1 /*
2 * 9p utilities
3 *
4 * Copyright IBM, Corp. 2017
5 *
6 * Authors:
7 * Greg Kurz <groug@kaod.org>
8 *
9 * This work is licensed under the terms of the GNU GPL, version 2 or later.
10 * See the COPYING file in the top-level directory.
11 */
12
13 #ifndef QEMU_9P_UTIL_H
14 #define QEMU_9P_UTIL_H
15
16 #include "qemu/error-report.h"
17
18 #ifdef O_PATH
19 #define O_PATH_9P_UTIL O_PATH
20 #else
21 #define O_PATH_9P_UTIL 0
22 #endif
23
24 #if !defined(CONFIG_LINUX)
25
26 /*
27 * Generates a Linux device number (a.k.a. dev_t) for given device major
28 * and minor numbers.
29 *
30 * To be more precise: it generates a device number in glibc's format
31 * (MMMM_Mmmm_mmmM_MMmm, 64 bits) actually, which is compatible with
32 * Linux's format (mmmM_MMmm, 32 bits), as described in <bits/sysmacros.h>.
33 */
makedev_dotl(uint32_t dev_major,uint32_t dev_minor)34 static inline uint64_t makedev_dotl(uint32_t dev_major, uint32_t dev_minor)
35 {
36 uint64_t dev;
37
38 // from glibc sysmacros.h:
39 dev = (((uint64_t) (dev_major & 0x00000fffu)) << 8);
40 dev |= (((uint64_t) (dev_major & 0xfffff000u)) << 32);
41 dev |= (((uint64_t) (dev_minor & 0x000000ffu)) << 0);
42 dev |= (((uint64_t) (dev_minor & 0xffffff00u)) << 12);
43 return dev;
44 }
45
46 #endif
47
48 /*
49 * Converts given device number from host's device number format to Linux
50 * device number format. As both the size of type dev_t and encoding of
51 * dev_t is system dependent, we have to convert them for Linux guests if
52 * host is not running Linux.
53 */
host_dev_to_dotl_dev(dev_t dev)54 static inline uint64_t host_dev_to_dotl_dev(dev_t dev)
55 {
56 #ifdef CONFIG_LINUX
57 return dev;
58 #else
59 return makedev_dotl(major(dev), minor(dev));
60 #endif
61 }
62
63 /* Translates errno from host -> Linux if needed */
errno_to_dotl(int err)64 static inline int errno_to_dotl(int err) {
65 #if defined(CONFIG_LINUX)
66 /* nothing to translate (Linux -> Linux) */
67 #elif defined(CONFIG_DARWIN)
68 /*
69 * translation mandatory for macOS hosts
70 *
71 * FIXME: Only most important errnos translated here yet, this should be
72 * extended to as many errnos being translated as possible in future.
73 */
74 if (err == ENAMETOOLONG) {
75 err = 36; /* ==ENAMETOOLONG on Linux */
76 } else if (err == ENOTEMPTY) {
77 err = 39; /* ==ENOTEMPTY on Linux */
78 } else if (err == ELOOP) {
79 err = 40; /* ==ELOOP on Linux */
80 } else if (err == ENOATTR) {
81 err = 61; /* ==ENODATA on Linux */
82 } else if (err == ENOTSUP) {
83 err = 95; /* ==EOPNOTSUPP on Linux */
84 } else if (err == EOPNOTSUPP) {
85 err = 95; /* ==EOPNOTSUPP on Linux */
86 }
87 #else
88 #error Missing errno translation to Linux for this host system
89 #endif
90 return err;
91 }
92
93 #ifdef CONFIG_DARWIN
94 #define qemu_fgetxattr(...) fgetxattr(__VA_ARGS__, 0, 0)
95 #else
96 #define qemu_fgetxattr fgetxattr
97 #endif
98
99 #define qemu_openat openat
100 #define qemu_fstat fstat
101 #define qemu_fstatat fstatat
102 #define qemu_mkdirat mkdirat
103 #define qemu_renameat renameat
104 #define qemu_utimensat utimensat
105 #define qemu_unlinkat unlinkat
106 #define qemu_futimens futimens
107
close_preserve_errno(int fd)108 static inline void close_preserve_errno(int fd)
109 {
110 int serrno = errno;
111 close(fd);
112 errno = serrno;
113 }
114
115 /**
116 * close_if_special_file() - Close @fd if neither regular file nor directory.
117 *
118 * @fd: file descriptor of open file
119 * Return: 0 on regular file or directory, -1 otherwise
120 *
121 * CVE-2023-2861: Prohibit opening any special file directly on host
122 * (especially device files), as a compromised client could potentially gain
123 * access outside exported tree under certain, unsafe setups. We expect
124 * client to handle I/O on special files exclusively on guest side.
