src/udev/udev-node.c

   1 /* SPDX-License-Identifier: GPL-2.0-or-later */
   2
   3 #include <errno.h>
   4 #include <fcntl.h>
   5 #include <stdbool.h>
   6 #include <stddef.h>
   7 #include <sys/stat.h>
   8 #include <unistd.h>
   9
  10 #include "sd-id128.h"
  11
  12 #include "alloc-util.h"
  13 #include "device-private.h"
  14 #include "device-util.h"
  15 #include "devnum-util.h"
  16 #include "dirent-util.h"
  17 #include "escape.h"
  18 #include "fd-util.h"
  19 #include "format-util.h"
  20 #include "fs-util.h"
  21 #include "hexdecoct.h"
  22 #include "mkdir-label.h"
  23 #include "parse-util.h"
  24 #include "path-util.h"
  25 #include "random-util.h"
  26 #include "selinux-util.h"
  27 #include "smack-util.h"
  28 #include "stat-util.h"
  29 #include "stdio-util.h"
  30 #include "string-util.h"
  31 #include "strxcpyx.h"
  32 #include "time-util.h"
  33 #include "udev-node.h"
  34 #include "user-util.h"
  35
  36 #define CREATE_LINK_MAX_RETRIES        128
  37 #define LINK_UPDATE_MAX_RETRIES        128
  38 #define UPDATE_TIMESTAMP_MAX_RETRIES   128
  39 #define MAX_RANDOM_DELAY (250 * USEC_PER_MSEC)
  40 #define MIN_RANDOM_DELAY ( 50 * USEC_PER_MSEC)
  41 #define UDEV_NODE_HASH_KEY SD_ID128_MAKE(b9,6a,f1,ce,40,31,44,1a,9e,19,ec,8b,ae,f3,e3,2f)
  42
  43 static int create_symlink(const char *target, const char *slink) {
  44         int r;
  45
  46         assert(target);
  47         assert(slink);
  48
  49         for (unsigned i = 0; i < CREATE_LINK_MAX_RETRIES; i++) {
  50                 r = mkdir_parents_label(slink, 0755);
  51                 if (r == -ENOENT)
  52                         continue;
  53                 if (r < 0)
  54                         return r;
  55
  56                 mac_selinux_create_file_prepare(slink, S_IFLNK);
  57                 r = RET_NERRNO(symlink(target, slink));
  58                 mac_selinux_create_file_clear();
  59                 if (r != -ENOENT)
  60                         return r;
  61         }
  62
  63         return r;
  64 }
  65
  66 static int node_symlink(sd_device *dev, const char *devnode, const char *slink) {
  67         _cleanup_free_ char *target = NULL;
  68         const char *id, *slink_tmp;
  69         struct stat st;
  70         int r;
  71
  72         assert(dev);
  73         assert(slink);
  74
  75         if (!devnode) {
  76                 r = sd_device_get_devname(dev, &devnode);
  77                 if (r < 0)
  78                         return log_device_debug_errno(dev, r, "Failed to get device node: %m");
  79         }
  80
  81         if (lstat(slink, &st) >= 0) {
  82                 if (!S_ISLNK(st.st_mode))
  83                         return log_device_debug_errno(dev, SYNTHETIC_ERRNO(EEXIST),
  84                                                       "Conflicting inode '%s' found, symlink to '%s' will not be created.",
  85                                                       slink, devnode);
  86         } else if (errno != ENOENT)
  87                 return log_device_debug_errno(dev, errno, "Failed to lstat() '%s': %m", slink);
  88
  89         /* use relative link */
  90         r = path_make_relative_parent(slink, devnode, &target);
  91         if (r < 0)
  92                 return log_device_debug_errno(dev, r, "Failed to get relative path from '%s' to '%s': %m", slink, devnode);
  93
  94         r = device_get_device_id(dev, &id);
  95         if (r < 0)
  96                 return log_device_debug_errno(dev, r, "Failed to get device id: %m");
  97
  98         slink_tmp = strjoina(slink, ".tmp-", id);
  99         (void) unlink(slink_tmp);
 100
 101         r = create_symlink(target, slink_tmp);
 102         if (r < 0)
 103                 return log_device_debug_errno(dev, r, "Failed to create symlink '%s' to '%s': %m", slink_tmp, target);
 104
 105         if (rename(slink_tmp, slink) < 0) {
 106                 r = log_device_debug_errno(dev, errno, "Failed to rename '%s' to '%s': %m", slink_tmp, slink);
 107                 (void) unlink(slink_tmp);
 108                 return r;
 109         }
 110
 111         return 0;
 112 }
 113
 114 static int stack_directory_find_prioritized_devnode(sd_device *dev, const char *dirname, bool add, char **ret) {
 115         _cleanup_closedir_ DIR *dir = NULL;
 116         _cleanup_free_ char *devnode = NULL;
