1 /* copy.c -- core functions for copying files and directories
2 Copyright (C) 1989-2019 Free Software Foundation, Inc.
4 This program is free software: you can redistribute it and/or modify
5 it under the terms of the GNU General Public License as published by
6 the Free Software Foundation, either version 3 of the License, or
7 (at your option) any later version.
9 This program is distributed in the hope that it will be useful,
10 but WITHOUT ANY WARRANTY; without even the implied warranty of
11 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 GNU General Public License for more details.
14 You should have received a copy of the GNU General Public License
15 along with this program. If not, see <https://www.gnu.org/licenses/>. */
17 /* Extracted from cp.c and librarified by Jim Meyering. */
22 #include <sys/ioctl.h>
23 #include <sys/types.h>
24 #include <selinux/selinux.h>
35 #include "backupfile.h"
36 #include "buffer-lcm.h"
37 #include "canonicalize.h"
40 #include "extent-scan.h"
48 #include "filenamecat.h"
49 #include "force-link.h"
50 #include "full-write.h"
52 #include "hash-triple.h"
53 #include "ignore-value.h"
54 #include "ioblksize.h"
56 #include "renameatu.h"
60 #include "stat-size.h"
61 #include "stat-time.h"
64 #include "write-any-file.h"
65 #include "areadlink.h"
70 # include <attr/error_context.h>
71 # include <attr/libattr.h>
76 #if HAVE_LINUX_FALLOC_H
77 # include <linux/falloc.h>
80 /* See HAVE_FALLOCATE workaround when including this file. */
81 #ifdef HAVE_LINUX_FS_H
82 # include <linux/fs.h>
85 #if !defined FICLONE && defined __linux__
86 # define FICLONE _IOW (0x94, 9, int)
90 # define HAVE_FCHOWN false
91 # define fchown(fd, uid, gid) (-1)
95 # define HAVE_LCHOWN false
96 # define lchown(name, uid, gid) chown (name, uid, gid)
101 rpl_mkfifo (char const *file
, mode_t mode
)
106 # define mkfifo rpl_mkfifo
113 #define SAME_OWNER(A, B) ((A).st_uid == (B).st_uid)
114 #define SAME_GROUP(A, B) ((A).st_gid == (B).st_gid)
115 #define SAME_OWNER_AND_GROUP(A, B) (SAME_OWNER (A, B) && SAME_GROUP (A, B))
117 /* LINK_FOLLOWS_SYMLINKS is tri-state; if it is -1, we don't know
118 how link() behaves, so assume we can't hardlink symlinks in that case. */
119 #if (defined HAVE_LINKAT && ! LINKAT_SYMLINK_NOTSUP) || ! LINK_FOLLOWS_SYMLINKS
120 # define CAN_HARDLINK_SYMLINKS 1
122 # define CAN_HARDLINK_SYMLINKS 0
127 struct dir_list
*parent
;
132 /* Initial size of the cp.dest_info hash table. */
133 #define DEST_INFO_INITIAL_CAPACITY 61
135 static bool copy_internal (char const *src_name
, char const *dst_name
,
136 bool new_dst
, struct stat
const *parent
,
137 struct dir_list
*ancestors
,
138 const struct cp_options
*x
,
139 bool command_line_arg
,
140 bool *first_dir_created_per_command_line_arg
,
141 bool *copy_into_self
,
142 bool *rename_succeeded
);
143 static bool owner_failure_ok (struct cp_options
const *x
);
145 /* Pointers to the file names: they're used in the diagnostic that is issued
146 when we detect the user is trying to copy a directory into itself. */
147 static char const *top_level_src_name
;
148 static char const *top_level_dst_name
;
150 #ifndef DEV_FD_MIGHT_BE_CHR
151 # define DEV_FD_MIGHT_BE_CHR false
154 /* Act like fstat (DIRFD, FILENAME, ST, FLAGS), except when following
155 symbolic links on Solaris-like systems, treat any character-special
156 device like /dev/fd/0 as if it were the file it is open on. */
158 follow_fstatat (int dirfd
, char const *filename
, struct stat
*st
, int flags
)
160 int result
= fstatat (dirfd
, filename
, st
, flags
);
162 if (DEV_FD_MIGHT_BE_CHR
&& result
== 0 && !(flags
& AT_SYMLINK_NOFOLLOW
)
163 && S_ISCHR (st
->st_mode
))
165 static dev_t stdin_rdev
;
166 static signed char stdin_rdev_status
;
167 if (stdin_rdev_status
== 0)
169 struct stat stdin_st
;
170 if (stat ("/dev/stdin", &stdin_st
) == 0 && S_ISCHR (stdin_st
.st_mode
)
171 && minor (stdin_st
.st_rdev
) == STDIN_FILENO
)
173 stdin_rdev
= stdin_st
.st_rdev
;
174 stdin_rdev_status
= 1;
177 stdin_rdev_status
= -1;
179 if (0 < stdin_rdev_status
&& major (stdin_rdev
) == major (st
->st_rdev
))
180 result
= fstat (minor (st
->st_rdev
), st
);
186 /* Set the timestamp of symlink, FILE, to TIMESPEC.
187 If this system lacks support for that, simply return 0. */
189 utimens_symlink (char const *file
, struct timespec
const *timespec
)
191 int err
= lutimens (file
, timespec
);
192 /* When configuring on a system with new headers and libraries, and
193 running on one with a kernel that is old enough to lack the syscall,
194 utimensat fails with ENOSYS. Ignore that. */
195 if (err
&& errno
== ENOSYS
)
200 /* Attempt to punch a hole to avoid any permanent
201 speculative preallocation on file systems such as XFS.
202 Return values as per fallocate(2) except ENOSYS etc. are ignored. */
205 punch_hole (int fd
, off_t offset
, off_t length
)
208 /* +0 is to work around older <linux/fs.h> defining HAVE_FALLOCATE to empty. */
209 #if HAVE_FALLOCATE + 0
210 # if defined FALLOC_FL_PUNCH_HOLE && defined FALLOC_FL_KEEP_SIZE
211 ret
= fallocate (fd
, FALLOC_FL_PUNCH_HOLE
| FALLOC_FL_KEEP_SIZE
,
213 if (ret
< 0 && (is_ENOTSUP (errno
) || errno
== ENOSYS
))
220 /* Create a hole at the end of a file,
221 avoiding preallocation if requested. */
224 create_hole (int fd
, char const *name
, bool punch_holes
, off_t size
)
226 off_t file_end
= lseek (fd
, size
, SEEK_CUR
);
230 error (0, errno
, _("cannot lseek %s"), quoteaf (name
));
234 /* Some file systems (like XFS) preallocate when write extending a file.
235 I.e., a previous write() may have preallocated extra space
236 that the seek above will not discard. A subsequent write() could
237 then make this allocation permanent. */
238 if (punch_holes
&& punch_hole (fd
, file_end
- size
, size
) < 0)
240 error (0, errno
, _("error deallocating %s"), quoteaf (name
));
248 /* Copy the regular file open on SRC_FD/SRC_NAME to DST_FD/DST_NAME,
249 honoring the MAKE_HOLES setting and using the BUF_SIZE-byte buffer
250 BUF for temporary storage. Copy no more than MAX_N_READ bytes.
251 Return true upon successful completion;
252 print a diagnostic and return false upon error.
253 Note that for best results, BUF should be "well"-aligned.
254 BUF must have sizeof(uintptr_t)-1 bytes of additional space
255 beyond BUF[BUF_SIZE-1].
256 Set *LAST_WRITE_MADE_HOLE to true if the final operation on
257 DEST_FD introduced a hole. Set *TOTAL_N_READ to the number of
260 sparse_copy (int src_fd
, int dest_fd
, char *buf
, size_t buf_size
,
261 size_t hole_size
, bool punch_holes
,
262 char const *src_name
, char const *dst_name
,
263 uintmax_t max_n_read
, off_t
*total_n_read
,
264 bool *last_write_made_hole
)
266 *last_write_made_hole
= false;
268 bool make_hole
= false;
273 ssize_t n_read
= read (src_fd
, buf
, MIN (max_n_read
, buf_size
));
278 error (0, errno
, _("error reading %s"), quoteaf (src_name
));
283 max_n_read
-= n_read
;
284 *total_n_read
+= n_read
;
286 /* Loop over the input buffer in chunks of hole_size. */
287 size_t csize
= hole_size
? hole_size
: buf_size
;
293 bool prev_hole
= make_hole
;
294 csize
= MIN (csize
, n_read
);
296 if (hole_size
&& csize
)
297 make_hole
= is_nul (cbuf
, csize
);
299 bool transition
= (make_hole
!= prev_hole
) && psize
;
300 bool last_chunk
= (n_read
== csize
&& ! make_hole
) || ! csize
;
302 if (transition
|| last_chunk
)
309 if (full_write (dest_fd
, pbuf
, psize
) != psize
)
311 error (0, errno
, _("error writing %s"),
318 if (! create_hole (dest_fd
, dst_name
, punch_holes
, psize
))
328 n_read
= 0; /* Finished processing buffer. */
331 csize
= 0; /* Loop again to deal with last chunk. */
333 psize
= 0; /* Reset for next read loop. */
336 else /* Coalesce writes/seeks. */
338 if (INT_ADD_WRAPV (psize
, csize
, &psize
))
340 error (0, 0, _("overflow reading %s"), quoteaf (src_name
));
349 *last_write_made_hole
= make_hole
;
351 /* It's tempting to break early here upon a short read from
352 a regular file. That would save the final read syscall
353 for each file. Unfortunately that doesn't work for
354 certain files in /proc or /sys with linux kernels. */
357 /* Ensure a trailing hole is created, so that subsequent
358 calls of sparse_copy() start at the correct offset. */
359 if (make_hole
&& ! create_hole (dest_fd
, dst_name
, punch_holes
, psize
))
365 /* Perform the O(1) btrfs clone operation, if possible.
366 Upon success, return 0. Otherwise, return -1 and set errno. */
368 clone_file (int dest_fd
, int src_fd
)
371 return ioctl (dest_fd
, FICLONE
, src_fd
);
380 /* Write N_BYTES zero bytes to file descriptor FD. Return true if successful.
381 Upon write failure, set errno and return false. */
383 write_zeros (int fd
, off_t n_bytes
)
386 static size_t nz
= IO_BUFSIZE
;
388 /* Attempt to use a relatively large calloc'd source buffer for
389 efficiency, but if that allocation fails, resort to a smaller
390 statically allocated one. */
393 static char fallback
[1024];
394 zeros
= calloc (nz
, 1);
398 nz
= sizeof fallback
;
404 size_t n
= MIN (nz
, n_bytes
);
405 if ((full_write (fd
, zeros
, n
)) != n
)
413 /* Perform an efficient extent copy, if possible. This avoids
414 the overhead of detecting holes in hole-introducing/preserving
415 copy, and thus makes copying sparse files much more efficient.
416 Upon a successful copy, return true. If the initial extent scan
417 fails, set *NORMAL_COPY_REQUIRED to true and return false.
418 Upon any other failure, set *NORMAL_COPY_REQUIRED to false and
421 extent_copy (int src_fd
, int dest_fd
, char *buf
, size_t buf_size
,
422 size_t hole_size
, off_t src_total_size
,
423 enum Sparse_type sparse_mode
,
424 char const *src_name
, char const *dst_name
,
425 bool *require_normal_copy
)
427 struct extent_scan scan
;
428 off_t last_ext_start
= 0;
429 off_t last_ext_len
= 0;
431 /* Keep track of the output position.
432 We may need this at the end, for a final ftruncate. */
435 extent_scan_init (src_fd
, &scan
);
437 *require_normal_copy
= false;
438 bool wrote_hole_at_eof
= true;
441 bool ok
= extent_scan_read (&scan
);
444 if (scan
.hit_final_extent
)
447 if (scan
.initial_scan_failed
)
449 *require_normal_copy
= true;
453 error (0, errno
, _("%s: failed to get extents info"),
458 bool empty_extent
= false;
459 for (unsigned int i
= 0; i
< scan
.ei_count
|| empty_extent
; i
++)
465 if (i
< scan
.ei_count
)
467 ext_start
= scan
.ext_info
[i
].ext_logical
;
468 ext_len
= scan
.ext_info
[i
].ext_length
;
470 else /* empty extent at EOF. */
473 ext_start
= last_ext_start
+ scan
.ext_info
[i
].ext_length
;
477 /* Truncate extent to EOF. Extents starting after EOF are
478 treated as zero length extents starting right after EOF.
