mirror of
https://github.com/morgan9e/systemd
synced 2026-04-15 17:06:39 +09:00
254d1313ae
-1 was used everywhere, but -EBADF or -EBADFD started being used in various places. Let's make things consistent in the new style. Note that there are two candidates: EBADF 9 Bad file descriptor EBADFD 77 File descriptor in bad state Since we're initializating the fd, we're just assigning a value that means "no fd yet", so it's just a bad file descriptor, and the first errno fits better. If instead we had a valid file descriptor that became invalid because of some operation or state change, the other errno would fit better. In some places, initialization is dropped if unnecessary.
411 lines
11 KiB
C
411 lines
11 KiB
C
/* SPDX-License-Identifier: LGPL-2.1-or-later */
|
||
|
||
#include <sys/mman.h>
|
||
|
||
#include "alloc-util.h"
|
||
#include "fd-util.h"
|
||
#include "fileio.h"
|
||
#include "fs-util.h"
|
||
#include "hexdecoct.h"
|
||
#include "macro.h"
|
||
#include "memfd-util.h"
|
||
#include "missing_fcntl.h"
|
||
#include "missing_syscall.h"
|
||
#include "path-util.h"
|
||
#include "process-util.h"
|
||
#include "random-util.h"
|
||
#include "stdio-util.h"
|
||
#include "string-util.h"
|
||
#include "tmpfile-util.h"
|
||
#include "umask-util.h"
|
||
|
||
static int fopen_temporary_internal(int dir_fd, const char *path, FILE **ret_file) {
|
||
_cleanup_fclose_ FILE *f = NULL;
|
||
_cleanup_close_ int fd = -EBADF;
|
||
int r;
|
||
|
||
assert(dir_fd >= 0 || dir_fd == AT_FDCWD);
|
||
assert(path);
|
||
|
||
fd = openat(dir_fd, path, O_CLOEXEC|O_NOCTTY|O_RDWR|O_CREAT|O_EXCL, 0600);
|
||
if (fd < 0)
|
||
return -errno;
|
||
|
||
/* This assumes that returned FILE object is short-lived and used within the same single-threaded
|
||
* context and never shared externally, hence locking is not necessary. */
|
||
|
||
r = take_fdopen_unlocked(&fd, "w", &f);
|
||
if (r < 0) {
|
||
(void) unlinkat(dir_fd, path, 0);
|
||
return r;
|
||
}
|
||
|
||
if (ret_file)
|
||
*ret_file = TAKE_PTR(f);
|
||
|
||
return 0;
|
||
}
|
||
|
||
int fopen_temporary_at(int dir_fd, const char *path, FILE **ret_file, char **ret_path) {
|
||
_cleanup_free_ char *t = NULL;
|
||
int r;
|
||
|
||
assert(dir_fd >= 0 || dir_fd == AT_FDCWD);
|
||
assert(path);
|
||
|
||
r = tempfn_random(path, NULL, &t);
|
||
if (r < 0)
|
||
return r;
|
||
|
||
r = fopen_temporary_internal(dir_fd, t, ret_file);
|
||
if (r < 0)
|
||
return r;
|
||
|
||
if (ret_path)
|
||
*ret_path = TAKE_PTR(t);
|
||
|
||
return 0;
|
||
}
|
||
|
||
int fopen_temporary_child_at(int dir_fd, const char *path, FILE **ret_file, char **ret_path) {
|
||
_cleanup_free_ char *t = NULL;
|
||
int r;
|
||
|
||
assert(dir_fd >= 0 || dir_fd == AT_FDCWD);
|
||
|
||
if (!path) {
|
||
r = tmp_dir(&path);
|
||
if (r < 0)
|
||
