src/basic/fs-util.c

   1 /* SPDX-License-Identifier: LGPL-2.1+ */
   2
   3 #include <errno.h>
   4 #include <stddef.h>
   5 #include <stdio.h>
   6 #include <stdlib.h>
   7 #include <string.h>
   8 #include <sys/stat.h>
   9 #include <linux/magic.h>
  10 #include <time.h>
  11 #include <unistd.h>
  12
  13 #include "alloc-util.h"
  14 #include "dirent-util.h"
  15 #include "fd-util.h"
  16 #include "fileio.h"
  17 #include "fs-util.h"
  18 #include "log.h"
  19 #include "macro.h"
  20 #include "missing.h"
  21 #include "mkdir.h"
  22 #include "parse-util.h"
  23 #include "path-util.h"
  24 #include "process-util.h"
  25 #include "stat-util.h"
  26 #include "stdio-util.h"
  27 #include "string-util.h"
  28 #include "strv.h"
  29 #include "time-util.h"
  30 #include "user-util.h"
  31 #include "util.h"
  32
  33 int unlink_noerrno(const char *path) {
  34         PROTECT_ERRNO;
  35         int r;
  36
  37         r = unlink(path);
  38         if (r < 0)
  39                 return -errno;
  40
  41         return 0;
  42 }
  43
  44 int rmdir_parents(const char *path, const char *stop) {
  45         size_t l;
  46         int r = 0;
  47
  48         assert(path);
  49         assert(stop);
  50
  51         l = strlen(path);
  52
  53         /* Skip trailing slashes */
  54         while (l > 0 && path[l-1] == '/')
  55                 l--;
  56
  57         while (l > 0) {
  58                 char *t;
  59
  60                 /* Skip last component */
  61                 while (l > 0 && path[l-1] != '/')
  62                         l--;
  63
  64                 /* Skip trailing slashes */
  65                 while (l > 0 && path[l-1] == '/')
  66                         l--;
  67
  68                 if (l <= 0)
  69                         break;
  70
  71                 t = strndup(path, l);
  72                 if (!t)
  73                         return -ENOMEM;
  74
  75                 if (path_startswith(stop, t)) {
  76                         free(t);
  77                         return 0;
  78                 }
  79
  80                 r = rmdir(t);
  81                 free(t);
  82
  83                 if (r < 0)
  84                         if (errno != ENOENT)
  85                                 return -errno;
  86         }
  87
  88         return 0;
  89 }
  90
  91 int rename_noreplace(int olddirfd, const char *oldpath, int newdirfd, const char *newpath) {
  92         struct stat buf;
  93         int ret;
  94
  95         ret = renameat2(olddirfd, oldpath, newdirfd, newpath, RENAME_NOREPLACE);
  96         if (ret >= 0)
  97                 return 0;
  98
  99         /* renameat2() exists since Linux 3.15, btrfs added support for it later.
 100          * If it is not implemented, fallback to another method. */
 101         if (!IN_SET(errno, EINVAL, ENOSYS))
 102                 return -errno;
 103
 104         /* The link()/unlink() fallback does not work on directories. But
 105          * renameat() without RENAME_NOREPLACE gives the same semantics on
 106          * directories, except when newpath is an *empty* directory. This is
 107          * good enough. */
 108         ret = fstatat(olddirfd, oldpath, &buf, AT_SYMLINK_NOFOLLOW);
 109         if (ret >= 0 && S_ISDIR(buf.st_mode)) {
 110                 ret = renameat(olddirfd, oldpath, newdirfd, newpath);
 111                 return ret >= 0 ? 0 : -errno;
 112         }
 113
 114         /* If it is not a directory, use the link()/unlink() fallback. */
 115         ret = linkat(olddirfd, oldpath, newdirfd, newpath, 0);
 116         if (ret < 0)
 117                 return -errno;
 118
 119         ret = unlinkat(olddirfd, oldpath, 0);
 120         if (ret < 0) {
 121                 /* backup errno before the following unlinkat() alters it */
 122                 ret = errno;
 123                 (void) unlinkat(newdirfd, newpath, 0);
 124                 errno = ret;
 125                 return -errno;
 126         }
 127
 128         return 0;
 129 }
 130
 131 int readlinkat_malloc(int fd, const char *p, char **ret) {
 132         size_t l = 100;
 133         int r;
 134
 135         assert(p);
 136         assert(ret);
 137
 138         for (;;) {
 139                 char *c;
 140                 ssize_t n;
 141
 142                 c = new(char, l);
 143                 if (!c)
 144                         return -ENOMEM;
 145
 146                 n = readlinkat(fd, p, c, l-1);
 147                 if (n < 0) {
 148                         r = -errno;
 149                         free(c);
 150                         return r;
 151                 }
 152
 153                 if ((size_t) n < l-1) {
 154                         c[n] = 0;
 155                         *ret = c;
 156                         return 0;
 157                 }
 158
 159                 free(c);
 160                 l *= 2;
 161         }
 162 }
 163
 164 int readlink_malloc(const char *p, char **ret) {
 165         return readlinkat_malloc(AT_FDCWD, p, ret);
 166 }
 167
 168 int readlink_value(const char *p, char **ret) {
 169         _cleanup_free_ char *link = NULL;
 170         char *value;
 171         int r;
 172
 173         r = readlink_malloc(p, &link);
 174         if (r < 0)
 175                 return r;
 176
 177         value = basename(link);
 178         if (!value)
 179                 return -ENOENT;
 180
 181         value = strdup(value);
 182         if (!value)
