1 /* chown-core.c -- core functions for changing ownership.
2 Copyright (C) 2000-2023 Free Software Foundation, Inc.
4 This program is free software: you can redistribute it and/or modify
5 it under the terms of the GNU General Public License as published by
6 the Free Software Foundation, either version 3 of the License, or
7 (at your option) any later version.
9 This program is distributed in the hope that it will be useful,
10 but WITHOUT ANY WARRANTY; without even the implied warranty of
11 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 GNU General Public License for more details.
14 You should have received a copy of the GNU General Public License
15 along with this program. If not, see <https://www.gnu.org/licenses/>. */
17 /* Extracted from chown.c/chgrp.c and librarified by Jim Meyering. */
21 #include <sys/types.h>
27 #include "chown-core.h"
28 #include "ignore-value.h"
29 #include "root-dev-ino.h"
32 #define FTSENT_IS_DIRECTORY(E) \
33 ((E)->fts_info == FTS_D \
34 || (E)->fts_info == FTS_DC \
35 || (E)->fts_info == FTS_DP \
36 || (E)->fts_info == FTS_DNR)
40 /* we called fchown and close, and both succeeded */
43 /* required_uid and/or required_gid are specified, but don't match */
46 /* SAME_INODE check failed */
49 /* open/fchown isn't needed, isn't safe, or doesn't work due to
50 permissions problems; fall back on chown */
53 /* open, fstat, fchown, or close failed */
58 chopt_init (struct Chown_option
*chopt
)
60 chopt
->verbosity
= V_off
;
61 chopt
->root_dev_ino
= nullptr;
62 chopt
->affect_symlink_referent
= true;
63 chopt
->recurse
= false;
64 chopt
->force_silent
= false;
65 chopt
->user_name
= nullptr;
66 chopt
->group_name
= nullptr;
70 chopt_free (struct Chown_option
*chopt
)
72 free (chopt
->user_name
);
73 free (chopt
->group_name
);
76 /* Convert the numeric user-id, UID, to a string stored in xmalloc'd memory,
77 and return it. Use the decimal representation of the ID. */
80 uid_to_str (uid_t uid
)
82 char buf
[INT_BUFSIZE_BOUND (intmax_t)];
83 return xstrdup (TYPE_SIGNED (uid_t
) ? imaxtostr (uid
, buf
)
84 : umaxtostr (uid
, buf
));
87 /* Convert the numeric group-id, GID, to a string stored in xmalloc'd memory,
88 and return it. Use the decimal representation of the ID. */
91 gid_to_str (gid_t gid
)
93 char buf
[INT_BUFSIZE_BOUND (intmax_t)];
94 return xstrdup (TYPE_SIGNED (gid_t
) ? imaxtostr (gid
, buf
)
95 : umaxtostr (gid
, buf
));
98 /* Convert the numeric group-id, GID, to a string stored in xmalloc'd memory,
99 and return it. If there's no corresponding group name, use the decimal
100 representation of the ID. */
103 gid_to_name (gid_t gid
)
105 struct group
*grp
= getgrgid (gid
);
106 return grp
? xstrdup (grp
->gr_name
) : gid_to_str (gid
);
109 /* Convert the numeric user-id, UID, to a string stored in xmalloc'd memory,
110 and return it. If there's no corresponding user name, use the decimal
111 representation of the ID. */
114 uid_to_name (uid_t uid
)
116 struct passwd
*pwd
= getpwuid (uid
);
117 return pwd
? xstrdup (pwd
->pw_name
) : uid_to_str (uid
);
120 /* Allocate a string representing USER and GROUP. */
123 user_group_str (char const *user
, char const *group
)
125 char *spec
= nullptr;
131 spec
= xmalloc (strlen (user
) + 1 + strlen (group
) + 1);
132 stpcpy (stpcpy (stpcpy (spec
, user
), ":"), group
);
136 spec
= xstrdup (user
);
141 spec
= xstrdup (group
);
147 /* Tell the user how/if the user and group of FILE have been changed.
