Apply patch to avoid truncating of arbitrary files. Thanks to Bryan

[apt.git] / apt-pkg / contrib / fileutl.cc

diff --git a/apt-pkg/contrib/fileutl.cc b/apt-pkg/contrib/fileutl.cc
index 5b7c76496461d1ac54b3c2d0c7b6a6348e4c752e..a5976cf3af811fb3abe6b3d0c966a6b2b6779b02 100644 (file)
--- a/apt-pkg/contrib/fileutl.cc
+++ b/apt-pkg/contrib/fileutl.cc
@@ -1,6 +1,6 @@
 // -*- mode: cpp; mode: fold -*-
 // Description                                                         /*{{{*/
 // -*- mode: cpp; mode: fold -*-
 // Description                                                         /*{{{*/

-// $Id: fileutl.cc,v 1.20 1999/02/12 20:47:41 doogie Exp $
+// $Id: fileutl.cc,v 1.42 2002/09/14 05:29:22 jgg Exp $

 /* ######################################################################
    
    File Utilities
 /* ######################################################################
    
    File Utilities


@@ -8,24 +8,99 @@
    CopyFile - Buffered copy of a single file
    GetLock - dpkg compatible lock file manipulation (fcntl)
    
    CopyFile - Buffered copy of a single file
    GetLock - dpkg compatible lock file manipulation (fcntl)
    

-   This source is placed in the Public Domain, do with it what you will
-   It was originally written by Jason Gunthorpe.
+   Most of this source is placed in the Public Domain, do with it what 
+   you will
+   It was originally written by Jason Gunthorpe <jgg@debian.org>.

    
    

+   The exception is RunScripts() it is under the GPLv2
+

    ##################################################################### */
                                                                        /*}}}*/
 // Include Files                                                       /*{{{*/
    ##################################################################### */
                                                                        /*}}}*/
 // Include Files                                                       /*{{{*/

-#ifdef __GNUG__
-#pragma implementation "apt-pkg/fileutl.h"
-#endif 

 #include <apt-pkg/fileutl.h>
 #include <apt-pkg/error.h>
 #include <apt-pkg/fileutl.h>
 #include <apt-pkg/error.h>

+#include <apt-pkg/sptr.h>
+#include <apt-pkg/configuration.h>
+
+#include <apti18n.h>
+
+#include <cstdlib>
+#include <cstring>

 
 

+#include <iostream>

 #include <unistd.h>
 #include <unistd.h>

+#include <fcntl.h>

 #include <sys/stat.h>
 #include <sys/stat.h>

-#include <sys/fcntl.h>

 #include <sys/types.h>
 #include <sys/time.h>
 #include <sys/types.h>
 #include <sys/time.h>

+#include <sys/wait.h>
+#include <signal.h>

 #include <errno.h>
 #include <errno.h>

+#include <set>
+                                                                       /*}}}*/
+
+using namespace std;
+
+// RunScripts - Run a set of scripts from a configuration subtree      /*{{{*/
+// ---------------------------------------------------------------------
+/* */
+bool RunScripts(const char *Cnf)
+{
+   Configuration::Item const *Opts = _config->Tree(Cnf);
+   if (Opts == 0 || Opts->Child == 0)
+      return true;
+   Opts = Opts->Child;
+
+   // Fork for running the system calls
+   pid_t Child = ExecFork();
+   
+   // This is the child
+   if (Child == 0)
+   {
+      if (chdir("/tmp/") != 0)
+        _exit(100);
+        
+      unsigned int Count = 1;
+      for (; Opts != 0; Opts = Opts->Next, Count++)
+      {
+        if (Opts->Value.empty() == true)
+           continue;
+        
+        if (system(Opts->Value.c_str()) != 0)
+           _exit(100+Count);
+      }
+      _exit(0);
+   }      
+
+   // Wait for the child
+   int Status = 0;
+   while (waitpid(Child,&Status,0) != Child)
+   {
+      if (errno == EINTR)
+        continue;
+      return _error->Errno("waitpid","Couldn't wait for subprocess");
+   }
+
+   // Restore sig int/quit
+   signal(SIGQUIT,SIG_DFL);
+   signal(SIGINT,SIG_DFL);   
+
+   // Check for an error code.
+   if (WIFEXITED(Status) == 0 || WEXITSTATUS(Status) != 0)
+   {
+      unsigned int Count = WEXITSTATUS(Status);
+      if (Count > 100)
+      {
+        Count -= 100;
+        for (; Opts != 0 && Count != 1; Opts = Opts->Next, Count--);
+        _error->Error("Problem executing scripts %s '%s'",Cnf,Opts->Value.c_str());
+      }
+      
+      return _error->Error("Sub-process returned an error code");
+   }
+   
+   return true;
+}

                                                                        /*}}}*/
 
 // CopyFile - Buffered copy of a file                                  /*{{{*/
                                                                        /*}}}*/
 
 // CopyFile - Buffered copy of a file                                  /*{{{*/


@@ -37,18 +112,21 @@ bool CopyFile(FileFd &From,FileFd &To)
       return false;
    
    // Buffered copy between fds
       return false;
    
