1 /* shred.c - overwrite files and devices to make it harder to recover data
3 Copyright (C) 1999-2023 Free Software Foundation, Inc.
4 Copyright (C) 1997, 1998, 1999 Colin Plumb.
6 This program is free software: you can redistribute it and/or modify
7 it under the terms of the GNU General Public License as published by
8 the Free Software Foundation, either version 3 of the License, or
9 (at your option) any later version.
11 This program is distributed in the hope that it will be useful,
12 but WITHOUT ANY WARRANTY; without even the implied warranty of
13 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 GNU General Public License for more details.
16 You should have received a copy of the GNU General Public License
17 along with this program. If not, see <https://www.gnu.org/licenses/>.
19 Written by Colin Plumb. */
22 * Do a more secure overwrite of given files or devices, to make it harder
23 * for even very expensive hardware probing to recover the data.
25 * Although this process is also known as "wiping", I prefer the longer
26 * name both because I think it is more evocative of what is happening and
27 * because a longer name conveys a more appropriate sense of deliberateness.
29 * For the theory behind this, see "Secure Deletion of Data from Magnetic
30 * and Solid-State Memory", on line at
31 * https://www.cs.auckland.ac.nz/~pgut001/pubs/secure_del.html
33 * Just for the record, reversing one or two passes of disk overwrite
34 * is not terribly difficult with hardware help. Hook up a good-quality
35 * digitizing oscilloscope to the output of the head preamplifier and copy
36 * the high-res digitized data to a computer for some off-line analysis.
37 * Read the "current" data and average all the pulses together to get an
38 * "average" pulse on the disk. Subtract this average pulse from all of
39 * the actual pulses and you can clearly see the "echo" of the previous
42 * Real hard drives have to balance the cost of the media, the head,
43 * and the read circuitry. They use better-quality media than absolutely
44 * necessary to limit the cost of the read circuitry. By throwing that
45 * assumption out, and the assumption that you want the data processed
46 * as fast as the hard drive can spin, you can do better.
48 * If asked to wipe a file, this also unlinks it, renaming it in a
49 * clever way to try to leave no trace of the original filename.
51 * This was inspired by a desire to improve on some code titled:
52 * Wipe V1.0-- Overwrite and delete files. S. 2/3/96
53 * but I've rewritten everything here so completely that no trace of
54 * the original remains.
57 * Bob Jenkins, for his good RNG work and patience with the FSF copyright
59 * Jim Meyering, for his work merging this into the GNU fileutils while
60 * still letting me feel a sense of ownership and pride. Getting me to
61 * tolerate the GNU brace style was quite a feat of diplomacy.
62 * Paul Eggert, for lots of useful discussion and code. I disagree with
63 * an awful lot of his suggestions, but they're disagreements worth having.
65 * Things to think about:
66 * - Security: Is there any risk to the race
67 * between overwriting and unlinking a file? Will it do anything
68 * drastically bad if told to attack a named pipe or socket?
71 /* The official name of this program (e.g., no 'g' prefix). */
72 #define PROGRAM_NAME "shred"
74 #define AUTHORS proper_name ("Colin Plumb")
81 #include <sys/types.h>
82 #if defined __linux__ && HAVE_SYS_MTIO_H
83 # include <sys/mtio.h>
87 #include "alignalloc.h"
90 #include "xdectoint.h"
95 #include "renameatu.h"
96 #include "stat-size.h"
98 /* Default number of times to overwrite. */
99 enum { DEFAULT_PASSES
= 3 };
101 /* How many seconds to wait before checking whether to output another
102 verbose output line. */
103 enum { VERBOSE_UPDATE
= 5 };
105 /* Sector size and corresponding mask, for recovering after write failures.
