X-Git-Url: https://www.chiark.greenend.org.uk/ucgi/~ianmdlvl/git?p=elogind.git;a=blobdiff_plain;f=udev-remove.c;h=7ad7c2402a8e05f77d23a1451ab9b891372a8116;hp=c20c651dc53687056d701c0a8714a7f5d39f3b9b;hb=9825617b078c2122d130676e934ce21714b60e8b;hpb=50e5de03d16be3e35e65cdf65f552807ad24e996

diff --git a/udev-remove.c b/udev-remove.c
index c20c651dc..7ad7c2402 100644
--- a/udev-remove.c
+++ b/udev-remove.c
@@ -29,8 +29,8 @@
 #include <errno.h>
 
 #include "udev.h"
+#include "udev_lib.h"
 #include "udev_version.h"
-#include "udev_dbus.h"
 #include "logging.h"
 #include "namedev.h"
 #include "udevdb.h"
@@ -51,6 +51,8 @@ static int delete_path(char *path)
 
 		/* remove if empty */
 		retval = rmdir(path);
+		if (errno == ENOENT)
+			retval = 0;
 		if (retval) {
 			if (errno == ENOTEMPTY)
 				return 0;
@@ -63,32 +65,66 @@ static int delete_path(char *path)
 	return 0;
 }
 
-static int delete_node(struct udevice *dev)
+/** Remove all permissions on the device node, before
+  * unlinking it. This fixes a security issue.
+  * If the user created a hard-link to the device node,
+  * he can't use it any longer, because he lost permission
+  * to do so.
+  */
+static int secure_unlink(const char *filename)
 {
-	char filename[255];
-	char partitionname[255];
-	char *symlinks;
-	char *linkname;
 	int retval;
-	int i;
 
-	strncpy(filename, udev_root, sizeof(filename));
-	strncat(filename, dev->name, sizeof(filename));
-
-	info("removing device node '%s'", filename);
+	retval = chown(filename, 0, 0);
+	if (retval) {
+		dbg("chown(%s, 0, 0) failed with error '%s'",
+		    filename, strerror(errno));
+		/* We continue nevertheless.
+		 * I think it's very unlikely for chown
+		 * to fail here, if the file exists.
+		 */
+	}
+	retval = chmod(filename, 0000);
+	if (retval) {
+		dbg("chmod(%s, 0000) failed with error '%s'",
+		    filename, strerror(errno));
+		/* We continue nevertheless. */
+	}
 	retval = unlink(filename);
+	if (errno == ENOENT)
+		retval = 0;
 	if (retval) {
 		dbg("unlink(%s) failed with error '%s'",
 			filename, strerror(errno));
-		return retval;
 	}
+	return retval;
+}
+
+static int delete_node(struct udevice *dev)
+{
+	char filename[NAME_SIZE];
+	char linkname[NAME_SIZE];
+	char partitionname[NAME_SIZE];
+	int retval;
+	int i;
+	char *pos;
+	int len;
+
+	strfieldcpy(filename, udev_root);
+	strfieldcat(filename, dev->name);
+
+	info("removing device node '%s'", filename);
+	retval = secure_unlink(filename);
+	if (retval)
+		return retval;
 
 	/* remove partition nodes */
 	if (dev->partitions > 0) {
 		info("removing partitions '%s[1-%i]'", filename, dev->partitions);
 		for (i = 1; i <= dev->partitions; i++) {
-			sprintf(partitionname, "%s%i", filename, i);
-			unlink(partitionname);
+			strfieldcpy(partitionname, filename);
+			strintcat(partitionname, i);
+			secure_unlink(partitionname);
 		}
 	}
 
@@ -96,26 +132,22 @@ static int delete_node(struct udevice *dev)
 	if (strchr(dev->name, '/'))
 		delete_path(filename);
 
-	if (dev->symlink[0] != '\0') {
-		symlinks = dev->symlink;
-		while (1) {
-			linkname = strsep(&symlinks, " ");
-			if (linkname == NULL)
-				break;
-
-			strncpy(filename, udev_root, sizeof(filename));
-			strncat(filename, linkname, sizeof(filename));
-
-			dbg("unlinking symlink '%s'", filename);
-			retval = unlink(filename);
-			if (retval) {
-				dbg("unlink(%s) failed with error '%s'",
-					filename, strerror(errno));
-				return retval;
-			}
-			if (strchr(dev->symlink, '/')) {
-				delete_path(filename);
-			}
+	foreach_strpart(dev->symlink, " ", pos, len) {
+		strfieldcpymax(linkname, pos, len+1);
+		strfieldcpy(filename, udev_root);
+		strfieldcat(filename, linkname);
+
+		dbg("unlinking symlink '%s'", filename);
+		retval = unlink(filename);
+		if (errno == ENOENT)
+			retval = 0;
+		if (retval) {
+			dbg("unlink(%s) failed with error '%s'",
+				filename, strerror(errno));
+			return retval;
+		}
+		if (strchr(dev->symlink, '/')) {
+			delete_path(filename);
 		}
 	}
 
@@ -127,28 +159,32 @@ static int delete_node(struct udevice *dev)
  * something different from the kernel name.  If we have, us it.  If not, use
  * the default kernel name for lack of anything else to know to do.
  */
-int udev_remove_device(char *path, char *subsystem)
+int udev_remove_device(const char *path, const char *subsystem)
 {
 	struct udevice dev;
 	char *temp;
 	int retval;
 
-	memset(&dev, 0, sizeof(dev));
+	memset(&dev, 0x00, sizeof(dev));
 
 	retval = udevdb_get_dev(path, &dev);
-	if (retval) {
+	if (retval != 0) {
 		dbg("'%s' not found in database, falling back on default name", path);
 		temp = strrchr(path, '/');
 		if (temp == NULL)
 			return -ENODEV;
-		strncpy(dev.name, &temp[1], sizeof(dev.name));
+		strfieldcpy(dev.name, &temp[1]);
 	}
+	dbg("name='%s'", dev.name);
 
-	dbg("name is '%s'", dev.name);
+	dev.type = get_device_type(path, subsystem);
+	dev_d_send(&dev, subsystem, path);
 	udevdb_delete_dev(path);
 
-	sysbus_send_remove(dev.name, path);
+	if (dev.type == 'b' || dev.type == 'c')
+		retval = delete_node(&dev);
+	else if (dev.type == 'n')
+		retval = 0;
 
-	retval = delete_node(&dev);
 	return retval;
 }