src/util/secsave.c

   1 /* Secure file saving handling */
   2
   3 #ifdef HAVE_CONFIG_H
   4 #include "config.h"
   5 #endif
   6
   7 #include <errno.h>
   8 #include <stdarg.h>
   9 #include <stdio.h>
  10 #include <stdlib.h>
  11 #include <string.h>
  12 #include <sys/types.h>
  13 #include <sys/stat.h> /* OS/2 needs this after sys/types.h */
  14 #ifdef HAVE_UNISTD_H
  15 #include <unistd.h>
  16 #endif
  17
  18 #include "elinks.h"
  19
  20 #include "config/options.h"
  21 #include "osdep/osdep.h" /* Needed for mkstemp() on win32 */
  22 #include "util/memory.h"
  23 #include "util/secsave.h"
  24 #include "util/string.h"
  25
  26
  27 /* If infofiles.secure_save is set:
  28  * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  29  *
  30  * A call to secure_open("/home/me/.elinks/filename", mask) will open a file
  31  * named "filename.tmp_XXXXXX" in /home/me/.elinks/ and return a pointer to a
  32  * structure secure_save_info on success or NULL on error.
  33  *
  34  * filename.tmp_XXXXXX can't conflict with any file since it's created using
  35  * mkstemp(). XXXXXX is a random string.
  36  *
  37  * Subsequent write operations are done using returned secure_save_info FILE *
  38  * field named fp.
  39  *
  40  * If an error is encountered, secure_save_info int field named err is set
  41  * (automatically if using secure_fp*() functions or by programmer)
  42  *
  43  * When secure_close() is called, "filename.tmp_XXXXXX" is flushed and closed,
  44  * and if secure_save_info err field has a value of zero, "filename.tmp_XXXXXX"
  45  * is renamed to "filename". If this succeeded, then secure_close() returns 0.
  46  *
  47  * WARNING: since rename() is used, any symlink called "filename" may be
  48  * replaced by a regular file. If destination file isn't a regular file,
  49  * then secsave is disabled for that file.
  50  *
  51  * If infofiles.secure_save is unset:
  52  * ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  53  *
  54  * No temporary file is created, "filename" is truncated, all operations are
  55  * done on it, no rename nor flush occur, symlinks are preserved.
  56  *
  57  * In both cases:
  58  * ~~~~~~~~~~~~~
  59  *
  60  * Access rights are affected by secure_open() mask parameter.
  61  */
  62
  63 /* FIXME: locking system on files about to be rewritten ? */
  64 /* FIXME: Low risk race conditions about ssi->file_name. */
  65
  66 enum secsave_errno secsave_errno = SS_ERR_NONE;
  67
  68
  69 /* Open a file for writing in a secure way. It returns a pointer to a structure
  70  * secure_save_info on success, or NULL on failure. */
  71 static struct secure_save_info *
  72 secure_open_umask(unsigned char *file_name, mode_t mask)
  73 {
  74         mode_t saved_mask;
  75         struct stat st;
  76         struct secure_save_info *ssi;
  77
  78         secsave_errno = SS_ERR_NONE;
  79
  80         /* XXX: This is inherently evil and has no place in util/, which
  81          * should be independent on such stuff. What do we do, except blaming
  82          * Jonas for noticing it? --pasky */
  83         if ((get_cmd_opt_bool("no-connect")
  84              || get_cmd_opt_int("session-ring"))
  85             && !get_cmd_opt_bool("touch-files")) {
  86                 secsave_errno = SS_ERR_DISABLED;
  87                 return NULL;
  88         }
  89
  90         ssi = mem_calloc(1, sizeof(*ssi));
  91         if (!ssi) {
  92                 secsave_errno = SS_ERR_OUT_OF_MEM;
  93                 goto end;
  94         }
  95
  96         ssi->secure_save = get_opt_bool("infofiles.secure_save");
  97
  98         ssi->file_name = stracpy(file_name);
  99         if (!ssi->file_name) {
 100                 secsave_errno = SS_ERR_OUT_OF_MEM;
 101                 goto free_f;
 102         }
 103
 104         /* Check properties of final file. */
 105 #ifdef FS_UNIX_SOFTLINKS
 106         if (lstat(ssi->file_name, &st)) {
 107 #else
 108         if (stat(ssi->file_name, &st)) {
 109 #endif
 110                 /* We ignore error caused by file inexistence. */
 111                 if (errno != ENOENT) {
 112                         /* lstat() error. */
