contrib/sendmail/libsmutil/safefile.c

   1 /*
   2  * Copyright (c) 1998-2004 Proofpoint, Inc. and its suppliers.
   3  *      All rights reserved.
   4  * Copyright (c) 1983, 1995-1997 Eric P. Allman.  All rights reserved.
   5  * Copyright (c) 1988, 1993
   6  *      The Regents of the University of California.  All rights reserved.
   7  *
   8  * By using this file, you agree to the terms and conditions set
   9  * forth in the LICENSE file which can be found at the top level of
  10  * the sendmail distribution.
  11  *
  12  */
  13
  14 #include <sendmail.h>
  15 #include <sm/io.h>
  16 #include <sm/errstring.h>
  17
  18 SM_RCSID("@(#)$Id: safefile.c,v 8.130 2013-11-22 20:51:50 ca Exp $")
  19
  20
  21 /*
  22 **  SAFEFILE -- return 0 if a file exists and is safe for a user.
  23 **
  24 **      Parameters:
  25 **              fn -- filename to check.
  26 **              uid -- user id to compare against.
  27 **              gid -- group id to compare against.
  28 **              user -- user name to compare against (used for group sets).
  29 **              flags -- modifiers:
  30 **                      SFF_MUSTOWN -- "uid" must own this file.
  31 **                      SFF_NOSLINK -- file cannot be a symbolic link.
  32 **              mode -- mode bits that must match.
  33 **              st -- if set, points to a stat structure that will
  34 **                      get the stat info for the file.
  35 **
  36 **      Returns:
  37 **              0 if fn exists, is owned by uid, and matches mode.
  38 **              An errno otherwise.  The actual errno is cleared.
  39 **
  40 **      Side Effects:
  41 **              none.
  42 */
  43
  44 int
  45 safefile(fn, uid, gid, user, flags, mode, st)
  46         char *fn;
  47         UID_T uid;
  48         GID_T gid;
  49         char *user;
  50         long flags;
  51         int mode;
  52         struct stat *st;
  53 {
  54         register char *p;
  55         register struct group *gr = NULL;
  56         int file_errno = 0;
  57         bool checkpath;
  58         struct stat stbuf;
  59         struct stat fstbuf;
  60         char fbuf[MAXPATHLEN];
  61
  62         if (tTd(44, 4))
  63                 sm_dprintf("safefile(%s, uid=%d, gid=%d, flags=%lx, mode=%o):\n",
  64                         fn, (int) uid, (int) gid, flags, mode);
  65         errno = 0;
  66         if (sm_strlcpy(fbuf, fn, sizeof fbuf) >= sizeof fbuf)
  67         {
  68                 if (tTd(44, 4))
  69                         sm_dprintf("\tpathname too long\n");
  70                 return ENAMETOOLONG;
  71         }
  72         fn = fbuf;
  73         if (st == NULL)
  74                 st = &fstbuf;
  75
  76         /* ignore SFF_SAFEDIRPATH if we are debugging */
  77         if (RealUid != 0 && RunAsUid == RealUid)
  78                 flags &= ~SFF_SAFEDIRPATH;
  79
  80         /* first check to see if the file exists at all */
  81 # if HASLSTAT
  82         if ((bitset(SFF_NOSLINK, flags) ? lstat(fn, st)
  83                                         : stat(fn, st)) < 0)
  84 # else
  85         if (stat(fn, st) < 0)
  86 # endif
  87         {
  88                 file_errno = errno;
  89         }
  90         else if (bitset(SFF_SETUIDOK, flags) &&
  91                  !bitset(S_IXUSR|S_IXGRP|S_IXOTH, st->st_mode) &&
  92                  S_ISREG(st->st_mode))
  93         {
  94                 /*
  95                 **  If final file is set-user-ID, run as the owner of that
  96                 **  file.  Gotta be careful not to reveal anything too
  97                 **  soon here!
