src/shared/copy.c

   1 /* SPDX-License-Identifier: LGPL-2.1-or-later */
   2
   3 #include <errno.h>
   4 #include <fcntl.h>
   5 #include <stddef.h>
   6 #include <stdio.h>
   7 #include <stdlib.h>
   8 #include <sys/sendfile.h>
   9 #include <sys/xattr.h>
  10 #include <unistd.h>
  11
  12 #include "alloc-util.h"
  13 #include "btrfs-util.h"
  14 #include "chattr-util.h"
  15 #include "copy.h"
  16 #include "dirent-util.h"
  17 #include "fd-util.h"
  18 #include "fileio.h"
  19 #include "fs-util.h"
  20 #include "io-util.h"
  21 #include "macro.h"
  22 #include "missing_syscall.h"
  23 #include "mkdir-label.h"
  24 #include "mountpoint-util.h"
  25 #include "nulstr-util.h"
  26 #include "rm-rf.h"
  27 #include "selinux-util.h"
  28 #include "signal-util.h"
  29 #include "stat-util.h"
  30 #include "stdio-util.h"
  31 #include "string-util.h"
  32 #include "strv.h"
  33 #include "sync-util.h"
  34 #include "time-util.h"
  35 #include "tmpfile-util.h"
  36 #include "umask-util.h"
  37 #include "user-util.h"
  38 #include "xattr-util.h"
  39
  40 #define COPY_BUFFER_SIZE (16U*1024U)
  41
  42 /* A safety net for descending recursively into file system trees to copy. On Linux PATH_MAX is 4096, which means the
  43  * deepest valid path one can build is around 2048, which we hence use as a safety net here, to not spin endlessly in
  44  * case of bind mount cycles and suchlike. */
  45 #define COPY_DEPTH_MAX 2048U
  46
  47 static ssize_t try_copy_file_range(
  48                 int fd_in, loff_t *off_in,
  49                 int fd_out, loff_t *off_out,
  50                 size_t len,
  51                 unsigned flags) {
  52
  53         static int have = -1;
  54         ssize_t r;
  55
  56         if (have == 0)
  57                 return -ENOSYS;
  58
  59         r = copy_file_range(fd_in, off_in, fd_out, off_out, len, flags);
  60         if (have < 0)
  61                 have = r >= 0 || errno != ENOSYS;
  62         if (r < 0)
  63                 return -errno;
  64
  65         return r;
  66 }
  67
  68 enum {
  69         FD_IS_NO_PIPE,
  70         FD_IS_BLOCKING_PIPE,
  71         FD_IS_NONBLOCKING_PIPE,
  72 };
  73
  74 static int fd_is_nonblock_pipe(int fd) {
  75         struct stat st;
  76         int flags;
  77
  78         /* Checks whether the specified file descriptor refers to a pipe, and if so if O_NONBLOCK is set. */
  79
  80         if (fstat(fd, &st) < 0)
  81                 return -errno;
  82
  83         if (!S_ISFIFO(st.st_mode))
  84                 return FD_IS_NO_PIPE;
  85
  86         flags = fcntl(fd, F_GETFL);
  87         if (flags < 0)
  88                 return -errno;
  89
  90         return FLAGS_SET(flags, O_NONBLOCK) ? FD_IS_NONBLOCKING_PIPE : FD_IS_BLOCKING_PIPE;
  91 }
  92
  93 static int look_for_signals(CopyFlags copy_flags) {
  94         int r;
  95
  96         if ((copy_flags & (COPY_SIGINT|COPY_SIGTERM)) == 0)
  97                 return 0;
  98
  99         r = pop_pending_signal(copy_flags & COPY_SIGINT ? SIGINT : 0,
 100                                copy_flags & COPY_SIGTERM ? SIGTERM : 0);
 101         if (r < 0)
 102                 return r;
 103         if (r != 0)
 104                 return log_debug_errno(SYNTHETIC_ERRNO(EINTR),
 105                                        "Got %s, cancelling copy operation.", signal_to_string(r));
 106
 107         return 0;
 108 }
 109
 110 static int create_hole(int fd, off_t size) {
 111         off_t offset;
 112         off_t end;
 113
 114         offset = lseek(fd, 0, SEEK_CUR);
 115         if (offset < 0)
 116                 return -errno;
 117
 118         end = lseek(fd, 0, SEEK_END);
 119         if (end < 0)
 120                 return -errno;
 121
 122         /* If we're not at the end of the target file, try to punch a hole in the existing space using fallocate(). */
 123
 124         if (offset < end &&
 125             fallocate(fd, FALLOC_FL_PUNCH_HOLE | FALLOC_FL_KEEP_SIZE, offset, MIN(size, end - offset)) < 0 &&
 126             !ERRNO_IS_NOT_SUPPORTED(errno))
 127                 return -errno;
 128
 129         if (end - offset >= size) {
 130                 /* If we've created the full hole, set the file pointer to the end of the hole we created and exit. */
 131                 if (lseek(fd, offset + size, SEEK_SET) < 0)
 132                         return -errno;
 133
 134                 return 0;
 135         }
 136
 137         /* If we haven't created the full hole, use ftruncate() to grow the file (and the hole) to the
 138          * required size and move the file pointer to the end of the file. */
 139
 140         size -= end - offset;
 141
 142         if (ftruncate(fd, end + size) < 0)
 143                 return -errno;
 144
 145         if (lseek(fd, 0, SEEK_END) < 0)
 146                 return -errno;
 147
 148         return 0;
 149 }
 150
 151 int copy_bytes_full(
 152                 int fdf, int fdt,
 153                 uint64_t max_bytes,
 154                 CopyFlags copy_flags,
 155                 void **ret_remains,
 156                 size_t *ret_remains_size,
 157                 copy_progress_bytes_t progress,
 158                 void *userdata) {
 159
 160         bool try_cfr = true, try_sendfile = true, try_splice = true, copied_something = false;
 161         int r, nonblock_pipe = -1;
 162         size_t m = SSIZE_MAX; /* that is the maximum that sendfile and c_f_r accept */
 163
 164         assert(fdf >= 0);
 165         assert(fdt >= 0);
 166
 167         /* Tries to copy bytes from the file descriptor 'fdf' to 'fdt' in the smartest possible way. Copies a maximum
 168          * of 'max_bytes', which may be specified as UINT64_MAX, in which no maximum is applied. Returns negative on
 169          * error, zero if EOF is hit before the bytes limit is hit and positive otherwise. If the copy fails for some
 170          * reason but we read but didn't yet write some data an ret_remains/ret_remains_size is not NULL, then it will
 171          * be initialized with an allocated buffer containing this "remaining" data. Note that these two parameters are
 172          * initialized with a valid buffer only on failure and only if there's actually data already read. Otherwise
 173          * these parameters if non-NULL are set to NULL. */
 174
 175         if (ret_remains)
 176                 *ret_remains = NULL;
 177         if (ret_remains_size)
 178                 *ret_remains_size = 0;
 179
 180         /* Try btrfs reflinks first. This only works on regular, seekable files, hence let's check the file offsets of
 181          * source and destination first. */
 182         if ((copy_flags & COPY_REFLINK)) {
 183                 off_t foffset;
 184
 185                 foffset = lseek(fdf, 0, SEEK_CUR);
 186                 if (foffset >= 0) {
 187                         off_t toffset;
 188
 189                         toffset = lseek(fdt, 0, SEEK_CUR);
 190                         if (toffset >= 0) {
 191
 192                                 if (foffset == 0 && toffset == 0 && max_bytes == UINT64_MAX)
 193                                         r = btrfs_reflink(fdf, fdt); /* full file reflink */
 194                                 else
 195                                         r = btrfs_clone_range(fdf, foffset, fdt, toffset, max_bytes == UINT64_MAX ? 0 : max_bytes); /* partial reflink */
 196                                 if (r >= 0) {
 197                                         off_t t;
 198
 199                                         /* This worked, yay! Now — to be fully correct — let's adjust the file pointers */
 200                                         if (max_bytes == UINT64_MAX) {
 201
 202                                                 /* We cloned to the end of the source file, let's position the read