 117         int r, priority = 0;
 118         const char *id;
 119
 120         assert(dev);
 121         assert(dirname);
 122         assert(ret);
 123
 124         /* Find device node of device with highest priority. This returns 1 if a device found, 0 if no
 125          * device found, or a negative errno on error. */
 126
 127         if (add) {
 128                 const char *n;
 129
 130                 r = device_get_devlink_priority(dev, &priority);
 131                 if (r < 0)
 132                         return r;
 133
 134                 r = sd_device_get_devname(dev, &n);
 135                 if (r < 0)
 136                         return r;
 137
 138                 devnode = strdup(n);
 139                 if (!devnode)
 140                         return -ENOMEM;
 141         }
 142
 143         dir = opendir(dirname);
 144         if (!dir)
 145                 return -errno;
 146
 147         r = device_get_device_id(dev, &id);
 148         if (r < 0)
 149                 return r;
 150
 151         FOREACH_DIRENT_ALL(de, dir, break) {
 152                 int tmp_prio;
 153
 154                 if (de->d_name[0] == '.')
 155                         continue;
 156
 157                 /* skip ourself */
 158                 if (streq(de->d_name, id))
 159                         continue;
 160
 161                 if (de->d_type == DT_LNK) {
 162                         _cleanup_free_ char *buf = NULL;
 163                         char *colon;
 164
 165                         /* New format. The devnode and priority can be obtained from symlink. */
 166
 167                         r = readlinkat_malloc(dirfd(dir), de->d_name, &buf);
 168                         if (r < 0) {
 169                                 log_device_debug_errno(dev, r, "Failed to read symlink %s, ignoring: %m", de->d_name);
 170                                 continue;
 171                         }
 172
 173                         colon = strchr(buf, ':');
 174                         if (!colon || colon == buf)
 175                                 continue;
 176
 177                         *colon = '\0';
 178
 179                         if (safe_atoi(buf, &tmp_prio) < 0)
 180                                 continue;
 181
 182                         if (devnode && tmp_prio <= priority)
 183                                 continue;
 184
 185                         r = free_and_strdup(&devnode, colon + 1);
 186                         if (r < 0)
 187                                 return r;
 188
 189                 } else if (de->d_type == DT_REG) {
 190                         _cleanup_(sd_device_unrefp) sd_device *tmp_dev = NULL;
 191                         const char *val;
 192
 193                         /* Old format. The devnode and priority must be obtained from uevent and
 194                          * udev database files. */
 195
 196                         if (sd_device_new_from_device_id(&tmp_dev, de->d_name) < 0)
 197                                 continue;
 198
 199                         if (device_get_devlink_priority(tmp_dev, &tmp_prio) < 0)
 200                                 continue;
 201
 202                         if (devnode && tmp_prio <= priority)
 203                                 continue;
 204
 205                         if (sd_device_get_devname(tmp_dev, &val) < 0)
 206                                 continue;
 207
 208                         r = free_and_strdup(&devnode, val);
 209                         if (r < 0)
 210                                 return r;
 211
 212                 } else
 213                         continue;
 214
 215                 priority = tmp_prio;
 216         }
 217
 218         *ret = TAKE_PTR(devnode);
 219         return !!*ret;
 220 }
 221
 222 static int update_timestamp(sd_device *dev, int fd, struct stat *prev) {
 223         assert(fd >= 0);
 224         assert(prev);
 225
 226         /* Even if a symlink in the stack directory is created/removed, the mtime of the directory may
 227          * not be changed. Why? Let's consider the following situation. For simplicity, let's assume
 228          * there exist two udev workers (A and B) and all of them calls link_update() for the same
 229          * devlink simultaneously.
 230          *
 231          * 1. A creates/removes a symlink in the stack directory.
