Eliminating TOCTOU Path Traversal in Python with Kernel-Enforced Containment and Lean 4 Formal Verification

Описание и применение

PathFence устраняет уязвимость TOCTOU в Python, используя дескрипторы каталогов и системные вызовы ядра, подтверждённые формальной верификацией Lean 4.

Задача

Python applications that validate paths with string checks are vulnerable to TOCTOU race conditions, allowing attackers to replace directories with symlinks and access unintended files.

Результат

PathFence eliminates TOCTOU path traversal without C extensions, providing zero‑dependency pure‑Python containment verified by 15 Lean 4 theorems and supported on Linux, macOS, BSD, and Windows.

Рабочий процесс

• 1. Create a Workspace or call pathfence.safe_open with a root directory.
• 2. PathFence normalizes the requested path and verifies containment using kernel flags or step‑by‑step O_NOFOLLOW walks.
• 3. If the path is allowed, PathFence returns a verified file descriptor; otherwise it denies or rejects with a reason.
• 4. The application uses the returned descriptor to read/write files safely.

Доказательства

PathFence is a zero‑dependency, pure‑Python path containment library backed by OS kernel primitives and mathematically verified in Lean 4.

Источник

The decision is lexical. It looks only at the path string, never at the file system.

Источник

PathFence invokes the openat2(2) syscall directly via ctypes with four strict resolution flags: RESOLVE_BENEATH, RESOLVE_NO_SYMLINKS, RESOLVE_NO_MAGICLINKS, RESOLVE_NO_XDEV.

Источник

We model path components, depth tracking, lexical normalization, and step‑by‑step directory resolution, proving 15 theorems with zero sorry placeholders and zero custom axioms.

Источник