src/udev/udev-node.c

   1 /* SPDX-License-Identifier: GPL-2.0-or-later */
   2
   3 #include <errno.h>
   4 #include <fcntl.h>
   5 #include <stdbool.h>
   6 #include <stddef.h>
   7 #include <sys/stat.h>
   8 #include <unistd.h>
   9
  10 #include "sd-id128.h"
  11
  12 #include "alloc-util.h"
  13 #include "device-private.h"
  14 #include "device-util.h"
  15 #include "devnum-util.h"
  16 #include "dirent-util.h"
  17 #include "escape.h"
  18 #include "fd-util.h"
  19 #include "format-util.h"
  20 #include "fs-util.h"
  21 #include "hexdecoct.h"
  22 #include "mkdir-label.h"
  23 #include "parse-util.h"
  24 #include "path-util.h"
  25 #include "random-util.h"
  26 #include "selinux-util.h"
  27 #include "smack-util.h"
  28 #include "stat-util.h"
  29 #include "stdio-util.h"
  30 #include "string-util.h"
  31 #include "strxcpyx.h"
  32 #include "time-util.h"
  33 #include "udev-node.h"
  34 #include "user-util.h"
  35
  36 #define CREATE_LINK_MAX_RETRIES        128
  37 #define LINK_UPDATE_MAX_RETRIES        128
  38 #define UPDATE_TIMESTAMP_MAX_RETRIES   128
  39 #define MAX_RANDOM_DELAY (250 * USEC_PER_MSEC)
  40 #define MIN_RANDOM_DELAY ( 50 * USEC_PER_MSEC)
  41 #define UDEV_NODE_HASH_KEY SD_ID128_MAKE(b9,6a,f1,ce,40,31,44,1a,9e,19,ec,8b,ae,f3,e3,2f)
  42
  43 static int create_symlink(const char *target, const char *slink) {
  44         int r;
  45
  46         assert(target);
  47         assert(slink);
  48
  49         for (unsigned i = 0; i < CREATE_LINK_MAX_RETRIES; i++) {
  50                 r = mkdir_parents_label(slink, 0755);
  51                 if (r == -ENOENT)
  52                         continue;
  53                 if (r < 0)
  54                         return r;
  55
  56                 mac_selinux_create_file_prepare(slink, S_IFLNK);
  57                 r = RET_NERRNO(symlink(target, slink));
  58                 mac_selinux_create_file_clear();
  59                 if (r != -ENOENT)
  60                         return r;
  61         }
  62
  63         return r;
  64 }
  65
  66 static int node_symlink(sd_device *dev, const char *node, const char *slink) {
  67         _cleanup_free_ char *slink_dirname = NULL, *target = NULL;
  68         const char *id, *slink_tmp;
  69         struct stat stats;
  70         int r;
  71
  72         assert(dev);
  73         assert(node);
  74         assert(slink);
  75
  76         if (lstat(slink, &stats) >= 0) {
  77                 if (!S_ISLNK(stats.st_mode))
  78                         return log_device_debug_errno(dev, SYNTHETIC_ERRNO(EEXIST),
  79                                                       "Conflicting inode '%s' found, link to '%s' will not be created.", slink, node);
  80         } else if (errno != ENOENT)
  81                 return log_device_debug_errno(dev, errno, "Failed to lstat() '%s': %m", slink);
  82
  83         r = path_extract_directory(slink, &slink_dirname);
  84         if (r < 0)
  85                 return log_device_debug_errno(dev, r, "Failed to get parent directory of '%s': %m", slink);
  86
  87         /* use relative link */
  88         r = path_make_relative(slink_dirname, node, &target);
  89         if (r < 0)
  90                 return log_device_debug_errno(dev, r, "Failed to get relative path from '%s' to '%s': %m", slink, node);
  91
  92         r = device_get_device_id(dev, &id);
  93         if (r < 0)
  94                 return log_device_debug_errno(dev, r, "Failed to get device id: %m");
  95
  96         slink_tmp = strjoina(slink, ".tmp-", id);
  97         (void) unlink(slink_tmp);
  98
  99         r = create_symlink(target, slink_tmp);
 100         if (r < 0)
 101                 return log_device_debug_errno(dev, r, "Failed to create symlink '%s' to '%s': %m", slink_tmp, target);
 102
 103         if (rename(slink_tmp, slink) < 0) {
 104                 r = log_device_debug_errno(dev, errno, "Failed to rename '%s' to '%s': %m", slink_tmp, slink);
 105                 (void) unlink(slink_tmp);
 106                 return r;
 107         }
 108
 109         return 0;
 110 }
 111
 112 static int link_find_prioritized(sd_device *dev, bool add, const char *stackdir, char **ret) {
 113         _cleanup_closedir_ DIR *dir = NULL;
 114         _cleanup_free_ char *target = NULL;
 115         int r, priority = 0;
 116         const char *id;
 117
 118         assert(dev);
 119         assert(stackdir);
