dotlock.c

   1 /*@ S-nail - a mail user agent derived from Berkeley Mail.
   2  *@ Mailbox file locking.
   3  *
   4  * Copyright (c) 2000-2004 Gunnar Ritter, Freiburg i. Br., Germany.
   5  * Copyright (c) 2012 - 2014 Steffen (Daode) Nurpmeso <sdaoden@users.sf.net>.
   6  */
   7 /*
   8  * Copyright (c) 1996 Christos Zoulas.  All rights reserved.
   9  *
  10  * Redistribution and use in source and binary forms, with or without
  11  * modification, are permitted provided that the following conditions
  12  * are met:
  13  * 1. Redistributions of source code must retain the above copyright
  14  *    notice, this list of conditions and the following disclaimer.
  15  * 2. Redistributions in binary form must reproduce the above copyright
  16  *    notice, this list of conditions and the following disclaimer in the
  17  *    documentation and/or other materials provided with the distribution.
  18  * 3. All advertising materials mentioning features or use of this software
  19  *    must display the following acknowledgement:
  20  *    This product includes software developed by Christos Zoulas.
  21  * 4. The name of the author may not be used to endorse or promote products
  22  *    derived from this software without specific prior written permission.
  23  *
  24  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
  25  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
  26  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
  27  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
  28  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
  29  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  30  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  31  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  32  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
  33  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  34  */
  35
  36 #ifndef HAVE_AMALGAMATION
  37 # include "nail.h"
  38 #endif
  39
  40 #include <sys/utsname.h>
  41
  42 #include <fcntl.h>
  43
  44 #define APID_SZ         40 /* sufficient for 128 bits pids XXX nail.h */
  45 #define CREATE_RETRIES  5  /* XXX nail.h */
  46 #define DOTLOCK_RETRIES 15 /* XXX nail.h */
  47
  48 #ifdef O_SYNC
  49 # define O_BITS         (O_WRONLY | O_CREAT | O_TRUNC | O_EXCL | O_SYNC)
  50 #else
  51 # define O_BITS         (O_WRONLY | O_CREAT | O_TRUNC | O_EXCL)
  52 #endif
  53
  54 /* TODO Allow safe setgid, optional: check on startup wether in receive mode,
  55  * TODO start helper process that is setgid and only does dotlocking.
  56  * TODO Approach two, also optional: use a configurable setgid dotlock prog */
  57 #define GID_MAYBESET(P) \
  58 do if (realgid != effectivegid && !_maybe_setgid(P, effectivegid)) {\
  59    perror("setgid");\
  60    exit(1);\
  61 } while (0)
  62
  63 #define GID_RESET() \
  64 do if (realgid != effectivegid && setgid(realgid) == -1) {\
  65    perror("setgid");\
  66    exit(1);\
  67 } while (0)
  68
  69 /* GID_*() helper: set the gid if the path is in the normal mail spool */
  70 static bool_t  _maybe_setgid(char const *name, gid_t gid);
  71
  72 /* Check if we can write a lock file at all */
  73 static int     maildir_access(char const *fname);
  74
  75 /* Create a unique file. O_EXCL does not really work over NFS so we follow
  76  * the following trick (inspired by  S.R. van den Berg):
  77  * - make a mostly unique filename and try to create it
  78  * - link the unique filename to our target
  79  * - get the link count of the target
  80  * - unlink the mostly unique filename
  81  * - if the link count was 2, then we are ok; else we've failed */
  82 static int     create_exclusive(char const *fname);
  83
  84 static bool_t
  85 _maybe_setgid(char const *name, gid_t gid)
  86 {
  87    char const safepath[] = MAILSPOOL;
  88    bool_t rv;
  89    NYD_ENTER;
  90
  91    if (strncmp(name, safepath, sizeof(safepath) -1) ||
  92          strchr(name + sizeof(safepath), '/') != NULL)
  93       rv = TRU1;
  94    else
  95       rv = (setgid(gid) != -1);
  96    NYD_LEAVE;
  97    return rv;
  98 }
  99
 100 static int
 101 maildir_access(char const *fname)
 102 {
 103    char *path, *p;
 104    int i;
 105    NYD_ENTER;
 106
 107    i = (int)strlen(fname);
 108    path = ac_alloc(i + 1 +1);
 109    memcpy(path, fname, i +1);
 110    p = strrchr(path, '/');
 111    if (p != NULL)
 112       *p = '\0';
 113    if (p == NULL || *path == '\0') {
 114       path[0] = '.';
 115       path[1] = '\0';
 116    }
 117    i = access(path, R_OK | W_OK | X_OK);
 118    ac_free(path);
 119    NYD_LEAVE;
 120    return i;
 121 }
 122
 123 static int