  98                 */
  99
 100 # ifdef SUID_ROOT_FILES_OK
 101                 if (bitset(S_ISUID, st->st_mode))
 102 # else
 103                 if (bitset(S_ISUID, st->st_mode) && st->st_uid != 0 &&
 104                     st->st_uid != TrustedUid)
 105 # endif
 106                 {
 107                         uid = st->st_uid;
 108                         user = NULL;
 109                 }
 110 # ifdef SUID_ROOT_FILES_OK
 111                 if (bitset(S_ISGID, st->st_mode))
 112 # else
 113                 if (bitset(S_ISGID, st->st_mode) && st->st_gid != 0)
 114 # endif
 115                         gid = st->st_gid;
 116         }
 117
 118         checkpath = !bitset(SFF_NOPATHCHECK, flags) ||
 119                     (uid == 0 && !bitset(SFF_ROOTOK|SFF_OPENASROOT, flags));
 120         if (bitset(SFF_NOWLINK, flags) && !bitset(SFF_SAFEDIRPATH, flags))
 121         {
 122                 int ret;
 123
 124                 /* check the directory */
 125                 p = strrchr(fn, '/');
 126                 if (p == NULL)
 127                 {
 128                         ret = safedirpath(".", uid, gid, user,
 129                                           flags|SFF_SAFEDIRPATH, 0, 0);
 130                 }
 131                 else
 132                 {
 133                         *p = '\0';
 134                         ret = safedirpath(fn, uid, gid, user,
 135                                           flags|SFF_SAFEDIRPATH, 0, 0);
 136                         *p = '/';
 137                 }
 138                 if (ret == 0)
 139                 {
 140                         /* directory is safe */
 141                         checkpath = false;
 142                 }
 143                 else
 144                 {
 145 # if HASLSTAT
 146                         /* Need lstat() information if called stat() before */
 147                         if (!bitset(SFF_NOSLINK, flags) && lstat(fn, st) < 0)
 148                         {
 149                                 ret = errno;
 150                                 if (tTd(44, 4))
 151                                         sm_dprintf("\t%s\n", sm_errstring(ret));
 152                                 return ret;
 153                         }
 154 # endif /* HASLSTAT */
 155                         /* directory is writable: disallow links */
 156                         flags |= SFF_NOLINK;
 157                 }
 158         }
 159
 160         if (checkpath)
 161         {
 162                 int ret;
 163
 164                 p = strrchr(fn, '/');
 165                 if (p == NULL)
 166                 {
 167                         ret = safedirpath(".", uid, gid, user, flags, 0, 0);
 168                 }
 169                 else
 170                 {
 171                         *p = '\0';
 172                         ret = safedirpath(fn, uid, gid, user, flags, 0, 0);
 173                         *p = '/';
 174                 }
 175                 if (ret != 0)
 176                         return ret;
 177         }
 178
 179         /*
 180         **  If the target file doesn't exist, check the directory to
 181         **  ensure that it is writable by this user.
 182         */
 183
 184         if (file_errno != 0)
 185         {
 186                 int ret = file_errno;
 187                 char *dir = fn;
 188
 189                 if (tTd(44, 4))
 190                         sm_dprintf("\t%s\n", sm_errstring(ret));
 191
 192                 errno = 0;
 193                 if (!bitset(SFF_CREAT, flags) || file_errno != ENOENT)
 194                         return ret;
 195
 196                 /* check to see if legal to create the file */
 197                 p = strrchr(dir, '/');
 198                 if (p == NULL)
 199                         dir = ".";
 200                 else if (p == dir)
 201                         dir = "/";
 202                 else
 203                         *p = '\0';
 204                 if (stat(dir, &stbuf) >= 0)
 205                 {
 206                         int md = S_IWRITE|S_IEXEC;
 207
 208                         ret = 0;
 209                         if (stbuf.st_uid == uid)
 210                                 /* EMPTY */
 211                                 ;
 212                         else if (uid == 0 && stbuf.st_uid == TrustedUid)
 213                                 /* EMPTY */
 214                                 ;
 215                         else
 216                         {
 217                                 md >>= 3;
 218                                 if (stbuf.st_gid == gid)
 219                                         /* EMPTY */
 220                                         ;
 221 # ifndef NO_GROUP_SET
 222                                 else if (user != NULL && !DontInitGroups &&
 223                                          ((gr != NULL &&
 224                                            gr->gr_gid == stbuf.st_gid) ||
 225                                           (gr = getgrgid(stbuf.st_gid)) != NULL))
 226                                 {
 227                                         register char **gp;
 228
 229                                         for (gp = gr->gr_mem; *gp != NULL; gp++)
 230                                                 if (strcmp(*gp, user) == 0)
 231                                                         break;
 232                                         if (*gp == NULL)
 233                                                 md >>= 3;
 234                                 }
 235 # endif /* ! NO_GROUP_SET */
 236                                 else
 237                                         md >>= 3;