 232          * 2. A calls the first stat() in the loop of link_update().
 233          * 3. A calls link_find_prioritized().
 234          * 4. B creates/removes another symlink in the stack directory, so the result of the step 3 is outdated.
 235          * 5. B finishes link_update().
 236          * 6. A creates/removes devlink according to the outdated result in the step 3.
 237          * 7. A calls the second stat() in the loop of link_update().
 238          *
 239          * If these 7 steps are processed in this order within a short time period that kernel's timer
 240          * does not increase, then even if the contents in the stack directory is changed, the results
 241          * of two stat() called by A shows the same timestamp, and A cannot detect the change.
 242          *
 243          * By calling this function after creating/removing symlinks in the stack directory, the
 244          * timestamp of the stack directory is always increased at least in the above step 5, so A can
 245          * detect the update. */
 246
 247         for (unsigned i = 0; i < UPDATE_TIMESTAMP_MAX_RETRIES; i++) {
 248                 struct stat st;
 249
 250                 if (fstat(fd, &st) < 0)
 251                         return -errno;
 252
 253                 if (!stat_inode_unmodified(prev, &st))
 254                         return 0;
 255
 256                 log_device_debug(dev,
 257                                  "Stack directory is modified, but its timestamp is not changed, "
 258                                  "updating timestamp after 10ms.");
 259
 260                 (void) usleep(10 * USEC_PER_MSEC);
 261                 if (futimens(fd, NULL) < 0)
 262                         return -errno;
 263         }
 264
 265         return -ELOOP;
 266 }
 267
 268 static int stack_directory_update(sd_device *dev, int fd, bool add) {
 269         struct stat st;
 270         const char *id;
 271         int r;
 272
 273         assert(dev);
 274         assert(fd >= 0);
 275
 276         r = device_get_device_id(dev, &id);
 277         if (r < 0)
 278                 return r;
 279
 280         if (fstat(fd, &st) < 0)
 281                 return -errno;
 282
 283         if (add) {
 284                 _cleanup_free_ char *data = NULL, *buf = NULL;
 285                 const char *devname;
 286                 int priority;
 287
 288                 r = sd_device_get_devname(dev, &devname);
 289                 if (r < 0)
 290                         return r;
 291
 292                 r = device_get_devlink_priority(dev, &priority);
 293                 if (r < 0)
 294                         return r;
 295
 296                 if (asprintf(&data, "%i:%s", priority, devname) < 0)
 297                         return -ENOMEM;
 298
 299                 if (readlinkat_malloc(fd, id, &buf) >= 0 && streq(buf, data))
 300                         return 0; /* Unchanged. */
 301
 302                 (void) unlinkat(fd, id, 0);
 303
 304                 if (symlinkat(data, fd, id) < 0)
 305                         return -errno;
 306
 307         } else {
 308                 if (unlinkat(fd, id, 0) < 0) {
 309                         if (errno == ENOENT)
 310                                 return 0; /* Unchanged. */
 311                         return -errno;
 312                 }
 313         }
 314
 315         r = update_timestamp(dev, fd, &st);
 316         if (r < 0)
 317                 return r;
 318
 319         return 0;
 320 }
 321
 322 static int stack_directory_open(const char *dirname) {
 323         _cleanup_close_ int fd = -1;
 324         int r;
 325
 326         assert(dirname);
 327
 328         r = mkdir_parents(dirname, 0755);
 329         if (r < 0)
 330                 return r;
 331
 332         fd = open_mkdir_at(AT_FDCWD, dirname, O_CLOEXEC | O_DIRECTORY | O_NOFOLLOW | O_RDONLY, 0755);
 333         if (fd < 0)
 334                 return fd;
 335
 336         return TAKE_FD(fd);
 337 }
 338
 339 size_t udev_node_escape_path(const char *src, char *dest, size_t size) {
 340         size_t i, j;
 341         uint64_t h;
 342
 343         assert(src);
 344         assert(dest);
 345         assert(size >= 12);
 346
 347         for (i = 0, j = 0; src[i] != '\0'; i++) {
 348                 if (src[i] == '/') {
 349                         if (j+4 >= size - 12 + 1)
 350                                 goto toolong;
 351                         memcpy(&dest[j], "\\x2f", 4);
