1 /* chown-core.c -- core functions for changing ownership.
2 Copyright (C) 2000, 2002, 2003, 2004, 2005, 2006, 2007 Free Software Foundation.
4 This program is free software: you can redistribute it and/or modify
5 it under the terms of the GNU General Public License as published by
6 the Free Software Foundation, either version 3 of the License, or
7 (at your option) any later version.
9 This program is distributed in the hope that it will be useful,
10 but WITHOUT ANY WARRANTY; without even the implied warranty of
11 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 GNU General Public License for more details.
14 You should have received a copy of the GNU General Public License
15 along with this program. If not, see <http://www.gnu.org/licenses/>. */
17 /* Extracted from chown.c/chgrp.c and librarified by Jim Meyering. */
21 #include <sys/types.h>
26 #include "chown-core.h"
31 #include "root-dev-ino.h"
34 #define FTSENT_IS_DIRECTORY(E) \
35 ((E)->fts_info == FTS_D \
36 || (E)->fts_info == FTS_DC \
37 || (E)->fts_info == FTS_DP \
38 || (E)->fts_info == FTS_DNR)
42 /* we called fchown and close, and both succeeded */
45 /* required_uid and/or required_gid are specified, but don't match */
48 /* SAME_INODE check failed */
51 /* open/fchown isn't needed, isn't safe, or doesn't work due to
52 permissions problems; fall back on chown */
55 /* open, fstat, fchown, or close failed */
60 chopt_init (struct Chown_option
*chopt
)
62 chopt
->verbosity
= V_off
;
63 chopt
->root_dev_ino
= NULL
;
64 chopt
->affect_symlink_referent
= true;
65 chopt
->recurse
= false;
66 chopt
->force_silent
= false;
67 chopt
->user_name
= NULL
;
68 chopt
->group_name
= NULL
;
72 chopt_free (struct Chown_option
*chopt ATTRIBUTE_UNUSED
)
74 /* Deliberately do not free chopt->user_name or ->group_name.
75 They're not always allocated. */
78 /* Convert the numeric group-id, GID, to a string stored in xmalloc'd memory,
79 and return it. If there's no corresponding group name, use the decimal
80 representation of the ID. */
83 gid_to_name (gid_t gid
)
85 char buf
[INT_BUFSIZE_BOUND (intmax_t)];
86 struct group
*grp
= getgrgid (gid
);
87 return xstrdup (grp
? grp
->gr_name
88 : TYPE_SIGNED (gid_t
) ? imaxtostr (gid
, buf
)
89 : umaxtostr (gid
, buf
));
92 /* Convert the numeric user-id, UID, to a string stored in xmalloc'd memory,
93 and return it. If there's no corresponding user name, use the decimal
94 representation of the ID. */
97 uid_to_name (uid_t uid
)
99 char buf
[INT_BUFSIZE_BOUND (intmax_t)];
100 struct passwd
*pwd
= getpwuid (uid
);
101 return xstrdup (pwd
? pwd
->pw_name
102 : TYPE_SIGNED (uid_t
) ? imaxtostr (uid
, buf
)
103 : umaxtostr (uid
, buf
));
106 /* Tell the user how/if the user and group of FILE have been changed.
107 If USER is NULL, give the group-oriented messages.
108 CHANGED describes what (if anything) has happened. */
111 describe_change (const char *file
, enum Change_status changed
,
112 char const *user
, char const *group
)
116 char *spec_allocated
= NULL
;
118 if (changed
== CH_NOT_APPLIED
)
120 printf (_("neither symbolic link %s nor referent has been changed\n"),
129 spec_allocated
= xmalloc (strlen (user
) + 1 + strlen (group
) + 1);
130 stpcpy (stpcpy (stpcpy (spec_allocated
, user
), ":"), group
);
131 spec
= spec_allocated
;
146 fmt
= (user
? _("changed ownership of %s to %s\n")
147 : group
? _("changed group of %s to %s\n")
148 : _("no change to ownership of %s\n"));
151 fmt
= (user
? _("failed to change ownership of %s to %s\n")
152 : group
? _("failed to change group of %s to %s\n")
153 : _("failed to change ownership of %s\n"));
155 case CH_NO_CHANGE_REQUESTED
:
156 fmt
= (user
? _("ownership of %s retained as %s\n")
157 : group
? _("group of %s retained as %s\n")
158 : _("ownership of %s retained\n"));
164 printf (fmt
, quote (file
), spec
);
166 free (spec_allocated
);
169 /* Change the owner and/or group of the FILE to UID and/or GID (safely)
170 only if REQUIRED_UID and REQUIRED_GID match the owner and group IDs
171 of FILE. ORIG_ST must be the result of `stat'ing FILE.
