source: trunk/athena/lib/locker/mountpoint.c @ 13522

/* Copyright 1998 by the Massachusetts Institute of Technology.
 *
 * Permission to use, copy, modify, and distribute this
 * software and its documentation for any purpose and without
 * fee is hereby granted, provided that the above copyright
 * notice appear in all copies and that both that copyright
 * notice and this permission notice appear in supporting
 * documentation, and that the name of M.I.T. not be used in
 * advertising or publicity pertaining to distribution of the
 * software without specific, written prior permission.
 * M.I.T. makes no representations about the suitability of
 * this software for any purpose.  It is provided "as is"
 * without express or implied warranty.
 */

/* This file is part of liblocker. It deals with canonicalizing and
 * creating mountpoints, and the associated security issues.
 */

static const char rcsid[] = "$Id: mountpoint.c,v 1.6 1999-08-19 18:38:59 ghudson Exp $";

#include <sys/stat.h>
#include <errno.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

#include "locker.h"
#include "locker_private.h"

/* Include <sys/param.h> for MAXPATHLEN (and MAXSYMLINKS). We assume
 * that if some future OS doesn't have a maximum path length then
 * they'll also provide replacements for getcwd() and readlink() that
 * don't require the caller to guess how large a buffer to provide.
 */
#include <sys/param.h>

#define MODE_MASK (S_IRWXU | S_IRWXG | S_IRWXO)
#define LOCKER_DIR_MODE (S_IRWXU | S_IRGRP | S_IXGRP | S_IROTH | S_IXOTH)
#define BAD_MODE_BITS (S_IWGRP | S_IWOTH)

static int mountpoint_mkdir(locker_context context, locker_attachent *at,
                            char *path);
static int mountpoint_rmdir(locker_context context, locker_attachent *at,
                            char *path);

static int get_dirlock(locker_context context, locker_attachent *at,
                       int type);
static void release_dirlock(locker_context context, locker_attachent *at);

/* Canonicalize a path and optionally make sure that it doesn't pass
 * through any mountpoints or user-writable directories.  *pathp must
 * contain an allocated string, which may be freed and replaced with
 * another allocated string containing the canonicalized path.  If
 * buildfromp is not NULL, *buildfromp is set to an allocated string
 * containing the first ancestor directory of the canonicalized path
 * which doesn't exist, or to NULL if the canonicalized path already
 * exists.
 */
int locker__canonicalize_path(locker_context context, int check,
                              char **pathp, char **buildfromp)
{
  char *path, *buildfrom = NULL, *cur, *end, *p;
  struct stat st;
  int nlinks = 0, status = 0;
  dev_t last_dev = 0;
  uid_t uid = geteuid();

  path = *pathp;

  /* If it doesn't start with '/', prepend cwd. */
  if (path[0] != '/')
    {
      char cwdbuf[MAXPATHLEN], *newpath;

      if (!getcwd(cwdbuf, sizeof(cwdbuf)))
        {
          locker__error(context, "Could not retrieve current working "
                        "directory:\n%s.\n", strerror(errno));
          free(path);
          return LOCKER_EBADPATH;
        }
      if (!strcmp(cwdbuf, "/"))
        *cwdbuf = '\0';         /* Avoid generating "//foo". */

      newpath = malloc(strlen(cwdbuf) + strlen(path) + 2);
      if (!newpath)
        {
          free(path);
          locker__error(context, "Out of memory canonicalizing mountpoint.\n");
          return LOCKER_ENOMEM;
        }

      sprintf(newpath, "%s/%s", cwdbuf, path);
      free(path);
      path = newpath;

      /* Don't need to canonicalize cwd part, so skip that. */
      cur = path + strlen(cwdbuf) + 1;
    }
  else
    cur = path + 1;

  /* Remove trailing slash. */
  p = strrchr(path, '/');
  if (p && !*(p + 1) && p > path)
    *p = '\0';

  if (uid != context->user)
    seteuid(context->user);

  /* Expand symlinks. */
  do
    {
      end = strchr(cur, '/');
      if (end)
        *end = '\0';

      /* cur points to the character after a '/'. Everything before cur is
       * canonicalized. If cur points to the final component, end is NULL.
       * Otherwise, end points to a '\0' that is covering the next '/'
       * after cur.
       */