479 Generally this will trigger with an extent starting after
480 src_total_size, and result in creating a hole or zeros until EOF.
481 Though in a file in which extents have changed since src_total_size
482 was determined, we might have an extent spanning that size,
483 in which case we'll only copy data up to that size. */
484 if (src_total_size
< ext_start
+ ext_len
)
486 if (src_total_size
< ext_start
)
487 ext_start
= src_total_size
;
488 ext_len
= src_total_size
- ext_start
;
491 ext_hole_size
= ext_start
- last_ext_start
- last_ext_len
;
493 wrote_hole_at_eof
= false;
497 if (lseek (src_fd
, ext_start
, SEEK_SET
) < 0)
499 error (0, errno
, _("cannot lseek %s"), quoteaf (src_name
));
501 extent_scan_free (&scan
);
505 if ((empty_extent
&& sparse_mode
== SPARSE_ALWAYS
)
506 || (!empty_extent
&& sparse_mode
!= SPARSE_NEVER
))
508 if (! create_hole (dest_fd
, dst_name
,
509 sparse_mode
== SPARSE_ALWAYS
,
512 wrote_hole_at_eof
= true;
516 /* When not inducing holes and when there is a hole between
517 the end of the previous extent and the beginning of the
518 current one, write zeros to the destination file. */
519 off_t nzeros
= ext_hole_size
;
521 nzeros
= MIN (src_total_size
- dest_pos
, ext_hole_size
);
523 if (! write_zeros (dest_fd
, nzeros
))
525 error (0, errno
, _("%s: write failed"),
530 dest_pos
= MIN (src_total_size
, ext_start
);
534 last_ext_start
= ext_start
;
536 /* Treat an unwritten but allocated extent much like a hole.
537 I.e., don't read, but don't convert to a hole in the destination,
538 unless SPARSE_ALWAYS. */
539 /* For now, do not treat FIEMAP_EXTENT_UNWRITTEN specially,
540 because that (in combination with no sync) would lead to data
541 loss at least on XFS and ext4 when using 2.6.39-rc3 kernels. */
542 if (0 && (scan
.ext_info
[i
].ext_flags
& FIEMAP_EXTENT_UNWRITTEN
))
546 if (ext_len
== 0) /* The last extent is empty and processed. */
547 empty_extent
= false;
552 empty_extent
= false;
553 last_ext_len
= ext_len
;
556 if ( ! sparse_copy (src_fd
, dest_fd
, buf
, buf_size
,
557 sparse_mode
== SPARSE_ALWAYS
? hole_size
: 0,
558 true, src_name
, dst_name
, ext_len
, &n_read
,
562 dest_pos
= ext_start
+ n_read
;
564 wrote_hole_at_eof
= read_hole
;
567 /* If the file ends with unwritten extents not accounted for in the
568 size, then skip processing them, and the associated redundant
569 read() calls which will always return 0. We will need to
570 remove this when we add fallocate() so that we can maintain
571 extents beyond the apparent size. */
572 if (dest_pos
== src_total_size
)
574 scan
.hit_final_extent
= true;
579 /* Release the space allocated to scan->ext_info. */
580 extent_scan_free (&scan
);
583 while (! scan
.hit_final_extent
);
585 /* When the source file ends with a hole, we have to do a little more work,
586 since the above copied only up to and including the final extent.
587 In order to complete the copy, we may have to insert a hole or write
588 zeros in the destination corresponding to the source file's hole-at-EOF.
590 In addition, if the final extent was a block of zeros at EOF and we've
591 just converted them to a hole in the destination, we must call ftruncate
592 here in order to record the proper length in the destination. */
593 if ((dest_pos
< src_total_size
|| wrote_hole_at_eof
)
594 && (sparse_mode
!= SPARSE_NEVER
595 ? ftruncate (dest_fd
, src_total_size
)
596 : ! write_zeros (dest_fd
, src_total_size
- dest_pos
)))
598 error (0, errno
, _("failed to extend %s"), quoteaf (dst_name
));
602 if (sparse_mode
== SPARSE_ALWAYS
&& dest_pos
< src_total_size
603 && punch_hole (dest_fd
, dest_pos
, src_total_size
- dest_pos
) < 0)
605 error (0, errno
, _("error deallocating %s"), quoteaf (dst_name
));
612 /* FIXME: describe */
613 /* FIXME: rewrite this to use a hash table so we avoid the quadratic
614 performance hit that's probably noticeable only on trees deeper
615 than a few hundred levels. See use of active_dir_map in remove.c */
617 static bool _GL_ATTRIBUTE_PURE
618 is_ancestor (const struct stat
*sb
, const struct dir_list
*ancestors
)
620 while (ancestors
!= 0)
622 if (ancestors
->ino
== sb
->st_ino
&& ancestors
->dev
== sb
->st_dev
)
624 ancestors
= ancestors
->parent
;
630 errno_unsupported (int err
)
632 return err
== ENOTSUP
|| err
== ENODATA
;
637 copy_attr_error (struct error_context
*ctx _GL_UNUSED
,
638 char const *fmt
, ...)
640 if (!errno_unsupported (errno
))
645 /* use verror module to print error message */
647 verror (0, err
, fmt
, ap
);
653 copy_attr_allerror (struct error_context
*ctx _GL_UNUSED
,
654 char const *fmt
, ...)
659 /* use verror module to print error message */
661 verror (0, err
, fmt
, ap
);
666 copy_attr_quote (struct error_context
*ctx _GL_UNUSED
, char const *str
)
668 return quoteaf (str
);
672 copy_attr_free (struct error_context
*ctx _GL_UNUSED
,
673 char const *str _GL_UNUSED
)
677 /* Exclude SELinux extended attributes that are otherwise handled,
678 and are problematic to copy again. Also honor attributes
679 configured for exclusion in /etc/xattr.conf.
680 FIXME: Should we handle POSIX ACLs similarly?
681 Return zero to skip. */
683 check_selinux_attr (const char *name
, struct error_context
*ctx
)
685 return STRNCMP_LIT (name
, "security.selinux")
686 && attr_copy_check_permissions (name
, ctx
);
689 /* If positive SRC_FD and DST_FD descriptors are passed,
690 then copy by fd, otherwise copy by name. */
693 copy_attr (char const *src_path
, int src_fd
,
694 char const *dst_path
, int dst_fd
, struct cp_options
const *x
)
697 bool all_errors
= (!x
->data_copy_required
|| x
->require_preserve_xattr
);
698 bool some_errors
= (!all_errors
&& !x
->reduce_diagnostics
);
699 bool selinux_done
= (x
->preserve_security_context
|| x
->set_security_context
);
700 struct error_context ctx
=
702 .error
= all_errors
? copy_attr_allerror
: copy_attr_error
,
703 .quote
= copy_attr_quote
,
704 .quote_free
= copy_attr_free
706 if (0 <= src_fd
&& 0 <= dst_fd
)
707 ret
= attr_copy_fd (src_path
, src_fd
, dst_path
, dst_fd
,
708 selinux_done
? check_selinux_attr
: NULL
,
709 (all_errors
|| some_errors
? &ctx
: NULL
));
711 ret
= attr_copy_file (src_path
, dst_path
,
712 selinux_done
? check_selinux_attr
: NULL
,
713 (all_errors
|| some_errors
? &ctx
: NULL
));
717 #else /* USE_XATTR */
720 copy_attr (char const *src_path _GL_UNUSED
,
721 int src_fd _GL_UNUSED
,
722 char const *dst_path _GL_UNUSED
,
723 int dst_fd _GL_UNUSED
,
724 struct cp_options
const *x _GL_UNUSED
)
728 #endif /* USE_XATTR */
730 /* Read the contents of the directory SRC_NAME_IN, and recursively
731 copy the contents to DST_NAME_IN. NEW_DST is true if
732 DST_NAME_IN is a directory that was created previously in the
733 recursion. SRC_SB and ANCESTORS describe SRC_NAME_IN.
734 Set *COPY_INTO_SELF if SRC_NAME_IN is a parent of
735 (or the same as) DST_NAME_IN; otherwise, clear it.
736 Propagate *FIRST_DIR_CREATED_PER_COMMAND_LINE_ARG from
737 caller to each invocation of copy_internal. Be careful to
738 pass the address of a temporary, and to update
739 *FIRST_DIR_CREATED_PER_COMMAND_LINE_ARG only upon completion.
740 Return true if successful. */
743 copy_dir (char const *src_name_in
, char const *dst_name_in
, bool new_dst
,
744 const struct stat
*src_sb
, struct dir_list
*ancestors
,
745 const struct cp_options
*x
,
746 bool *first_dir_created_per_command_line_arg
,
747 bool *copy_into_self
)
751 struct cp_options non_command_line_options
= *x
;
754 name_space
= savedir (src_name_in
, SAVEDIR_SORT_FASTREAD
);
755 if (name_space
== NULL
)
757 /* This diagnostic is a bit vague because savedir can fail in
758 several different ways. */
759 error (0, errno
, _("cannot access %s"), quoteaf (src_name_in
));
763 /* For cp's -H option, dereference command line arguments, but do not
764 dereference symlinks that are found via recursive traversal. */
765 if (x
->dereference
== DEREF_COMMAND_LINE_ARGUMENTS
)
766 non_command_line_options
.dereference
= DEREF_NEVER
;
768 bool new_first_dir_created
= false;
770 while (*namep
!= '\0')
772 bool local_copy_into_self
;
773 char *src_name
= file_name_concat (src_name_in
, namep
, NULL
);
774 char *dst_name
= file_name_concat (dst_name_in
, namep
, NULL
);
775 bool first_dir_created
= *first_dir_created_per_command_line_arg
;
777 ok
&= copy_internal (src_name
, dst_name
, new_dst
, src_sb
,
778 ancestors
, &non_command_line_options
, false,
780 &local_copy_into_self
, NULL
);
781 *copy_into_self
|= local_copy_into_self
;
786 /* If we're copying into self, there's no point in continuing,
787 and in fact, that would even infloop, now that we record only
788 the first created directory per command line argument. */
789 if (local_copy_into_self
)
792 new_first_dir_created
|= first_dir_created
;
793 namep
+= strlen (namep
) + 1;
796 *first_dir_created_per_command_line_arg
= new_first_dir_created
;
801 /* Set the owner and owning group of DEST_DESC to the st_uid and
802 st_gid fields of SRC_SB. If DEST_DESC is undefined (-1), set
803 the owner and owning group of DST_NAME instead; for
804 safety prefer lchown if the system supports it since no
805 symbolic links should be involved. DEST_DESC must
806 refer to the same file as DEST_NAME if defined.
807 Upon failure to set both UID and GID, try to set only the GID.
808 NEW_DST is true if the file was newly created; otherwise,
809 DST_SB is the status of the destination.
810 Return 1 if the initial syscall succeeds, 0 if it fails but it's OK
811 not to preserve ownership, -1 otherwise. */
814 set_owner (const struct cp_options
*x
, char const *dst_name
, int dest_desc
,
815 struct stat
const *src_sb
, bool new_dst
,
816 struct stat
const *dst_sb
)
818 uid_t uid
= src_sb
->st_uid
;
819 gid_t gid
= src_sb
->st_gid
;
821 /* Naively changing the ownership of an already-existing file before
822 changing its permissions would create a window of vulnerability if
823 the file's old permissions are too generous for the new owner and
824 group. Avoid the window by first changing to a restrictive
825 temporary mode if necessary. */
827 if (!new_dst
&& (x
->preserve_mode
|| x
->move_mode
|| x
->set_mode
))
829 mode_t old_mode
= dst_sb
->st_mode
;
831 (x
->preserve_mode
|| x
->move_mode
? src_sb
->st_mode
: x
->mode
);
832 mode_t restrictive_temp_mode
= old_mode
& new_mode
& S_IRWXU
;
835 || (old_mode
& CHMOD_MODE_BITS
836 & (~new_mode
| S_ISUID
| S_ISGID
| S_ISVTX
)))
837 && qset_acl (dst_name
, dest_desc
, restrictive_temp_mode
) != 0)
839 if (! owner_failure_ok (x
))
840 error (0, errno
, _("clearing permissions for %s"),
842 return -x
->require_preserve
;
846 if (HAVE_FCHOWN
&& dest_desc
!= -1)
848 if (fchown (dest_desc
, uid
, gid
) == 0)
850 if (errno
== EPERM
|| errno
== EINVAL
)
852 /* We've failed to set *both*. Now, try to set just the group
853 ID, but ignore any failure here, and don't change errno. */
854 int saved_errno
= errno
;
855 ignore_value (fchown (dest_desc
, -1, gid
));
861 if (lchown (dst_name
, uid
, gid
) == 0)
863 if (errno
== EPERM
|| errno
== EINVAL
)
865 /* We've failed to set *both*. Now, try to set just the group
866 ID, but ignore any failure here, and don't change errno. */
867 int saved_errno
= errno
;
868 ignore_value (lchown (dst_name
, -1, gid
));
873 if (! chown_failure_ok (x
))
875 error (0, errno
, _("failed to preserve ownership for %s"),
877 if (x
->require_preserve
)
884 /* Set the st_author field of DEST_DESC to the st_author field of
885 SRC_SB. If DEST_DESC is undefined (-1), set the st_author field
886 of DST_NAME instead. DEST_DESC must refer to the same file as
887 DEST_NAME if defined. */
890 set_author (const char *dst_name
, int dest_desc
, const struct stat
*src_sb
)
892 #if HAVE_STRUCT_STAT_ST_AUTHOR
893 /* FIXME: Modify the following code so that it does not
894 follow symbolic links. */
896 /* Preserve the st_author field. */
897 file_t file
= (dest_desc
< 0
898 ? file_name_lookup (dst_name
, 0, 0)
899 : getdport (dest_desc
));
900 if (file
== MACH_PORT_NULL
)
901 error (0, errno
, _("failed to lookup file %s"), quoteaf (dst_name
));
904 error_t err
= file_chauthor (file
, src_sb
->st_author
);
906 error (0, err
, _("failed to preserve authorship for %s"),
908 mach_port_deallocate (mach_task_self (), file
);
917 /* Set the default security context for the process. New files will
918 have this security context set. Also existing files can have their
919 context adjusted based on this process context, by
920 set_file_security_ctx() called with PROCESS_LOCAL=true.