 238                         }
 239                         if ((stbuf.st_mode & md) != md)
 240                                 ret = errno = EACCES;
 241                 }
 242                 else
 243                         ret = errno;
 244                 if (tTd(44, 4))
 245                         sm_dprintf("\t[final dir %s uid %d mode %lo] %s\n",
 246                                 dir, (int) stbuf.st_uid,
 247                                 (unsigned long) stbuf.st_mode,
 248                                 sm_errstring(ret));
 249                 if (p != NULL)
 250                         *p = '/';
 251                 st->st_mode = ST_MODE_NOFILE;
 252                 return ret;
 253         }
 254
 255 # ifdef S_ISLNK
 256         if (bitset(SFF_NOSLINK, flags) && S_ISLNK(st->st_mode))
 257         {
 258                 if (tTd(44, 4))
 259                         sm_dprintf("\t[slink mode %lo]\tE_SM_NOSLINK\n",
 260                                 (unsigned long) st->st_mode);
 261                 return E_SM_NOSLINK;
 262         }
 263 # endif /* S_ISLNK */
 264         if (bitset(SFF_REGONLY, flags) && !S_ISREG(st->st_mode))
 265         {
 266                 if (tTd(44, 4))
 267                         sm_dprintf("\t[non-reg mode %lo]\tE_SM_REGONLY\n",
 268                                 (unsigned long) st->st_mode);
 269                 return E_SM_REGONLY;
 270         }
 271         if (bitset(SFF_NOGWFILES, flags) &&
 272             bitset(S_IWGRP, st->st_mode))
 273         {
 274                 if (tTd(44, 4))
 275                         sm_dprintf("\t[write bits %lo]\tE_SM_GWFILE\n",
 276                                 (unsigned long) st->st_mode);
 277                 return E_SM_GWFILE;
 278         }
 279         if (bitset(SFF_NOWWFILES, flags) &&
 280             bitset(S_IWOTH, st->st_mode))
 281         {
 282                 if (tTd(44, 4))
 283                         sm_dprintf("\t[write bits %lo]\tE_SM_WWFILE\n",
 284                                 (unsigned long) st->st_mode);
 285                 return E_SM_WWFILE;
 286         }
 287         if (bitset(SFF_NOGRFILES, flags) && bitset(S_IRGRP, st->st_mode))
 288         {
 289                 if (tTd(44, 4))
 290                         sm_dprintf("\t[read bits %lo]\tE_SM_GRFILE\n",
 291                                 (unsigned long) st->st_mode);
 292                 return E_SM_GRFILE;
 293         }
 294         if (bitset(SFF_NOWRFILES, flags) && bitset(S_IROTH, st->st_mode))
 295         {
 296                 if (tTd(44, 4))
 297                         sm_dprintf("\t[read bits %lo]\tE_SM_WRFILE\n",
 298                                 (unsigned long) st->st_mode);
 299                 return E_SM_WRFILE;
 300         }
 301         if (!bitset(SFF_EXECOK, flags) &&
 302             bitset(S_IWUSR|S_IWGRP|S_IWOTH, mode) &&
 303             bitset(S_IXUSR|S_IXGRP|S_IXOTH, st->st_mode))
 304         {
 305                 if (tTd(44, 4))
 306                         sm_dprintf("\t[exec bits %lo]\tE_SM_ISEXEC\n",
 307                                 (unsigned long) st->st_mode);
 308                 return E_SM_ISEXEC;
 309         }
 310         if (bitset(SFF_NOHLINK, flags) && st->st_nlink != 1)
 311         {
 312                 if (tTd(44, 4))
 313                         sm_dprintf("\t[link count %d]\tE_SM_NOHLINK\n",
 314                                 (int) st->st_nlink);
 315                 return E_SM_NOHLINK;
 316         }
 317
 318         if (uid == 0 && bitset(SFF_OPENASROOT, flags))
 319                 /* EMPTY */
 320                 ;
 321         else if (uid == 0 && !bitset(SFF_ROOTOK, flags))
 322                 mode >>= 6;
 323         else if (st->st_uid == uid)
 324                 /* EMPTY */
 325                 ;
 326         else if (uid == 0 && st->st_uid == TrustedUid)
 327                 /* EMPTY */
 328                 ;
 329         else
 330         {
 331                 mode >>= 3;
 332                 if (st->st_gid == gid)
 333                         /* EMPTY */
 334                         ;
 335 # ifndef NO_GROUP_SET
 336                 else if (user != NULL && !DontInitGroups &&
 337                          ((gr != NULL && gr->gr_gid == st->st_gid) ||
 338                           (gr = getgrgid(st->st_gid)) != NULL))
 339                 {
 340                         register char **gp;
 341
 342                         for (gp = gr->gr_mem; *gp != NULL; gp++)
 343                                 if (strcmp(*gp, user) == 0)
 344                                         break;
 345                         if (*gp == NULL)
 346                                 mode >>= 3;
 347                 }
 348 # endif /* ! NO_GROUP_SET */
 349                 else
 350                         mode >>= 3;
 351         }
 352         if (tTd(44, 4))
 353                 sm_dprintf("\t[uid %d, nlink %d, stat %lo, mode %lo] ",
 354                         (int) st->st_uid, (int) st->st_nlink,
 355                         (unsigned long) st->st_mode, (unsigned long) mode);
 356         if ((st->st_uid == uid || st->st_uid == 0 ||
 357              st->st_uid == TrustedUid ||
 358              !bitset(SFF_MUSTOWN, flags)) &&
 359             (st->st_mode & mode) == mode)
 360         {
 361                 if (tTd(44, 4))
 362                         sm_dprintf("\tOK\n");
 363                 return 0;
 364         }
 365         if (tTd(44, 4))
 366                 sm_dprintf("\tEACCES\n");
 367         return EACCES;
 368 }
 369 /*
 370 **  SAFEDIRPATH -- check to make sure a path to a directory is safe
 371 **
 372 **      Safe means not writable and owned by the right folks.