106 The size must be a power of 2. */
107 enum { SECTOR_SIZE
= 512 };
108 enum { SECTOR_MASK
= SECTOR_SIZE
- 1 };
109 static_assert (0 < SECTOR_SIZE
&& (SECTOR_SIZE
& SECTOR_MASK
) == 0);
113 remove_none
= 0, /* the default: only wipe data. */
114 remove_unlink
, /* don't obfuscate name, just unlink. */
115 remove_wipe
, /* obfuscate name before unlink. */
116 remove_wipesync
/* obfuscate name, syncing each byte, before unlink. */
119 static char const *const remove_args
[] =
121 "unlink", "wipe", "wipesync", nullptr
124 static enum remove_method
const remove_methods
[] =
126 remove_unlink
, remove_wipe
, remove_wipesync
131 bool force
; /* -f flag: chmod files if necessary */
132 size_t n_iterations
; /* -n flag: Number of iterations */
133 off_t size
; /* -s flag: size of file */
134 enum remove_method remove_file
; /* -u flag: remove file after shredding */
135 bool verbose
; /* -v flag: Print progress */
136 bool exact
; /* -x flag: Do not round up file size */
137 bool zero_fill
; /* -z flag: Add a final zero pass */
140 /* For long options that have no equivalent short option, use a
141 non-character as a pseudo short option, starting with CHAR_MAX + 1. */
144 RANDOM_SOURCE_OPTION
= CHAR_MAX
+ 1
147 static struct option
const long_opts
[] =
149 {"exact", no_argument
, nullptr, 'x'},
150 {"force", no_argument
, nullptr, 'f'},
151 {"iterations", required_argument
, nullptr, 'n'},
152 {"size", required_argument
, nullptr, 's'},
153 {"random-source", required_argument
, nullptr, RANDOM_SOURCE_OPTION
},
154 {"remove", optional_argument
, nullptr, 'u'},
155 {"verbose", no_argument
, nullptr, 'v'},
156 {"zero", no_argument
, nullptr, 'z'},
157 {GETOPT_HELP_OPTION_DECL
},
158 {GETOPT_VERSION_OPTION_DECL
},
159 {nullptr, 0, nullptr, 0}
165 if (status
!= EXIT_SUCCESS
)
169 printf (_("Usage: %s [OPTION]... FILE...\n"), program_name
);
171 Overwrite the specified FILE(s) repeatedly, in order to make it harder\n\
172 for even very expensive hardware probing to recover the data.\n\
176 If FILE is -, shred standard output.\n\
179 emit_mandatory_arg_note ();
182 -f, --force change permissions to allow writing if necessary\n\
183 -n, --iterations=N overwrite N times instead of the default (%d)\n\
184 --random-source=FILE get random bytes from FILE\n\
185 -s, --size=N shred this many bytes (suffixes like K, M, G accepted)\n\
188 -u deallocate and remove file after overwriting\n\
189 --remove[=HOW] like -u but give control on HOW to delete; See below\n\
190 -v, --verbose show progress\n\
191 -x, --exact do not round file sizes up to the next full block;\n\
192 this is the default for non-regular files\n\
193 -z, --zero add a final overwrite with zeros to hide shredding\n\
195 fputs (HELP_OPTION_DESCRIPTION
, stdout
);
196 fputs (VERSION_OPTION_DESCRIPTION
, stdout
);
199 Delete FILE(s) if --remove (-u) is specified. The default is not to remove\n\
200 the files because it is common to operate on device files like /dev/hda,\n\
201 and those files usually should not be removed.\n\
202 The optional HOW parameter indicates how to remove a directory entry:\n\
203 'unlink' => use a standard unlink call.\n\
204 'wipe' => also first obfuscate bytes in the name.\n\
205 'wipesync' => also sync each obfuscated byte to the device.\n\
206 The default mode is 'wipesync', but note it can be expensive.\n\
210 CAUTION: shred assumes the file system and hardware overwrite data in place.\n\
211 Although this is common, many platforms operate otherwise. Also, backups\n\
212 and mirrors may contain unremovable copies that will let a shredded file\n\
213 be recovered later. See the GNU coreutils manual for details.\n\
215 emit_ancillary_info (PROGRAM_NAME
);
221 * Determine if pattern type is periodic or not.
224 periodic_pattern (int type
)
230 unsigned int bits
= type
& 0xfff;
233 r
[0] = (bits
>> 4) & 255;
234 r
[1] = (bits
>> 8) & 255;
237 return (r
[0] != r
[1]) || (r
[0] != r
[2]);
241 * Fill a buffer with a fixed pattern.
243 * The buffer must be at least 3 bytes long, even if
244 * size is less. Larger sizes are filled exactly.
247 fillpattern (int type
, unsigned char *r
, size_t size
)
250 unsigned int bits
= type
& 0xfff;
253 r
[0] = (bits
>> 4) & 255;
254 r
[1] = (bits
>> 8) & 255;
256 for (i
= 3; i
<= size
/ 2; i
*= 2)
257 memcpy (r
+ i
, r
, i
);
259 memcpy (r
+ i
, r
, size
- i
);
261 /* Invert the first bit of every sector. */
263 for (i
= 0; i
< size
; i
+= SECTOR_SIZE
)
268 * Generate a 6-character (+ nul) pass name string
269 * FIXME: allow translation of "random".