 203                                                  * pointer there, and query it at the same time. */
 204                                                 t = lseek(fdf, 0, SEEK_END);
 205                                                 if (t < 0)
 206                                                         return -errno;
 207                                                 if (t < foffset)
 208                                                         return -ESPIPE;
 209
 210                                                 /* Let's adjust the destination file write pointer by the same number
 211                                                  * of bytes. */
 212                                                 t = lseek(fdt, toffset + (t - foffset), SEEK_SET);
 213                                                 if (t < 0)
 214                                                         return -errno;
 215
 216                                                 return 0; /* we copied the whole thing, hence hit EOF, return 0 */
 217                                         } else {
 218                                                 t = lseek(fdf, foffset + max_bytes, SEEK_SET);
 219                                                 if (t < 0)
 220                                                         return -errno;
 221
 222                                                 t = lseek(fdt, toffset + max_bytes, SEEK_SET);
 223                                                 if (t < 0)
 224                                                         return -errno;
 225
 226                                                 return 1; /* we copied only some number of bytes, which worked, but this means we didn't hit EOF, return 1 */
 227                                         }
 228                                 }
 229                         }
 230                 }
 231         }
 232
 233         for (;;) {
 234                 ssize_t n;
 235
 236                 if (max_bytes <= 0)
 237                         return 1; /* return > 0 if we hit the max_bytes limit */
 238
 239                 r = look_for_signals(copy_flags);
 240                 if (r < 0)
 241                         return r;
 242
 243                 if (max_bytes != UINT64_MAX && m > max_bytes)
 244                         m = max_bytes;
 245
 246                 if (copy_flags & COPY_HOLES) {
 247                         off_t c, e;
 248
 249                         c = lseek(fdf, 0, SEEK_CUR);
 250                         if (c < 0)
 251                                 return -errno;
 252
 253                         /* To see if we're in a hole, we search for the next data offset. */
 254                         e = lseek(fdf, c, SEEK_DATA);
 255                         if (e < 0 && errno == ENXIO)
 256                                 /* If errno == ENXIO, that means we've reached the final hole of the file and
 257                                 * that hole isn't followed by more data. */
 258                                 e = lseek(fdf, 0, SEEK_END);
 259                         if (e < 0)
 260                                 return -errno;
 261
 262                         /* If we're in a hole (current offset is not a data offset), create a hole of the
 263                          * same size in the target file. */
 264                         if (e > c) {
 265                                 r = create_hole(fdt, e - c);
 266                                 if (r < 0)
 267                                         return r;
 268                         }
 269
 270                         c = e; /* Set c to the start of the data segment. */
 271
 272                         /* After copying a potential hole, find the end of the data segment by looking for
 273                          * the next hole. If we get ENXIO, we're at EOF. */
 274                         e = lseek(fdf, c, SEEK_HOLE);
 275                         if (e < 0) {
 276                                 if (errno == ENXIO)
 277                                         break;
 278                                 return -errno;
 279                         }
 280
 281                         /* SEEK_HOLE modifies the file offset so we need to move back to the initial offset. */
 282                         if (lseek(fdf, c, SEEK_SET) < 0)
 283                                 return -errno;
 284
 285                         /* Make sure we're not copying more than the current data segment. */
 286                         m = MIN(m, (size_t) e - c);
 287                 }
 288
 289                 /* First try copy_file_range(), unless we already tried */
 290                 if (try_cfr) {
 291                         n = try_copy_file_range(fdf, NULL, fdt, NULL, m, 0u);
 292                         if (n < 0) {
 293                                 if (!IN_SET(n, -EINVAL, -ENOSYS, -EXDEV, -EBADF))
 294                                         return n;
 295
 296                                 try_cfr = false;
 297                                 /* use fallback below */
 298                         } else if (n == 0) { /* likely EOF */
 299
 300                                 if (copied_something)
 301                                         break;
 302
 303                                 /* So, we hit EOF immediately, without having copied a single byte. This
 304                                  * could indicate two things: the file is actually empty, or we are on some
 305                                  * virtual file system such as procfs/sysfs where the syscall actually
 306                                  * doesn't work but doesn't return an error. Try to handle that, by falling
 307                                  * back to simple read()s in case we encounter empty files.
 308                                  *
 309                                  * See: https://lwn.net/Articles/846403/ */
 310                                 try_cfr = try_sendfile = try_splice = false;
 311                         } else
 312                                 /* Success! */
 313                                 goto next;
 314                 }
 315
 316                 /* First try sendfile(), unless we already tried */
 317                 if (try_sendfile) {
 318                         n = sendfile(fdt, fdf, NULL, m);
 319                         if (n < 0) {
 320                                 if (!IN_SET(errno, EINVAL, ENOSYS))
 321                                         return -errno;
 322
 323                                 try_sendfile = false;
 324                                 /* use fallback below */
 325                         } else if (n == 0) { /* likely EOF */
 326
 327                                 if (copied_something)
 328                                         break;
 329
 330                                 try_sendfile = try_splice = false; /* same logic as above for copy_file_range() */
 331                         } else
 332                                 /* Success! */
 333                                 goto next;
 334                 }
 335
 336                 /* Then try splice, unless we already tried. */
 337                 if (try_splice) {
 338
 339                         /* splice()'s asynchronous I/O support is a bit weird. When it encounters a pipe file
 340                          * descriptor, then it will ignore its O_NONBLOCK flag and instead only honour the
 341                          * SPLICE_F_NONBLOCK flag specified in its flag parameter. Let's hide this behaviour
 342                          * here, and check if either of the specified fds are a pipe, and if so, let's pass
 343                          * the flag automatically, depending on O_NONBLOCK being set.
