From: drh Date: Fri, 22 Nov 2019 00:42:01 +0000 (+0000) Subject: Revise the SQLITE_OPEN_NOFOLLOW so that it actually uses O_NOFOLLOW in the X-Git-Tag: version-3.31.0~292 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c398c65bee850b6b8f24a44852872a27f114535d;p=thirdparty%2Fsqlite.git Revise the SQLITE_OPEN_NOFOLLOW so that it actually uses O_NOFOLLOW in the open() system call. This backs out the SQLITE_ACCESS_SYMLINK value but adds the new SQLITE_OK_SYMLINK return code from the xFullPathname method of sqlite3_vfs when that routine resolves symbolic links. O_NOFOLLOW is always included in open() system calls for journal files. FossilOrigin-Name: 6a64fb6a2da6c98f1e87b55ad5689967e1db4eae2e08345471d95e28cd567e0f --- diff --git a/manifest b/manifest index 3ead66b532..f1676b3eda 100644 --- a/manifest +++ b/manifest @@ -1,5 +1,5 @@ -C Add\sall\sfuzz-test\scases\sreceived\sfrom\sYongheng\sChen\sand\sRui\sZhong.\s\sAlso\nfix\sa\sminor\sproblem\sin\sgencol1.test\scases. -D 2019-11-21T20:24:04.565 +C Revise\sthe\sSQLITE_OPEN_NOFOLLOW\sso\sthat\sit\sactually\suses\sO_NOFOLLOW\sin\sthe\nopen()\ssystem\scall.\s\sThis\sbacks\sout\sthe\sSQLITE_ACCESS_SYMLINK\svalue\sbut\sadds\nthe\snew\sSQLITE_OK_SYMLINK\sreturn\scode\sfrom\sthe\sxFullPathname\smethod\sof\s\nsqlite3_vfs\swhen\sthat\sroutine\sresolves\ssymbolic\slinks.\sO_NOFOLLOW\sis\salways\nincluded\sin\sopen()\ssystem\scalls\sfor\sjournal\sfiles. +D 2019-11-22T00:42:01.486 F .fossil-settings/empty-dirs dbb81e8fc0401ac46a1491ab34a7f2c7c0452f2f06b54ebb845d024ca8283ef1 F .fossil-settings/ignore-glob 35175cdfcf539b2318cb04a9901442804be81cd677d8b889fcc9149c21f239ea F LICENSE.md df5091916dbb40e6e9686186587125e1b2ff51f022cc334e886c19a0e9982724 @@ -467,7 +467,7 @@ F src/auth.c a3d5bfdba83d25abed1013a8c7a5f204e2e29b0c25242a56bc02bb0c07bf1e06 F src/backup.c f70077d40c08b7787bfe934e4d1da8030cb0cc57d46b345fba2294b7d1be23ab F src/bitvec.c 17ea48eff8ba979f1f5b04cc484c7bb2be632f33 F src/btmutex.c 8acc2f464ee76324bf13310df5692a262b801808984c1b79defb2503bbafadb6 -F src/btree.c b43507671f291ed874e469517b3b333d2743c190def89cae4e1dccd6d5473a9d +F src/btree.c d22498af716953400e314d2d98d1dac3ea5c3b01e0fd243ef9e9b132c74114ec F src/btree.h f27a33c49280209a93385e218306c4ee5f46ba8d7649d2f81a7166b282232484 F src/btreeInt.h 91806f01fd1145a9a86ba3042f25c38d8faf6002701bf5e780742cf88bcff437 F src/build.c fe0b0b6dfab27a6f5778bd3dba8db879fda114c1d524a9597e5195ac55c8d01b @@ -506,14 +506,14 @@ F src/mutex_noop.c 9d4309c075ba9cc7249e19412d3d62f7f94839c4 F src/mutex_unix.c aaf9ebc3f89df28483c52208497a99a02cc3650011422fc9d4c57e4392f7fe58 F src/mutex_w32.c 7670d770c94bbfe8289bec9d7f1394c5a00a57c37f892aab6b6612d085255235 F src/notify.c 