 183                 return -ENOMEM;
 184
 185         *ret = value;
 186
 187         return 0;
 188 }
 189
 190 int readlink_and_make_absolute(const char *p, char **r) {
 191         _cleanup_free_ char *target = NULL;
 192         char *k;
 193         int j;
 194
 195         assert(p);
 196         assert(r);
 197
 198         j = readlink_malloc(p, &target);
 199         if (j < 0)
 200                 return j;
 201
 202         k = file_in_same_dir(p, target);
 203         if (!k)
 204                 return -ENOMEM;
 205
 206         *r = k;
 207         return 0;
 208 }
 209
 210 int chmod_and_chown(const char *path, mode_t mode, uid_t uid, gid_t gid) {
 211         assert(path);
 212
 213         /* Under the assumption that we are running privileged we
 214          * first change the access mode and only then hand out
 215          * ownership to avoid a window where access is too open. */
 216
 217         if (mode != MODE_INVALID)
 218                 if (chmod(path, mode) < 0)
 219                         return -errno;
 220
 221         if (uid != UID_INVALID || gid != GID_INVALID)
 222                 if (chown(path, uid, gid) < 0)
 223                         return -errno;
 224
 225         return 0;
 226 }
 227
 228 int fchmod_umask(int fd, mode_t m) {
 229         mode_t u;
 230         int r;
 231
 232         u = umask(0777);
 233         r = fchmod(fd, m & (~u)) < 0 ? -errno : 0;
 234         umask(u);
 235
 236         return r;
 237 }
 238
 239 int fchmod_opath(int fd, mode_t m) {
 240         char procfs_path[STRLEN("/proc/self/fd/") + DECIMAL_STR_MAX(int)];
 241
 242         /* This function operates also on fd that might have been opened with
 243          * O_PATH. Indeed fchmodat() doesn't have the AT_EMPTY_PATH flag like
 244          * fchownat() does. */
 245
 246         xsprintf(procfs_path, "/proc/self/fd/%i", fd);
 247
 248         if (chmod(procfs_path, m) < 0)
 249                 return -errno;
 250
 251         return 0;
 252 }
 253
 254 int fd_warn_permissions(const char *path, int fd) {
 255         struct stat st;
 256
 257         if (fstat(fd, &st) < 0)
 258                 return -errno;
 259
 260         if (st.st_mode & 0111)
 261                 log_warning("Configuration file %s is marked executable. Please remove executable permission bits. Proceeding anyway.", path);
 262
 263         if (st.st_mode & 0002)
 264                 log_warning("Configuration file %s is marked world-writable. Please remove world writability permission bits. Proceeding anyway.", path);
 265
 266         if (getpid_cached() == 1 && (st.st_mode & 0044) != 0044)
 267                 log_warning("Configuration file %s is marked world-inaccessible. This has no effect as configuration data is accessible via APIs without restrictions. Proceeding anyway.", path);
 268
 269         return 0;
 270 }
 271
 272 int touch_file(const char *path, bool parents, usec_t stamp, uid_t uid, gid_t gid, mode_t mode) {
 273         char fdpath[STRLEN("/proc/self/fd/") + DECIMAL_STR_MAX(int)];
 274         _cleanup_close_ int fd = -1;
 275         int r, ret = 0;
 276
 277         assert(path);
 278
 279         /* Note that touch_file() does not follow symlinks: if invoked on an existing symlink, then it is the symlink
 280          * itself which is updated, not its target
 281          *
 282          * Returns the first error we encounter, but tries to apply as much as possible. */
 283
 284         if (parents)
 285                 (void) mkdir_parents(path, 0755);
 286
 287         /* Initially, we try to open the node with O_PATH, so that we get a reference to the node. This is useful in
 288          * case the path refers to an existing device or socket node, as we can open it successfully in all cases, and
 289          * won't trigger any driver magic or so. */
 290         fd = open(path, O_PATH|O_CLOEXEC|O_NOFOLLOW);
 291         if (fd < 0) {
 292                 if (errno != ENOENT)
 293                         return -errno;
 294
 295                 /* if the node doesn't exist yet, we create it, but with O_EXCL, so that we only create a regular file
 296                  * here, and nothing else */
 297                 fd = open(path, O_WRONLY|O_CREAT|O_EXCL|O_CLOEXEC, IN_SET(mode, 0, MODE_INVALID) ? 0644 : mode);
 298                 if (fd < 0)
 299                         return -errno;
 300         }
 301
 302         /* Let's make a path from the fd, and operate on that. With this logic, we can adjust the access mode,
 303          * ownership and time of the file node in all cases, even if the fd refers to an O_PATH object — which is
 304          * something fchown(), fchmod(), futimensat() don't allow. */
 305         xsprintf(fdpath, "/proc/self/fd/%i", fd);
 306
 307         if (mode != MODE_INVALID)
 308                 if (chmod(fdpath, mode) < 0)
 309                         ret = -errno;
 310
 311         if (uid_is_valid(uid) || gid_is_valid(gid))
 312                 if (chown(fdpath, uid, gid) < 0 && ret >= 0)
 313                         ret = -errno;
 314
 315         if (stamp != USEC_INFINITY) {
 316                 struct timespec ts[2];
 317
 318                 timespec_store(&ts[0], stamp);
 319                 ts[1] = ts[0];
 320                 r = utimensat(AT_FDCWD, fdpath, ts, 0);
 321         } else
 322                 r = utimensat(AT_FDCWD, fdpath, NULL, 0);
 323         if (r < 0 && ret >= 0)
 324                 return -errno;