 124 create_exclusive(char const *fname) /* TODO revisit! */
 125 {
 126    char path[PATH_MAX], apid[APID_SZ], *hostname;
 127    struct stat st;
 128    struct utsname ut;
 129    char const *ptr;
 130    time_t t;
 131    size_t ntries;
 132    int pid, fd, serrno, cc;
 133    NYD_ENTER;
 134
 135    time(&t);
 136    uname(&ut);
 137    hostname = ut.nodename;
 138    pid = (int)getpid();
 139
 140    /* We generate a semi-unique filename, from hostname.(pid ^ usec) */
 141    if ((ptr = strrchr(fname, '/')) == NULL)
 142       ptr = fname;
 143    else
 144       ++ptr;
 145
 146    snprintf(path, sizeof path, "%.*s.%s.%x",
 147        (int)PTR2SIZE(ptr - fname), fname, hostname, (pid ^ (int)t));
 148
 149    /* We try to create the unique filename */
 150    for (ntries = 0; ntries < CREATE_RETRIES; ++ntries) {
 151       GID_MAYBESET(path);
 152       fd = open(path, O_BITS, 0);
 153       serrno = errno;
 154       GID_RESET();
 155       if (fd != -1) {
 156          snprintf(apid, APID_SZ, "%d", pid);
 157          write(fd, apid, strlen(apid));
 158          close(fd);
 159          break;
 160       } else if (serrno != EEXIST) {
 161          serrno = -1;
 162          goto jleave;
 163       }
 164    }
 165
 166    /* We link the path to the name */
 167    GID_MAYBESET(fname);
 168    cc = link(path, fname);
 169    serrno = errno;
 170    GID_RESET();
 171    if (cc == -1)
 172       goto jbad;
 173
 174    /* Note that we stat our own exclusively created name, not the
 175     * destination, since the destination can be affected by others */
 176    if (stat(path, &st) == -1) {
 177       serrno = errno;
 178       goto jbad;
 179    }
 180
 181    GID_MAYBESET(fname);
 182    unlink(path);
 183    GID_RESET();
 184
 185    /* If the number of links was two (one for the unique file and one for
 186     * the lock), we've won the race */
 187    if (st.st_nlink != 2) {
 188       errno = EEXIST;
 189       serrno = -1;
 190       goto jleave;
 191    }
 192    serrno = 0;
 193 jleave:
 194    NYD_LEAVE;
 195    return serrno;
 196 jbad:
 197    unlink(path);
 198    errno = serrno;
 199    serrno = -1;
 200    goto jleave;
 201 }
 202
 203 FL int
 204 fcntl_lock(int fd, enum flock_type ft) /* TODO check callees */
 205 {
 206    struct flock flp;
 207    int rv;
 208    NYD_ENTER;
 209
 210    switch (ft) {
 211    case FLOCK_READ:     rv = F_RDLCK;  break;
 212    case FLOCK_WRITE:    rv = F_WRLCK;  break;
 213    default:
 214    case FLOCK_UNLOCK:   rv = F_UNLCK;  break;
 215    }
 216
 217    flp.l_type = rv;
 218    flp.l_start = 0;
 219    flp.l_whence = SEEK_SET;
 220    flp.l_len = 0;
 221    rv = fcntl(fd, F_SETLKW, &flp);
 222    NYD_LEAVE;
 223    return rv;
 224 }
 225
 226 FL int
 227 dot_lock(char const *fname, int fd, int pollival, FILE *fp, char const *msg)
 228 {
 229    char path[PATH_MAX];
 230    sigset_t nset, oset;
 231    int i, olderrno, rv;
 232    NYD_ENTER;
 233
 234    rv = 0;
 235    if (maildir_access(fname) != 0)
 236       goto jleave;
 237    rv = -1;
 238
 239    sigemptyset(&nset);
 240    sigaddset(&nset, SIGHUP);
 241    sigaddset(&nset, SIGINT);
 242    sigaddset(&nset, SIGQUIT);
 243    sigaddset(&nset, SIGTERM);
 244    sigaddset(&nset, SIGTTIN);
 245    sigaddset(&nset, SIGTTOU);
 246    sigaddset(&nset, SIGTSTP);
 247    sigaddset(&nset, SIGCHLD);
 248
 249    snprintf(path, sizeof(path), "%s.lock", fname);
 250
 251    for (i = 0; i < DOTLOCK_RETRIES; ++i) {
 252       sigprocmask(SIG_BLOCK, &nset, &oset);
 253       rv = create_exclusive(path);
 254       olderrno = errno;
 255       sigprocmask(SIG_SETMASK, &oset, NULL);
 256       if (!rv)
 257          goto jleave;
 258       assert(rv == -1);
 259
 260       fcntl_lock(fd, FLOCK_UNLOCK);
 261       if (olderrno != EEXIST)
 262          goto jleave;
 263
 264       if (fp != NULL && msg != NULL)
 265           fputs(msg, fp);
 266
 267       if (pollival) {
 268          if (pollival == -1) {
 269             errno = EEXIST;
 270             goto jleave;
 271          }
 272          sleep(pollival);
 273       }
 274       fcntl_lock(fd, FLOCK_WRITE);
 275    }
 276    fprintf(stderr, _(
 277       "%s seems a stale lock? Need to be removed by hand?\n"), path);
 278 jleave:
 279    NYD_LEAVE;
 280    return rv;
 281 }
 282
 283 FL void
 284 dot_unlock(char const *fname)
 285 {
 286    char path[PATH_MAX];
 287    NYD_ENTER;
 288
 289    if (maildir_access(fname) != 0)
 290       goto jleave;
 291
 292    snprintf(path, sizeof(path), "%s.lock", fname);
 293    GID_MAYBESET(path);
 294    unlink(path);
 295    GID_RESET();
 296 jleave:
 297    NYD_LEAVE;
 298 }
 299
 300 /* vim:set fenc=utf-8:s-it-mode */