      /* Handle special cases. */
      if (!*cur || !strcmp(cur, "."))
        {
          /* "." can't be final path component (since we might not have
           * wanted to resolve the final path component, and now it's
           * too late.
           */
          if (!end)
            {
              locker__error(context, "Path cannot end with \".\" (%s).\n",
                            path);
              status = LOCKER_EBADPATH;
              goto cleanup;
            }

          /* Copy the next component over this one. */
          strcpy(cur, end + 1);
          continue;
        }
      else if (!strcmp(cur, ".."))
        {
          /* ".." can't be final path component for similar reasons
           * to above.
           */
          if (!end)
            {
              locker__error(context, "%s: Path cannot end with \"..\" (%s).\n",
                            path);
              status = LOCKER_EBADPATH;
              goto cleanup;
            }

          /* Remove this component and the previous one. */
          cur -= 2;
          while (cur > path && *cur != '/')
            cur--;

          if (cur < path)
            cur++;              /* "/.." == "/" */

          /* Copy the next component over the previous one. */
          strcpy(cur, end + 1);
          continue;
        }

      /* Don't resolve the final component unless we need to check it. */
      if (!end && (check != LOCKER_CANON_CHECK_ALL))
        break;

      /* Check if current component is a symlink. */
      if (lstat(path, &st) < 0)
        {
          if (errno == ENOENT)
            {
              /* The rest of the path doesn't exist. */
              buildfrom = strdup(path);
              if (!buildfrom)
                {
                  locker__error(context, "Out of memory canonicalizing "
                                "mountpoint.\n");
                  status = LOCKER_ENOMEM;
                  goto cleanup;
                }
              if (end)
                *end = '/';
              break;
            }
          else
            {
              locker__error(context, "Could not canonicalize path:\n"
                            "%s for %s\n", strerror(errno), path);
              status = LOCKER_EBADPATH;
              goto cleanup;
            }
        }
      else if (!end && !S_ISDIR(st.st_mode))
        {
          locker__error(context, "Final path component is not a directory "
                        "in \"%s\".\n", path);
          status = LOCKER_EBADPATH;
          goto cleanup;
        }
      else if (S_ISLNK(st.st_mode))
        {
          char linkbuf[MAXPATHLEN], *newpath;
          int len;

          if (++nlinks > MAXSYMLINKS)
            {
              locker__error(context, "Too many levels of symlinks "
                            "while canonicalizing path \"%s\".\n",
                            path);
              status = LOCKER_EBADPATH;
              goto cleanup;
            }

          len = readlink(path, linkbuf, sizeof(linkbuf));
          if (len == -1)
            {
              locker__error(context, "Could not canonicalize mountpoint:\n"
                            "%s while reading symlink %s\n", strerror(errno),
                            path);
              status = LOCKER_EBADPATH;
              goto cleanup;
            }

          if (linkbuf[0] == '/')
            {
              /* It's absolute, so replace existing path with it. */
              newpath = malloc(len + strlen(end + 1) + 2);
              if (!newpath)
                {
                  locker__error(context, "Out of memory canonicalizing "
                                "mountpoint.\n");
                  status = LOCKER_ENOMEM;
                  goto cleanup;
                }
              sprintf(newpath, "%.*s/%s", len, linkbuf, end + 1);
              free(path);
              path = newpath;
              /* And start over from the top. */
              cur = path + 1;
            }
          else
            {
              /* Add this in to existing path. */
              *cur = '\0';
              newpath = malloc(strlen(path) + len + strlen(end + 1) + 3);
              if (!newpath)
                {
                  locker__error(context, "Out of memory canonicalizing "
                                "mountpoint.\n");
                  status = LOCKER_ENOMEM;
                  goto cleanup;
                }
              sprintf(newpath, "%s%.*s/%s", path, len, linkbuf, end + 1);
              /* cur is effectively unchanged. */
              cur = newpath + (cur - path);
              free(path);
              path = newpath;
            }
        }
      else
        {
          if (check != LOCKER_CANON_CHECK_NONE)
            {
              /* Check that we can build in this directory. */
              if (last_dev && st.st_dev != last_dev)
                {
                  locker__error(context, "Cannot attach locker on %s:\n"
                                "directory %s is not on root filesystem.\n",
                                *pathp, path);
                  status = LOCKER_EBADPATH;
                  goto cleanup;
                }
              else if (st.st_uid != 0)
                {
                  locker__error(context, "Cannot attach locker on %s:\n"
                                "directory %s is not owned by root.\n",
                                *pathp, path);
                  status = LOCKER_EBADPATH;
                  goto cleanup;
                }
              else if (st.st_mode & BAD_MODE_BITS)
                {
                  locker__error(context, "Cannot attach locker on %s:\n"
                                "directory %s is group/other writable.\n",
                                *pathp, path);
                  status = LOCKER_EBADPATH;
                  goto cleanup;
                }