 120         assert(ret);
 121
 122         /* Find device node of device with highest priority. This returns 1 if a device found, 0 if no
 123          * device found, or a negative errno. */
 124
 125         if (add) {
 126                 const char *devnode;
 127
 128                 r = device_get_devlink_priority(dev, &priority);
 129                 if (r < 0)
 130                         return r;
 131
 132                 r = sd_device_get_devname(dev, &devnode);
 133                 if (r < 0)
 134                         return r;
 135
 136                 target = strdup(devnode);
 137                 if (!target)
 138                         return -ENOMEM;
 139         }
 140
 141         dir = opendir(stackdir);
 142         if (!dir)
 143                 return -errno;
 144
 145         r = device_get_device_id(dev, &id);
 146         if (r < 0)
 147                 return r;
 148
 149         FOREACH_DIRENT_ALL(de, dir, break) {
 150                 _cleanup_free_ char *path = NULL, *buf = NULL;
 151                 int tmp_prio;
 152
 153                 if (de->d_name[0] == '.')
 154                         continue;
 155
 156                 /* skip ourself */
 157                 if (streq(de->d_name, id))
 158                         continue;
 159
 160                 path = path_join(stackdir, de->d_name);
 161                 if (!path)
 162                         return -ENOMEM;
 163
 164                 if (readlink_malloc(path, &buf) >= 0) {
 165                         char *devnode;
 166
 167                         /* New format. The devnode and priority can be obtained from symlink. */
 168
 169                         devnode = strchr(buf, ':');
 170                         if (!devnode || devnode == buf)
 171                                 continue;
 172
 173                         *(devnode++) = '\0';
 174                         if (!path_startswith(devnode, "/dev"))
 175                                 continue;
 176
 177                         if (safe_atoi(buf, &tmp_prio) < 0)
 178                                 continue;
 179
 180                         if (target && tmp_prio <= priority)
 181                                 continue;
 182
 183                         r = free_and_strdup(&target, devnode);
 184                         if (r < 0)
 185                                 return r;
 186                 } else {
 187                         _cleanup_(sd_device_unrefp) sd_device *tmp_dev = NULL;
 188                         const char *devnode;
 189
 190                         /* Old format. The devnode and priority must be obtained from uevent and
 191                          * udev database files. */
 192
 193                         if (sd_device_new_from_device_id(&tmp_dev, de->d_name) < 0)
 194                                 continue;
 195
 196                         if (device_get_devlink_priority(tmp_dev, &tmp_prio) < 0)
 197                                 continue;
 198
 199                         if (target && tmp_prio <= priority)
 200                                 continue;
 201
 202                         if (sd_device_get_devname(tmp_dev, &devnode) < 0)
 203                                 continue;
 204
 205                         r = free_and_strdup(&target, devnode);
 206                         if (r < 0)
 207                                 return r;
 208                 }
 209
 210                 priority = tmp_prio;
 211         }
 212
 213         *ret = TAKE_PTR(target);
 214         return !!*ret;
 215 }
 216
 217 static int update_timestamp(sd_device *dev, int fd, struct stat *prev) {
 218         assert(fd >= 0);
 219         assert(prev);
 220
 221         /* Even if a symlink in the stack directory is created/removed, the mtime of the directory may
 222          * not be changed. Why? Let's consider the following situation. For simplicity, let's assume
 223          * there exist two udev workers (A and B) and all of them calls link_update() for the same
 224          * devlink simultaneously.
 225          *
 226          * 1. A creates/removes a symlink in the stack directory.
 227          * 2. A calls the first stat() in the loop of link_update().
 228          * 3. A calls link_find_prioritized().
 229          * 4. B creates/removes another symlink in the stack directory, so the result of the step 3 is outdated.
