src/basic/fs-util.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2 /***
   3   This file is part of systemd.
   4
   5   Copyright 2010 Lennart Poettering
   6
   7   systemd is free software; you can redistribute it and/or modify it
   8   under the terms of the GNU Lesser General Public License as published by
   9   the Free Software Foundation; either version 2.1 of the License, or
  10   (at your option) any later version.
  11
  12   systemd is distributed in the hope that it will be useful, but
  13   WITHOUT ANY WARRANTY; without even the implied warranty of
  14   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
  15   Lesser General Public License for more details.
  16
  17   You should have received a copy of the GNU Lesser General Public License
  18   along with systemd; If not, see <http://www.gnu.org/licenses/>.
  19 ***/
  20
  21 #include <errno.h>
  22 #include <stddef.h>
  23 #include <stdio.h>
  24 #include <stdlib.h>
  25 #include <string.h>
  26 #include <sys/stat.h>
  27 #include <linux/magic.h>
  28 #include <time.h>
  29 #include <unistd.h>
  30
  31 #include "alloc-util.h"
  32 #include "dirent-util.h"
  33 #include "fd-util.h"
  34 #include "fileio.h"
  35 #include "fs-util.h"
  36 #include "log.h"
  37 #include "macro.h"
  38 #include "missing.h"
  39 #include "mkdir.h"
  40 #include "parse-util.h"
  41 #include "path-util.h"
  42 #include "process-util.h"
  43 #include "stat-util.h"
  44 #include "stdio-util.h"
  45 #include "string-util.h"
  46 #include "strv.h"
  47 #include "time-util.h"
  48 #include "user-util.h"
  49 #include "util.h"
  50
  51 int unlink_noerrno(const char *path) {
  52         PROTECT_ERRNO;
  53         int r;
  54
  55         r = unlink(path);
  56         if (r < 0)
  57                 return -errno;
  58
  59         return 0;
  60 }
  61
  62 int rmdir_parents(const char *path, const char *stop) {
  63         size_t l;
  64         int r = 0;
  65
  66         assert(path);
  67         assert(stop);
  68
  69         l = strlen(path);
  70
  71         /* Skip trailing slashes */
  72         while (l > 0 && path[l-1] == '/')
  73                 l--;
  74
  75         while (l > 0) {
  76                 char *t;
  77
  78                 /* Skip last component */
  79                 while (l > 0 && path[l-1] != '/')
  80                         l--;
  81
  82                 /* Skip trailing slashes */
  83                 while (l > 0 && path[l-1] == '/')
  84                         l--;
  85
  86                 if (l <= 0)
  87                         break;
  88
  89                 t = strndup(path, l);
  90                 if (!t)
  91                         return -ENOMEM;
  92
  93                 if (path_startswith(stop, t)) {
  94                         free(t);
  95                         return 0;
  96                 }
  97
  98                 r = rmdir(t);
  99                 free(t);
 100
 101                 if (r < 0)
 102                         if (errno != ENOENT)
 103                                 return -errno;
 104         }
 105
 106         return 0;
 107 }
 108
 109 int rename_noreplace(int olddirfd, const char *oldpath, int newdirfd, const char *newpath) {
 110         struct stat buf;
 111         int ret;
 112
 113         ret = renameat2(olddirfd, oldpath, newdirfd, newpath, RENAME_NOREPLACE);
 114         if (ret >= 0)
 115                 return 0;
 116
 117         /* renameat2() exists since Linux 3.15, btrfs added support for it later.