9711a7575036f0d3040ba61bc6e217f13a9888e7 -F src/os.c 20f7b32c1e8839999fa7e79756a6cdc3041b44d7fc635c25a1b9399180d1fbd9 +F src/os.c 669cc3839cc35d20f81faf0be1ab6d4581cea35e9d8f3a9d48a98d6571f7c285 F src/os.h 48388821692e87da174ea198bf96b1b2d9d83be5dfc908f673ee21fafbe0d432 F src/os_common.h b2f4707a603e36811d9b1a13278bffd757857b85 F src/os_setup.h 0dbaea40a7d36bf311613d31342e0b99e2536586 -F src/os_unix.c ca1cc9524cb3ae8d59529fb37944487bec89df2041da7c3890f96dae389c5719 -F src/os_win.c 87a38901f217d2ea467fbb67b8501727f81592603de0624b86fa1f3221bf40cf +F src/os_unix.c 3e0e519f27683083a465e948e056759a8340728c222b5c394a135e0c57c220bc +F src/os_win.c 035a813cbd17f355bdcad7ab894af214a9c13a1db8aeac902365350b98cd45a7 F src/os_win.h 7b073010f1451abe501be30d12f6bc599824944a -F src/pager.c 49630bdba882b82537fc9fd93b126f566949ef913df99f4c303e5e371d2fb331 +F src/pager.c 30f20d2263d3717f41a0d9a40f7a3d0f48ce1cfab461b875c6187ead9d6ad1c7 F src/pager.h 217921e81eb5fe455caa5cda96061959706bcdd29ddb57166198645ef7822ac3 F src/parse.y 17c1ae265e1b92cb1f3f1661b020e3eb31f2d8b9588322d2b6f2b22f25b674c9 F src/pcache.c 385ff064bca69789d199a98e2169445dc16e4291fa807babd61d4890c3b34177 @@ -528,7 +528,7 @@ F src/resolve.c 023397b50d09a3587a15169b713342e2d595ab29e14e54fd8f4a86b76c461d21 F src/rowset.c d977b011993aaea002cab3e0bb2ce50cf346000dff94e944d547b989f4b1fe93 F src/select.c 50ccaf5fc3566b897fd3090b63bd60605f2f3f38ac5709fda6c482510d71aa6c F src/shell.c.in 4a3a9e1c11847b1904f2b01d087af1c052f660902755abab457cab1756817ded -F src/sqlite.h.in 556c9ea9b168a65db70f9b32ce6f530442f717e8033cf56f4699961de9165ed3 +F src/sqlite.h.in 4fe42f27a7be44586bbd94f49f2b097ef8a1053c747d82f135456c7f5381c85a F src/sqlite3.rc 5121c9e10c3964d5755191c80dd1180c122fc3a8 F src/sqlite3ext.h 72af51aa4e912e14cd495fb6e7fac65f0940db80ed950d90911aff292cc47ce2 F src/sqliteInt.h 98bc9562acfc361e34182aa25b00e2c73095732ddd3ba4158f984b94f5601f96 @@ -553,7 +553,7 @@ F src/test_blob.c ae4a0620b478548afb67963095a7417cd06a4ec0a56adb453542203bfdcb31 F src/test_btree.c 8b2dc8b8848cf3a4db93f11578f075e82252a274 F src/test_config.c e25826d693039cdd45963de378cbf39e3af0e8aa7a8a6fc159876f4e7b5a4f8c F src/test_delete.c e2fe07646dff6300b48d49b2fee2fe192ed389e834dd635e3b3bac0ce0bf9f8f -F src/test_demovfs.c da5ab4828c4cb07179fea5997895471a4c963069f02dbeda1b92562275462d58 +F src/test_demovfs.c 86142ba864d4297d54c5b2e972e74f3141ae4b30f05b3a95824184ed2d3d7f91 F src/test_devsym.c 6109b45c3db3ef7b002320947ed448c027356ab8b885156ff535fd8684d4a571 F src/test_fs.c ba1e1dc18fd3159fdba0b9c4256f14032159785320dfbd6776eb9973cb75d480 F src/test_func.c 181f992e5495644434c4f0e3cc72362a78c295eb2cf3ff4d02498b8bde7aa276 @@ -583,7 +583,7 @@ F