271 #define PASS_NAME_SIZE 7
273 passname (unsigned char const *data
, char name
[PASS_NAME_SIZE
])
276 sprintf (name
, "%02x%02x%02x", data
[0], data
[1], data
[2]);
278 memcpy (name
, "random", PASS_NAME_SIZE
);
281 /* Return true when it's ok to ignore an fsync or fdatasync
282 failure that set errno to ERRNO_VAL. */
284 ignorable_sync_errno (int errno_val
)
286 return (errno_val
== EINVAL
287 || errno_val
== EBADF
288 /* HP-UX does this */
289 || errno_val
== EISDIR
);
292 /* Request that all data for FD be transferred to the corresponding
293 storage device. QNAME is the file name (quoted for colons).
294 Report any errors found. Return 0 on success, -1
295 (setting errno) on failure. It is not an error if fdatasync and/or
296 fsync is not supported for this file, or if the file is not a
297 writable file descriptor. */
299 dosync (int fd
, char const *qname
)
304 if (fdatasync (fd
) == 0)
307 if ( ! ignorable_sync_errno (err
))
309 error (0, err
, _("%s: fdatasync failed"), qname
);
318 if ( ! ignorable_sync_errno (err
))
320 error (0, err
, _("%s: fsync failed"), qname
);
329 /* Turn on or off direct I/O mode for file descriptor FD, if possible.
330 Try to turn it on if ENABLE is true. Otherwise, try to turn it off. */
332 direct_mode (int fd
, bool enable
)
336 int fd_flags
= fcntl (fd
, F_GETFL
);
339 int new_flags
= (enable
340 ? (fd_flags
| O_DIRECT
)
341 : (fd_flags
& ~O_DIRECT
));
342 if (new_flags
!= fd_flags
)
343 fcntl (fd
, F_SETFL
, new_flags
);
347 #if HAVE_DIRECTIO && defined DIRECTIO_ON && defined DIRECTIO_OFF
348 /* This is Solaris-specific. */
349 directio (fd
, enable
? DIRECTIO_ON
: DIRECTIO_OFF
);
353 /* Rewind FD; its status is ST. */
355 dorewind (int fd
, struct stat
const *st
)
357 if (S_ISCHR (st
->st_mode
))
359 #if defined __linux__ && HAVE_SYS_MTIO_H
360 /* In the Linux kernel, lseek does not work on tape devices; it
361 returns a randomish value instead. Try the low-level tape
362 rewind operation first. */
366 if (ioctl (fd
, MTIOCTOP
, &op
) == 0)
370 off_t offset
= lseek (fd
, 0, SEEK_SET
);
376 /* By convention, negative sizes represent unknown values. */
385 * Do pass number K of N, writing *SIZEP bytes of the given pattern TYPE
386 * to the file descriptor FD. K and N are passed in only for verbose
387 * progress message purposes. If N == 0, no progress messages are printed.
389 * If *SIZEP == -1, the size is unknown, and it will be filled in as soon
390 * as writing fails with ENOSPC.
392 * Return 1 on write error, -1 on other error, 0 on success.
395 dopass (int fd
, struct stat
const *st
, char const *qname
, off_t
*sizep
,
396 int type
, struct randread_source
*s
,
397 unsigned long int k
, unsigned long int n
)
400 off_t offset
; /* Current file position */
401 time_t thresh
IF_LINT ( = 0); /* Time to maybe print next status update */
402 time_t now
= 0; /* Current time */
403 size_t lim
; /* Amount of data to try writing */
404 size_t soff
; /* Offset into buffer for next write */
405 ssize_t ssize
; /* Return value from write */
407 /* Fill pattern buffer. Aligning it to a page so we can do direct I/O. */
408 size_t page_size
= getpagesize ();
409 #define PERIODIC_OUTPUT_SIZE (60 * 1024)
410 #define NONPERIODIC_OUTPUT_SIZE (64 * 1024)
411 static_assert (PERIODIC_OUTPUT_SIZE
% 3 == 0);
412 size_t output_size
= periodic_pattern (type
)
413 ? PERIODIC_OUTPUT_SIZE
: NONPERIODIC_OUTPUT_SIZE
;
414 #define FILLPATTERN_SIZE (((output_size + 2) / 3) * 3) /* Multiple of 3 */
415 unsigned char *pbuf
= xalignalloc (page_size
, FILLPATTERN_SIZE
);
417 char pass_string
[PASS_NAME_SIZE
]; /* Name of current pass */
418 bool write_error
= false;
419 bool other_error
= false;
421 /* Printable previous offset into the file */
422 char previous_offset_buf
[LONGEST_HUMAN_READABLE
+ 1];
423 char const *previous_human_offset
;
425 /* As a performance tweak, avoid direct I/O for small sizes,
426 as it's just a performance rather then security consideration,