 118          * If it is not implemented, fallback to another method. */
 119         if (!IN_SET(errno, EINVAL, ENOSYS))
 120                 return -errno;
 121
 122         /* The link()/unlink() fallback does not work on directories. But
 123          * renameat() without RENAME_NOREPLACE gives the same semantics on
 124          * directories, except when newpath is an *empty* directory. This is
 125          * good enough. */
 126         ret = fstatat(olddirfd, oldpath, &buf, AT_SYMLINK_NOFOLLOW);
 127         if (ret >= 0 && S_ISDIR(buf.st_mode)) {
 128                 ret = renameat(olddirfd, oldpath, newdirfd, newpath);
 129                 return ret >= 0 ? 0 : -errno;
 130         }
 131
 132         /* If it is not a directory, use the link()/unlink() fallback. */
 133         ret = linkat(olddirfd, oldpath, newdirfd, newpath, 0);
 134         if (ret < 0)
 135                 return -errno;
 136
 137         ret = unlinkat(olddirfd, oldpath, 0);
 138         if (ret < 0) {
 139                 /* backup errno before the following unlinkat() alters it */
 140                 ret = errno;
 141                 (void) unlinkat(newdirfd, newpath, 0);
 142                 errno = ret;
 143                 return -errno;
 144         }
 145
 146         return 0;
 147 }
 148
 149 int readlinkat_malloc(int fd, const char *p, char **ret) {
 150         size_t l = 100;
 151         int r;
 152
 153         assert(p);
 154         assert(ret);
 155
 156         for (;;) {
 157                 char *c;
 158                 ssize_t n;
 159
 160                 c = new(char, l);
 161                 if (!c)
 162                         return -ENOMEM;
 163
 164                 n = readlinkat(fd, p, c, l-1);
 165                 if (n < 0) {
 166                         r = -errno;
 167                         free(c);
 168                         return r;
 169                 }
 170
 171                 if ((size_t) n < l-1) {
 172                         c[n] = 0;
 173                         *ret = c;
 174                         return 0;
 175                 }
 176
 177                 free(c);
 178                 l *= 2;
 179         }
 180 }
 181
 182 int readlink_malloc(const char *p, char **ret) {
 183         return readlinkat_malloc(AT_FDCWD, p, ret);
 184 }
 185
 186 int readlink_value(const char *p, char **ret) {
 187         _cleanup_free_ char *link = NULL;
 188         char *value;
 189         int r;
 190
 191         r = readlink_malloc(p, &link);
 192         if (r < 0)
 193                 return r;
 194
 195         value = basename(link);
 196         if (!value)
 197                 return -ENOENT;
 198
 199         value = strdup(value);
 200         if (!value)
 201                 return -ENOMEM;
 202
 203         *ret = value;
 204
 205         return 0;
 206 }
 207
 208 int readlink_and_make_absolute(const char *p, char **r) {
 209         _cleanup_free_ char *target = NULL;
 210         char *k;
 211         int j;
 212
 213         assert(p);
 214         assert(r);
 215
 216         j = readlink_malloc(p, &target);
 217         if (j < 0)
 218                 return j;
 219
 220         k = file_in_same_dir(p, target);
 221         if (!k)
 222                 return -ENOMEM;
 223
 224         *r = k;
 225         return 0;
 226 }
 227
 228 int readlink_and_canonicalize(const char *p, const char *root, char **ret) {
 229         char *t, *s;
 230         int r;
 231
 232         assert(p);
 233         assert(ret);
 234
 235         r = readlink_and_make_absolute(p, &t);
 236         if (r < 0)
 237                 return r;
 238
 239         r = chase_symlinks(t, root, 0, &s);
 240         if (r < 0)
 241                 /* If we can't follow up, then let's return the original string, slightly cleaned up. */
 242                 *ret = path_kill_slashes(t);
 243         else {
 244                 *ret = s;
 245                 free(t);
 246         }
 247
 248         return 0;
 249 }
 250
 251 int readlink_and_make_absolute_root(const char *root, const char *path, char **ret) {
 252         _cleanup_free_ char *target = NULL, *t = NULL;
 253         const char *full;
 254         int r;
 255
 256         full = prefix_roota(root, path);
 257         r = readlink_malloc(full, &target);
 258         if (r < 0)
 259                 return r;
 260
 261         t = file_in_same_dir(path, target);
 262         if (!t)
