X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?a=blobdiff_plain;f=src%2Fbasic%2Fcopy.c;h=bb17d3ae3cb2569de7f243756a31d416989b6322;hb=dd656b3679e4b5a7ec3534bf8786b022327e080d;hp=5b53f2e0fc3fefe57025cbeb80c29550b3f1402d;hpb=3f87ae2530d8bb022f54526c3a568165a34acf05;p=elogind.git diff --git a/src/basic/copy.c b/src/basic/copy.c index 5b53f2e0f..bb17d3ae3 100644 --- a/src/basic/copy.c +++ b/src/basic/copy.c @@ -1,7 +1,5 @@ /* SPDX-License-Identifier: LGPL-2.1+ */ /*** - This file is part of systemd. - Copyright 2014 Lennart Poettering ***/ @@ -29,6 +27,7 @@ #include "io-util.h" //#include "macro.h" #include "missing.h" +//#include "mount-util.h" //#include "string-util.h" #include "strv.h" #include "time-util.h" @@ -36,7 +35,12 @@ #include "user-util.h" //#include "xattr-util.h" -#define COPY_BUFFER_SIZE (16*1024u) +#define COPY_BUFFER_SIZE (16U*1024U) + +/* A safety net for descending recursively into file system trees to copy. On Linux PATH_MAX is 4096, which means the + * deepest valid path one can build is around 2048, which we hence use as a safety net here, to not spin endlessly in + * case of bind mount cycles and suchlike. */ +#define COPY_DEPTH_MAX 2048U static ssize_t try_copy_file_range( int fd_in, loff_t *off_in, @@ -482,6 +486,7 @@ static int fd_copy_directory( int dt, const char *to, dev_t original_device, + unsigned depth_left, uid_t override_uid, gid_t override_gid, CopyFlags copy_flags) { @@ -495,6 +500,9 @@ static int fd_copy_directory( assert(st); assert(to); + if (depth_left == 0) + return -ENAMETOOLONG; + if (from) fdf = openat(df, from, O_RDONLY|O_DIRECTORY|O_CLOEXEC|O_NOCTTY|O_NOFOLLOW); else @@ -533,13 +541,40 @@ static int fd_copy_directory( continue; } - if (buf.st_dev != original_device) - continue; + if (S_ISDIR(buf.st_mode)) { + /* + * Don't descend into directories on other file systems, if this is requested. We do a simple + * .st_dev check here, which basically comes for free. Note that we do this check only on + * directories, not other kind of file system objects, for two reason: + * + * • The kernel's overlayfs pseudo file system that overlays multiple real file systems + * propagates the .st_dev field of the file system a file originates from all the way up + * through the stack to stat(). It doesn't do that for directories however. This means that + * comparing .st_dev on non-directories suggests that they all are mount points. To avoid + * confusion we hence avoid relying on this check for regular files. + * + * • The main reason we do this check at all is to protect ourselves from bind mount cycles, + * where we really want to avoid descending down in all eternity. However the .st_dev check + * is usually not sufficient for this protection anyway, as bind mount cycles from the same + * file system onto itself can't be detected that way. (Note we also do a recursion depth + * check, which is probably the better protection in this regard, which is why + * COPY_SAME_MOUNT is optional). + */ + + if (FLAGS_SET(copy_flags, COPY_SAME_MOUNT)) { + if (buf.st_dev != original_device) + continue; + + r = fd_is_mount_point(dirfd(d), de->d_name, 0); + if (r < 0) + return r; + if (r > 0) + continue; + } - if (S_ISREG(buf.st_mode)) + q = fd_copy_directory(dirfd(d), de->d_name, &buf, fdt, de->d_name, original_device, depth_left-1, override_uid, override_gid, copy_flags); + } else if (S_ISREG(buf.st_mode)) q = fd_copy_regular(dirfd(d), de->d_name, &buf, fdt, de->d_name, override_uid, override_gid, copy_flags); - else if (S_ISDIR(buf.st_mode)) - q = fd_copy_directory(dirfd(d), de->d_name, &buf, fdt, de->d_name, original_device, override_uid, override_gid, copy_flags); else if (S_ISLNK(buf.st_mode)) q = fd_copy_symlink(dirfd(d), de->d_name, &buf, fdt, de->d_name, override_uid, override_gid, copy_flags); else if (S_ISFIFO(buf.st_mode)) @@ -589,7 +624,7 @@ int copy_tree_at(int fdf, const char *from, int fdt, const char *to, uid_t overr if (S_ISREG(st.st_mode)) return fd_copy_regular(fdf, from, &st, fdt, to, override_uid, override_gid, copy_flags); else if (S_ISDIR(st.st_mode)) - return fd_copy_directory(fdf, from, &st, fdt, to, st.st_dev, override_uid, override_gid, copy_flags); + return fd_copy_directory(fdf, from, &st, fdt, to, st.st_dev, COPY_DEPTH_MAX, override_uid, override_gid, copy_flags); else if (S_ISLNK(st.st_mode)) return fd_copy_symlink(fdf, from, &st, fdt, to, override_uid, override_gid, copy_flags); else if (S_ISFIFO(st.st_mode)) @@ -616,7 +651,7 @@ int copy_directory_fd(int dirfd, const char *to, CopyFlags copy_flags) { if (!S_ISDIR(st.st_mode)) return -ENOTDIR; - return fd_copy_directory(dirfd, NULL, &st, AT_FDCWD, to, st.st_dev, UID_INVALID, GID_INVALID, copy_flags); + return fd_copy_directory(dirfd, NULL, &st, AT_FDCWD, to, st.st_dev, COPY_DEPTH_MAX, UID_INVALID, GID_INVALID, copy_flags); } int copy_directory(const char *from, const char *to, CopyFlags copy_flags) { @@ -631,7 +666,7 @@ int copy_directory(const char *from, const char *to, CopyFlags copy_flags) { if (!S_ISDIR(st.st_mode)) return -ENOTDIR; - return fd_copy_directory(AT_FDCWD, from, &st, AT_FDCWD, to, st.st_dev, UID_INVALID, GID_INVALID, copy_flags); + return fd_copy_directory(AT_FDCWD, from, &st, AT_FDCWD, to, st.st_dev, COPY_DEPTH_MAX, UID_INVALID, GID_INVALID, copy_flags); } int copy_file_fd(const char *from, int fdt, CopyFlags copy_flags) { @@ -684,55 +719,31 @@ int copy_file(const char *from, const char *to, int flags, mode_t mode, unsigned } int copy_file_atomic(const char *from, const char *to, mode_t mode, unsigned chattr_flags, CopyFlags copy_flags) { - _cleanup_(unlink_and_freep) char *t = NULL; - _cleanup_close_ int fdt = -1; + _cleanup_free_ char *t = NULL; int r; assert(from); assert(to); - /* We try to use O_TMPFILE here to create the file if we can. Note that that only works if COPY_REPLACE is not - * set though as we need to use linkat() for linking the O_TMPFILE file into the file system but that system - * call can't replace existing files. Hence, if COPY_REPLACE is set we create a temporary name in the file - * system right-away and unconditionally which we then can renameat() to the right name after we completed - * writing it. */ - - if (copy_flags & COPY_REPLACE) { - r = tempfn_random(to, NULL, &t); - if (r < 0) - return r; - - fdt = open(t, O_CREAT|O_EXCL|O_NOFOLLOW|O_NOCTTY|O_WRONLY|O_CLOEXEC, 0600); - if (fdt < 0) { - t = mfree(t); - return -errno; - } - } else { - fdt = open_tmpfile_linkable(to, O_WRONLY|O_CLOEXEC, &t); - if (fdt < 0) - return fdt; - } - - if (chattr_flags != 0) - (void) chattr_fd(fdt, chattr_flags, (unsigned) -1); - - r = copy_file_fd(from, fdt, copy_flags); + r = tempfn_random(to, NULL, &t); if (r < 0) return r; - if (fchmod(fdt, mode) < 0) - return -errno; + r = copy_file(from, t, O_NOFOLLOW|O_EXCL, mode, chattr_flags, copy_flags); + if (r < 0) + return r; if (copy_flags & COPY_REPLACE) { - if (renameat(AT_FDCWD, t, AT_FDCWD, to) < 0) - return -errno; - } else { - r = link_tmpfile(fdt, t, to); + r = renameat(AT_FDCWD, t, AT_FDCWD, to); if (r < 0) - return r; + r = -errno; + } else + r = rename_noreplace(AT_FDCWD, t, AT_FDCWD, to); + if (r < 0) { + (void) unlink(t); + return r; } - t = mfree(t); return 0; }