 373 **
 374 **      Parameters:
 375 **              fn -- filename to check.
 376 **              uid -- user id to compare against.
 377 **              gid -- group id to compare against.
 378 **              user -- user name to compare against (used for group
 379 **                      sets).
 380 **              flags -- modifiers:
 381 **                      SFF_ROOTOK -- ok to use root permissions to open.
 382 **                      SFF_SAFEDIRPATH -- writable directories are considered
 383 **                              to be fatal errors.
 384 **              level -- symlink recursive level.
 385 **              offset -- offset into fn to start checking from.
 386 **
 387 **      Returns:
 388 **              0 -- if the directory path is "safe".
 389 **              else -- an error number associated with the path.
 390 */
 391
 392 int
 393 safedirpath(fn, uid, gid, user, flags, level, offset)
 394         char *fn;
 395         UID_T uid;
 396         GID_T gid;
 397         char *user;
 398         long flags;
 399         int level;
 400         int offset;
 401 {
 402         int ret = 0;
 403         int mode = S_IWOTH;
 404         char save = '\0';
 405         char *saveptr = NULL;
 406         char *p, *enddir;
 407         register struct group *gr = NULL;
 408         char s[MAXLINKPATHLEN];
 409         struct stat stbuf;
 410
 411         /* make sure we aren't in a symlink loop */
 412         if (level > MAXSYMLINKS)
 413                 return ELOOP;
 414
 415         if (level < 0 || offset < 0 || offset > strlen(fn))
 416                 return EINVAL;
 417
 418         /* special case root directory */
 419         if (*fn == '\0')
 420                 fn = "/";
 421
 422         if (tTd(44, 4))
 423                 sm_dprintf("safedirpath(%s, uid=%ld, gid=%ld, flags=%lx, level=%d, offset=%d):\n",
 424                         fn, (long) uid, (long) gid, flags, level, offset);
 425
 426         if (!bitnset(DBS_GROUPWRITABLEDIRPATHSAFE, DontBlameSendmail))
 427                 mode |= S_IWGRP;
 428
 429         /* Make a modifiable copy of the filename */
 430         if (sm_strlcpy(s, fn, sizeof s) >= sizeof s)
 431                 return EINVAL;
 432
 433         p = s + offset;
 434         while (p != NULL)
 435         {
 436                 /* put back character */
 437                 if (saveptr != NULL)
 438                 {
 439                         *saveptr = save;
 440                         saveptr = NULL;
 441                         p++;
 442                 }
 443
 444                 if (*p == '\0')
 445                         break;
 446
 447                 p = strchr(p, '/');
 448
 449                 /* Special case for root directory */
 450                 if (p == s)
 451                 {
 452                         save = *(p + 1);
 453                         saveptr = p + 1;
 454                         *(p + 1) = '\0';
 455                 }
 456                 else if (p != NULL)
 457                 {
 458                         save = *p;
 459                         saveptr = p;
 460                         *p = '\0';
 461                 }
 462
 463                 /* Heuristic: . and .. have already been checked */
 464                 enddir = strrchr(s, '/');
 465                 if (enddir != NULL &&
 466                     (strcmp(enddir, "/..") == 0 ||
 467                      strcmp(enddir, "/.") == 0))
 468                         continue;
 469
 470                 if (tTd(44, 20))
 471                         sm_dprintf("\t[dir %s]\n", s);
 472
 473 # if HASLSTAT
 474                 ret = lstat(s, &stbuf);
 475 # else
 476                 ret = stat(s, &stbuf);
 477 # endif
 478                 if (ret < 0)
 479                 {
 480                         ret = errno;
 481                         break;
 482                 }
 483
 484 # ifdef S_ISLNK
 485                 /* Follow symlinks */
 486                 if (S_ISLNK(stbuf.st_mode))
 487                 {
 488                         int linklen;
 489                         char *target;
 490                         char buf[MAXPATHLEN];
 491                         char fullbuf[MAXLINKPATHLEN];
 492
 493                         memset(buf, '\0', sizeof buf);
 494                         linklen = readlink(s, buf, sizeof buf);
 495                         if (linklen < 0)
 496                         {
 497                                 ret = errno;
 498                                 break;
 499                         }
 500                         if (linklen >= sizeof buf)
 501                         {
 502                                 /* file name too long for buffer */
 503                                 ret = errno = EINVAL;
 504                                 break;
 505                         }
 506
 507                         offset = 0;
 508                         if (*buf == '/')
 509                         {
 510                                 target = buf;
 511
 512                                 /* If path is the same, avoid rechecks */
 513                                 while (s[offset] == buf[offset] &&
 514                                        s[offset] != '\0')
 515                                         offset++;
 516
 517                                 if (s[offset] == '\0' && buf[offset] == '\0')
 518                                 {
 519                                         /* strings match, symlink loop */
 520                                         return ELOOP;
 521                                 }
