xz-archive/src/lzma/io.c

///////////////////////////////////////////////////////////////////////////////
//
/// \file       io.c
/// \brief      File opening, unlinking, and closing
//
//  Copyright (C) 2007 Lasse Collin
//
//  This program is free software; you can redistribute it and/or
//  modify it under the terms of the GNU Lesser General Public
//  License as published by the Free Software Foundation; either
//  version 2.1 of the License, or (at your option) any later version.
//
//  This program is distributed in the hope that it will be useful,
//  but WITHOUT ANY WARRANTY; without even the implied warranty of
//  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
//  Lesser General Public License for more details.
//
///////////////////////////////////////////////////////////////////////////////

#include "private.h"

#if defined(HAVE_FUTIMES) || defined(HAVE_FUTIMESAT)
#	include <sys/time.h>
#endif

#ifndef O_SEARCH
#	define O_SEARCH O_RDONLY
#endif


/// \brief      Number of open file_pairs
///
/// Once the main() function has requested processing of all files,
/// we wait that open_pairs drops back to zero. Then it is safe to
/// exit from the program.
static size_t open_pairs = 0;


/// \brief      mutex for file system operations
///
/// All file system operations are done via the functions in this file.
/// They use fchdir() to avoid some race conditions (more portable than
/// openat() & co.).
///
/// Synchronizing all file system operations shouldn't affect speed notably,
/// since the actual reading from and writing to files is done in parallel.
static pthread_mutex_t mutex = PTHREAD_MUTEX_INITIALIZER;


/// This condition is invoked when a file is closed and the value of
/// the open_files variable has dropped to zero. The only listener for
/// this condition is io_finish() which is called from main().
static pthread_cond_t io_cond = PTHREAD_COND_INITIALIZER;


/// True when stdout is being used by some thread
static bool stdout_in_use = false;


/// This condition is signalled when a thread releases stdout (no longer
/// writes data to it).
static pthread_cond_t stdout_cond = PTHREAD_COND_INITIALIZER;


/// \brief      Directory where we were started
///
/// This is needed when a new file, whose name was given on command line,
/// is opened.
static int start_dir;


static uid_t uid;
static gid_t gid;


extern void
io_init(void)
{
	start_dir = open(".", O_SEARCH | O_NOCTTY);
	if (start_dir == -1) {
		errmsg(V_ERROR, _("Cannot get file descriptor of the current "
				"directory: %s"), strerror(errno));
		my_exit(ERROR);
	}

	uid = getuid();
	gid = getgid();

	return;
}


/// Waits until the number of open file_pairs has dropped to zero.
extern void
io_finish(void)
{
	pthread_mutex_lock(&mutex);

	while (open_pairs != 0)
		pthread_cond_wait(&io_cond, &mutex);

	(void)close(start_dir);

	pthread_mutex_unlock(&mutex);

	return;
}


/// \brief      Unlinks a file
///
/// \param      dir_fd  File descriptor of the directory containing the file
/// \param      name    Name of the file with or without path
///
/// \return     Zero on success. On error, -1 is returned and errno set.
///
static void
io_unlink(int dir_fd, const char *name, ino_t ino)
{
	const char *base = str_filename(name);
	if (base == NULL) {
		// This shouldn't happen.
		errmsg(V_ERROR, _("%s: Invalid filename"), name);
		return;
	}

	pthread_mutex_lock(&mutex);

	if (fchdir(dir_fd)) {
		errmsg(V_ERROR, _("Cannot change directory: %s"),
				strerror(errno));
	} else {
		struct stat st;
		if (lstat(base, &st) || st.st_ino != ino)
			errmsg(V_ERROR, _("%s: File seems to be moved, "
					"not removing"), name);

