#include <errno.h>

#include <stddef.h>

#include <stdlib.h>

#include <linux/falloc.h>

#include <linux/magic.h>

#include <unistd.h>

#include "alloc-util.h"

#include "dirent-util.h"

#include "fd-util.h"

#include "fileio.h"

#include "fs-util.h"

#include "locale-util.h"

#include "log.h"

#include "macro.h"

#include "missing_fcntl.h"

#include "missing_fs.h"

#include "missing_syscall.h"

#include "mkdir.h"

#include "parse-util.h"

#include "path-util.h"

#include "process-util.h"

#include "random-util.h"

#include "ratelimit.h"

#include "stat-util.h"

#include "stdio-util.h"

#include "string-util.h"

#include "strv.h"

#include "time-util.h"

#include "tmpfile-util.h"

#include "user-util.h"

#include "util.h"

int unlink_noerrno(const char *path) {

PROTECT_ERRNO;

int r;

r = unlink(path);

if (r < 0)

return -errno;

return 0;

}

int rmdir_parents(const char *path, const char *stop) {

size_t l;

int r = 0;

assert(path);

assert(stop);

l = strlen(path);

/* Skip trailing slashes */

while (l > 0 && path[l-1] == '/')

l--;

while (l > 0) {

char *t;

/* Skip last component */

while (l > 0 && path[l-1] != '/')

l--;

/* Skip trailing slashes */

while (l > 0 && path[l-1] == '/')

l--;

if (l <= 0)

break;

t = strndup(path, l);

if (!t)

return -ENOMEM;

if (path_startswith(stop, t)) {

free(t);

return 0;

}

r = rmdir(t);

free(t);

if (r < 0)

if (errno != ENOENT)

return -errno;

}

return 0;

}

int rename_noreplace(int olddirfd, const char *oldpath, int newdirfd, const char *newpath) {

int r;

/* Try the ideal approach first */

if (renameat2(olddirfd, oldpath, newdirfd, newpath, RENAME_NOREPLACE) >= 0)

return 0;

/* renameat2() exists since Linux 3.15, btrfs and FAT added support for it later. If it is not implemented,

if (!ERRNO_IS_NOT_SUPPORTED(errno) && errno != EINVAL)

return -errno;

/* Let's try to use linkat()+unlinkat() as fallback. This doesn't work on directories and on some file systems

if (linkat(olddirfd, oldpath, newdirfd, newpath, 0) >= 0) {

if (unlinkat(olddirfd, oldpath, 0) < 0) {

r = -errno; /* Backup errno before the following unlinkat() alters it */

(void) unlinkat(newdirfd, newpath, 0);

return r;

}

return 0;

}

if (!ERRNO_IS_NOT_SUPPORTED(errno) && !IN_SET(errno, EINVAL, EPERM)) /* FAT returns EPERM on link()… */

return -errno;

/* OK, neither RENAME_NOREPLACE nor linkat()+unlinkat() worked. Let's then fall back to the racy TOCTOU

if (faccessat(newdirfd, newpath, F_OK, AT_SYMLINK_NOFOLLOW) >= 0)

return -EEXIST;

if (errno != ENOENT)

return -errno;

if (renameat(olddirfd, oldpath, newdirfd, newpath) < 0)

return -errno;

return 0;

}

int readlinkat_malloc(int fd, const char *p, char **ret) {

size_t l = PATH_MAX;

assert(p);

assert(ret);

for (;;) {

_cleanup_free_ char *c = NULL;

ssize_t n;

c = new(char, l+1);

if (!c)

return -ENOMEM;

n = readlinkat(fd, p, c, l);

if (n < 0)

return -errno;

if ((size_t) n < l) {

c[n] = 0;

*ret = TAKE_PTR(c);

return 0;

}

if (l > (SSIZE_MAX-1)/2) /* readlinkat() returns an ssize_t, and we want an extra byte for a

return -EFBIG;

l *= 2;

}

}

int readlink_malloc(const char *p, char **ret) {

return readlinkat_malloc(AT_FDCWD, p, ret);

