src/chown-core.c

   1 /* chown-core.c -- core functions for changing ownership.
   2    Copyright (C) 2000-2023 Free Software Foundation, Inc.
   3
   4    This program is free software: you can redistribute it and/or modify
   5    it under the terms of the GNU General Public License as published by
   6    the Free Software Foundation, either version 3 of the License, or
   7    (at your option) any later version.
   8
   9    This program is distributed in the hope that it will be useful,
  10    but WITHOUT ANY WARRANTY; without even the implied warranty of
  11    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12    GNU General Public License for more details.
  13
  14    You should have received a copy of the GNU General Public License
  15    along with this program.  If not, see <https://www.gnu.org/licenses/>.  */
  16
  17 /* Extracted from chown.c/chgrp.c and librarified by Jim Meyering.  */
  18
  19 #include <config.h>
  20 #include <stdio.h>
  21 #include <sys/types.h>
  22 #include <pwd.h>
  23 #include <grp.h>
  24
  25 #include "system.h"
  26 #include "assure.h"
  27 #include "chown-core.h"
  28 #include "ignore-value.h"
  29 #include "root-dev-ino.h"
  30 #include "xfts.h"
  31
  32 #define FTSENT_IS_DIRECTORY(E)  \
  33   ((E)->fts_info == FTS_D       \
  34    || (E)->fts_info == FTS_DC   \
  35    || (E)->fts_info == FTS_DP   \
  36    || (E)->fts_info == FTS_DNR)
  37
  38 enum RCH_status
  39   {
  40     /* we called fchown and close, and both succeeded */
  41     RC_ok = 2,
  42
  43     /* required_uid and/or required_gid are specified, but don't match */
  44     RC_excluded,
  45
  46     /* SAME_INODE check failed */
  47     RC_inode_changed,
  48
  49     /* open/fchown isn't needed, isn't safe, or doesn't work due to
  50        permissions problems; fall back on chown */
  51     RC_do_ordinary_chown,
  52
  53     /* open, fstat, fchown, or close failed */
  54     RC_error
  55   };
  56
  57 extern void
  58 chopt_init (struct Chown_option *chopt)
  59 {
  60   chopt->verbosity = V_off;
  61   chopt->root_dev_ino = nullptr;
  62   chopt->affect_symlink_referent = true;
  63   chopt->recurse = false;
  64   chopt->force_silent = false;
  65   chopt->user_name = nullptr;
  66   chopt->group_name = nullptr;
  67 }
  68
  69 extern void
  70 chopt_free (struct Chown_option *chopt)
  71 {
  72   free (chopt->user_name);
  73   free (chopt->group_name);
  74 }
  75
  76 /* Convert the numeric user-id, UID, to a string stored in xmalloc'd memory,
  77    and return it.  Use the decimal representation of the ID.  */
  78
  79 static char *
  80 uid_to_str (uid_t uid)
  81 {
  82   char buf[INT_BUFSIZE_BOUND (intmax_t)];
  83   return xstrdup (TYPE_SIGNED (uid_t) ? imaxtostr (uid, buf)
  84                   : umaxtostr (uid, buf));
  85 }
  86
  87 /* Convert the numeric group-id, GID, to a string stored in xmalloc'd memory,
  88    and return it.  Use the decimal representation of the ID.  */
  89
  90 static char *
  91 gid_to_str (gid_t gid)
  92 {
  93   char buf[INT_BUFSIZE_BOUND (intmax_t)];
  94   return xstrdup (TYPE_SIGNED (gid_t) ? imaxtostr (gid, buf)
  95                   : umaxtostr (gid, buf));
  96 }
  97
  98 /* Convert the numeric group-id, GID, to a string stored in xmalloc'd memory,
  99    and return it.  If there's no corresponding group name, use the decimal
 100    representation of the ID.  */
 101
 102 extern char *
 103 gid_to_name (gid_t gid)
 104 {
 105   struct group *grp = getgrgid (gid);
 106   return grp ? xstrdup (grp->gr_name) : gid_to_str (gid);
 107 }
 108
 109 /* Convert the numeric user-id, UID, to a string stored in xmalloc'd memory,
 110    and return it.  If there's no corresponding user name, use the decimal
 111    representation of the ID.  */
 112
 113 extern char *
 114 uid_to_name (uid_t uid)
 115 {
 116   struct passwd *pwd = getpwuid (uid);
 117   return pwd ? xstrdup (pwd->pw_name) : uid_to_str (uid);
 118 }
 119
 120 /* Allocate a string representing USER and GROUP.  */
 121
 122 static char *
 123 user_group_str (char const *user, char const *group)
 124 {
 125   char *spec = nullptr;
 126
 127   if (user)
 128     {
 129       if (group)
 130         {
 131           spec = xmalloc (strlen (user) + 1 + strlen (group) + 1);
 132           stpcpy (stpcpy (stpcpy (spec, user), ":"), group);
 133         }
 134       else
 135         {
 136           spec = xstrdup (user);
 137         }
 138     }
 139   else if (group)
 140     {
 141       spec = xstrdup (group);
 142     }
 143
 144   return spec;
 145 }
 146
 147 /* Tell the user how/if the user and group of FILE have been changed.