921 This should be called before files are created so there is no race
922 where a file may be present without an appropriate security context.
923 Based on CP_OPTIONS, diagnose warnings and fail when appropriate.
924 Return FALSE on failure, TRUE on success. */
927 set_process_security_ctx (char const *src_name
, char const *dst_name
,
928 mode_t mode
, bool new_dst
, const struct cp_options
*x
)
930 if (x
->preserve_security_context
)
932 /* Set the default context for the process to match the source. */
933 bool all_errors
= !x
->data_copy_required
|| x
->require_preserve_context
;
934 bool some_errors
= !all_errors
&& !x
->reduce_diagnostics
;
937 if (0 <= lgetfilecon (src_name
, &con
))
939 if (setfscreatecon (con
) < 0)
941 if (all_errors
|| (some_errors
&& !errno_unsupported (errno
)))
943 _("failed to set default file creation context to %s"),
945 if (x
->require_preserve_context
)
955 if (all_errors
|| (some_errors
&& !errno_unsupported (errno
)))
958 _("failed to get security context of %s"),
961 if (x
->require_preserve_context
)
965 else if (x
->set_security_context
)
967 /* With -Z, adjust the default context for the process
968 to have the type component adjusted as per the destination path. */
969 if (new_dst
&& defaultcon (dst_name
, mode
) < 0
970 && ! ignorable_ctx_err (errno
))
973 _("failed to set default file creation context for %s"),
981 /* Reset the security context of DST_NAME, to that already set
982 as the process default if PROCESS_LOCAL is true. Otherwise
983 adjust the type component of DST_NAME's security context as
984 per the system default for that path. Issue warnings upon
985 failure, when allowed by various settings in CP_OPTIONS.
986 Return FALSE on failure, TRUE on success. */
989 set_file_security_ctx (char const *dst_name
, bool process_local
,
990 bool recurse
, const struct cp_options
*x
)
992 bool all_errors
= (!x
->data_copy_required
993 || x
->require_preserve_context
);
994 bool some_errors
= !all_errors
&& !x
->reduce_diagnostics
;
996 if (! restorecon (dst_name
, recurse
, process_local
))
998 if (all_errors
|| (some_errors
&& !errno_unsupported (errno
)))
999 error (0, errno
, _("failed to set the security context of %s"),
1000 quoteaf_n (0, dst_name
));
1007 /* Change the file mode bits of the file identified by DESC or NAME to MODE.
1008 Use DESC if DESC is valid and fchmod is available, NAME otherwise. */
1011 fchmod_or_lchmod (int desc
, char const *name
, mode_t mode
)
1015 return fchmod (desc
, mode
);
1017 return lchmod (name
, mode
);
1020 #ifndef HAVE_STRUCT_STAT_ST_BLOCKS
1021 # define HAVE_STRUCT_STAT_ST_BLOCKS 0
1024 /* Use a heuristic to determine whether stat buffer SB comes from a file
1025 with sparse blocks. If the file has fewer blocks than would normally
1026 be needed for a file of its size, then at least one of the blocks in
1027 the file is a hole. In that case, return true. */
1029 is_probably_sparse (struct stat
const *sb
)
1031 return (HAVE_STRUCT_STAT_ST_BLOCKS
1032 && S_ISREG (sb
->st_mode
)
1033 && ST_NBLOCKS (*sb
) < sb
->st_size
/ ST_NBLOCKSIZE
);
1037 /* Copy a regular file from SRC_NAME to DST_NAME.
1038 If the source file contains holes, copies holes and blocks of zeros
1039 in the source file as holes in the destination file.
1040 (Holes are read as zeroes by the 'read' system call.)
1041 When creating the destination, use DST_MODE & ~OMITTED_PERMISSIONS
1042 as the third argument in the call to open, adding
1043 OMITTED_PERMISSIONS after copying as needed.
1044 X provides many option settings.
1045 Return true if successful.
1046 *NEW_DST is as in copy_internal.
1047 SRC_SB is the result of calling follow_fstatat on SRC_NAME. */
1050 copy_reg (char const *src_name
, char const *dst_name
,
1051 const struct cp_options
*x
,
1052 mode_t dst_mode
, mode_t omitted_permissions
, bool *new_dst
,
1053 struct stat
const *src_sb
)
1056 char *buf_alloc
= NULL
;
1057 char *name_alloc
= NULL
;
1061 mode_t src_mode
= src_sb
->st_mode
;
1063 struct stat src_open_sb
;
1064 bool return_val
= true;
1065 bool data_copy_required
= x
->data_copy_required
;
1067 source_desc
= open (src_name
,
1068 (O_RDONLY
| O_BINARY
1069 | (x
->dereference
== DEREF_NEVER
? O_NOFOLLOW
: 0)));
1070 if (source_desc
< 0)
1072 error (0, errno
, _("cannot open %s for reading"), quoteaf (src_name
));
1076 if (fstat (source_desc
, &src_open_sb
) != 0)
1078 error (0, errno
, _("cannot fstat %s"), quoteaf (src_name
));
1080 goto close_src_desc
;
1083 /* Compare the source dev/ino from the open file to the incoming,
1084 saved ones obtained via a previous call to stat. */
1085 if (! SAME_INODE (*src_sb
, src_open_sb
))
1088 _("skipping file %s, as it was replaced while being copied"),
1089 quoteaf (src_name
));
1091 goto close_src_desc
;
1094 /* The semantics of the following open calls are mandated
1095 by the specs for both cp and mv. */
1099 O_WRONLY
| O_BINARY
| (x
->data_copy_required
? O_TRUNC
: 0);
1100 dest_desc
= open (dst_name
, open_flags
);
1103 /* When using cp --preserve=context to copy to an existing destination,
1104 reset the context as per the default context, which has already been
1105 set according to the src.
1106 When using the mutually exclusive -Z option, then adjust the type of
1107 the existing context according to the system default for the dest.
1108 Note we set the context here, _after_ the file is opened, lest the
1109 new context disallow that. */
1110 if ((x
->set_security_context
|| x
->preserve_security_context
)
1113 if (! set_file_security_ctx (dst_name
, x
->preserve_security_context
,
1116 if (x
->require_preserve_context
)
1119 goto close_src_and_dst_desc
;
1124 if (dest_desc
< 0 && x
->unlink_dest_after_failed_open
)
1126 if (unlink (dst_name
) != 0)
1128 error (0, errno
, _("cannot remove %s"), quoteaf (dst_name
));
1130 goto close_src_desc
;
1133 printf (_("removed %s\n"), quoteaf (dst_name
));
1135 /* Tell caller that the destination file was unlinked. */
1138 /* Ensure there is no race where a file may be left without
1139 an appropriate security context. */
1140 if (x
->set_security_context
)
1142 if (! set_process_security_ctx (src_name
, dst_name
, dst_mode
,
1146 goto close_src_desc
;
1156 int open_flags
= O_WRONLY
| O_CREAT
| O_BINARY
;
1157 dest_desc
= open (dst_name
, open_flags
| O_EXCL
,
1158 dst_mode
& ~omitted_permissions
);
1161 /* When trying to copy through a dangling destination symlink,
1162 the above open fails with EEXIST. If that happens, and
1163 lstat'ing the DST_NAME shows that it is a symlink, then we
1164 have a problem: trying to resolve this dangling symlink to
1165 a directory/destination-entry pair is fundamentally racy,
1166 so punt. If x->open_dangling_dest_symlink is set (cp sets
1167 that when POSIXLY_CORRECT is set in the environment), simply
1168 call open again, but without O_EXCL (potentially dangerous).