 352                         j += 4;
 353                 } else if (src[i] == '\\') {
 354                         if (j+4 >= size - 12 + 1)
 355                                 goto toolong;
 356                         memcpy(&dest[j], "\\x5c", 4);
 357                         j += 4;
 358                 } else {
 359                         if (j+1 >= size - 12 + 1)
 360                                 goto toolong;
 361                         dest[j] = src[i];
 362                         j++;
 363                 }
 364         }
 365         dest[j] = '\0';
 366         return j;
 367
 368 toolong:
 369         /* If the input path is too long to encode as a filename, then let's suffix with a string
 370          * generated from the hash of the path. */
 371
 372         h = siphash24_string(src, UDEV_NODE_HASH_KEY.bytes);
 373
 374         for (unsigned k = 0; k <= 10; k++)
 375                 dest[size - k - 2] = urlsafe_base64char((h >> (k * 6)) & 63);
 376
 377         dest[size - 1] = '\0';
 378         return size - 1;
 379 }
 380
 381 static int stack_directory_get_name(const char *slink, char **ret) {
 382         _cleanup_free_ char *s = NULL, *dirname = NULL;
 383         char name_enc[NAME_MAX+1];
 384         const char *name;
 385
 386         assert(slink);
 387         assert(ret);
 388
 389         s = strdup(slink);
 390         if (!s)
 391                 return -ENOMEM;
 392
 393         path_simplify(s);
 394
 395         if (!path_is_normalized(s))
 396                 return -EINVAL;
 397
 398         name = path_startswith(s, "/dev");
 399         if (empty_or_root(name))
 400                 return -EINVAL;
 401
 402         udev_node_escape_path(name, name_enc, sizeof(name_enc));
 403
 404         dirname = path_join("/run/udev/links", name_enc);
 405         if (!dirname)
 406                 return -ENOMEM;
 407
 408         *ret = TAKE_PTR(dirname);
 409         return 0;
 410 }
 411
 412 static int link_update(sd_device *dev, const char *slink, bool add) {
 413         _cleanup_free_ char *dirname = NULL;
 414         _cleanup_close_ int dirfd = -1;
 415         int r;
 416
 417         assert(dev);
 418         assert(slink);
 419
 420         r = stack_directory_get_name(slink, &dirname);
 421         if (r < 0)
 422                 return log_device_debug_errno(dev, r, "Failed to build stack directory name for '%s': %m", slink);
 423
 424         dirfd = stack_directory_open(dirname);
 425         if (dirfd < 0)
 426                 return log_device_debug_errno(dev, dirfd, "Failed to open stack directory '%s': %m", dirname);
 427
 428         r = stack_directory_update(dev, dirfd, add);
 429         if (r < 0)
 430                 return log_device_debug_errno(dev, r, "Failed to update stack directory '%s': %m", dirname);
 431
 432         for (unsigned i = 0; i < LINK_UPDATE_MAX_RETRIES; i++) {
 433                 _cleanup_free_ char *target = NULL;
 434                 struct stat st1 = {}, st2 = {};
 435
 436                 if (i > 0) {
 437                         usec_t delay = MIN_RANDOM_DELAY + random_u64_range(MAX_RANDOM_DELAY - MIN_RANDOM_DELAY);
 438
 439                         log_device_debug(dev, "Directory %s was updated, retrying to update devlink %s after %s.",
 440                                          dirname, slink, FORMAT_TIMESPAN(delay, USEC_PER_MSEC));
 441                         (void) usleep(delay);
 442                 }
 443
 444                 if (stat(dirname, &st1) < 0 && errno != ENOENT)
 445                         return log_device_debug_errno(dev, errno, "Failed to stat %s: %m", dirname);
 446
 447                 r = stack_directory_find_prioritized_devnode(dev, dirname, add, &target);
 448                 if (r < 0)
 449                         return log_device_debug_errno(dev, r, "Failed to determine device node with the highest priority for '%s': %m", slink);
 450                 if (r == 0) {
 451                         log_device_debug(dev, "No reference left for '%s', removing", slink);
 452
 453                         if (unlink(slink) < 0 && errno != ENOENT)
 454                                 log_device_debug_errno(dev, errno, "Failed to remove '%s', ignoring: %m", slink);
 455
 456                         (void) rmdir_parents(slink, "/dev");
 457                         return 0;
 458                 }
 459
 460                 r = node_symlink(dev, target, slink);
