1 /* movemail foo bar -- move file foo to file bar,
2 locking file foo the way /bin/mail respects.
4 Copyright (C) 1986, 1992-1994, 1996, 1999, 2001-2012
5 Free Software Foundation, Inc.
7 This file is part of GNU Emacs.
9 GNU Emacs is free software: you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation, either version 3 of the License, or
12 (at your option) any later version.
14 GNU Emacs is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
19 You should have received a copy of the GNU General Public License
20 along with GNU Emacs. If not, see <http://www.gnu.org/licenses/>. */
23 /* Important notice: defining MAIL_USE_FLOCK or MAIL_USE_LOCKF *will
24 cause loss of mail* if you do it on a system that does not normally
25 use flock as its way of interlocking access to inbox files. The
26 setting of MAIL_USE_FLOCK and MAIL_USE_LOCKF *must agree* with the
27 system's own conventions. It is not a choice that is up to you.
29 So, if your system uses lock files rather than flock, then the only way
30 you can get proper operation is to enable movemail to write lockfiles there.
31 This means you must either give that directory access modes
32 that permit everyone to write lockfiles in it, or you must make movemail
33 a setuid or setgid program. */
36 * Modified January, 1986 by Michael R. Gretzinger (Project Athena)
38 * Added POP (Post Office Protocol) service. When compiled -DMAIL_USE_POP
39 * movemail will accept input filename arguments of the form
40 * "po:username". This will cause movemail to open a connection to
41 * a pop server running on $MAILHOST (environment variable). Movemail
42 * must be setuid to root in order to work with POP.
44 * New module: popmail.c
46 * main - added code within #ifdef MAIL_USE_POP; added setuid (getuid ())
48 * New routines in movemail.c:
49 * get_errmsg - return pointer to system error message
51 * Modified August, 1993 by Jonathan Kamens (OpenVision Technologies)
53 * Move all of the POP code into a separate file, "pop.c".
54 * Use strerror instead of get_errmsg.
59 #include <sys/types.h>
86 #define wait(var) (*(var) = 0)
87 /* Unfortunately, Samba doesn't seem to properly lock Unix files even
88 though the locking call succeeds (and indeed blocks local access from
89 other NT programs). If you have direct file access using an NFS
90 client or something other than Samba, the locking call might work
91 properly - make sure it does before you enable this!
93 [18-Feb-97 andrewi] I now believe my comment above to be incorrect,
94 since it was based on a misunderstanding of how locking calls are
95 implemented and used on Unix. */
96 //#define DISABLE_DIRECT_ACCESS
99 #endif /* WINDOWSNT */
109 #include <sys/locking.h>
112 #ifdef MAIL_USE_LOCKF
113 #define MAIL_USE_SYSTEM_LOCK
116 #ifdef MAIL_USE_FLOCK
117 #define MAIL_USE_SYSTEM_LOCK
121 extern int lk_open (), lk_close ();
124 #if !defined (MAIL_USE_SYSTEM_LOCK) && !defined (MAIL_USE_MMDF) && \
125 (defined (HAVE_LIBMAIL) || defined (HAVE_LIBLOCKFILE)) && \
126 defined (HAVE_MAILLOCK_H)
127 #include <maillock.h>
128 /* We can't use maillock unless we know what directory system mail
131 #define MAIL_USE_MAILLOCK
132 static char *mail_spool_name (char *);
136 static _Noreturn
void fatal (const char *s1
, const char *s2
, const char *s3
);
137 static void error (const char *s1
, const char *s2
, const char *s3
);
138 static _Noreturn
void pfatal_with_name (char *name
);
139 static _Noreturn
void pfatal_and_delete (char *name
);
141 static int popmail (char *mailbox
, char *outfile
, int preserve
, char *password
, int reverse_order
);
142 static int pop_retr (popserver server
, int msgno
, FILE *arg
);
143 static int mbx_write (char *line
, int len
, FILE *mbf
);
144 static int mbx_delimit_begin (FILE *mbf
);
145 static int mbx_delimit_end (FILE *mbf
);
148 #if (defined MAIL_USE_MAILLOCK \