 325
 326         return ret;
 327 }
 328
 329 int touch(const char *path) {
 330         return touch_file(path, false, USEC_INFINITY, UID_INVALID, GID_INVALID, MODE_INVALID);
 331 }
 332
 333 int symlink_idempotent(const char *from, const char *to) {
 334         int r;
 335
 336         assert(from);
 337         assert(to);
 338
 339         if (symlink(from, to) < 0) {
 340                 _cleanup_free_ char *p = NULL;
 341
 342                 if (errno != EEXIST)
 343                         return -errno;
 344
 345                 r = readlink_malloc(to, &p);
 346                 if (r == -EINVAL) /* Not a symlink? In that case return the original error we encountered: -EEXIST */
 347                         return -EEXIST;
 348                 if (r < 0) /* Any other error? In that case propagate it as is */
 349                         return r;
 350
 351                 if (!streq(p, from)) /* Not the symlink we want it to be? In that case, propagate the original -EEXIST */
 352                         return -EEXIST;
 353         }
 354
 355         return 0;
 356 }
 357
 358 int symlink_atomic(const char *from, const char *to) {
 359         _cleanup_free_ char *t = NULL;
 360         int r;
 361
 362         assert(from);
 363         assert(to);
 364
 365         r = tempfn_random(to, NULL, &t);
 366         if (r < 0)
 367                 return r;
 368
 369         if (symlink(from, t) < 0)
 370                 return -errno;
 371
 372         if (rename(t, to) < 0) {
 373                 unlink_noerrno(t);
 374                 return -errno;
 375         }
 376
 377         return 0;
 378 }
 379
 380 int mknod_atomic(const char *path, mode_t mode, dev_t dev) {
 381         _cleanup_free_ char *t = NULL;
 382         int r;
 383
 384         assert(path);
 385
 386         r = tempfn_random(path, NULL, &t);
 387         if (r < 0)
 388                 return r;
 389
 390         if (mknod(t, mode, dev) < 0)
 391                 return -errno;
 392
 393         if (rename(t, path) < 0) {
 394                 unlink_noerrno(t);
 395                 return -errno;
 396         }
 397
 398         return 0;
 399 }
 400
 401 int mkfifo_atomic(const char *path, mode_t mode) {
 402         _cleanup_free_ char *t = NULL;
 403         int r;
 404
 405         assert(path);
 406
 407         r = tempfn_random(path, NULL, &t);
 408         if (r < 0)
 409                 return r;
 410
 411         if (mkfifo(t, mode) < 0)
 412                 return -errno;
 413
 414         if (rename(t, path) < 0) {
 415                 unlink_noerrno(t);
 416                 return -errno;
 417         }
 418
 419         return 0;
 420 }
 421
 422 int get_files_in_directory(const char *path, char ***list) {
 423         _cleanup_closedir_ DIR *d = NULL;
 424         struct dirent *de;
 425         size_t bufsize = 0, n = 0;
 426         _cleanup_strv_free_ char **l = NULL;
 427
 428         assert(path);
 429
 430         /* Returns all files in a directory in *list, and the number
 431          * of files as return value. If list is NULL returns only the
 432          * number. */
 433
 434         d = opendir(path);
 435         if (!d)
 436                 return -errno;
 437
 438         FOREACH_DIRENT_ALL(de, d, return -errno) {
 439                 dirent_ensure_type(d, de);
 440
 441                 if (!dirent_is_file(de))
 442                         continue;
 443
 444                 if (list) {
 445                         /* one extra slot is needed for the terminating NULL */
 446                         if (!GREEDY_REALLOC(l, bufsize, n + 2))
 447                                 return -ENOMEM;
 448
 449                         l[n] = strdup(de->d_name);
 450                         if (!l[n])
 451                                 return -ENOMEM;
 452
 453                         l[++n] = NULL;
 454                 } else
 455                         n++;
 456         }
 457
 458         if (list)
 459                 *list = TAKE_PTR(l);
 460
 461         return n;
 462 }
 463
 464 static int getenv_tmp_dir(const char **ret_path) {
 465         const char *n;
 466         int r, ret = 0;
 467
 468         assert(ret_path);
 469
 470         /* We use the same order of environment variables python uses in tempfile.gettempdir():
 471          * https://docs.python.org/3/library/tempfile.html#tempfile.gettempdir */
 472         FOREACH_STRING(n, "TMPDIR", "TEMP", "TMP") {
 473                 const char *e;
 474
 475                 e = secure_getenv(n);
 476                 if (!e)
 477                         continue;
 478                 if (!path_is_absolute(e)) {
 479                         r = -ENOTDIR;
 480                         goto next;
 481                 }
 482                 if (!path_is_normalized(e)) {
 483                         r = -EPERM;
 484                         goto next;
 485                 }
 486
 487                 r = is_dir(e, true);
 488                 if (r < 0)
 489                         goto next;
 490                 if (r == 0) {
 491                         r = -ENOTDIR;
 492                         goto next;
 493                 }
 494
 495                 *ret_path = e;
 496                 return 1;
 497
 498         next:
 499                 /* Remember first error, to make this more debuggable */
 500                 if (ret >= 0)
 501                         ret = r;
 502         }
 503