 113                         ssi->err = errno;
 114                         secsave_errno = SS_ERR_STAT;
 115                         goto free_file_name;
 116                 }
 117         } else {
 118                 if (!S_ISREG(st.st_mode)) {
 119                         /* Not a regular file, secure_save is disabled. */
 120                         ssi->secure_save = 0;
 121                 } else {
 122 #ifdef HAVE_ACCESS
 123                         /* XXX: access() do not work with setuid programs. */
 124                         if (access(ssi->file_name, R_OK | W_OK) < 0) {
 125                                 ssi->err = errno;
 126                                 secsave_errno = SS_ERR_ACCESS;
 127                                 goto free_file_name;
 128                         }
 129 #else
 130                         FILE *f1;
 131
 132                         /* We still have a race condition here between
 133                          * [l]stat() and fopen() */
 134
 135                         f1 = fopen(ssi->file_name, "rb+");
 136                         if (f1) {
 137                                 fclose(f1);
 138                         } else {
 139                                 ssi->err = errno;
 140                                 secsave_errno = SS_ERR_OPEN_READ;
 141                                 goto free_file_name;
 142                         }
 143 #endif
 144                 }
 145         }
 146
 147         saved_mask = umask(mask);
 148
 149         if (ssi->secure_save) {
 150                 /* We use a random name for temporary file, mkstemp() opens
 151                  * the file and return a file descriptor named fd, which is
 152                  * then converted to FILE * using fdopen().
 153                  */
 154                 int fd;
 155                 unsigned char *randname = straconcat(ssi->file_name,
 156                                                      ".tmp_XXXXXX", NULL);
 157
 158                 if (!randname) {
 159                         secsave_errno = SS_ERR_OUT_OF_MEM;
 160                         goto free_file_name;
 161                 }
 162
 163                 /* No need to use safe_mkstemp() here. --Zas */
 164                 fd = mkstemp(randname);
 165                 if (fd == -1) {
 166                         secsave_errno = SS_ERR_MKSTEMP;
 167                         mem_free(randname);
 168                         goto free_file_name;
 169                 }
 170
 171                 ssi->fp = fdopen(fd, "w");
 172                 if (!ssi->fp) {
 173                         secsave_errno = SS_ERR_OPEN_WRITE;
 174                         ssi->err = errno;
 175                         mem_free(randname);
 176                         goto free_file_name;
 177                 }
 178
 179                 ssi->tmp_file_name = randname;
 180         } else {
 181                 /* No need to create a temporary file here. */
 182                 ssi->fp = fopen(ssi->file_name, "wb");
 183                 if (!ssi->fp) {
 184                         secsave_errno = SS_ERR_OPEN_WRITE;
 185                         ssi->err = errno;
 186                         goto free_file_name;
 187                 }
 188         }
 189
 190         umask(saved_mask);
 191
 192         return ssi;
 193
 194 free_file_name:
 195         mem_free(ssi->file_name);
 196         ssi->file_name = NULL;
 197
 198 free_f:
 199         mem_free(ssi);
 200         ssi = NULL;
 201
 202 end:
 203         return NULL;
 204 }
 205
 206 struct secure_save_info *
 207 secure_open(unsigned char *file_name)
 208 {
 209 #ifdef CONFIG_OS_WIN32
 210         /* There is neither S_IRWXG nor S_IRWXO under crossmingw32-gcc */
 211         return secure_open_umask(file_name, 0177);
 212 #else
 213         return secure_open_umask(file_name, S_IXUSR | S_IRWXG | S_IRWXO);
 214 #endif
 215 }
 216
 217 /* Close a file opened with secure_open, and return 0 on success, errno
 218  * or -1 on failure. */
 219 int
 220 secure_close(struct secure_save_info *ssi)
 221 {
 222         int ret = -1;
 223
 224         if (!ssi) return ret;