 522
 523                                 /* back off from the mismatch */
 524                                 if (offset > 0)
 525                                         offset--;
 526
 527                                 /* Make sure we are at a directory break */
 528                                 if (offset > 0 &&
 529                                     s[offset] != '/' &&
 530                                     s[offset] != '\0')
 531                                 {
 532                                         while (buf[offset] != '/' &&
 533                                                offset > 0)
 534                                                 offset--;
 535                                 }
 536                                 if (offset > 0 &&
 537                                     s[offset] == '/' &&
 538                                     buf[offset] == '/')
 539                                 {
 540                                         /* Include the trailing slash */
 541                                         offset++;
 542                                 }
 543                         }
 544                         else
 545                         {
 546                                 char *sptr;
 547
 548                                 sptr = strrchr(s, '/');
 549                                 if (sptr != NULL)
 550                                 {
 551                                         *sptr = '\0';
 552                                         offset = sptr + 1 - s;
 553                                         if (sm_strlcpyn(fullbuf,
 554                                                         sizeof fullbuf, 2,
 555                                                         s, "/") >=
 556                                                 sizeof fullbuf ||
 557                                             sm_strlcat(fullbuf, buf,
 558                                                        sizeof fullbuf) >=
 559                                                 sizeof fullbuf)
 560                                         {
 561                                                 ret = EINVAL;
 562                                                 break;
 563                                         }
 564                                         *sptr = '/';
 565                                 }
 566                                 else
 567                                 {
 568                                         if (sm_strlcpy(fullbuf, buf,
 569                                                        sizeof fullbuf) >=
 570                                                 sizeof fullbuf)
 571                                         {
 572                                                 ret = EINVAL;
 573                                                 break;
 574                                         }
 575                                 }
 576                                 target = fullbuf;
 577                         }
 578                         ret = safedirpath(target, uid, gid, user, flags,
 579                                           level + 1, offset);
 580                         if (ret != 0)
 581                                 break;
 582
 583                         /* Don't check permissions on the link file itself */
 584                         continue;
 585                 }
 586 #endif /* S_ISLNK */
 587
 588                 if ((uid == 0 || bitset(SFF_SAFEDIRPATH, flags)) &&
 589 #ifdef S_ISVTX
 590                     !(bitnset(DBS_TRUSTSTICKYBIT, DontBlameSendmail) &&
 591                       bitset(S_ISVTX, stbuf.st_mode)) &&
 592 #endif
 593                     bitset(mode, stbuf.st_mode))
 594                 {
 595                         if (tTd(44, 4))
 596                                 sm_dprintf("\t[dir %s] mode %lo ",
 597                                         s, (unsigned long) stbuf.st_mode);
 598                         if (bitset(SFF_SAFEDIRPATH, flags))
 599                         {
 600                                 if (bitset(S_IWOTH, stbuf.st_mode))
 601                                         ret = E_SM_WWDIR;
 602                                 else
 603                                         ret = E_SM_GWDIR;
 604                                 if (tTd(44, 4))
 605                                         sm_dprintf("FATAL\n");
 606                                 break;
 607                         }
 608                         if (tTd(44, 4))
 609                                 sm_dprintf("WARNING\n");
 610                         if (Verbose > 1)
 611                                 message("051 WARNING: %s writable directory %s",
 612                                         bitset(S_IWOTH, stbuf.st_mode)
 613                                            ? "World"
 614                                            : "Group",
 615                                         s);
 616                 }
 617                 if (uid == 0 && !bitset(SFF_ROOTOK|SFF_OPENASROOT, flags))
 618                 {
 619                         if (bitset(S_IXOTH, stbuf.st_mode))
 620                                 continue;
 621                         ret = EACCES;
 622                         break;
 623                 }
 624
 625                 /*
 626                 **  Let OS determine access to file if we are not
 627                 **  running as a privileged user.  This allows ACLs
 628                 **  to work.  Also, if opening as root, assume we can
 629                 **  scan the directory.