		// There's a race condition between lstat() and unlink()
		// but at least we have tried to avoid removing wrong file.
		else if (unlink(base))
			errmsg(V_ERROR, _("%s: Cannot remove: %s"),
					name, strerror(errno));
	}

	pthread_mutex_unlock(&mutex);

	return;
}


/// \brief      Copies owner/group and permissions
///
/// \todo       ACL and EA support
///
static void
io_copy_attrs(const file_pair *pair)
{
	// This function is more tricky than you may think at first.
	// Blindly copying permissions may permit users to access the
	// destination file who didn't have permission to access the
	// source file.

	if (uid == 0 && fchown(pair->dest_fd, pair->src_st.st_uid, -1))
		errmsg(V_WARNING, _("%s: Cannot set the file owner: %s"),
				pair->dest_name, strerror(errno));

	mode_t mode;

	if (fchown(pair->dest_fd, -1, pair->src_st.st_gid)) {
		errmsg(V_WARNING, _("%s: Cannot set the file group: %s"),
				pair->dest_name, strerror(errno));
		// We can still safely copy some additional permissions:
		// `group' must be at least as strict as `other' and
		// also vice versa.
		//
		// NOTE: After this, the owner of the source file may
		// get additional permissions. This shouldn't be too bad,
		// because the owner would have had permission to chmod
		// the original file anyway.
		mode = ((pair->src_st.st_mode & 0070) >> 3)
				& (pair->src_st.st_mode & 0007);
		mode = (pair->src_st.st_mode & 0700) | (mode << 3) | mode;
	} else {
		// Drop the setuid, setgid, and sticky bits.
		mode = pair->src_st.st_mode & 0777;
	}

	if (fchmod(pair->dest_fd, mode))
		errmsg(V_WARNING, _("%s: Cannot set the file permissions: %s"),
				pair->dest_name, strerror(errno));

	// Copy the timestamps only if we have a secure function to do it.
#if defined(HAVE_FUTIMES) || defined(HAVE_FUTIMESAT)
	struct timeval tv[2];
	tv[0].tv_sec = pair->src_st.st_atime;
	tv[1].tv_sec = pair->src_st.st_mtime;

#	if defined(HAVE_STRUCT_STAT_ST_ATIM_TV_NSEC)
	tv[0].tv_usec = pair->src_st.st_atim.tv_nsec / 1000;
#	elif defined(HAVE_STRUCT_STAT_ST_ATIMESPEC_TV_NSEC)
	tv[0].tv_usec = pair->src_st.st_atimespec.tv_nsec / 1000;
#	else
	tv[0].tv_usec = 0;
#	endif

#	if defined(HAVE_STRUCT_STAT_ST_MTIM_TV_NSEC)
	tv[1].tv_usec = pair->src_st.st_mtim.tv_nsec / 1000;
#	elif defined(HAVE_STRUCT_STAT_ST_MTIMESPEC_TV_NSEC)
	tv[1].tv_usec = pair->src_st.st_mtimespec.tv_nsec / 1000;
#	else
	tv[1].tv_usec = 0;
#	endif

#	ifdef HAVE_FUTIMES
	(void)futimes(pair->dest_fd, tv);
#	else
	(void)futimesat(pair->dest_fd, NULL, tv);
#	endif
#endif

	return;
}


/// Opens and changes into the directory containing the source file.
static int
io_open_dir(file_pair *pair)
{
	if (pair->src_name == stdin_filename)
		return 0;

	if (fchdir(start_dir)) {
		errmsg(V_ERROR, _("Cannot change directory: %s"),
				strerror(errno));
		return -1;
	}

	const char *split = strrchr(pair->src_name, '/');
	if (split == NULL) {
		pair->dir_fd = start_dir;
	} else {
		// Copy also the slash. It's needed to support filenames
		// like "/foo" (dirname being "/"), and it never hurts anyway.
		const size_t dirname_len = split - pair->src_name + 1;
		char dirname[dirname_len + 1];
		memcpy(dirname, pair->src_name, dirname_len);
		dirname[dirname_len] = '\0';

