src/chown-core.c

   1 /* chown-core.c -- core functions for changing ownership.
   2    Copyright (C) 2000, 2002, 2003, 2004, 2005, 2006 Free Software Foundation.
   3
   4    This program is free software; you can redistribute it and/or modify
   5    it under the terms of the GNU General Public License as published by
   6    the Free Software Foundation; either version 2, or (at your option)
   7    any later version.
   8
   9    This program is distributed in the hope that it will be useful,
  10    but WITHOUT ANY WARRANTY; without even the implied warranty of
  11    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12    GNU General Public License for more details.
  13
  14    You should have received a copy of the GNU General Public License
  15    along with this program; if not, write to the Free Software Foundation,
  16    Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.  */
  17
  18 /* Extracted from chown.c/chgrp.c and librarified by Jim Meyering.  */
  19
  20 #include <config.h>
  21 #include <stdio.h>
  22 #include <sys/types.h>
  23 #include <pwd.h>
  24 #include <grp.h>
  25
  26 #include "system.h"
  27 #include "chown-core.h"
  28 #include "error.h"
  29 #include "inttostr.h"
  30 #include "openat.h"
  31 #include "quote.h"
  32 #include "root-dev-ino.h"
  33 #include "xfts.h"
  34
  35 enum RCH_status
  36   {
  37     /* we called fchown and close, and both succeeded */
  38     RC_ok = 2,
  39
  40     /* required_uid and/or required_gid are specified, but don't match */
  41     RC_excluded,
  42
  43     /* SAME_INODE check failed */
  44     RC_inode_changed,
  45
  46     /* open/fchown isn't needed, isn't safe, or doesn't work due to
  47        permissions problems; fall back on chown */
  48     RC_do_ordinary_chown,
  49
  50     /* open, fstat, fchown, or close failed */
  51     RC_error
  52   };
  53
  54 extern void
  55 chopt_init (struct Chown_option *chopt)
  56 {
  57   chopt->verbosity = V_off;
  58   chopt->root_dev_ino = NULL;
  59   chopt->affect_symlink_referent = true;
  60   chopt->recurse = false;
  61   chopt->force_silent = false;
  62   chopt->user_name = NULL;
  63   chopt->group_name = NULL;
  64 }
  65
  66 extern void
  67 chopt_free (struct Chown_option *chopt ATTRIBUTE_UNUSED)
  68 {
  69   /* Deliberately do not free chopt->user_name or ->group_name.
  70      They're not always allocated.  */
  71 }
  72
  73 /* Convert the numeric group-id, GID, to a string stored in xmalloc'd memory,
  74    and return it.  If there's no corresponding group name, use the decimal
  75    representation of the ID.  */
  76
  77 extern char *
  78 gid_to_name (gid_t gid)
  79 {
  80   char buf[INT_BUFSIZE_BOUND (intmax_t)];
  81   struct group *grp = getgrgid (gid);
  82   return xstrdup (grp ? grp->gr_name
  83                   : TYPE_SIGNED (gid_t) ? imaxtostr (gid, buf)
  84                   : umaxtostr (gid, buf));
  85 }
  86
  87 /* Convert the numeric user-id, UID, to a string stored in xmalloc'd memory,
  88    and return it.  If there's no corresponding user name, use the decimal
  89    representation of the ID.  */
  90
  91 extern char *
  92 uid_to_name (uid_t uid)
  93 {
  94   char buf[INT_BUFSIZE_BOUND (intmax_t)];
  95   struct passwd *pwd = getpwuid (uid);
  96   return xstrdup (pwd ? pwd->pw_name
  97                   : TYPE_SIGNED (uid_t) ? imaxtostr (uid, buf)
  98                   : umaxtostr (uid, buf));
  99 }
 100
 101 /* Tell the user how/if the user and group of FILE have been changed.