 504         if (ret < 0)
 505                 return ret;
 506
 507         *ret_path = NULL;
 508         return ret;
 509 }
 510
 511 static int tmp_dir_internal(const char *def, const char **ret) {
 512         const char *e;
 513         int r, k;
 514
 515         assert(def);
 516         assert(ret);
 517
 518         r = getenv_tmp_dir(&e);
 519         if (r > 0) {
 520                 *ret = e;
 521                 return 0;
 522         }
 523
 524         k = is_dir(def, true);
 525         if (k == 0)
 526                 k = -ENOTDIR;
 527         if (k < 0)
 528                 return r < 0 ? r : k;
 529
 530         *ret = def;
 531         return 0;
 532 }
 533
 534 int var_tmp_dir(const char **ret) {
 535
 536         /* Returns the location for "larger" temporary files, that is backed by physical storage if available, and thus
 537          * even might survive a boot: /var/tmp. If $TMPDIR (or related environment variables) are set, its value is
 538          * returned preferably however. Note that both this function and tmp_dir() below are affected by $TMPDIR,
 539          * making it a variable that overrides all temporary file storage locations. */
 540
 541         return tmp_dir_internal("/var/tmp", ret);
 542 }
 543
 544 int tmp_dir(const char **ret) {
 545
 546         /* Similar to var_tmp_dir() above, but returns the location for "smaller" temporary files, which is usually
 547          * backed by an in-memory file system: /tmp. */
 548
 549         return tmp_dir_internal("/tmp", ret);
 550 }
 551
 552 int unlink_or_warn(const char *filename) {
 553         if (unlink(filename) < 0 && errno != ENOENT)
 554                 /* If the file doesn't exist and the fs simply was read-only (in which
 555                  * case unlink() returns EROFS even if the file doesn't exist), don't
 556                  * complain */
 557                 if (errno != EROFS || access(filename, F_OK) >= 0)
 558                         return log_error_errno(errno, "Failed to remove \"%s\": %m", filename);
 559
 560         return 0;
 561 }
 562
 563 int inotify_add_watch_fd(int fd, int what, uint32_t mask) {
 564         char path[STRLEN("/proc/self/fd/") + DECIMAL_STR_MAX(int) + 1];
 565         int r;
 566
 567         /* This is like inotify_add_watch(), except that the file to watch is not referenced by a path, but by an fd */
 568         xsprintf(path, "/proc/self/fd/%i", what);
 569
 570         r = inotify_add_watch(fd, path, mask);
 571         if (r < 0)
 572                 return -errno;
 573
 574         return r;
 575 }
 576
 577 static bool safe_transition(const struct stat *a, const struct stat *b) {
 578         /* Returns true if the transition from a to b is safe, i.e. that we never transition from unprivileged to
 579          * privileged files or directories. Why bother? So that unprivileged code can't symlink to privileged files
 580          * making us believe we read something safe even though it isn't safe in the specific context we open it in. */
 581
 582         if (a->st_uid == 0) /* Transitioning from privileged to unprivileged is always fine */
 583                 return true;
 584
 585         return a->st_uid == b->st_uid; /* Otherwise we need to stay within the same UID */
 586 }
 587
 588 int chase_symlinks(const char *path, const char *original_root, unsigned flags, char **ret) {
 589         _cleanup_free_ char *buffer = NULL, *done = NULL, *root = NULL;
 590         _cleanup_close_ int fd = -1;
 591         unsigned max_follow = CHASE_SYMLINKS_MAX; /* how many symlinks to follow before giving up and returning ELOOP */
 592         struct stat previous_stat;
 593         bool exists = true;
 594         char *todo;
 595         int r;
 596
 597         assert(path);
 598
 599         /* Either the file may be missing, or we return an fd to the final object, but both make no sense */
 600         if (FLAGS_SET(flags, CHASE_NONEXISTENT | CHASE_OPEN))
 601                 return -EINVAL;
 602
 603         if (FLAGS_SET(flags, CHASE_STEP | CHASE_OPEN))
 604                 return -EINVAL;
 605
 606         if (isempty(path))
 607                 return -EINVAL;
 608
 609         /* This is a lot like canonicalize_file_name(), but takes an additional "root" parameter, that allows following
 610          * symlinks relative to a root directory, instead of the root of the host.
 611          *
 612          * Note that "root" primarily matters if we encounter an absolute symlink. It is also used when following
 613          * relative symlinks to ensure they cannot be used to "escape" the root directory. The path parameter passed is
 614          * assumed to be already prefixed by it, except if the CHASE_PREFIX_ROOT flag is set, in which case it is first
 615          * prefixed accordingly.
 616          *
 617          * Algorithmically this operates on two path buffers: "done" are the components of the path we already
 618          * processed and resolved symlinks, "." and ".." of. "todo" are the components of the path we still need to
 619          * process. On each iteration, we move one component from "todo" to "done", processing it's special meaning
 620          * each time. The "todo" path always starts with at least one slash, the "done" path always ends in no
 621          * slash. We always keep an O_PATH fd to the component we are currently processing, thus keeping lookup races
 622          * at a minimum.