 148    If USER is null, give the group-oriented messages.
 149    CHANGED describes what (if anything) has happened. */
 150
 151 static void
 152 describe_change (char const *file, enum Change_status changed,
 153                  char const *old_user, char const *old_group,
 154                  char const *user, char const *group)
 155 {
 156   char const *fmt;
 157   char *old_spec;
 158   char *spec;
 159
 160   if (changed == CH_NOT_APPLIED)
 161     {
 162       printf (_("neither symbolic link %s nor referent has been changed\n"),
 163               quoteaf (file));
 164       return;
 165     }
 166
 167   spec = user_group_str (user, group);
 168   old_spec = user_group_str (user ? old_user : nullptr,
 169                              group ? old_group : nullptr);
 170
 171   switch (changed)
 172     {
 173     case CH_SUCCEEDED:
 174       fmt = (user ? _("changed ownership of %s from %s to %s\n")
 175              : group ? _("changed group of %s from %s to %s\n")
 176              : _("no change to ownership of %s\n"));
 177       break;
 178     case CH_FAILED:
 179       if (old_spec)
 180         {
 181           fmt = (user ? _("failed to change ownership of %s from %s to %s\n")
 182                  : group ? _("failed to change group of %s from %s to %s\n")
 183                  : _("failed to change ownership of %s\n"));
 184         }
 185       else
 186         {
 187           fmt = (user ? _("failed to change ownership of %s to %s\n")
 188                  : group ? _("failed to change group of %s to %s\n")
 189                  : _("failed to change ownership of %s\n"));
 190           free (old_spec);
 191           old_spec = spec;
 192           spec = nullptr;
 193         }
 194       break;
 195     case CH_NO_CHANGE_REQUESTED:
 196       fmt = (user ? _("ownership of %s retained as %s\n")
 197              : group ? _("group of %s retained as %s\n")
 198              : _("ownership of %s retained\n"));
 199       break;
 200     default:
 201       affirm (false);
 202     }
 203
 204   printf (fmt, quoteaf (file), old_spec, spec);
 205
 206   free (old_spec);
 207   free (spec);
 208 }
 209
 210 /* Change the owner and/or group of the FILE to UID and/or GID (safely)
 211    only if REQUIRED_UID and REQUIRED_GID match the owner and group IDs
 212    of FILE.  ORIG_ST must be the result of 'stat'ing FILE.
 213
 214    The 'safely' part above means that we can't simply use chown(2),
 215    since FILE might be replaced with some other file between the time
 216    of the preceding stat/lstat and this chown call.  So here we open
 217    FILE and do everything else via the resulting file descriptor.
 218    We first call fstat and verify that the dev/inode match those from
 219    the preceding stat call, and only then, if appropriate (given the
 220    required_uid and required_gid constraints) do we call fchown.
 221
 222    Return RC_do_ordinary_chown if we can't open FILE, or if FILE is a
 223    special file that might have undesirable side effects when opening.
