2 * Copyright (C) 1996-2000 Michael R. Elkins <me@mutt.org>
3 * Copyright (C) 1998-2000 Thomas Roessler <roessler@does-not-exist.org>
5 * This program is free software; you can redistribute it and/or modify
6 * it under the terms of the GNU General Public License as published by
7 * the Free Software Foundation; either version 2 of the License, or
8 * (at your option) any later version.
10 * This program is distributed in the hope that it will be useful,
11 * but WITHOUT ANY WARRANTY; without even the implied warranty of
12 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
13 * GNU General Public License for more details.
15 * You should have received a copy of the GNU General Public License
16 * along with this program; if not, write to the Free Software
17 * Foundation, Inc., 59 Temple Place - Suite 330, Boston, MA 02111, USA.
21 * This module either be compiled into Mutt, or it can be
22 * built as a separate program. For building it
23 * separately, define the DL_STANDALONE preprocessor
39 #include <sys/utsname.h>
45 #ifndef _POSIX_PATH_MAX
46 #include <posix1_lim.h>
60 #define MAXLINKS 1024 /* maximum link depth */
64 # define LONG_STRING 1024
65 # define MAXLOCKATTEMPT 5
67 # define strfcpy(A,B,C) strncpy (A,B,C), *(A+(C)-1)=0
72 # define SETEGID setegid
74 # define SETEGID setgid
77 # define S_ISLNK(x) (((x) & S_IFMT) == S_IFLNK ? 1 : 0)
82 # ifndef HAVE_SNPRINTF
83 extern int snprintf (char *, size_t, const char *, ...);
86 #else /* DL_STANDALONE */
89 # error Do not try to compile dotlock as a mutt module when requiring egid switching!
95 #endif /* DL_STANDALONE */
97 static int DotlockFlags;
98 static int Retry = MAXLOCKATTEMPT;
101 static char *Hostname;
105 static gid_t UserGid;
106 static gid_t MailGid;
109 static int dotlock_deference_symlink (char *, size_t, const char *);
110 static int dotlock_prepare (char *, size_t, const char *, int fd);
111 static int dotlock_check_stats (struct stat *, struct stat *);
112 static int dotlock_dispatch (const char *, int fd);
115 static int dotlock_init_privs (void);
116 static void usage (const char *);
119 static void dotlock_expand_link (char *, const char *, const char *);
120 static void BEGIN_PRIVILEGED (void);
121 static void END_PRIVILEGED (void);
123 /* These functions work on the current directory.
124 * Invoke dotlock_prepare () before and check their
128 static int dotlock_try (void);
129 static int dotlock_unlock (const char *);
130 static int dotlock_unlink (const char *);
131 static int dotlock_lock (const char *);
136 #define check_flags(a) if (a & DL_FL_ACTIONS) usage (argv[0])
138 int main (int argc, char **argv)
142 struct utsname utsname;
144 /* first, drop privileges */
146 if (dotlock_init_privs () == -1)
150 /* determine the system's host name */
153 if (!(Hostname = strdup (utsname.nodename))) /* __MEM_CHECKED__ */
155 if ((p = strchr (Hostname, '.')))
159 /* parse the command line options. */
162 while ((i = getopt (argc, argv, "dtfupr:")) != EOF)
166 /* actions, mutually exclusive */
167 case 't': check_flags (DotlockFlags); DotlockFlags |= DL_FL_TRY; break;
168 case 'd': check_flags (DotlockFlags); DotlockFlags |= DL_FL_UNLINK; break;
169 case 'u': check_flags (DotlockFlags); DotlockFlags |= DL_FL_UNLOCK; break;
172 case 'f': DotlockFlags |= DL_FL_FORCE; break;
173 case 'p': DotlockFlags |= DL_FL_USEPRIV; break;
174 case 'r': DotlockFlags |= DL_FL_RETRY; Retry = atoi (optarg); break;
176 default: usage (argv[0]);
180 if (optind == argc || Retry < 0)
183 return dotlock_dispatch (argv[optind], -1);
188 * Determine our effective group ID, and drop
193 * 0 - everything went fine
194 * -1 - we couldn't drop privileges.
200 dotlock_init_privs (void)
206 MailGid = getegid ();
208 if (SETEGID (UserGid) != 0)
217 #else /* DL_STANDALONE */
220 * This function is intended to be invoked from within
221 * mutt instead of mx.c's invoke_dotlock ().