 461                 if (r < 0)
 462                         return r;
 463
 464                 if (stat(dirname, &st2) < 0 && errno != ENOENT)
 465                         return log_device_debug_errno(dev, errno, "Failed to stat %s: %m", dirname);
 466
 467                 if (((st1.st_mode & S_IFMT) == 0 && (st2.st_mode & S_IFMT) == 0) ||
 468                     stat_inode_unmodified(&st1, &st2))
 469                         return 0;
 470         }
 471
 472         return -ELOOP;
 473 }
 474
 475 static int device_get_devpath_by_devnum(sd_device *dev, char **ret) {
 476         const char *subsystem;
 477         dev_t devnum;
 478         int r;
 479
 480         assert(dev);
 481         assert(ret);
 482
 483         r = sd_device_get_subsystem(dev, &subsystem);
 484         if (r < 0)
 485                 return r;
 486
 487         r = sd_device_get_devnum(dev, &devnum);
 488         if (r < 0)
 489                 return r;
 490
 491         return device_path_make_major_minor(streq(subsystem, "block") ? S_IFBLK : S_IFCHR, devnum, ret);
 492 }
 493
 494 int udev_node_update(sd_device *dev, sd_device *dev_old) {
 495         _cleanup_free_ char *filename = NULL;
 496         const char *devlink;
 497         int r;
 498
 499         assert(dev);
 500         assert(dev_old);
 501
 502         /* update possible left-over symlinks */
 503         FOREACH_DEVICE_DEVLINK(dev_old, devlink) {
 504                 /* check if old link name still belongs to this device */
 505                 if (device_has_devlink(dev, devlink))
 506                         continue;
 507
 508                 log_device_debug(dev,
 509                                  "Removing/updating old device symlink '%s', which is no longer belonging to this device.",
 510                                  devlink);
 511
 512                 r = link_update(dev, devlink, /* add = */ false);
 513                 if (r < 0)
 514                         log_device_warning_errno(dev, r,
 515                                                  "Failed to remove/update device symlink '%s', ignoring: %m",
 516                                                  devlink);
 517         }
 518
 519         /* create/update symlinks, add symlinks to name index */
 520         FOREACH_DEVICE_DEVLINK(dev, devlink) {
 521                 r = link_update(dev, devlink, /* add = */ true);
 522                 if (r < 0)
 523                         log_device_warning_errno(dev, r,
 524                                                  "Failed to create/update device symlink '%s', ignoring: %m",
 525                                                  devlink);
 526         }
 527
 528         r = device_get_devpath_by_devnum(dev, &filename);
 529         if (r < 0)
 530                 return log_device_debug_errno(dev, r, "Failed to get device path: %m");
 531
 532         /* always add /dev/{block,char}/$major:$minor */
 533         r = node_symlink(dev, NULL, filename);
 534         if (r < 0)
 535                 return log_device_warning_errno(dev, r, "Failed to create device symlink '%s': %m", filename);
 536
 537         return 0;
 538 }
 539
 540 int udev_node_remove(sd_device *dev) {
 541         _cleanup_free_ char *filename = NULL;
 542         const char *devlink;
 543         int r;
 544
 545         assert(dev);
 546
 547         /* remove/update symlinks, remove symlinks from name index */
 548         FOREACH_DEVICE_DEVLINK(dev, devlink) {
 549                 r = link_update(dev, devlink, /* add = */ false);
 550                 if (r < 0)
 551                         log_device_warning_errno(dev, r,
 552                                                  "Failed to remove/update device symlink '%s', ignoring: %m",
 553                                                  devlink);
 554         }
 555
 556         r = device_get_devpath_by_devnum(dev, &filename);
 557         if (r < 0)
 558                 return log_device_debug_errno(dev, r, "Failed to get device path: %m");
 559
 560         /* remove /dev/{block,char}/$major:$minor */
 561         if (unlink(filename) < 0 && errno != ENOENT)
 562                 return log_device_debug_errno(dev, errno, "Failed to remove '%s': %m", filename);
 563
 564         return 0;
 565 }
 566
 567 static int udev_node_apply_permissions_impl(
 568                 sd_device *dev, /* can be NULL, only used for logging. */
 569                 int node_fd,