 102    If USER is NULL, give the group-oriented messages.
 103    CHANGED describes what (if anything) has happened. */
 104
 105 static void
 106 describe_change (const char *file, enum Change_status changed,
 107                  char const *user, char const *group)
 108 {
 109   const char *fmt;
 110   char const *spec;
 111   char *spec_allocated = NULL;
 112
 113   if (changed == CH_NOT_APPLIED)
 114     {
 115       printf (_("neither symbolic link %s nor referent has been changed\n"),
 116               quote (file));
 117       return;
 118     }
 119
 120   if (user)
 121     {
 122       if (group)
 123         {
 124           spec_allocated = xmalloc (strlen (user) + 1 + strlen (group) + 1);
 125           stpcpy (stpcpy (stpcpy (spec_allocated, user), ":"), group);
 126           spec = spec_allocated;
 127         }
 128       else
 129         {
 130           spec = user;
 131         }
 132     }
 133   else
 134     {
 135       spec = group;
 136     }
 137
 138   switch (changed)
 139     {
 140     case CH_SUCCEEDED:
 141       fmt = (user ? _("changed ownership of %s to %s\n")
 142              : group ? _("changed group of %s to %s\n")
 143              : _("no change to ownership of %s\n"));
 144       break;
 145     case CH_FAILED:
 146       fmt = (user ? _("failed to change ownership of %s to %s\n")
 147              : group ? _("failed to change group of %s to %s\n")
 148              : _("failed to change ownership of %s\n"));
 149       break;
 150     case CH_NO_CHANGE_REQUESTED:
 151       fmt = (user ? _("ownership of %s retained as %s\n")
 152              : group ? _("group of %s retained as %s\n")
 153              : _("ownership of %s retained\n"));
 154       break;
 155     default:
 156       abort ();
 157     }
 158
 159   printf (fmt, quote (file), spec);
 160
 161   free (spec_allocated);
 162 }
 163
 164 /* Change the owner and/or group of the FILE to UID and/or GID (safely)
 165    only if REQUIRED_UID and REQUIRED_GID match the owner and group IDs
 166    of FILE.  ORIG_ST must be the result of `stat'ing FILE.
 167
 168    The `safely' part above means that we can't simply use chown(2),
 169    since FILE might be replaced with some other file between the time
 170    of the preceding stat/lstat and this chown call.  So here we open
 171    FILE and do everything else via the resulting file descriptor.
 172    We first call fstat and verify that the dev/inode match those from
 173    the preceding stat call, and only then, if appropriate (given the
 174    required_uid and required_gid constraints) do we call fchown.
 175
 176    Return RC_do_ordinary_chown if we can't open FILE, or if FILE is a
 177    special file that might have undesirable side effects when opening.
 178    In this case the caller can use the less-safe ordinary chown.
 179
 180    Return one of the RCH_status values.  */
 181
 182 static enum RCH_status
 183 restricted_chown (int cwd_fd, char const *file,
 184                   struct stat const *orig_st,
 185                   uid_t uid, gid_t gid,
 186                   uid_t required_uid, gid_t required_gid)
 187 {
 188   enum RCH_status status = RC_ok;
 189   struct stat st;
 190   int open_flags = O_NONBLOCK | O_NOCTTY;
 191   int fd;
 192
 193   if (required_uid == (uid_t) -1 && required_gid == (gid_t) -1)
 194     return RC_do_ordinary_chown;
 195
 196   if (! S_ISREG (orig_st->st_mode))
 197     {
 198       if (S_ISDIR (orig_st->st_mode))
 199         open_flags |= O_DIRECTORY;
 200       else
 201         return RC_do_ordinary_chown;
 202     }
 203
 204   fd = openat (cwd_fd, file, O_RDONLY | open_flags);
 205   if (! (0 <= fd
 206          || (errno == EACCES && S_ISREG (orig_st->st_mode)
 207              && 0 <= (fd = openat (cwd_fd, file, O_WRONLY | open_flags)))))
 208     return (errno == EACCES ? RC_do_ordinary_chown : RC_error);
 209
 210   if (fstat (fd, &st) != 0)
 211     status = RC_error;
 212   else if (! SAME_INODE (*orig_st, st))
 213     status = RC_inode_changed;
 214   else if ((required_uid == (uid_t) -1 || required_uid == st.st_uid)
 215            && (required_gid == (gid_t) -1 || required_gid == st.st_gid))
 216     {
 217       if (fchown (fd, uid, gid) == 0)
 218         {
 219           status = (close (fd) == 0
 220                     ? RC_ok : RC_error);
 221           return status;
 222         }
 223       else
 224         {
 225           status = RC_error;
 226         }
 227     }
 228
 229   { /* FIXME: remove these curly braces when we assume C99.  */
 230     int saved_errno = errno;
 231     close (fd);
 232     errno = saved_errno;
 233     return status;
 234   }
 235 }
 236
 237 /* Change the owner and/or group of the file specified by FTS and ENT
 238    to UID and/or GID as appropriate.