224 int dotlock_invoke (const char *path, int fd, int flags, int retry)
229 DotlockFlags = flags;
231 if ((currdir = open (".", O_RDONLY)) == -1)
234 if (!(DotlockFlags & DL_FL_RETRY) || retry)
235 Retry = MAXLOCKATTEMPT;
239 r = dotlock_dispatch (path, fd);
247 #endif /* DL_STANDALONE */
250 static int dotlock_dispatch (const char *f, int fd)
252 char realpath[_POSIX_PATH_MAX];
254 /* If dotlock_prepare () succeeds [return value == 0],
255 * realpath contains the basename of f, and we have
256 * successfully changed our working directory to
257 * `dirname $f`. Additionally, f has been opened for
258 * reading to verify that the user has at least read
259 * permissions on that file.
261 * For a more detailed explanation of all this, see the
262 * lengthy comment below.
265 if (dotlock_prepare (realpath, sizeof (realpath), f, fd) != 0)
268 /* Actually perform the locking operation. */
270 if (DotlockFlags & DL_FL_TRY)
271 return dotlock_try ();
272 else if (DotlockFlags & DL_FL_UNLOCK)
273 return dotlock_unlock (realpath);
274 else if (DotlockFlags & DL_FL_UNLINK)
275 return dotlock_unlink (realpath);
277 return dotlock_lock (realpath);
284 * This function re-acquires the privileges we may have
285 * if the user told us to do so by giving the "-p"
286 * command line option.
288 * BEGIN_PRIVILEGES () won't return if an error occurs.
293 BEGIN_PRIVILEGED (void)
296 if (DotlockFlags & DL_FL_USEPRIV)
298 if (SETEGID (MailGid) != 0)
300 /* perror ("setegid"); */
310 * This function drops the group privileges we may have.
312 * END_PRIVILEGED () won't return if an error occurs.
317 END_PRIVILEGED (void)
320 if (DotlockFlags & DL_FL_USEPRIV)
322 if (SETEGID (UserGid) != 0)
324 /* perror ("setegid"); */
336 * This function doesn't return.
341 usage (const char *av0)
343 fprintf (stderr, "dotlock [Mutt-ng %s (%s)]\n", VERSION, ReleaseDate);
344 fprintf (stderr, "usage: %s [-t|-f|-u|-d] [-p] [-r <retries>] file\n",
352 "\n -p\t\tprivileged"
356 "\n -r <retries>\tRetry locking"
365 * Access checking: Let's avoid to lock other users' mail
366 * spool files if we aren't permitted to read them.
368 * Some simple-minded access (2) checking isn't sufficient
369 * here: The problem is that the user may give us a
370 * deeply nested path to a file which has the same name
371 * as the file he wants to lock, but different
372 * permissions, say, e.g.
373 * /tmp/lots/of/subdirs/var/spool/mail/root.
375 * He may then try to replace /tmp/lots/of/subdirs by a
376 * symbolic link to / after we have invoked access () to
377 * check the file's permissions. The lockfile we'd
378 * create or remove would then actually be
379 * /var/spool/mail/root.
381 * To avoid this attack, we proceed as follows:
383 * - First, follow symbolic links a la
384 * dotlock_deference_symlink ().
386 * - get the result's dirname.
388 * - chdir to this directory. If you can't, bail out.
390 * - try to open the file in question, only using its
391 * basename. If you can't, bail out.
393 * - fstat that file and compare the result to a
394 * subsequent lstat (only using the basename). If
395 * the comparison fails, bail out.
397 * dotlock_prepare () is invoked from main () directly
398 * after the command line parsing has been done.
402 * 0 - Evereything's fine. The program's new current
403 * directory is the contains the file to be locked.
404 * The string pointed to by bn contains the name of
405 * the file to be locked.
407 * -1 - Something failed. Don't continue.
413 dotlock_check_stats (struct stat *fsb, struct stat *lsb)
415 /* S_ISLNK (fsb->st_mode) should actually be impossible,
416 * but we may have mixed up the parameters somewhere.
420 if (S_ISLNK (lsb->st_mode) || S_ISLNK (fsb->st_mode))
423 if ((lsb->st_dev != fsb->st_dev) ||
424 (lsb->st_ino != fsb->st_ino) ||
425 (lsb->st_mode != fsb->st_mode) ||
426 (lsb->st_nlink != fsb->st_nlink) ||
427 (lsb->st_uid != fsb->st_uid) ||
428 (lsb->st_gid != fsb->st_gid) ||
429 (lsb->st_rdev != fsb->st_rdev) ||
430 (lsb->st_size != fsb->st_size))
432 /* something's fishy */
440 dotlock_prepare (char *bn, size_t l, const char *f, int _fd)
442 struct stat fsb, lsb;
443 char realpath[_POSIX_PATH_MAX];
444 char *basename, *dirname;
449 if (dotlock_deference_symlink (realpath, sizeof (realpath), f) == -1)
452 if ((p = strrchr (realpath, '/')))
464 if (strlen (basename) + 1 > l)
467 strfcpy (bn, basename, l);
469 if (chdir (dirname) == -1)
474 else if ((fd = open (basename, O_RDONLY)) == -1)
477 r = fstat (fd, &fsb);
485 if (lstat (basename, &lsb) == -1)
488 if (dotlock_check_stats (&fsb, &lsb) == -1)
495 * Expand a symbolic link.