 623          *
 624          * Suggested usage: whenever you want to canonicalize a path, use this function. Pass the absolute path you got
 625          * as-is: fully qualified and relative to your host's root. Optionally, specify the root parameter to tell this
 626          * function what to do when encountering a symlink with an absolute path as directory: prefix it by the
 627          * specified path.
 628          *
 629          * There are three ways to invoke this function:
 630          *
 631          * 1. Without CHASE_STEP or CHASE_OPEN: in this case the path is resolved and the normalized path is returned
 632          *    in `ret`. The return value is < 0 on error. If CHASE_NONEXISTENT is also set 0 is returned if the file
 633          *    doesn't exist, > 0 otherwise. If CHASE_NONEXISTENT is not set >= 0 is returned if the destination was
 634          *    found, -ENOENT if it doesn't.
 635          *
 636          * 2. With CHASE_OPEN: in this case the destination is opened after chasing it as O_PATH and this file
 637          *    descriptor is returned as return value. This is useful to open files relative to some root
 638          *    directory. Note that the returned O_PATH file descriptors must be converted into a regular one (using
 639          *    fd_reopen() or such) before it can be used for reading/writing. CHASE_OPEN may not be combined with
 640          *    CHASE_NONEXISTENT.
 641          *
 642          * 3. With CHASE_STEP: in this case only a single step of the normalization is executed, i.e. only the first
 643          *    symlink or ".." component of the path is resolved, and the resulting path is returned. This is useful if
 644          *    a caller wants to trace the a path through the file system verbosely. Returns < 0 on error, > 0 if the
 645          *    path is fully normalized, and == 0 for each normalization step. This may be combined with
 646          *    CHASE_NONEXISTENT, in which case 1 is returned when a component is not found.
 647          *
 648          * */
 649
 650         /* A root directory of "/" or "" is identical to none */
 651         if (empty_or_root(original_root))
 652                 original_root = NULL;
 653
 654         if (!original_root && !ret && (flags & (CHASE_NONEXISTENT|CHASE_NO_AUTOFS|CHASE_SAFE|CHASE_OPEN|CHASE_STEP)) == CHASE_OPEN) {
 655                 /* Shortcut the CHASE_OPEN case if the caller isn't interested in the actual path and has no root set
 656                  * and doesn't care about any of the other special features we provide either. */
 657                 r = open(path, O_PATH|O_CLOEXEC);
 658                 if (r < 0)
 659                         return -errno;
 660
 661                 return r;
 662         }
 663
 664         if (original_root) {
 665                 r = path_make_absolute_cwd(original_root, &root);
 666                 if (r < 0)
 667                         return r;
 668
 669                 if (flags & CHASE_PREFIX_ROOT) {
 670
 671                         /* We don't support relative paths in combination with a root directory */
 672                         if (!path_is_absolute(path))
 673                                 return -EINVAL;
 674
 675                         path = prefix_roota(root, path);
 676                 }
 677         }
 678
 679         r = path_make_absolute_cwd(path, &buffer);
 680         if (r < 0)
 681                 return r;
 682
 683         fd = open("/", O_CLOEXEC|O_NOFOLLOW|O_PATH);
 684         if (fd < 0)
 685                 return -errno;
 686
 687         if (flags & CHASE_SAFE) {
 688                 if (fstat(fd, &previous_stat) < 0)
 689                         return -errno;
 690         }
 691
 692         todo = buffer;
 693         for (;;) {
 694                 _cleanup_free_ char *first = NULL;
 695                 _cleanup_close_ int child = -1;
 696                 struct stat st;
 697                 size_t n, m;
 698
 699                 /* Determine length of first component in the path */
 700                 n = strspn(todo, "/");                  /* The slashes */
 701                 m = n + strcspn(todo + n, "/");         /* The entire length of the component */
 702
 703                 /* Extract the first component. */
 704                 first = strndup(todo, m);
 705                 if (!first)
 706                         return -ENOMEM;
 707
 708                 todo += m;
 709
 710                 /* Empty? Then we reached the end. */
 711                 if (isempty(first))
 712                         break;
 713
 714                 /* Just a single slash? Then we reached the end. */
 715                 if (path_equal(first, "/")) {
 716                         /* Preserve the trailing slash */
 717
 718                         if (flags & CHASE_TRAIL_SLASH)
 719                                 if (!strextend(&done, "/", NULL))
 720                                         return -ENOMEM;
 721
 722                         break;
 723                 }
 724
 725                 /* Just a dot? Then let's eat this up. */
 726                 if (path_equal(first, "/."))