125 */
close_if_special_file(int fd)126 static inline int close_if_special_file(int fd)
127 {
128 struct stat stbuf;
129
130 if (qemu_fstat(fd, &stbuf) < 0) {
131 close_preserve_errno(fd);
132 return -1;
133 }
134 if (!S_ISREG(stbuf.st_mode) && !S_ISDIR(stbuf.st_mode)) {
135 error_report_once(
136 "9p: broken or compromised client detected; attempt to open "
137 "special file (i.e. neither regular file, nor directory)"
138 );
139 close(fd);
140 errno = ENXIO;
141 return -1;
142 }
143
144 return 0;
145 }
146
openat_dir(int dirfd,const char * name)147 static inline int openat_dir(int dirfd, const char *name)
148 {
149 return qemu_openat(dirfd, name,
150 O_DIRECTORY | O_RDONLY | O_NOFOLLOW | O_PATH_9P_UTIL);
151 }
152
openat_file(int dirfd,const char * name,int flags,mode_t mode)153 static inline int openat_file(int dirfd, const char *name, int flags,
154 mode_t mode)
155 {
156 int fd, serrno, ret;
157
158 #ifndef CONFIG_DARWIN
159 again:
160 #endif
161 fd = qemu_openat(dirfd, name, flags | O_NOFOLLOW | O_NOCTTY | O_NONBLOCK,
162 mode);
163 if (fd == -1) {
164 #ifndef CONFIG_DARWIN
165 if (errno == EPERM && (flags & O_NOATIME)) {
166 /*
167 * The client passed O_NOATIME but we lack permissions to honor it.
168 * Rather than failing the open, fall back without O_NOATIME. This
169 * doesn't break the semantics on the client side, as the Linux
170 * open(2) man page notes that O_NOATIME "may not be effective on
171 * all filesystems". In particular, NFS and other network
172 * filesystems ignore it entirely.
173 */
174 flags &= ~O_NOATIME;
175 goto again;
176 }
177 #endif
178 return -1;
179 }
180
181 /* Only if O_PATH is not set ... */
182 if (!(flags & O_PATH_9P_UTIL)) {
183 /*
184 * Prevent I/O on special files (device files, etc.) on host side,
185 * however it is safe and required to allow opening them with O_PATH,
186 * as this is limited to (required) path based operations only.
187 */
188 if (close_if_special_file(fd) < 0) {
189 return -1;
190 }
191
192 serrno = errno;
193 /*
194 * O_NONBLOCK was only needed to open the file. Let's drop it. We don't
195 * do that with O_PATH since fcntl(F_SETFL) isn't supported, and
196 * openat() ignored it anyway.
197 */
198 ret = fcntl(fd, F_SETFL, flags);
199 assert(!ret);
200 errno = serrno;
201 }
202 return fd;
203 }
204
205 ssize_t fgetxattrat_nofollow(int dirfd, const char *path, const char *name,
206 void *value, size_t size);
207 int fsetxattrat_nofollow(int dirfd, const char *path, const char *name,
208 void *value, size_t size, int flags);
209 ssize_t flistxattrat_nofollow(int dirfd, const char *filename,
210 char *list, size_t size);
211 ssize_t fremovexattrat_nofollow(int dirfd, const char *filename,
212 const char *name);
213
214 /*
215 * Darwin has d_seekoff, which appears to function similarly to d_off.
216 * However, it does not appear to be supported on all file systems,
217 * so ensure it is manually injected earlier and call here when
218 * needed.
219 */
qemu_dirent_off(struct dirent * dent)220 static inline off_t qemu_dirent_off(struct dirent *dent)
221 {
222 #ifdef CONFIG_DARWIN
223 return dent->d_seekoff;
224 #else
225 return dent->d_off;
226 #endif
227 }
228
229 /**
230 * qemu_dirent_dup() - Duplicate directory entry @dent.
231 *
232 * @dent: original directory entry to be duplicated
233 * Return: duplicated directory entry which should be freed with g_free()
234 *
235 * It is highly recommended to use this function instead of open coding
236 * duplication of dirent objects, because the actual struct dirent
237 * size may be bigger or shorter than sizeof(struct dirent) and correct
238 * handling is platform specific (see gitlab issue #841).
239 */
qemu_dirent_dup(struct dirent * dent)240 static inline struct dirent *qemu_dirent_dup(struct dirent *dent)
241 {
242 size_t sz = 0;
243 #if defined _DIRENT_HAVE_D_RECLEN
244 /* Avoid use of strlen() if platform supports d_reclen. */
245 sz = dent->d_reclen;
246 #endif
247 /*
248 * Test sz for zero even if d_reclen is available
249 * because some drivers may set d_reclen to zero.
250 */
251 if (sz == 0) {
252 /* Fallback to the most portable way. */
253 sz = offsetof(struct dirent, d_name) +
254 strlen(dent->d_name) + 1;
255 }
256 return g_memdup(dent, sz);
257 }
258
259 /*
260 * As long as mknodat is not available on macOS, this workaround
261 * using pthread_fchdir_np is needed. qemu_mknodat is defined in
262 * os-posix.c. pthread_fchdir_np is weakly linked here as a guard
263 * in case it disappears in future macOS versions, because it is
264 * is a private API.
265 */
266 #if defined CONFIG_DARWIN && defined CONFIG_PTHREAD_FCHDIR_NP
267 int pthread_fchdir_np(int fd) __attribute__((weak_import));
268 #endif
269 int qemu_mknodat(int dirfd, const char *filename, mode_t mode, dev_t dev);
270
271 /*
272 * Returns a newly allocated string presentation of open() flags, intended
273 * for debugging (tracing) purposes only.
274 */
275 char *qemu_open_flags_tostr(int flags);
276
277 #endif
278