497 * This function expects newpath to have space for
498 * at least _POSIX_PATH_MAX characters.
503 dotlock_expand_link (char *newpath, const char *path, const char *link)
505 const char *lb = NULL;
508 /* link is full path */
511 strfcpy (newpath, link, _POSIX_PATH_MAX);
515 if ((lb = strrchr (path, '/')) == NULL)
517 /* no path in link */
518 strfcpy (newpath, link, _POSIX_PATH_MAX);
523 memcpy (newpath, path, len);
524 strfcpy (newpath + len, link, _POSIX_PATH_MAX - len);
529 * Deference a chain of symbolic links
531 * The final path is written to d.
536 dotlock_deference_symlink (char *d, size_t l, const char *path)
539 char realpath[_POSIX_PATH_MAX];
540 const char *pathptr = path;
543 while (count++ < MAXLINKS)
545 if (lstat (pathptr, &sb) == -1)
547 /* perror (pathptr); */
551 if (S_ISLNK (sb.st_mode))
553 char linkfile[_POSIX_PATH_MAX];
554 char linkpath[_POSIX_PATH_MAX];
557 if ((len = readlink (pathptr, linkfile, sizeof (linkfile))) == -1)
559 /* perror (pathptr); */
563 linkfile[len] = '\0';
564 dotlock_expand_link (linkpath, pathptr, linkfile);
565 strfcpy (realpath, linkpath, sizeof (realpath));
572 strfcpy (d, pathptr, l);
579 * realpath is assumed _not_ to be an absolute path to
580 * the file we are about to lock. Invoke
581 * dotlock_prepare () before using this function!
585 #define HARDMAXATTEMPTS 10
588 dotlock_lock (const char *realpath)
590 char lockfile[_POSIX_PATH_MAX + LONG_STRING];
591 char nfslockfile[_POSIX_PATH_MAX + LONG_STRING];
592 size_t prev_size = 0;
599 snprintf (nfslockfile, sizeof (nfslockfile), "%s.%s.%d",
600 realpath, Hostname, (int) getpid ());
601 snprintf (lockfile, sizeof (lockfile), "%s.lock", realpath);
606 unlink (nfslockfile);
608 while ((fd = open (nfslockfile, O_WRONLY | O_EXCL | O_CREAT, 0)) < 0)
615 /* perror ("cannot open NFS lock file"); */
628 while (hard_count++ < HARDMAXATTEMPTS)
632 link (nfslockfile, lockfile);
635 if (stat (nfslockfile, &sb) != 0)
637 /* perror ("stat"); */
641 if (sb.st_nlink == 2)
645 prev_size = sb.st_size;
647 if (prev_size == sb.st_size && ++count > Retry)
649 if (DotlockFlags & DL_FL_FORCE)
661 unlink (nfslockfile);
667 prev_size = sb.st_size;
669 /* don't trust sleep (3) as it may be interrupted
670 * by users sending signals.
676 } while (time (NULL) == t);
680 unlink (nfslockfile);
690 * The same comment as for dotlock_lock () applies here.
695 dotlock_unlock (const char *realpath)
697 char lockfile[_POSIX_PATH_MAX + LONG_STRING];
700 snprintf (lockfile, sizeof (lockfile), "%s.lock",
704 i = unlink (lockfile);
713 /* remove an empty file */
716 dotlock_unlink (const char *realpath)
721 if (dotlock_lock (realpath) != DL_EX_OK)
724 if ((i = lstat (realpath, &lsb)) == 0 && lsb.st_size == 0)
727 dotlock_unlock (realpath);
729 return (i == 0) ? DL_EX_OK : DL_EX_ERROR;
734 * Check if a file can be locked at all.
736 * The same comment as for dotlock_lock () applies here.
747 if (access (".", W_OK) == 0)
751 if (stat (".", &sb) == 0)
753 if ((sb.st_mode & S_IWGRP) == S_IWGRP && sb.st_gid == MailGid)
754 return DL_EX_NEED_PRIVS;
758 return DL_EX_IMPOSSIBLE;