cadrumo.core.file_permissions module¶
Cross-platform best-effort directory-permission hardening for sensitive files.
App-owned sensitive plaintext files must be restricted to the operator’s user account. Browser session state is persisted through secure objects and does not use this plaintext-file helper.
POSIX: chmod 0o700 is sufficient. Windows: the DACL is rewritten in
process to what icacls.exe /inheritance:r /grant:r <user>:<rights> would
leave – inherited ACEs stripped and the DACL protected, explicit ACEs kept,
and the operator’s same-flag allow ACE replaced by (or joined by) a
full-control grant. The operator is resolved from DOMAIN\\user and then
user so it works on standalone machines and domain-joined hosts.
The Windows branch reads USERDOMAIN as operating-system ambient context
only. It does not read Cadrumo configuration or make permission tightening an
authorization decision.
- restrict_directory_permissions(path)[source]¶
Best-effort restrict
pathand everything later created inside it.The O(1) confidentiality boundary for a storage tree. POSIX applies mode
0o700; Windows strips inherited ACEs and grants the operator(OI)(CI)F, so files written into the tree afterwards inherit the restriction with no per-write cost.Call this when a storage root or namespace directory is created. Do NOT call a per-file variant on the write path to achieve the same thing – see
_windows_restrict_to_operator()for the measured reason.