v4.0.3

[LeChatP]

I genuinely don't know why I never saw that debug left in the code. Anyway, I got Claude for one month. I'll use carefully, and it's credited in these commits.

• chore: create_with_privileges, remove_with_privileges and create_dir_all_with_privileges are no longer used
• chore: enable clippy::undocumented_unsafe_blocks, test modules are allowed like in sudo-rs
• chore: SAFETY comments of cutils.rs, securemem.rs and rpassword.rs are taken from sudo-rs
• fix: the monitor process exits with _exit to not run the atexit handlers of the parent
• fix: the hierarchy plugin notifies events while its callback runs, the API is now a RefCell borrowed immutably during notifications
• fix: raise CAP_FOWNER to change file flags whenever the file is not owned by the user
• fix: mark file descriptors above stderr close-on-exec with close_range, fallback on /proc/self/fd
• fix: an error while handling file descriptors now aborts the execution instead of being ignored
• fix: setting capabilities returns an error instead of panicking in the child
• fix: the tty is the controlling terminal, not the device behind stdout
• fix: tty cookies are bound to the session leader and ppid cookies to the parent, both with their start time, so a recycled pid does not match
• fix: without a controlling terminal, tty cookies fall back to the parent process instead of being valid for every process of the user
• fix: cookie times use CLOCK_BOOTTIME, cookies from the future are rejected
• fix: the timestamp directory and cookie files are created owned by root, opened without following symbolic links and checked before use
• fix: insecure cookie files left by previous versions are replaced
• fix: replace the racy lockfile by a flock on the cookie file
• fix: failing to save a cookie no longer aborts the session
• fix: remove forgotten debug logging of session I/O to /tmp/dosr-session.log
• chore: remove RAR_MAX_LOCKFILE_RETRIES and RAR_LOCKFILE_RETRY_INTERVAL
• chore: SimpleFileLogger creates its file with mode 0600 and never follows symlinks

Also, I'm working on fuzzing the tool. Code is there but not used/tested for now.

[codecov]

Codecov Report

❌ Patch coverage is 72.33010% with 57 lines in your changes missing coverage. Please review.
✅ Project coverage is 68.50%. Comparing base (79e7aac) to head (dd192bb).
⚠️ Report is 3 commits behind head on main.

Files with missing lines	Patch %	Lines
src/dosr/timeout.rs	80.71%	27 Missing ⚠️
src/dosr/main.rs	41.17%	10 Missing ⚠️
fuzz/fuzz_targets/setup_environment.rs	0.00%	5 Missing ⚠️
fuzz/fuzz_targets/cli_args.rs	0.00%	3 Missing ⚠️
fuzz/fuzz_targets/environment.rs	0.00%	3 Missing ⚠️
src/dosr/procfs.rs	88.00%	3 Missing ⚠️
exec/src/terminal.rs	0.00%	2 Missing ⚠️
core/src/util.rs	50.00%	1 Missing ⚠️
exec/src/runner.rs	50.00%	1 Missing ⚠️
src/dosr/pam/mod.rs	50.00%	1 Missing ⚠️
... and 1 more

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #106      +/-   ##
==========================================
+ Coverage   68.46%   68.50%   +0.03%     
==========================================
  Files          51       55       +4     
  Lines        6352     6426      +74     
==========================================
+ Hits         4349     4402      +53     
- Misses       2003     2024      +21     

Flag	Coverage Δ
admin-unittests	68.50% <72.33%> (+0.08%)	⬆️
unittests	68.47% <72.33%> (+0.06%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.