		// Open the directory and change into it.
		pair->dir_fd = open(dirname, O_SEARCH | O_NOCTTY);
		if (pair->dir_fd == -1 || fchdir(pair->dir_fd)) {
			errmsg(V_ERROR, _("%s: Cannot open the directory "
					"containing the file: %s"),
					pair->src_name, strerror(errno));
			(void)close(pair->dir_fd);
			return -1;
		}
	}

	return 0;
}


static void
io_close_dir(file_pair *pair)
{
	if (pair->dir_fd != start_dir)
		(void)close(pair->dir_fd);

	return;
}


/// Opens the source file. The file is opened using the plain filename without
/// path, thus the file must be in the current working directory. This is
/// ensured because io_open_dir() is always called before this function.
static int
io_open_src(file_pair *pair)
{
	if (pair->src_name == stdin_filename) {
		pair->src_fd = STDIN_FILENO;
	} else {
		// Strip the pathname. Thanks to io_open_dir(), the file
		// is now in the current working directory.
		const char *filename = str_filename(pair->src_name);
		if (filename == NULL)
			return -1;

		// Symlinks are followed if --stdout or --force has been
		// specified.
		const bool follow_symlinks = opt_stdout || opt_force;
		pair->src_fd = open(filename, O_RDONLY | O_NOCTTY
				| (follow_symlinks ? 0 : O_NOFOLLOW));
		if (pair->src_fd == -1) {
			// Give an understandable error message in if reason
			// for failing was that the file was a symbolic link.
			//  - Linux, OpenBSD, Solaris: ELOOP
			//  - FreeBSD: EMLINK
			//  - Tru64: ENOTSUP
			// It seems to be safe to check for all these, since
			// those errno values aren't used for other purporses
			// on any of the listed operating system *when* the
			// above flags are used with open().
			if (!follow_symlinks
					&& (errno == ELOOP
#ifdef EMLINK
					|| errno == EMLINK
#endif
#ifdef ENOTSUP
					|| errno == ENOTSUP
#endif
					)) {
				errmsg(V_WARNING, _("%s: Is a symbolic link, "
						"skipping"), pair->src_name);
			} else {
				errmsg(V_ERROR, "%s: %s", pair->src_name,
						strerror(errno));
			}

			return -1;
		}

		if (fstat(pair->src_fd, &pair->src_st)) {
			errmsg(V_ERROR, "%s: %s", pair->src_name,
					strerror(errno));
			goto error;
		}

		if (S_ISDIR(pair->src_st.st_mode)) {
			errmsg(V_WARNING, _("%s: Is a directory, skipping"),
					pair->src_name);
			goto error;
		}

		if (!opt_stdout) {
			if (!opt_force && !S_ISREG(pair->src_st.st_mode)) {
				errmsg(V_WARNING, _("%s: Not a regular file, "
						"skipping"), pair->src_name);
				goto error;
			}

			if (pair->src_st.st_mode & (S_ISUID | S_ISGID)) {
				// Setuid and setgid files are rejected even
				// with --force. This is good for security
				// (hopefully) but it's a bit weird to reject
				// file when --force was given. At least this
				// matches gzip's behavior.
				errmsg(V_WARNING, _("%s: File has setuid or "
						"setgid bit set, skipping"),
						pair->src_name);
				goto error;
			}

			if (!opt_force && (pair->src_st.st_mode & S_ISVTX)) {
				errmsg(V_WARNING, _("%s: File has sticky bit "
						"set, skipping"),
						pair->src_name);
				goto error;
			}

			if (pair->src_st.st_nlink > 1) {
				errmsg(V_WARNING, _("%s: Input file has more "
						"than one hard link, "
						"skipping"), pair->src_name);
				goto error;
			}
		}
	}

	return 0;

error:
	(void)close(pair->src_fd);
	return -1;
}


/// \brief      Closes source file of the file_pair structure
///
/// \param      pair    File whose src_fd should be closed
/// \param      success If true, the file will be removed from the disk if
///                     closing succeeds and --keep hasn't been used.
static void
io_close_src(file_pair *pair, bool success)
{
	if (pair->src_fd == STDIN_FILENO || pair->src_fd == -1)
		return;