 570                 const char *devnode,
 571                 bool apply_mac,
 572                 mode_t mode,
 573                 uid_t uid,
 574                 gid_t gid,
 575                 OrderedHashmap *seclabel_list) {
 576
 577         bool apply_mode, apply_uid, apply_gid;
 578         struct stat stats;
 579         int r;
 580
 581         assert(node_fd >= 0);
 582         assert(devnode);
 583
 584         if (fstat(node_fd, &stats) < 0)
 585                 return log_device_debug_errno(dev, errno, "cannot stat() node %s: %m", devnode);
 586
 587         /* If group is set, but mode is not set, "upgrade" mode for the group. */
 588         if (mode == MODE_INVALID && gid_is_valid(gid) && gid > 0)
 589                 mode = 0660;
 590
 591         apply_mode = mode != MODE_INVALID && (stats.st_mode & 0777) != (mode & 0777);
 592         apply_uid = uid_is_valid(uid) && stats.st_uid != uid;
 593         apply_gid = gid_is_valid(gid) && stats.st_gid != gid;
 594
 595         if (apply_mode || apply_uid || apply_gid || apply_mac) {
 596                 bool selinux = false, smack = false;
 597                 const char *name, *label;
 598
 599                 if (apply_mode || apply_uid || apply_gid) {
 600                         log_device_debug(dev, "Setting permissions %s, uid=" UID_FMT ", gid=" GID_FMT ", mode=%#o",
 601                                          devnode,
 602                                          uid_is_valid(uid) ? uid : stats.st_uid,
 603                                          gid_is_valid(gid) ? gid : stats.st_gid,
 604                                          mode != MODE_INVALID ? mode & 0777 : stats.st_mode & 0777);
 605
 606                         r = fchmod_and_chown(node_fd, mode, uid, gid);
 607                         if (r < 0)
 608                                 log_device_full_errno(dev, r == -ENOENT ? LOG_DEBUG : LOG_ERR, r,
 609                                                       "Failed to set owner/mode of %s to uid=" UID_FMT
 610                                                       ", gid=" GID_FMT ", mode=%#o: %m",
 611                                                       devnode,
 612                                                       uid_is_valid(uid) ? uid : stats.st_uid,
 613                                                       gid_is_valid(gid) ? gid : stats.st_gid,
 614                                                       mode != MODE_INVALID ? mode & 0777 : stats.st_mode & 0777);
 615                 } else
 616                         log_device_debug(dev, "Preserve permissions of %s, uid=" UID_FMT ", gid=" GID_FMT ", mode=%#o",
 617                                          devnode,
 618                                          uid_is_valid(uid) ? uid : stats.st_uid,
 619                                          gid_is_valid(gid) ? gid : stats.st_gid,
 620                                          mode != MODE_INVALID ? mode & 0777 : stats.st_mode & 0777);
 621
 622                 /* apply SECLABEL{$module}=$label */
 623                 ORDERED_HASHMAP_FOREACH_KEY(label, name, seclabel_list) {
 624                         int q;
 625
 626                         if (streq(name, "selinux")) {
 627                                 selinux = true;
 628
 629                                 q = mac_selinux_apply_fd(node_fd, devnode, label);
 630                                 if (q < 0)
 631                                         log_device_full_errno(dev, q == -ENOENT ? LOG_DEBUG : LOG_ERR, q,
 632                                                               "SECLABEL: failed to set SELinux label '%s': %m", label);
 633                                 else
 634                                         log_device_debug(dev, "SECLABEL: set SELinux label '%s'", label);
 635
 636                         } else if (streq(name, "smack")) {
 637                                 smack = true;
 638
 639                                 q = mac_smack_apply_fd(node_fd, SMACK_ATTR_ACCESS, label);
 640                                 if (q < 0)
 641                                         log_device_full_errno(dev, q == -ENOENT ? LOG_DEBUG : LOG_ERR, q,
 642                                                               "SECLABEL: failed to set SMACK label '%s': %m", label);
 643                                 else
 644                                         log_device_debug(dev, "SECLABEL: set SMACK label '%s'", label);
