1 /* Secure file saving handling */
12 #include <sys/types.h>
13 #include <sys/stat.h> /* OS/2 needs this after sys/types.h */
20 #include "config/options.h"
21 #include "osdep/osdep.h" /* Needed for mkstemp() on win32 */
22 #include "util/memory.h"
23 #include "util/secsave.h"
24 #include "util/string.h"
27 /* If infofiles.secure_save is set:
28 * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
30 * A call to secure_open("/home/me/.elinks/filename", mask) will open a file
31 * named "filename.tmp_XXXXXX" in /home/me/.elinks/ and return a pointer to a
32 * structure secure_save_info on success or NULL on error.
34 * filename.tmp_XXXXXX can't conflict with any file since it's created using
35 * mkstemp(). XXXXXX is a random string.
37 * Subsequent write operations are done using returned secure_save_info FILE *
40 * If an error is encountered, secure_save_info int field named err is set
41 * (automatically if using secure_fp*() functions or by programmer)
43 * When secure_close() is called, "filename.tmp_XXXXXX" is flushed and closed,
44 * and if secure_save_info err field has a value of zero, "filename.tmp_XXXXXX"
45 * is renamed to "filename". If this succeeded, then secure_close() returns 0.
47 * WARNING: since rename() is used, any symlink called "filename" may be
48 * replaced by a regular file. If destination file isn't a regular file,
49 * then secsave is disabled for that file.
51 * If infofiles.secure_save is unset:
52 * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
54 * No temporary file is created, "filename" is truncated, all operations are
55 * done on it, no rename nor flush occur, symlinks are preserved.
60 * Access rights are affected by secure_open() mask parameter.
63 /* FIXME: locking system on files about to be rewritten ? */
64 /* FIXME: Low risk race conditions about ssi->file_name. */
66 enum secsave_errno secsave_errno
= SS_ERR_NONE
;
69 /* Open a file for writing in a secure way. It returns a pointer to a structure
70 * secure_save_info on success, or NULL on failure. */
71 struct secure_save_info
*
72 secure_open(unsigned char *file_name
, mode_t mask
)
76 struct secure_save_info
*ssi
;
78 secsave_errno
= SS_ERR_NONE
;
80 /* XXX: This is inherently evil and has no place in util/, which
81 * should be independent on such stuff. What do we do, except blaming
82 * Jonas for noticing it? --pasky */
83 if ((get_cmd_opt_bool("no-connect")
84 || get_cmd_opt_int("session-ring"))
85 && !get_cmd_opt_bool("touch-files")) {
86 secsave_errno
= SS_ERR_DISABLED
;
90 ssi
= mem_calloc(1, sizeof(*ssi
));
92 secsave_errno
= SS_ERR_OUT_OF_MEM
;
96 ssi
->secure_save
= get_opt_bool("infofiles.secure_save");
98 ssi
->file_name
= stracpy(file_name
);
99 if (!ssi
->file_name
) {
100 secsave_errno
= SS_ERR_OUT_OF_MEM
;
104 /* Check properties of final file. */
105 #ifdef FS_UNIX_SOFTLINKS
106 if (lstat(ssi
->file_name
, &st
)) {
108 if (stat(ssi
->file_name
, &st
)) {
110 /* We ignore error caused by file inexistence. */
111 if (errno
!= ENOENT
) {
114 secsave_errno
= SS_ERR_STAT
;
118 if (!S_ISREG(st
.st_mode
)) {
119 /* Not a regular file, secure_save is disabled. */
120 ssi
->secure_save
= 0;
123 /* XXX: access() do not work with setuid programs. */
124 if (access(ssi
->file_name
, R_OK
| W_OK
) < 0) {
126 secsave_errno
= SS_ERR_ACCESS
;
132 /* We still have a race condition here between
133 * [l]stat() and fopen() */
135 f1
= fopen(ssi
->file_name
, "rb+");
140 secsave_errno
= SS_ERR_OPEN_READ
;
147 saved_mask
= umask(mask
);
149 if (ssi
->secure_save
) {
150 /* We use a random name for temporary file, mkstemp() opens
151 * the file and return a file descriptor named fd, which is
152 * then converted to FILE * using fdopen().