	if (close(pair->src_fd)) {
		errmsg(V_ERROR, _("%s: Closing the file failed: %s"),
				pair->src_name, strerror(errno));
	} else if (success && !opt_keep_original) {
		io_unlink(pair->dir_fd, pair->src_name, pair->src_st.st_ino);
	}

	return;
}


static int
io_open_dest(file_pair *pair)
{
	if (opt_stdout || pair->src_fd == STDIN_FILENO) {
		// We don't modify or free() this.
		pair->dest_name = (char *)"(stdout)";
		pair->dest_fd = STDOUT_FILENO;

		// Synchronize the order in which files get written to stdout.
		// Unlocking the mutex is safe, because opening the file_pair
		// can no longer fail.
		while (stdout_in_use)
			pthread_cond_wait(&stdout_cond, &mutex);

		stdout_in_use = true;

	} else {
		pair->dest_name = get_dest_name(pair->src_name);
		if (pair->dest_name == NULL)
			return -1;

		// This cannot fail, because get_dest_name() doesn't return
		// invalid names.
		const char *filename = str_filename(pair->dest_name);
		assert(filename != NULL);

		pair->dest_fd = open(filename, O_WRONLY | O_NOCTTY | O_CREAT
				| (opt_force ? O_TRUNC : O_EXCL),
				S_IRUSR | S_IWUSR);
		if (pair->dest_fd == -1) {
			errmsg(V_ERROR, "%s: %s", pair->dest_name,
					strerror(errno));
			free(pair->dest_name);
			return -1;
		}

		// If this really fails... well, we have a safe fallback.
		struct stat st;
		if (fstat(pair->dest_fd, &st))
			pair->dest_ino = 0;
		else
			pair->dest_ino = st.st_ino;
	}

	return 0;
}


/// \brief      Closes destination file of the file_pair structure
///
/// \param      pair    File whose dest_fd should be closed
/// \param      success If false, the file will be removed from the disk.
///
/// \return     Zero if closing succeeds. On error, -1 is returned and
///             error message printed.
static int
io_close_dest(file_pair *pair, bool success)
{
	if (pair->dest_fd == -1)
		return 0;

	if (pair->dest_fd == STDOUT_FILENO) {
		stdout_in_use = false;
		pthread_cond_signal(&stdout_cond);
		return 0;
	}

	if (close(pair->dest_fd)) {
		errmsg(V_ERROR, _("%s: Closing the file failed: %s"),
				pair->dest_name, strerror(errno));

		// Closing destination file failed, so we cannot trust its
		// contents. Get rid of junk:
		io_unlink(pair->dir_fd, pair->dest_name, pair->dest_ino);
		free(pair->dest_name);
		return -1;
	}

	// If the operation using this file wasn't successful, we git rid
	// of the junk file.
	if (!success)
		io_unlink(pair->dir_fd, pair->dest_name, pair->dest_ino);

	free(pair->dest_name);

	return 0;
}


extern file_pair *
io_open(const char *src_name)
{
	if (is_empty_filename(src_name))
		return NULL;

	file_pair *pair = malloc(sizeof(file_pair));
	if (pair == NULL) {
		out_of_memory();
		return NULL;
	}

	*pair = (file_pair){
		.src_name = src_name,
		.dest_name = NULL,
		.dir_fd = -1,
		.src_fd = -1,
		.dest_fd = -1,
		.src_eof = false,
	};

	pthread_mutex_lock(&mutex);

	++open_pairs;

	if (io_open_dir(pair))
		goto error_dir;

	if (io_open_src(pair))
		goto error_src;

	if (user_abort || io_open_dest(pair))
		goto error_dest;

	pthread_mutex_unlock(&mutex);

	return pair;

error_dest:
	io_close_src(pair, false);
error_src:
	io_close_dir(pair);
error_dir:
	--open_pairs;
	pthread_mutex_unlock(&mutex);
	free(pair);
	return NULL;
}