1169 If not, fail with a diagnostic. These shenanigans are necessary
1170 only when copying, i.e., not in move_mode. */
1171 if (dest_desc
< 0 && dest_errno
== EEXIST
&& ! x
->move_mode
)
1173 struct stat dangling_link_sb
;
1174 if (lstat (dst_name
, &dangling_link_sb
) == 0
1175 && S_ISLNK (dangling_link_sb
.st_mode
))
1177 if (x
->open_dangling_dest_symlink
)
1179 dest_desc
= open (dst_name
, open_flags
,
1180 dst_mode
& ~omitted_permissions
);
1185 error (0, 0, _("not writing through dangling symlink %s"),
1186 quoteaf (dst_name
));
1188 goto close_src_desc
;
1193 /* Improve quality of diagnostic when a nonexistent dst_name
1194 ends in a slash and open fails with errno == EISDIR. */
1195 if (dest_desc
< 0 && dest_errno
== EISDIR
1196 && *dst_name
&& dst_name
[strlen (dst_name
) - 1] == '/')
1197 dest_errno
= ENOTDIR
;
1201 omitted_permissions
= 0;
1206 /* If we've just failed due to ENOENT for an ostensibly preexisting
1207 destination (*new_dst was 0), that's a bit of a contradiction/race:
1208 the prior stat/lstat said the file existed (*new_dst was 0), yet
1209 the subsequent open-existing-file failed with ENOENT. With NFS,
1210 the race window is wider still, since its meta-data caching tends
1211 to make the stat succeed for a just-removed remote file, while the
1212 more-definitive initial open call will fail with ENOENT. When this
1213 situation arises, we attempt to open again, but this time with
1214 O_CREAT. Do this only when not in move-mode, since when handling
1215 a cross-device move, we must never open an existing destination. */
1216 if (dest_errno
== ENOENT
&& ! *new_dst
&& ! x
->move_mode
)
1219 goto open_with_O_CREAT
;
1222 /* Otherwise, it's an error. */
1223 error (0, dest_errno
, _("cannot create regular file %s"),
1224 quoteaf (dst_name
));
1226 goto close_src_desc
;
1229 if (fstat (dest_desc
, &sb
) != 0)
1231 error (0, errno
, _("cannot fstat %s"), quoteaf (dst_name
));
1233 goto close_src_and_dst_desc
;
1236 /* --attributes-only overrides --reflink. */
1237 if (data_copy_required
&& x
->reflink_mode
)
1239 bool clone_ok
= clone_file (dest_desc
, source_desc
) == 0;
1240 if (clone_ok
|| x
->reflink_mode
== REFLINK_ALWAYS
)
1244 error (0, errno
, _("failed to clone %s from %s"),
1245 quoteaf_n (0, dst_name
), quoteaf_n (1, src_name
));
1247 goto close_src_and_dst_desc
;
1249 data_copy_required
= false;
1253 if (data_copy_required
)
1255 /* Choose a suitable buffer size; it may be adjusted later. */
1256 size_t buf_alignment
= getpagesize ();
1257 size_t buf_size
= io_blksize (sb
);
1258 size_t hole_size
= ST_BLKSIZE (sb
);
1260 fdadvise (source_desc
, 0, 0, FADVISE_SEQUENTIAL
);
1262 /* Deal with sparse files. */
1263 bool make_holes
= false;
1264 bool sparse_src
= is_probably_sparse (&src_open_sb
);
1266 if (S_ISREG (sb
.st_mode
))
1268 /* Even with --sparse=always, try to create holes only
1269 if the destination is a regular file. */
1270 if (x
->sparse_mode
== SPARSE_ALWAYS
)
1273 /* Use a heuristic to determine whether SRC_NAME contains any sparse
1274 blocks. If the file has fewer blocks than would normally be
1275 needed for a file of its size, then at least one of the blocks in
1276 the file is a hole. */
1277 if (x
->sparse_mode
== SPARSE_AUTO
&& sparse_src
)
1281 /* If not making a sparse file, try to use a more-efficient
1285 /* Compute the least common multiple of the input and output
1286 buffer sizes, adjusting for outlandish values. */
1287 size_t blcm_max
= MIN (SIZE_MAX
, SSIZE_MAX
) - buf_alignment
;
1288 size_t blcm
= buffer_lcm (io_blksize (src_open_sb
), buf_size
,
1291 /* Do not bother with a buffer larger than the input file, plus one
1292 byte to make sure the file has not grown while reading it. */
1293 if (S_ISREG (src_open_sb
.st_mode
) && src_open_sb
.st_size
< buf_size
)
1294 buf_size
= src_open_sb
.st_size
+ 1;
1296 /* However, stick with a block size that is a positive multiple of
1297 blcm, overriding the above adjustments. Watch out for
1299 buf_size
+= blcm
- 1;
1300 buf_size
-= buf_size
% blcm
;
1301 if (buf_size
== 0 || blcm_max
< buf_size
)
1305 buf_alloc
= xmalloc (buf_size
+ buf_alignment
);
1306 buf
= ptr_align (buf_alloc
, buf_alignment
);
1310 bool normal_copy_required
;
1312 /* Perform an efficient extent-based copy, falling back to the
1313 standard copy only if the initial extent scan fails. If the
1314 '--sparse=never' option is specified, write all data but use
1315 any extents to read more efficiently. */
1316 if (extent_copy (source_desc
, dest_desc
, buf
, buf_size
, hole_size
,
1317 src_open_sb
.st_size
,
1318 make_holes
? x
->sparse_mode
: SPARSE_NEVER
,
1319 src_name
, dst_name
, &normal_copy_required
))
1320 goto preserve_metadata
;
1322 if (! normal_copy_required
)
1325 goto close_src_and_dst_desc
;
1330 bool wrote_hole_at_eof
;
1331 if (! sparse_copy (source_desc
, dest_desc
, buf
, buf_size
,
1332 make_holes
? hole_size
: 0,
1333 x
->sparse_mode
== SPARSE_ALWAYS
, src_name
, dst_name
,
1334 UINTMAX_MAX
, &n_read
,
1335 &wrote_hole_at_eof
))
1338 goto close_src_and_dst_desc
;
1340 else if (wrote_hole_at_eof
&& ftruncate (dest_desc
, n_read
) < 0)
1342 error (0, errno
, _("failed to extend %s"), quoteaf (dst_name
));
1344 goto close_src_and_dst_desc
;
1349 if (x
->preserve_timestamps
)
1351 struct timespec timespec
[2];
1352 timespec
[0] = get_stat_atime (src_sb
);
1353 timespec
[1] = get_stat_mtime (src_sb
);
1355 if (fdutimens (dest_desc
, dst_name
, timespec
) != 0)
1357 error (0, errno
, _("preserving times for %s"), quoteaf (dst_name
));
1358 if (x
->require_preserve
)
1361 goto close_src_and_dst_desc
;
1366 /* Set ownership before xattrs as changing owners will
1367 clear capabilities. */
1368 if (x
->preserve_ownership
&& ! SAME_OWNER_AND_GROUP (*src_sb
, sb
))
1370 switch (set_owner (x
, dst_name
, dest_desc
, src_sb
, *new_dst
, &sb
))
1374 goto close_src_and_dst_desc
;
1377 src_mode
&= ~ (S_ISUID
| S_ISGID
| S_ISVTX
);
1382 /* To allow copying xattrs on read-only files, temporarily chmod u+rw.
1383 This workaround is required as an inode permission check is done
1384 by xattr_permission() in fs/xattr.c of the GNU/Linux kernel tree. */
1385 if (x
->preserve_xattr
)
1387 bool access_changed
= false;
1389 if (!(sb
.st_mode
& S_IWUSR
) && geteuid () != ROOT_UID
)
1391 access_changed
= fchmod_or_lchmod (dest_desc
, dst_name
,
1392 S_IRUSR
| S_IWUSR
) == 0;
1395 if (!copy_attr (src_name
, source_desc
, dst_name
, dest_desc
, x
)
1396 && x
->require_preserve_xattr
)
1400 fchmod_or_lchmod (dest_desc
, dst_name
, dst_mode
& ~omitted_permissions
);
1403 set_author (dst_name
, dest_desc
, src_sb
);
1405 if (x
->preserve_mode
|| x
->move_mode
)
1407 if (copy_acl (src_name
, source_desc
, dst_name
, dest_desc
, src_mode
) != 0
1408 && x
->require_preserve
)
1411 else if (x
->set_mode
)
1413 if (set_acl (dst_name
, dest_desc
, x
->mode
) != 0)
1416 else if (x
->explicit_no_preserve_mode
&& *new_dst
)
1418 if (set_acl (dst_name
, dest_desc
, MODE_RW_UGO
& ~cached_umask ()) != 0)
1421 else if (omitted_permissions
)
1423 omitted_permissions
&= ~ cached_umask ();
1424 if (omitted_permissions
1425 && fchmod_or_lchmod (dest_desc
, dst_name
, dst_mode
) != 0)
1427 error (0, errno
, _("preserving permissions for %s"),
1428 quoteaf (dst_name
));
1429 if (x
->require_preserve
)
1434 close_src_and_dst_desc
:
1435 if (close (dest_desc
) < 0)
1437 error (0, errno
, _("failed to close %s"), quoteaf (dst_name
));
1441 if (close (source_desc
) < 0)
1443 error (0, errno
, _("failed to close %s"), quoteaf (src_name
));
1452 /* Return true if it's ok that the source and destination
1453 files are the 'same' by some measure. The goal is to avoid
1454 making the 'copy' operation remove both copies of the file
1455 in that case, while still allowing the user to e.g., move or
1456 copy a regular file onto a symlink that points to it.
1457 Try to minimize the cost of this function in the common case.
1458 Set *RETURN_NOW if we've determined that the caller has no more
1459 work to do and should return successfully, right away. */
1462 same_file_ok (char const *src_name
, struct stat
const *src_sb
,
1463 char const *dst_name
, struct stat
const *dst_sb
,
1464 const struct cp_options
*x
, bool *return_now
)
1466 const struct stat
*src_sb_link
;
1467 const struct stat
*dst_sb_link
;
1468 struct stat tmp_dst_sb
;
1469 struct stat tmp_src_sb
;
1472 bool same
= SAME_INODE (*src_sb
, *dst_sb
);
1474 *return_now
= false;
1476 /* FIXME: this should (at the very least) be moved into the following
1477 if-block. More likely, it should be removed, because it inhibits
1478 making backups. But removing it will result in a change in behavior
1479 that will probably have to be documented -- and tests will have to
1481 if (same
&& x
->hard_link
)
1487 if (x
->dereference
== DEREF_NEVER
)
1491 /* If both the source and destination files are symlinks (and we'll
1492 know this here IFF preserving symlinks), then it's usually ok
1493 when they are distinct. */
1494 if (S_ISLNK (src_sb
->st_mode
) && S_ISLNK (dst_sb
->st_mode
))
1496 bool sn
= same_name (src_name
, dst_name
);
1499 /* It's fine when we're making any type of backup. */
1500 if (x
->backup_type
!= no_backups
)
1503 /* Here we have two symlinks that are hard-linked together,
1504 and we're not making backups. In this unusual case, simply
1505 returning true would lead to mv calling "rename(A,B)",
1506 which would do nothing and return 0. */
1510 return ! x
->move_mode
;
1517 src_sb_link
= src_sb
;
1518 dst_sb_link
= dst_sb
;
1525 if (lstat (dst_name
, &tmp_dst_sb
) != 0
1526 || lstat (src_name
, &tmp_src_sb
) != 0)
1529 src_sb_link
= &tmp_src_sb
;
1530 dst_sb_link
= &tmp_dst_sb
;
1532 same_link
= SAME_INODE (*src_sb_link
, *dst_sb_link
);
1534 /* If both are symlinks, then it's ok, but only if the destination
1535 will be unlinked before being opened. This is like the test
1536 above, but with the addition of the unlink_dest_before_opening
1537 conjunct because otherwise, with two symlinks to the same target,
1538 we'd end up truncating the source file. */
1539 if (S_ISLNK (src_sb_link
->st_mode
) && S_ISLNK (dst_sb_link
->st_mode
)
1540 && x
->unlink_dest_before_opening
)
1544 /* The backup code ensures there's a copy, so it's usually ok to
1545 remove any destination file. One exception is when both
1546 source and destination are the same directory entry. In that
1547 case, moving the destination file aside (in making the backup)
1548 would also rename the source file and result in an error. */
1549 if (x
->backup_type
!= no_backups
)
1553 /* In copy mode when dereferencing symlinks, if the source is a
1554 symlink and the dest is not, then backing up the destination
1555 (moving it aside) would make it a dangling symlink, and the
1556 subsequent attempt to open it in copy_reg would fail with
1557 a misleading diagnostic. Avoid that by returning zero in
1558 that case so the caller can make cp (or mv when it has to
1559 resort to reading the source file) fail now. */
1561 /* FIXME-note: even with the following kludge, we can still provoke
1562 the offending diagnostic. It's just a little harder to do :-)
1563 $ rm -f a b c; touch c; ln -s c b; ln -s b a; cp -b a b
1564 cp: cannot open 'a' for reading: No such file or directory
1565 That's misleading, since a subsequent 'ls' shows that 'a'
1567 One solution would be to open the source file *before* moving
1568 aside the destination, but that'd involve a big rewrite. */
1570 && x
->dereference
!= DEREF_NEVER
1571 && S_ISLNK (src_sb_link
->st_mode
)
1572 && ! S_ISLNK (dst_sb_link
->st_mode
))
1578 /* FIXME: What about case insensitive file systems ? */
1579 return ! same_name (src_name
, dst_name
);
1583 /* FIXME: use or remove */
1585 /* If we're making a backup, we'll detect the problem case in
1586 copy_reg because SRC_NAME will no longer exist. Allowing
1587 the test to be deferred lets cp do some useful things.
1588 But when creating hardlinks and SRC_NAME is a symlink
1589 but DST_NAME is not we must test anyway. */
1591 || !S_ISLNK (src_sb_link
->st_mode
)
1592 || S_ISLNK (dst_sb_link
->st_mode
))
1595 if (x
->dereference
!= DEREF_NEVER
)
1599 if (x
->move_mode
|| x
->unlink_dest_before_opening
)
1601 /* They may refer to the same file if we're in move mode and the
1602 target is a symlink. That is ok, since we remove any existing
1603 destination file before opening it -- via 'rename' if they're on
1604 the same file system, via 'unlink (DST_NAME)' otherwise. */
1605 if (S_ISLNK (dst_sb_link
->st_mode
))
1608 /* It's not ok if they're distinct hard links to the same file as
1609 this causes a race condition and we may lose data in this case. */
1611 && 1 < dst_sb_link
->st_nlink
1612 && ! same_name (src_name
, dst_name
))
1613 return ! x
->move_mode
;
1616 /* If neither is a symlink, then it's ok as long as they aren't
1617 hard links to the same file. */
1618 if (!S_ISLNK (src_sb_link
->st_mode
) && !S_ISLNK (dst_sb_link
->st_mode
))
1620 if (!SAME_INODE (*src_sb_link
, *dst_sb_link
))
1623 /* If they are the same file, it's ok if we're making hard links. */
1631 /* At this point, it is normally an error (data loss) to move a symlink
1632 onto its referent, but in at least one narrow case, it is not:
1634 1) src is a symlink,
1635 2) dest has a link count of 2 or more and
1636 3) dest and the referent of src are not the same directory entry,
1637 then it's ok, since while we'll lose one of those hard links,
1638 src will still point to a remaining link.