427 and direct I/O can often be unsupported for small non aligned sizes. */
428 bool try_without_directio
= 0 < size
&& size
< output_size
;
429 if (! try_without_directio
)
430 direct_mode (fd
, true);
432 if (! dorewind (fd
, st
))
434 error (0, errno
, _("%s: cannot rewind"), qname
);
436 goto free_pattern_mem
;
439 /* Constant fill patterns need only be set up once. */
442 lim
= known (size
) && size
< FILLPATTERN_SIZE
? size
: FILLPATTERN_SIZE
;
443 fillpattern (type
, pbuf
, lim
);
444 passname (pbuf
, pass_string
);
448 passname (0, pass_string
);
451 /* Set position if first status update */
454 error (0, 0, _("%s: pass %lu/%lu (%s)..."), qname
, k
, n
, pass_string
);
455 thresh
= time (nullptr) + VERBOSE_UPDATE
;
456 previous_human_offset
= "";
462 /* How much to write this time? */
464 if (known (size
) && size
- offset
< output_size
)
473 randread (s
, pbuf
, lim
);
474 /* Loop to retry partial writes. */
475 for (soff
= 0; soff
< lim
; soff
+= ssize
)
477 ssize
= write (fd
, pbuf
+ soff
, lim
- soff
);
480 if (! known (size
) && (ssize
== 0 || errno
== ENOSPC
))
482 /* We have found the end of the file. */
483 if (soff
<= OFF_T_MAX
- offset
)
484 *sizep
= size
= offset
+ soff
;
490 char buf
[INT_BUFSIZE_BOUND (uintmax_t)];
492 /* Retry without direct I/O since this may not be supported
493 at all on some (file) systems, or with the current size.
494 I.e., a specified --size that is not aligned, or when
495 dealing with slop at the end of a file with --exact. */
496 if (! try_without_directio
&& errno
== EINVAL
)
498 direct_mode (fd
, false);
500 try_without_directio
= true;
503 error (0, errnum
, _("%s: error writing at offset %s"),
504 qname
, umaxtostr (offset
+ soff
, buf
));
506 /* 'shred' is often used on bad media, before throwing it
507 out. Thus, it shouldn't give up on bad blocks. This
508 code works because lim is always a multiple of
509 SECTOR_SIZE, except at the end. This size constraint
510 also enables direct I/O on some (file) systems. */
511 static_assert (PERIODIC_OUTPUT_SIZE
% SECTOR_SIZE
== 0);
512 static_assert (NONPERIODIC_OUTPUT_SIZE
% SECTOR_SIZE
== 0);
513 if (errnum
== EIO
&& known (size
)
514 && (soff
| SECTOR_MASK
) < lim
)
516 size_t soff1
= (soff
| SECTOR_MASK
) + 1;
517 if (lseek (fd
, offset
+ soff1
, SEEK_SET
) != -1)
519 /* Arrange to skip this block. */
520 ssize
= soff1
- soff
;
524 error (0, errno
, _("%s: lseek failed"), qname
);
527 goto free_pattern_mem
;
532 /* Okay, we have written "soff" bytes. */
534 if (OFF_T_MAX
- offset
< soff
)
536 error (0, 0, _("%s: file too large"), qname
);
538 goto free_pattern_mem
;
543 bool done
= offset
== size
;
545 /* Time to print progress? */
546 if (n
&& ((done
&& *previous_human_offset
)
547 || thresh
<= (now
= time (nullptr))))
549 char offset_buf
[LONGEST_HUMAN_READABLE
+ 1];
550 char size_buf
[LONGEST_HUMAN_READABLE
+ 1];
551 int human_progress_opts
= (human_autoscale
| human_SI
552 | human_base_1024
| human_B
);
553 char const *human_offset
554 = human_readable (offset
, offset_buf
,
555 human_floor
| human_progress_opts
, 1, 1);
557 if (done
|| !STREQ (previous_human_offset
, human_offset
))
560 error (0, 0, _("%s: pass %lu/%lu (%s)...%s"),
561 qname
, k
, n
, pass_string
, human_offset
);
564 uintmax_t off
= offset
;
565 int percent
= (size
== 0
567 : (off
<= TYPE_MAXIMUM (uintmax_t) / 100
569 : off
/ (size
/ 100)));
570 char const *human_size
571 = human_readable (size
, size_buf
,
572 human_ceiling
| human_progress_opts
,
575 human_offset
= human_size
;
576 error (0, 0, _("%s: pass %lu/%lu (%s)...%s/%s %d%%"),
577 qname
, k
, n
, pass_string
, human_offset
, human_size
,
581 strcpy (previous_offset_buf
, human_offset
);
582 previous_human_offset
= previous_offset_buf
;
583 thresh
= now
+ VERBOSE_UPDATE
;
586 * Force periodic syncs to keep displayed progress accurate
587 * FIXME: Should these be present even if -v is not enabled,
588 * to keep the buffer cache from filling with dirty pages?