148 If USER is null, give the group-oriented messages.
149 CHANGED describes what (if anything) has happened. */
152 describe_change (char const *file
, enum Change_status changed
,
153 char const *old_user
, char const *old_group
,
154 char const *user
, char const *group
)
160 if (changed
== CH_NOT_APPLIED
)
162 printf (_("neither symbolic link %s nor referent has been changed\n"),
167 spec
= user_group_str (user
, group
);
168 old_spec
= user_group_str (user
? old_user
: nullptr,
169 group
? old_group
: nullptr);
174 fmt
= (user
? _("changed ownership of %s from %s to %s\n")
175 : group
? _("changed group of %s from %s to %s\n")
176 : _("no change to ownership of %s\n"));
181 fmt
= (user
? _("failed to change ownership of %s from %s to %s\n")
182 : group
? _("failed to change group of %s from %s to %s\n")
183 : _("failed to change ownership of %s\n"));
187 fmt
= (user
? _("failed to change ownership of %s to %s\n")
188 : group
? _("failed to change group of %s to %s\n")
189 : _("failed to change ownership of %s\n"));
195 case CH_NO_CHANGE_REQUESTED
:
196 fmt
= (user
? _("ownership of %s retained as %s\n")
197 : group
? _("group of %s retained as %s\n")
198 : _("ownership of %s retained\n"));
204 printf (fmt
, quoteaf (file
), old_spec
, spec
);
210 /* Change the owner and/or group of the FILE to UID and/or GID (safely)
211 only if REQUIRED_UID and REQUIRED_GID match the owner and group IDs
212 of FILE. ORIG_ST must be the result of 'stat'ing FILE.
214 The 'safely' part above means that we can't simply use chown(2),
215 since FILE might be replaced with some other file between the time
216 of the preceding stat/lstat and this chown call. So here we open
217 FILE and do everything else via the resulting file descriptor.
218 We first call fstat and verify that the dev/inode match those from
219 the preceding stat call, and only then, if appropriate (given the
220 required_uid and required_gid constraints) do we call fchown.
222 Return RC_do_ordinary_chown if we can't open FILE, or if FILE is a
223 special file that might have undesirable side effects when opening.
224 In this case the caller can use the less-safe ordinary chown.
226 Return one of the RCH_status values. */
228 static enum RCH_status
229 restricted_chown (int cwd_fd
, char const *file
,
230 struct stat
const *orig_st
,
231 uid_t uid
, gid_t gid
,
232 uid_t required_uid
, gid_t required_gid
)
234 enum RCH_status status
= RC_ok
;
236 int open_flags
= O_NONBLOCK
| O_NOCTTY
;
239 if (required_uid
== (uid_t
) -1 && required_gid
== (gid_t
) -1)
240 return RC_do_ordinary_chown
;
242 if (! S_ISREG (orig_st
->st_mode
))
244 if (S_ISDIR (orig_st
->st_mode
))
245 open_flags
|= O_DIRECTORY
;
247 return RC_do_ordinary_chown
;
250 fd
= openat (cwd_fd
, file
, O_RDONLY
| open_flags
);
252 || (errno
== EACCES
&& S_ISREG (orig_st
->st_mode
)
253 && 0 <= (fd
= openat (cwd_fd
, file
, O_WRONLY
| open_flags
)))))
254 return (errno
== EACCES
? RC_do_ordinary_chown
: RC_error
);
256 if (fstat (fd
, &st
) != 0)
258 else if (! SAME_INODE (*orig_st
, st
))
259 status
= RC_inode_changed
;
260 else if ((required_uid
== (uid_t
) -1 || required_uid
== st
.st_uid
)
261 && (required_gid
== (gid_t
) -1 || required_gid
== st
.st_gid
))
263 if (fchown (fd
, uid
, gid
) == 0)
265 status
= (close (fd
) == 0
275 int saved_errno
= errno
;
281 /* Change the owner and/or group of the file specified by FTS and ENT
282 to UID and/or GID as appropriate.