 263                 return -ENOMEM;
 264
 265         *ret = t;
 266         t = NULL;
 267
 268         return 0;
 269 }
 270
 271 int chmod_and_chown(const char *path, mode_t mode, uid_t uid, gid_t gid) {
 272         assert(path);
 273
 274         /* Under the assumption that we are running privileged we
 275          * first change the access mode and only then hand out
 276          * ownership to avoid a window where access is too open. */
 277
 278         if (mode != MODE_INVALID)
 279                 if (chmod(path, mode) < 0)
 280                         return -errno;
 281
 282         if (uid != UID_INVALID || gid != GID_INVALID)
 283                 if (chown(path, uid, gid) < 0)
 284                         return -errno;
 285
 286         return 0;
 287 }
 288
 289 int fchmod_umask(int fd, mode_t m) {
 290         mode_t u;
 291         int r;
 292
 293         u = umask(0777);
 294         r = fchmod(fd, m & (~u)) < 0 ? -errno : 0;
 295         umask(u);
 296
 297         return r;
 298 }
 299
 300 int fd_warn_permissions(const char *path, int fd) {
 301         struct stat st;
 302
 303         if (fstat(fd, &st) < 0)
 304                 return -errno;
 305
 306         if (st.st_mode & 0111)
 307                 log_warning("Configuration file %s is marked executable. Please remove executable permission bits. Proceeding anyway.", path);
 308
 309         if (st.st_mode & 0002)
 310                 log_warning("Configuration file %s is marked world-writable. Please remove world writability permission bits. Proceeding anyway.", path);
 311
 312         if (getpid_cached() == 1 && (st.st_mode & 0044) != 0044)
 313                 log_warning("Configuration file %s is marked world-inaccessible. This has no effect as configuration data is accessible via APIs without restrictions. Proceeding anyway.", path);
 314
 315         return 0;
 316 }
 317
 318 int touch_file(const char *path, bool parents, usec_t stamp, uid_t uid, gid_t gid, mode_t mode) {
 319         char fdpath[STRLEN("/proc/self/fd/") + DECIMAL_STR_MAX(int)];
 320         _cleanup_close_ int fd = -1;
 321         int r, ret = 0;
 322
 323         assert(path);
 324
 325         /* Note that touch_file() does not follow symlinks: if invoked on an existing symlink, then it is the symlink
 326          * itself which is updated, not its target
 327          *
 328          * Returns the first error we encounter, but tries to apply as much as possible. */
 329
 330         if (parents)
 331                 (void) mkdir_parents(path, 0755);
 332
 333         /* Initially, we try to open the node with O_PATH, so that we get a reference to the node. This is useful in
 334          * case the path refers to an existing device or socket node, as we can open it successfully in all cases, and
 335          * won't trigger any driver magic or so. */
 336         fd = open(path, O_PATH|O_CLOEXEC|O_NOFOLLOW);
 337         if (fd < 0) {
 338                 if (errno != ENOENT)
 339                         return -errno;
 340
 341                 /* if the node doesn't exist yet, we create it, but with O_EXCL, so that we only create a regular file
 342                  * here, and nothing else */
 343                 fd = open(path, O_WRONLY|O_CREAT|O_EXCL|O_CLOEXEC, IN_SET(mode, 0, MODE_INVALID) ? 0644 : mode);
 344                 if (fd < 0)
 345                         return -errno;
 346         }
 347
 348         /* Let's make a path from the fd, and operate on that. With this logic, we can adjust the access mode,
 349          * ownership and time of the file node in all cases, even if the fd refers to an O_PATH object — which is
 350          * something fchown(), fchmod(), futimensat() don't allow. */
 351         xsprintf(fdpath, "/proc/self/fd/%i", fd);
 352
 353         if (mode != MODE_INVALID)
 354                 if (chmod(fdpath, mode) < 0)
 355                         ret = -errno;
 356
 357         if (uid_is_valid(uid) || gid_is_valid(gid))
 358                 if (chown(fdpath, uid, gid) < 0 && ret >= 0)
 359                         ret = -errno;
 360
 361         if (stamp != USEC_INFINITY) {
 362                 struct timespec ts[2];
 363
 364                 timespec_store(&ts[0], stamp);
 365                 ts[1] = ts[0];
 366                 r = utimensat(AT_FDCWD, fdpath, ts, 0);
 367         } else
 368                 r = utimensat(AT_FDCWD, fdpath, NULL, 0);
 369         if (r < 0 && ret >= 0)