}

int readlink_value(const char *p, char **ret) {

_cleanup_free_ char *link = NULL;

char *value;

int r;

r = readlink_malloc(p, &link);

if (r < 0)

return r;

value = basename(link);

if (!value)

return -ENOENT;

value = strdup(value);

if (!value)

return -ENOMEM;

*ret = value;

return 0;

}

int readlink_and_make_absolute(const char *p, char **r) {

_cleanup_free_ char *target = NULL;

char *k;

int j;

assert(p);

assert(r);

j = readlink_malloc(p, &target);

if (j < 0)

return j;

k = file_in_same_dir(p, target);

if (!k)

return -ENOMEM;

*r = k;

return 0;

}

int chmod_and_chown(const char *path, mode_t mode, uid_t uid, gid_t gid) {

_cleanup_close_ int fd = -1;

assert(path);

fd = open(path, O_PATH|O_CLOEXEC|O_NOFOLLOW); /* Let's acquire an O_PATH fd, as precaution to change

if (fd < 0)

return -errno;

return fchmod_and_chown(fd, mode, uid, gid);

}

int fchmod_and_chown_with_fallback(int fd, const char *path, mode_t mode, uid_t uid, gid_t gid) {

bool do_chown, do_chmod;

struct stat st;

int r;

/* Change ownership and access mode of the specified fd. Tries to do so safely, ensuring that at no

if (fstat(fd, &st) < 0)

return -errno;

do_chown =

(uid != UID_INVALID && st.st_uid != uid) ||

(gid != GID_INVALID && st.st_gid != gid);

do_chmod =

!S_ISLNK(st.st_mode) && /* chmod is not defined on symlinks */

((mode != MODE_INVALID && ((st.st_mode ^ mode) & 07777) != 0) ||

do_chown); /* If we change ownership, make sure we reset the mode afterwards, since chown()

if (mode == MODE_INVALID)

mode = st.st_mode; /* If we only shall do a chown(), save original mode, since chown() might break it. */

else if ((mode & S_IFMT) != 0 && ((mode ^ st.st_mode) & S_IFMT) != 0)

return -EINVAL; /* insist on the right file type if it was specified */

if (do_chown && do_chmod) {

mode_t minimal = st.st_mode & mode; /* the subset of the old and the new mask */

if (((minimal ^ st.st_mode) & 07777) != 0) {

r = fchmod_opath(fd, minimal & 07777);

if (r < 0) {

if (!path || r != -ENOSYS)

return r;

/* Fallback path which doesn't use /proc/self/fd/. */

if (chmod(path, minimal & 07777) < 0)

return -errno;

}

}

}

if (do_chown)

if (fchownat(fd, "", uid, gid, AT_EMPTY_PATH) < 0)

return -errno;

if (do_chmod) {

r = fchmod_opath(fd, mode & 07777);

if (r < 0) {

if (!path || r != -ENOSYS)

return r;

/* Fallback path which doesn't use /proc/self/fd/. */

if (chmod(path, mode & 07777) < 0)

return -errno;

}

}

return do_chown || do_chmod;

}

int fchmod_umask(int fd, mode_t m) {

mode_t u;

int r;

u = umask(0777);

r = fchmod(fd, m & (~u)) < 0 ? -errno : 0;

umask(u);

return r;

}

int fchmod_opath(int fd, mode_t m) {

char procfs_path[STRLEN("/proc/self/fd/") + DECIMAL_STR_MAX(int)];

/* This function operates also on fd that might have been opened with

xsprintf(procfs_path, "/proc/self/fd/%i", fd);

if (chmod(procfs_path, m) < 0) {

if (errno != ENOENT)

return -errno;

if (proc_mounted() == 0)

return -ENOSYS; /* if we have no /proc/, the concept is not implementable */

return -ENOENT;

}

return 0;

}

int futimens_opath(int fd, const struct timespec ts[2]) {

char procfs_path[STRLEN("/proc/self/fd/") + DECIMAL_STR_MAX(int)];