 230          * 5. B finishes link_update().
 231          * 6. A creates/removes devlink according to the outdated result in the step 3.
 232          * 7. A calls the second stat() in the loop of link_update().
 233          *
 234          * If these 7 steps are processed in this order within a short time period that kernel's timer
 235          * does not increase, then even if the contents in the stack directory is changed, the results
 236          * of two stat() called by A shows the same timestamp, and A cannot detect the change.
 237          *
 238          * By calling this function after creating/removing symlinks in the stack directory, the
 239          * timestamp of the stack directory is always increased at least in the above step 5, so A can
 240          * detect the update. */
 241
 242         for (unsigned i = 0; i < UPDATE_TIMESTAMP_MAX_RETRIES; i++) {
 243                 struct stat st;
 244
 245                 if (fstat(fd, &st) < 0)
 246                         return -errno;
 247
 248                 if (!stat_inode_unmodified(prev, &st))
 249                         return 0;
 250
 251                 log_device_debug(dev,
 252                                  "Stack directory is modified, but its timestamp is not changed, "
 253                                  "updating timestamp after 10ms.");
 254
 255                 (void) usleep(10 * USEC_PER_MSEC);
 256                 if (futimens(fd, NULL) < 0)
 257                         return -errno;
 258         }
 259
 260         return -ELOOP;
 261 }
 262
 263 static int stack_directory_update(sd_device *dev, int fd, bool add) {
 264         struct stat st;
 265         const char *id;
 266         int r;
 267
 268         assert(dev);
 269         assert(fd >= 0);
 270
 271         r = device_get_device_id(dev, &id);
 272         if (r < 0)
 273                 return r;
 274
 275         if (fstat(fd, &st) < 0)
 276                 return -errno;
 277
 278         if (add) {
 279                 _cleanup_free_ char *data = NULL, *buf = NULL;
 280                 const char *devname;
 281                 int priority;
 282
 283                 r = sd_device_get_devname(dev, &devname);
 284                 if (r < 0)
 285                         return r;
 286
 287                 r = device_get_devlink_priority(dev, &priority);
 288                 if (r < 0)
 289                         return r;
 290
 291                 if (asprintf(&data, "%i:%s", priority, devname) < 0)
 292                         return -ENOMEM;
 293
 294                 if (readlinkat_malloc(fd, id, &buf) >= 0 && streq(buf, data))
 295                         return 0; /* Unchanged. */
 296
 297                 (void) unlinkat(fd, id, 0);
 298
 299                 if (symlinkat(data, fd, id) < 0)
 300                         return -errno;
 301
 302         } else {
 303                 if (unlinkat(fd, id, 0) < 0) {
 304                         if (errno == ENOENT)
 305                                 return 0; /* Unchanged. */
 306                         return -errno;
 307                 }
 308         }
 309
 310         r = update_timestamp(dev, fd, &st);
 311         if (r < 0)
 312                 return r;
 313
 314         return 0;
 315 }
 316
 317 static int stack_directory_open(const char *dirname) {
 318         _cleanup_close_ int fd = -1;
 319         int r;
 320
 321         assert(dirname);
 322
 323         r = mkdir_parents(dirname, 0755);
 324         if (r < 0)
 325                 return r;
 326
 327         fd = open_mkdir_at(AT_FDCWD, dirname, O_CLOEXEC | O_DIRECTORY | O_NOFOLLOW | O_RDONLY, 0755);
 328         if (fd < 0)
 329                 return fd;
 330
 331         return TAKE_FD(fd);
 332 }
 333
 334 size_t udev_node_escape_path(const char *src, char *dest, size_t size) {
 335         size_t i, j;
 336         uint64_t h;
 337
 338         assert(src);
 339         assert(dest);
 340         assert(size >= 12);
 341
 342         for (i = 0, j = 0; src[i] != '\0'; i++) {
 343                 if (src[i] == '/') {
 344                         if (j+4 >= size - 12 + 1)
 345                                 goto toolong;
 346                         memcpy(&dest[j], "\\x2f", 4);
 347                         j += 4;
 348                 } else if (src[i] == '\\') {
 349                         if (j+4 >= size - 12 + 1)
 350                                 goto toolong;
 351                         memcpy(&dest[j], "\\x5c", 4);