 224    In this case the caller can use the less-safe ordinary chown.
 225
 226    Return one of the RCH_status values.  */
 227
 228 static enum RCH_status
 229 restricted_chown (int cwd_fd, char const *file,
 230                   struct stat const *orig_st,
 231                   uid_t uid, gid_t gid,
 232                   uid_t required_uid, gid_t required_gid)
 233 {
 234   enum RCH_status status = RC_ok;
 235   struct stat st;
 236   int open_flags = O_NONBLOCK | O_NOCTTY;
 237   int fd;
 238
 239   if (required_uid == (uid_t) -1 && required_gid == (gid_t) -1)
 240     return RC_do_ordinary_chown;
 241
 242   if (! S_ISREG (orig_st->st_mode))
 243     {
 244       if (S_ISDIR (orig_st->st_mode))
 245         open_flags |= O_DIRECTORY;
 246       else
 247         return RC_do_ordinary_chown;
 248     }
 249
 250   fd = openat (cwd_fd, file, O_RDONLY | open_flags);
 251   if (! (0 <= fd
 252          || (errno == EACCES && S_ISREG (orig_st->st_mode)
 253              && 0 <= (fd = openat (cwd_fd, file, O_WRONLY | open_flags)))))
 254     return (errno == EACCES ? RC_do_ordinary_chown : RC_error);
 255
 256   if (fstat (fd, &st) != 0)
 257     status = RC_error;
 258   else if (! SAME_INODE (*orig_st, st))
 259     status = RC_inode_changed;
 260   else if ((required_uid == (uid_t) -1 || required_uid == st.st_uid)
 261            && (required_gid == (gid_t) -1 || required_gid == st.st_gid))
 262     {
 263       if (fchown (fd, uid, gid) == 0)
 264         {
 265           status = (close (fd) == 0
 266                     ? RC_ok : RC_error);
 267           return status;
 268         }
 269       else
 270         {
 271           status = RC_error;
 272         }
 273     }
 274
 275   int saved_errno = errno;
 276   close (fd);
 277   errno = saved_errno;
 278   return status;
 279 }
 280
 281 /* Change the owner and/or group of the file specified by FTS and ENT
 282    to UID and/or GID as appropriate.
 283    If REQUIRED_UID is not -1, then skip files with any other user ID.
 284    If REQUIRED_GID is not -1, then skip files with any other group ID.
 285    CHOPT specifies additional options.
 286    Return true if successful.  */
 287 static bool
 288 change_file_owner (FTS *fts, FTSENT *ent,
 289                    uid_t uid, gid_t gid,
 290                    uid_t required_uid, gid_t required_gid,
 291                    struct Chown_option const *chopt)
 292 {
 293   char const *file_full_name = ent->fts_path;
 294   char const *file = ent->fts_accpath;
 295   struct stat const *file_stats;
 296   struct stat stat_buf;
 297   bool ok = true;
 298   bool do_chown;
 299   bool symlink_changed = true;
 300
 301   switch (ent->fts_info)
 302     {
 303     case FTS_D:
 304       if (chopt->recurse)
 305         {
 306           if (ROOT_DEV_INO_CHECK (chopt->root_dev_ino, ent->fts_statp))
 307             {
 308               /* This happens e.g., with "chown -R --preserve-root 0 /"
 309                  and with "chown -RH --preserve-root 0 symlink-to-root".  */
 310               ROOT_DEV_INO_WARN (file_full_name);
 311               /* Tell fts not to traverse into this hierarchy.  */
 312               fts_set (fts, ent, FTS_SKIP);
 313               /* Ensure that we do not process "/" on the second visit.  */
 314               ignore_value (fts_read (fts));
 315               return false;
 316             }
 317           return true;
 318         }
 319       break;
 320
 321     case FTS_DP:
 322       if (! chopt->recurse)
 323         return true;
 324       break;
 325
 326     case FTS_NS:
 327       /* For a top-level file or directory, this FTS_NS (stat failed)
 328          indicator is determined at the time of the initial fts_open call.
