potager/mm3-hk-export
3
0
Fork 0
Code Issues 1 Pull requests Projects Releases Packages Wiki Activity Actions

Drop the /var/tmp handoff hardening for a plain copy

Browse source 
The SHA-256 double-hash and TOCTOU defenses (O_NOFOLLOW/O_NONBLOCK, S_ISREG, fsync, in-process durable mkdir) guarded against a hostile same-uid process racing the /var/tmp handoff — a threat that does not match this deployment (a small trusted collective, no hostile local users), and the cost showed up as a 10-15s silent gap after the progress bar (two full passes over the archive).

Replace the ~60-line python3 publish block with plain shell: mkdir -p, mktemp in the destination dir, cp, atomic mv -f, rm the source. The two-stage handoff and atomic rename stay (the web user cannot write into a root-owned destination, and the rename keeps $out from being partial). The exporter no longer hashes either. README updated to match.
This commit is contained in:
veg 2026-05-31 14:47:35 +00:00
parent a39ca3157f
commit f4ed22ceab
2 changed files with 19 additions and 98 deletions
Download patch file Download diff file Expand all files Collapse all files

7
README.md
View file

@ -71,7 +71,6 @@ export must still halt the destroy.)
- **Large lists.** Streamed via a DB iterator, so no memory blow-up like the web
export.
- **Re-import.** Valid mbox; re-importable with `hyperkitty_import`.
- **Handoff.** The web user builds the archive in `/var/tmp`; root verifies it by
SHA-256 and publishes atomically, so a swap, truncation, or corruption before
publish is caught and nothing is published. A compromised `mailman-web` is out
of scope.
- **Handoff.** The web user builds the archive in `/var/tmp` (it can't write into
a root-owned destination); root copies it out and renames into place, so `$out`
is never left partial.