2 Unix SMB/CIFS implementation.
4 POSIX NTVFS backend - pvfs_sys wrappers
6 Copyright (C) Andrew Tridgell 2010
7 Copyright (C) Andrew Bartlett 2010
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
24 #include "vfs_posix.h"
25 #include "../lib/util/unix_privs.h"
28 these wrapper functions must only be called when the appropriate ACL
29 has already been checked. The wrappers will override a EACCES result
30 by gaining root privileges if the 'pvfs:perm override' is set on the
31 share (it is enabled by default)
33 Careful use of O_NOFOLLOW and O_DIRECTORY is used to prevent
34 security attacks via symlinks
39 struct pvfs_state
*pvfs
;
47 we create PVFS_NOFOLLOW and PVFS_DIRECTORY as aliases for O_NOFOLLOW
48 and O_DIRECTORY on systems that have them. On systems that don't
49 have O_NOFOLLOW we are less safe, but the root override code is off
53 #define PVFS_NOFOLLOW O_NOFOLLOW
55 #define PVFS_NOFOLLOW 0
58 #define PVFS_DIRECTORY O_DIRECTORY
60 #define PVFS_DIRECTORY 0
64 return to original directory when context is destroyed
66 static int pvfs_sys_pushdir_destructor(struct pvfs_sys_ctx
*ctx
)
70 if (ctx
->old_wd
== NULL
) {
74 if (chdir(ctx
->old_wd
) != 0) {
75 smb_panic("Failed to restore working directory");
77 if (stat(".", &st
) != 0) {
78 smb_panic("Failed to stat working directory");
80 if (st
.st_ino
!= ctx
->st_orig
.st_ino
||
81 st
.st_dev
!= ctx
->st_orig
.st_dev
) {
82 smb_panic("Working directory changed during call");
90 chdir() to the directory part of a pathname, but disallow any
91 component with a symlink
93 Note that we can't use O_NOFOLLOW on the whole path as that only
94 prevents links in the final component of the path
96 static int pvfs_sys_chdir_nosymlink(struct pvfs_sys_ctx
*ctx
, const char *pathname
)
99 size_t base_len
= strlen(ctx
->pvfs
->base_directory
);
101 /* don't check for symlinks in the base directory of the share */
102 if (strncmp(ctx
->pvfs
->base_directory
, pathname
, base_len
) == 0 &&
103 pathname
[base_len
] == '/') {
104 if (chdir(ctx
->pvfs
->base_directory
) != 0) {
107 pathname
+= base_len
+ 1;
110 path
= talloc_strdup(ctx
, pathname
);
114 while ((p
= strchr(path
, '/'))) {
116 struct stat st1
, st2
;
118 fd
= open(path
, PVFS_NOFOLLOW
| PVFS_DIRECTORY
| O_RDONLY
);
122 if (chdir(path
) != 0) {
126 if (stat(".", &st1
) != 0 ||
127 fstat(fd
, &st2
) != 0) {
132 if (st1
.st_ino
!= st2
.st_ino
||
133 st1
.st_dev
!= st2
.st_dev
) {
134 DEBUG(0,(__location__
": Inode changed during chdir in '%s' - symlink attack?",
146 become root, and change directory to the directory component of a
147 path. Return a talloc context which when freed will move us back
148 to the original directory, and return us to the original uid
150 change the pathname argument to contain just the base component of
153 return NULL on error, which could include an attempt to subvert
154 security using symlink tricks
156 static struct pvfs_sys_ctx
*pvfs_sys_pushdir(struct pvfs_state
*pvfs
,
157 const char **pathname
)
159 struct pvfs_sys_ctx
*ctx
;
160 char *cwd
, *p
, *dirname
;
163 ctx
= talloc_zero(pvfs
, struct pvfs_sys_ctx
);
168 ctx
->privs
= root_privileges();
169 if (ctx
->privs
== NULL
) {
174 talloc_steal(ctx
, ctx
->privs
);
177 /* no pathname needed */
181 p
= strrchr(*pathname
, '/');
183 /* we don't need to change directory */
187 /* we keep the old st around, so we can tell that
188 we have come back to the right directory */
189 if (stat(".", &ctx
->st_orig
) != 0) {
194 cwd
= get_current_dir_name();
200 ctx
->old_wd
= talloc_strdup(ctx
, cwd
);
203 if (ctx
->old_wd
== NULL
) {
208 dirname
= talloc_strndup(ctx
, *pathname
, (p
- *pathname
));
209 if (dirname
== NULL
) {
214 ret
= pvfs_sys_chdir_nosymlink(ctx
, *pathname
);
220 talloc_set_destructor(ctx
, pvfs_sys_pushdir_destructor
);
222 /* return the basename as the filename that should be operated on */
223 (*pathname
) = talloc_strdup(ctx
, p
+1);
234 chown a file that we created with a root privileges override
236 static int pvfs_sys_fchown(struct pvfs_state
*pvfs
, struct pvfs_sys_ctx
*ctx
, int fd
)
238 return fchown(fd
, root_privileges_original_uid(ctx
->privs
), -1);
242 chown a directory that we created with a root privileges override
244 static int pvfs_sys_chown(struct pvfs_state
*pvfs
, struct pvfs_sys_ctx
*ctx
, const char *name
)