 630                 */
 631                 if (geteuid() != 0 || bitset(SFF_OPENASROOT, flags))
 632                         continue;
 633
 634                 if (stbuf.st_uid == uid &&
 635                     bitset(S_IXUSR, stbuf.st_mode))
 636                         continue;
 637                 if (stbuf.st_gid == gid &&
 638                     bitset(S_IXGRP, stbuf.st_mode))
 639                         continue;
 640 # ifndef NO_GROUP_SET
 641                 if (user != NULL && !DontInitGroups &&
 642                     ((gr != NULL && gr->gr_gid == stbuf.st_gid) ||
 643                      (gr = getgrgid(stbuf.st_gid)) != NULL))
 644                 {
 645                         register char **gp;
 646
 647                         for (gp = gr->gr_mem; gp != NULL && *gp != NULL; gp++)
 648                                 if (strcmp(*gp, user) == 0)
 649                                         break;
 650                         if (gp != NULL && *gp != NULL &&
 651                             bitset(S_IXGRP, stbuf.st_mode))
 652                                 continue;
 653                 }
 654 # endif /* ! NO_GROUP_SET */
 655                 if (!bitset(S_IXOTH, stbuf.st_mode))
 656                 {
 657                         ret = EACCES;
 658                         break;
 659                 }
 660         }
 661         if (tTd(44, 4))
 662                 sm_dprintf("\t[dir %s] %s\n", fn,
 663                         ret == 0 ? "OK" : sm_errstring(ret));
 664         return ret;
 665 }
 666 /*
 667 **  SAFEOPEN -- do a file open with extra checking
 668 **
 669 **      Parameters:
 670 **              fn -- the file name to open.
 671 **              omode -- the open-style mode flags.
 672 **              cmode -- the create-style mode flags.
 673 **              sff -- safefile flags.
 674 **
 675 **      Returns:
 676 **              Same as open.
 677 */
 678
 679 int
 680 safeopen(fn, omode, cmode, sff)
 681         char *fn;
 682         int omode;
 683         int cmode;
 684         long sff;
 685 {
 686 #if !NOFTRUNCATE
 687         bool truncate;
 688 #endif
 689         int rval;
 690         int fd;
 691         int smode;
 692         struct stat stb;
 693
 694         if (tTd(44, 10))
 695                 sm_dprintf("safeopen: fn=%s, omode=%x, cmode=%x, sff=%lx\n",
 696                            fn, omode, cmode, sff);
 697
 698         if (bitset(O_CREAT, omode))
 699                 sff |= SFF_CREAT;
 700         omode &= ~O_CREAT;
 701         switch (omode & O_ACCMODE)
 702         {
 703           case O_RDONLY:
 704                 smode = S_IREAD;
 705                 break;
 706
 707           case O_WRONLY:
 708                 smode = S_IWRITE;
 709                 break;
 710
 711           case O_RDWR:
 712                 smode = S_IREAD|S_IWRITE;
 713                 break;
 714
 715           default:
 716                 smode = 0;
 717                 break;
 718         }
 719         if (bitset(SFF_OPENASROOT, sff))
 720                 rval = safefile(fn, RunAsUid, RunAsGid, RunAsUserName,
 721                                 sff, smode, &stb);
 722         else
 723                 rval = safefile(fn, RealUid, RealGid, RealUserName,
 724                                 sff, smode, &stb);
 725         if (rval != 0)
 726         {
 727                 errno = rval;
 728                 return -1;
 729         }
 730         if (stb.st_mode == ST_MODE_NOFILE && bitset(SFF_CREAT, sff))
 731                 omode |= O_CREAT | (bitset(SFF_NOTEXCL, sff) ? 0 : O_EXCL);
 732         else if (bitset(SFF_CREAT, sff) && bitset(O_EXCL, omode))
 733         {
 734                 /* The file exists so an exclusive create would fail */
 735                 errno = EEXIST;
 736                 return -1;