 329          With programs like chmod, chown, and chgrp, that modify
 330          permissions, it is possible that the file in question is
 331          accessible when control reaches this point.  So, if this is
 332          the first time we've seen the FTS_NS for this file, tell
 333          fts_read to stat it "again".  */
 334       if (ent->fts_level == 0 && ent->fts_number == 0)
 335         {
 336           ent->fts_number = 1;
 337           fts_set (fts, ent, FTS_AGAIN);
 338           return true;
 339         }
 340       if (! chopt->force_silent)
 341         error (0, ent->fts_errno, _("cannot access %s"),
 342                quoteaf (file_full_name));
 343       ok = false;
 344       break;
 345
 346     case FTS_ERR:
 347       if (! chopt->force_silent)
 348         error (0, ent->fts_errno, "%s", quotef (file_full_name));
 349       ok = false;
 350       break;
 351
 352     case FTS_DNR:
 353       if (! chopt->force_silent)
 354         error (0, ent->fts_errno, _("cannot read directory %s"),
 355                quoteaf (file_full_name));
 356       ok = false;
 357       break;
 358
 359     case FTS_DC:                /* directory that causes cycles */
 360       if (cycle_warning_required (fts, ent))
 361         {
 362           emit_cycle_warning (file_full_name);
 363           return false;
 364         }
 365       break;
 366
 367     default:
 368       break;
 369     }
 370
 371   if (!ok)
 372     {
 373       do_chown = false;
 374       file_stats = nullptr;
 375     }
 376   else if (required_uid == (uid_t) -1 && required_gid == (gid_t) -1
 377            && chopt->verbosity == V_off
 378            && ! chopt->root_dev_ino
 379            && ! chopt->affect_symlink_referent)
 380     {
 381       do_chown = true;
 382       file_stats = ent->fts_statp;
 383     }
 384   else
 385     {
 386       file_stats = ent->fts_statp;
 387
 388       /* If this is a symlink and we're dereferencing them,
 389          stat it to get info on the referent.  */
 390       if (chopt->affect_symlink_referent && S_ISLNK (file_stats->st_mode))
 391         {
 392           if (fstatat (fts->fts_cwd_fd, file, &stat_buf, 0) != 0)
 393             {
 394               if (! chopt->force_silent)
 395                 error (0, errno, _("cannot dereference %s"),
 396                        quoteaf (file_full_name));
 397               ok = false;
 398             }
 399
 400           file_stats = &stat_buf;
 401         }
 402
 403       do_chown = (ok
 404                   && (required_uid == (uid_t) -1
 405                       || required_uid == file_stats->st_uid)
 406                   && (required_gid == (gid_t) -1
 407                       || required_gid == file_stats->st_gid));
 408     }
 409
 410   /* This happens when chown -LR --preserve-root encounters a symlink-to-/.  */
 411   if (ok
 412       && FTSENT_IS_DIRECTORY (ent)
 413       && ROOT_DEV_INO_CHECK (chopt->root_dev_ino, file_stats))
 414     {
 415       ROOT_DEV_INO_WARN (file_full_name);
 416       return false;
 417     }
 418
 419   if (do_chown)
 420     {
 421       if ( ! chopt->affect_symlink_referent)
 422         {
 423           ok = (lchownat (fts->fts_cwd_fd, file, uid, gid) == 0);
 424
 425           /* Ignore any error due to lack of support; POSIX requires
 426              this behavior for top-level symbolic links with -h, and
 427              implies that it's required for all symbolic links.  */
 428           if (!ok && errno == EOPNOTSUPP)
 429             {
 430               ok = true;
 431               symlink_changed = false;
 432             }
 433         }
 434       else
 435         {
 436           /* If possible, avoid a race condition with --from=O:G and without the
 437              (-h) --no-dereference option.  If fts's stat call determined
 438              that the uid/gid of FILE matched the --from=O:G-selected
 439              owner and group IDs, blindly using chown(2) here could lead
 440              chown(1) or chgrp(1) mistakenly to dereference a *symlink*
 441              to an arbitrary file that an attacker had moved into the
 442              place of FILE during the window between the stat and
 443              chown(2) calls.  If FILE is a regular file or a directory
 444              that can be opened, this race condition can be avoided safely.  */
 445
 446           enum RCH_status err
 447             = restricted_chown (fts->fts_cwd_fd, file, file_stats, uid, gid,
 448                                 required_uid, required_gid);
 449           switch (err)
 450             {
 451             case RC_ok:
 452               break;
 453
 454             case RC_do_ordinary_chown:
 455               ok = (chownat (fts->fts_cwd_fd, file, uid, gid) == 0);
 456               break;
 457
 458             case RC_error:
 459               ok = false;
 460               break;
 461
 462             case RC_inode_changed:
 463               /* FIXME: give a diagnostic in this case?  */
 464             case RC_excluded:
 465               do_chown = false;
 466               ok = false;
 467               break;
 468
 469             default:
 470               unreachable ();
 471             }
 472         }
 473
 474       /* On some systems (e.g., GNU/Linux 2.4.x),
 475          the chown function resets the 'special' permission bits.