 370                 return -errno;
 371
 372         return ret;
 373 }
 374
 375 int touch(const char *path) {
 376         return touch_file(path, false, USEC_INFINITY, UID_INVALID, GID_INVALID, MODE_INVALID);
 377 }
 378
 379 int symlink_idempotent(const char *from, const char *to) {
 380         int r;
 381
 382         assert(from);
 383         assert(to);
 384
 385         if (symlink(from, to) < 0) {
 386                 _cleanup_free_ char *p = NULL;
 387
 388                 if (errno != EEXIST)
 389                         return -errno;
 390
 391                 r = readlink_malloc(to, &p);
 392                 if (r == -EINVAL) /* Not a symlink? In that case return the original error we encountered: -EEXIST */
 393                         return -EEXIST;
 394                 if (r < 0) /* Any other error? In that case propagate it as is */
 395                         return r;
 396
 397                 if (!streq(p, from)) /* Not the symlink we want it to be? In that case, propagate the original -EEXIST */
 398                         return -EEXIST;
 399         }
 400
 401         return 0;
 402 }
 403
 404 int symlink_atomic(const char *from, const char *to) {
 405         _cleanup_free_ char *t = NULL;
 406         int r;
 407
 408         assert(from);
 409         assert(to);
 410
 411         r = tempfn_random(to, NULL, &t);
 412         if (r < 0)
 413                 return r;
 414
 415         if (symlink(from, t) < 0)
 416                 return -errno;
 417
 418         if (rename(t, to) < 0) {
 419                 unlink_noerrno(t);
 420                 return -errno;
 421         }
 422
 423         return 0;
 424 }
 425
 426 int mknod_atomic(const char *path, mode_t mode, dev_t dev) {
 427         _cleanup_free_ char *t = NULL;
 428         int r;
 429
 430         assert(path);
 431
 432         r = tempfn_random(path, NULL, &t);
 433         if (r < 0)
 434                 return r;
 435
 436         if (mknod(t, mode, dev) < 0)
 437                 return -errno;
 438
 439         if (rename(t, path) < 0) {
 440                 unlink_noerrno(t);
 441                 return -errno;
 442         }
 443
 444         return 0;
 445 }
 446
 447 int mkfifo_atomic(const char *path, mode_t mode) {
 448         _cleanup_free_ char *t = NULL;
 449         int r;
 450
 451         assert(path);
 452
 453         r = tempfn_random(path, NULL, &t);
 454         if (r < 0)
 455                 return r;
 456
 457         if (mkfifo(t, mode) < 0)
 458                 return -errno;
 459
 460         if (rename(t, path) < 0) {
 461                 unlink_noerrno(t);
 462                 return -errno;
 463         }
 464
 465         return 0;
 466 }
 467
 468 int get_files_in_directory(const char *path, char ***list) {
 469         _cleanup_closedir_ DIR *d = NULL;
 470         struct dirent *de;
 471         size_t bufsize = 0, n = 0;
 472         _cleanup_strv_free_ char **l = NULL;
 473
 474         assert(path);
 475
 476         /* Returns all files in a directory in *list, and the number
 477          * of files as return value. If list is NULL returns only the
 478          * number. */
 479
 480         d = opendir(path);
 481         if (!d)
 482                 return -errno;
 483
 484         FOREACH_DIRENT_ALL(de, d, return -errno) {
 485                 dirent_ensure_type(d, de);
 486
 487                 if (!dirent_is_file(de))
 488                         continue;
 489
 490                 if (list) {
 491                         /* one extra slot is needed for the terminating NULL */
 492                         if (!GREEDY_REALLOC(l, bufsize, n + 2))
 493                                 return -ENOMEM;
 494
 495                         l[n] = strdup(de->d_name);
 496                         if (!l[n])
 497                                 return -ENOMEM;
 498
 499                         l[++n] = NULL;
 500                 } else
 501                         n++;
 502         }
 503
 504         if (list) {
 505                 *list = l;
 506                 l = NULL; /* avoid freeing */
 507         }
 508
 509         return n;
 510 }
 511
 512 static int getenv_tmp_dir(const char **ret_path) {
 513         const char *n;
 514         int r, ret = 0;
 515
 516         assert(ret_path);
 517
 518         /* We use the same order of environment variables python uses in tempfile.gettempdir():