149 || (!defined DISABLE_DIRECT_ACCESS && !defined MAIL_USE_MMDF \
150 && !defined MAIL_USE_SYSTEM_LOCK))
151 /* Like malloc but get fatal error if memory is exhausted. */
154 xmalloc (size_t size
)
156 void *result
= malloc (size
);
158 fatal ("virtual memory exhausted", 0, 0);
163 /* Nonzero means this is name of a lock file to delete on fatal error. */
164 static char *delete_lockname
;
167 main (int argc
, char **argv
)
169 char *inname
, *outname
;
173 int c
, preserve_mail
= 0;
175 #ifndef MAIL_USE_SYSTEM_LOCK
180 size_t inname_len
, inname_dirlen
;
182 #endif /* not MAIL_USE_SYSTEM_LOCK */
184 #ifdef MAIL_USE_MAILLOCK
189 int pop_reverse_order
= 0;
191 #else /* ! MAIL_USE_POP */
193 #endif /* MAIL_USE_POP */
195 uid_t real_gid
= getgid ();
196 uid_t priv_gid
= getegid ();
199 /* Ensure all file i/o is in binary mode. */
205 while ((c
= getopt (argc
, argv
, ARGSTR
)) != EOF
)
210 pop_reverse_order
= 1;
223 (argc
- optind
< 2) || (argc
- optind
> 3)
230 fprintf (stderr
, "Usage: movemail [-p] [-r] inbox destfile%s\n",
233 fprintf (stderr
, "Usage: movemail [-p] inbox destfile%s\n", "");
238 inname
= argv
[optind
];
239 outname
= argv
[optind
+1];
246 fatal ("Destination file name is empty", 0, 0);
249 if (!strncmp (inname
, "po:", 3))
253 status
= popmail (inname
+ 3, outname
, preserve_mail
,
254 (argc
- optind
== 3) ? argv
[optind
+2] : NULL
,
259 if (setuid (getuid ()) < 0)
260 fatal ("Failed to drop privileges", 0, 0);
262 #endif /* MAIL_USE_POP */
264 #ifndef DISABLE_DIRECT_ACCESS
265 #ifndef MAIL_USE_MMDF
266 #ifndef MAIL_USE_SYSTEM_LOCK
267 #ifdef MAIL_USE_MAILLOCK
268 spool_name
= mail_spool_name (inname
);
278 #ifndef DIRECTORY_SEP
279 #define DIRECTORY_SEP '/'
281 #ifndef IS_DIRECTORY_SEP
282 #define IS_DIRECTORY_SEP(_c_) ((_c_) == DIRECTORY_SEP)
285 /* Use a lock file named after our first argument with .lock appended:
286 If it exists, the mail file is locked. */
287 /* Note: this locking mechanism is *required* by the mailer
288 (on systems which use it) to prevent loss of mail.
290 On systems that use a lock file, extracting the mail without locking
291 WILL occasionally cause loss of mail due to timing errors!
293 So, if creation of the lock file fails
294 due to access permission on the mail spool directory,
295 you simply MUST change the permission
296 and/or make movemail a setgid program
297 so it can create lock files properly.
299 You might also wish to verify that your system is one
300 which uses lock files for this purpose. Some systems use other methods.
302 If your system uses the `flock' system call for mail locking,
303 define MAIL_USE_SYSTEM_LOCK in config.h or the s-*.h file
304 and recompile movemail. If the s- file for your system
305 should define MAIL_USE_SYSTEM_LOCK but does not, send a bug report
306 to bug-gnu-emacs@prep.ai.mit.edu so we can fix it. */
308 inname_len
= strlen (inname
);
309 lockname
= xmalloc (inname_len
+ sizeof ".lock");
310 strcpy (lockname
, inname
);
311 strcpy (lockname
+ inname_len
, ".lock");
312 for (inname_dirlen
= inname_len
;
313 inname_dirlen
&& !IS_DIRECTORY_SEP (inname
[inname_dirlen
- 1]);
316 tempname
= xmalloc (inname_dirlen
+ sizeof "EXXXXXX");
320 /* Create the lock file, but not under the lock file name. */
321 /* Give up if cannot do that. */
323 memcpy (tempname
, inname
, inname_dirlen
);
324 strcpy (tempname
+ inname_dirlen
, "EXXXXXX");
326 desc
= mkstemp (tempname
);
334 desc
= open (tempname
, O_WRONLY
| O_CREAT
| O_EXCL
, 0600);
339 int mkstemp_errno
= errno
;
340 error ("error while creating what would become the lock file",
342 errno
= mkstemp_errno
;
343 pfatal_with_name (tempname
);
347 tem
= link (tempname
, lockname
);
350 if (tem
< 0 && errno
== EPERM
)
351 fatal ("Unable to create hard link between %s and %s",
360 /* If lock file is five minutes old, unlock it.