src/test_tclsh.c eeafce33ad2136d57e5dec10f1e9a4347447eb72ffd504a1c7b9c6bfe2e71 F src/test_tclvar.c 33ff42149494a39c5fbb0df3d25d6fafb2f668888e41c0688d07273dcb268dfc F src/test_thread.c 911d15fb14e19c0c542bdc8aabf981c2f10a4858 F src/test_vdbecov.c f60c6f135ec42c0de013a1d5136777aa328a776d33277f92abac648930453d43 -F src/test_vfs.c a10a2a7c50c196153bf77c55163aa822a6c3a56411246534399cada48c355b77 +F src/test_vfs.c 36822d696789535bdd0260f07d2c9a46546082fea8bb1d0a7354c7f9366e37ea F src/test_vfstrace.c bab9594adc976cbe696ff3970728830b4c5ed698 F src/test_windirent.c a895e2c068a06644eef91a7f0a32182445a893b9a0f33d0cdb4283dca2486ac1 F src/test_windirent.h 90dfbe95442c9762357fe128dc7ae3dc199d006de93eb33ba3972e0a90484215 @@ -1850,7 +1850,7 @@ F vsixtest/vsixtest.tcl 6a9a6ab600c25a91a7acc6293828957a386a8a93 F vsixtest/vsixtest.vcxproj.data 2ed517e100c66dc455b492e1a33350c1b20fbcdc F vsixtest/vsixtest.vcxproj.filters 37e51ffedcdb064aad6ff33b6148725226cd608e F vsixtest/vsixtest_TemporaryKey.pfx e5b1b036facdb453873e7084e1cae9102ccc67a0 -P a0ab42f779b9a96f4e43879210dfaba8fa593de77fc0ec0e2e6f116d9301ea59 -R f1060b511b7e55c545d9108dd53386f7 +P ac080432b480062507452d3cdbe6c0f759e6f95b65d9862e0462017405ab2b8e +R b32992f83d3fe313532417046634561a U drh -Z 63a3ed9bacf7a8b3d10bd1629e578cad +Z 3c868f0a98a5c208f527ca2b91cdb564 diff --git a/manifest.uuid b/manifest.uuid index e2de7994c5..85931cbb52 100644 --- a/manifest.uuid +++ b/manifest.uuid @@ -1 +1 @@ -ac080432b480062507452d3cdbe6c0f759e6f95b65d9862e0462017405ab2b8e \ No newline at end of file +6a64fb6a2da6c98f1e87b55ad5689967e1db4eae2e08345471d95e28cd567e0f \ No newline at end of file diff --git a/src/btree.c b/src/btree.c index 57634f69bb..d0eed5dd43 100644 --- a/src/btree.c +++ b/src/btree.c @@ -2403,9 +2403,13 @@ int sqlite3BtreeOpen( rc = sqlite3OsFullPathname(pVfs, zFilename, nFullPathname, zFullPathname); if( rc ){ - sqlite3_free(zFullPathname); - sqlite3_free(p); - return rc; + if( rc==SQLITE_OK_SYMLINK ){ + rc = SQLITE_OK; + }else{ + sqlite3_free(zFullPathname); + sqlite3_free(p); + return rc; + } } } #if SQLITE_THREADSAFE diff --git a/src/os.c b/src/os.c index b9ad29d4f8..b729e95e65 100644 --- a/src/os.c +++ b/src/os.c @@ -215,7 +215,7 @@ int sqlite3OsOpen( ** down into the VFS layer. Some SQLITE_OPEN_ flags (for example, ** SQLITE_OPEN_FULLMUTEX or SQLITE_OPEN_SHAREDCACHE) are blocked before ** reaching the VFS. */ - rc = pVfs->xOpen(pVfs, zPath, pFile, flags & 0x87f7f, pFlagsOut); + rc = pVfs->xOpen(pVfs, zPath, pFile, flags & 0x1087f7f, pFlagsOut); assert( rc==SQLITE_OK || pFile->pMethods==0 ); return rc; } diff --git a/src/os_unix.c b/src/os_unix.c index 7217a5d5f9..18f2afcb66 100644 --- a/src/os_unix.c +++ b/src/os_unix.c @@ -3685,7 +3685,7 @@ static int openDirectory(const char *zFilename, int *pFd){ if( zDirname[0]!