1639 Note that technically, condition #3 obviates condition #2, but we
1640 retain the 1 < st_nlink condition because that means fewer invocations
1641 of the more expensive #3.
1644 $ touch f && ln f l && ln -s f s
1646 -rw-------. 2 0 Jan 4 22:46 f
1647 -rw-------. 2 0 Jan 4 22:46 l
1648 lrwxrwxrwx. 1 1 Jan 4 22:46 s -> f
1649 this must fail: mv s f
1650 this must succeed: mv s l */
1652 && S_ISLNK (src_sb
->st_mode
)
1653 && 1 < dst_sb_link
->st_nlink
)
1655 char *abs_src
= canonicalize_file_name (src_name
);
1658 bool result
= ! same_name (abs_src
, dst_name
);
1664 /* It's ok to recreate a destination symlink. */
1665 if (x
->symbolic_link
&& S_ISLNK (dst_sb_link
->st_mode
))
1668 if (x
->dereference
== DEREF_NEVER
)
1670 if ( ! S_ISLNK (src_sb_link
->st_mode
))
1671 tmp_src_sb
= *src_sb_link
;
1672 else if (stat (src_name
, &tmp_src_sb
) != 0)
1675 if ( ! S_ISLNK (dst_sb_link
->st_mode
))
1676 tmp_dst_sb
= *dst_sb_link
;
1677 else if (stat (dst_name
, &tmp_dst_sb
) != 0)
1680 if ( ! SAME_INODE (tmp_src_sb
, tmp_dst_sb
))
1685 /* It's ok to attempt to hardlink the same file,
1686 and return early if not replacing a symlink.
1687 Note we need to return early to avoid a later
1688 unlink() of DST (when SRC is a symlink). */
1689 *return_now
= ! S_ISLNK (dst_sb_link
->st_mode
);
1697 /* Return true if FILE, with mode MODE, is writable in the sense of 'mv'.
1698 Always consider a symbolic link to be writable. */
1700 writable_destination (char const *file
, mode_t mode
)
1702 return (S_ISLNK (mode
)
1703 || can_write_any_file ()
1704 || euidaccess (file
, W_OK
) == 0);
1708 overwrite_ok (struct cp_options
const *x
, char const *dst_name
,
1709 struct stat
const *dst_sb
)
1711 if (! writable_destination (dst_name
, dst_sb
->st_mode
))
1713 char perms
[12]; /* "-rwxrwxrwx " ls-style modes. */
1714 strmode (dst_sb
->st_mode
, perms
);
1717 (x
->move_mode
|| x
->unlink_dest_before_opening
1718 || x
->unlink_dest_after_failed_open
)
1719 ? _("%s: replace %s, overriding mode %04lo (%s)? ")
1720 : _("%s: unwritable %s (mode %04lo, %s); try anyway? "),
1721 program_name
, quoteaf (dst_name
),
1722 (unsigned long int) (dst_sb
->st_mode
& CHMOD_MODE_BITS
),
1727 fprintf (stderr
, _("%s: overwrite %s? "),
1728 program_name
, quoteaf (dst_name
));
1734 /* Initialize the hash table implementing a set of F_triple entries
1735 corresponding to destination files. */
1737 dest_info_init (struct cp_options
*x
)
1740 = hash_initialize (DEST_INFO_INITIAL_CAPACITY
,
1747 /* Initialize the hash table implementing a set of F_triple entries
1748 corresponding to source files listed on the command line. */
1750 src_info_init (struct cp_options
*x
)
1753 /* Note that we use triple_hash_no_name here.
1754 Contrast with the use of triple_hash above.
1755 That is necessary because a source file may be specified
1756 in many different ways. We want to warn about this
1762 = hash_initialize (DEST_INFO_INITIAL_CAPACITY
,
1764 triple_hash_no_name
,
1769 /* When effecting a move (e.g., for mv(1)), and given the name DST_NAME
1770 of the destination and a corresponding stat buffer, DST_SB, return
1771 true if the logical 'move' operation should _not_ proceed.
1772 Otherwise, return false.
1773 Depending on options specified in X, this code may issue an
1774 interactive prompt asking whether it's ok to overwrite DST_NAME. */
1776 abandon_move (const struct cp_options
*x
,
1777 char const *dst_name
,
1778 struct stat
const *dst_sb
)
1780 assert (x
->move_mode
);
1781 return (x
->interactive
== I_ALWAYS_NO
1782 || ((x
->interactive
== I_ASK_USER
1783 || (x
->interactive
== I_UNSPECIFIED
1785 && ! writable_destination (dst_name
, dst_sb
->st_mode
)))
1786 && ! overwrite_ok (x
, dst_name
, dst_sb
)));
1789 /* Print --verbose output on standard output, e.g. 'new' -> 'old'.
1790 If BACKUP_DST_NAME is non-NULL, then also indicate that it is
1791 the name of a backup file. */
1793 emit_verbose (char const *src
, char const *dst
, char const *backup_dst_name
)
1795 printf ("%s -> %s", quoteaf_n (0, src
), quoteaf_n (1, dst
));
1796 if (backup_dst_name
)
1797 printf (_(" (backup: %s)"), quoteaf (backup_dst_name
));
1801 /* A wrapper around "setfscreatecon (NULL)" that exits upon failure. */
1803 restore_default_fscreatecon_or_die (void)
1805 if (setfscreatecon (NULL
) != 0)
1806 die (EXIT_FAILURE
, errno
,
1807 _("failed to restore the default file creation context"));
1810 /* Create a hard link DST_NAME to SRC_NAME, honoring the REPLACE, VERBOSE and
1811 DEREFERENCE settings. Return true upon success. Otherwise, diagnose the
1812 failure and return false. If SRC_NAME is a symbolic link, then it will not
1813 be followed unless DEREFERENCE is true.
1814 If the system doesn't support hard links to symbolic links, then DST_NAME
1815 will be created as a symbolic link to SRC_NAME. */
1817 create_hard_link (char const *src_name
, char const *dst_name
,
1818 bool replace
, bool verbose
, bool dereference
)
1820 int err
= force_linkat (AT_FDCWD
, src_name
, AT_FDCWD
, dst_name
,
1821 dereference
? AT_SYMLINK_FOLLOW
: 0,
1825 error (0, err
, _("cannot create hard link %s to %s"),
1826 quoteaf_n (0, dst_name
), quoteaf_n (1, src_name
));
1829 if (err
< 0 && verbose
)
1830 printf (_("removed %s\n"), quoteaf (dst_name
));
1834 /* Return true if the current file should be (tried to be) dereferenced:
1835 either for DEREF_ALWAYS or for DEREF_COMMAND_LINE_ARGUMENTS in the case
1836 where the current file is a COMMAND_LINE_ARG; otherwise return false. */
1837 static inline bool _GL_ATTRIBUTE_PURE
1838 should_dereference (const struct cp_options
*x
, bool command_line_arg
)
1840 return x
->dereference
== DEREF_ALWAYS
1841 || (x
->dereference
== DEREF_COMMAND_LINE_ARGUMENTS
1842 && command_line_arg
);
1845 /* Return true if the source file with basename SRCBASE and status SRC_ST
1846 is likely to be the simple backup file for DST_NAME. */
1848 source_is_dst_backup (char const *srcbase
, struct stat
const *src_st
,
1849 char const *dst_name
)
1851 size_t srcbaselen
= strlen (srcbase
);
1852 char const *dstbase
= last_component (dst_name
);
1853 size_t dstbaselen
= strlen (dstbase
);
1854 size_t suffixlen
= strlen (simple_backup_suffix
);
1855 if (! (srcbaselen
== dstbaselen
+ suffixlen
1856 && memcmp (srcbase
, dstbase
, dstbaselen
) == 0
1857 && STREQ (srcbase
+ dstbaselen
, simple_backup_suffix
)))
1859 size_t dstlen
= strlen (dst_name
);
1860 char *dst_back
= xmalloc (dstlen
+ suffixlen
+ 1);
1861 strcpy (mempcpy (dst_back
, dst_name
, dstlen
), simple_backup_suffix
);
1862 struct stat dst_back_sb
;
1863 int dst_back_status
= stat (dst_back
, &dst_back_sb
);
1865 return dst_back_status
== 0 && SAME_INODE (*src_st
, dst_back_sb
);
1868 /* Copy the file SRC_NAME to the file DST_NAME. The files may be of
1869 any type. NEW_DST should be true if the file DST_NAME cannot
1870 exist because its parent directory was just created; NEW_DST should
1871 be false if DST_NAME might already exist. A non-null PARENT describes the
1872 parent directory. ANCESTORS points to a linked, null terminated list of
1873 devices and inodes of parent directories of SRC_NAME. COMMAND_LINE_ARG
1874 is true iff SRC_NAME was specified on the command line.
1875 FIRST_DIR_CREATED_PER_COMMAND_LINE_ARG is both input and output.
1876 Set *COPY_INTO_SELF if SRC_NAME is a parent of (or the
1877 same as) DST_NAME; otherwise, clear it.
1878 Return true if successful. */
1880 copy_internal (char const *src_name
, char const *dst_name
,
1882 struct stat
const *parent
,
1883 struct dir_list
*ancestors
,
1884 const struct cp_options
*x
,
1885 bool command_line_arg
,
1886 bool *first_dir_created_per_command_line_arg
,
1887 bool *copy_into_self
,
1888 bool *rename_succeeded
)
1892 mode_t src_mode
IF_LINT ( = 0);
1893 mode_t dst_mode
IF_LINT ( = 0);
1894 mode_t dst_mode_bits
;
1895 mode_t omitted_permissions
;
1896 bool restore_dst_mode
= false;
1897 char *earlier_file
= NULL
;
1898 char *dst_backup
= NULL
;
1900 bool copied_as_regular
= false;
1901 bool dest_is_symlink
= false;
1902 bool have_dst_lstat
= false;
1904 *copy_into_self
= false;
1906 int rename_errno
= x
->rename_errno
;
1909 if (rename_errno
< 0)
1910 rename_errno
= (renameatu (AT_FDCWD
, src_name
, AT_FDCWD
, dst_name
,
1913 new_dst
= rename_errno
== 0;
1914 if (rename_succeeded
)
1915 *rename_succeeded
= new_dst
;
1918 if (rename_errno
== 0
1920 : rename_errno
!= EEXIST
|| x
->interactive
!= I_ALWAYS_NO
)
1922 char const *name
= rename_errno
== 0 ? dst_name
: src_name
;
1924 = x
->dereference
== DEREF_NEVER
? AT_SYMLINK_NOFOLLOW
: 0;
1925 if (follow_fstatat (AT_FDCWD
, name
, &src_sb
, fstatat_flags
) != 0)
1927 error (0, errno
, _("cannot stat %s"), quoteaf (name
));
1931 src_mode
= src_sb
.st_mode
;
1933 if (S_ISDIR (src_mode
) && !x
->recursive
)
1935 error (0, 0, ! x
->install_mode
/* cp */
1936 ? _("-r not specified; omitting directory %s")
1937 : _("omitting directory %s"),
1938 quoteaf (src_name
));
1945 assert (x
->move_mode
);
1946 memset (&src_sb
, 0, sizeof src_sb
);
1950 /* Detect the case in which the same source file appears more than
1951 once on the command line and no backup option has been selected.
1952 If so, simply warn and don't copy it the second time.
1953 This check is enabled only if x->src_info is non-NULL. */
1954 if (command_line_arg
&& x
->src_info
)
1956 if ( ! S_ISDIR (src_mode
)
1957 && x
->backup_type
== no_backups
1958 && seen_file (x
->src_info
, src_name
, &src_sb
))
1960 error (0, 0, _("warning: source file %s specified more than once"),
1961 quoteaf (src_name
));
1965 record_file (x
->src_info
, src_name
, &src_sb
);
1968 bool dereference
= should_dereference (x
, command_line_arg
);
1972 if (! (rename_errno
== EEXIST
&& x
->interactive
== I_ALWAYS_NO
))
1974 /* Regular files can be created by writing through symbolic
1975 links, but other files cannot. So use stat on the
1976 destination when copying a regular file, and lstat otherwise.