 225         if (!ssi->fp) goto free;
 226
 227         if (ssi->err) { /* Keep previous errno. */
 228                 ret = ssi->err;
 229                 fclose(ssi->fp); /* Close file */
 230                 goto free;
 231         }
 232
 233         /* Ensure data is effectively written to disk, we first flush libc buffers
 234          * using fflush(), then fsync() to flush kernel buffers, and finally call
 235          * fclose() (which call fflush() again, but the first one is needed since
 236          * it doesn't make much sense to flush kernel buffers and then libc buffers,
 237          * while closing file releases file descriptor we need to call fsync(). */
 238 #if defined(HAVE_FFLUSH) || defined(HAVE_FSYNC)
 239         if (ssi->secure_save) {
 240                 int fail = 0;
 241
 242 #ifdef HAVE_FFLUSH
 243                 fail = (fflush(ssi->fp) == EOF);
 244 #endif
 245
 246 #ifdef HAVE_FSYNC
 247                 if (!fail && get_opt_bool("infofiles.secure_save_fsync"))
 248                         fail = fsync(fileno(ssi->fp));
 249 #endif
 250
 251                 if (fail) {
 252                         ret = errno;
 253                         secsave_errno = SS_ERR_OTHER;
 254
 255                         fclose(ssi->fp); /* Close file, ignore errors. */
 256                         goto free;
 257                 }
 258         }
 259 #endif
 260
 261         /* Close file. */
 262         if (fclose(ssi->fp) == EOF) {
 263                 ret = errno;
 264                 secsave_errno = SS_ERR_OTHER;
 265                 goto free;
 266         }
 267
 268         if (ssi->secure_save && ssi->file_name && ssi->tmp_file_name) {
 269 #ifdef CONFIG_OS_OS2
 270                 /* OS/2 needs this, however it breaks atomicity on
 271                  * UN*X. */
 272                 unlink(ssi->file_name);
 273 #endif
 274                 /* FIXME: Race condition on ssi->file_name. The file
 275                  * named ssi->file_name may have changed since
 276                  * secure_open() call (where we stat() file and
 277                  * more..).  */
 278                 if (rename(ssi->tmp_file_name, ssi->file_name) == -1) {
 279                         ret = errno;
 280                         secsave_errno = SS_ERR_RENAME;
 281                         goto free;
 282                 }
 283         }
 284
 285         ret = 0;        /* Success. */
 286
 287 free:
 288         mem_free_if(ssi->tmp_file_name);
 289         mem_free_if(ssi->file_name);
 290         mem_free_if(ssi);
 291
 292         return ret;
 293 }
 294
 295
 296 /* fputs() wrapper, set ssi->err to errno on error. If ssi->err is set when
 297  * called, it immediatly returns EOF. */
 298 int
 299 secure_fputs(struct secure_save_info *ssi, const char *s)
 300 {
 301         int ret;
 302
 303         if (!ssi || !ssi->fp || ssi->err) return EOF;
 304
 305         ret = fputs(s, ssi->fp);
 306         if (ret == EOF) {
 307                 secsave_errno = SS_ERR_OTHER;
 308                 ssi->err = errno;
 309         }
 310
 311         return ret;
 312 }
 313
 314
 315 /* fputc() wrapper, set ssi->err to errno on error. If ssi->err is set when
 316  * called, it immediatly returns EOF. */
 317 int
 318 secure_fputc(struct secure_save_info *ssi, int c)
 319 {
 320         int ret;
 321
 322         if (!ssi || !ssi->fp || ssi->err) return EOF;
 323
 324         ret = fputc(c, ssi->fp);
 325         if (ret == EOF) {
 326                 ssi->err = errno;
 327                 secsave_errno = SS_ERR_OTHER;
 328         }
 329
 330         return ret;
 331 }
 332
 333 /* fprintf() wrapper, set ssi->err to errno on error and return a negative
 334  * value. If ssi->err is set when called, it immediatly returns -1. */
 335 int
 336 secure_fprintf(struct secure_save_info *ssi, const char *format, ...)
 337 {
 338         va_list ap;
 339         int ret;
 340
 341         if (!ssi || !ssi->fp || ssi->err) return -1;
 342
 343         va_start(ap, format);
 344         ret = vfprintf(ssi->fp, format, ap);
 345         if (ret < 0) ssi->err = errno;
 346         va_end(ap);
 347
 348         return ret;
 349 }