 519          * https://docs.python.org/3/library/tempfile.html#tempfile.gettempdir */
 520         FOREACH_STRING(n, "TMPDIR", "TEMP", "TMP") {
 521                 const char *e;
 522
 523                 e = secure_getenv(n);
 524                 if (!e)
 525                         continue;
 526                 if (!path_is_absolute(e)) {
 527                         r = -ENOTDIR;
 528                         goto next;
 529                 }
 530                 if (!path_is_normalized(e)) {
 531                         r = -EPERM;
 532                         goto next;
 533                 }
 534
 535                 r = is_dir(e, true);
 536                 if (r < 0)
 537                         goto next;
 538                 if (r == 0) {
 539                         r = -ENOTDIR;
 540                         goto next;
 541                 }
 542
 543                 *ret_path = e;
 544                 return 1;
 545
 546         next:
 547                 /* Remember first error, to make this more debuggable */
 548                 if (ret >= 0)
 549                         ret = r;
 550         }
 551
 552         if (ret < 0)
 553                 return ret;
 554
 555         *ret_path = NULL;
 556         return ret;
 557 }
 558
 559 static int tmp_dir_internal(const char *def, const char **ret) {
 560         const char *e;
 561         int r, k;
 562
 563         assert(def);
 564         assert(ret);
 565
 566         r = getenv_tmp_dir(&e);
 567         if (r > 0) {
 568                 *ret = e;
 569                 return 0;
 570         }
 571
 572         k = is_dir(def, true);
 573         if (k == 0)
 574                 k = -ENOTDIR;
 575         if (k < 0)
 576                 return r < 0 ? r : k;
 577
 578         *ret = def;
 579         return 0;
 580 }
 581
 582 int var_tmp_dir(const char **ret) {
 583
 584         /* Returns the location for "larger" temporary files, that is backed by physical storage if available, and thus
 585          * even might survive a boot: /var/tmp. If $TMPDIR (or related environment variables) are set, its value is
 586          * returned preferably however. Note that both this function and tmp_dir() below are affected by $TMPDIR,
 587          * making it a variable that overrides all temporary file storage locations. */
 588
 589         return tmp_dir_internal("/var/tmp", ret);
 590 }
 591
 592 int tmp_dir(const char **ret) {
 593
 594         /* Similar to var_tmp_dir() above, but returns the location for "smaller" temporary files, which is usually
 595          * backed by an in-memory file system: /tmp. */
 596
 597         return tmp_dir_internal("/tmp", ret);
 598 }
 599
 600 int inotify_add_watch_fd(int fd, int what, uint32_t mask) {
 601         char path[STRLEN("/proc/self/fd/") + DECIMAL_STR_MAX(int) + 1];
 602         int r;
 603
 604         /* This is like inotify_add_watch(), except that the file to watch is not referenced by a path, but by an fd */
 605         xsprintf(path, "/proc/self/fd/%i", what);
 606
 607         r = inotify_add_watch(fd, path, mask);
 608         if (r < 0)
 609                 return -errno;
 610
 611         return r;
 612 }
 613
 614 static bool safe_transition(const struct stat *a, const struct stat *b) {
 615         /* Returns true if the transition from a to b is safe, i.e. that we never transition from unprivileged to
 616          * privileged files or directories. Why bother? So that unprivileged code can't symlink to privileged files
 617          * making us believe we read something safe even though it isn't safe in the specific context we open it in. */
 618
 619         if (a->st_uid == 0) /* Transitioning from privileged to unprivileged is always fine */
 620                 return true;
 621
 622         return a->st_uid == b->st_uid; /* Otherwise we need to stay within the same UID */
 623 }
 624
 625 int chase_symlinks(const char *path, const char *original_root, unsigned flags, char **ret) {
 626         _cleanup_free_ char *buffer = NULL, *done = NULL, *root = NULL;
 627         _cleanup_close_ int fd = -1;
 628         unsigned max_follow = 32; /* how many symlinks to follow before giving up and returning ELOOP */
 629         struct stat previous_stat;
 630         bool exists = true;
 631         char *todo;
 632         int r;
 633
 634         assert(path);
 635
 636         /* Either the file may be missing, or we return an fd to the final object, but both make no sense */