 352                         j += 4;
 353                 } else {
 354                         if (j+1 >= size - 12 + 1)
 355                                 goto toolong;
 356                         dest[j] = src[i];
 357                         j++;
 358                 }
 359         }
 360         dest[j] = '\0';
 361         return j;
 362
 363 toolong:
 364         /* If the input path is too long to encode as a filename, then let's suffix with a string
 365          * generated from the hash of the path. */
 366
 367         h = siphash24_string(src, UDEV_NODE_HASH_KEY.bytes);
 368
 369         for (unsigned k = 0; k <= 10; k++)
 370                 dest[size - k - 2] = urlsafe_base64char((h >> (k * 6)) & 63);
 371
 372         dest[size - 1] = '\0';
 373         return size - 1;
 374 }
 375
 376 static int stack_directory_get_name(const char *slink, char **ret) {
 377         _cleanup_free_ char *s = NULL, *dirname = NULL;
 378         char name_enc[NAME_MAX+1];
 379         const char *name;
 380
 381         assert(slink);
 382         assert(ret);
 383
 384         s = strdup(slink);
 385         if (!s)
 386                 return -ENOMEM;
 387
 388         path_simplify(s);
 389
 390         if (!path_is_normalized(s))
 391                 return -EINVAL;
 392
 393         name = path_startswith(s, "/dev");
 394         if (empty_or_root(name))
 395                 return -EINVAL;
 396
 397         udev_node_escape_path(name, name_enc, sizeof(name_enc));
 398
 399         dirname = path_join("/run/udev/links", name_enc);
 400         if (!dirname)
 401                 return -ENOMEM;
 402
 403         *ret = TAKE_PTR(dirname);
 404         return 0;
 405 }
 406
 407 static int link_update(sd_device *dev, const char *slink, bool add) {
 408         _cleanup_free_ char *dirname = NULL;
 409         _cleanup_close_ int dirfd = -1;
 410         int r;
 411
 412         assert(dev);
 413         assert(slink);
 414
 415         r = stack_directory_get_name(slink, &dirname);
 416         if (r < 0)
 417                 return log_device_debug_errno(dev, r, "Failed to build stack directory name for '%s': %m", slink);
 418
 419         dirfd = stack_directory_open(dirname);
 420         if (dirfd < 0)
 421                 return log_device_debug_errno(dev, dirfd, "Failed to open stack directory '%s': %m", dirname);
 422
 423         r = stack_directory_update(dev, dirfd, add);
 424         if (r < 0)
 425                 return log_device_debug_errno(dev, r, "Failed to update stack directory '%s': %m", dirname);
 426
 427         for (unsigned i = 0; i < LINK_UPDATE_MAX_RETRIES; i++) {
 428                 _cleanup_free_ char *target = NULL;
 429                 struct stat st1 = {}, st2 = {};
 430
 431                 if (i > 0) {
 432                         usec_t delay = MIN_RANDOM_DELAY + random_u64_range(MAX_RANDOM_DELAY - MIN_RANDOM_DELAY);
 433
 434                         log_device_debug(dev, "Directory %s was updated, retrying to update devlink %s after %s.",
 435                                          dirname, slink, FORMAT_TIMESPAN(delay, USEC_PER_MSEC));
 436                         (void) usleep(delay);
 437                 }
 438
 439                 if (stat(dirname, &st1) < 0 && errno != ENOENT)
 440                         return log_device_debug_errno(dev, errno, "Failed to stat %s: %m", dirname);
 441
 442                 r = link_find_prioritized(dev, add, dirname, &target);
 443                 if (r < 0)
 444                         return log_device_debug_errno(dev, r, "Failed to determine device node with the highest priority for '%s': %m", slink);
 445                 if (r == 0) {
 446                         log_device_debug(dev, "No reference left for '%s', removing", slink);
 447
 448                         if (unlink(slink) < 0 && errno != ENOENT)
 449                                 log_device_debug_errno(dev, errno, "Failed to remove '%s', ignoring: %m", slink);
 450
 451                         (void) rmdir_parents(slink, "/dev");
 452                         return 0;
 453                 }
 454
 455                 r = node_symlink(dev, target, slink);
 456                 if (r < 0)
 457                         return r;
 458
 459                 if (stat(dirname, &st2) < 0 && errno != ENOENT)
 460                         return log_device_debug_errno(dev, errno, "Failed to stat %s: %m", dirname);
 461
 462                 if (((st1.st_mode & S_IFMT) == 0 && (st2.st_mode & S_IFMT) == 0) ||