='/' ) zDirname[0] = '.'; zDirname[1] = 0; } - fd = robust_open(zDirname, O_RDONLY|O_BINARY, 0); + fd = robust_open(zDirname, O_RDONLY|O_BINARY|O_NOFOLLOW, 0); if( fd>=0 ){ OSTRACE(("OPENDIR %-3d %s\n", fd, zDirname)); } @@ -4576,10 +4576,12 @@ static int unixOpenSharedMemory(unixFile *pDbFd){ if( pInode->bProcessLock==0 ){ if( 0==sqlite3_uri_boolean(pDbFd->zPath, "readonly_shm", 0) ){ - pShmNode->hShm = robust_open(zShm, O_RDWR|O_CREAT,(sStat.st_mode&0777)); + pShmNode->hShm = robust_open(zShm, O_RDWR|O_CREAT|O_NOFOLLOW, + (sStat.st_mode&0777)); } if( pShmNode->hShm<0 ){ - pShmNode->hShm = robust_open(zShm, O_RDONLY, (sStat.st_mode&0777)); + pShmNode->hShm = robust_open(zShm, O_RDONLY|O_NOFOLLOW, + (sStat.st_mode&0777)); if( pShmNode->hShm<0 ){ rc = unixLogError(SQLITE_CANTOPEN_BKPT, "open", zShm); goto shm_open_err; @@ -5929,7 +5931,7 @@ static int unixOpen( unixFile *p = (unixFile *)pFile; int fd = -1; /* File descriptor returned by open() */ int openFlags = 0; /* Flags to pass to open() */ - int eType = flags&0xFFFFFF00; /* Type of file to open */ + int eType = flags&0x0FFF00; /* Type of file to open */ int noLock; /* True to omit locking primitives */ int rc = SQLITE_OK; /* Function Return Code */ int ctrlFlags = 0; /* UNIXFILE_* flags */ @@ -6039,7 +6041,7 @@ static int unixOpen( if( isReadWrite ) openFlags |= O_RDWR; if( isCreate ) openFlags |= O_CREAT; if( isExclusive ) openFlags |= (O_EXCL|O_NOFOLLOW); - openFlags |= (O_LARGEFILE|O_BINARY); + openFlags |= (O_LARGEFILE|O_BINARY|O_NOFOLLOW); if( fd<0 ){ mode_t openMode; /* Permissions to create file with */ @@ -6251,25 +6253,15 @@ static int unixAccess( SimulateIOError( return SQLITE_IOERR_ACCESS; ); assert( pResOut!=0 ); - /* The spec says there are four possible values for flags. But the - ** SQLITE_ACCESS_READ flag is never used */ - assert( flags==SQLITE_ACCESS_EXISTS - || flags==SQLITE_ACCESS_READWRITE - || flags==SQLITE_ACCESS_SYMLINK ); + /* The spec says there are three possible values for flags. But only + ** two of them are actually used */ + assert( flags==SQLITE_ACCESS_EXISTS || flags==SQLITE_ACCESS_READWRITE ); if( flags==SQLITE_ACCESS_EXISTS ){ struct stat buf; *pResOut = (0==osStat(zPath, &buf) && buf.st_size>0); - }else if( flags==SQLITE_ACCESS_READWRITE ){ - *pResOut = osAccess(zPath, W_OK|R_OK)==0; }else{ -#if !defined(HAVE_LSTAT) - *pResOut = 0; -#else - struct stat buf; - *pResOut = (0==osLstat(zPath, &buf) && S_ISLNK(buf.st_mode)); -#endif - assert( flags==SQLITE_ACCESS_SYMLINK ); + *pResOut = osAccess(zPath, W_OK|R_OK)==0; } return SQLITE_OK; } @@ -6321,7 +6313,7 @@ static int unixFullPathname( #else int rc = SQLITE_OK; int nByte; - int nLink = 1; /* Number of symbolic links followed so far */ + int nLink = 0; /* Number of symbolic links followed so far */ const char *zIn = zPath; /* Input path for each iteration of loop */ char *zDel = 0; @@ -6350,10 +6342,11 @@ static int unixFullPathname( } if( bLink ){ + nLink++; if( zDel==0 ){ zDel = sqlite3_malloc(nOut); if( zDel==0 ) rc = SQLITE_NOMEM_BKPT; - }else if( ++nLink>SQLITE_MAX_SYMLINKS ){ + }else if( nLink>=SQLITE_MAX_SYMLINKS ){ rc = SQLITE_CANTOPEN_BKPT; } @@ -6389,6 +6382,7 @@ static int unixFullPathname( }while( rc==SQLITE_OK ); sqlite3_free(zDel); + if( rc==SQLITE_OK && nLink ) rc = SQLITE_OK_SYMLINK; return rc; #endif /* HAVE_READLINK && HAVE_LSTAT */ } @@ -6874,7 +6868,7 @@ static int proxyCreateUnixFile( int fd = -1; unixFile *pNew; int rc = SQLITE_OK; - int openFlags = O_RDWR | O_CREAT; + int openFlags = O_RDWR | O_CREAT | O_NOFOLLOW; sqlite3_vfs dummyVfs; int terrno = 0; UnixUnusedFd *pUnused = NULL; @@ -6904,7 +6898,7 @@ static int proxyCreateUnixFile( } } if( fd<0 ){ - openFlags = O_RDONLY; + openFlags = O_RDONLY | O_NOFOLLOW; fd = robust_open(path, openFlags, 0); terrno = errno; } @@ -7030,7 +7024,7 @@ static int proxyBreakConchLock(unixFile *pFile, uuid_t myHostID){ goto end_breaklock; } /* write it out to the temporary break file */ - fd = robust_open(tPath, (O_RDWR|O_CREAT|O_EXCL), 0); + fd = robust_open(tPath, (O_RDWR|O_CREAT|O_EXCL|O_NOFOLLOW), 0); if( fd<0 ){ sqlite3_snprintf(sizeof(errmsg), errmsg, "create failed (%d)", errno); goto end_breaklock; diff --git a/src/os_win.c b/src/os_win.c index 698d6556c6..32758ab760 100644 --- a/src/os_win.c +++ b/src/os_win.c @@ -80,14 +80,6 @@ # define NTDDI_WINTHRESHOLD 0x06040000 #endif -/* -** This constant is needed by the winAccess function; therefore, define -** it when it is missing from the SDK header files. -*/ -#ifndef FILE_ATTRIBUTE_REPARSE_POINT -# define FILE_ATTRIBUTE_REPARSE_POINT 0x00000400 -#endif - /* ** Check to see if the GetVersionEx[AW] functions are deprecated on the ** target system. GetVersionEx was first deprecated in Win8.1. @@ -5480,10 +5472,6 @@ static int winAccess( rc = attr!=INVALID_FILE_ATTRIBUTES && (attr & FILE_ATTRIBUTE_READONLY)==0; break; - case SQLITE_ACCESS_SYMLINK: - rc = attr!=INVALID_FILE_ATTRIBUTES && - (attr & FILE_ATTRIBUTE_REPARSE_POINT)!=0; - break; default: assert(!"Invalid flags argument"); } diff --git a/src/pager.c b/src/pager.c index 67e757640f..9d4922c4a3 100644 --- a/src/pager.c +++ b/src/pager.c @@ -4790,12 +4790,6 @@ int sqlite3PagerOpen( */ if( zFilename && zFilename[0] ){ const char *z; - if( (vfsFlags & SQLITE_OPEN_NOFOLLOW)!