 637         if ((flags & (CHASE_NONEXISTENT|CHASE_OPEN)) == (CHASE_NONEXISTENT|CHASE_OPEN))
 638                 return -EINVAL;
 639
 640         if (isempty(path))
 641                 return -EINVAL;
 642
 643         /* This is a lot like canonicalize_file_name(), but takes an additional "root" parameter, that allows following
 644          * symlinks relative to a root directory, instead of the root of the host.
 645          *
 646          * Note that "root" primarily matters if we encounter an absolute symlink. It is also used when following
 647          * relative symlinks to ensure they cannot be used to "escape" the root directory. The path parameter passed is
 648          * assumed to be already prefixed by it, except if the CHASE_PREFIX_ROOT flag is set, in which case it is first
 649          * prefixed accordingly.
 650          *
 651          * Algorithmically this operates on two path buffers: "done" are the components of the path we already
 652          * processed and resolved symlinks, "." and ".." of. "todo" are the components of the path we still need to
 653          * process. On each iteration, we move one component from "todo" to "done", processing it's special meaning
 654          * each time. The "todo" path always starts with at least one slash, the "done" path always ends in no
 655          * slash. We always keep an O_PATH fd to the component we are currently processing, thus keeping lookup races
 656          * at a minimum.
 657          *
 658          * Suggested usage: whenever you want to canonicalize a path, use this function. Pass the absolute path you got
 659          * as-is: fully qualified and relative to your host's root. Optionally, specify the root parameter to tell this
 660          * function what to do when encountering a symlink with an absolute path as directory: prefix it by the
 661          * specified path. */
 662
 663         /* A root directory of "/" or "" is identical to none */
 664         if (isempty(original_root) || path_equal(original_root, "/"))
 665                 original_root = NULL;
 666
 667         if (original_root) {
 668                 r = path_make_absolute_cwd(original_root, &root);
 669                 if (r < 0)
 670                         return r;
 671
 672                 if (flags & CHASE_PREFIX_ROOT) {
 673
 674                         /* We don't support relative paths in combination with a root directory */
 675                         if (!path_is_absolute(path))
 676                                 return -EINVAL;
 677
 678                         path = prefix_roota(root, path);
 679                 }
 680         }
 681
 682         r = path_make_absolute_cwd(path, &buffer);
 683         if (r < 0)
 684                 return r;
 685
 686         fd = open("/", O_CLOEXEC|O_NOFOLLOW|O_PATH);
 687         if (fd < 0)
 688                 return -errno;
 689
 690         if (flags & CHASE_SAFE) {
 691                 if (fstat(fd, &previous_stat) < 0)
 692                         return -errno;
 693         }
 694
 695         todo = buffer;
 696         for (;;) {
 697                 _cleanup_free_ char *first = NULL;
 698                 _cleanup_close_ int child = -1;
 699                 struct stat st;
 700                 size_t n, m;
 701
 702                 /* Determine length of first component in the path */
 703                 n = strspn(todo, "/");                  /* The slashes */
 704                 m = n + strcspn(todo + n, "/");         /* The entire length of the component */
 705
 706                 /* Extract the first component. */
 707                 first = strndup(todo, m);
 708                 if (!first)
 709                         return -ENOMEM;
 710
 711                 todo += m;
 712
 713                 /* Empty? Then we reached the end. */
 714                 if (isempty(first))
 715                         break;
 716
 717                 /* Just a single slash? Then we reached the end. */
 718                 if (path_equal(first, "/")) {
 719                         /* Preserve the trailing slash */
 720                         if (!strextend(&done, "/", NULL))
 721                                 return -ENOMEM;
 722
 723                         break;
 724                 }
 725
 726                 /* Just a dot? Then let's eat this up. */
 727                 if (path_equal(first, "/."))