246 /* to avoid symlink hacks, we need to use fchown() on a directory fd */
248 fd
= open(name
, PVFS_DIRECTORY
| PVFS_NOFOLLOW
| O_RDONLY
);
252 ret
= pvfs_sys_fchown(pvfs
, ctx
, fd
);
259 wrap open for system override
261 int pvfs_sys_open(struct pvfs_state
*pvfs
, const char *filename
, int flags
, mode_t mode
, bool allow_override
)
264 struct pvfs_sys_ctx
*ctx
;
265 int saved_errno
, orig_errno
;
270 fd
= open(filename
, flags
, mode
);
278 ctx
= pvfs_sys_pushdir(pvfs
, &filename
);
284 /* don't allow permission overrides to follow links */
285 flags
|= PVFS_NOFOLLOW
;
288 if O_CREAT was specified and O_EXCL was not specified
289 then initially do the open without O_CREAT, as in that case
290 we know that we did not create the file, so we don't have
293 if ((flags
& O_CREAT
) && !(flags
& O_EXCL
)) {
295 fd
= open(filename
, flags
& ~O_CREAT
, mode
);
296 /* if this open succeeded, or if it failed
297 with anything other than ENOENT, then we return the
298 open result, with the original errno */
299 if (fd
== -1 && errno
!= ENOENT
) {
305 /* the file already existed and we opened it */
311 fd
= open(filename
, flags
| O_EXCL
, mode
);
312 if (fd
== -1 && errno
!= EEXIST
) {
318 /* we created the file, we need to set the
319 right ownership on it */
320 ret
= pvfs_sys_fchown(pvfs
, ctx
, fd
);
333 /* the file got created between the two times
334 we tried to open it! Try again */
344 fd
= open(filename
, flags
, mode
);
351 /* if we have created a file then fchown it */
352 if (flags
& O_CREAT
) {
353 ret
= pvfs_sys_fchown(pvfs
, ctx
, fd
);
369 wrap unlink for system override
371 int pvfs_sys_unlink(struct pvfs_state
*pvfs
, const char *filename
, bool allow_override
)
374 struct pvfs_sys_ctx
*ctx
;
375 int saved_errno
, orig_errno
;
379 ret
= unlink(filename
);
388 ctx
= pvfs_sys_pushdir(pvfs
, &filename
);
394 ret
= unlink(filename
);
407 static bool contains_symlink(const char *path
)
409 int fd
= open(path
, PVFS_NOFOLLOW
| O_RDONLY
);
410 int posix_errno
= errno
;
416 #if defined(ENOTSUP) && defined(OSF1)
417 /* handle special Tru64 errno */
418 if (errno
== ENOTSUP
) {
424 /* fix broken NetBSD errno */
425 if (errno
== EFTYPE
) {
430 /* fix broken FreeBSD errno */
431 if (errno
== EMLINK
) {
435 return (posix_errno
== ELOOP
);
439 wrap rename for system override
441 int pvfs_sys_rename(struct pvfs_state
*pvfs
, const char *name1
, const char *name2
, bool allow_override
)
444 struct pvfs_sys_ctx
*ctx
;
445 int saved_errno
, orig_errno
;
449 ret
= rename(name1
, name2
);
458 ctx
= pvfs_sys_pushdir(pvfs
, &name1
);
464 /* we need the destination as an absolute path */
465 if (name2
[0] != '/') {
466 name2
= talloc_asprintf(ctx
, "%s/%s", ctx
->old_wd
, name2
);
474 /* make sure the destination isn't a symlink beforehand */
475 if (contains_symlink(name2
)) {
481 ret
= rename(name1
, name2
);
488 /* make sure the destination isn't a symlink afterwards */
489 if (contains_symlink(name2
)) {
490 DEBUG(0,(__location__
": Possible symlink attack in rename to '%s' - unlinking\n", name2
));
504 wrap mkdir for system override
506 int pvfs_sys_mkdir(struct pvfs_state
*pvfs
, const char *dirname
, mode_t mode
, bool allow_override
)
509 struct pvfs_sys_ctx
*ctx
;
510 int saved_errno
, orig_errno
;
514 ret
= mkdir(dirname
, mode
);
522 ctx
= pvfs_sys_pushdir(pvfs
, &dirname
);
528 ret
= mkdir(dirname
, mode
);
535 ret
= pvfs_sys_chown(pvfs
, ctx
, dirname
);
550 wrap rmdir for system override
552 int pvfs_sys_rmdir(struct pvfs_state
*pvfs
, const char *dirname
, bool allow_override
)
555 struct pvfs_sys_ctx
*ctx
;
556 int saved_errno
, orig_errno
;
560 ret
= rmdir(dirname
);
569 ctx
= pvfs_sys_pushdir(pvfs
, &dirname
);
575 ret
= rmdir(dirname
);
588 wrap fchmod for system override
590 int pvfs_sys_fchmod(struct pvfs_state
*pvfs
, int fd
, mode_t mode
, bool allow_override
)
593 struct pvfs_sys_ctx
*ctx
;
594 int saved_errno
, orig_errno
;
598 ret
= fchmod(fd
, mode
);
607 ctx
= pvfs_sys_pushdir(pvfs
, NULL
);
613 ret
= fchmod(fd
, mode
);
627 wrap chmod for system override
629 int pvfs_sys_chmod(struct pvfs_state
*pvfs
, const char *filename
, mode_t mode
, bool allow_override
)
632 struct pvfs_sys_ctx
*ctx
;
633 int saved_errno
, orig_errno
;
637 ret
= chmod(filename
, mode
);
646 ctx
= pvfs_sys_pushdir(pvfs
, &filename
);
652 ret
= chmod(filename
, mode
);