ALLOW_WORLD_READABLE_SECRETS is set to true.", file_path, metadata.mode()).into());
- }
- }
- let mut file = std::fs::OpenOptions::new().read(true).open(file_path)?;
- let mut secret_buf = String::new();
- file.read_to_string(&mut secret_buf)?;
- // trim_end: allows for use case such as `echo "$(openssl rand -hex 32)" > somefile`.
- // also editors sometimes add a trailing newline
- *secret = Some(String::from(secret_buf.trim_end()));
- }
+ (None, Some(file_path)) => *secret = Some(read_secret_file(file_path)?),
}
Ok(())
}