 727                         continue;
 728
 729                 /* Two dots? Then chop off the last bit of what we already found out. */
 730                 if (path_equal(first, "/..")) {
 731                         _cleanup_free_ char *parent = NULL;
 732                         _cleanup_close_ int fd_parent = -1;
 733
 734                         /* If we already are at the top, then going up will not change anything. This is in-line with
 735                          * how the kernel handles this. */
 736                         if (empty_or_root(done))
 737                                 continue;
 738
 739                         parent = dirname_malloc(done);
 740                         if (!parent)
 741                                 return -ENOMEM;
 742
 743                         /* Don't allow this to leave the root dir.  */
 744                         if (root &&
 745                             path_startswith(done, root) &&
 746                             !path_startswith(parent, root))
 747                                 continue;
 748
 749                         free_and_replace(done, parent);
 750
 751                         if (flags & CHASE_STEP)
 752                                 goto chased_one;
 753
 754                         fd_parent = openat(fd, "..", O_CLOEXEC|O_NOFOLLOW|O_PATH);
 755                         if (fd_parent < 0)
 756                                 return -errno;
 757
 758                         if (flags & CHASE_SAFE) {
 759                                 if (fstat(fd_parent, &st) < 0)
 760                                         return -errno;
 761
 762                                 if (!safe_transition(&previous_stat, &st))
 763                                         return -EPERM;
 764
 765                                 previous_stat = st;
 766                         }
 767
 768                         safe_close(fd);
 769                         fd = TAKE_FD(fd_parent);
 770
 771                         continue;
 772                 }
 773
 774                 /* Otherwise let's see what this is. */
 775                 child = openat(fd, first + n, O_CLOEXEC|O_NOFOLLOW|O_PATH);
 776                 if (child < 0) {
 777
 778                         if (errno == ENOENT &&
 779                             (flags & CHASE_NONEXISTENT) &&
 780                             (isempty(todo) || path_is_normalized(todo))) {
 781
 782                                 /* If CHASE_NONEXISTENT is set, and the path does not exist, then that's OK, return
 783                                  * what we got so far. But don't allow this if the remaining path contains "../ or "./"
 784                                  * or something else weird. */
 785
 786                                 /* If done is "/", as first also contains slash at the head, then remove this redundant slash. */
 787                                 if (streq_ptr(done, "/"))
 788                                         *done = '\0';
 789
 790                                 if (!strextend(&done, first, todo, NULL))
 791                                         return -ENOMEM;
 792
 793                                 exists = false;
 794                                 break;
 795                         }
 796
 797                         return -errno;
 798                 }
 799
 800                 if (fstat(child, &st) < 0)
 801                         return -errno;
 802                 if ((flags & CHASE_SAFE) &&
 803                     !safe_transition(&previous_stat, &st))
 804                         return -EPERM;
 805
 806                 previous_stat = st;
 807
 808                 if ((flags & CHASE_NO_AUTOFS) &&
 809                     fd_is_fs_type(child, AUTOFS_SUPER_MAGIC) > 0)
 810                         return -EREMOTE;
 811
 812                 if (S_ISLNK(st.st_mode)) {
 813                         char *joined;
 814
 815                         _cleanup_free_ char *destination = NULL;
 816
 817                         /* This is a symlink, in this case read the destination. But let's make sure we don't follow
 818                          * symlinks without bounds. */
 819                         if (--max_follow <= 0)
 820                                 return -ELOOP;
 821
 822                         r = readlinkat_malloc(fd, first + n, &destination);
 823                         if (r < 0)
 824                                 return r;
 825                         if (isempty(destination))
 826                                 return -EINVAL;
 827
 828                         if (path_is_absolute(destination)) {
 829
 830                                 /* An absolute destination. Start the loop from the beginning, but use the root
 831                                  * directory as base. */
 832
 833                                 safe_close(fd);
 834                                 fd = open(root ?: "/", O_CLOEXEC|O_NOFOLLOW|O_PATH);
 835                                 if (fd < 0)
 836                                         return -errno;
 837
 838                                 if (flags & CHASE_SAFE) {
 839                                         if (fstat(fd, &st) < 0)
 840                                                 return -errno;
 841
 842                                         if (!safe_transition(&previous_stat, &st))
 843                                                 return -EPERM;
 844
 845                                         previous_stat = st;
 846                                 }
 847
 848                                 free(done);
 849
 850                                 /* Note that we do not revalidate the root, we take it as is. */
 851                                 if (isempty(root))
 852                                         done = NULL;
 853                                 else {
 854                                         done = strdup(root);
 855                                         if (!done)
 856                                                 return -ENOMEM;
 857                                 }
 858
 859                                 /* Prefix what's left to do with what we just read, and start the loop again, but
 860                                  * remain in the current directory. */
 861                                 joined = strjoin(destination, todo);
 862                         } else
 863                                 joined = strjoin("/", destination, todo);
 864                         if (!joined)
 865                                 return -ENOMEM;
 866
 867                         free(buffer);
 868                         todo = buffer = joined;
 869
 870                         if (flags & CHASE_STEP)
 871                                 goto chased_one;
 872
 873                         continue;
 874                 }
 875
 876                 /* If this is not a symlink, then let's just add the name we read to what we already verified. */
 877                 if (!done)
 878                         done = TAKE_PTR(first);
 879                 else {