return r;
|
||
}
|
||
|
||
r = tempfn_random_child(path, NULL, &t);
|
||
if (r < 0)
|
||
return r;
|
||
|
||
r = fopen_temporary_internal(dir_fd, t, ret_file);
|
||
if (r < 0)
|
||
return r;
|
||
|
||
if (ret_path)
|
||
*ret_path = TAKE_PTR(t);
|
||
|
||
return 0;
|
||
}
|
||
|
||
/* This is much like mkostemp() but is subject to umask(). */
|
||
int mkostemp_safe(char *pattern) {
|
||
assert(pattern);
|
||
BLOCK_WITH_UMASK(0077);
|
||
return RET_NERRNO(mkostemp(pattern, O_CLOEXEC));
|
||
}
|
||
|
||
int fmkostemp_safe(char *pattern, const char *mode, FILE **ret_f) {
|
||
_cleanup_close_ int fd = -EBADF;
|
||
FILE *f;
|
||
|
||
fd = mkostemp_safe(pattern);
|
||
if (fd < 0)
|
||
return fd;
|
||
|
||
f = take_fdopen(&fd, mode);
|
||
if (!f)
|
||
return -errno;
|
||
|
||
*ret_f = f;
|
||
return 0;
|
||
}
|
||
|
||
static int tempfn_build(const char *p, const char *pre, const char *post, bool child, char **ret) {
|
||
_cleanup_free_ char *d = NULL, *fn = NULL, *nf = NULL, *result = NULL;
|
||
size_t len_pre, len_post, len_add;
|
||
int r;
|
||
|
||
assert(p);
|
||
assert(ret);
|
||
|
||
/*
|
||
* Turns this:
|
||
* /foo/bar/waldo
|
||
*
|
||
* Into this :
|
||
* /foo/bar/waldo/.#<pre><post> (child == true)
|
||
* /foo/bar/.#<pre>waldo<post> (child == false)
|
||
*/
|
||
|
||
if (pre && strchr(pre, '/'))
|
||
return -EINVAL;
|
||
|
||
if (post && strchr(post, '/'))
|
||
return -EINVAL;
|
||
|
||
len_pre = strlen_ptr(pre);
|
||
len_post = strlen_ptr(post);
|
||
/* NAME_MAX is counted *without* the trailing NUL byte. */
|
||
if (len_pre > NAME_MAX - STRLEN(".#") ||
|
||
len_post > NAME_MAX - STRLEN(".#") - len_pre)
|
||
return -EINVAL;
|
||
|
||
len_add = len_pre + len_post + STRLEN(".#");
|
||
|
||
if (child) {
|
||
d = strdup(p);
|
||
if (!d)
|
||
return -ENOMEM;
|
||
} else {
|
||
r = path_extract_directory(p, &d);
|
||
if (r < 0 && r != -EDESTADDRREQ) /* EDESTADDRREQ → No directory specified, just a filename */
|
||
return r;
|
||
|
||
r = path_extract_filename(p, &fn);
|
||
if (r < 0)
|
||
return r;
|
||
|
||
if (strlen(fn) > NAME_MAX - len_add)
|
||
/* We cannot simply prepend and append strings to the filename. Let's truncate the filename. */
|
||
fn[NAME_MAX - len_add] = '\0';
|
||
}
|
||
|
||
nf = strjoin(".#", strempty(pre), strempty(fn), strempty(post));
|
||
if (!nf)
|
||
return -ENOMEM;
|
||
|
||
if (d) {
|
||
if (!path_extend(&d, nf))
|
||
return -ENOMEM;
|
||
|
||
result = path_simplify(TAKE_PTR(d));
|
||
} else
|
||
result = TAKE_PTR(nf);
|
||
|
||
if (!path_is_valid(result)) /* New path is not valid? (Maybe because too long?) Refuse. */
|
||
return -EINVAL;
|
||
|
||
*ret = TAKE_PTR(result);
|
||
return 0;
|
||
}
|
||
|
||
int tempfn_xxxxxx(const char *p, const char *extra, char **ret) {
|
||
/*
|
||
* Turns this:
|
||