173 The `safely' part above means that we can't simply use chown(2),
174 since FILE might be replaced with some other file between the time
175 of the preceding stat/lstat and this chown call. So here we open
176 FILE and do everything else via the resulting file descriptor.
177 We first call fstat and verify that the dev/inode match those from
178 the preceding stat call, and only then, if appropriate (given the
179 required_uid and required_gid constraints) do we call fchown.
181 Return RC_do_ordinary_chown if we can't open FILE, or if FILE is a
182 special file that might have undesirable side effects when opening.
183 In this case the caller can use the less-safe ordinary chown.
185 Return one of the RCH_status values. */
187 static enum RCH_status
188 restricted_chown (int cwd_fd
, char const *file
,
189 struct stat
const *orig_st
,
190 uid_t uid
, gid_t gid
,
191 uid_t required_uid
, gid_t required_gid
)
193 enum RCH_status status
= RC_ok
;
195 int open_flags
= O_NONBLOCK
| O_NOCTTY
;
198 if (required_uid
== (uid_t
) -1 && required_gid
== (gid_t
) -1)
199 return RC_do_ordinary_chown
;
201 if (! S_ISREG (orig_st
->st_mode
))
203 if (S_ISDIR (orig_st
->st_mode
))
204 open_flags
|= O_DIRECTORY
;
206 return RC_do_ordinary_chown
;
209 fd
= openat (cwd_fd
, file
, O_RDONLY
| open_flags
);
211 || (errno
== EACCES
&& S_ISREG (orig_st
->st_mode
)
212 && 0 <= (fd
= openat (cwd_fd
, file
, O_WRONLY
| open_flags
)))))
213 return (errno
== EACCES
? RC_do_ordinary_chown
: RC_error
);
215 if (fstat (fd
, &st
) != 0)
217 else if (! SAME_INODE (*orig_st
, st
))
218 status
= RC_inode_changed
;
219 else if ((required_uid
== (uid_t
) -1 || required_uid
== st
.st_uid
)
220 && (required_gid
== (gid_t
) -1 || required_gid
== st
.st_gid
))
222 if (fchown (fd
, uid
, gid
) == 0)
224 status
= (close (fd
) == 0
234 { /* FIXME: remove these curly braces when we assume C99. */
235 int saved_errno
= errno
;
242 /* Change the owner and/or group of the file specified by FTS and ENT
243 to UID and/or GID as appropriate.
244 If REQUIRED_UID is not -1, then skip files with any other user ID.
245 If REQUIRED_GID is not -1, then skip files with any other group ID.
246 CHOPT specifies additional options.
247 Return true if successful. */
249 change_file_owner (FTS
*fts
, FTSENT
*ent
,
250 uid_t uid
, gid_t gid
,
251 uid_t required_uid
, gid_t required_gid
,
252 struct Chown_option
const *chopt
)
254 char const *file_full_name
= ent
->fts_path
;
255 char const *file
= ent
->fts_accpath
;
256 struct stat
const *file_stats
;
257 struct stat stat_buf
;
260 bool symlink_changed
= true;
262 switch (ent
->fts_info
)
267 if (ROOT_DEV_INO_CHECK (chopt
->root_dev_ino
, ent
->fts_statp
))
269 /* This happens e.g., with "chown -R --preserve-root 0 /"
270 and with "chown -RH --preserve-root 0 symlink-to-root". */
271 ROOT_DEV_INO_WARN (file_full_name
);
272 /* Tell fts not to traverse into this hierarchy. */
273 fts_set (fts
, ent
, FTS_SKIP
);
274 /* Ensure that we do not process "/" on the second visit. */
275 ent
= fts_read (fts
);
283 if (! chopt
->recurse
)
288 /* For a top-level file or directory, this FTS_NS (stat failed)
289 indicator is determined at the time of the initial fts_open call.