/* Similar to fchmod_path() but for futimens() */

xsprintf(procfs_path, "/proc/self/fd/%i", fd);

if (utimensat(AT_FDCWD, procfs_path, ts, 0) < 0) {

if (errno != ENOENT)

return -errno;

if (proc_mounted() == 0)

return -ENOSYS; /* if we have no /proc/, the concept is not implementable */

return -ENOENT;

}

return 0;

}

int stat_warn_permissions(const char *path, const struct stat *st) {

assert(path);

assert(st);

/* Don't complain if we are reading something that is not a file, for example /dev/null */

if (!S_ISREG(st->st_mode))

return 0;

if (st->st_mode & 0111)

log_warning("Configuration file %s is marked executable. Please remove executable permission bits. Proceeding anyway.", path);

if (st->st_mode & 0002)

log_warning("Configuration file %s is marked world-writable. Please remove world writability permission bits. Proceeding anyway.", path);

if (getpid_cached() == 1 && (st->st_mode & 0044) != 0044)

log_warning("Configuration file %s is marked world-inaccessible. This has no effect as configuration data is accessible via APIs without restrictions. Proceeding anyway.", path);

return 0;

}

int fd_warn_permissions(const char *path, int fd) {

struct stat st;

assert(path);

assert(fd >= 0);

if (fstat(fd, &st) < 0)

return -errno;

return stat_warn_permissions(path, &st);

}

int touch_file(const char *path, bool parents, usec_t stamp, uid_t uid, gid_t gid, mode_t mode) {

char fdpath[STRLEN("/proc/self/fd/") + DECIMAL_STR_MAX(int)];

_cleanup_close_ int fd = -1;

int r, ret = 0;

assert(path);

/* Note that touch_file() does not follow symlinks: if invoked on an existing symlink, then it is the symlink

if (parents)

(void) mkdir_parents(path, 0755);

/* Initially, we try to open the node with O_PATH, so that we get a reference to the node. This is useful in

fd = open(path, O_PATH|O_CLOEXEC|O_NOFOLLOW);

if (fd < 0) {

if (errno != ENOENT)

return -errno;

/* if the node doesn't exist yet, we create it, but with O_EXCL, so that we only create a regular file

fd = open(path, O_WRONLY|O_CREAT|O_EXCL|O_CLOEXEC, IN_SET(mode, 0, MODE_INVALID) ? 0644 : mode);

if (fd < 0)

return -errno;

}

/* Let's make a path from the fd, and operate on that. With this logic, we can adjust the access mode,

xsprintf(fdpath, "/proc/self/fd/%i", fd);

ret = fchmod_and_chown(fd, mode, uid, gid);

if (stamp != USEC_INFINITY) {

struct timespec ts[2];

timespec_store(&ts[0], stamp);

ts[1] = ts[0];

r = utimensat(AT_FDCWD, fdpath, ts, 0);

} else

r = utimensat(AT_FDCWD, fdpath, NULL, 0);

if (r < 0 && ret >= 0)

return -errno;

return ret;

}

int touch(const char *path) {

return touch_file(path, false, USEC_INFINITY, UID_INVALID, GID_INVALID, MODE_INVALID);

}

int symlink_idempotent(const char *from, const char *to, bool make_relative) {

_cleanup_free_ char *relpath = NULL;

int r;

assert(from);

assert(to);

if (make_relative) {

_cleanup_free_ char *parent = NULL;

r = path_extract_directory(to, &parent);

if (r < 0)

return r;

r = path_make_relative(parent, from, &relpath);

if (r < 0)

return r;

from = relpath;

}

if (symlink(from, to) < 0) {

_cleanup_free_ char *p = NULL;

if (errno != EEXIST)

return -errno;

r = readlink_malloc(to, &p);

if (r == -EINVAL) /* Not a symlink? In that case return the original error we encountered: -EEXIST */

return -EEXIST;

if (r < 0) /* Any other error? In that case propagate it as is */

return r;

if (!streq(p, from)) /* Not the symlink we want it to be? In that case, propagate the original -EEXIST */

return -EEXIST;