589 * It's a common problem with programs that do lots of writes,
592 if (dosync (fd
, qname
) != 0)
597 goto free_pattern_mem
;
605 /* Force what we just wrote to hit the media. */
606 if (dosync (fd
, qname
) != 0)
611 goto free_pattern_mem
;
619 return other_error
? -1 : write_error
;
623 * The passes start and end with a random pass, and the passes in between
624 * are done in random order. The idea is to deprive someone trying to
625 * reverse the process of knowledge of the overwrite patterns, so they
626 * have the additional step of figuring out what was done to the device
627 * before they can try to reverse or cancel it.
629 * First, all possible 1-bit patterns. There are two of them.
630 * Then, all possible 2-bit patterns. There are four, but the two
631 * which are also 1-bit patterns can be omitted.
632 * Then, all possible 3-bit patterns. Likewise, 8-2 = 6.
633 * Then, all possible 4-bit patterns. 16-4 = 12.
635 * The basic passes are:
636 * 1-bit: 0x000, 0xFFF
637 * 2-bit: 0x555, 0xAAA
638 * 3-bit: 0x249, 0x492, 0x924, 0x6DB, 0xB6D, 0xDB6 (+ 1-bit)
639 * 100100100100 110110110110
641 * 4-bit: 0x111, 0x222, 0x333, 0x444, 0x666, 0x777,
642 * 0x888, 0x999, 0xBBB, 0xCCC, 0xDDD, 0xEEE (+ 1-bit, 2-bit)
643 * Adding three random passes at the beginning, middle and end
644 * produces the default 25-pass structure.
646 * The next extension would be to 5-bit and 6-bit patterns.
647 * There are 30 uncovered 5-bit patterns and 64-8-2 = 46 uncovered
648 * 6-bit patterns, so they would increase the time required
649 * significantly. 4-bit patterns are enough for most purposes.
651 * The main gotcha is that this would require a trickier encoding,
652 * since lcm(2,3,4) = 12 bits is easy to fit into an int, but
653 * lcm(2,3,4,5) = 60 bits is not.
655 * One extension that is included is to complement the first bit in each
656 * 512-byte block, to alter the phase of the encoded data in the more
657 * complex encodings. This doesn't apply to MFM, so the 1-bit patterns
658 * are considered part of the 3-bit ones and the 2-bit patterns are
659 * considered part of the 4-bit patterns.
662 * How does the generalization to variable numbers of passes work?
665 * Have an ordered list of groups of passes. Each group is a set.
666 * Take as many groups as will fit, plus a random subset of the
667 * last partial group, and place them into the passes list.
668 * Then shuffle the passes list into random order and use that.
670 * One extra detail: if we can't include a large enough fraction of the
671 * last group to be interesting, then just substitute random passes.
673 * If you want more passes than the entire list of groups can
674 * provide, just start repeating from the beginning of the list.
679 -2, /* 2 random passes */
680 2, 0x000, 0xFFF, /* 1-bit */
681 2, 0x555, 0xAAA, /* 2-bit */
682 -1, /* 1 random pass */
683 6, 0x249, 0x492, 0x6DB, 0x924, 0xB6D, 0xDB6, /* 3-bit */
684 12, 0x111, 0x222, 0x333, 0x444, 0x666, 0x777,
685 0x888, 0x999, 0xBBB, 0xCCC, 0xDDD, 0xEEE, /* 4-bit */
686 -1, /* 1 random pass */
687 /* The following patterns have the first bit per block flipped */
688 8, 0x1000, 0x1249, 0x1492, 0x16DB, 0x1924, 0x1B6D, 0x1DB6, 0x1FFF,
689 14, 0x1111, 0x1222, 0x1333, 0x1444, 0x1555, 0x1666, 0x1777,
690 0x1888, 0x1999, 0x1AAA, 0x1BBB, 0x1CCC, 0x1DDD, 0x1EEE,
691 -1, /* 1 random pass */
696 * Generate a random wiping pass pattern with num passes.