 239    If REQUIRED_UID is not -1, then skip files with any other user ID.
 240    If REQUIRED_GID is not -1, then skip files with any other group ID.
 241    CHOPT specifies additional options.
 242    Return true if successful.  */
 243 static bool
 244 change_file_owner (FTS *fts, FTSENT *ent,
 245                    uid_t uid, gid_t gid,
 246                    uid_t required_uid, gid_t required_gid,
 247                    struct Chown_option const *chopt)
 248 {
 249   char const *file_full_name = ent->fts_path;
 250   char const *file = ent->fts_accpath;
 251   struct stat const *file_stats;
 252   struct stat stat_buf;
 253   bool ok = true;
 254   bool do_chown;
 255   bool symlink_changed = true;
 256
 257   switch (ent->fts_info)
 258     {
 259     case FTS_D:
 260       if (chopt->recurse)
 261         {
 262           if (ROOT_DEV_INO_CHECK (chopt->root_dev_ino, ent->fts_statp))
 263             {
 264               /* This happens e.g., with "chown -R --preserve-root /".  */
 265               ROOT_DEV_INO_WARN (file_full_name);
 266               /* Tell fts not to traverse into this hierarchy.  */
 267               fts_set (fts, ent, FTS_SKIP);
 268               /* Ensure that we do not process "/" on the second visit.  */
 269               ent = fts_read (fts);
 270               return false;
 271             }
 272           return true;
 273         }
 274       break;
 275
 276     case FTS_DP:
 277       if (! chopt->recurse)
 278         return true;
 279       break;
 280
 281     case FTS_NS:
 282       /* For a top-level file or directory, this FTS_NS (stat failed)
 283          indicator is determined at the time of the initial fts_open call.
 284          With programs like chmod, chown, and chgrp, that modify
 285          permissions, it is possible that the file in question is
 286          accessible when control reaches this point.  So, if this is
 287          the first time we've seen the FTS_NS for this file, tell
 288          fts_read to stat it "again".  */
 289       if (ent->fts_level == 0 && ent->fts_number == 0)
 290         {
 291           ent->fts_number = 1;
 292           fts_set (fts, ent, FTS_AGAIN);
 293           return true;
 294         }
 295       error (0, ent->fts_errno, _("cannot access %s"), quote (file_full_name));
 296       ok = false;
 297       break;
 298
 299     case FTS_ERR:
 300       error (0, ent->fts_errno, _("%s"), quote (file_full_name));
 301       ok = false;
 302       break;
 303
 304     case FTS_DNR:
 305       error (0, ent->fts_errno, _("cannot read directory %s"),
 306              quote (file_full_name));
 307       ok = false;
 308       break;
 309
 310     default:
 311       break;
 312     }
 313
 314   if (!ok)
 315     {
 316       do_chown = false;
 317       file_stats = NULL;
 318     }
 319   else if (required_uid == (uid_t) -1 && required_gid == (gid_t) -1
 320            && chopt->verbosity == V_off
 321            && ! chopt->root_dev_ino
 322            && ! chopt->affect_symlink_referent)
 323     {
 324       do_chown = true;
 325       file_stats = ent->fts_statp;
 326     }
 327   else
 328     {
 329       file_stats = ent->fts_statp;
 330
 331       /* If this is a symlink and we're dereferencing them,
 332          stat it to get info on the referent.  */
 333       if (chopt->affect_symlink_referent && S_ISLNK (file_stats->st_mode))
 334         {
 335           if (fstatat (fts->fts_cwd_fd, file, &stat_buf, 0) != 0)
 336             {
 337               error (0, errno, _("cannot dereference %s"),
 338                      quote (file_full_name));
 339               ok = false;
 340             }
 341
 342           file_stats = &stat_buf;
 343         }
 344
 345       do_chown = (ok
 346                   && (required_uid == (uid_t) -1
 347                       || required_uid == file_stats->st_uid)
 348                   && (required_gid == (gid_t) -1
 349                       || required_gid == file_stats->st_gid));
 350     }
 351
 352   /* This happens when chown -LR --preserve-root encounters a symlink-to-/.  */
 353   if (ROOT_DEV_INO_CHECK (chopt->root_dev_ino, file_stats))
 354     {
 355       ROOT_DEV_INO_WARN (file_full_name);
 356       return false;
 357     }
 358
 359   if (do_chown)
 360     {
 361       if ( ! chopt->affect_symlink_referent)
 362         {
 363           ok = (lchownat (fts->fts_cwd_fd, file, uid, gid) == 0);
 364
 365           /* Ignore any error due to lack of support; POSIX requires
 366              this behavior for top-level symbolic links with -h, and
 367              implies that it's required for all symbolic links.  */
 368           if (!ok && errno == EOPNOTSUPP)
 369             {
 370               ok = true;
 371               symlink_changed = false;
 372             }
 373         }
 374       else
 375         {
 376           /* If possible, avoid a race condition with --from=O:G and without the
 377              (-h) --no-dereference option.  If fts's stat call determined
 378              that the uid/gid of FILE matched the --from=O:G-selected
 379              owner and group IDs, blindly using chown(2) here could lead
 380              chown(1) or chgrp(1) mistakenly to dereference a *symlink*
 381              to an arbitrary file that an attacker had moved into the
 382              place of FILE during the window between the stat and
 383              chown(2) calls.  If FILE is a regular file or a directory
 384              that can be opened, this race condition can be avoided safely.  */
 385
 386           enum RCH_status err
 387             = restricted_chown (fts->fts_cwd_fd, file, file_stats, uid, gid,
 388                                 required_uid, required_gid);
 389           switch (err)
 390             {
 391             case RC_ok:
 392               break;
 393
 394             case RC_do_ordinary_chown:
 395               ok = (chownat (fts->fts_cwd_fd, file, uid, gid) == 0);
 396               break;
 397
 398             case RC_error:
 399               ok = false;
 400               break;
 401
 402             case RC_inode_changed:
 403               /* FIXME: give a diagnostic in this case?  */
 404             case RC_excluded:
 405               do_chown = false;
 406               ok = false;
 407               break;
 408
 409             default:
 410               abort ();
 411             }
 412         }
 413
 414       /* On some systems (e.g., Linux-2.4.x),
 415          the chown function resets the `special' permission bits.