361 Five minutes should be good enough to cope with crashes
362 and wedgitude, and long enough to avoid being fooled
363 by time differences between machines. */
364 if (stat (lockname
, &st
) >= 0)
366 time_t now
= time (0);
367 if (st
.st_ctime
< now
- 300)
372 delete_lockname
= lockname
;
374 #endif /* not MAIL_USE_SYSTEM_LOCK */
375 #endif /* not MAIL_USE_MMDF */
381 #if defined (MAIL_USE_MAILLOCK) && defined (HAVE_TOUCHLOCK)
388 if (setuid (getuid ()) < 0 || setregid (-1, real_gid
) < 0)
389 fatal ("Failed to drop privileges", 0, 0);
391 #ifndef MAIL_USE_MMDF
392 #ifdef MAIL_USE_SYSTEM_LOCK
393 indesc
= open (inname
, O_RDWR
);
394 #else /* if not MAIL_USE_SYSTEM_LOCK */
395 indesc
= open (inname
, O_RDONLY
);
396 #endif /* not MAIL_USE_SYSTEM_LOCK */
397 #else /* MAIL_USE_MMDF */
398 indesc
= lk_open (inname
, O_RDONLY
, 0, 0, 10);
399 #endif /* MAIL_USE_MMDF */
402 pfatal_with_name (inname
);
405 /* In case movemail is setuid to root, make sure the user can
406 read the output file. */
407 /* This is desirable for all systems
408 but I don't want to assume all have the umask system call */
409 umask (umask (0) & 0333);
410 #endif /* BSD_SYSTEM */
411 outdesc
= open (outname
, O_WRONLY
| O_CREAT
| O_EXCL
, 0666);
413 pfatal_with_name (outname
);
415 if (setregid (-1, priv_gid
) < 0)
416 fatal ("Failed to regain privileges", 0, 0);
418 /* This label exists so we can retry locking
419 after a delay, if it got EAGAIN or EBUSY. */
422 /* Try to lock it. */
423 #ifdef MAIL_USE_MAILLOCK
426 /* The "0 - " is to make it a negative number if maillock returns
428 status
= 0 - maillock (spool_name
, 1);
429 #ifdef HAVE_TOUCHLOCK
430 touched_lock
= time (0);
435 #endif /* MAIL_USE_MAILLOCK */
437 #ifdef MAIL_USE_SYSTEM_LOCK
438 #ifdef MAIL_USE_LOCKF
439 status
= lockf (indesc
, F_LOCK
, 0);
440 #else /* not MAIL_USE_LOCKF */
442 status
= locking (indesc
, LK_RLCK
, -1L);
444 status
= flock (indesc
, LOCK_EX
);
446 #endif /* not MAIL_USE_LOCKF */
447 #endif /* MAIL_USE_SYSTEM_LOCK */
450 /* If it fails, retry up to 5 times
451 for certain failure codes. */
454 if (++lockcount
<= 5)
472 pfatal_with_name (inname
);
480 nread
= read (indesc
, buf
, sizeof buf
);
482 pfatal_with_name (inname
);
483 if (nread
!= write (outdesc
, buf
, nread
))
485 int saved_errno
= errno
;
488 pfatal_with_name (outname
);
490 if (nread
< sizeof buf
)
492 #if defined (MAIL_USE_MAILLOCK) && defined (HAVE_TOUCHLOCK)
495 time_t now
= time (0);
496 if (now
- touched_lock
> 60)
502 #endif /* MAIL_USE_MAILLOCK */
507 if (fsync (outdesc
) < 0)
508 pfatal_and_delete (outname
);
511 /* Prevent symlink attacks truncating other users' mailboxes */
512 if (setregid (-1, real_gid
) < 0)
513 fatal ("Failed to drop privileges", 0, 0);
515 /* Check to make sure no errors before we zap the inbox. */
516 if (close (outdesc
) != 0)
517 pfatal_and_delete (outname
);
519 #ifdef MAIL_USE_SYSTEM_LOCK
522 if (ftruncate (indesc
, 0L) != 0)
523 pfatal_with_name (inname
);
525 #endif /* MAIL_USE_SYSTEM_LOCK */