* /foo/bar/waldo
|
||
*
|
||
* Into this:
|
||
* /foo/bar/.#<extra>waldoXXXXXX
|
||
*/
|
||
|
||
return tempfn_build(p, extra, "XXXXXX", /* child = */ false, ret);
|
||
}
|
||
|
||
int tempfn_random(const char *p, const char *extra, char **ret) {
|
||
_cleanup_free_ char *s = NULL;
|
||
|
||
assert(p);
|
||
assert(ret);
|
||
|
||
/*
|
||
* Turns this:
|
||
* /foo/bar/waldo
|
||
*
|
||
* Into this:
|
||
* /foo/bar/.#<extra>waldobaa2a261115984a9
|
||
*/
|
||
|
||
if (asprintf(&s, "%016" PRIx64, random_u64()) < 0)
|
||
return -ENOMEM;
|
||
|
||
return tempfn_build(p, extra, s, /* child = */ false, ret);
|
||
}
|
||
|
||
int tempfn_random_child(const char *p, const char *extra, char **ret) {
|
||
_cleanup_free_ char *s = NULL;
|
||
int r;
|
||
|
||
assert(ret);
|
||
|
||
/* Turns this:
|
||
* /foo/bar/waldo
|
||
* Into this:
|
||
* /foo/bar/waldo/.#<extra>3c2b6219aa75d7d0
|
||
*/
|
||
|
||
if (!p) {
|
||
r = tmp_dir(&p);
|
||
if (r < 0)
|
||
return r;
|
||
}
|
||
|
||
if (asprintf(&s, "%016" PRIx64, random_u64()) < 0)
|
||
return -ENOMEM;
|
||
|
||
return tempfn_build(p, extra, s, /* child = */ true, ret);
|
||
}
|
||
|
||
int open_tmpfile_unlinkable(const char *directory, int flags) {
|
||
char *p;
|
||
int fd, r;
|
||
|
||
if (!directory) {
|
||
r = tmp_dir(&directory);
|
||
if (r < 0)
|
||
return r;
|
||
} else if (isempty(directory))
|
||
return -EINVAL;
|
||
|
||
/* Returns an unlinked temporary file that cannot be linked into the file system anymore */
|
||
|
||
/* Try O_TMPFILE first, if it is supported */
|
||
fd = open(directory, flags|O_TMPFILE|O_EXCL, S_IRUSR|S_IWUSR);
|
||
if (fd >= 0)
|
||
return fd;
|
||
|
||
/* Fall back to unguessable name + unlinking */
|
||
p = strjoina(directory, "/systemd-tmp-XXXXXX");
|
||
|
||
fd = mkostemp_safe(p);
|
||
if (fd < 0)
|
||
return fd;
|
||
|
||
(void) unlink(p);
|
||
|
||
return fd;
|
||
}
|
||
|
||
int open_tmpfile_linkable(const char *target, int flags, char **ret_path) {
|
||
_cleanup_free_ char *tmp = NULL;
|
||
int r, fd;
|
||
|
||
assert(target);
|
||
assert(ret_path);
|
||
|
||
/* Don't allow O_EXCL, as that has a special meaning for O_TMPFILE */
|
||
assert((flags & O_EXCL) == 0);
|
||
|
||
/* Creates a temporary file, that shall be renamed to "target" later. If possible, this uses O_TMPFILE – in
|
||
* which case "ret_path" will be returned as NULL. If not possible the temporary path name used is returned in
|
||
* "ret_path". Use link_tmpfile() below to rename the result after writing the file in full. */
|
||
|
||
fd = open_parent(target, O_TMPFILE|flags, 0640);
|
||
if (fd >= 0) {
|
||
*ret_path = NULL;
|
||
return fd;
|
||
}
|
||
|
||
log_debug_errno(fd, "Failed to use O_TMPFILE for %s: %m", target);
|
||
|
||
r = tempfn_random(target, NULL, &tmp);
|
||
if (r < 0)
|
||
