hw/9pfs/9p-util.h

   1 /*
   2  * 9p utilities
   3  *
   4  * Copyright IBM, Corp. 2017
   5  *
   6  * Authors:
   7  *  Greg Kurz <groug@kaod.org>
   8  *
   9  * This work is licensed under the terms of the GNU GPL, version 2 or later.
  10  * See the COPYING file in the top-level directory.
  11  */
  12
  13 #ifndef QEMU_9P_UTIL_H
  14 #define QEMU_9P_UTIL_H
  15
  16 #include "qemu/error-report.h"
  17
  18 #ifdef O_PATH
  19 #define O_PATH_9P_UTIL O_PATH
  20 #else
  21 #define O_PATH_9P_UTIL 0
  22 #endif
  23
  24 #if !defined(CONFIG_LINUX)
  25
  26 /*
  27  * Generates a Linux device number (a.k.a. dev_t) for given device major
  28  * and minor numbers.
  29  *
  30  * To be more precise: it generates a device number in glibc's format
  31  * (MMMM_Mmmm_mmmM_MMmm, 64 bits) actually, which is compatible with
  32  * Linux's format (mmmM_MMmm, 32 bits), as described in <bits/sysmacros.h>.
  33  */
  34 static inline uint64_t makedev_dotl(uint32_t dev_major, uint32_t dev_minor)
  35 {
  36     uint64_t dev;
  37
  38     // from glibc sysmacros.h:
  39     dev  = (((uint64_t) (dev_major & 0x00000fffu)) <<  8);
  40     dev |= (((uint64_t) (dev_major & 0xfffff000u)) << 32);
  41     dev |= (((uint64_t) (dev_minor & 0x000000ffu)) <<  0);
  42     dev |= (((uint64_t) (dev_minor & 0xffffff00u)) << 12);
  43     return dev;
  44 }
  45
  46 #endif
  47
  48 /*
  49  * Converts given device number from host's device number format to Linux
  50  * device number format. As both the size of type dev_t and encoding of
  51  * dev_t is system dependent, we have to convert them for Linux guests if
  52  * host is not running Linux.
  53  */
  54 static inline uint64_t host_dev_to_dotl_dev(dev_t dev)
  55 {
  56 #ifdef CONFIG_LINUX
  57     return dev;
  58 #else
  59     return makedev_dotl(major(dev), minor(dev));
  60 #endif
  61 }
  62
  63 /* Translates errno from host -> Linux if needed */
  64 static inline int errno_to_dotl(int err) {
  65 #if defined(CONFIG_LINUX)
  66     /* nothing to translate (Linux -> Linux) */
  67 #elif defined(CONFIG_DARWIN)
  68     /*
  69      * translation mandatory for macOS hosts
  70      *
  71      * FIXME: Only most important errnos translated here yet, this should be
  72      * extended to as many errnos being translated as possible in future.
  73      */
  74     if (err == ENAMETOOLONG) {
  75         err = 36; /* ==ENAMETOOLONG on Linux */
  76     } else if (err == ENOTEMPTY) {
  77         err = 39; /* ==ENOTEMPTY on Linux */
  78     } else if (err == ELOOP) {
  79         err = 40; /* ==ELOOP on Linux */
  80     } else if (err == ENOATTR) {
  81         err = 61; /* ==ENODATA on Linux */
  82     } else if (err == ENOTSUP) {
  83         err = 95; /* ==EOPNOTSUPP on Linux */
  84     } else if (err == EOPNOTSUPP) {
  85         err = 95; /* ==EOPNOTSUPP on Linux */
  86     }
  87 #else
  88 #error Missing errno translation to Linux for this host system
  89 #endif
  90     return err;
  91 }
  92
  93 #ifdef CONFIG_DARWIN
  94 #define qemu_fgetxattr(...) fgetxattr(__VA_ARGS__, 0, 0)
  95 #else
  96 #define qemu_fgetxattr fgetxattr
  97 #endif
  98
  99 #define qemu_openat     openat
 100 #define qemu_fstat      fstat
 101 #define qemu_fstatat    fstatat
 102 #define qemu_mkdirat    mkdirat
 103 #define qemu_renameat   renameat
 104 #define qemu_utimensat  utimensat
 105 #define qemu_unlinkat   unlinkat
 106
 107 static inline void close_preserve_errno(int fd)
 108 {
 109     int serrno = errno;
 110     close(fd);
 111     errno = serrno;
 112 }
 113
 114 /**
 115  * close_if_special_file() - Close @fd if neither regular file nor directory.
 116  *
 117  * @fd: file descriptor of open file
 118  * Return: 0 on regular file or directory, -1 otherwise
 119  *
 120  * CVE-2023-2861: Prohibit opening any special file directly on host
 121  * (especially device files), as a compromised client could potentially gain
 122  * access outside exported tree under certain, unsafe setups. We expect
 123  * client to handle I/O on special files exclusively on guest side.
 124  */
 125 static inline int close_if_special_file(int fd)
 126 {
 127     struct stat stbuf;
 128
 129     if (qemu_fstat(fd, &stbuf) < 0) {
 130         close_preserve_errno(fd);
 131         return -1;
 132     }
 133     if (!S_ISREG(stbuf.st_mode) && !S_ISDIR(stbuf.st_mode)) {
 134         error_report_once(
 135             "9p: broken or compromised client detected; attempt to open "
 136             "special file (i.e. neither regular file, nor directory)"
 137         );
 138         close(fd);
 139         errno = ENXIO;
 140         return -1;
 141     }
 142
 143     return 0;
 144 }
 145
 146 static inline int openat_dir(int dirfd, const char *name)
 147 {
 148     return qemu_openat(dirfd, name,
 149                        O_DIRECTORY | O_RDONLY | O_NOFOLLOW | O_PATH_9P_UTIL);
 150 }
 151
 152 static inline int openat_file(int dirfd, const char *name, int flags,
 153                               mode_t mode)
 154 {
 155     int fd, serrno, ret;
 156
 157 #ifndef CONFIG_DARWIN
 158 again:
 159 #endif
 160     fd = qemu_openat(dirfd, name, flags | O_NOFOLLOW | O_NOCTTY | O_NONBLOCK,
 161                      mode);
 162     if (fd == -1) {
 163 #ifndef CONFIG_DARWIN
 164         if (errno == EPERM && (flags & O_NOATIME)) {
 165             /*
 166              * The client passed O_NOATIME but we lack permissions to honor it.
 167              * Rather than failing the open, fall back without O_NOATIME. This
 168              * doesn't break the semantics on the client side, as the Linux
 169              * open(2) man page notes that O_NOATIME "may not be effective on
 170              * all filesystems". In particular, NFS and other network
 171              * filesystems ignore it entirely.
 172              */
 173             flags &= ~O_NOATIME;
 174             goto again;
 175         }
 176 #endif
 177         return -1;
 178     }
 179
 180     if (close_if_special_file(fd) < 0) {
 181         return -1;
 182     }
 183
 184     serrno = errno;
 185     /* O_NONBLOCK was only needed to open the file. Let's drop it. We don't
 186      * do that with O_PATH since fcntl(F_SETFL) isn't supported, and openat()
 187      * ignored it anyway.
 188      */
 189     if (!(flags & O_PATH_9P_UTIL)) {
 190         ret = fcntl(fd, F_SETFL, flags);
 191         assert(!ret);
 192     }
 193     errno = serrno;
 194     return fd;
 195 }
 196
 197 ssize_t fgetxattrat_nofollow(int dirfd, const char *path, const char *name,
 198                              void *value, size_t size);
 199 int fsetxattrat_nofollow(int dirfd, const char *path, const char *name,
 200                          void *value, size_t size, int flags);
 201 ssize_t flistxattrat_nofollow(int dirfd, const char *filename,
 202                               char *list, size_t size);
 203 ssize_t fremovexattrat_nofollow(int dirfd, const char *filename,
 204                                 const char *name);
 205
 206 /*
 207  * Darwin has d_seekoff, which appears to function similarly to d_off.
 208  * However, it does not appear to be supported on all file systems,
 209  * so ensure it is manually injected earlier and call here when
 210  * needed.
 211  */
 212 static inline off_t qemu_dirent_off(struct dirent *dent)
 213 {
 214 #ifdef CONFIG_DARWIN
 215     return dent->d_seekoff;
 216 #else
 217     return dent->d_off;
 218 #endif
 219 }
 220
 221 /**
 222  * qemu_dirent_dup() - Duplicate directory entry @dent.
 223  *
 224  * @dent: original directory entry to be duplicated
 225  * Return: duplicated directory entry which should be freed with g_free()
 226  *
 227  * It is highly recommended to use this function instead of open coding
 228  * duplication of dirent objects, because the actual struct dirent
 229  * size may be bigger or shorter than sizeof(struct dirent) and correct
 230  * handling is platform specific (see gitlab issue #841).
 231  */
 232 static inline struct dirent *qemu_dirent_dup(struct dirent *dent)
 233 {
 234     size_t sz = 0;
 235 #if defined _DIRENT_HAVE_D_RECLEN
 236     /* Avoid use of strlen() if platform supports d_reclen. */
 237     sz = dent->d_reclen;
 238 #endif
 239     /*
 240      * Test sz for zero even if d_reclen is available
 241      * because some drivers may set d_reclen to zero.
 242      */
 243     if (sz == 0) {
 244         /* Fallback to the most portable way. */
 245         sz = offsetof(struct dirent, d_name) +
 246                       strlen(dent->d_name) + 1;
 247     }
 248     return g_memdup(dent, sz);
 249 }
 250
 251 /*
 252  * As long as mknodat is not available on macOS, this workaround
 253  * using pthread_fchdir_np is needed. qemu_mknodat is defined in
 254  * os-posix.c. pthread_fchdir_np is weakly linked here as a guard
 255  * in case it disappears in future macOS versions, because it is
 256  * is a private API.
 257  */
 258 #if defined CONFIG_DARWIN && defined CONFIG_PTHREAD_FCHDIR_NP
 259 int pthread_fchdir_np(int fd) __attribute__((weak_import));
 260 #endif
 261 int qemu_mknodat(int dirfd, const char *filename, mode_t mode, dev_t dev);
 262
 263 #endif