              last_dev = st.st_dev;
            }

          /* Replace *end, update cur. */
          if (end)
            {
              *end = '/';
              cur = end + 1;
            }
        }
    }
  while (end);

  if (check != LOCKER_CANON_CHECK_NONE)
    {
      int len = strlen(context->attachtab);
      if (!strncmp(context->attachtab, path, len) &&
          (path[len] == '\0' || path[len] == '/'))
        {
          locker__error(context, "Cannot attach locker on %s:\n"
                        "directory passes through attachtab directory.\n",
                        *pathp, path);
          status = LOCKER_EBADPATH;
          goto cleanup;
        }
    }

  /* Remove trailing slash. */
  p = strrchr(path, '/');
  if (p && !*(p + 1) && p > path)
    *p = '\0';

  *pathp = path;
  if (buildfromp)
    *buildfromp = buildfrom;
  else
    free(buildfrom);

cleanup:
  if (uid != context->user)
    seteuid(uid);
  if (status)
    {
      free(path);
      free(buildfrom);
    }
  return status;
}

/* Create any directories needed to attach something to the named
 * mountpoint. Record the fact that we created the directory so that
 * we know to delete it later.
 */
int locker__build_mountpoint(locker_context context, locker_attachent *at)
{
  char *q, *p;
  int status;

  status = get_dirlock(context, at, F_RDLCK);
  if (status)
    return status;

  if (at->buildfrom)
    {
      /* Create any remaining directories. */
      p = q = at->mountpoint + (strrchr(at->buildfrom, '/') - at->buildfrom);
      while (!status)
        {
          q = strchr(q + 1, '/');
          if (q)
            *q = '\0';
          else if (!(at->fs->flags & LOCKER_FS_NEEDS_MOUNTDIR))
            break;
          status = mountpoint_mkdir(context, at, at->mountpoint);
          if (q)
            *q = '/';
          else
            break;
        }
    }

  /* We do not release the dirlock now, to guarantee that no one
   * else deletes our directories before we're done mounting
   * the filesystem. It will be released by locker_free_attachent().
   */

  return status;
}

/* Remove any directories we created as part of attaching a locker */
int locker__remove_mountpoint(locker_context context, locker_attachent *at)
{
  char *p, *q;
  int status;

  p = strrchr(at->mountpoint, '/');

  /* If no '/', it must be a MUL locker. */
  if (!p)
    return LOCKER_SUCCESS;

  status = get_dirlock(context, at, F_WRLCK);
  if (status)
    return status;

  status = mountpoint_rmdir(context, at, at->mountpoint);
  if (status == LOCKER_ENOENT)
    status = LOCKER_SUCCESS;
  while (!status && (q = p) && (q != at->mountpoint))
    {
      *q = '\0';
      p = strrchr(at->mountpoint, '/');
      status = mountpoint_rmdir(context, at, at->mountpoint);
      *q = '/';
    }

  release_dirlock(context, at);

  if (status == LOCKER_ENOENT || status == LOCKER_EMOUNTPOINTBUSY)
    return LOCKER_SUCCESS;
  else
    return status;
}

/* Lock the dirlock file. type should be F_RDLCK if you are creating
 * directories and F_WRLCK if you are deleting them. A process that creates
 * directories should hold onto the lock until it has actually finished
 * trying to attach the locker, so that some other detach procedure doesn't
 * remove those directories out from under it.
 */
static int get_dirlock(locker_context context, locker_attachent *at, int type)
{
  int status;
  char *lock;
  struct flock fl;

  lock = locker__attachtab_pathname(context, LOCKER_LOCK, ".dirlock");
  if (!lock)
    return LOCKER_ENOMEM;