1977 However, if we intend to unlink or remove the destination
1978 first, use lstat, since a copy won't actually be made to the
1979 destination in that case. */
1981 = ((! S_ISREG (src_mode
)
1982 && (! x
->copy_as_regular
1983 || S_ISDIR (src_mode
) || S_ISLNK (src_mode
)))
1984 || x
->move_mode
|| x
->symbolic_link
|| x
->hard_link
1985 || x
->backup_type
!= no_backups
1986 || x
->unlink_dest_before_opening
);
1987 int fstatat_flags
= use_lstat
? AT_SYMLINK_NOFOLLOW
: 0;
1988 if (follow_fstatat (AT_FDCWD
, dst_name
, &dst_sb
, fstatat_flags
) == 0)
1990 have_dst_lstat
= use_lstat
;
1991 rename_errno
= EEXIST
;
1995 if (errno
== ELOOP
&& x
->unlink_dest_after_failed_open
)
1996 /* leave new_dst=false so we unlink later. */;
1997 else if (errno
!= ENOENT
)
1999 error (0, errno
, _("cannot stat %s"), quoteaf (dst_name
));
2007 if (rename_errno
== EEXIST
)
2009 bool return_now
= false;
2011 if (x
->interactive
!= I_ALWAYS_NO
2012 && ! same_file_ok (src_name
, &src_sb
, dst_name
, &dst_sb
,
2015 error (0, 0, _("%s and %s are the same file"),
2016 quoteaf_n (0, src_name
), quoteaf_n (1, dst_name
));
2020 if (x
->update
&& !S_ISDIR (src_mode
))
2022 /* When preserving timestamps (but not moving within a file
2023 system), don't worry if the destination timestamp is
2024 less than the source merely because of timestamp
2026 int options
= ((x
->preserve_timestamps
2028 && dst_sb
.st_dev
== src_sb
.st_dev
))
2029 ? UTIMECMP_TRUNCATE_SOURCE
2032 if (0 <= utimecmp (dst_name
, &dst_sb
, &src_sb
, options
))
2034 /* We're using --update and the destination is not older
2035 than the source, so do not copy or move. Pretend the
2036 rename succeeded, so the caller (if it's mv) doesn't
2037 end up removing the source file. */
2038 if (rename_succeeded
)
2039 *rename_succeeded
= true;
2041 /* However, we still must record that we've processed
2042 this src/dest pair, in case this source file is
2043 hard-linked to another one. In that case, we'll use
2044 the mapping information to link the corresponding
2045 destination names. */
2046 earlier_file
= remember_copied (dst_name
, src_sb
.st_ino
,
2050 /* Note we currently replace DST_NAME unconditionally,
2051 even if it was a newer separate file. */
2052 if (! create_hard_link (earlier_file
, dst_name
, true,
2053 x
->verbose
, dereference
))
2063 /* When there is an existing destination file, we may end up
2064 returning early, and hence not copying/moving the file.
2065 This may be due to an interactive 'negative' reply to the
2066 prompt about the existing file. It may also be due to the
2067 use of the --no-clobber option.
2069 cp and mv treat -i and -f differently. */
2072 if (abandon_move (x
, dst_name
, &dst_sb
))
2074 /* Pretend the rename succeeded, so the caller (mv)
2075 doesn't end up removing the source file. */
2076 if (rename_succeeded
)
2077 *rename_succeeded
= true;
2083 if (! S_ISDIR (src_mode
)
2084 && (x
->interactive
== I_ALWAYS_NO
2085 || (x
->interactive
== I_ASK_USER
2086 && ! overwrite_ok (x
, dst_name
, &dst_sb
))))
2093 if (!S_ISDIR (dst_sb
.st_mode
))
2095 if (S_ISDIR (src_mode
))
2097 if (x
->move_mode
&& x
->backup_type
!= no_backups
)
2099 /* Moving a directory onto an existing
2100 non-directory is ok only with --backup. */
2105 _("cannot overwrite non-directory %s with directory %s"),
2106 quoteaf_n (0, dst_name
), quoteaf_n (1, src_name
));
2111 /* Don't let the user destroy their data, even if they try hard:
2112 This mv command must fail (likewise for cp):
2113 rm -rf a b c; mkdir a b c; touch a/f b/f; mv a/f b/f c
2114 Otherwise, the contents of b/f would be lost.
2115 In the case of 'cp', b/f would be lost if the user simulated
2116 a move using cp and rm.
2117 Note that it works fine if you use --backup=numbered. */
2118 if (command_line_arg
2119 && x
->backup_type
!= numbered_backups
2120 && seen_file (x
->dest_info
, dst_name
, &dst_sb
))
2123 _("will not overwrite just-created %s with %s"),
2124 quoteaf_n (0, dst_name
), quoteaf_n (1, src_name
));
2129 if (!S_ISDIR (src_mode
))
2131 if (S_ISDIR (dst_sb
.st_mode
))
2133 if (x
->move_mode
&& x
->backup_type
!= no_backups
)
2135 /* Moving a non-directory onto an existing
2136 directory is ok only with --backup. */
2141 _("cannot overwrite directory %s with non-directory"),
2142 quoteaf (dst_name
));
2150 /* Don't allow user to move a directory onto a non-directory. */
2151 if (S_ISDIR (src_sb
.st_mode
) && !S_ISDIR (dst_sb
.st_mode
)
2152 && x
->backup_type
== no_backups
)
2155 _("cannot move directory onto non-directory: %s -> %s"),
2156 quotef_n (0, src_name
), quotef_n (0, dst_name
));
2161 char const *srcbase
;
2162 if (x
->backup_type
!= no_backups
2163 /* Don't try to back up a destination if the last
2164 component of src_name is "." or "..". */
2165 && ! dot_or_dotdot (srcbase
= last_component (src_name
))
2166 /* Create a backup of each destination directory in move mode,
2167 but not in copy mode. FIXME: it might make sense to add an
2168 option to suppress backup creation also for move mode.
2169 That would let one use mv to merge new content into an
2170 existing hierarchy. */
2171 && (x
->move_mode
|| ! S_ISDIR (dst_sb
.st_mode
)))
2173 /* Fail if creating the backup file would likely destroy
2174 the source file. Otherwise, the commands:
2175 cd /tmp; rm -f a a~; : > a; echo A > a~; cp --b=simple a~ a
2176 would leave two zero-length files: a and a~. */
2177 if (x
->backup_type
!= numbered_backups
2178 && source_is_dst_backup (srcbase
, &src_sb
, dst_name
))
2182 ? _("backing up %s might destroy source; %s not moved")
2183 : _("backing up %s might destroy source; %s not copied"));
2185 quoteaf_n (0, dst_name
),
2186 quoteaf_n (1, src_name
));
2190 char *tmp_backup
= backup_file_rename (AT_FDCWD
, dst_name
,
2194 Using alloca for a file name that may be arbitrarily
2195 long is not recommended. In fact, even forming such a name
2196 should be discouraged. Eventually, this code will be rewritten
2197 to use fts, so using alloca here will be less of a problem. */
2200 ASSIGN_STRDUPA (dst_backup
, tmp_backup
);
2203 else if (errno
!= ENOENT
)
2205 error (0, errno
, _("cannot backup %s"), quoteaf (dst_name
));
2210 else if (! S_ISDIR (dst_sb
.st_mode
)
2211 /* Never unlink dst_name when in move mode. */
2213 && (x
->unlink_dest_before_opening
2214 || (x
->preserve_links
&& 1 < dst_sb
.st_nlink
)
2215 || (x
->dereference
== DEREF_NEVER
2216 && ! S_ISREG (src_sb
.st_mode
))
2219 if (unlink (dst_name
) != 0 && errno
!= ENOENT
)
2221 error (0, errno
, _("cannot remove %s"), quoteaf (dst_name
));
2226 printf (_("removed %s\n"), quoteaf (dst_name
));
2231 /* Ensure we don't try to copy through a symlink that was
2232 created by a prior call to this function. */
2233 if (command_line_arg
2236 && x
->backup_type
== no_backups
)
2238 bool lstat_ok
= true;
2239 struct stat tmp_buf
;
2240 struct stat
*dst_lstat_sb
;
2242 /* If we called lstat above, good: use that data.
2243 Otherwise, call lstat here, in case dst_name is a symlink. */
2245 dst_lstat_sb
= &dst_sb
;
2248 if (lstat (dst_name
, &tmp_buf
) == 0)
2249 dst_lstat_sb
= &tmp_buf
;
2254 /* Never copy through a symlink we've just created. */
2256 && S_ISLNK (dst_lstat_sb
->st_mode
)
2257 && seen_file (x
->dest_info
, dst_name
, dst_lstat_sb
))
2260 _("will not copy %s through just-created symlink %s"),
2261 quoteaf_n (0, src_name
), quoteaf_n (1, dst_name
));
2266 /* If the source is a directory, we don't always create the destination
2267 directory. So --verbose should not announce anything until we're
2268 sure we'll create a directory. Also don't announce yet when moving
2269 so we can distinguish renames versus copies. */
2270 if (x
->verbose
&& !x
->move_mode
&& !S_ISDIR (src_mode
))
2271 emit_verbose (src_name
, dst_name
, dst_backup
);
2273 /* Associate the destination file name with the source device and inode
2274 so that if we encounter a matching dev/ino pair in the source tree
2275 we can arrange to create a hard link between the corresponding names
2276 in the destination tree.
2278 When using the --link (-l) option, there is no need to take special
2279 measures, because (barring race conditions) files that are hard-linked
2280 in the source tree will also be hard-linked in the destination tree.
2282 Sometimes, when preserving links, we have to record dev/ino even
2283 though st_nlink == 1:
2284 - when in move_mode, since we may be moving a group of N hard-linked
2285 files (via two or more command line arguments) to a different
2286 partition; the links may be distributed among the command line
2287 arguments (possibly hierarchies) so that the link count of
2288 the final, once-linked source file is reduced to 1 when it is
2289 considered below. But in this case (for mv) we don't need to
2290 incur the expense of recording the dev/ino => name mapping; all we
2291 really need is a lookup, to see if the dev/ino pair has already
2293 - when using -H and processing a command line argument;
2294 that command line argument could be a symlink pointing to another
2295 command line argument. With 'cp -H --preserve=link', we hard-link
2296 those two destination files.
2297 - likewise for -L except that it applies to all files, not just
2298 command line arguments.
2300 Also, with --recursive, record dev/ino of each command-line directory.
2301 We'll use that info to detect this problem: cp -R dir dir. */
2303 if (rename_errno
== 0)
2304 earlier_file
= NULL
;
2305 else if (x
->recursive
&& S_ISDIR (src_mode
))
2307 if (command_line_arg
)
2308 earlier_file
= remember_copied (dst_name
, src_sb
.st_ino
, src_sb
.st_dev
);
2310 earlier_file
= src_to_dest_lookup (src_sb
.st_ino
, src_sb
.st_dev
);
2312 else if (x
->move_mode
&& src_sb
.st_nlink
== 1)
2314 earlier_file
= src_to_dest_lookup (src_sb
.st_ino
, src_sb
.st_dev
);
2316 else if (x
->preserve_links
2318 && (1 < src_sb
.st_nlink
2319 || (command_line_arg
2320 && x
->dereference
== DEREF_COMMAND_LINE_ARGUMENTS
)
2321 || x
->dereference
== DEREF_ALWAYS
))
2323 earlier_file
= remember_copied (dst_name
, src_sb
.st_ino
, src_sb
.st_dev
);
2326 /* Did we copy this inode somewhere else (in this command line argument)
2327 and therefore this is a second hard link to the inode? */
2331 /* Avoid damaging the destination file system by refusing to preserve
2332 hard-linked directories (which are found at least in Netapp snapshot
2334 if (S_ISDIR (src_mode
))
2336 /* If src_name and earlier_file refer to the same directory entry,
2337 then warn about copying a directory into itself. */
2338 if (same_name (src_name
, earlier_file
))
2340 error (0, 0, _("cannot copy a directory, %s, into itself, %s"),
2341 quoteaf_n (0, top_level_src_name
),
2342 quoteaf_n (1, top_level_dst_name
));
2343 *copy_into_self
= true;
2346 else if (same_name (dst_name
, earlier_file
))
2348 error (0, 0, _("warning: source directory %s "
2349 "specified more than once"),
2350 quoteaf (top_level_src_name
));
2351 /* In move mode, if a previous rename succeeded, then
2352 we won't be in this path as the source is missing. If the
2353 rename previously failed, then that has been handled, so
2354 pretend this attempt succeeded so the source isn't removed. */
2355 if (x
->move_mode
&& rename_succeeded
)
2356 *rename_succeeded
= true;
2357 /* We only do backups in move mode, and for non directories.