 344                          *
 345                          * Here's a twist though: when we use it to move data between two pipes of which one
 346                          * has O_NONBLOCK set and the other has not, then we have no individual control over
 347                          * O_NONBLOCK behaviour. Hence in that case we can't use splice() and still guarantee
 348                          * systematic O_NONBLOCK behaviour, hence don't. */
 349
 350                         if (nonblock_pipe < 0) {
 351                                 int a, b;
 352
 353                                 /* Check if either of these fds is a pipe, and if so non-blocking or not */
 354                                 a = fd_is_nonblock_pipe(fdf);
 355                                 if (a < 0)
 356                                         return a;
 357
 358                                 b = fd_is_nonblock_pipe(fdt);
 359                                 if (b < 0)
 360                                         return b;
 361
 362                                 if ((a == FD_IS_NO_PIPE && b == FD_IS_NO_PIPE) ||
 363                                     (a == FD_IS_BLOCKING_PIPE && b == FD_IS_NONBLOCKING_PIPE) ||
 364                                     (a == FD_IS_NONBLOCKING_PIPE && b == FD_IS_BLOCKING_PIPE))
 365
 366                                         /* splice() only works if one of the fds is a pipe. If neither is,
 367                                          * let's skip this step right-away. As mentioned above, if one of the
 368                                          * two fds refers to a blocking pipe and the other to a non-blocking
 369                                          * pipe, we can't use splice() either, hence don't try either. This
 370                                          * hence means we can only use splice() if either only one of the two
 371                                          * fds is a pipe, or if both are pipes with the same nonblocking flag
 372                                          * setting. */
 373
 374                                         try_splice = false;
 375                                 else
 376                                         nonblock_pipe = a == FD_IS_NONBLOCKING_PIPE || b == FD_IS_NONBLOCKING_PIPE;
 377                         }
 378                 }
 379
 380                 if (try_splice) {
 381                         n = splice(fdf, NULL, fdt, NULL, m, nonblock_pipe ? SPLICE_F_NONBLOCK : 0);
 382                         if (n < 0) {
 383                                 if (!IN_SET(errno, EINVAL, ENOSYS))
 384                                         return -errno;
 385
 386                                 try_splice = false;
 387                                 /* use fallback below */
 388                         } else if (n == 0) { /* likely EOF */
 389
 390                                 if (copied_something)
 391                                         break;
 392
 393                                 try_splice = false; /* same logic as above for copy_file_range() + sendfile() */
 394                         } else
 395                                 /* Success! */
 396                                 goto next;
 397                 }
 398
 399                 /* As a fallback just copy bits by hand */
 400                 {
 401                         uint8_t buf[MIN(m, COPY_BUFFER_SIZE)], *p = buf;
 402                         ssize_t z;
 403
 404                         n = read(fdf, buf, sizeof buf);
 405                         if (n < 0)
 406                                 return -errno;
 407                         if (n == 0) /* EOF */
 408                                 break;
 409
 410                         z = (size_t) n;
 411                         do {
 412                                 ssize_t k;
 413
 414                                 k = write(fdt, p, z);
 415                                 if (k < 0) {
 416                                         r = -errno;
 417
 418                                         if (ret_remains) {
 419                                                 void *copy;
 420
 421                                                 copy = memdup(p, z);
 422                                                 if (!copy)
 423                                                         return -ENOMEM;
 424
 425                                                 *ret_remains = copy;
 426                                         }
 427
 428                                         if (ret_remains_size)
 429                                                 *ret_remains_size = z;
 430
 431                                         return r;
 432                                 }
 433
 434                                 assert(k <= z);
 435                                 z -= k;
 436                                 p += k;
 437                         } while (z > 0);
 438                 }
 439
 440         next:
 441                 if (progress) {
 442                         r = progress(n, userdata);
 443                         if (r < 0)
 444                                 return r;
 445                 }
 446
 447                 if (max_bytes != UINT64_MAX) {
 448                         assert(max_bytes >= (uint64_t) n);
 449                         max_bytes -= n;
 450                 }
 451
 452                 /* sendfile accepts at most SSIZE_MAX-offset bytes to copy, so reduce our maximum by the
 453                  * amount we already copied, but don't go below our copy buffer size, unless we are close the
 454                  * limit of bytes we are allowed to copy. */
 455                 m = MAX(MIN(COPY_BUFFER_SIZE, max_bytes), m - n);
 456
 457                 copied_something = true;
 458         }
 459
 460         return 0; /* return 0 if we hit EOF earlier than the size limit */
 461 }
 462
 463 static int fd_copy_symlink(
 464                 int df,
 465                 const char *from,
 466                 const struct stat *st,
 467                 int dt,
 468                 const char *to,
 469                 uid_t override_uid,
 470                 gid_t override_gid,
 471                 CopyFlags copy_flags) {
 472
 473         _cleanup_free_ char *target = NULL;
 474         int r;
 475
 476         assert(from);
 477         assert(st);
 478         assert(to);
 479
 480         r = readlinkat_malloc(df, from, &target);
 481         if (r < 0)
 482                 return r;
 483
 484         if (copy_flags & COPY_MAC_CREATE) {
 485                 r = mac_selinux_create_file_prepare_at(dt, to, S_IFLNK);
 486                 if (r < 0)
 487                         return r;
 488         }
 489         r = symlinkat(target, dt, to);
 490         if (copy_flags & COPY_MAC_CREATE)
 491                 mac_selinux_create_file_clear();
 492         if (r < 0)
 493                 return -errno;
 494
 495         if (fchownat(dt, to,
 496                      uid_is_valid(override_uid) ? override_uid : st->st_uid,
 497                      gid_is_valid(override_gid) ? override_gid : st->st_gid,
 498                      AT_SYMLINK_NOFOLLOW) < 0)
 499                 r = -errno;
 500
 501         (void) utimensat(dt, to, (struct timespec[]) { st->st_atim, st->st_mtim }, AT_SYMLINK_NOFOLLOW);
 502         return r;
 503 }
 504
 505 /* Encapsulates the database we store potential hardlink targets in */
 506 typedef struct HardlinkContext {
 507         int dir_fd;    /* An fd to the directory we use as lookup table. Never AT_FDCWD. Lazily created, when
 508                         * we add the first entry. */
 509
 510         /* These two fields are used to create the hardlink repository directory above — via
 511          * mkdirat(parent_fd, subdir) — and are kept so that we can automatically remove the directory again
 512          * when we are done. */
 513         int parent_fd; /* Possibly AT_FDCWD */
 514         char *subdir;
 515 } HardlinkContext;
 516
 517 static int hardlink_context_setup(
 518                 HardlinkContext *c,
 519                 int dt,
 520                 const char *to,
 521                 CopyFlags copy_flags) {
 522
 523         _cleanup_close_ int dt_copy = -1;
 524         int r;
 525
 526         assert(c);
 527         assert(c->dir_fd < 0 && c->dir_fd != AT_FDCWD);
 528         assert(c->parent_fd < 0);
 529         assert(!c->subdir);
 530
 531         /* If hardlink recreation is requested we have to maintain a database of inodes that are potential
 532          * hardlink sources. Given that generally disk sizes have to be assumed to be larger than what fits
 533          * into physical RAM we cannot maintain that database in dynamic memory alone. Here we opt to
 534          * maintain it on disk, to simplify things: inside the destination directory we'll maintain a
 535          * temporary directory consisting of hardlinks of every inode we copied that might be subject of
 536          * hardlinks. We can then use that as hardlink source later on. Yes, this means additional disk IO
 537          * but thankfully Linux is optimized for this kind of thing. If this ever becomes a performance
 538          * bottleneck we can certainly place an in-memory hash table in front of this, but for the beginning,
 539          * let's keep things simple, and just use the disk as lookup table for inodes.