/// \brief      Closes the file descriptors and frees the structure
extern void
io_close(file_pair *pair, bool success)
{
	if (success && pair->dest_fd != STDOUT_FILENO)
		io_copy_attrs(pair);

	// Close the destination first. If it fails, we must not remove
	// the source file!
	if (!io_close_dest(pair, success)) {
		// Closing destination file succeeded. Remove the source file
		// if the operation using this file pair was successful
		// and we haven't been requested to keep the source file.
		io_close_src(pair, success);
	} else {
		// We don't care if operation using this file pair was
		// successful or not, since closing the destination file
		// failed. Don't remove the original file.
		io_close_src(pair, false);
	}

	io_close_dir(pair);

	free(pair);

	pthread_mutex_lock(&mutex);

	if (--open_pairs == 0)
		pthread_cond_signal(&io_cond);

	pthread_mutex_unlock(&mutex);

	return;
}


/// \brief      Reads from a file to a buffer
///
/// \param      pair    File pair having the sourcefile open for reading
/// \param      buf     Destination buffer to hold the read data
/// \param      size    Size of the buffer; assumed be smaller than SSIZE_MAX
///
/// \return     On success, number of bytes read is returned. On end of
///             file zero is returned and pair->src_eof set to true.
///             On error, SIZE_MAX is returned and error message printed.
///
/// \note       This does no locking, thus two threads must not read from
///             the same file. This no problem in this program.
extern size_t
io_read(file_pair *pair, uint8_t *buf, size_t size)
{
	// We use small buffers here.
	assert(size < SSIZE_MAX);

	size_t left = size;

	while (left > 0) {
		const ssize_t amount = read(pair->src_fd, buf, left);

		if (amount == 0) {
			pair->src_eof = true;
			break;
		}

		if (amount == -1) {
			if (errno == EINTR) {
				if (user_abort)
					return SIZE_MAX;

				continue;
			}

			errmsg(V_ERROR, _("%s: Read error: %s"),
					pair->src_name, strerror(errno));

			// FIXME Is this needed?
			pair->src_eof = true;

			return SIZE_MAX;
		}

		buf += (size_t)(amount);
		left -= (size_t)(amount);
	}

	return size - left;
}


/// \brief      Writes a buffer to a file
///
/// \param      pair    File pair having the destination file open for writing
/// \param      buf     Buffer containing the data to be written
/// \param      size    Size of the buffer; assumed be smaller than SSIZE_MAX
///
/// \return     On success, zero is returned. On error, -1 is returned
///             and error message printed.
///
/// \note       This does no locking, thus two threads must not write to
///             the same file. This no problem in this program.
extern int
io_write(const file_pair *pair, const uint8_t *buf, size_t size)
{
	assert(size < SSIZE_MAX);

	while (size > 0) {
		const ssize_t amount = write(pair->dest_fd, buf, size);
		if (amount == -1) {
			if (errno == EINTR) {
				if (user_abort)
					return -1;

				continue;
			}

			// Handle broken pipe specially. gzip and bzip2
			// don't print anything on SIGPIPE. In addition,
			// gzip --quiet uses exit status 2 (warning) on
			// broken pipe instead of whatever raise(SIGPIPE)
			// would make it return. It is there to hide "Broken
			// pipe" message on some old shells (probably old
			// GNU bash).
			//
			// We don't do anything special with --quiet, which
			// is what bzip2 does too. However, we print a
			// message if --verbose was used (or should that
			// only be with double --verbose i.e. debugging?).
			errmsg(errno == EPIPE ? V_VERBOSE : V_ERROR,
					_("%s: Write error: %s"),
					pair->dest_name, strerror(errno));
			return -1;
		}

		buf += (size_t)(amount);
		size -= (size_t)(amount);
	}

	return 0;
}