 416          Do *not* restore those bits;  doing so would open a window in
 417          which a malicious user, M, could subvert a chown command run
 418          by some other user and operating on files in a directory
 419          where M has write access.  */
 420
 421       if (do_chown && !ok && ! chopt->force_silent)
 422         error (0, errno, (uid != (uid_t) -1
 423                           ? _("changing ownership of %s")
 424                           : _("changing group of %s")),
 425                quote (file_full_name));
 426     }
 427
 428   if (chopt->verbosity != V_off)
 429     {
 430       bool changed =
 431         ((do_chown & ok & symlink_changed)
 432          && ! ((uid == (uid_t) -1 || uid == file_stats->st_uid)
 433                && (gid == (gid_t) -1 || gid == file_stats->st_gid)));
 434
 435       if (changed || chopt->verbosity == V_high)
 436         {
 437           enum Change_status ch_status =
 438             (!ok ? CH_FAILED
 439              : !symlink_changed ? CH_NOT_APPLIED
 440              : !changed ? CH_NO_CHANGE_REQUESTED
 441              : CH_SUCCEEDED);
 442           describe_change (file_full_name, ch_status,
 443                            chopt->user_name, chopt->group_name);
 444         }
 445     }
 446
 447   if ( ! chopt->recurse)
 448     fts_set (fts, ent, FTS_SKIP);
 449
 450   return ok;
 451 }
 452
 453 /* Change the owner and/or group of the specified FILES.
 454    BIT_FLAGS specifies how to treat each symlink-to-directory
 455    that is encountered during a recursive traversal.
 456    CHOPT specifies additional options.
 457    If UID is not -1, then change the owner id of each file to UID.
 458    If GID is not -1, then change the group id of each file to GID.
 459    If REQUIRED_UID and/or REQUIRED_GID is not -1, then change only
 460    files with user ID and group ID that match the non-(-1) value(s).
 461    Return true if successful.  */
 462 extern bool
 463 chown_files (char **files, int bit_flags,
 464              uid_t uid, gid_t gid,
 465              uid_t required_uid, gid_t required_gid,
 466              struct Chown_option const *chopt)
 467 {
 468   bool ok = true;
 469
 470   /* Use lstat and stat only if they're needed.  */
 471   int stat_flags = ((required_uid != (uid_t) -1 || required_gid != (gid_t) -1
 472                      || chopt->affect_symlink_referent
 473                      || chopt->verbosity != V_off)
 474                     ? 0
 475                     : FTS_NOSTAT);
 476
 477   FTS *fts = xfts_open (files, bit_flags | stat_flags, NULL);
 478
 479   while (1)
 480     {
 481       FTSENT *ent;
 482
 483       ent = fts_read (fts);
 484       if (ent == NULL)
 485         {
 486           if (errno != 0)
 487             {
 488               /* FIXME: try to give a better message  */
 489               error (0, errno, _("fts_read failed"));
 490               ok = false;
 491             }
 492           break;
 493         }
 494
 495       ok &= change_file_owner (fts, ent, uid, gid,
 496                                required_uid, required_gid, chopt);
 497     }
 498
 499   /* Ignore failure, since the only way it can do so is in failing to
 500      return to the original directory, and since we're about to exit,
 501      that doesn't matter.  */
 502   fts_close (fts);
 503
 504   return ok;
 505 }