 476          Do *not* restore those bits;  doing so would open a window in
 477          which a malicious user, M, could subvert a chown command run
 478          by some other user and operating on files in a directory
 479          where M has write access.  */
 480
 481       if (do_chown && !ok && ! chopt->force_silent)
 482         error (0, errno, (uid != (uid_t) -1
 483                           ? _("changing ownership of %s")
 484                           : _("changing group of %s")),
 485                quoteaf (file_full_name));
 486     }
 487
 488   if (chopt->verbosity != V_off)
 489     {
 490       bool changed =
 491         ((do_chown && ok && symlink_changed)
 492          && ! ((uid == (uid_t) -1 || uid == file_stats->st_uid)
 493                && (gid == (gid_t) -1 || gid == file_stats->st_gid)));
 494
 495       if (changed || chopt->verbosity == V_high)
 496         {
 497           enum Change_status ch_status =
 498             (!ok ? CH_FAILED
 499              : !symlink_changed ? CH_NOT_APPLIED
 500              : !changed ? CH_NO_CHANGE_REQUESTED
 501              : CH_SUCCEEDED);
 502           char *old_usr = (file_stats
 503                            ? uid_to_name (file_stats->st_uid) : nullptr);
 504           char *old_grp = (file_stats
 505                            ? gid_to_name (file_stats->st_gid) : nullptr);
 506           char *new_usr = chopt->user_name
 507                           ? chopt->user_name : uid != -1
 508                                                ? uid_to_str (uid) : nullptr;
 509           char *new_grp = chopt->group_name
 510                           ? chopt->group_name : gid != -1
 511                                                ? gid_to_str (gid) : nullptr;
 512           describe_change (file_full_name, ch_status,
 513                            old_usr, old_grp,
 514                            new_usr, new_grp);
 515           free (old_usr);
 516           free (old_grp);
 517           if (new_usr != chopt->user_name)
 518             free (new_usr);
 519           if (new_grp != chopt->group_name)
 520             free (new_grp);
 521         }
 522     }
 523
 524   if ( ! chopt->recurse)
 525     fts_set (fts, ent, FTS_SKIP);
 526
 527   return ok;
 528 }
 529
 530 /* Change the owner and/or group of the specified FILES.
 531    BIT_FLAGS specifies how to treat each symlink-to-directory
 532    that is encountered during a recursive traversal.
 533    CHOPT specifies additional options.
 534    If UID is not -1, then change the owner id of each file to UID.
 535    If GID is not -1, then change the group id of each file to GID.
 536    If REQUIRED_UID and/or REQUIRED_GID is not -1, then change only
 537    files with user ID and group ID that match the non-(-1) value(s).
 538    Return true if successful.  */
 539 extern bool
 540 chown_files (char **files, int bit_flags,
 541              uid_t uid, gid_t gid,
 542              uid_t required_uid, gid_t required_gid,
 543              struct Chown_option const *chopt)
 544 {
 545   bool ok = true;
 546
 547   /* Use lstat and stat only if they're needed.  */
 548   int stat_flags = ((required_uid != (uid_t) -1 || required_gid != (gid_t) -1
 549                      || chopt->affect_symlink_referent
 550                      || chopt->verbosity != V_off)
 551                     ? 0
 552                     : FTS_NOSTAT);
 553
 554   FTS *fts = xfts_open (files, bit_flags | stat_flags, nullptr);
 555
 556   while (true)
 557     {
 558       FTSENT *ent;
 559
 560       ent = fts_read (fts);
 561       if (ent == nullptr)
 562         {
 563           if (errno != 0)
 564             {
 565               /* FIXME: try to give a better message  */
 566               if (! chopt->force_silent)
 567                 error (0, errno, _("fts_read failed"));
 568               ok = false;
 569             }
 570           break;
 571         }
 572
 573       ok &= change_file_owner (fts, ent, uid, gid,
 574                                required_uid, required_gid, chopt);
 575     }
 576
 577   if (fts_close (fts) != 0)
 578     {
 579       error (0, errno, _("fts_close failed"));
 580       ok = false;
 581     }
 582
 583   return ok;
 584 }