}

return 0;

}

int symlink_atomic(const char *from, const char *to) {

_cleanup_free_ char *t = NULL;

int r;

assert(from);

assert(to);

r = tempfn_random(to, NULL, &t);

if (r < 0)

return r;

if (symlink(from, t) < 0)

return -errno;

if (rename(t, to) < 0) {

unlink_noerrno(t);

return -errno;

}

return 0;

}

int mknod_atomic(const char *path, mode_t mode, dev_t dev) {

_cleanup_free_ char *t = NULL;

int r;

assert(path);

r = tempfn_random(path, NULL, &t);

if (r < 0)

return r;

if (mknod(t, mode, dev) < 0)

return -errno;

if (rename(t, path) < 0) {

unlink_noerrno(t);

return -errno;

}

return 0;

}

int mkfifo_atomic(const char *path, mode_t mode) {

_cleanup_free_ char *t = NULL;

int r;

assert(path);

r = tempfn_random(path, NULL, &t);

if (r < 0)

return r;

if (mkfifo(t, mode) < 0)

return -errno;

if (rename(t, path) < 0) {

unlink_noerrno(t);

return -errno;

}

return 0;

}

int mkfifoat_atomic(int dirfd, const char *path, mode_t mode) {

_cleanup_free_ char *t = NULL;

int r;

assert(path);

if (path_is_absolute(path))

return mkfifo_atomic(path, mode);

/* We're only interested in the (random) filename. */

r = tempfn_random_child("", NULL, &t);

if (r < 0)

return r;

if (mkfifoat(dirfd, t, mode) < 0)

return -errno;

if (renameat(dirfd, t, dirfd, path) < 0) {

unlink_noerrno(t);

return -errno;

}

return 0;

}

int get_files_in_directory(const char *path, char ***list) {

_cleanup_strv_free_ char **l = NULL;

_cleanup_closedir_ DIR *d = NULL;

struct dirent *de;

size_t n = 0;

assert(path);

/* Returns all files in a directory in *list, and the number

d = opendir(path);

if (!d)

return -errno;

FOREACH_DIRENT_ALL(de, d, return -errno) {

if (!dirent_is_file(de))

continue;

if (list) {

/* one extra slot is needed for the terminating NULL */

if (!GREEDY_REALLOC(l, n + 2))

return -ENOMEM;

l[n] = strdup(de->d_name);

if (!l[n])

return -ENOMEM;

l[++n] = NULL;

} else

n++;

}

if (list)

*list = TAKE_PTR(l);

return n;

}

static int getenv_tmp_dir(const char **ret_path) {

const char *n;

int r, ret = 0;

assert(ret_path);

/* We use the same order of environment variables python uses in tempfile.gettempdir():

FOREACH_STRING(n, "TMPDIR", "TEMP", "TMP") {

const char *e;

e = secure_getenv(n);

if (!e)

continue;

if (!path_is_absolute(e)) {

r = -ENOTDIR;

goto next;

}

if (!path_is_normalized(e)) {

r = -EPERM;

goto next;

}

r = is_dir(e, true);

if (r < 0)

goto next;

if (r == 0) {

r = -ENOTDIR;

goto next;

}

*ret_path = e;

return 1;

next:

/* Remember first error, to make this more debuggable */

if (ret >= 0)

ret = r;

}

if (ret < 0)

return ret;

*ret_path = NULL;

return ret;

}

static int tmp_dir_internal(const char *def, const char **ret) {

const char *e;

int r, k;

assert(def);

assert(ret);

r = getenv_tmp_dir(&e);

if (r > 0) {

*ret = e;

return 0;

}

k = is_dir(def, true);

if (k == 0)

k = -ENOTDIR;

if (k < 0)

return r < 0 ? r : k;

*ret = def;

return 0;

}

int var_tmp_dir(const char **ret) {

/* Returns the location for "larger" temporary files, that is backed by physical storage if available, and thus

return tmp_dir_internal("/var/tmp", ret);