283 If REQUIRED_UID is not -1, then skip files with any other user ID.
284 If REQUIRED_GID is not -1, then skip files with any other group ID.
285 CHOPT specifies additional options.
286 Return true if successful. */
288 change_file_owner (FTS
*fts
, FTSENT
*ent
,
289 uid_t uid
, gid_t gid
,
290 uid_t required_uid
, gid_t required_gid
,
291 struct Chown_option
const *chopt
)
293 char const *file_full_name
= ent
->fts_path
;
294 char const *file
= ent
->fts_accpath
;
295 struct stat
const *file_stats
;
296 struct stat stat_buf
;
299 bool symlink_changed
= true;
301 switch (ent
->fts_info
)
306 if (ROOT_DEV_INO_CHECK (chopt
->root_dev_ino
, ent
->fts_statp
))
308 /* This happens e.g., with "chown -R --preserve-root 0 /"
309 and with "chown -RH --preserve-root 0 symlink-to-root". */
310 ROOT_DEV_INO_WARN (file_full_name
);
311 /* Tell fts not to traverse into this hierarchy. */
312 fts_set (fts
, ent
, FTS_SKIP
);
313 /* Ensure that we do not process "/" on the second visit. */
314 ignore_value (fts_read (fts
));
322 if (! chopt
->recurse
)
327 /* For a top-level file or directory, this FTS_NS (stat failed)
328 indicator is determined at the time of the initial fts_open call.
329 With programs like chmod, chown, and chgrp, that modify
330 permissions, it is possible that the file in question is
331 accessible when control reaches this point. So, if this is
332 the first time we've seen the FTS_NS for this file, tell
333 fts_read to stat it "again". */
334 if (ent
->fts_level
== 0 && ent
->fts_number
== 0)
337 fts_set (fts
, ent
, FTS_AGAIN
);
340 if (! chopt
->force_silent
)
341 error (0, ent
->fts_errno
, _("cannot access %s"),
342 quoteaf (file_full_name
));
347 if (! chopt
->force_silent
)
348 error (0, ent
->fts_errno
, "%s", quotef (file_full_name
));
353 if (! chopt
->force_silent
)
354 error (0, ent
->fts_errno
, _("cannot read directory %s"),
355 quoteaf (file_full_name
));
359 case FTS_DC
: /* directory that causes cycles */
360 if (cycle_warning_required (fts
, ent
))
362 emit_cycle_warning (file_full_name
);
374 file_stats
= nullptr;
376 else if (required_uid
== (uid_t
) -1 && required_gid
== (gid_t
) -1
377 && chopt
->verbosity
== V_off
378 && ! chopt
->root_dev_ino
379 && ! chopt
->affect_symlink_referent
)
382 file_stats
= ent
->fts_statp
;
386 file_stats
= ent
->fts_statp
;
388 /* If this is a symlink and we're dereferencing them,
389 stat it to get info on the referent. */
390 if (chopt
->affect_symlink_referent
&& S_ISLNK (file_stats
->st_mode
))
392 if (fstatat (fts
->fts_cwd_fd
, file
, &stat_buf
, 0) != 0)
394 if (! chopt
->force_silent
)
395 error (0, errno
, _("cannot dereference %s"),
396 quoteaf (file_full_name
));
400 file_stats
= &stat_buf
;
404 && (required_uid
== (uid_t
) -1
405 || required_uid
== file_stats
->st_uid
)
406 && (required_gid
== (gid_t
) -1
407 || required_gid
== file_stats
->st_gid
));
410 /* This happens when chown -LR --preserve-root encounters a symlink-to-/. */
412 && FTSENT_IS_DIRECTORY (ent
)
413 && ROOT_DEV_INO_CHECK (chopt
->root_dev_ino
, file_stats
))
415 ROOT_DEV_INO_WARN (file_full_name
);
421 if ( ! chopt
->affect_symlink_referent
)
423 ok
= (lchownat (fts
->fts_cwd_fd
, file
, uid
, gid
) == 0);
425 /* Ignore any error due to lack of support; POSIX requires
426 this behavior for top-level symbolic links with -h, and
427 implies that it's required for all symbolic links. */
428 if (!ok
&& errno
== EOPNOTSUPP
)
431 symlink_changed
= false;
436 /* If possible, avoid a race condition with --from=O:G and without the
437 (-h) --no-dereference option. If fts's stat call determined
438 that the uid/gid of FILE matched the --from=O:G-selected
439 owner and group IDs, blindly using chown(2) here could lead
440 chown(1) or chgrp(1) mistakenly to dereference a *symlink*
441 to an arbitrary file that an attacker had moved into the
442 place of FILE during the window between the stat and
443 chown(2) calls. If FILE is a regular file or a directory
444 that can be opened, this race condition can be avoided safely. */
447 = restricted_chown (fts
->fts_cwd_fd
, file
, file_stats
, uid
, gid
,
448 required_uid
, required_gid
);
454 case RC_do_ordinary_chown
:
455 ok
= (chownat (fts
->fts_cwd_fd
, file
, uid
, gid
) == 0);
462 case RC_inode_changed
:
463 /* FIXME: give a diagnostic in this case? */
474 /* On some systems (e.g., GNU/Linux 2.4.x),
475 the chown function resets the 'special' permission bits.