155 unsigned char *randname
= straconcat(ssi
->file_name
,
156 ".tmp_XXXXXX", NULL
);
159 secsave_errno
= SS_ERR_OUT_OF_MEM
;
163 /* No need to use safe_mkstemp() here. --Zas */
164 fd
= mkstemp(randname
);
166 secsave_errno
= SS_ERR_MKSTEMP
;
171 ssi
->fp
= fdopen(fd
, "w");
173 secsave_errno
= SS_ERR_OPEN_WRITE
;
179 ssi
->tmp_file_name
= randname
;
181 /* No need to create a temporary file here. */
182 ssi
->fp
= fopen(ssi
->file_name
, "wb");
184 secsave_errno
= SS_ERR_OPEN_WRITE
;
195 mem_free(ssi
->file_name
);
196 ssi
->file_name
= NULL
;
207 /* Close a file opened with secure_open, and return 0 on success, errno
208 * or -1 on failure. */
210 secure_close(struct secure_save_info
*ssi
)
214 if (!ssi
) return ret
;
215 if (!ssi
->fp
) goto free
;
217 if (ssi
->err
) { /* Keep previous errno. */
219 fclose(ssi
->fp
); /* Close file */
223 /* Ensure data is effectively written to disk, we first flush libc buffers
224 * using fflush(), then fsync() to flush kernel buffers, and finally call
225 * fclose() (which call fflush() again, but the first one is needed since
226 * it doesn't make much sense to flush kernel buffers and then libc buffers,
227 * while closing file releases file descriptor we need to call fsync(). */
228 #if defined(HAVE_FFLUSH) || defined(HAVE_FSYNC)
229 if (ssi
->secure_save
) {
233 fail
= (fflush(ssi
->fp
) == EOF
);
237 if (!fail
&& get_opt_bool("infofiles.secure_save_fsync"))
238 fail
= fsync(fileno(ssi
->fp
));
243 secsave_errno
= SS_ERR_OTHER
;
245 fclose(ssi
->fp
); /* Close file, ignore errors. */
252 if (fclose(ssi
->fp
) == EOF
) {
254 secsave_errno
= SS_ERR_OTHER
;
258 if (ssi
->secure_save
&& ssi
->file_name
&& ssi
->tmp_file_name
) {
260 /* OS/2 needs this, however it breaks atomicity on
262 unlink(ssi
->file_name
);
264 /* FIXME: Race condition on ssi->file_name. The file
265 * named ssi->file_name may have changed since
266 * secure_open() call (where we stat() file and
268 if (rename(ssi
->tmp_file_name
, ssi
->file_name
) == -1) {
270 secsave_errno
= SS_ERR_RENAME
;
275 ret
= 0; /* Success. */
278 mem_free_if(ssi
->tmp_file_name
);
279 mem_free_if(ssi
->file_name
);
286 /* fputs() wrapper, set ssi->err to errno on error. If ssi->err is set when
287 * called, it immediatly returns EOF. */
289 secure_fputs(struct secure_save_info
*ssi
, const char *s
)
293 if (!ssi
|| !ssi
->fp
|| ssi
->err
) return EOF
;
295 ret
= fputs(s
, ssi
->fp
);
297 secsave_errno
= SS_ERR_OTHER
;
305 /* fputc() wrapper, set ssi->err to errno on error. If ssi->err is set when
306 * called, it immediatly returns EOF. */
308 secure_fputc(struct secure_save_info
*ssi
, int c
)
312 if (!ssi
|| !ssi
->fp
|| ssi
->err
) return EOF
;
314 ret
= fputc(c
, ssi
->fp
);
317 secsave_errno
= SS_ERR_OTHER
;
323 /* fprintf() wrapper, set ssi->err to errno on error and return a negative
324 * value. If ssi->err is set when called, it immediatly returns -1. */
326 secure_fprintf(struct secure_save_info
*ssi
, const char *format
, ...)
331 if (!ssi
|| !ssi
->fp
|| ssi
->err
) return -1;
333 va_start(ap
, format
);
334 ret
= vfprintf(ssi
->fp
, format
, ap
);
335 if (ret
< 0) ssi
->err
= errno
;