}

int tmp_dir(const char **ret) {

/* Similar to var_tmp_dir() above, but returns the location for "smaller" temporary files, which is usually

return tmp_dir_internal("/tmp", ret);

}

int unlink_or_warn(const char *filename) {

if (unlink(filename) < 0 && errno != ENOENT)

/* If the file doesn't exist and the fs simply was read-only (in which

if (errno != EROFS || access(filename, F_OK) >= 0)

return log_error_errno(errno, "Failed to remove \"%s\": %m", filename);

return 0;

}

int inotify_add_watch_fd(int fd, int what, uint32_t mask) {

char path[STRLEN("/proc/self/fd/") + DECIMAL_STR_MAX(int) + 1];

int wd;

/* This is like inotify_add_watch(), except that the file to watch is not referenced by a path, but by an fd */

xsprintf(path, "/proc/self/fd/%i", what);

wd = inotify_add_watch(fd, path, mask);

if (wd < 0)

return -errno;

return wd;

}

int inotify_add_watch_and_warn(int fd, const char *pathname, uint32_t mask) {

int wd;

wd = inotify_add_watch(fd, pathname, mask);

if (wd < 0) {

if (errno == ENOSPC)

return log_error_errno(errno, "Failed to add a watch for %s: inotify watch limit reached", pathname);

return log_error_errno(errno, "Failed to add a watch for %s: %m", pathname);

}

return wd;

}

bool unsafe_transition(const struct stat *a, const struct stat *b) {

/* Returns true if the transition from a to b is safe, i.e. that we never transition from unprivileged to

if (a->st_uid == 0) /* Transitioning from privileged to unprivileged is always fine */

return false;

return a->st_uid != b->st_uid; /* Otherwise we need to stay within the same UID */

}

static int log_unsafe_transition(int a, int b, const char *path, unsigned flags) {

_cleanup_free_ char *n1 = NULL, *n2 = NULL, *user_a = NULL, *user_b = NULL;

struct stat st;

if (!FLAGS_SET(flags, CHASE_WARN))

return -ENOLINK;

(void) fd_get_path(a, &n1);

(void) fd_get_path(b, &n2);

if (fstat(a, &st) == 0)

user_a = uid_to_name(st.st_uid);

if (fstat(b, &st) == 0)

user_b = uid_to_name(st.st_uid);

return log_warning_errno(SYNTHETIC_ERRNO(ENOLINK),

"Detected unsafe path transition %s (owned by %s) %s %s (owned by %s) during canonicalization of %s.",

strna(n1), strna(user_a), special_glyph(SPECIAL_GLYPH_ARROW), strna(n2), strna(user_b), path);

}

static int log_autofs_mount_point(int fd, const char *path, unsigned flags) {

_cleanup_free_ char *n1 = NULL;

if (!FLAGS_SET(flags, CHASE_WARN))

return -EREMOTE;

(void) fd_get_path(fd, &n1);

return log_warning_errno(SYNTHETIC_ERRNO(EREMOTE),

"Detected autofs mount point %s during canonicalization of %s.",

strna(n1), path);

}

int chase_symlinks(const char *path, const char *original_root, unsigned flags, char **ret_path, int *ret_fd) {

_cleanup_free_ char *buffer = NULL, *done = NULL, *root = NULL;

_cleanup_close_ int fd = -1;

unsigned max_follow = CHASE_SYMLINKS_MAX; /* how many symlinks to follow before giving up and returning ELOOP */

bool exists = true, append_trail_slash = false;

struct stat previous_stat;

const char *todo;

int r;

assert(path);

/* Either the file may be missing, or we return an fd to the final object, but both make no sense */

if ((flags & CHASE_NONEXISTENT) && ret_fd)

return -EINVAL;

if ((flags & CHASE_STEP) && ret_fd)

return -EINVAL;

if (isempty(path))

return -EINVAL;

/* This is a lot like canonicalize_file_name(), but takes an additional "root" parameter, that allows following