476 Do *not* restore those bits; doing so would open a window in
477 which a malicious user, M, could subvert a chown command run
478 by some other user and operating on files in a directory
479 where M has write access. */
481 if (do_chown
&& !ok
&& ! chopt
->force_silent
)
482 error (0, errno
, (uid
!= (uid_t
) -1
483 ? _("changing ownership of %s")
484 : _("changing group of %s")),
485 quoteaf (file_full_name
));
488 if (chopt
->verbosity
!= V_off
)
491 ((do_chown
&& ok
&& symlink_changed
)
492 && ! ((uid
== (uid_t
) -1 || uid
== file_stats
->st_uid
)
493 && (gid
== (gid_t
) -1 || gid
== file_stats
->st_gid
)));
495 if (changed
|| chopt
->verbosity
== V_high
)
497 enum Change_status ch_status
=
499 : !symlink_changed
? CH_NOT_APPLIED
500 : !changed
? CH_NO_CHANGE_REQUESTED
502 char *old_usr
= (file_stats
503 ? uid_to_name (file_stats
->st_uid
) : nullptr);
504 char *old_grp
= (file_stats
505 ? gid_to_name (file_stats
->st_gid
) : nullptr);
506 char *new_usr
= chopt
->user_name
507 ? chopt
->user_name
: uid
!= -1
508 ? uid_to_str (uid
) : nullptr;
509 char *new_grp
= chopt
->group_name
510 ? chopt
->group_name
: gid
!= -1
511 ? gid_to_str (gid
) : nullptr;
512 describe_change (file_full_name
, ch_status
,
517 if (new_usr
!= chopt
->user_name
)
519 if (new_grp
!= chopt
->group_name
)
524 if ( ! chopt
->recurse
)
525 fts_set (fts
, ent
, FTS_SKIP
);
530 /* Change the owner and/or group of the specified FILES.
531 BIT_FLAGS specifies how to treat each symlink-to-directory
532 that is encountered during a recursive traversal.
533 CHOPT specifies additional options.
534 If UID is not -1, then change the owner id of each file to UID.
535 If GID is not -1, then change the group id of each file to GID.
536 If REQUIRED_UID and/or REQUIRED_GID is not -1, then change only
537 files with user ID and group ID that match the non-(-1) value(s).
538 Return true if successful. */
540 chown_files (char **files
, int bit_flags
,
541 uid_t uid
, gid_t gid
,
542 uid_t required_uid
, gid_t required_gid
,
543 struct Chown_option
const *chopt
)
547 /* Use lstat and stat only if they're needed. */
548 int stat_flags
= ((required_uid
!= (uid_t
) -1 || required_gid
!= (gid_t
) -1
549 || chopt
->affect_symlink_referent
550 || chopt
->verbosity
!= V_off
)
554 FTS
*fts
= xfts_open (files
, bit_flags
| stat_flags
, nullptr);
560 ent
= fts_read (fts
);
565 /* FIXME: try to give a better message */
566 if (! chopt
->force_silent
)
567 error (0, errno
, _("fts_read failed"));
573 ok
&= change_file_owner (fts
, ent
, uid
, gid
,
574 required_uid
, required_gid
, chopt
);
577 if (fts_close (fts
) != 0)
579 error (0, errno
, _("fts_close failed"));