return r;
|
||
|
||
fd = open(tmp, O_CREAT|O_EXCL|O_NOFOLLOW|O_NOCTTY|flags, 0640);
|
||
if (fd < 0)
|
||
return -errno;
|
||
|
||
*ret_path = TAKE_PTR(tmp);
|
||
|
||
return fd;
|
||
}
|
||
|
||
int fopen_tmpfile_linkable(const char *target, int flags, char **ret_path, FILE **ret_file) {
|
||
_cleanup_free_ char *path = NULL;
|
||
_cleanup_fclose_ FILE *f = NULL;
|
||
_cleanup_close_ int fd = -EBADF;
|
||
|
||
assert(target);
|
||
assert(ret_file);
|
||
assert(ret_path);
|
||
|
||
fd = open_tmpfile_linkable(target, flags, &path);
|
||
if (fd < 0)
|
||
return fd;
|
||
|
||
f = take_fdopen(&fd, "w");
|
||
if (!f)
|
||
return -ENOMEM;
|
||
|
||
*ret_path = TAKE_PTR(path);
|
||
*ret_file = TAKE_PTR(f);
|
||
return 0;
|
||
}
|
||
|
||
int link_tmpfile(int fd, const char *path, const char *target) {
|
||
assert(fd >= 0);
|
||
assert(target);
|
||
|
||
/* Moves a temporary file created with open_tmpfile() above into its final place. if "path" is NULL an fd
|
||
* created with O_TMPFILE is assumed, and linkat() is used. Otherwise it is assumed O_TMPFILE is not supported
|
||
* on the directory, and renameat2() is used instead.
|
||
*
|
||
* Note that in both cases we will not replace existing files. This is because linkat() does not support this
|
||
* operation currently (renameat2() does), and there is no nice way to emulate this. */
|
||
|
||
if (path)
|
||
return rename_noreplace(AT_FDCWD, path, AT_FDCWD, target);
|
||
|
||
return RET_NERRNO(linkat(AT_FDCWD, FORMAT_PROC_FD_PATH(fd), AT_FDCWD, target, AT_SYMLINK_FOLLOW));
|
||
}
|
||
|
||
int flink_tmpfile(FILE *f, const char *path, const char *target) {
|
||
int fd, r;
|
||
|
||
assert(f);
|
||
assert(target);
|
||
|
||
fd = fileno(f);
|
||
if (fd < 0) /* Not all FILE* objects encapsulate fds */
|
||
return -EBADF;
|
||
|
||
r = fflush_sync_and_check(f);
|
||
if (r < 0)
|
||
return r;
|
||
|
||
return link_tmpfile(fd, path, target);
|
||
}
|
||
|
||
int mkdtemp_malloc(const char *template, char **ret) {
|
||
_cleanup_free_ char *p = NULL;
|
||
int r;
|
||
|
||
assert(ret);
|
||
|
||
if (template)
|
||
p = strdup(template);
|
||
else {
|
||
const char *tmp;
|
||
|
||
r = tmp_dir(&tmp);
|
||
if (r < 0)
|
||
return r;
|
||
|
||
p = path_join(tmp, "XXXXXX");
|
||
}
|
||
if (!p)
|
||
return -ENOMEM;
|
||
|
||
if (!mkdtemp(p))
|
||
return -errno;
|
||
|
||
*ret = TAKE_PTR(p);
|
||
return 0;
|
||
}
|
||
|
||
int mkdtemp_open(const char *template, int flags, char **ret) {
|
||
_cleanup_free_ char *p = NULL;
|
||
int fd, r;
|
||
|
||
r = mkdtemp_malloc(template, &p);
|
||
if (r < 0)
|
||
return r;
|
||
|
||
fd = RET_NERRNO(open(p, O_DIRECTORY|O_CLOEXEC|flags));
|
||
if (fd < 0) {
|
||
(void) rmdir(p);
|
||
return fd;
|
||
}
|
||
|
||
if (ret)
|
||
*ret = TAKE_PTR(p);
|
||
|
||
return fd;
|
||
}
|