2358 So just ignore this repeated entry. */
2361 else if (x
->dereference
== DEREF_ALWAYS
2362 || (command_line_arg
2363 && x
->dereference
== DEREF_COMMAND_LINE_ARGUMENTS
))
2365 /* This happens when e.g., encountering a directory for the
2366 second or subsequent time via symlinks when cp is invoked
2367 with -R and -L. E.g.,
2368 rm -rf a b c d; mkdir a b c d; ln -s ../c a; ln -s ../c b;
2374 error (0, 0, _("will not create hard link %s to directory %s"),
2375 quoteaf_n (0, dst_name
), quoteaf_n (1, earlier_file
));
2381 if (! create_hard_link (earlier_file
, dst_name
, true, x
->verbose
,
2391 if (rename_errno
== EEXIST
)
2392 rename_errno
= rename (src_name
, dst_name
) == 0 ? 0 : errno
;
2394 if (rename_errno
== 0)
2398 printf (_("renamed "));
2399 emit_verbose (src_name
, dst_name
, dst_backup
);
2402 if (x
->set_security_context
)
2404 /* -Z failures are only warnings currently. */
2405 (void) set_file_security_ctx (dst_name
, false, true, x
);
2408 if (rename_succeeded
)
2409 *rename_succeeded
= true;
2411 if (command_line_arg
&& !x
->last_file
)
2413 /* Record destination dev/ino/name, so that if we are asked
2414 to overwrite that file again, we can detect it and fail. */
2415 /* It's fine to use the _source_ stat buffer (src_sb) to get the
2416 _destination_ dev/ino, since the rename above can't have
2417 changed those, and 'mv' always uses lstat.
2418 We could limit it further by operating
2419 only on non-directories. */
2420 record_file (x
->dest_info
, dst_name
, &src_sb
);
2426 /* FIXME: someday, consider what to do when moving a directory into
2427 itself but when source and destination are on different devices. */
2429 /* This happens when attempting to rename a directory to a
2430 subdirectory of itself. */
2431 if (rename_errno
== EINVAL
)
2433 /* FIXME: this is a little fragile in that it relies on rename(2)
2434 failing with a specific errno value. Expect problems on
2435 non-POSIX systems. */
2436 error (0, 0, _("cannot move %s to a subdirectory of itself, %s"),
2437 quoteaf_n (0, top_level_src_name
),
2438 quoteaf_n (1, top_level_dst_name
));
2440 /* Note that there is no need to call forget_created here,
2441 (compare with the other calls in this file) since the
2442 destination directory didn't exist before. */
2444 *copy_into_self
= true;
2445 /* FIXME-cleanup: Don't return true here; adjust mv.c accordingly.
2446 The only caller that uses this code (mv.c) ends up setting its
2447 exit status to nonzero when copy_into_self is nonzero. */
2451 /* WARNING: there probably exist systems for which an inter-device
2452 rename fails with a value of errno not handled here.
2453 If/as those are reported, add them to the condition below.
2454 If this happens to you, please do the following and send the output
2455 to the bug-reporting address (e.g., in the output of cp --help):
2456 touch k; perl -e 'rename "k","/tmp/k" or print "$!(",$!+0,")\n"'
2457 where your current directory is on one partition and /tmp is the other.
2458 Also, please try to find the E* errno macro name corresponding to
2459 the diagnostic and parenthesized integer, and include that in your
2460 e-mail. One way to do that is to run a command like this
2461 find /usr/include/. -type f \
2462 | xargs grep 'define.*\<E[A-Z]*\>.*\<18\>' /dev/null
2463 where you'd replace '18' with the integer in parentheses that
2464 was output from the perl one-liner above.
2465 If necessary, of course, change '/tmp' to some other directory. */
2466 if (rename_errno
!= EXDEV
)
2468 /* There are many ways this can happen due to a race condition.
2469 When something happens between the initial follow_fstatat and the
2470 subsequent rename, we can get many different types of errors.
2471 For example, if the destination is initially a non-directory
2472 or non-existent, but it is created as a directory, the rename
2473 fails. If two 'mv' commands try to rename the same file at
2474 about the same time, one will succeed and the other will fail.
2475 If the permissions on the directory containing the source or
2476 destination file are made too restrictive, the rename will
2478 error (0, rename_errno
,
2479 _("cannot move %s to %s"),
2480 quoteaf_n (0, src_name
), quoteaf_n (1, dst_name
));
2481 forget_created (src_sb
.st_ino
, src_sb
.st_dev
);
2485 /* The rename attempt has failed. Remove any existing destination
2486 file so that a cross-device 'mv' acts as if it were really using
2487 the rename syscall. Note both src and dst must both be directories
2488 or not, and this is enforced above. Therefore we check the src_mode
2489 and operate on dst_name here as a tighter constraint and also because
2490 src_mode is readily available here. */
2491 if ((S_ISDIR (src_mode
) ? rmdir (dst_name
) : unlink (dst_name
)) != 0
2495 _("inter-device move failed: %s to %s; unable to remove target"),
2496 quoteaf_n (0, src_name
), quoteaf_n (1, dst_name
));
2497 forget_created (src_sb
.st_ino
, src_sb
.st_dev
);
2501 if (x
->verbose
&& !S_ISDIR (src_mode
))
2503 printf (_("copied "));
2504 emit_verbose (src_name
, dst_name
, dst_backup
);
2509 /* If the ownership might change, or if it is a directory (whose
2510 special mode bits may change after the directory is created),
2511 omit some permissions at first, so unauthorized users cannot nip
2512 in before the file is ready. */
2513 dst_mode_bits
= (x
->set_mode
? x
->mode
: src_mode
) & CHMOD_MODE_BITS
;
2514 omitted_permissions
=
2516 & (x
->preserve_ownership
? S_IRWXG
| S_IRWXO
2517 : S_ISDIR (src_mode
) ? S_IWGRP
| S_IWOTH
2522 /* If required, set the default security context for new files.
2523 Also for existing files this is used as a reference
2524 when copying the context with --preserve=context.
2525 FIXME: Do we need to consider dst_mode_bits here? */
2526 if (! set_process_security_ctx (src_name
, dst_name
, src_mode
, new_dst
, x
))
2529 if (S_ISDIR (src_mode
))
2531 struct dir_list
*dir
;
2533 /* If this directory has been copied before during the
2534 recursion, there is a symbolic link to an ancestor
2535 directory of the symbolic link. It is impossible to
2536 continue to copy this, unless we've got an infinite disk. */
2538 if (is_ancestor (&src_sb
, ancestors
))
2540 error (0, 0, _("cannot copy cyclic symbolic link %s"),
2541 quoteaf (src_name
));
2545 /* Insert the current directory in the list of parents. */
2547 dir
= alloca (sizeof *dir
);
2548 dir
->parent
= ancestors
;
2549 dir
->ino
= src_sb
.st_ino
;
2550 dir
->dev
= src_sb
.st_dev
;
2552 if (new_dst
|| !S_ISDIR (dst_sb
.st_mode
))
2554 /* POSIX says mkdir's behavior is implementation-defined when
2555 (src_mode & ~S_IRWXUGO) != 0. However, common practice is
2556 to ask mkdir to copy all the CHMOD_MODE_BITS, letting mkdir
2557 decide what to do with S_ISUID | S_ISGID | S_ISVTX. */
2558 if (mkdir (dst_name
, dst_mode_bits
& ~omitted_permissions
) != 0)
2560 error (0, errno
, _("cannot create directory %s"),
2561 quoteaf (dst_name
));
2565 /* We need search and write permissions to the new directory
2566 for writing the directory's contents. Check if these
2567 permissions are there. */
2569 if (lstat (dst_name
, &dst_sb
) != 0)
2571 error (0, errno
, _("cannot stat %s"), quoteaf (dst_name
));
2574 else if ((dst_sb
.st_mode
& S_IRWXU
) != S_IRWXU
)
2576 /* Make the new directory searchable and writable. */
2578 dst_mode
= dst_sb
.st_mode
;
2579 restore_dst_mode
= true;
2581 if (lchmod (dst_name
, dst_mode
| S_IRWXU
) != 0)
2583 error (0, errno
, _("setting permissions for %s"),
2584 quoteaf (dst_name
));
2589 /* Record the created directory's inode and device numbers into
2590 the search structure, so that we can avoid copying it again.
2591 Do this only for the first directory that is created for each
2592 source command line argument. */
2593 if (!*first_dir_created_per_command_line_arg
)
2595 remember_copied (dst_name
, dst_sb
.st_ino
, dst_sb
.st_dev
);
2596 *first_dir_created_per_command_line_arg
= true;
2602 printf (_("created directory %s\n"), quoteaf (dst_name
));
2604 emit_verbose (src_name
, dst_name
, NULL
);
2609 omitted_permissions
= 0;
2611 /* For directories, the process global context could be reset for
2612 descendents, so use it to set the context for existing dirs here.
2613 This will also give earlier indication of failure to set ctx. */
2614 if (x
->set_security_context
|| x
->preserve_security_context
)
2615 if (! set_file_security_ctx (dst_name
, x
->preserve_security_context
,
2618 if (x
->require_preserve_context
)
2623 /* Decide whether to copy the contents of the directory. */
2624 if (x
->one_file_system
&& parent
&& parent
->st_dev
!= src_sb
.st_dev
)
2626 /* Here, we are crossing a file system boundary and cp's -x option
2627 is in effect: so don't copy the contents of this directory. */
2631 /* Copy the contents of the directory. Don't just return if
2632 this fails -- otherwise, the failure to read a single file
2633 in a source directory would cause the containing destination
2634 directory not to have owner/perms set properly. */
2635 delayed_ok
= copy_dir (src_name
, dst_name
, new_dst
, &src_sb
, dir
, x
,
2636 first_dir_created_per_command_line_arg
,
2640 else if (x
->symbolic_link
)
2642 dest_is_symlink
= true;
2643 if (*src_name
!= '/')
2645 /* Check that DST_NAME denotes a file in the current directory. */
2647 struct stat dst_parent_sb
;
2649 bool in_current_dir
;
2651 dst_parent
= dir_name (dst_name
);
2653 in_current_dir
= (STREQ (".", dst_parent
)
2654 /* If either stat call fails, it's ok not to report
2655 the failure and say dst_name is in the current
2656 directory. Other things will fail later. */
2657 || stat (".", &dot_sb
) != 0
2658 || stat (dst_parent
, &dst_parent_sb
) != 0
2659 || SAME_INODE (dot_sb
, dst_parent_sb
));
2662 if (! in_current_dir
)
2665 _("%s: can make relative symbolic links only in current directory"),
2671 int err
= force_symlinkat (src_name
, AT_FDCWD
, dst_name
,
2672 x
->unlink_dest_after_failed_open
, -1);
2675 error (0, err
, _("cannot create symbolic link %s to %s"),
2676 quoteaf_n (0, dst_name
), quoteaf_n (1, src_name
));
2681 /* POSIX 2008 states that it is implementation-defined whether
2682 link() on a symlink creates a hard-link to the symlink, or only
2683 to the referent (effectively dereferencing the symlink) (POSIX
2684 2001 required the latter behavior, although many systems provided
2685 the former). Yet cp, invoked with '--link --no-dereference',
2686 should not follow the link. We can approximate the desired
2687 behavior by skipping this hard-link creating block and instead
2688 copying the symlink, via the 'S_ISLNK'- copying code below.
2690 Note gnulib's linkat module, guarantees that the symlink is not
2691 dereferenced. However its emulation currently doesn't maintain
2692 timestamps or ownership so we only call it when we know the
2693 emulation will not be needed. */
2694 else if (x
->hard_link
2695 && !(! CAN_HARDLINK_SYMLINKS
&& S_ISLNK (src_mode
)
2696 && x
->dereference
== DEREF_NEVER
))
2698 bool replace
= (x
->unlink_dest_after_failed_open
2699 || x
->interactive
== I_ASK_USER
);
2700 if (! create_hard_link (src_name
, dst_name
, replace
, false, dereference
))
2703 else if (S_ISREG (src_mode
)
2704 || (x
->copy_as_regular
&& !S_ISLNK (src_mode
)))
2706 copied_as_regular
= true;
2707 /* POSIX says the permission bits of the source file must be
2708 used as the 3rd argument in the open call. Historical
2709 practice passed all the source mode bits to 'open', but the extra
2710 bits were ignored, so it should be the same either way.