 880                         /* If done is "/", as first also contains slash at the head, then remove this redundant slash. */
 881                         if (streq(done, "/"))
 882                                 *done = '\0';
 883
 884                         if (!strextend(&done, first, NULL))
 885                                 return -ENOMEM;
 886                 }
 887
 888                 /* And iterate again, but go one directory further down. */
 889                 safe_close(fd);
 890                 fd = TAKE_FD(child);
 891         }
 892
 893         if (!done) {
 894                 /* Special case, turn the empty string into "/", to indicate the root directory. */
 895                 done = strdup("/");
 896                 if (!done)
 897                         return -ENOMEM;
 898         }
 899
 900         if (ret)
 901                 *ret = TAKE_PTR(done);
 902
 903         if (flags & CHASE_OPEN) {
 904                 /* Return the O_PATH fd we currently are looking to the caller. It can translate it to a proper fd by
 905                  * opening /proc/self/fd/xyz. */
 906
 907                 assert(fd >= 0);
 908                 return TAKE_FD(fd);
 909         }
 910
 911         if (flags & CHASE_STEP)
 912                 return 1;
 913
 914         return exists;
 915
 916 chased_one:
 917         if (ret) {
 918                 char *c;
 919
 920                 c = strjoin(strempty(done), todo);
 921                 if (!c)
 922                         return -ENOMEM;
 923
 924                 *ret = c;
 925         }
 926
 927         return 0;
 928 }
 929
 930 int chase_symlinks_and_open(
 931                 const char *path,
 932                 const char *root,
 933                 unsigned chase_flags,
 934                 int open_flags,
 935                 char **ret_path) {
 936
 937         _cleanup_close_ int path_fd = -1;
 938         _cleanup_free_ char *p = NULL;
 939         int r;
 940
 941         if (chase_flags & CHASE_NONEXISTENT)
 942                 return -EINVAL;
 943
 944         if (empty_or_root(root) && !ret_path && (chase_flags & (CHASE_NO_AUTOFS|CHASE_SAFE)) == 0) {
 945                 /* Shortcut this call if none of the special features of this call are requested */
 946                 r = open(path, open_flags);
 947                 if (r < 0)
 948                         return -errno;
 949
 950                 return r;
 951         }
 952
 953         path_fd = chase_symlinks(path, root, chase_flags|CHASE_OPEN, ret_path ? &p : NULL);
 954         if (path_fd < 0)
 955                 return path_fd;
 956
 957         r = fd_reopen(path_fd, open_flags);
 958         if (r < 0)
 959                 return r;
 960
 961         if (ret_path)
 962                 *ret_path = TAKE_PTR(p);
 963
 964         return r;
 965 }
 966
 967 int chase_symlinks_and_opendir(
 968                 const char *path,
 969                 const char *root,
 970                 unsigned chase_flags,
 971                 char **ret_path,
 972                 DIR **ret_dir) {
 973
 974         char procfs_path[STRLEN("/proc/self/fd/") + DECIMAL_STR_MAX(int)];
 975         _cleanup_close_ int path_fd = -1;
 976         _cleanup_free_ char *p = NULL;
 977         DIR *d;
 978
 979         if (!ret_dir)
 980                 return -EINVAL;
 981         if (chase_flags & CHASE_NONEXISTENT)
 982                 return -EINVAL;
 983
 984         if (empty_or_root(root) && !ret_path && (chase_flags & (CHASE_NO_AUTOFS|CHASE_SAFE)) == 0) {
 985                 /* Shortcut this call if none of the special features of this call are requested */
 986                 d = opendir(path);
 987                 if (!d)
 988                         return -errno;
 989
 990                 *ret_dir = d;
 991                 return 0;
 992         }
 993
 994         path_fd = chase_symlinks(path, root, chase_flags|CHASE_OPEN, ret_path ? &p : NULL);
 995         if (path_fd < 0)
 996                 return path_fd;
 997
 998         xsprintf(procfs_path, "/proc/self/fd/%i", path_fd);
 999         d = opendir(procfs_path);
1000         if (!d)
1001                 return -errno;
1002
1003         if (ret_path)
1004                 *ret_path = TAKE_PTR(p);
1005
1006         *ret_dir = d;
1007         return 0;
1008 }
1009
1010 int chase_symlinks_and_stat(
1011                 const char *path,
1012                 const char *root,
1013                 unsigned chase_flags,
1014                 char **ret_path,
1015                 struct stat *ret_stat) {
1016
1017         _cleanup_close_ int path_fd = -1;
1018         _cleanup_free_ char *p = NULL;
1019
1020         assert(path);
1021         assert(ret_stat);
1022
1023         if (chase_flags & CHASE_NONEXISTENT)
1024                 return -EINVAL;
1025
1026         if (empty_or_root(root) && !ret_path && (chase_flags & (CHASE_NO_AUTOFS|CHASE_SAFE)) == 0) {
1027                 /* Shortcut this call if none of the special features of this call are requested */
1028                 if (stat(path, ret_stat) < 0)
1029                         return -errno;
1030
1031                 return 1;
1032         }
1033
1034         path_fd = chase_symlinks(path, root, chase_flags|CHASE_OPEN, ret_path ? &p : NULL);
1035         if (path_fd < 0)
1036                 return path_fd;
1037
1038         if (fstat(path_fd, ret_stat) < 0)
1039                 return -errno;
1040
1041         if (ret_path)
1042                 *ret_path = TAKE_PTR(p);
1043
1044         if (chase_flags & CHASE_OPEN)
1045                 return TAKE_FD(path_fd);
1046
1047         return 1;
1048 }
1049
1050 int access_fd(int fd, int mode) {
1051         char p[STRLEN("/proc/self/fd/") + DECIMAL_STR_MAX(fd) + 1];
1052         int r;
1053
1054         /* Like access() but operates on an already open fd */
1055
1056         xsprintf(p, "/proc/self/fd/%i", fd);
1057         r = access(p, mode);
1058         if (r < 0)
1059                 return -errno;
1060
1061         return r;
1062 }
1063
1064 void unlink_tempfilep(char (*p)[]) {
1065         /* If the file is created with mkstemp(), it will (almost always)
1066          * change the suffix. Treat this as a sign that the file was
1067          * successfully created. We ignore both the rare case where the
1068          * original suffix is used and unlink failures. */
1069         if (!endswith(*p, ".XXXXXX"))
1070                 (void) unlink_noerrno(*p);
1071 }
1072
1073 int unlinkat_deallocate(int fd, const char *name, int flags) {
1074         _cleanup_close_ int truncate_fd = -1;
1075         struct stat st;
1076         off_t l, bs;
1077
1078         /* Operates like unlinkat() but also deallocates the file contents if it is a regular file and there's no other
1079          * link to it. This is useful to ensure that other processes that might have the file open for reading won't be
1080          * able to keep the data pinned on disk forever. This call is particular useful whenever we execute clean-up
1081          * jobs ("vacuuming"), where we want to make sure the data is really gone and the disk space released and
1082          * returned to the free pool.