 737         }
 738
 739 #if !NOFTRUNCATE
 740         truncate = bitset(O_TRUNC, omode);
 741         if (truncate)
 742                 omode &= ~O_TRUNC;
 743 #endif
 744
 745         fd = dfopen(fn, omode, cmode, sff);
 746         if (fd < 0)
 747                 return fd;
 748         if (filechanged(fn, fd, &stb))
 749         {
 750                 syserr("554 5.3.0 cannot open: file %s changed after open", fn);
 751                 (void) close(fd);
 752                 errno = E_SM_FILECHANGE;
 753                 return -1;
 754         }
 755
 756 #if !NOFTRUNCATE
 757         if (truncate &&
 758             ftruncate(fd, (off_t) 0) < 0)
 759         {
 760                 int save_errno;
 761
 762                 save_errno = errno;
 763                 syserr("554 5.3.0 cannot open: file %s could not be truncated",
 764                        fn);
 765                 (void) close(fd);
 766                 errno = save_errno;
 767                 return -1;
 768         }
 769 #endif /* !NOFTRUNCATE */
 770
 771         return fd;
 772 }
 773 /*
 774 **  SAFEFOPEN -- do a file open with extra checking
 775 **
 776 **      Parameters:
 777 **              fn -- the file name to open.
 778 **              omode -- the open-style mode flags.
 779 **              cmode -- the create-style mode flags.
 780 **              sff -- safefile flags.
 781 **
 782 **      Returns:
 783 **              Same as fopen.
 784 */
 785
 786 SM_FILE_T *
 787 safefopen(fn, omode, cmode, sff)
 788         char *fn;
 789         int omode;
 790         int cmode;
 791         long sff;
 792 {
 793         int fd;
 794         int save_errno;
 795         SM_FILE_T *fp;
 796         int fmode;
 797
 798         switch (omode & O_ACCMODE)
 799         {
 800           case O_RDONLY:
 801                 fmode = SM_IO_RDONLY;
 802                 break;
 803
 804           case O_WRONLY:
 805                 if (bitset(O_APPEND, omode))
 806                         fmode = SM_IO_APPEND;
 807                 else
 808                         fmode = SM_IO_WRONLY;
 809                 break;
 810
 811           case O_RDWR:
 812                 if (bitset(O_TRUNC, omode))
 813                         fmode = SM_IO_RDWRTR;
 814                 else if (bitset(O_APPEND, omode))
 815                         fmode = SM_IO_APPENDRW;
 816                 else
 817                         fmode = SM_IO_RDWR;
 818                 break;
 819
 820           default:
 821                 syserr("554 5.3.5 safefopen: unknown omode %o", omode);
 822                 fmode = 0;
 823         }
 824         fd = safeopen(fn, omode, cmode, sff);
 825         if (fd < 0)
 826         {
 827                 save_errno = errno;
 828                 if (tTd(44, 10))
 829                         sm_dprintf("safefopen: safeopen failed: %s\n",
 830                                    sm_errstring(errno));
 831                 errno = save_errno;
 832                 return NULL;
 833         }
 834         fp = sm_io_open(SmFtStdiofd, SM_TIME_DEFAULT,
 835                         (void *) &fd, fmode, NULL);
 836         if (fp != NULL)
 837                 return fp;
 838
 839         save_errno = errno;
 840         if (tTd(44, 10))
 841         {
 842                 sm_dprintf("safefopen: fdopen(%s, %d) failed: omode=%x, sff=%lx, err=%s\n",
 843                            fn, fmode, omode, sff, sm_errstring(errno));
 844         }
 845         (void) close(fd);
 846         errno = save_errno;
 847         return NULL;
 848 }
 849 /*
 850 **  FILECHANGED -- check to see if file changed after being opened
 851 **
 852 **      Parameters:
 853 **              fn -- pathname of file to check.
 854 **              fd -- file descriptor to check.
 855 **              stb -- stat structure from before open.