2712 This call uses DST_MODE_BITS, not SRC_MODE. These are
2713 normally the same, and the exception (where x->set_mode) is
2714 used only by 'install', which POSIX does not specify and
2715 where DST_MODE_BITS is what's wanted. */
2716 if (! copy_reg (src_name
, dst_name
, x
, dst_mode_bits
& S_IRWXUGO
,
2717 omitted_permissions
, &new_dst
, &src_sb
))
2720 else if (S_ISFIFO (src_mode
))
2722 /* Use mknod, rather than mkfifo, because the former preserves
2723 the special mode bits of a fifo on Solaris 10, while mkfifo
2724 does not. But fall back on mkfifo, because on some BSD systems,
2725 mknod always fails when asked to create a FIFO. */
2726 if (mknod (dst_name
, src_mode
& ~omitted_permissions
, 0) != 0)
2727 if (mkfifo (dst_name
, src_mode
& ~S_IFIFO
& ~omitted_permissions
) != 0)
2729 error (0, errno
, _("cannot create fifo %s"), quoteaf (dst_name
));
2733 else if (S_ISBLK (src_mode
) || S_ISCHR (src_mode
) || S_ISSOCK (src_mode
))
2735 if (mknod (dst_name
, src_mode
& ~omitted_permissions
, src_sb
.st_rdev
)
2738 error (0, errno
, _("cannot create special file %s"),
2739 quoteaf (dst_name
));
2743 else if (S_ISLNK (src_mode
))
2745 char *src_link_val
= areadlink_with_size (src_name
, src_sb
.st_size
);
2746 dest_is_symlink
= true;
2747 if (src_link_val
== NULL
)
2749 error (0, errno
, _("cannot read symbolic link %s"),
2750 quoteaf (src_name
));
2754 int symlink_err
= force_symlinkat (src_link_val
, AT_FDCWD
, dst_name
,
2755 x
->unlink_dest_after_failed_open
, -1);
2756 if (0 < symlink_err
&& x
->update
&& !new_dst
&& S_ISLNK (dst_sb
.st_mode
)
2757 && dst_sb
.st_size
== strlen (src_link_val
))
2759 /* See if the destination is already the desired symlink.
2760 FIXME: This behavior isn't documented, and seems wrong
2761 in some cases, e.g., if the destination symlink has the
2762 wrong ownership, permissions, or timestamps. */
2763 char *dest_link_val
=
2764 areadlink_with_size (dst_name
, dst_sb
.st_size
);
2767 if (STREQ (dest_link_val
, src_link_val
))
2769 free (dest_link_val
);
2772 free (src_link_val
);
2773 if (0 < symlink_err
)
2775 error (0, symlink_err
, _("cannot create symbolic link %s"),
2776 quoteaf (dst_name
));
2780 if (x
->preserve_security_context
)
2781 restore_default_fscreatecon_or_die ();
2783 if (x
->preserve_ownership
)
2785 /* Preserve the owner and group of the just-'copied'
2786 symbolic link, if possible. */
2788 && lchown (dst_name
, src_sb
.st_uid
, src_sb
.st_gid
) != 0
2789 && ! chown_failure_ok (x
))
2791 error (0, errno
, _("failed to preserve ownership for %s"),
2793 if (x
->require_preserve
)
2798 /* Can't preserve ownership of symlinks.
2799 FIXME: maybe give a warning or even error for symlinks
2800 in directories with the sticky bit set -- there, not
2801 preserving owner/group is a potential security problem. */
2807 error (0, 0, _("%s has unknown file type"), quoteaf (src_name
));
2811 /* With -Z or --preserve=context, set the context for existing files.
2812 Note this is done already for copy_reg() for reasons described therein. */
2813 if (!new_dst
&& !x
->copy_as_regular
&& !S_ISDIR (src_mode
)
2814 && (x
->set_security_context
|| x
->preserve_security_context
))
2816 if (! set_file_security_ctx (dst_name
, x
->preserve_security_context
,
2819 if (x
->require_preserve_context
)
2824 if (command_line_arg
&& x
->dest_info
)
2826 /* Now that the destination file is very likely to exist,
2827 add its info to the set. */
2829 if (lstat (dst_name
, &sb
) == 0)
2830 record_file (x
->dest_info
, dst_name
, &sb
);
2833 /* If we've just created a hard-link due to cp's --link option,
2835 if (x
->hard_link
&& ! S_ISDIR (src_mode
)
2836 && !(! CAN_HARDLINK_SYMLINKS
&& S_ISLNK (src_mode
)
2837 && x
->dereference
== DEREF_NEVER
))
2840 if (copied_as_regular
)
2843 /* POSIX says that 'cp -p' must restore the following:
2845 - setuid, setgid bits
2847 If it fails to restore any of those, we may give a warning but
2848 the destination must not be removed.
2849 FIXME: implement the above. */
2851 /* Adjust the times (and if possible, ownership) for the copy.
2852 chown turns off set[ug]id bits for non-root,
2853 so do the chmod last. */
2855 if (x
->preserve_timestamps
)
2857 struct timespec timespec
[2];
2858 timespec
[0] = get_stat_atime (&src_sb
);
2859 timespec
[1] = get_stat_mtime (&src_sb
);
2861 if ((dest_is_symlink
2862 ? utimens_symlink (dst_name
, timespec
)
2863 : utimens (dst_name
, timespec
))
2866 error (0, errno
, _("preserving times for %s"), quoteaf (dst_name
));
2867 if (x
->require_preserve
)
2872 /* Avoid calling chown if we know it's not necessary. */
2873 if (!dest_is_symlink
&& x
->preserve_ownership
2874 && (new_dst
|| !SAME_OWNER_AND_GROUP (src_sb
, dst_sb
)))
2876 switch (set_owner (x
, dst_name
, -1, &src_sb
, new_dst
, &dst_sb
))
2882 src_mode
&= ~ (S_ISUID
| S_ISGID
| S_ISVTX
);
2887 /* Set xattrs after ownership as changing owners will clear capabilities. */
2888 if (x
->preserve_xattr
&& ! copy_attr (src_name
, -1, dst_name
, -1, x
)
2889 && x
->require_preserve_xattr
)
2892 /* The operations beyond this point may dereference a symlink. */
2893 if (dest_is_symlink
)
2896 set_author (dst_name
, -1, &src_sb
);
2898 if (x
->preserve_mode
|| x
->move_mode
)
2900 if (copy_acl (src_name
, -1, dst_name
, -1, src_mode
) != 0
2901 && x
->require_preserve
)
2904 else if (x
->set_mode
)
2906 if (set_acl (dst_name
, -1, x
->mode
) != 0)
2909 else if (x
->explicit_no_preserve_mode
&& new_dst
)
2911 int default_permissions
= S_ISDIR (src_mode
) || S_ISSOCK (src_mode
)
2912 ? S_IRWXUGO
: MODE_RW_UGO
;
2913 if (set_acl (dst_name
, -1, default_permissions
& ~cached_umask ()) != 0)
2918 if (omitted_permissions
)
2920 omitted_permissions
&= ~ cached_umask ();
2922 if (omitted_permissions
&& !restore_dst_mode
)
2924 /* Permissions were deliberately omitted when the file
2925 was created due to security concerns. See whether
2926 they need to be re-added now. It'd be faster to omit
2927 the lstat, but deducing the current destination mode
2928 is tricky in the presence of implementation-defined
2929 rules for special mode bits. */
2930 if (new_dst
&& lstat (dst_name
, &dst_sb
) != 0)
2932 error (0, errno
, _("cannot stat %s"), quoteaf (dst_name
));
2935 dst_mode
= dst_sb
.st_mode
;
2936 if (omitted_permissions
& ~dst_mode
)
2937 restore_dst_mode
= true;
2941 if (restore_dst_mode
)
2943 if (lchmod (dst_name
, dst_mode
| omitted_permissions
) != 0)
2945 error (0, errno
, _("preserving permissions for %s"),
2946 quoteaf (dst_name
));
2947 if (x
->require_preserve
)
2957 if (x
->preserve_security_context
)
2958 restore_default_fscreatecon_or_die ();
2960 /* We have failed to create the destination file.
2961 If we've just added a dev/ino entry via the remember_copied
2962 call above (i.e., unless we've just failed to create a hard link),
2963 remove the entry associating the source dev/ino with the
2964 destination file name, so we don't try to 'preserve' a link
2965 to a file we didn't create. */
2966 if (earlier_file
== NULL
)
2967 forget_created (src_sb
.st_ino
, src_sb
.st_dev
);
2971 if (rename (dst_backup
, dst_name
) != 0)
2972 error (0, errno
, _("cannot un-backup %s"), quoteaf (dst_name
));
2976 printf (_("%s -> %s (unbackup)\n"),
2977 quoteaf_n (0, dst_backup
), quoteaf_n (1, dst_name
));
2983 static bool _GL_ATTRIBUTE_PURE
2984 valid_options (const struct cp_options
*co
)
2986 assert (co
!= NULL
);
2987 assert (VALID_BACKUP_TYPE (co
->backup_type
));
2988 assert (VALID_SPARSE_MODE (co
->sparse_mode
));
2989 assert (VALID_REFLINK_MODE (co
->reflink_mode
));
2990 assert (!(co
->hard_link
&& co
->symbolic_link
));
2992 (co
->reflink_mode
== REFLINK_ALWAYS
2993 && co
->sparse_mode
!= SPARSE_AUTO
));
2997 /* Copy the file SRC_NAME to the file DST_NAME. The files may be of
2998 any type. NONEXISTENT_DST should be true if the file DST_NAME
2999 is known not to exist (e.g., because its parent directory was just
3000 created); NONEXISTENT_DST should be false if DST_NAME might already
3001 exist. OPTIONS is ... FIXME-describe
3002 Set *COPY_INTO_SELF if SRC_NAME is a parent of (or the
3003 same as) DST_NAME; otherwise, set clear it.
3004 Return true if successful. */
3007 copy (char const *src_name
, char const *dst_name
,
3008 bool nonexistent_dst
, const struct cp_options
*options
,
3009 bool *copy_into_self
, bool *rename_succeeded
)
3011 assert (valid_options (options
));
3013 /* Record the file names: they're used in case of error, when copying
3014 a directory into itself. I don't like to make these tools do *any*
3015 extra work in the common case when that work is solely to handle
3016 exceptional cases, but in this case, I don't see a way to derive the
3017 top level source and destination directory names where they're used.
3018 An alternative is to use COPY_INTO_SELF and print the diagnostic
3019 from every caller -- but I don't want to do that. */
3020 top_level_src_name
= src_name
;
3021 top_level_dst_name
= dst_name
;
3023 bool first_dir_created_per_command_line_arg
= false;
3024 return copy_internal (src_name
, dst_name
, nonexistent_dst
, NULL
, NULL
,
3026 &first_dir_created_per_command_line_arg
,
3027 copy_into_self
, rename_succeeded
);
3030 /* Set *X to the default options for a value of type struct cp_options. */
3033 cp_options_default (struct cp_options
*x
)
3035 memset (x
, 0, sizeof *x
);
3036 #ifdef PRIV_FILE_CHOWN
3038 priv_set_t
*pset
= priv_allocset ();
3041 if (getppriv (PRIV_EFFECTIVE
, pset
) == 0)
3043 x
->chown_privileges
= priv_ismember (pset
, PRIV_FILE_CHOWN
);
3044 x
->owner_privileges
= priv_ismember (pset
, PRIV_FILE_OWNER
);
3046 priv_freeset (pset
);
3049 x
->chown_privileges
= x
->owner_privileges
= (geteuid () == ROOT_UID
);
3051 x
->rename_errno
= -1;
3054 /* Return true if it's OK for chown to fail, where errno is
3055 the error number that chown failed with and X is the copying
3059 chown_failure_ok (struct cp_options
const *x
)
3061 /* If non-root uses -p, it's ok if we can't preserve ownership.
3062 But root probably wants to know, e.g. if NFS disallows it,
3063 or if the target system doesn't support file ownership. */
3065 return ((errno
== EPERM
|| errno
== EINVAL
) && !x
->chown_privileges
);
3068 /* Similarly, return true if it's OK for chmod and similar operations
3069 to fail, where errno is the error number that chmod failed with and
3070 X is the copying option set. */
3073 owner_failure_ok (struct cp_options
const *x
)
3075 return ((errno
== EPERM
|| errno
== EINVAL
) && !x
->owner_privileges
);
3078 /* Return the user's umask, caching the result.
3080 FIXME: If the destination's parent directory has has a default ACL,
3081 some operating systems (e.g., GNU/Linux's "POSIX" ACLs) use that
3082 ACL's mask rather than the process umask. Currently, the callers
3083 of cached_umask incorrectly assume that this situation cannot occur. */
3087 static mode_t mask
= (mode_t
) -1;
3088 if (mask
== (mode_t
) -1)