  at->dirlockfd = open(lock, O_CREAT | O_RDWR, S_IWUSR | S_IRUSR);
  free(lock);
  if (at->dirlockfd < 0)
    {
      at->dirlockfd = 0;
      locker__error(context, "%s: Could not %s mountpoint:\n"
                    "%s while opening directory lock file.\n", at->name,
                    at->attached ? "remove" : "create", strerror(errno));
      return LOCKER_EATTACHTAB;
    }
  fl.l_type = type;
  fl.l_whence = SEEK_SET;
  fl.l_start = fl.l_len = 0;
  status = fcntl(at->dirlockfd, F_SETLKW, &fl);
  if (status < 0)
    {
      close(at->dirlockfd);
      at->dirlockfd = 0;
      locker__error(context, "%s: Could not %s mountpoint:\n"
                    "%s while locking directory lock file.\n", at->name,
                    at->attached ? "remove" : "create", strerror(errno));
      return LOCKER_EATTACHTAB;
    }

  return LOCKER_SUCCESS;
}

static void release_dirlock(locker_context context, locker_attachent *at)
{
  close(at->dirlockfd);
  at->dirlockfd = 0;
}

static int mountpoint_mkdir(locker_context context, locker_attachent *at,
                            char *path)
{
  char *file;
  struct stat st;
  mode_t omask;
  int status;

  file = locker__attachtab_pathname(context, LOCKER_DIRECTORY, path);
  if (!file)
    {
      locker__error(context, "Out of memory building mountpoint.\n");
      return LOCKER_ENOMEM;
    }

  if (access(file, F_OK) != 0 || lstat(path, &st) != 0)
    {
      int fd;

      /* Need to create the dirfile and the directory. If we get killed
       * in between the two steps, we'd rather have a dirfile that
       * doesn't correspond to a directory than a directory that we
       * don't know is our fault. So do the dirfile first.
       */

      fd = open(file, O_RDWR | O_CREAT, S_IRUSR | S_IWUSR);
      if (fd == -1)
        {
          free(file);
          locker__error(context, "Could not create directory data file "
                        "%s:\n%s.\n", file, strerror(errno));
          return LOCKER_EATTACHTAB;
        }
      close(fd);

      /* Make directory. */
      omask = umask(0);
      status = mkdir(path, LOCKER_DIR_MODE);
      umask(omask);
      if (status == -1)
        {
          if (errno == EEXIST)
            {
              locker__error(context, "%s: Directory should not exist: %s\n",
                            at->name, path);
            }
          else
            {
              locker__error(context, "%s: Could not create directory %s:\n"
                            "%s.\n", at->name, path, strerror(errno));
            }
          unlink(file);
          free(file);
          return LOCKER_EMOUNTPOINT;
        }
    }
  else
    {
      if (!S_ISDIR(st.st_mode) || st.st_uid != 0 ||
          (st.st_mode & MODE_MASK) != LOCKER_DIR_MODE)
        {
          locker__error(context, "%s: Directory \"%s\" has changed.\n",
                        at->name, path);
          unlink(file);
          free(file);
          return LOCKER_EMOUNTPOINT;
        }
    }

  free(file);
  return LOCKER_SUCCESS;
}

static int mountpoint_rmdir(locker_context context, locker_attachent *at,
                            char *path)
{
  char *file;
  struct stat st;

  file = locker__attachtab_pathname(context, LOCKER_DIRECTORY, path);
  if (!file)
    {
      locker__error(context, "Out of memory removing mountpoint.\n");
      return LOCKER_ENOMEM;
    }

  if (access(file, F_OK) != 0)
    {
      free(file);
      return LOCKER_ENOENT;
    }

  /* Make sure directory exists and looks like we built it. */
  if (lstat(path, &st) == -1)
    {
      locker__error(context, "%s: Could not check directory %s:\n%s.\n",
                    at->name, path, strerror(errno));
      unlink(file);
      free(file);
      return LOCKER_EMOUNTPOINT;
    }

  if (!S_ISDIR(st.st_mode) || st.st_uid != 0 ||
      (st.st_mode & MODE_MASK) != LOCKER_DIR_MODE)
    {
      locker__error(context, "%s: Directory \"%s\" has changed.\n",
                    at->name, path);
      unlink(file);
      free(file);
      return LOCKER_EMOUNTPOINT;
    }

  if (rmdir(path) == -1)
    {
      free(file);
      if (errno == EEXIST)
        return LOCKER_EMOUNTPOINTBUSY;
      locker__error(context, "%s: Could not remove mountpoint component "
                    "%s:\n%s.\n", at->name, path, strerror(errno));
      return LOCKER_EMOUNTPOINT;
    }

  unlink(file);
  free(file);
  return LOCKER_SUCCESS;
}