/* A root directory of "/" or "" is identical to none */

if (empty_or_root(original_root))

original_root = NULL;

if (!original_root && !ret_path && !(flags & (CHASE_NONEXISTENT|CHASE_NO_AUTOFS|CHASE_SAFE|CHASE_STEP)) && ret_fd) {

/* Shortcut the ret_fd case if the caller isn't interested in the actual path and has no root set

r = open(path, O_PATH|O_CLOEXEC|((flags & CHASE_NOFOLLOW) ? O_NOFOLLOW : 0));

if (r < 0)

return -errno;

*ret_fd = r;

return 0;

}

if (original_root) {

r = path_make_absolute_cwd(original_root, &root);

if (r < 0)

return r;

/* Simplify the root directory, so that it has no duplicate slashes and nothing at the

delete_trailing_chars(root, "/");

path_simplify(root);

if (flags & CHASE_PREFIX_ROOT) {

/* We don't support relative paths in combination with a root directory */

if (!path_is_absolute(path))

return -EINVAL;

path = prefix_roota(root, path);

}

}

r = path_make_absolute_cwd(path, &buffer);

if (r < 0)

return r;

fd = open(root ?: "/", O_CLOEXEC|O_DIRECTORY|O_PATH);

if (fd < 0)

return -errno;

if (flags & CHASE_SAFE)

if (fstat(fd, &previous_stat) < 0)

return -errno;

if (flags & CHASE_TRAIL_SLASH)

append_trail_slash = endswith(buffer, "/") || endswith(buffer, "/.");

if (root) {

/* If we are operating on a root directory, let's take the root directory as it is. */

todo = path_startswith(buffer, root);

if (!todo)

return log_full_errno(flags & CHASE_WARN ? LOG_WARNING : LOG_DEBUG,

SYNTHETIC_ERRNO(ECHRNG),

"Specified path '%s' is outside of specified root directory '%s', refusing to resolve.",

path, root);

done = strdup(root);

} else {

todo = buffer;

done = strdup("/");

}

for (;;) {

_cleanup_free_ char *first = NULL;

_cleanup_close_ int child = -1;

struct stat st;

const char *e;

r = path_find_first_component(&todo, true, &e);

if (r < 0)

return r;

if (r == 0) { /* We reached the end. */

if (append_trail_slash)

if (!strextend(&done, "/"))

return -ENOMEM;

break;

}

first = strndup(e, r);

if (!first)

return -ENOMEM;

/* Two dots? Then chop off the last bit of what we already found out. */

if (path_equal(first, "..")) {

_cleanup_free_ char *parent = NULL;

_cleanup_close_ int fd_parent = -1;

/* If we already are at the top, then going up will not change anything. This is in-line with

if (empty_or_root(done))

continue;

parent = dirname_malloc(done);

if (!parent)

return -ENOMEM;

/* Don't allow this to leave the root dir. */

if (root &&

path_startswith(done, root) &&

!path_startswith(parent, root))

continue;

free_and_replace(done, parent);

if (flags & CHASE_STEP)

goto chased_one;

fd_parent = openat(fd, "..", O_CLOEXEC|O_NOFOLLOW|O_PATH);

if (fd_parent < 0)

return -errno;

if (flags & CHASE_SAFE) {

if (fstat(fd_parent, &st) < 0)

return -errno;

if (unsafe_transition(&previous_stat, &st))

return log_unsafe_transition(fd, fd_parent, path, flags);

previous_stat = st;

}

safe_close(fd);

fd = TAKE_FD(fd_parent);

continue;

}

/* Otherwise let's see what this is. */

child = openat(fd, first, O_CLOEXEC|O_NOFOLLOW|O_PATH);

if (child < 0) {

if (errno == ENOENT &&

(flags & CHASE_NONEXISTENT) &&

(isempty(todo) || path_is_safe(todo))) {

/* If CHASE_NONEXISTENT is set, and the path does not exist, then

if (!path_extend(&done, first, todo))

return -ENOMEM;

exists = false;

break;

}

return -errno;

}

if (fstat(child, &st) < 0)

return -errno;