 463                     stat_inode_unmodified(&st1, &st2))
 464                         return 0;
 465         }
 466
 467         return -ELOOP;
 468 }
 469
 470 static int device_get_devpath_by_devnum(sd_device *dev, char **ret) {
 471         const char *subsystem;
 472         dev_t devnum;
 473         int r;
 474
 475         assert(dev);
 476         assert(ret);
 477
 478         r = sd_device_get_subsystem(dev, &subsystem);
 479         if (r < 0)
 480                 return r;
 481
 482         r = sd_device_get_devnum(dev, &devnum);
 483         if (r < 0)
 484                 return r;
 485
 486         return device_path_make_major_minor(streq(subsystem, "block") ? S_IFBLK : S_IFCHR, devnum, ret);
 487 }
 488
 489 int udev_node_update(sd_device *dev, sd_device *dev_old) {
 490         _cleanup_free_ char *filename = NULL;
 491         const char *devnode, *devlink;
 492         int r;
 493
 494         assert(dev);
 495         assert(dev_old);
 496
 497         r = sd_device_get_devname(dev, &devnode);
 498         if (r < 0)
 499                 return log_device_debug_errno(dev, r, "Failed to get devnode: %m");
 500
 501         if (DEBUG_LOGGING) {
 502                 const char *id = NULL;
 503
 504                 (void) device_get_device_id(dev, &id);
 505                 log_device_debug(dev, "Handling device node '%s', devnum=%s", devnode, strna(id));
 506         }
 507
 508         /* update possible left-over symlinks */
 509         FOREACH_DEVICE_DEVLINK(dev_old, devlink) {
 510                 /* check if old link name still belongs to this device */
 511                 if (device_has_devlink(dev, devlink))
 512                         continue;
 513
 514                 log_device_debug(dev,
 515                                  "Removing/updating old device symlink '%s', which is no longer belonging to this device.",
 516                                  devlink);
 517
 518                 r = link_update(dev, devlink, /* add = */ false);
 519                 if (r < 0)
 520                         log_device_warning_errno(dev, r,
 521                                                  "Failed to remove/update device symlink '%s', ignoring: %m",
 522                                                  devlink);
 523         }
 524
 525         /* create/update symlinks, add symlinks to name index */
 526         FOREACH_DEVICE_DEVLINK(dev, devlink) {
 527                 r = link_update(dev, devlink, /* add = */ true);
 528                 if (r < 0)
 529                         log_device_warning_errno(dev, r,
 530                                                  "Failed to create/update device symlink '%s', ignoring: %m",
 531                                                  devlink);
 532         }
 533
 534         r = device_get_devpath_by_devnum(dev, &filename);
 535         if (r < 0)
 536                 return log_device_debug_errno(dev, r, "Failed to get device path: %m");
 537
 538         /* always add /dev/{block,char}/$major:$minor */
 539         r = node_symlink(dev, devnode, filename);
 540         if (r < 0)
 541                 return log_device_warning_errno(dev, r, "Failed to create device symlink '%s': %m", filename);
 542
 543         return 0;
 544 }
 545
 546 int udev_node_remove(sd_device *dev) {
 547         _cleanup_free_ char *filename = NULL;
 548         const char *devlink;
 549         int r;
 550
 551         assert(dev);
 552
 553         /* remove/update symlinks, remove symlinks from name index */
 554         FOREACH_DEVICE_DEVLINK(dev, devlink) {
 555                 r = link_update(dev, devlink, /* add = */ false);
 556                 if (r < 0)
 557                         log_device_warning_errno(dev, r,
 558                                                  "Failed to remove/update device symlink '%s', ignoring: %m",
 559                                                  devlink);
 560         }
 561
 562         r = device_get_devpath_by_devnum(dev, &filename);
 563         if (r < 0)
 564                 return log_device_debug_errno(dev, r, "Failed to get device path: %m");
 565
 566         /* remove /dev/{block,char}/$major:$minor */
 567         if (unlink(filename) < 0 && errno != ENOENT)
 568                 return log_device_debug_errno(dev, errno, "Failed to remove '%s': %m", filename);
 569
 570         return 0;
 571 }
 572
 573 static int udev_node_apply_permissions_impl(
 574                 sd_device *dev, /* can be NULL, only used for logging. */