697 * This is a two-stage process. First, the passes to include
698 * are chosen, and then they are shuffled into the desired
702 genpattern (int *dest
, size_t num
, struct randint_source
*s
)
708 size_t accum
, top
, swap
;
714 /* Stage 1: choose the passes to use */
717 d
= dest
; /* Destination for generated pass list */
718 n
= num
; /* Passes remaining to fill */
722 k
= *p
++; /* Block descriptor word */
724 { /* Loop back to the beginning */
728 { /* -k random passes */
738 else if ((size_t) k
<= n
)
739 { /* Full block of patterns */
740 memcpy (d
, p
, k
* sizeof (int));
745 else if (n
< 2 || 3 * n
< (size_t) k
)
746 { /* Finish with random */
751 { /* Pad out with n of the k available */
754 if (n
== (size_t) k
|| randint_choose (s
, k
) < n
)
766 top
= num
- randpasses
; /* Top of initialized data */
767 /* affirm (d == dest + top); */
770 * We now have fixed patterns in the dest buffer up to
771 * "top", and we need to scramble them, with "randpasses"
772 * random passes evenly spaced among them.
774 * We want one at the beginning, one at the end, and
775 * evenly spaced in between. To do this, we basically
776 * use Bresenham's line draw (a.k.a DDA) algorithm
777 * to draw a line with slope (randpasses-1)/(num-1).
778 * (We use a positive accumulator and count down to
781 * So for each desired output value, we do the following:
782 * - If it should be a random pass, copy the pass type
783 * to top++, out of the way of the other passes, and
784 * set the current pass to -1 (random).
785 * - If it should be a normal pattern pass, choose an
786 * entry at random between here and top-1 (inclusive)
787 * and swap the current entry with that one.
789 randpasses
--; /* To speed up later math */
790 accum
= randpasses
; /* Bresenham DDA accumulator */
791 for (n
= 0; n
< num
; n
++)
793 if (accum
<= randpasses
)
796 dest
[top
++] = dest
[n
];
801 swap
= n
+ randint_choose (s
, top
- n
);
803 dest
[n
] = dest
[swap
];
808 /* affirm (top == num); */
812 * The core routine to actually do the work. This overwrites the first
813 * size bytes of the given fd. Return true if successful.
816 do_wipefd (int fd
, char const *qname
, struct randint_source
*s
,
817 struct Options
const *flags
)
821 off_t size
; /* Size to write, size to read */
822 off_t i_size
= 0; /* For small files, initial size to overwrite inode */
823 unsigned long int n
; /* Number of passes for printing purposes */
826 struct randread_source
*rs
;
828 n
= 0; /* dopass takes n == 0 to mean "don't print progress" */
830 n
= flags
->n_iterations
+ flags
->zero_fill
;
834 error (0, errno
, _("%s: fstat failed"), qname
);
838 /* If we know that we can't possibly shred the file, give up now.
839 Otherwise, we may go into an infinite loop writing data before we
840 find that we can't rewind the device. */
841 if ((S_ISCHR (st
.st_mode
) && isatty (fd
))
842 || S_ISFIFO (st
.st_mode
)
843 || S_ISSOCK (st
.st_mode
))
845 error (0, 0, _("%s: invalid file type"), qname
);
848 else if (S_ISREG (st
.st_mode
) && st
.st_size
< 0)
850 error (0, 0, _("%s: file has negative size"), qname
);
854 /* Allocate pass array */
855 passarray
= xnmalloc (flags
->n_iterations
, sizeof *passarray
);
860 if (S_ISREG (st
.st_mode
))
866 /* Round up to the nearest block size to clear slack space. */
867 off_t remainder
= size
% ST_BLKSIZE (st
);
868 if (size
&& size
< ST_BLKSIZE (st
))
872 off_t size_incr
= ST_BLKSIZE (st
) - remainder
;
873 size
+= MIN (size_incr
, OFF_T_MAX
- size
);
879 /* The behavior of lseek is unspecified, but in practice if
880 it returns a positive number that's the size of this
882 size
= lseek (fd
, 0, SEEK_END
);
885 /* We are unable to determine the length, up front.