 540          *
 541          * Note that this should have zero performance impact as long as .n_link of all files copied remains
 542          * <= 0, because in that case we will not actually allocate the hardlink inode lookup table directory
 543          * on disk (we do so lazily, when the first candidate with .n_link > 1 is seen). This means, in the
 544          * common case where hardlinks are not used at all or only for few files the fact that we store the
 545          * table on disk shouldn't matter perfomance-wise. */
 546
 547         if (!FLAGS_SET(copy_flags, COPY_HARDLINKS))
 548                 return 0;
 549
 550         if (dt == AT_FDCWD)
 551                 dt_copy = AT_FDCWD;
 552         else if (dt < 0)
 553                 return -EBADF;
 554         else {
 555                 dt_copy = fcntl(dt, F_DUPFD_CLOEXEC, 3);
 556                 if (dt_copy < 0)
 557                         return -errno;
 558         }
 559
 560         r = tempfn_random_child(to, "hardlink", &c->subdir);
 561         if (r < 0)
 562                 return r;
 563
 564         c->parent_fd = TAKE_FD(dt_copy);
 565
 566         /* We don't actually create the directory we keep the table in here, that's done on-demand when the
 567          * first entry is added, using hardlink_context_realize() below. */
 568         return 1;
 569 }
 570
 571 static int hardlink_context_realize(HardlinkContext *c) {
 572         if (!c)
 573                 return 0;
 574
 575         if (c->dir_fd >= 0) /* Already realized */
 576                 return 1;
 577
 578         if (c->parent_fd < 0 && c->parent_fd != AT_FDCWD) /* Not configured */
 579                 return 0;
 580
 581         assert(c->subdir);
 582
 583         c->dir_fd = open_mkdir_at(c->parent_fd, c->subdir, O_EXCL|O_CLOEXEC, 0700);
 584         if (c->dir_fd < 0)
 585                 return c->dir_fd;
 586
 587         return 1;
 588 }
 589
 590 static void hardlink_context_destroy(HardlinkContext *c) {
 591         int r;
 592
 593         assert(c);
 594
 595         /* Automatically remove the hardlink lookup table directory again after we are done. This is used via
 596          * _cleanup_() so that we really delete this, even on failure. */
 597
 598         if (c->dir_fd >= 0) {
 599                 r = rm_rf_children(TAKE_FD(c->dir_fd), REMOVE_PHYSICAL, NULL); /* consumes dir_fd in all cases, even on failure */
 600                 if (r < 0)
 601                         log_debug_errno(r, "Failed to remove hardlink store (%s) contents, ignoring: %m", c->subdir);
 602
 603                 assert(c->parent_fd >= 0 || c->parent_fd == AT_FDCWD);
 604                 assert(c->subdir);
 605
 606                 if (unlinkat(c->parent_fd, c->subdir, AT_REMOVEDIR) < 0)
 607                         log_debug_errno(errno, "Failed to remove hardlink store (%s) directory, ignoring: %m", c->subdir);
 608         }
 609
 610         assert_cc(AT_FDCWD < 0);
 611         c->parent_fd = safe_close(c->parent_fd);
 612
 613         c->subdir = mfree(c->subdir);
 614 }
 615
 616 static int try_hardlink(
 617                 HardlinkContext *c,
 618                 const struct stat *st,
 619                 int dt,
 620                 const char *to) {
 621
 622         char dev_ino[DECIMAL_STR_MAX(dev_t)*2 + DECIMAL_STR_MAX(uint64_t) + 4];
 623
 624         assert(st);
 625         assert(dt >= 0 || dt == AT_FDCWD);
 626         assert(to);
 627
 628         if (!c) /* No temporary hardlink directory, don't bother */
 629                 return 0;
 630
 631         if (st->st_nlink <= 1) /* Source not hardlinked, don't bother */
 632                 return 0;
 633
 634         if (c->dir_fd < 0) /* not yet realized, hence empty */
 635                 return 0;
 636
 637         xsprintf(dev_ino, "%u:%u:%" PRIu64, major(st->st_dev), minor(st->st_dev), (uint64_t) st->st_ino);
 638         if (linkat(c->dir_fd, dev_ino, dt, to, 0) < 0)  {
 639                 if (errno != ENOENT) /* doesn't exist in store yet */
 640                         log_debug_errno(errno, "Failed to hardlink %s to %s, ignoring: %m", dev_ino, to);
 641                 return 0;
 642         }
 643
 644         return 1;
 645 }
 646
 647 static int memorize_hardlink(
 648                 HardlinkContext *c,
 649                 const struct stat *st,
 650                 int dt,
 651                 const char *to) {
 652
 653         char dev_ino[DECIMAL_STR_MAX(dev_t)*2 + DECIMAL_STR_MAX(uint64_t) + 4];
 654         int r;
 655
 656         assert(st);
 657         assert(dt >= 0 || dt == AT_FDCWD);
 658         assert(to);
 659
 660         if (!c) /* No temporary hardlink directory, don't bother */
 661                 return 0;
 662
 663         if (st->st_nlink <= 1) /* Source not hardlinked, don't bother */
 664                 return 0;
 665
 666         r = hardlink_context_realize(c); /* Create the hardlink store lazily */
 667         if (r < 0)
 668                 return r;
 669
 670         xsprintf(dev_ino, "%u:%u:%" PRIu64, major(st->st_dev), minor(st->st_dev), (uint64_t) st->st_ino);
 671         if (linkat(dt, to, c->dir_fd, dev_ino, 0) < 0) {
 672                 log_debug_errno(errno, "Failed to hardlink %s to %s, ignoring: %m", to, dev_ino);
 673                 return 0;
 674         }
 675
 676         return 1;
 677 }
 678
 679 static int fd_copy_tree_generic(
 680                 int df,
 681                 const char *from,
 682                 const struct stat *st,
 683                 int dt,
 684                 const char *to,
 685                 dev_t original_device,
 686                 unsigned depth_left,
 687                 uid_t override_uid,
 688                 gid_t override_gid,
 689                 CopyFlags copy_flags,
 690                 const Set *denylist,
 691                 HardlinkContext *hardlink_context,
 692                 const char *display_path,
 693                 copy_progress_path_t progress_path,
 694                 copy_progress_bytes_t progress_bytes,
 695                 void *userdata);
 696
 697 static int fd_copy_regular(
 698                 int df,
 699                 const char *from,
 700                 const struct stat *st,
 701                 int dt,
 702                 const char *to,
 703                 uid_t override_uid,
 704                 gid_t override_gid,
 705                 CopyFlags copy_flags,
 706                 HardlinkContext *hardlink_context,
 707                 copy_progress_bytes_t progress,
 708                 void *userdata) {
 709
 710         _cleanup_close_ int fdf = -1, fdt = -1;
 711         int r, q;
 712
 713         assert(from);
 714         assert(st);
 715         assert(to);
 716
 717         r = try_hardlink(hardlink_context, st, dt, to);
 718         if (r < 0)
 719                 return r;
 720         if (r > 0) /* worked! */
 721                 return 0;
 722
 723         fdf = openat(df, from, O_RDONLY|O_CLOEXEC|O_NOCTTY|O_NOFOLLOW);
 724         if (fdf < 0)
 725                 return -errno;
 726
 727         if (copy_flags & COPY_MAC_CREATE) {
 728                 r = mac_selinux_create_file_prepare_at(dt, to, S_IFREG);
 729                 if (r < 0)
 730                         return r;
 731         }
 732         fdt = openat(dt, to, O_WRONLY|O_CREAT|O_EXCL|O_CLOEXEC|O_NOCTTY|O_NOFOLLOW, st->st_mode & 07777);
 733         if (copy_flags & COPY_MAC_CREATE)
 734                 mac_selinux_create_file_clear();
 735         if (fdt < 0)
 736                 return -errno;
 737
 738         r = copy_bytes_full(fdf, fdt, UINT64_MAX, copy_flags, NULL, NULL, progress, userdata);
 739         if (r < 0)
 740                 goto fail;
 741
 742         if (fchown(fdt,
 743                    uid_is_valid(override_uid) ? override_uid : st->st_uid,
 744                    gid_is_valid(override_gid) ? override_gid : st->st_gid) < 0)
 745                 r = -errno;
 746
 747         if (fchmod(fdt, st->st_mode & 07777) < 0)
 748                 r = -errno;
 749
 750         (void) futimens(fdt, (struct timespec[]) { st->st_atim, st->st_mtim });
 751         (void) copy_xattr(fdf, fdt, copy_flags);
 752
 753         if (copy_flags & COPY_FSYNC) {
 754                 if (fsync(fdt) < 0) {
 755                         r = -errno;
 756                         goto fail;
 757                 }
 758         }
 759
 760         q = close_nointr(TAKE_FD(fdt)); /* even if this fails, the fd is now invalidated */
 761         if (q < 0) {
 762                 r = q;
 763                 goto fail;
 764         }
 765
 766         (void) memorize_hardlink(hardlink_context, st, dt, to);
 767         return r;
 768
 769 fail:
 770         (void) unlinkat(dt, to, 0);
 771         return r;
 772 }
 773
 774 static int fd_copy_fifo(
 775                 int df,
 776                 const char *from,
 777                 const struct stat *st,
 778                 int dt,
