1. Overview
The PolicySecurity.hpp header declares RootGuard’s hardened policy-file reader. Its contract specifically removes a validate-then-open TOCTOU window by validating the descriptor that is actually read.
The file integrates the following components, APIs, or runtime concepts:
- POSIX open/fstat/read – descriptor-based secure read path
2. Read API
read(path, requireSecureOwnership) returns the complete policy text. When secure ownership is required, the implementation additionally enforces root ownership and rejects group/other writable policy files.
3. TOCTOU Contract
The documented design opens with O_NOFOLLOW, validates the already-open file descriptor, and reads from that same descriptor. This prevents a symlink/path swap between validation and read.
4. Runtime and Security Considerations
- Symlink rejection: policy paths cannot silently redirect to another file.
- Same-descriptor validation: security checks apply to the exact file content consumed by the parser.
Published on:
Last updated on: