1 /* Support for extended attributes.
3 Copyright (C) 2006-2022 Free Software Foundation, Inc.
5 This file is part of GNU tar.
7 GNU tar is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 GNU tar is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
20 Written by James Antill, on 2006-07-27. */
31 #include "selinux-at.h"
33 #define XATTRS_PREFIX "SCHILY.xattr."
34 #define XATTRS_PREFIX_LEN (sizeof XATTRS_PREFIX - 1)
37 xheader_xattr_init (struct tar_stat_info
*st
)
39 xattr_map_init (&st
->xattr_map
);
41 st
->acls_a_ptr
= NULL
;
43 st
->acls_d_ptr
= NULL
;
49 xattr_map_init (struct xattr_map
*map
)
51 memset (map
, 0, sizeof *map
);
55 xattr_map_free (struct xattr_map
*xattr_map
)
59 for (i
= 0; i
< xattr_map
->xm_size
; i
++)
61 free (xattr_map
->xm_map
[i
].xkey
);
62 free (xattr_map
->xm_map
[i
].xval_ptr
);
64 free (xattr_map
->xm_map
);
68 xattr_map_add (struct xattr_map
*map
,
69 const char *key
, const char *val
, size_t len
)
71 struct xattr_array
*p
;
73 if (map
->xm_size
== map
->xm_max
)
74 map
->xm_map
= x2nrealloc (map
->xm_map
, &map
->xm_max
,
75 sizeof (map
->xm_map
[0]));
76 p
= &map
->xm_map
[map
->xm_size
];
77 p
->xkey
= xstrdup (key
);
78 p
->xval_ptr
= xmemdup (val
, len
+ 1);
84 xheader_xattr_add (struct tar_stat_info
*st
,
85 const char *key
, const char *val
, size_t len
)
87 size_t klen
= strlen (key
);
88 char *xkey
= xmalloc (XATTRS_PREFIX_LEN
+ klen
+ 1);
91 tmp
= stpcpy (tmp
, XATTRS_PREFIX
);
94 xattr_map_add (&st
->xattr_map
, xkey
, val
, len
);
100 xattr_map_copy (struct xattr_map
*dst
, const struct xattr_map
*src
)
104 for (i
= 0; i
< src
->xm_size
; i
++)
105 xattr_map_add (dst
, src
->xm_map
[i
].xkey
,
106 src
->xm_map
[i
].xval_ptr
,
107 src
->xm_map
[i
].xval_len
);
110 struct xattrs_mask_map
117 /* list of fnmatch patterns */
120 /* lists of fnmatch patterns */
121 struct xattrs_mask_map incl
;
122 struct xattrs_mask_map excl
;
125 /* disable posix acls when problem found in gnulib script m4/acl.m4 */
127 # undef HAVE_POSIX_ACLS
130 #ifdef HAVE_POSIX_ACLS
132 # include <sys/acl.h>
135 #ifdef HAVE_POSIX_ACLS
137 /* acl-at wrappers, TODO: move to gnulib in future? */
138 static acl_t
acl_get_file_at (int, const char *, acl_type_t
);
139 static int acl_set_file_at (int, const char *, acl_type_t
, acl_t
);
140 static int file_has_acl_at (int, char const *, struct stat
const *);
141 static int acl_delete_def_file_at (int, char const *);
143 /* acl_get_file_at */
144 #define AT_FUNC_NAME acl_get_file_at
145 #define AT_FUNC_RESULT acl_t
146 #define AT_FUNC_FAIL (acl_t)NULL
147 #define AT_FUNC_F1 acl_get_file
148 #define AT_FUNC_POST_FILE_PARAM_DECLS , acl_type_t type
149 #define AT_FUNC_POST_FILE_ARGS , type
153 #undef AT_FUNC_RESULT
155 #undef AT_FUNC_POST_FILE_PARAM_DECLS
156 #undef AT_FUNC_POST_FILE_ARGS
158 /* acl_set_file_at */
159 #define AT_FUNC_NAME acl_set_file_at
160 #define AT_FUNC_F1 acl_set_file
161 #define AT_FUNC_POST_FILE_PARAM_DECLS , acl_type_t type, acl_t acl
162 #define AT_FUNC_POST_FILE_ARGS , type, acl
166 #undef AT_FUNC_POST_FILE_PARAM_DECLS
167 #undef AT_FUNC_POST_FILE_ARGS
169 /* acl_delete_def_file_at */
170 #define AT_FUNC_NAME acl_delete_def_file_at
171 #define AT_FUNC_F1 acl_delete_def_file
172 #define AT_FUNC_POST_FILE_PARAM_DECLS
173 #define AT_FUNC_POST_FILE_ARGS
177 #undef AT_FUNC_POST_FILE_PARAM_DECLS
178 #undef AT_FUNC_POST_FILE_ARGS
180 /* gnulib file_has_acl_at */
181 #define AT_FUNC_NAME file_has_acl_at
182 #define AT_FUNC_F1 file_has_acl
183 #define AT_FUNC_POST_FILE_PARAM_DECLS , struct stat const *st
184 #define AT_FUNC_POST_FILE_ARGS , st
188 #undef AT_FUNC_POST_FILE_PARAM_DECLS
189 #undef AT_FUNC_POST_FILE_ARGS
191 /* convert unix permissions into an ACL ... needed due to "default" ACLs */
193 perms2acl (int perms
)
195 char val
[] = "user::---,group::---,other::---";
196 /* 0123456789 123456789 123456789 123456789 */
222 return acl_from_text (val
);
226 skip_to_ext_fields (char *ptr
)
228 /* skip tag name (user/group/default/mask) */
229 ptr
+= strcspn (ptr
, ":,\n");
235 ptr
+= strcspn (ptr
, ":,\n"); /* skip user/group name */
241 ptr
+= strcspn (ptr
, ":,\n"); /* skip perms */
246 /* The POSIX draft allows extra fields after the three main ones. Star
247 uses this to add a fourth field for user/group which is the numeric ID.
248 This function removes such extra fields by overwriting them with the
249 characters that follow. */
251 fixup_extra_acl_fields (char *ptr
)
258 const char *old
= src
;
261 src
= skip_to_ext_fields (src
);
264 memmove (dst
, old
, len
);
267 if (*src
== ':') /* We have extra fields, skip them all */
268 src
+= strcspn (src
, "\n,");
270 if ((*src
== '\n') || (*src
== ','))
271 *dst
++ = *src
++; /* also done when dst == src, but that's ok */
279 /* Set the "system.posix_acl_access/system.posix_acl_default" extended
280 attribute. Called only when acls_option > 0. */
282 xattrs__acls_set (struct tar_stat_info
const *st
,
283 char const *file_name
, int type
,
284 char *ptr
, size_t len
, bool def
)
290 /* assert (strlen (ptr) == len); */
291 ptr
= fixup_extra_acl_fields (ptr
);
292 acl
= acl_from_text (ptr
);
296 /* No "default" IEEE 1003.1e ACL set for directory. At this moment,
297 FILE_NAME may already have inherited default acls from parent
298 directory; clean them up. */
299 if (acl_delete_def_file_at (chdir_fd
, file_name
))
300 WARNOPT (WARN_XATTR_WRITE
,
302 _("acl_delete_def_file_at: Cannot drop default POSIX ACLs "
308 acl
= perms2acl (st
->stat
.st_mode
);
312 call_arg_warn ("acl_from_text", file_name
);
316 if (acl_set_file_at (chdir_fd
, file_name
, type
, acl
) == -1)
317 /* warn even if filesystem does not support acls */
318 WARNOPT (WARN_XATTR_WRITE
,
320 _ ("acl_set_file_at: Cannot set POSIX ACLs for file '%s'"),
326 /* Cleanup textual representation of the ACL in VAL by eliminating tab
327 characters and comments */
329 xattrs_acls_cleanup (char *val
, size_t *plen
)
333 p
= q
= val
+ strcspn (val
, "#\t");
351 xattrs__acls_get_a (int parentfd
, const char *file_name
,
352 struct tar_stat_info
*st
,
353 char **ret_ptr
, size_t * ret_len
)
358 if (!(acl
= acl_get_file_at (parentfd
, file_name
, ACL_TYPE_ACCESS
)))
360 if (errno
!= ENOTSUP
)
361 call_arg_warn ("acl_get_file_at", file_name
);
365 val
= acl_to_text (acl
, NULL
);
370 call_arg_warn ("acl_to_text", file_name
);
374 *ret_ptr
= xstrdup (val
);
375 xattrs_acls_cleanup (*ret_ptr
, ret_len
);
379 /* "system.posix_acl_default" */
381 xattrs__acls_get_d (int parentfd
, char const *file_name
,
382 struct tar_stat_info
*st
,
383 char **ret_ptr
, size_t * ret_len
)
388 if (!(acl
= acl_get_file_at (parentfd
, file_name
, ACL_TYPE_DEFAULT
)))
390 if (errno
!= ENOTSUP
)
391 call_arg_warn ("acl_get_file_at", file_name
);
395 val
= acl_to_text (acl
, NULL
);
400 call_arg_warn ("acl_to_text", file_name
);
404 *ret_ptr
= xstrdup (val
);
405 xattrs_acls_cleanup (*ret_ptr
, ret_len
);
408 #endif /* HAVE_POSIX_ACLS */
411 acls_one_line (const char *prefix
, char delim
,
412 const char *aclstring
, size_t len
)
414 /* support both long and short text representation of posix acls */
416 int pref_len
= strlen (prefix
);
417 const char *oldstring
= aclstring
;
420 if (!aclstring
|| !len
)
426 int move
= strcspn (aclstring
, ",\n");
430 if (oldstring
!= aclstring
)
431 obstack_1grow (&stk
, delim
);
433 obstack_grow (&stk
, prefix
, pref_len
);
434 obstack_grow (&stk
, aclstring
, move
);
437 aclstring
+= move
+ 1;
440 obstack_1grow (&stk
, '\0');
442 fprintf (stdlis
, "%s", (char *) obstack_finish (&stk
));
444 obstack_free (&stk
, NULL
);
448 xattrs_acls_get (int parentfd
, char const *file_name
,
449 struct tar_stat_info
*st
, int fd
, int xisfile
)
453 #ifndef HAVE_POSIX_ACLS
456 WARN ((0, 0, _("POSIX ACL support is not available")));
459 int err
= file_has_acl_at (parentfd
, file_name
, &st
->stat
);
464 call_arg_warn ("file_has_acl_at", file_name
);
468 xattrs__acls_get_a (parentfd
, file_name
, st
,
469 &st
->acls_a_ptr
, &st
->acls_a_len
);
471 xattrs__acls_get_d (parentfd
, file_name
, st
,
472 &st
->acls_d_ptr
, &st
->acls_d_len
);
478 xattrs_acls_set (struct tar_stat_info
const *st
,
479 char const *file_name
, char typeflag
)
481 if (acls_option
> 0 && typeflag
!= SYMTYPE
)
483 #ifndef HAVE_POSIX_ACLS
486 WARN ((0, 0, _("POSIX ACL support is not available")));
489 xattrs__acls_set (st
, file_name
, ACL_TYPE_ACCESS
,
490 st
->acls_a_ptr
, st
->acls_a_len
, false);
491 if (typeflag
== DIRTYPE
|| typeflag
== GNUTYPE_DUMPDIR
)
492 xattrs__acls_set (st
, file_name
, ACL_TYPE_DEFAULT
,
493 st
->acls_d_ptr
, st
->acls_d_len
, true);
499 mask_map_realloc (struct xattrs_mask_map
*map
)
501 if (map
->used
== map
->size
)
505 map
->masks
= x2nrealloc (map
->masks
, &map
->size
, sizeof (map
->masks
[0]));
510 xattrs_mask_add (const char *mask
, bool incl
)
512 struct xattrs_mask_map
*mask_map
=
513 incl
? &xattrs_setup
.incl
: &xattrs_setup
.excl
;
514 /* ensure there is enough space */
515 mask_map_realloc (mask_map
);
516 /* just assign pointers -- we silently expect that pointer "mask" is valid
517 through the whole program (pointer to argv array) */
518 mask_map
->masks
[mask_map
->used
++] = mask
;
522 clear_mask_map (struct xattrs_mask_map
*mask_map
)
525 free (mask_map
->masks
);
529 xattrs_clear_setup (void)
531 clear_mask_map (&xattrs_setup
.incl
);
532 clear_mask_map (&xattrs_setup
.excl
);
535 static bool xattrs_masked_out (const char *kw
, bool archiving
);
537 /* get xattrs from file given by FILE_NAME or FD (when non-zero)
538 xattrs are checked against the user supplied include/exclude mask
539 if no mask is given this includes all the user.*, security.*, system.*,
540 etc. available domains */
542 xattrs_xattrs_get (int parentfd
, char const *file_name
,
543 struct tar_stat_info
*st
, int fd
)
545 if (xattrs_option
> 0)
550 WARN ((0, 0, _("XATTR support is not available")));
553 static size_t xsz
= 1024;
554 static char *xatrs
= NULL
;
558 xatrs
= x2nrealloc (xatrs
, &xsz
, 1);
562 llistxattrat (parentfd
, file_name
, xatrs
, xsz
)) == -1) :
563 ((xret
= flistxattr (fd
, xatrs
, xsz
)) == -1))
564 && (errno
== ERANGE
))
566 xatrs
= x2nrealloc (xatrs
, &xsz
, 1);
570 call_arg_warn ((fd
== 0) ? "llistxattrat" : "flistxattr", file_name
);
573 const char *attr
= xatrs
;
574 static size_t asz
= 1024;
575 static char *val
= NULL
;
578 val
= x2nrealloc (val
, &asz
, 1);
582 size_t len
= strlen (attr
);
586 ? ((aret
= lgetxattrat (parentfd
, file_name
, attr
,
588 : ((aret
= fgetxattr (fd
, attr
, val
, asz
)) == -1))
589 && (errno
== ERANGE
))
591 val
= x2nrealloc (val
, &asz
, 1);
596 if (!xattrs_masked_out (attr
, true))
597 xheader_xattr_add (st
, attr
, val
, aret
);
599 else if (errno
!= ENOATTR
)
600 call_arg_warn ((fd
== 0) ? "lgetxattrat"
601 : "fgetxattr", file_name
);
613 xattrs__fd_set (struct tar_stat_info
const *st
,
614 char const *file_name
, char typeflag
,
615 const char *attr
, const char *ptr
, size_t len
)
619 const char *sysname
= "setxattrat";
622 if (typeflag
!= SYMTYPE
)
623 ret
= setxattrat (chdir_fd
, file_name
, attr
, ptr
, len
, 0);
626 sysname
= "lsetxattr";
627 ret
= lsetxattrat (chdir_fd
, file_name
, attr
, ptr
, len
, 0);
631 WARNOPT (WARN_XATTR_WRITE
,
633 _("%s: Cannot set '%s' extended attribute for file '%s'"),
634 sysname
, attr
, file_name
));
639 /* lgetfileconat is called against FILE_NAME iff the FD parameter is set to
640 zero, otherwise the fgetfileconat is used against correct file descriptor */
642 xattrs_selinux_get (int parentfd
, char const *file_name
,
643 struct tar_stat_info
*st
, int fd
)
645 if (selinux_context_option
> 0)
647 #if HAVE_SELINUX_SELINUX_H != 1
650 WARN ((0, 0, _("SELinux support is not available")));
654 fgetfilecon (fd
, &st
->cntx_name
)
655 : lgetfileconat (parentfd
, file_name
, &st
->cntx_name
);
657 if (result
== -1 && errno
!= ENODATA
&& errno
!= ENOTSUP
)
658 call_arg_warn (fd
? "fgetfilecon" : "lgetfileconat", file_name
);
664 xattrs_selinux_set (struct tar_stat_info
const *st
,
665 char const *file_name
, char typeflag
)
667 if (selinux_context_option
> 0)
669 #if HAVE_SELINUX_SELINUX_H != 1
672 WARN ((0, 0, _("SELinux support is not available")));
675 const char *sysname
= "setfilecon";
681 if (typeflag
!= SYMTYPE
)
683 ret
= setfileconat (chdir_fd
, file_name
, st
->cntx_name
);
684 sysname
= "setfileconat";
688 ret
= lsetfileconat (chdir_fd
, file_name
, st
->cntx_name
);
689 sysname
= "lsetfileconat";
693 WARNOPT (WARN_XATTR_WRITE
,
695 _("%s: Cannot set SELinux context for file '%s'"),
696 sysname
, file_name
));
702 xattrs_matches_mask (const char *kw
, struct xattrs_mask_map
*mm
)
709 for (i
= 0; i
< mm
->used
; i
++)
710 if (fnmatch (mm
->masks
[i
], kw
, 0) == 0)
716 #define USER_DOT_PFX "user."
719 xattrs_kw_included (const char *kw
, bool archiving
)
721 if (xattrs_setup
.incl
.size
)
722 return xattrs_matches_mask (kw
, &xattrs_setup
.incl
);
726 return strncmp (kw
, USER_DOT_PFX
, sizeof (USER_DOT_PFX
) - 1) == 0;
730 xattrs_kw_excluded (const char *kw
, bool archiving
)
732 return xattrs_setup
.excl
.size
?
733 xattrs_matches_mask (kw
, &xattrs_setup
.excl
) : false;
736 /* Check whether the xattr with keyword KW should be discarded from list of
737 attributes that are going to be archived/excluded (set ARCHIVING=true for
738 archiving, false for excluding) */
740 xattrs_masked_out (const char *kw
, bool archiving
)
742 return xattrs_kw_included (kw
, archiving
) ?
743 xattrs_kw_excluded (kw
, archiving
) : true;
747 xattrs_xattrs_set (struct tar_stat_info
const *st
,
748 char const *file_name
, char typeflag
, int later_run
)
750 if (xattrs_option
> 0)
755 WARN ((0, 0, _("XATTR support is not available")));
760 if (!st
->xattr_map
.xm_size
)
763 for (i
= 0; i
< st
->xattr_map
.xm_size
; i
++)
765 char *keyword
= st
->xattr_map
.xm_map
[i
].xkey
+ XATTRS_PREFIX_LEN
;
767 /* TODO: this 'later_run' workaround is temporary solution -> once
768 capabilities should become fully supported by it's API and there
769 should exist something like xattrs_capabilities_set() call.
770 For a regular files: all extended attributes are restored during
771 the first run except 'security.capability' which is restored in
773 if (typeflag
== REGTYPE
774 && later_run
== !!strcmp (keyword
, "security.capability"))
777 if (xattrs_masked_out (keyword
, false /* extracting */ ))
778 /* we don't want to restore this keyword */
781 xattrs__fd_set (st
, file_name
, typeflag
, keyword
,
782 st
->xattr_map
.xm_map
[i
].xval_ptr
,
783 st
->xattr_map
.xm_map
[i
].xval_len
);
790 xattrs_print_char (struct tar_stat_info
const *st
, char *output
)
794 if (verbose_option
< 2)
800 if (xattrs_option
> 0 || selinux_context_option
> 0 || acls_option
> 0)
807 if (xattrs_option
> 0 && st
->xattr_map
.xm_size
)
808 for (i
= 0; i
< st
->xattr_map
.xm_size
; ++i
)
810 char *keyword
= st
->xattr_map
.xm_map
[i
].xkey
+ XATTRS_PREFIX_LEN
;
811 if (!xattrs_masked_out (keyword
, false /* like extracting */ ))
818 if (selinux_context_option
> 0 && st
->cntx_name
)
821 if (acls_option
> 0 && (st
->acls_a_len
|| st
->acls_d_len
))
826 xattrs_print (struct tar_stat_info
const *st
)
828 if (verbose_option
< 3)
832 if (selinux_context_option
> 0 && st
->cntx_name
)
833 fprintf (stdlis
, " s: %s\n", st
->cntx_name
);
836 if (acls_option
> 0 && (st
->acls_a_len
|| st
->acls_d_len
))
838 fprintf (stdlis
, " a: ");
839 acls_one_line ("", ',', st
->acls_a_ptr
, st
->acls_a_len
);
840 if (st
->acls_a_len
&& st
->acls_d_len
)
841 fprintf (stdlis
, ",");
842 acls_one_line ("default:", ',', st
->acls_d_ptr
, st
->acls_d_len
);
843 fprintf (stdlis
, "\n");
847 if (xattrs_option
> 0 && st
->xattr_map
.xm_size
)
851 for (i
= 0; i
< st
->xattr_map
.xm_size
; ++i
)
853 char *keyword
= st
->xattr_map
.xm_map
[i
].xkey
+ XATTRS_PREFIX_LEN
;
854 if (!xattrs_masked_out (keyword
, false /* like extracting */ ))
855 fprintf (stdlis
, " x: %lu %s\n",
856 (unsigned long) st
->xattr_map
.xm_map
[i
].xval_len
, keyword
);