528 lk_close (indesc
, 0, 0, 0);
533 #ifndef MAIL_USE_SYSTEM_LOCK
536 /* Delete the input file; if we can't, at least get rid of its
538 #ifdef MAIL_UNLINK_SPOOL
539 /* This is generally bad to do, because it destroys the permissions
540 that were set on the file. Better to just empty the file. */
541 if (unlink (inname
) < 0 && errno
!= ENOENT
)
542 #endif /* MAIL_UNLINK_SPOOL */
543 creat (inname
, 0600);
545 #endif /* not MAIL_USE_SYSTEM_LOCK */
547 /* End of mailbox truncation */
548 if (setregid (-1, priv_gid
) < 0)
549 fatal ("Failed to regain privileges", 0, 0);
551 #ifdef MAIL_USE_MAILLOCK
552 /* This has to occur in the child, i.e., in the process that
553 acquired the lock! */
561 if (!WIFEXITED (wait_status
))
563 else if (WRETCODE (wait_status
) != 0)
564 exit (WRETCODE (wait_status
));
566 #if !defined (MAIL_USE_MMDF) && !defined (MAIL_USE_SYSTEM_LOCK)
567 #ifdef MAIL_USE_MAILLOCK
569 #endif /* MAIL_USE_MAILLOCK */
571 #endif /* not MAIL_USE_MMDF and not MAIL_USE_SYSTEM_LOCK */
573 #endif /* ! DISABLE_DIRECT_ACCESS */
578 #ifdef MAIL_USE_MAILLOCK
579 /* This function uses stat to confirm that the mail directory is
580 identical to the directory of the input file, rather than just
581 string-comparing the two paths, because one or both of them might
582 be symbolic links pointing to some other directory. */
584 mail_spool_name (char *inname
)
586 struct stat stat1
, stat2
;
590 if (! (fname
= strrchr (inname
, '/')))
595 if (stat (MAILDIR
, &stat1
) < 0)
598 indir
= xmalloc (fname
- inname
+ 1);
599 memcpy (indir
, inname
, fname
- inname
);
600 indir
[fname
-inname
] = '\0';
603 status
= stat (indir
, &stat2
);
610 if (stat1
.st_dev
== stat2
.st_dev
611 && stat1
.st_ino
== stat2
.st_ino
)
616 #endif /* MAIL_USE_MAILLOCK */
618 /* Print error message and exit. */
621 fatal (const char *s1
, const char *s2
, const char *s3
)
624 unlink (delete_lockname
);
629 /* Print error message. `s1' is printf control string, `s2' and `s3'
630 are args for it or null. */
633 error (const char *s1
, const char *s2
, const char *s3
)
635 fprintf (stderr
, "movemail: ");
637 fprintf (stderr
, s1
, s2
, s3
);
639 fprintf (stderr
, s1
, s2
);
641 fprintf (stderr
, "%s", s1
);
642 fprintf (stderr
, "\n");
646 pfatal_with_name (char *name
)
648 fatal ("%s for %s", strerror (errno
), name
);
652 pfatal_and_delete (char *name
)
654 char *s
= strerror (errno
);
656 fatal ("%s for %s", s
, name
);
659 /* This is the guts of the interface to the Post Office Protocol. */
664 #include <sys/socket.h>
665 #include <netinet/in.h>
677 static char Errmsg
[200]; /* POP errors, at least, can exceed
678 the original length of 80. */
681 * The full valid syntax for a POP mailbox specification for movemail
682 * is "po:username:hostname". The ":hostname" is optional; if it is
683 * omitted, the MAILHOST environment variable will be consulted. Note
684 * that by the time popmail() is called the "po:" has been stripped
685 * off of the front of the mailbox name.