=0 ){ - int isLink = 0; - int rc = sqlite3OsAccess(pVfs, zFilename, SQLITE_ACCESS_SYMLINK, &isLink); - if( rc==SQLITE_OK && isLink ) rc = SQLITE_CANTOPEN_SYMLINK; - if( rc ) return rc; - } nPathname = pVfs->mxPathname+1; zPathname = sqlite3DbMallocRaw(0, nPathname*2); if( zPathname==0 ){ @@ -4803,6 +4797,15 @@ int sqlite3PagerOpen( } zPathname[0] = 0; /* Make sure initialized even if FullPathname() fails */ rc = sqlite3OsFullPathname(pVfs, zFilename, nPathname, zPathname); + if( rc!=SQLITE_OK ){ + if( rc==SQLITE_OK_SYMLINK ){ + if( vfsFlags & SQLITE_OPEN_NOFOLLOW ){ + rc = SQLITE_CANTOPEN_SYMLINK; + }else{ + rc = SQLITE_OK; + } + } + } nPathname = sqlite3Strlen30(zPathname); z = zUri = &zFilename[sqlite3Strlen30(zFilename)+1]; while( *z ){ diff --git a/src/sqlite.h.in b/src/sqlite.h.in index 8373f5c7f8..53fb22651c 100644 --- a/src/sqlite.h.in +++ b/src/sqlite.h.in @@ -541,6 +541,7 @@ int sqlite3_exec( #define SQLITE_WARNING_AUTOINDEX (SQLITE_WARNING | (1<<8)) #define SQLITE_AUTH_USER (SQLITE_AUTH | (1<<8)) #define SQLITE_OK_LOAD_PERMANENTLY (SQLITE_OK | (1<<8)) +#define SQLITE_OK_SYMLINK (SQLITE_OK | (2<<8)) /* ** CAPI3REF: Flags For File Open Operations @@ -1408,7 +1409,6 @@ struct sqlite3_vfs { #define SQLITE_ACCESS_EXISTS 0 #define SQLITE_ACCESS_READWRITE 1 /* Used by PRAGMA temp_store_directory */ #define SQLITE_ACCESS_READ 2 /* Unused */ -#define SQLITE_ACCESS_SYMLINK 3 /* Test if file is symbolic link */ /* ** CAPI3REF: Flags for the xShmLock VFS method diff --git a/src/test_demovfs.c b/src/test_demovfs.c index baf14b10b0..eaba208732 100644 --- a/src/test_demovfs.c +++ b/src/test_demovfs.c @@ -508,14 +508,8 @@ static int demoAccess( assert( flags==SQLITE_ACCESS_EXISTS /* access(zPath, F_OK) */ || flags==SQLITE_ACCESS_READ /* access(zPath, R_OK) */ || flags==SQLITE_ACCESS_READWRITE /* access(zPath, R_OK|W_OK) */ - || flags==SQLITE_ACCESS_SYMLINK /* Always false */ ); - if( flags==SQLITE_ACCESS_SYMLINK ){ - /* For this demo implementation, assume that symlinks do not exist. */ - *pResOut = 0; - return SQLITE_OK; - } if( flags==SQLITE_ACCESS_READWRITE ) eAccess = R_OK|W_OK; if( flags==SQLITE_ACCESS_READ ) eAccess = R_OK; diff --git a/src/test_vfs.c b/src/test_vfs.c index f1ed8d051f..9d753896e9 100644 --- a/src/test_vfs.c +++ b/src/test_vfs.c @@ -732,7 +732,6 @@ static int tvfsAccess( if( flags==SQLITE_ACCESS_EXISTS ) zArg = "SQLITE_ACCESS_EXISTS"; if( flags==SQLITE_ACCESS_READWRITE ) zArg = "SQLITE_ACCESS_READWRITE"; if( flags==SQLITE_ACCESS_READ ) zArg = "SQLITE_ACCESS_READ"; - if( flags==SQLITE_ACCESS_SYMLINK ) zArg = "SQLITE_ACCESS_SYMLINK"; tvfsExecTcl(p, "xAccess", Tcl_NewStringObj(zPath, -1), Tcl_NewStringObj(zArg, -1), 0, 0 );