 779                 const char *to,
 780                 uid_t override_uid,
 781                 gid_t override_gid,
 782                 CopyFlags copy_flags,
 783                 HardlinkContext *hardlink_context) {
 784         int r;
 785
 786         assert(from);
 787         assert(st);
 788         assert(to);
 789
 790         r = try_hardlink(hardlink_context, st, dt, to);
 791         if (r < 0)
 792                 return r;
 793         if (r > 0) /* worked! */
 794                 return 0;
 795
 796         if (copy_flags & COPY_MAC_CREATE) {
 797                 r = mac_selinux_create_file_prepare_at(dt, to, S_IFIFO);
 798                 if (r < 0)
 799                         return r;
 800         }
 801         r = mkfifoat(dt, to, st->st_mode & 07777);
 802         if (copy_flags & COPY_MAC_CREATE)
 803                 mac_selinux_create_file_clear();
 804         if (r < 0)
 805                 return -errno;
 806
 807         if (fchownat(dt, to,
 808                      uid_is_valid(override_uid) ? override_uid : st->st_uid,
 809                      gid_is_valid(override_gid) ? override_gid : st->st_gid,
 810                      AT_SYMLINK_NOFOLLOW) < 0)
 811                 r = -errno;
 812
 813         if (fchmodat(dt, to, st->st_mode & 07777, 0) < 0)
 814                 r = -errno;
 815
 816         (void) utimensat(dt, to, (struct timespec[]) { st->st_atim, st->st_mtim }, AT_SYMLINK_NOFOLLOW);
 817
 818         (void) memorize_hardlink(hardlink_context, st, dt, to);
 819         return r;
 820 }
 821
 822 static int fd_copy_node(
 823                 int df,
 824                 const char *from,
 825                 const struct stat *st,
 826                 int dt,
 827                 const char *to,
 828                 uid_t override_uid,
 829                 gid_t override_gid,
 830                 CopyFlags copy_flags,
 831                 HardlinkContext *hardlink_context) {
 832         int r;
 833
 834         assert(from);
 835         assert(st);
 836         assert(to);
 837
 838         r = try_hardlink(hardlink_context, st, dt, to);
 839         if (r < 0)
 840                 return r;
 841         if (r > 0) /* worked! */
 842                 return 0;
 843
 844         if (copy_flags & COPY_MAC_CREATE) {
 845                 r = mac_selinux_create_file_prepare_at(dt, to, st->st_mode & S_IFMT);
 846                 if (r < 0)
 847                         return r;
 848         }
 849         r = mknodat(dt, to, st->st_mode, st->st_rdev);
 850         if (copy_flags & COPY_MAC_CREATE)
 851                 mac_selinux_create_file_clear();
 852         if (r < 0)
 853                 return -errno;
 854
 855         if (fchownat(dt, to,
 856                      uid_is_valid(override_uid) ? override_uid : st->st_uid,
 857                      gid_is_valid(override_gid) ? override_gid : st->st_gid,
 858                      AT_SYMLINK_NOFOLLOW) < 0)
 859                 r = -errno;
 860
 861         if (fchmodat(dt, to, st->st_mode & 07777, 0) < 0)
 862                 r = -errno;
 863
 864         (void) utimensat(dt, to, (struct timespec[]) { st->st_atim, st->st_mtim }, AT_SYMLINK_NOFOLLOW);
 865
 866         (void) memorize_hardlink(hardlink_context, st, dt, to);
 867         return r;
 868 }
 869
 870 static int fd_copy_directory(
 871                 int df,
 872                 const char *from,
 873                 const struct stat *st,
 874                 int dt,
 875                 const char *to,
 876                 dev_t original_device,
 877                 unsigned depth_left,
 878                 uid_t override_uid,
 879                 gid_t override_gid,
 880                 CopyFlags copy_flags,
 881                 const Set *denylist,
 882                 HardlinkContext *hardlink_context,
 883                 const char *display_path,
 884                 copy_progress_path_t progress_path,
 885                 copy_progress_bytes_t progress_bytes,
 886                 void *userdata) {
 887
 888         _cleanup_(hardlink_context_destroy) HardlinkContext our_hardlink_context = {
 889                 .dir_fd = -1,
 890                 .parent_fd = -1,
 891         };
 892
 893         _cleanup_close_ int fdf = -1, fdt = -1;
 894         _cleanup_closedir_ DIR *d = NULL;
 895         bool exists, created;
 896         int r;
 897
 898         assert(st);
 899         assert(to);
 900
 901         if (depth_left == 0)
 902                 return -ENAMETOOLONG;
 903
 904         if (from)
 905                 fdf = openat(df, from, O_RDONLY|O_DIRECTORY|O_CLOEXEC|O_NOCTTY|O_NOFOLLOW);
 906         else
 907                 fdf = fcntl(df, F_DUPFD_CLOEXEC, 3);
 908         if (fdf < 0)
 909                 return -errno;
 910
 911         if (!hardlink_context) {
 912                 /* If recreating hardlinks is requested let's set up a context for that now. */
 913                 r = hardlink_context_setup(&our_hardlink_context, dt, to, copy_flags);
 914                 if (r < 0)
 915                         return r;
 916                 if (r > 0) /* It's enabled and allocated, let's now use the same context for all recursive
 917                             * invocations from here down */
 918                         hardlink_context = &our_hardlink_context;
 919         }
 920
 921         d = take_fdopendir(&fdf);
 922         if (!d)
 923                 return -errno;
 924
 925         exists = false;
 926         if (copy_flags & COPY_MERGE_EMPTY) {
 927                 r = dir_is_empty_at(dt, to, /* ignore_hidden_or_backup= */ false);
 928                 if (r < 0 && r != -ENOENT)
 929                         return r;
 930                 else if (r == 1)
 931                         exists = true;
 932         }
 933
 934         if (exists)
 935                 created = false;
 936         else {
 937                 if (copy_flags & COPY_MAC_CREATE)
 938                         r = mkdirat_label(dt, to, st->st_mode & 07777);
 939                 else
 940                         r = mkdirat(dt, to, st->st_mode & 07777);
 941                 if (r >= 0)
 942                         created = true;
 943                 else if (errno == EEXIST && (copy_flags & COPY_MERGE))
 944                         created = false;
 945                 else
 946                         return -errno;
 947         }
 948
 949         fdt = openat(dt, to, O_RDONLY|O_DIRECTORY|O_CLOEXEC|O_NOCTTY|O_NOFOLLOW);
 950         if (fdt < 0)
 951                 return -errno;
 952
 953         r = 0;
 954
 955         FOREACH_DIRENT_ALL(de, d, return -errno) {
 956                 const char *child_display_path = NULL;
 957                 _cleanup_free_ char *dp = NULL;
 958                 struct stat buf;
 959                 int q;
 960
 961                 if (dot_or_dot_dot(de->d_name))
 962                         continue;
 963
 964                 r = look_for_signals(copy_flags);
 965                 if (r < 0)
 966                         return r;
 967
 968                 if (fstatat(dirfd(d), de->d_name, &buf, AT_SYMLINK_NOFOLLOW) < 0) {
 969                         r = -errno;
 970                         continue;
 971                 }
 972
 973                 if (progress_path) {
 974                         if (display_path)
 975                                 child_display_path = dp = path_join(display_path, de->d_name);
 976                         else
 977                                 child_display_path = de->d_name;
 978
 979                         r = progress_path(child_display_path, &buf, userdata);
 980                         if (r < 0)
 981                                 return r;
 982                 }
 983
 984                 if (set_contains(denylist, &buf)) {
 985                         log_debug("%s/%s is in the denylist, skipping", from, de->d_name);
 986                         continue;
 987                 }
 988
 989                 if (S_ISDIR(buf.st_mode)) {
 990                         /*
 991                          * Don't descend into directories on other file systems, if this is requested. We do a simple
 992                          * .st_dev check here, which basically comes for free. Note that we do this check only on
 993                          * directories, not other kind of file system objects, for two reason:
 994                          *
 995                          * • The kernel's overlayfs pseudo file system that overlays multiple real file systems
 996                          *   propagates the .st_dev field of the file system a file originates from all the way up
 997                          *   through the stack to stat(). It doesn't do that for directories however. This means that
 998                          *   comparing .st_dev on non-directories suggests that they all are mount points. To avoid
 999                          *   confusion we hence avoid relying on this check for regular files.