886 Let dopass do that as part of its first iteration. */
891 else if (S_ISREG (st
.st_mode
)
892 && st
.st_size
< MIN (ST_BLKSIZE (st
), size
))
895 /* Schedule the passes in random order. */
896 genpattern (passarray
, flags
->n_iterations
, s
);
898 rs
= randint_get_source (s
);
903 unsigned long int pn
= n
;
916 /* TODO: consider handling tail packing by
917 writing the tail padding as a separate pass,
918 (that would not rewind). */
922 for (i
= 0; i
< flags
->n_iterations
+ flags
->zero_fill
; i
++)
925 int type
= i
< flags
->n_iterations
? passarray
[i
] : 0;
927 err
= dopass (fd
, &st
, qname
, &pass_size
, type
, rs
, i
+ 1, pn
);
938 /* Now deallocate the data. The effect of ftruncate is specified
939 on regular files and shared memory objects (also directories, but
940 they are not possible here); don't worry about errors reported
941 for other file types. */
943 if (flags
->remove_file
&& ftruncate (fd
, 0) != 0
944 && (S_ISREG (st
.st_mode
) || S_TYPEISSHM (&st
)))
946 error (0, errno
, _("%s: error truncating"), qname
);
956 /* A wrapper with a little more checking for fds on the command line */
958 wipefd (int fd
, char const *qname
, struct randint_source
*s
,
959 struct Options
const *flags
)
961 int fd_flags
= fcntl (fd
, F_GETFL
);
965 error (0, errno
, _("%s: fcntl failed"), qname
);
968 if (fd_flags
& O_APPEND
)
970 error (0, 0, _("%s: cannot shred append-only file descriptor"), qname
);
973 return do_wipefd (fd
, qname
, s
, flags
);
976 /* --- Name-wiping code --- */
978 /* Characters allowed in a file name - a safe universal set. */
979 static char const nameset
[] =
980 "0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ_.";
982 /* Increment NAME (with LEN bytes). NAME must be a big-endian base N
983 number with the digits taken from nameset. Return true if successful.
984 Otherwise, (because NAME already has the greatest possible value)
988 incname (char *name
, size_t len
)
992 char const *p
= strchr (nameset
, name
[len
]);
994 /* Given that NAME is composed of bytes from NAMESET,
995 P will never be null here. */
997 /* If this character has a successor, use it. */
1004 /* Otherwise, set this digit to 0 and increment the prefix. */
1005 name
[len
] = nameset
[0];
1012 * Repeatedly rename a file with shorter and shorter names,
1013 * to obliterate all traces of the file name (and length) on any system
1014 * that adds a trailing delimiter to on-device file names and reuses
1015 * the same directory slot. Finally, unlink it.
1016 * The passed-in filename is modified in place to the new filename.
1017 * (Which is unlinked if this function succeeds, but is still present if
1018 * it fails for some reason.)
1020 * The main loop is written carefully to not get stuck if all possible
1021 * names of a given length are occupied. It counts down the length from
1022 * the original to 0. While the length is non-zero, it tries to find an
1023 * unused file name of the given length. It continues until either the
1024 * name is available and the rename succeeds, or it runs out of names
1025 * to try (incname wraps and returns 1). Finally, it unlinks the file.
1027 * The unlink is Unix-specific, as ANSI-standard remove has more
1028 * portability problems with C libraries making it "safe". rename
1031 * To force the directory data out, we try to open the directory and
1032 * invoke fdatasync and/or fsync on it. This is non-standard, so don't
1033 * insist that it works: just fall back to a global sync in that case.
1034 * This is fairly significantly Unix-specific. Of course, on any
1035 * file system with synchronous metadata updates, this is unnecessary.
1038 wipename (char *oldname
, char const *qoldname
, struct Options
const *flags
)
1040 char *newname
= xstrdup (oldname
);
1041 char *base
= last_component (newname
);
1042 char *dir
= dir_name (newname
);
1043 char *qdir
= xstrdup (quotef (dir
));
1048 if (flags
->remove_file
== remove_wipesync
)
1049 dir_fd
= open (dir
, O_RDONLY
| O_DIRECTORY
| O_NOCTTY
| O_NONBLOCK
);
1052 error (0, 0, _("%s: removing"), qoldname
);
1054 if (flags
->remove_file
!= remove_unlink
)
1055 for (size_t len
= base_len (base
); len
!= 0; len
--)
1057 memset (base
, nameset
[0], len
);
1060 while (! (rename_ok
= (renameatu (AT_FDCWD
, oldname
, AT_FDCWD
, newname
,
1063 && errno
== EEXIST
&& incname (base
, len
))
1067 if (0 <= dir_fd
&& dosync (dir_fd
, qdir
) != 0)
1071 /* People seem to understand this better than talking
1072 about renaming OLDNAME. NEWNAME doesn't need
1073 quoting because we picked it. OLDNAME needs to be
1074 quoted only the first time. */
1075 char const *old
= first
? qoldname
: oldname
;
1077 _("%s: renamed to %s"), old
, newname
);
1080 memcpy (oldname
+ (base
- newname
), base
, len
+ 1);
1084 if (unlink (oldname
) != 0)
1086 error (0, errno
, _("%s: failed to remove"), qoldname
);
1089 else if (flags
->verbose
)
1090 error (0, 0, _("%s: removed"), qoldname
);
1093 if (dosync (dir_fd
, qdir
) != 0)
1095 if (close (dir_fd
) != 0)
1097 error (0, errno
, _("%s: failed to close"), qdir
);
1108 * Finally, the function that actually takes a filename and grinds
1109 * it into hamburger.