1083          *
1084          * Deallocation is preferably done by FALLOC_FL_PUNCH_HOLE|FALLOC_FL_KEEP_SIZE (👊) if supported, which means
1085          * the file won't change size. That's a good thing since we shouldn't needlessly trigger SIGBUS in other
1086          * programs that have mmap()ed the file. (The assumption here is that changing file contents to all zeroes
1087          * underneath those programs is the better choice than simply triggering SIGBUS in them which truncation does.)
1088          * However if hole punching is not implemented in the kernel or file system we'll fall back to normal file
1089          * truncation (🔪), as our goal of deallocating the data space trumps our goal of being nice to readers (💐).
1090          *
1091          * Note that we attempt deallocation, but failure to succeed with that is not considered fatal, as long as the
1092          * primary job – to delete the file – is accomplished. */
1093
1094         if ((flags & AT_REMOVEDIR) == 0) {
1095                 truncate_fd = openat(fd, name, O_WRONLY|O_CLOEXEC|O_NOCTTY|O_NOFOLLOW|O_NONBLOCK);
1096                 if (truncate_fd < 0) {
1097
1098                         /* If this failed because the file doesn't exist propagate the error right-away. Also,
1099                          * AT_REMOVEDIR wasn't set, and we tried to open the file for writing, which means EISDIR is
1100                          * returned when this is a directory but we are not supposed to delete those, hence propagate
1101                          * the error right-away too. */
1102                         if (IN_SET(errno, ENOENT, EISDIR))
1103                                 return -errno;
1104
1105                         if (errno != ELOOP) /* don't complain if this is a symlink */
1106                                 log_debug_errno(errno, "Failed to open file '%s' for deallocation, ignoring: %m", name);
1107                 }
1108         }
1109
1110         if (unlinkat(fd, name, flags) < 0)
1111                 return -errno;
1112
1113         if (truncate_fd < 0) /* Don't have a file handle, can't do more ☹️ */
1114                 return 0;
1115
1116         if (fstat(truncate_fd, &st) < 0) {
1117                 log_debug_errno(errno, "Failed to stat file '%s' for deallocation, ignoring.", name);
1118                 return 0;
1119         }
1120
1121         if (!S_ISREG(st.st_mode) || st.st_blocks == 0 || st.st_nlink > 0)
1122                 return 0;
1123
1124         /* If this is a regular file, it actually took up space on disk and there are no other links it's time to
1125          * punch-hole/truncate this to release the disk space. */
1126
1127         bs = MAX(st.st_blksize, 512);
1128         l = DIV_ROUND_UP(st.st_size, bs) * bs; /* Round up to next block size */
1129
1130         if (fallocate(truncate_fd, FALLOC_FL_PUNCH_HOLE|FALLOC_FL_KEEP_SIZE, 0, l) >= 0)
1131                 return 0; /* Successfully punched a hole! 😊 */
1132
1133         /* Fall back to truncation */
1134         if (ftruncate(truncate_fd, 0) < 0) {
1135                 log_debug_errno(errno, "Failed to truncate file to 0, ignoring: %m");
1136                 return 0;
1137         }
1138
1139         return 0;
1140 }
1141
1142 int fsync_directory_of_file(int fd) {
1143         _cleanup_free_ char *path = NULL, *dn = NULL;
1144         _cleanup_close_ int dfd = -1;
1145         int r;
1146
1147         r = fd_verify_regular(fd);
1148         if (r < 0)
1149                 return r;
1150
1151         r = fd_get_path(fd, &path);
1152         if (r < 0) {
1153                 log_debug_errno(r, "Failed to query /proc/self/fd/%d%s: %m",
1154                                 fd,
1155                                 r == -EOPNOTSUPP ? ", ignoring" : "");
1156
1157                 if (r == -EOPNOTSUPP)
1158                         /* If /proc is not available, we're most likely running in some
1159                          * chroot environment, and syncing the directory is not very
1160                          * important in that case. Let's just silently do nothing. */
1161                         return 0;
1162
1163                 return r;
1164         }
1165
1166         if (!path_is_absolute(path))
1167                 return -EINVAL;
1168
1169         dn = dirname_malloc(path);
1170         if (!dn)
1171                 return -ENOMEM;
1172
1173         dfd = open(dn, O_RDONLY|O_CLOEXEC|O_DIRECTORY);
1174         if (dfd < 0)
1175                 return -errno;
1176
1177         if (fsync(dfd) < 0)
1178                 return -errno;
1179
1180         return 0;
1181 }