libdokan: Provide fake root directory for other SIDs #1016
Conversation
There was a problem hiding this comment.
LGTM 👍
As an aside, I've wondered if there is a way to quiet down all the Explorer access it seems to do for previews and recently used files listing, etc. I think there may be a way which would require using an extension, which seems heavy-handed. Do you have thoughts on that?
libdokan/fs.go
Outdated
| @@ -538,6 +545,18 @@ func (f *FS) MoveFile(ctx context.Context, source *dokan.FileInfo, targetPath st | |||
| return nil | |||
| } | |||
|
|
|||
| // isPotentialRenamePath filters out some special paths | |||
There was a problem hiding this comment.
nit: can you please move this up to above the use?
libdokan/fakeroot.go
Outdated
| return nil | ||
| } | ||
| var ns dokan.NamedStat | ||
| ns.FileAttributes = dokan.FileAttributeDirectory |
There was a problem hiding this comment.
Why a directory and not a file? Not a big deal, just curious. I'd slightly prefer a solution that had a text file with explanatory text inside, but this is good enough for now I think.
| f.log.Errorf("Refusing access: SID match error") | ||
| return nil, false, dokan.ErrAccessDenied | ||
| f.log.Errorf("FS CreateFile - Refusing real access: SID match error") | ||
| return openFakeRoot(ctx, f, fi) |
There was a problem hiding this comment.
We're always guaranteed on Windows that the root will get a CreateFile call first on an empty string, before file listing is allowed or any other specific files can be looked up?
There was a problem hiding this comment.
The only ops not needing an opened file are CreateFile, GetDiskFreeSpace and GetVolumeInformation. MoveFile (rename) is also interesting from a security pov, but it needs an open file. Fakeroot takes care that only \ and \errorfilename succeed at CreateFile.
taruti
force-pushed
the
taruti/dokan-fakeroot
branch
from
4092d18
to
ddf5f18
Compare
|
Also changed from a folder to a file as per CR and moved the one comment around. |
Provides a fake root directory for different SIDs. Should help with:
keybase/client#5490 and more recent issues.
The basic issue is with corporate AV products doing:
To test this patch using
-mount-flags 0when mounting kbfsdokan + switch user is the simplest way.@zanderz is the error folder name ok for you?