1000                          *
1001                          * • The main reason we do this check at all is to protect ourselves from bind mount cycles,
1002                          *   where we really want to avoid descending down in all eternity. However the .st_dev check
1003                          *   is usually not sufficient for this protection anyway, as bind mount cycles from the same
1004                          *   file system onto itself can't be detected that way. (Note we also do a recursion depth
1005                          *   check, which is probably the better protection in this regard, which is why
1006                          *   COPY_SAME_MOUNT is optional).
1007                          */
1008
1009                         if (FLAGS_SET(copy_flags, COPY_SAME_MOUNT)) {
1010                                 if (buf.st_dev != original_device)
1011                                         continue;
1012
1013                                 r = fd_is_mount_point(dirfd(d), de->d_name, 0);
1014                                 if (r < 0)
1015                                         return r;
1016                                 if (r > 0)
1017                                         continue;
1018                         }
1019                 }
1020
1021                 q = fd_copy_tree_generic(dirfd(d), de->d_name, &buf, fdt, de->d_name, original_device,
1022                                          depth_left-1, override_uid, override_gid, copy_flags, denylist,
1023                                          hardlink_context, child_display_path, progress_path, progress_bytes,
1024                                          userdata);
1025
1026                 if (q == -EINTR) /* Propagate SIGINT/SIGTERM up instantly */
1027                         return q;
1028                 if (q == -EEXIST && (copy_flags & COPY_MERGE))
1029                         q = 0;
1030                 if (q < 0)
1031                         r = q;
1032         }
1033
1034         if (created) {
1035                 if (fchown(fdt,
1036                            uid_is_valid(override_uid) ? override_uid : st->st_uid,
1037                            gid_is_valid(override_gid) ? override_gid : st->st_gid) < 0)
1038                         r = -errno;
1039
1040                 if (fchmod(fdt, st->st_mode & 07777) < 0)
1041                         r = -errno;
1042
1043                 (void) copy_xattr(dirfd(d), fdt, copy_flags);
1044                 (void) futimens(fdt, (struct timespec[]) { st->st_atim, st->st_mtim });
1045         }
1046
1047         if (copy_flags & COPY_FSYNC_FULL) {
1048                 if (fsync(fdt) < 0)
1049                         return -errno;
1050         }
1051
1052         return r;
1053 }
1054
1055 static int fd_copy_leaf(
1056                 int df,
1057                 const char *from,
1058                 const struct stat *st,
1059                 int dt,
1060                 const char *to,
1061                 uid_t override_uid,
1062                 gid_t override_gid,
1063                 CopyFlags copy_flags,
1064                 HardlinkContext *hardlink_context,
1065                 const char *display_path,
1066                 copy_progress_bytes_t progress_bytes,
1067                 void *userdata) {
1068         int r;
1069
1070         if (S_ISREG(st->st_mode))
1071                 r = fd_copy_regular(df, from, st, dt, to, override_uid, override_gid, copy_flags, hardlink_context, progress_bytes, userdata);
1072         else if (S_ISLNK(st->st_mode))
1073                 r = fd_copy_symlink(df, from, st, dt, to, override_uid, override_gid, copy_flags);
1074         else if (S_ISFIFO(st->st_mode))
1075                 r = fd_copy_fifo(df, from, st, dt, to, override_uid, override_gid, copy_flags, hardlink_context);
1076         else if (S_ISBLK(st->st_mode) || S_ISCHR(st->st_mode) || S_ISSOCK(st->st_mode))
1077                 r = fd_copy_node(df, from, st, dt, to, override_uid, override_gid, copy_flags, hardlink_context);
1078         else
1079                 r = -EOPNOTSUPP;
1080
1081         return r;
1082 }
1083
1084 static int fd_copy_tree_generic(
1085                 int df,
1086                 const char *from,
1087                 const struct stat *st,
1088                 int dt,
1089                 const char *to,
1090                 dev_t original_device,
1091                 unsigned depth_left,
1092                 uid_t override_uid,
1093                 gid_t override_gid,
1094                 CopyFlags copy_flags,
1095                 const Set *denylist,
1096                 HardlinkContext *hardlink_context,
1097                 const char *display_path,
1098                 copy_progress_path_t progress_path,
1099                 copy_progress_bytes_t progress_bytes,
1100                 void *userdata) {
1101         int r;
1102
1103         if (S_ISDIR(st->st_mode))
1104                 return fd_copy_directory(df, from, st, dt, to, original_device, depth_left-1, override_uid,
1105                                          override_gid, copy_flags, denylist, hardlink_context, display_path,
1106                                          progress_path, progress_bytes, userdata);
1107
1108         r = fd_copy_leaf(df, from, st, dt, to, override_uid, override_gid, copy_flags, hardlink_context, display_path, progress_bytes, userdata);
1109         /* We just tried to copy a leaf node of the tree. If it failed because the node already exists *and* the COPY_REPLACE flag has been provided, we should unlink the node and re-copy. */
1110         if (r == -EEXIST && (copy_flags & COPY_REPLACE)) {
1111                 /* This codepath is us trying to address an error to copy, if the unlink fails, lets just return the original error. */
1112                 if (unlinkat(dt, to, 0) < 0)
1113                         return r;
1114
1115                 r = fd_copy_leaf(df, from, st, dt, to, override_uid, override_gid, copy_flags, hardlink_context, display_path, progress_bytes, userdata);
1116         }
1117
1118         return r;
1119 }
1120
1121 int copy_tree_at_full(
1122                 int fdf,
1123                 const char *from,
1124                 int fdt,
1125                 const char *to,
1126                 uid_t override_uid,
1127                 gid_t override_gid,
1128                 CopyFlags copy_flags,
1129                 const Set *denylist,
1130                 copy_progress_path_t progress_path,
1131                 copy_progress_bytes_t progress_bytes,
1132                 void *userdata) {
1133
1134         struct stat st;
1135         int r;
1136
1137         assert(from);
1138         assert(to);
1139
1140         if (fstatat(fdf, from, &st, AT_SYMLINK_NOFOLLOW) < 0)
1141                 return -errno;
1142
1143         r = fd_copy_tree_generic(fdf, from, &st, fdt, to, st.st_dev, COPY_DEPTH_MAX, override_uid,
1144                                  override_gid, copy_flags, denylist, NULL, NULL, progress_path,
1145                                  progress_bytes, userdata);
1146         if (r < 0)
1147                 return r;
1148
1149         if (S_ISDIR(st.st_mode) && (copy_flags & COPY_SYNCFS)) {
1150                 /* If the top-level inode is a directory run syncfs() now. */
1151                 r = syncfs_path(fdt, to);
1152                 if (r < 0)
1153                         return r;
1154         } else if ((copy_flags & (COPY_FSYNC_FULL|COPY_SYNCFS)) != 0) {