 645
 646                         } else
 647                                 log_device_error(dev, "SECLABEL: unknown subsystem, ignoring '%s'='%s'", name, label);
 648                 }
 649
 650                 /* set the defaults */
 651                 if (!selinux)
 652                         (void) mac_selinux_fix_full(node_fd, NULL, devnode, LABEL_IGNORE_ENOENT);
 653                 if (!smack)
 654                         (void) mac_smack_apply_fd(node_fd, SMACK_ATTR_ACCESS, NULL);
 655         }
 656
 657         /* always update timestamp when we re-use the node, like on media change events */
 658         r = futimens_opath(node_fd, NULL);
 659         if (r < 0)
 660                 log_device_debug_errno(dev, r, "Failed to adjust timestamp of node %s: %m", devnode);
 661
 662         return 0;
 663 }
 664
 665 int udev_node_apply_permissions(
 666                 sd_device *dev,
 667                 bool apply_mac,
 668                 mode_t mode,
 669                 uid_t uid,
 670                 gid_t gid,
 671                 OrderedHashmap *seclabel_list) {
 672
 673         const char *devnode;
 674         _cleanup_close_ int node_fd = -1;
 675         int r;
 676
 677         assert(dev);
 678
 679         r = sd_device_get_devname(dev, &devnode);
 680         if (r < 0)
 681                 return log_device_debug_errno(dev, r, "Failed to get devname: %m");
 682
 683         node_fd = sd_device_open(dev, O_PATH|O_CLOEXEC);
 684         if (node_fd < 0) {
 685                 if (ERRNO_IS_DEVICE_ABSENT(node_fd)) {
 686                         log_device_debug_errno(dev, node_fd, "Device node %s is missing, skipping handling.", devnode);
 687                         return 0; /* This is necessarily racey, so ignore missing the device */
 688                 }
 689
 690                 return log_device_debug_errno(dev, node_fd, "Cannot open node %s: %m", devnode);
 691         }
 692
 693         return udev_node_apply_permissions_impl(dev, node_fd, devnode, apply_mac, mode, uid, gid, seclabel_list);
 694 }
 695
 696 int static_node_apply_permissions(
 697                 const char *name,
 698                 mode_t mode,
 699                 uid_t uid,
 700                 gid_t gid,
 701                 char **tags) {
 702
 703         _cleanup_free_ char *unescaped_filename = NULL;
 704         _cleanup_close_ int node_fd = -1;
 705         const char *devnode;
 706         struct stat stats;
 707         int r;
 708
 709         assert(name);
 710
 711         if (uid == UID_INVALID && gid == GID_INVALID && mode == MODE_INVALID && !tags)
 712                 return 0;
 713
 714         devnode = strjoina("/dev/", name);
 715
 716         node_fd = open(devnode, O_PATH|O_CLOEXEC);
 717         if (node_fd < 0) {
 718                 if (errno != ENOENT)
 719                         return log_error_errno(errno, "Failed to open %s: %m", devnode);
 720                 return 0;
 721         }
 722
 723         if (fstat(node_fd, &stats) < 0)
 724                 return log_error_errno(errno, "Failed to stat %s: %m", devnode);
 725
 726         if (!S_ISBLK(stats.st_mode) && !S_ISCHR(stats.st_mode)) {
 727                 log_warning("%s is neither block nor character device, ignoring.", devnode);
 728                 return 0;
 729         }
 730
 731         if (!strv_isempty(tags)) {
 732                 unescaped_filename = xescape(name, "/.");
 733                 if (!unescaped_filename)
 734                         return log_oom();
 735         }
 736
 737         /* export the tags to a directory as symlinks, allowing otherwise dead nodes to be tagged */
 738         STRV_FOREACH(t, tags) {
 739                 _cleanup_free_ char *p = NULL;
 740
 741                 p = path_join("/run/udev/static_node-tags/", *t, unescaped_filename);
 742                 if (!p)
 743                         return log_oom();
 744
 745                 r = mkdir_parents(p, 0755);
 746                 if (r < 0)
 747                         return log_error_errno(r, "Failed to create parent directory for %s: %m", p);
 748
 749                 r = symlink(devnode, p);
 750                 if (r < 0 && errno != EEXIST)
 751                         return log_error_errno(errno, "Failed to create symlink %s -> %s: %m", p, devnode);
 752         }
 753
 754         return udev_node_apply_permissions_impl(NULL, node_fd, devnode, false, mode, uid, gid, NULL);
 755 }