 575                 int node_fd,
 576                 const char *devnode,
 577                 bool apply_mac,
 578                 mode_t mode,
 579                 uid_t uid,
 580                 gid_t gid,
 581                 OrderedHashmap *seclabel_list) {
 582
 583         bool apply_mode, apply_uid, apply_gid;
 584         struct stat stats;
 585         int r;
 586
 587         assert(node_fd >= 0);
 588         assert(devnode);
 589
 590         if (fstat(node_fd, &stats) < 0)
 591                 return log_device_debug_errno(dev, errno, "cannot stat() node %s: %m", devnode);
 592
 593         /* If group is set, but mode is not set, "upgrade" mode for the group. */
 594         if (mode == MODE_INVALID && gid_is_valid(gid) && gid > 0)
 595                 mode = 0660;
 596
 597         apply_mode = mode != MODE_INVALID && (stats.st_mode & 0777) != (mode & 0777);
 598         apply_uid = uid_is_valid(uid) && stats.st_uid != uid;
 599         apply_gid = gid_is_valid(gid) && stats.st_gid != gid;
 600
 601         if (apply_mode || apply_uid || apply_gid || apply_mac) {
 602                 bool selinux = false, smack = false;
 603                 const char *name, *label;
 604
 605                 if (apply_mode || apply_uid || apply_gid) {
 606                         log_device_debug(dev, "Setting permissions %s, uid=" UID_FMT ", gid=" GID_FMT ", mode=%#o",
 607                                          devnode,
 608                                          uid_is_valid(uid) ? uid : stats.st_uid,
 609                                          gid_is_valid(gid) ? gid : stats.st_gid,
 610                                          mode != MODE_INVALID ? mode & 0777 : stats.st_mode & 0777);
 611
 612                         r = fchmod_and_chown(node_fd, mode, uid, gid);
 613                         if (r < 0)
 614                                 log_device_full_errno(dev, r == -ENOENT ? LOG_DEBUG : LOG_ERR, r,
 615                                                       "Failed to set owner/mode of %s to uid=" UID_FMT
 616                                                       ", gid=" GID_FMT ", mode=%#o: %m",
 617                                                       devnode,
 618                                                       uid_is_valid(uid) ? uid : stats.st_uid,
 619                                                       gid_is_valid(gid) ? gid : stats.st_gid,
 620                                                       mode != MODE_INVALID ? mode & 0777 : stats.st_mode & 0777);
 621                 } else
 622                         log_device_debug(dev, "Preserve permissions of %s, uid=" UID_FMT ", gid=" GID_FMT ", mode=%#o",
 623                                          devnode,
 624                                          uid_is_valid(uid) ? uid : stats.st_uid,
 625                                          gid_is_valid(gid) ? gid : stats.st_gid,
 626                                          mode != MODE_INVALID ? mode & 0777 : stats.st_mode & 0777);
 627
 628                 /* apply SECLABEL{$module}=$label */
 629                 ORDERED_HASHMAP_FOREACH_KEY(label, name, seclabel_list) {
 630                         int q;
 631
 632                         if (streq(name, "selinux")) {
 633                                 selinux = true;
 634
 635                                 q = mac_selinux_apply_fd(node_fd, devnode, label);
 636                                 if (q < 0)
 637                                         log_device_full_errno(dev, q == -ENOENT ? LOG_DEBUG : LOG_ERR, q,
 638                                                               "SECLABEL: failed to set SELinux label '%s': %m", label);
 639                                 else
 640                                         log_device_debug(dev, "SECLABEL: set SELinux label '%s'", label);
 641
 642                         } else if (streq(name, "smack")) {
 643                                 smack = true;
 644
 645                                 q = mac_smack_apply_fd(node_fd, SMACK_ATTR_ACCESS, label);
 646                                 if (q < 0)
 647                                         log_device_full_errno(dev, q == -ENOENT ? LOG_DEBUG : LOG_ERR, q,
 648                                                               "SECLABEL: failed to set SMACK label '%s': %m", label);
 649                                 else
 650                                         log_device_debug(dev, "SECLABEL: set SMACK label '%s'", label);