1155                 /* fsync() the parent dir of what we just copied if COPY_FSYNC_FULL is set. Also do this in
1156                  * case COPY_SYNCFS is set but the top-level inode wasn't actually a directory. We do this so that
1157                  * COPY_SYNCFS provides reasonable synchronization semantics on any kind of inode: when the
1158                  * copy operation is done the whole inode — regardless of its type — and all its children
1159                  * will be synchronized to disk. */
1160                 r = fsync_parent_at(fdt, to);
1161                 if (r < 0)
1162                         return r;
1163         }
1164
1165         return 0;
1166 }
1167
1168 static int sync_dir_by_flags(const char *path, CopyFlags copy_flags) {
1169
1170         if (copy_flags & COPY_SYNCFS)
1171                 return syncfs_path(AT_FDCWD, path);
1172         if (copy_flags & COPY_FSYNC_FULL)
1173                 return fsync_parent_at(AT_FDCWD, path);
1174
1175         return 0;
1176 }
1177
1178 int copy_directory_fd_full(
1179                 int dirfd,
1180                 const char *to,
1181                 CopyFlags copy_flags,
1182                 copy_progress_path_t progress_path,
1183                 copy_progress_bytes_t progress_bytes,
1184                 void *userdata) {
1185
1186         struct stat st;
1187         int r;
1188
1189         assert(dirfd >= 0);
1190         assert(to);
1191
1192         if (fstat(dirfd, &st) < 0)
1193                 return -errno;
1194
1195         r = stat_verify_directory(&st);
1196         if (r < 0)
1197                 return r;
1198
1199         r = fd_copy_directory(
1200                         dirfd, NULL,
1201                         &st,
1202                         AT_FDCWD, to,
1203                         st.st_dev,
1204                         COPY_DEPTH_MAX,
1205                         UID_INVALID, GID_INVALID,
1206                         copy_flags,
1207                         NULL, NULL, NULL,
1208                         progress_path,
1209                         progress_bytes,
1210                         userdata);
1211         if (r < 0)
1212                 return r;
1213
1214         r = sync_dir_by_flags(to, copy_flags);
1215         if (r < 0)
1216                 return r;
1217
1218         return 0;
1219 }
1220
1221 int copy_directory_full(
1222                 const char *from,
1223                 const char *to,
1224                 CopyFlags copy_flags,
1225                 copy_progress_path_t progress_path,
1226                 copy_progress_bytes_t progress_bytes,
1227                 void *userdata) {
1228
1229         struct stat st;
1230         int r;
1231
1232         assert(from);
1233         assert(to);
1234
1235         if (lstat(from, &st) < 0)
1236                 return -errno;
1237
1238         r = stat_verify_directory(&st);
1239         if (r < 0)
1240                 return r;
1241
1242         r = fd_copy_directory(
1243                         AT_FDCWD, from,
1244                         &st,
1245                         AT_FDCWD, to,
1246                         st.st_dev,
1247                         COPY_DEPTH_MAX,
1248                         UID_INVALID, GID_INVALID,
1249                         copy_flags,
1250                         NULL, NULL, NULL,
1251                         progress_path,
1252                         progress_bytes,
1253                         userdata);
1254         if (r < 0)
1255                 return r;
1256
1257         r = sync_dir_by_flags(to, copy_flags);
1258         if (r < 0)
1259                 return r;
1260
1261         return 0;
1262 }
1263
1264 int copy_file_fd_full(
1265                 const char *from,
1266                 int fdt,
1267                 CopyFlags copy_flags,
1268                 copy_progress_bytes_t progress_bytes,
1269                 void *userdata) {
1270
1271         _cleanup_close_ int fdf = -1;
1272         struct stat st;
1273         int r;
1274
1275         assert(from);
1276         assert(fdt >= 0);
1277
1278         fdf = open(from, O_RDONLY|O_CLOEXEC|O_NOCTTY);
1279         if (fdf < 0)
1280                 return -errno;
1281
1282         r = fd_verify_regular(fdf);
1283         if (r < 0)
1284                 return r;
1285
1286         if (fstat(fdt, &st) < 0)
1287                 return -errno;
1288
1289         r = copy_bytes_full(fdf, fdt, UINT64_MAX, copy_flags, NULL, NULL, progress_bytes, userdata);
1290         if (r < 0)
1291                 return r;
1292
1293         /* Make sure to copy file attributes only over if target is a regular
1294          * file (so that copying a file to /dev/null won't alter the access
1295          * mode/ownership of that device node...) */
1296         if (S_ISREG(st.st_mode)) {
1297                 (void) copy_times(fdf, fdt, copy_flags);
1298                 (void) copy_xattr(fdf, fdt, copy_flags);
1299         }
1300
1301         if (copy_flags & COPY_FSYNC_FULL) {
1302                 r = fsync_full(fdt);
1303                 if (r < 0)
1304                         return r;
1305         } else if (copy_flags & COPY_FSYNC) {
1306                 if (fsync(fdt) < 0)
1307                         return -errno;
1308         }
1309
1310         return 0;
1311 }
1312
1313 int copy_file_full(
1314                 const char *from,
1315                 const char *to,
1316                 int flags,
1317                 mode_t mode,
1318                 unsigned chattr_flags,
1319                 unsigned chattr_mask,
1320                 CopyFlags copy_flags,
1321                 copy_progress_bytes_t progress_bytes,
1322                 void *userdata) {
1323
1324         _cleanup_close_ int fdf = -1, fdt = -1;
1325         struct stat st;
1326         int r;
1327
1328         assert(from);
1329         assert(to);
1330
1331         fdf = open(from, O_RDONLY|O_CLOEXEC|O_NOCTTY);
1332         if (fdf < 0)
1333                 return -errno;
1334
1335         if (fstat(fdf, &st) < 0)
1336                 return -errno;
1337
1338         r = stat_verify_regular(&st);
1339         if (r < 0)
1340                 return r;
1341
1342         RUN_WITH_UMASK(0000) {
1343                 if (copy_flags & COPY_MAC_CREATE) {
1344                         r = mac_selinux_create_file_prepare(to, S_IFREG);
1345                         if (r < 0)
1346                                 return r;
1347                 }
1348                 fdt = open(to, flags|O_WRONLY|O_CREAT|O_CLOEXEC|O_NOCTTY,
1349                            mode != MODE_INVALID ? mode : st.st_mode);
1350                 if (copy_flags & COPY_MAC_CREATE)
1351                         mac_selinux_create_file_clear();
1352                 if (fdt < 0)
1353                         return -errno;
1354         }
1355
1356         if (!FLAGS_SET(flags, O_EXCL)) { /* if O_EXCL was used we created the thing as regular file, no need to check again */
1357                 r = fd_verify_regular(fdt);
1358                 if (r < 0)
1359                         goto fail;
1360         }
1361
1362         if (chattr_mask != 0)
1363                 (void) chattr_fd(fdt, chattr_flags, chattr_mask & CHATTR_EARLY_FL, NULL);
1364
1365         r = copy_bytes_full(fdf, fdt, UINT64_MAX, copy_flags, NULL, NULL, progress_bytes, userdata);
1366         if (r < 0)
1367                 goto fail;
1368
