Rework Toolchain model and drop relative file path overrides

[rbtcollins]

Rework Toolchain model and drop relative file path overrides

Relative path overrides permit a freshly downloaded source tree to
execute arbitrary code on any rustup command that executes a binary from
the configured toolchain, and its a reasonable tradeoff for us to remove
this feature. Absolute path overrides are kept intact - these were added
to support users of large monorepo tool systems, and can be kept with
reasonable safety.

Introduce an interior model for toolchain names which allows the
elimination of conditional code for custom vs named vs path based
toolchains. Fixes #3130. Close #3174

Finishes the separation of Toolchain vs DistributableToolchain vs
CustomToolchain started some time ago.

Moves some test support into the src tree in order to keep symbols
private and adds a 'test' feature required for self-testing, ensuring
that that code doesn't affect production builds.

Adds in a new build that tests the combination of features together (on just one platform), to ensure all combinations are valid.

[hi-rustin]

I have noticed a few minor issues.

Looks great and much clearer. Thank you!

[matklad]

Relative path overrides permit a freshly downloaded source tree to
execute arbitrary code on any rustup command that executes a binary from
the configured toolchain, and its a reasonable tradeoff for us to remove
this feature. Absolute path overrides are kept intact - these were added
to support users of large monorepo tool systems, and can be kept with
reasonable safety.

I think relative paths are a subset of absolute paths, so, security-wise, this is a no-op.

Namely, ./foo/bar relative path is equivalent to /proc/self/cwd/foo/bar absolute path.

[matklad]

Verified with

[toolchain]
# path = ".cargo"
path = "/proc/self/cwd/.cargo"

on

https://github.com/jonas-schievink/mallory

[jonhoo]

That's definitely unfortunate. I think removing path-based toolchains altogether is going to break things, especially for more corporate users with additional build orchestration around Cargo (e.g., Amazon). How feasible is it to disallow specifically /proc (and maybe also /sys)? Do we know of other absolute-to-relative proxies like this?

[matklad]

@rbtcollins is the issue that absolute paths are also unsafe tracked anywhere?

[rbtcollins]

Not yet, please do open a bug from this, and we'll have to discuss whether to give up, filter some absolute paths and hope that's sufficient, or some other thing.