 728                         continue;
 729
 730                 /* Two dots? Then chop off the last bit of what we already found out. */
 731                 if (path_equal(first, "/..")) {
 732                         _cleanup_free_ char *parent = NULL;
 733                         _cleanup_close_ int fd_parent = -1;
 734
 735                         /* If we already are at the top, then going up will not change anything. This is in-line with
 736                          * how the kernel handles this. */
 737                         if (isempty(done) || path_equal(done, "/"))
 738                                 continue;
 739
 740                         parent = dirname_malloc(done);
 741                         if (!parent)
 742                                 return -ENOMEM;
 743
 744                         /* Don't allow this to leave the root dir.  */
 745                         if (root &&
 746                             path_startswith(done, root) &&
 747                             !path_startswith(parent, root))
 748                                 continue;
 749
 750                         free_and_replace(done, parent);
 751
 752                         fd_parent = openat(fd, "..", O_CLOEXEC|O_NOFOLLOW|O_PATH);
 753                         if (fd_parent < 0)
 754                                 return -errno;
 755
 756                         if (flags & CHASE_SAFE) {
 757                                 if (fstat(fd_parent, &st) < 0)
 758                                         return -errno;
 759
 760                                 if (!safe_transition(&previous_stat, &st))
 761                                         return -EPERM;
 762
 763                                 previous_stat = st;
 764                         }
 765
 766                         safe_close(fd);
 767                         fd = fd_parent;
 768                         fd_parent = -1;
 769
 770                         continue;
 771                 }
 772
 773                 /* Otherwise let's see what this is. */
 774                 child = openat(fd, first + n, O_CLOEXEC|O_NOFOLLOW|O_PATH);
 775                 if (child < 0) {
 776
 777                         if (errno == ENOENT &&
 778                             (flags & CHASE_NONEXISTENT) &&
 779                             (isempty(todo) || path_is_normalized(todo))) {
 780
 781                                 /* If CHASE_NONEXISTENT is set, and the path does not exist, then that's OK, return
 782                                  * what we got so far. But don't allow this if the remaining path contains "../ or "./"
 783                                  * or something else weird. */
 784
 785                                 /* If done is "/", as first also contains slash at the head, then remove this redundant slash. */
 786                                 if (streq_ptr(done, "/"))
 787                                         *done = '\0';
 788
 789                                 if (!strextend(&done, first, todo, NULL))
 790                                         return -ENOMEM;
 791
 792                                 exists = false;
 793                                 break;
 794                         }
 795
 796                         return -errno;
 797                 }
 798
 799                 if (fstat(child, &st) < 0)
 800                         return -errno;
 801                 if ((flags & CHASE_SAFE) &&
 802                     !safe_transition(&previous_stat, &st))
 803                         return -EPERM;
 804
 805                 previous_stat = st;
 806
 807                 if ((flags & CHASE_NO_AUTOFS) &&
 808                     fd_is_fs_type(child, AUTOFS_SUPER_MAGIC) > 0)
 809                         return -EREMOTE;
 810
 811                 if (S_ISLNK(st.st_mode)) {
 812                         char *joined;
 813
 814                         _cleanup_free_ char *destination = NULL;
 815
 816                         /* This is a symlink, in this case read the destination. But let's make sure we don't follow
 817                          * symlinks without bounds. */
 818                         if (--max_follow <= 0)
 819                                 return -ELOOP;
 820
 821                         r = readlinkat_malloc(fd, first + n, &destination);
 822                         if (r < 0)
 823                                 return r;