1369         (void) copy_times(fdf, fdt, copy_flags);
1370         (void) copy_xattr(fdf, fdt, copy_flags);
1371
1372         if (chattr_mask != 0)
1373                 (void) chattr_fd(fdt, chattr_flags, chattr_mask & ~CHATTR_EARLY_FL, NULL);
1374
1375         if (copy_flags & (COPY_FSYNC|COPY_FSYNC_FULL)) {
1376                 if (fsync(fdt) < 0) {
1377                         r = -errno;
1378                         goto fail;
1379                 }
1380         }
1381
1382         r = close_nointr(TAKE_FD(fdt)); /* even if this fails, the fd is now invalidated */
1383         if (r < 0)
1384                 goto fail;
1385
1386         if (copy_flags & COPY_FSYNC_FULL) {
1387                 r = fsync_parent_at(AT_FDCWD, to);
1388                 if (r < 0)
1389                         goto fail;
1390         }
1391
1392         return 0;
1393
1394 fail:
1395         /* Only unlink if we definitely are the ones who created the file */
1396         if (FLAGS_SET(flags, O_EXCL))
1397                 (void) unlink(to);
1398
1399         return r;
1400 }
1401
1402 int copy_file_atomic_full(
1403                 const char *from,
1404                 const char *to,
1405                 mode_t mode,
1406                 unsigned chattr_flags,
1407                 unsigned chattr_mask,
1408                 CopyFlags copy_flags,
1409                 copy_progress_bytes_t progress_bytes,
1410                 void *userdata) {
1411
1412         _cleanup_(unlink_and_freep) char *t = NULL;
1413         _cleanup_close_ int fdt = -1;
1414         int r;
1415
1416         assert(from);
1417         assert(to);
1418
1419         /* We try to use O_TMPFILE here to create the file if we can. Note that this only works if COPY_REPLACE is not
1420          * set though as we need to use linkat() for linking the O_TMPFILE file into the file system but that system
1421          * call can't replace existing files. Hence, if COPY_REPLACE is set we create a temporary name in the file
1422          * system right-away and unconditionally which we then can renameat() to the right name after we completed
1423          * writing it. */
1424
1425         if (copy_flags & COPY_REPLACE) {
1426                 _cleanup_free_ char *f = NULL;
1427
1428                 r = tempfn_random(to, NULL, &f);
1429                 if (r < 0)
1430                         return r;
1431
1432                 if (copy_flags & COPY_MAC_CREATE) {
1433                         r = mac_selinux_create_file_prepare(to, S_IFREG);
1434                         if (r < 0)
1435                                 return r;
1436                 }
1437                 fdt = open(f, O_CREAT|O_EXCL|O_NOFOLLOW|O_NOCTTY|O_WRONLY|O_CLOEXEC, 0600);
1438                 if (copy_flags & COPY_MAC_CREATE)
1439                         mac_selinux_create_file_clear();
1440                 if (fdt < 0)
1441                         return -errno;
1442
1443                 t = TAKE_PTR(f);
1444         } else {
1445                 if (copy_flags & COPY_MAC_CREATE) {
1446                         r = mac_selinux_create_file_prepare(to, S_IFREG);
1447                         if (r < 0)
1448                                 return r;
1449                 }
1450                 fdt = open_tmpfile_linkable(to, O_WRONLY|O_CLOEXEC, &t);
1451                 if (copy_flags & COPY_MAC_CREATE)
1452                         mac_selinux_create_file_clear();
1453                 if (fdt < 0)
1454                         return fdt;
1455         }
1456
1457         if (chattr_mask != 0)
1458                 (void) chattr_fd(fdt, chattr_flags, chattr_mask & CHATTR_EARLY_FL, NULL);
1459
1460         r = copy_file_fd_full(from, fdt, copy_flags, progress_bytes, userdata);
1461         if (r < 0)
1462                 return r;
1463
1464         if (fchmod(fdt, mode) < 0)
1465                 return -errno;
1466
1467         if ((copy_flags & (COPY_FSYNC|COPY_FSYNC_FULL))) {
1468                 /* Sync the file */
1469                 if (fsync(fdt) < 0)
1470                         return -errno;
1471         }
1472
1473         if (copy_flags & COPY_REPLACE) {
1474                 if (renameat(AT_FDCWD, t, AT_FDCWD, to) < 0)
1475                         return -errno;
1476         } else {
1477                 r = link_tmpfile(fdt, t, to);
1478                 if (r < 0)
1479                         return r;
1480         }
1481
1482         t = mfree(t);
1483
1484         if (chattr_mask != 0)
1485                 (void) chattr_fd(fdt, chattr_flags, chattr_mask & ~CHATTR_EARLY_FL, NULL);
1486
1487         r = close_nointr(TAKE_FD(fdt)); /* even if this fails, the fd is now invalidated */
1488         if (r < 0)
1489                 goto fail;
1490
1491         if (copy_flags & COPY_FSYNC_FULL) {
1492                 /* Sync the parent directory */
1493                 r = fsync_parent_at(AT_FDCWD, to);
1494                 if (r < 0)
1495                         goto fail;
1496         }
1497
1498         return 0;
1499
1500 fail:
1501         (void) unlink(to);
1502         return r;
1503 }
1504
1505 int copy_times(int fdf, int fdt, CopyFlags flags) {
1506         struct stat st;
1507
1508         assert(fdf >= 0);
1509         assert(fdt >= 0);
1510
1511         if (fstat(fdf, &st) < 0)
1512                 return -errno;
1513
1514         if (futimens(fdt, (struct timespec[2]) { st.st_atim, st.st_mtim }) < 0)
1515                 return -errno;
1516
1517         if (FLAGS_SET(flags, COPY_CRTIME)) {
1518                 usec_t crtime;
1519
1520                 if (fd_getcrtime(fdf, &crtime) >= 0)
1521                         (void) fd_setcrtime(fdt, crtime);
1522         }
1523
1524         return 0;
1525 }
1526
1527 int copy_access(int fdf, int fdt) {
1528         struct stat st;
1529
1530         assert(fdf >= 0);
1531         assert(fdt >= 0);
1532
1533         /* Copies just the access mode (and not the ownership) from fdf to fdt */
1534
1535         if (fstat(fdf, &st) < 0)
1536                 return -errno;
1537
1538         return RET_NERRNO(fchmod(fdt, st.st_mode & 07777));
1539 }
1540
1541 int copy_rights_with_fallback(int fdf, int fdt, const char *patht) {
1542         struct stat st;
1543
1544         assert(fdf >= 0);
1545         assert(fdt >= 0);
1546
1547         /* Copies both access mode and ownership from fdf to fdt */
1548
1549         if (fstat(fdf, &st) < 0)
1550                 return -errno;
1551
1552         return fchmod_and_chown_with_fallback(fdt, patht, st.st_mode & 07777, st.st_uid, st.st_gid);
1553 }
1554
1555 int copy_xattr(int fdf, int fdt, CopyFlags copy_flags) {
1556         _cleanup_free_ char *names = NULL;
1557         int ret = 0, r;
1558         const char *p;
1559
1560         r = flistxattr_malloc(fdf, &names);
1561         if (r < 0)
1562                 return r;
1563
1564         NULSTR_FOREACH(p, names) {
1565                 _cleanup_free_ char *value = NULL;
1566
1567                 if (!FLAGS_SET(copy_flags, COPY_ALL_XATTRS) && !startswith(p, "user."))
1568                         continue;
1569
1570                 r = fgetxattr_malloc(fdf, p, &value);
1571                 if (r == -ENODATA)
1572                         continue; /* gone by now */
1573                 if (r < 0)
1574                         return r;
1575
1576                 if (fsetxattr(fdt, p, value, r, 0) < 0)
1577                         ret = -errno;
1578         }
1579
1580         return ret;
1581 }