 856 **
 857 **      Returns:
 858 **              true -- if a problem was detected.
 859 **              false -- if this file is still the same.
 860 */
 861
 862 bool
 863 filechanged(fn, fd, stb)
 864         char *fn;
 865         int fd;
 866         struct stat *stb;
 867 {
 868         struct stat sta;
 869
 870         if (stb->st_mode == ST_MODE_NOFILE)
 871         {
 872 # if HASLSTAT && BOGUS_O_EXCL
 873                 /* only necessary if exclusive open follows symbolic links */
 874                 if (lstat(fn, stb) < 0 || stb->st_nlink != 1)
 875                         return true;
 876 # else
 877                 return false;
 878 # endif
 879         }
 880         if (fstat(fd, &sta) < 0)
 881                 return true;
 882
 883         if (sta.st_nlink != stb->st_nlink ||
 884             sta.st_dev != stb->st_dev ||
 885             sta.st_ino != stb->st_ino ||
 886 # if HAS_ST_GEN && 0            /* AFS returns garbage in st_gen */
 887             sta.st_gen != stb->st_gen ||
 888 # endif
 889             sta.st_uid != stb->st_uid ||
 890             sta.st_gid != stb->st_gid)
 891         {
 892                 if (tTd(44, 8))
 893                 {
 894                         sm_dprintf("File changed after opening:\n");
 895                         sm_dprintf(" nlink      = %ld/%ld\n",
 896                                 (long) stb->st_nlink, (long) sta.st_nlink);
 897                         sm_dprintf(" dev        = %ld/%ld\n",
 898                                 (long) stb->st_dev, (long) sta.st_dev);
 899                         sm_dprintf(" ino        = %llu/%llu\n",
 900                                 (ULONGLONG_T) stb->st_ino,
 901                                 (ULONGLONG_T) sta.st_ino);
 902 # if HAS_ST_GEN
 903                         sm_dprintf(" gen        = %ld/%ld\n",
 904                                 (long) stb->st_gen, (long) sta.st_gen);
 905 # endif
 906                         sm_dprintf(" uid        = %ld/%ld\n",
 907                                 (long) stb->st_uid, (long) sta.st_uid);
 908                         sm_dprintf(" gid        = %ld/%ld\n",
 909                                 (long) stb->st_gid, (long) sta.st_gid);
 910                 }
 911                 return true;
 912         }
 913
 914         return false;
 915 }
 916 /*
 917 **  DFOPEN -- determined file open
 918 **
 919 **      This routine has the semantics of open, except that it will
 920 **      keep trying a few times to make this happen.  The idea is that
 921 **      on very loaded systems, we may run out of resources (inodes,
 922 **      whatever), so this tries to get around it.
 923 */
 924
 925 int
 926 dfopen(filename, omode, cmode, sff)
 927         char *filename;
 928         int omode;
 929         int cmode;
 930         long sff;
 931 {
 932         register int tries;
 933         int fd = -1;
 934         struct stat st;
 935
 936         for (tries = 0; tries < 10; tries++)
 937         {
 938                 (void) sleep((unsigned) (10 * tries));
 939                 errno = 0;
 940                 fd = open(filename, omode, cmode);
 941                 if (fd >= 0)
 942                         break;
 943                 switch (errno)
 944                 {
 945                   case ENFILE:          /* system file table full */
 946                   case EINTR:           /* interrupted syscall */
 947 #ifdef ETXTBSY
 948                   case ETXTBSY:         /* Apollo: net file locked */
 949 #endif
 950                         continue;
 951                 }
 952                 break;
 953         }
 954         if (!bitset(SFF_NOLOCK, sff) &&
 955             fd >= 0 &&
 956             fstat(fd, &st) >= 0 &&
 957             S_ISREG(st.st_mode))
 958         {
 959                 int locktype;
 960
 961                 /* lock the file to avoid accidental conflicts */
 962                 if ((omode & O_ACCMODE) != O_RDONLY)
 963                         locktype = LOCK_EX;
 964                 else
 965                         locktype = LOCK_SH;
 966                 if (bitset(SFF_NBLOCK, sff))
 967                         locktype |= LOCK_NB;
 968
 969                 if (!lockfile(fd, filename, NULL, locktype))
 970                 {
 971                         int save_errno = errno;
 972
 973                         (void) close(fd);
 974                         fd = -1;
 975                         errno = save_errno;
 976                 }
 977                 else
 978                         errno = 0;
 979         }
 980         return fd;
 981 }