 824                         if (isempty(destination))
 825                                 return -EINVAL;
 826
 827                         if (path_is_absolute(destination)) {
 828
 829                                 /* An absolute destination. Start the loop from the beginning, but use the root
 830                                  * directory as base. */
 831
 832                                 safe_close(fd);
 833                                 fd = open(root ?: "/", O_CLOEXEC|O_NOFOLLOW|O_PATH);
 834                                 if (fd < 0)
 835                                         return -errno;
 836
 837                                 if (flags & CHASE_SAFE) {
 838                                         if (fstat(fd, &st) < 0)
 839                                                 return -errno;
 840
 841                                         if (!safe_transition(&previous_stat, &st))
 842                                                 return -EPERM;
 843
 844                                         previous_stat = st;
 845                                 }
 846
 847                                 free(done);
 848
 849                                 /* Note that we do not revalidate the root, we take it as is. */
 850                                 if (isempty(root))
 851                                         done = NULL;
 852                                 else {
 853                                         done = strdup(root);
 854                                         if (!done)
 855                                                 return -ENOMEM;
 856                                 }
 857
 858                                 /* Prefix what's left to do with what we just read, and start the loop again, but
 859                                  * remain in the current directory. */
 860                                 joined = strjoin(destination, todo);
 861                         } else
 862                                 joined = strjoin("/", destination, todo);
 863                         if (!joined)
 864                                 return -ENOMEM;
 865
 866                         free(buffer);
 867                         todo = buffer = joined;
 868
 869                         continue;
 870                 }
 871
 872                 /* If this is not a symlink, then let's just add the name we read to what we already verified. */
 873                 if (!done) {
 874                         done = first;
 875                         first = NULL;
 876                 } else {
 877                         /* If done is "/", as first also contains slash at the head, then remove this redundant slash. */
 878                         if (streq(done, "/"))
 879                                 *done = '\0';
 880
 881                         if (!strextend(&done, first, NULL))
 882                                 return -ENOMEM;
 883                 }
 884
 885                 /* And iterate again, but go one directory further down. */
 886                 safe_close(fd);
 887                 fd = child;
 888                 child = -1;
 889         }
 890
 891         if (!done) {
 892                 /* Special case, turn the empty string into "/", to indicate the root directory. */
 893                 done = strdup("/");
 894                 if (!done)
 895                         return -ENOMEM;
 896         }
 897
 898         if (ret) {
 899                 *ret = done;
 900                 done = NULL;
 901         }
 902
 903         if (flags & CHASE_OPEN) {
 904                 int q;
 905
 906                 /* Return the O_PATH fd we currently are looking to the caller. It can translate it to a proper fd by
 907                  * opening /proc/self/fd/xyz. */
 908
 909                 assert(fd >= 0);
 910                 q = fd;
 911                 fd = -1;
 912
 913                 return q;
 914         }
 915
 916         return exists;
 917 }
 918
 919 int access_fd(int fd, int mode) {
 920         char p[STRLEN("/proc/self/fd/") + DECIMAL_STR_MAX(fd) + 1];
 921         int r;
 922
 923         /* Like access() but operates on an already open fd */
 924
 925         xsprintf(p, "/proc/self/fd/%i", fd);
 926
 927         r = access(p, mode);
 928         if (r < 0)
 929                 r = -errno;
 930
 931         return r;
 932 }