290 With programs like chmod, chown, and chgrp, that modify
291 permissions, it is possible that the file in question is
292 accessible when control reaches this point. So, if this is
293 the first time we've seen the FTS_NS for this file, tell
294 fts_read to stat it "again". */
295 if (ent
->fts_level
== 0 && ent
->fts_number
== 0)
298 fts_set (fts
, ent
, FTS_AGAIN
);
301 error (0, ent
->fts_errno
, _("cannot access %s"), quote (file_full_name
));
306 error (0, ent
->fts_errno
, _("%s"), quote (file_full_name
));
311 error (0, ent
->fts_errno
, _("cannot read directory %s"),
312 quote (file_full_name
));
325 else if (required_uid
== (uid_t
) -1 && required_gid
== (gid_t
) -1
326 && chopt
->verbosity
== V_off
327 && ! chopt
->root_dev_ino
328 && ! chopt
->affect_symlink_referent
)
331 file_stats
= ent
->fts_statp
;
335 file_stats
= ent
->fts_statp
;
337 /* If this is a symlink and we're dereferencing them,
338 stat it to get info on the referent. */
339 if (chopt
->affect_symlink_referent
&& S_ISLNK (file_stats
->st_mode
))
341 if (fstatat (fts
->fts_cwd_fd
, file
, &stat_buf
, 0) != 0)
343 error (0, errno
, _("cannot dereference %s"),
344 quote (file_full_name
));
348 file_stats
= &stat_buf
;
352 && (required_uid
== (uid_t
) -1
353 || required_uid
== file_stats
->st_uid
)
354 && (required_gid
== (gid_t
) -1
355 || required_gid
== file_stats
->st_gid
));
358 /* This happens when chown -LR --preserve-root encounters a symlink-to-/. */
360 && FTSENT_IS_DIRECTORY (ent
)
361 && ROOT_DEV_INO_CHECK (chopt
->root_dev_ino
, file_stats
))
363 ROOT_DEV_INO_WARN (file_full_name
);
369 if ( ! chopt
->affect_symlink_referent
)
371 ok
= (lchownat (fts
->fts_cwd_fd
, file
, uid
, gid
) == 0);
373 /* Ignore any error due to lack of support; POSIX requires
374 this behavior for top-level symbolic links with -h, and
375 implies that it's required for all symbolic links. */
376 if (!ok
&& errno
== EOPNOTSUPP
)
379 symlink_changed
= false;
384 /* If possible, avoid a race condition with --from=O:G and without the
385 (-h) --no-dereference option. If fts's stat call determined
386 that the uid/gid of FILE matched the --from=O:G-selected
387 owner and group IDs, blindly using chown(2) here could lead
388 chown(1) or chgrp(1) mistakenly to dereference a *symlink*
389 to an arbitrary file that an attacker had moved into the
390 place of FILE during the window between the stat and
391 chown(2) calls. If FILE is a regular file or a directory
392 that can be opened, this race condition can be avoided safely. */
395 = restricted_chown (fts
->fts_cwd_fd
, file
, file_stats
, uid
, gid
,
396 required_uid
, required_gid
);
402 case RC_do_ordinary_chown
:
403 ok
= (chownat (fts
->fts_cwd_fd
, file
, uid
, gid
) == 0);
410 case RC_inode_changed
:
411 /* FIXME: give a diagnostic in this case? */
422 /* On some systems (e.g., Linux-2.4.x),
423 the chown function resets the `special' permission bits.
424 Do *not* restore those bits; doing so would open a window in
425 which a malicious user, M, could subvert a chown command run
426 by some other user and operating on files in a directory
427 where M has write access. */
429 if (do_chown
&& !ok
&& ! chopt
->force_silent
)
430 error (0, errno
, (uid
!= (uid_t
) -1
431 ? _("changing ownership of %s")
432 : _("changing group of %s")),
433 quote (file_full_name
));
436 if (chopt
->verbosity
!= V_off
)
439 ((do_chown
& ok
& symlink_changed
)
440 && ! ((uid
== (uid_t
) -1 || uid
== file_stats
->st_uid
)
441 && (gid
== (gid_t
) -1 || gid
== file_stats
->st_gid
)));
443 if (changed
|| chopt
->verbosity
== V_high
)
445 enum Change_status ch_status
=
447 : !symlink_changed
? CH_NOT_APPLIED
448 : !changed
? CH_NO_CHANGE_REQUESTED
450 describe_change (file_full_name
, ch_status
,
451 chopt
->user_name
, chopt
->group_name
);
455 if ( ! chopt
->recurse
)
456 fts_set (fts
, ent
, FTS_SKIP
);
461 /* Change the owner and/or group of the specified FILES.
462 BIT_FLAGS specifies how to treat each symlink-to-directory
463 that is encountered during a recursive traversal.
464 CHOPT specifies additional options.
465 If UID is not -1, then change the owner id of each file to UID.
466 If GID is not -1, then change the group id of each file to GID.
467 If REQUIRED_UID and/or REQUIRED_GID is not -1, then change only
468 files with user ID and group ID that match the non-(-1) value(s).
469 Return true if successful. */
471 chown_files (char **files
, int bit_flags
,
472 uid_t uid
, gid_t gid
,
473 uid_t required_uid
, gid_t required_gid
,
474 struct Chown_option
const *chopt
)
478 /* Use lstat and stat only if they're needed. */
479 int stat_flags
= ((required_uid
!= (uid_t
) -1 || required_gid
!= (gid_t
) -1
480 || chopt
->affect_symlink_referent
481 || chopt
->verbosity
!= V_off
)
485 FTS
*fts
= xfts_open (files
, bit_flags
| stat_flags
, NULL
);
491 ent
= fts_read (fts
);
496 /* FIXME: try to give a better message */
497 error (0, errno
, _("fts_read failed"));
503 ok
&= change_file_owner (fts
, ent
, uid
, gid
,
504 required_uid
, required_gid
, chopt
);
507 /* Ignore failure, since the only way it can do so is in failing to
508 return to the original directory, and since we're about to exit,
509 that doesn't matter. */