687 * If the mailbox is in the form "po:username:hostname", then it is
688 * modified by this function -- the second colon is replaced by a
691 * Return a value suitable for passing to `exit'.
695 popmail (char *mailbox
, char *outfile
, int preserve
, char *password
, int reverse_order
)
701 char *getenv (const char *);
703 int start
, end
, increment
;
704 char *user
, *hostname
;
707 if ((hostname
= strchr (mailbox
, ':')))
710 server
= pop_open (hostname
, user
, password
, POP_NO_GETPASS
);
713 error ("Error connecting to POP server: %s", pop_error
, 0);
717 if (pop_stat (server
, &nmsgs
, &nbytes
))
719 error ("Error getting message count from POP server: %s", pop_error
, 0);
729 mbfi
= open (outfile
, O_WRONLY
| O_CREAT
| O_EXCL
, 0666);
733 error ("Error in open: %s, %s", strerror (errno
), outfile
);
737 if (fchown (mbfi
, getuid (), -1) != 0)
739 int fchown_errno
= errno
;
741 if (fstat (mbfi
, &st
) != 0 || st
.st_uid
!= getuid ())
744 error ("Error in fchown: %s, %s", strerror (fchown_errno
), outfile
);
749 if ((mbf
= fdopen (mbfi
, "wb")) == NULL
)
752 error ("Error in fdopen: %s", strerror (errno
), 0);
771 for (i
= start
; i
* increment
<= end
* increment
; i
+= increment
)
773 mbx_delimit_begin (mbf
);
774 if (pop_retr (server
, i
, mbf
) != OK
)
776 error ("%s", Errmsg
, 0);
780 mbx_delimit_end (mbf
);
784 error ("Error in fflush: %s", strerror (errno
), 0);
791 /* On AFS, a call to write only modifies the file in the local
792 * workstation's AFS cache. The changes are not written to the server
793 * until a call to fsync or close is made. Users with AFS home
794 * directories have lost mail when over quota because these checks were
795 * not made in previous versions of movemail. */
798 if (fsync (mbfi
) < 0)
800 error ("Error in fsync: %s", strerror (errno
), 0);
805 if (close (mbfi
) == -1)
807 error ("Error in close: %s", strerror (errno
), 0);
812 for (i
= 1; i
<= nmsgs
; i
++)
814 if (pop_delete (server
, i
))
816 error ("Error from POP server: %s", pop_error
, 0);
822 if (pop_quit (server
))
824 error ("Error from POP server: %s", pop_error
, 0);
832 pop_retr (popserver server
, int msgno
, FILE *arg
)
837 if (pop_retrieve_first (server
, msgno
, &line
))
839 snprintf (Errmsg
, sizeof Errmsg
, "Error from POP server: %s", pop_error
);
843 while ((ret
= pop_retrieve_next (server
, &line
)) >= 0)
848 if (mbx_write (line
, ret
, arg
) != OK
)
850 strcpy (Errmsg
, strerror (errno
));
858 snprintf (Errmsg
, sizeof Errmsg
, "Error from POP server: %s", pop_error
);
866 mbx_write (char *line
, int len
, FILE *mbf
)
868 #ifdef MOVEMAIL_QUOTE_POP_FROM_LINES
869 /* Do this as a macro instead of using strcmp to save on execution time. */
870 # define IS_FROM_LINE(a) ((a[0] == 'F') \
875 if (IS_FROM_LINE (line
))
877 if (fputc ('>', mbf
) == EOF
)
881 if (line
[0] == '\037')
883 if (fputs ("^_", mbf
) == EOF
)
888 if (fwrite (line
, 1, len
, mbf
) != len
)
890 if (fputc (0x0a, mbf
) == EOF
)
896 mbx_delimit_begin (FILE *mbf
)
900 char fromline
[40] = "From movemail ";
903 ltime
= localtime (&now
);
905 strcat (fromline
, asctime (ltime
));
907 if (fputs (fromline
, mbf
) == EOF
)
913 mbx_delimit_end (FILE *mbf
)
915 if (putc ('\n', mbf
) == EOF
)
920 #endif /* MAIL_USE_POP */