 651
 652                         } else
 653                                 log_device_error(dev, "SECLABEL: unknown subsystem, ignoring '%s'='%s'", name, label);
 654                 }
 655
 656                 /* set the defaults */
 657                 if (!selinux)
 658                         (void) mac_selinux_fix_full(node_fd, NULL, devnode, LABEL_IGNORE_ENOENT);
 659                 if (!smack)
 660                         (void) mac_smack_apply_fd(node_fd, SMACK_ATTR_ACCESS, NULL);
 661         }
 662
 663         /* always update timestamp when we re-use the node, like on media change events */
 664         r = futimens_opath(node_fd, NULL);
 665         if (r < 0)
 666                 log_device_debug_errno(dev, r, "Failed to adjust timestamp of node %s: %m", devnode);
 667
 668         return 0;
 669 }
 670
 671 int udev_node_apply_permissions(
 672                 sd_device *dev,
 673                 bool apply_mac,
 674                 mode_t mode,
 675                 uid_t uid,
 676                 gid_t gid,
 677                 OrderedHashmap *seclabel_list) {
 678
 679         const char *devnode;
 680         _cleanup_close_ int node_fd = -1;
 681         int r;
 682
 683         assert(dev);
 684
 685         r = sd_device_get_devname(dev, &devnode);
 686         if (r < 0)
 687                 return log_device_debug_errno(dev, r, "Failed to get devname: %m");
 688
 689         node_fd = sd_device_open(dev, O_PATH|O_CLOEXEC);
 690         if (node_fd < 0) {
 691                 if (ERRNO_IS_DEVICE_ABSENT(node_fd)) {
 692                         log_device_debug_errno(dev, node_fd, "Device node %s is missing, skipping handling.", devnode);
 693                         return 0; /* This is necessarily racey, so ignore missing the device */
 694                 }
 695
 696                 return log_device_debug_errno(dev, node_fd, "Cannot open node %s: %m", devnode);
 697         }
 698
 699         return udev_node_apply_permissions_impl(dev, node_fd, devnode, apply_mac, mode, uid, gid, seclabel_list);
 700 }
 701
 702 int static_node_apply_permissions(
 703                 const char *name,
 704                 mode_t mode,
 705                 uid_t uid,
 706                 gid_t gid,
 707                 char **tags) {
 708
 709         _cleanup_free_ char *unescaped_filename = NULL;
 710         _cleanup_close_ int node_fd = -1;
 711         const char *devnode;
 712         struct stat stats;
 713         int r;
 714
 715         assert(name);
 716
 717         if (uid == UID_INVALID && gid == GID_INVALID && mode == MODE_INVALID && !tags)
 718                 return 0;
 719
 720         devnode = strjoina("/dev/", name);
 721
 722         node_fd = open(devnode, O_PATH|O_CLOEXEC);
 723         if (node_fd < 0) {
 724                 if (errno != ENOENT)
 725                         return log_error_errno(errno, "Failed to open %s: %m", devnode);
 726                 return 0;
 727         }
 728
 729         if (fstat(node_fd, &stats) < 0)
 730                 return log_error_errno(errno, "Failed to stat %s: %m", devnode);
 731
 732         if (!S_ISBLK(stats.st_mode) && !S_ISCHR(stats.st_mode)) {
 733                 log_warning("%s is neither block nor character device, ignoring.", devnode);
 734                 return 0;
 735         }
 736
 737         if (!strv_isempty(tags)) {
 738                 unescaped_filename = xescape(name, "/.");
 739                 if (!unescaped_filename)
 740                         return log_oom();
 741         }
 742
 743         /* export the tags to a directory as symlinks, allowing otherwise dead nodes to be tagged */
 744         STRV_FOREACH(t, tags) {
 745                 _cleanup_free_ char *p = NULL;
 746
 747                 p = path_join("/run/udev/static_node-tags/", *t, unescaped_filename);
 748                 if (!p)
 749                         return log_oom();
 750
 751                 r = mkdir_parents(p, 0755);
 752                 if (r < 0)
 753                         return log_error_errno(r, "Failed to create parent directory for %s: %m", p);
 754
 755                 r = symlink(devnode, p);
 756                 if (r < 0 && errno != EEXIST)
 757                         return log_error_errno(errno, "Failed to create symlink %s -> %s: %m", p, devnode);
 758         }
 759
 760         return udev_node_apply_permissions_impl(NULL, node_fd, devnode, false, mode, uid, gid, NULL);
 761 }