src/shared/chown-recursive.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <fcntl.h>
   4 #include <sys/stat.h>
   5 #include <sys/types.h>
   6 #include <sys/xattr.h>
   7
   8 #include "chown-recursive.h"
   9 #include "dirent-util.h"
  10 #include "fd-util.h"
  11 #include "fs-util.h"
  12 #include "macro.h"
  13 #include "stdio-util.h"
  14 #include "strv.h"
  15 #include "user-util.h"
  16
  17 static int chown_one(
  18                 int fd,
  19                 const struct stat *st,
  20                 uid_t uid,
  21                 gid_t gid,
  22                 mode_t mask) {
  23
  24         char procfs_path[STRLEN("/proc/self/fd/") + DECIMAL_STR_MAX(int) + 1];
  25         const char *n;
  26         int r;
  27
  28         assert(fd >= 0);
  29         assert(st);
  30
  31         /* We change ACLs through the /proc/self/fd/%i path, so that we have a stable reference that works
  32          * with O_PATH. */
  33         xsprintf(procfs_path, "/proc/self/fd/%i", fd);
  34
  35         /* Drop any ACL if there is one */
  36         FOREACH_STRING(n, "system.posix_acl_access", "system.posix_acl_default")
  37                 if (removexattr(procfs_path, n) < 0)
  38                         if (!IN_SET(errno, ENODATA, EOPNOTSUPP, ENOSYS, ENOTTY))
  39                                 return -errno;
  40
  41         r = fchmod_and_chown(fd, st->st_mode & mask, uid, gid);
  42         if (r < 0)
  43                 return r;
  44
  45         return 1;
  46 }
  47
  48 static int chown_recursive_internal(
  49                 int fd,
  50                 const struct stat *st,
  51                 uid_t uid,
  52                 gid_t gid,
  53                 mode_t mask) {
  54
  55         _cleanup_closedir_ DIR *d = NULL;
  56         bool changed = false;
  57         struct dirent *de;
  58         int r;
  59
  60         assert(fd >= 0);
  61         assert(st);
  62
  63         d = fdopendir(fd);
  64         if (!d) {
  65                 safe_close(fd);
  66                 return -errno;
  67         }
  68
  69         FOREACH_DIRENT_ALL(de, d, return -errno) {
  70                 _cleanup_close_ int path_fd = -1;
  71                 struct stat fst;
  72
  73                 if (dot_or_dot_dot(de->d_name))
  74                         continue;
  75
  76                 /* Let's pin the child inode we want to fix now with an O_PATH fd, so that it cannot be swapped out
  77                  * while we manipulate it. */
  78                 path_fd = openat(dirfd(d), de->d_name, O_PATH|O_CLOEXEC|O_NOFOLLOW);
  79                 if (path_fd < 0)
  80                         return -errno;
  81
  82                 if (fstat(path_fd, &fst) < 0)
  83                         return -errno;
  84
  85                 if (S_ISDIR(fst.st_mode)) {
  86                         int subdir_fd;
  87
  88                         /* Convert it to a "real" (i.e. non-O_PATH) fd now */
  89                         subdir_fd = fd_reopen(path_fd, O_RDONLY|O_CLOEXEC|O_NOATIME);
  90                         if (subdir_fd < 0)
  91                                 return subdir_fd;
  92
  93                         r = chown_recursive_internal(subdir_fd, &fst, uid, gid, mask); /* takes possession of subdir_fd even on failure */
  94                         if (r < 0)
  95                                 return r;
  96                         if (r > 0)
  97                                 changed = true;
  98                 } else {
  99                         r = chown_one(path_fd, &fst, uid, gid, mask);
 100                         if (r < 0)
 101                                 return r;
 102                         if (r > 0)
 103                                 changed = true;
 104                 }
 105         }
 106
 107         r = chown_one(dirfd(d), st, uid, gid, mask);
 108         if (r < 0)
 109                 return r;
 110
 111         return r > 0 || changed;
 112 }
 113
 114 int path_chown_recursive(
 115                 const char *path,
 116                 uid_t uid,
 117                 gid_t gid,
 118                 mode_t mask) {
 119
 120         _cleanup_close_ int fd = -1;
 121         struct stat st;
 122
 123         fd = open(path, O_RDONLY|O_DIRECTORY|O_CLOEXEC|O_NOFOLLOW|O_NOATIME);
 124         if (fd < 0)
 125                 return -errno;
 126
 127         if (!uid_is_valid(uid) && !gid_is_valid(gid) && FLAGS_SET(mask, 07777))
 128                 return 0; /* nothing to do */
 129
 130         if (fstat(fd, &st) < 0)
 131                 return -errno;
 132
 133         /* Let's take a shortcut: if the top-level directory is properly owned, we don't descend into the
 134          * whole tree, under the assumption that all is OK anyway. */
 135         if ((!uid_is_valid(uid) || st.st_uid == uid) &&
 136             (!gid_is_valid(gid) || st.st_gid == gid) &&
 137             ((st.st_mode & ~mask & 07777) == 0))
 138                 return 0;
 139
 140         return chown_recursive_internal(TAKE_FD(fd), &st, uid, gid, mask); /* we donate the fd to the call, regardless if it succeeded or failed */
 141 }
 142
 143 int fd_chown_recursive(
 144                 int fd,
 145                 uid_t uid,
 146                 gid_t gid,
 147                 mode_t mask) {
 148
 149         int duplicated_fd = -1;
 150         struct stat st;
 151
 152         /* Note that the slightly different order of fstat() and the checks here and in
 153          * path_chown_recursive(). That's because when we open the directory ourselves we can specify
 154          * O_DIRECTORY and we always want to ensure we are operating on a directory before deciding whether
 155          * the operation is otherwise redundant. */
 156
 157         if (fstat(fd, &st) < 0)
 158                 return -errno;
 159
 160         if (!S_ISDIR(st.st_mode))
 161                 return -ENOTDIR;
 162
 163         if (!uid_is_valid(uid) && !gid_is_valid(gid) && FLAGS_SET(mask, 07777))
 164                 return 0; /* nothing to do */
 165
 166         /* Shortcut, as above */
 167         if ((!uid_is_valid(uid) || st.st_uid == uid) &&
 168             (!gid_is_valid(gid) || st.st_gid == gid) &&
 169             ((st.st_mode & ~mask & 07777) == 0))
 170                 return 0;
 171
 172         /* Let's duplicate the fd here, as opendir() wants to take possession of it and close it afterwards */
 173         duplicated_fd = fcntl(fd, F_DUPFD_CLOEXEC, 3);
 174         if (duplicated_fd < 0)
 175                 return -errno;
 176
 177         return chown_recursive_internal(duplicated_fd, &st, uid, gid, mask); /* fd donated even on failure */
 178 }