protect framework files from apps

There's a separate open question here of where Teliva should store files
like teliva_editor_state and teliva_editor_buffer. One school of thought
is that apps should never be dropping crud into people's directories. On
the other hand, I'm kinda encouraging people so far to just run apps
from Teliva's directory. Perhaps that makes it ok?

2 files changed, 33 insertions, 8 deletions

diff --git a/src/liolib.c b/src/liolib.c
index 6fb3359..feeeb8f 100644
--- a/src/liolib.c
+++ b/src/liolib.c
@@ -132,10 +132,19 @@ static int io_open (lua_State *L) {
   snprintf(buffer, 1020, "io.open(\"%s\", \"%s\")", filename, mode);
   append_to_audit_log(L, buffer);
   FILE **pf = newfile(L);
-  if (file_operation_permitted(filename, mode)
-      /* filenames starting with teliva_tmp_ are always ok */
-      || starts_with(filename, "teliva_tmp_"))
+  /* filenames starting with teliva_tmp_ are always ok */
+  if (starts_with(filename, "teliva_tmp_")) {
     *pf = fopen(filename, mode);
+  }
+  /* other filenames starting with teliva_ are never ok (reserved for the
+   * framework, should not be accessed by apps directly */
+  else if (starts_with(filename, "teliva_")) {
+    snprintf(iolib_errbuf, 1024, "app tried to open file '%s'; that's never allowed for filenames starting with 'teliva_'", filename);
+    Previous_message = iolib_errbuf;
+  }
+  else if (file_operation_permitted(filename, mode)) {
+    *pf = fopen(filename, mode);
+  }
   else {
     snprintf(iolib_errbuf, 1024, "app tried to open file '%s'; adjust its permissions (ctrl-p) if that is expected", filename);
     Previous_message = iolib_errbuf;
diff --git a/src/loslib.c b/src/loslib.c
index 09a00c3..3137a6b 100644
--- a/src/loslib.c
+++ b/src/loslib.c
@@ -46,19 +46,35 @@ static char oslib_errbuf[1024] = {0};
 static int os_rename (lua_State *L) {
   const char *fromname = luaL_checkstring(L, 1);
   const char *toname = luaL_checkstring(L, 2);
-  /* A rename is like reading from one file and writing to another file. */
-  if (!file_operation_permitted(fromname, "r")
-      && !starts_with(fromname, "teliva_tmp_")) {
+  /* Sandboxing {
+   * A rename is like reading from one file and writing to another file. */
+  if (starts_with(fromname, "teliva_tmp_")) {
+    /* continue */
+  }
+  else if (starts_with(fromname, "teliva_")) {
+    snprintf(oslib_errbuf, 1024, "app tried to open file '%s'; that's never allowed for filenames starting with 'teliva_'", fromname);
+    Previous_message = oslib_errbuf;
+    return os_pushresult(L, 0, fromname);
+  }
+  else if (!file_operation_permitted(fromname, "r")) {
     snprintf(oslib_errbuf, 1024, "app tried to open file '%s' for reading; adjust its permissions (ctrl-p) if that is expected", fromname);
     Previous_message = oslib_errbuf;
     return os_pushresult(L, 0, fromname);
   }
-  if (!file_operation_permitted(toname, "w")
-      && !starts_with(fromname, "teliva_tmp_")) {
+  if (starts_with(toname, "teliva_tmp_")) {
+    /* continue */
+  }
+  else if (starts_with(toname, "teliva_")) {
+    snprintf(oslib_errbuf, 1024, "app tried to open file '%s'; that's never allowed for filenames starting with 'teliva_'", toname);
+    Previous_message = oslib_errbuf;
+    return os_pushresult(L, 0, toname);
+  }
+  else if (!file_operation_permitted(toname, "w")) {
     snprintf(oslib_errbuf, 1024, "app tried to open file '%s' for writing; adjust its permissions (ctrl-p) if that is expected", toname);
     Previous_message = oslib_errbuf;
     return os_pushresult(L, 0, toname);
   }
+  /* } */
   return os_pushresult(L, rename(fromname, toname) == 0, fromname);
 }