1112 * Detail to note: since we do not restore errno to EACCES after
1113 * a failed chmod, we end up printing the error code from the chmod.
1114 * This is actually the error that stopped us from proceeding, so
1115 * it's arguably the right one, and in practice it'll be either EACCES
1116 * again or EPERM, which both give similar error messages.
1117 * Does anyone disagree?
1120 wipefile (char *name
, char const *qname
,
1121 struct randint_source
*s
, struct Options
const *flags
)
1126 fd
= open (name
, O_WRONLY
| O_NOCTTY
| O_BINARY
);
1128 && (errno
== EACCES
&& flags
->force
)
1129 && chmod (name
, S_IWUSR
) == 0)
1130 fd
= open (name
, O_WRONLY
| O_NOCTTY
| O_BINARY
);
1133 error (0, errno
, _("%s: failed to open for writing"), qname
);
1137 ok
= do_wipefd (fd
, qname
, s
, flags
);
1138 if (close (fd
) != 0)
1140 error (0, errno
, _("%s: failed to close"), qname
);
1143 if (ok
&& flags
->remove_file
)
1144 ok
= wipename (name
, qname
, flags
);
1149 /* Buffers for random data. */
1150 static struct randint_source
*randint_source
;
1152 /* Just on general principles, wipe buffers containing information
1153 that may be related to the possibly-pseudorandom values used during
1156 clear_random_data (void)
1158 randint_all_free (randint_source
);
1163 main (int argc
, char **argv
)
1166 struct Options flags
= { 0, };
1171 char const *random_source
= nullptr;
1173 initialize_main (&argc
, &argv
);
1174 set_program_name (argv
[0]);
1175 setlocale (LC_ALL
, "");
1176 bindtextdomain (PACKAGE
, LOCALEDIR
);
1177 textdomain (PACKAGE
);
1179 atexit (close_stdout
);
1181 flags
.n_iterations
= DEFAULT_PASSES
;
1184 while ((c
= getopt_long (argc
, argv
, "fn:s:uvxz", long_opts
, nullptr)) != -1)
1193 flags
.n_iterations
= xdectoumax (optarg
, 0,
1195 SIZE_MAX
/ sizeof (int)), "",
1196 _("invalid number of passes"), 0);
1199 case RANDOM_SOURCE_OPTION
:
1200 if (random_source
&& !STREQ (random_source
, optarg
))
1201 error (EXIT_FAILURE
, 0, _("multiple random sources specified"));
1202 random_source
= optarg
;
1206 if (optarg
== nullptr)
1207 flags
.remove_file
= remove_wipesync
;
1209 flags
.remove_file
= XARGMATCH ("--remove", optarg
,
1210 remove_args
, remove_methods
);
1214 flags
.size
= xnumtoumax (optarg
, 0, 0, OFF_T_MAX
, "cbBkKMGTPEZYRQ0",
1215 _("invalid file size"), 0);
1219 flags
.verbose
= true;
1227 flags
.zero_fill
= true;
1230 case_GETOPT_HELP_CHAR
;
1232 case_GETOPT_VERSION_CHAR (PROGRAM_NAME
, AUTHORS
);
1235 usage (EXIT_FAILURE
);
1239 file
= argv
+ optind
;
1240 n_files
= argc
- optind
;
1244 error (0, 0, _("missing file operand"));
1245 usage (EXIT_FAILURE
);
1248 randint_source
= randint_all_new (random_source
, SIZE_MAX
);
1249 if (! randint_source
)
1250 error (EXIT_FAILURE
, errno
, "%s",
1251 quotef (random_source
? random_source
: "getrandom"));
1252 atexit (clear_random_data
);
1254 for (i
= 0; i
< n_files
; i
++)
1256 char *qname
= xstrdup (quotef (file
[i
]));
1257 if (STREQ (file
[i
], "-"))
1259 ok
&= wipefd (STDOUT_FILENO
, qname
, randint_source
, &flags
);
1263 /* Plain filename - Note that this overwrites *argv! */
1264 ok
&= wipefile (file
[i
], qname
, randint_source
, &flags
);
1269 return ok
? EXIT_SUCCESS
: EXIT_FAILURE
;