    // Buffered copy between fds

-   unsigned char *Buf = new unsigned char[64000];
-   long Size;
-   while ((Size = read(From.Fd(),Buf,64000)) > 0)
+   SPtrArray<unsigned char> Buf = new unsigned char[64000];
+   unsigned long Size = From.Size();
+   while (Size != 0)

    {
    {

-      if (To.Write(Buf,Size) == false)
-      {
-        delete [] Buf;
+      unsigned long ToRead = Size;
+      if (Size > 64000)
+        ToRead = 64000;
+      
+      if (From.Read(Buf,ToRead) == false || 
+         To.Write(Buf,ToRead) == false)

         return false;
         return false;

-      }
+      
+      Size -= ToRead;

    }
 
    }
 

-   delete [] Buf;

    return true;   
 }
                                                                        /*}}}*/
    return true;   
 }
                                                                        /*}}}*/


@@ -60,14 +138,27 @@ bool CopyFile(FileFd &From,FileFd &To)
    close at some time. */
 int GetLock(string File,bool Errors)
 {
    close at some time. */
 int GetLock(string File,bool Errors)
 {

-   int FD = open(File.c_str(),O_RDWR | O_CREAT | O_TRUNC,0640);
+   // GetLock() is used in aptitude on directories with public-write access
+   // Use O_NOFOLLOW here to prevent symlink traversal attacks
+   int FD = open(File.c_str(),O_RDWR | O_CREAT | O_NOFOLLOW,0640);

    if (FD < 0)
    {
    if (FD < 0)
    {

+      // Read only .. cant have locking problems there.
+      if (errno == EROFS)
+      {
+        _error->Warning(_("Not using locking for read only lock file %s"),File.c_str());
+        return dup(0);       // Need something for the caller to close
+      }
+      

       if (Errors == true)
       if (Errors == true)

-        _error->Errno("open","Could not open lock file %s",File.c_str());
+        _error->Errno("open",_("Could not open lock file %s"),File.c_str());
+
+      // Feh.. We do this to distinguish the lock vs open case..
+      errno = EPERM;

       return -1;
    }
       return -1;
    }

-   
+   SetCloseExec(FD,true);
+      

    // Aquire a write lock
    struct flock fl;
    fl.l_type = F_WRLCK;
    // Aquire a write lock
    struct flock fl;
    fl.l_type = F_WRLCK;


@@ -76,9 +167,17 @@ int GetLock(string File,bool Errors)
    fl.l_len = 0;
    if (fcntl(FD,F_SETLK,&fl) == -1)
    {
    fl.l_len = 0;
    if (fcntl(FD,F_SETLK,&fl) == -1)
    {

+      if (errno == ENOLCK)
+      {
+        _error->Warning(_("Not using locking for nfs mounted lock file %s"),File.c_str());
+        return dup(0);       // Need something for the caller to close  
+      }      

       if (Errors == true)
       if (Errors == true)

-        _error->Errno("open","Could not get lock %s",File.c_str());
+        _error->Errno("open",_("Could not get lock %s"),File.c_str());
+      
+      int Tmp = errno;

       close(FD);
       close(FD);

+      errno = Tmp;

       return -1;
    }
 
       return -1;
    }
 


@@ -126,16 +225,85 @@ string flNotDir(string File)
                                                                        /*}}}*/
 // flNotFile - Strip the file from the directory name                  /*{{{*/
 // ---------------------------------------------------------------------
                                                                        /*}}}*/
 // flNotFile - Strip the file from the directory name                  /*{{{*/
 // ---------------------------------------------------------------------

-/* */
+/* Result ends in a / */

 string flNotFile(string File)
 {
    string::size_type Res = File.rfind('/');
    if (Res == string::npos)
 string flNotFile(string File)
 {
    string::size_type Res = File.rfind('/');
    if (Res == string::npos)

-      return File;
+      return "./";

    Res++;
    return string(File,0,Res);
 }
                                                                        /*}}}*/
    Res++;
    return string(File,0,Res);
 }
                                                                        /*}}}*/

+// flExtension - Return the extension for the file                     /*{{{*/
+// ---------------------------------------------------------------------
+/* */
+string flExtension(string File)
+{
+   string::size_type Res = File.rfind('.');
+   if (Res == string::npos)
+      return File;
+   Res++;
+   return string(File,Res,Res - File.length());
+}
+                                                                       /*}}}*/
+// flNoLink - If file is a symlink then deref it                       /*{{{*/
+// ---------------------------------------------------------------------
+/* If the name is not a link then the returned path is the input. */
+string flNoLink(string File)
+{
+   struct stat St;
+   if (lstat(File.c_str(),&St) != 0 || S_ISLNK(St.st_mode) == 0)
+      return File;
+   if (stat(File.c_str(),&St) != 0)
+      return File;
+   
+   /* Loop resolving the link. There is no need to limit the number of 
+      loops because the stat call above ensures that the symlink is not 
+      circular */
+   char Buffer[1024];
+   string NFile = File;
+   while (1)
+   {
+      // Read the link
+      int Res;
+      if ((Res = readlink(NFile.c_str(),Buffer,sizeof(Buffer))) <= 0 || 
+         (unsigned)Res >= sizeof(Buffer))
+         return File;
+      
+      // Append or replace the previous path
+      Buffer[Res] = 0;
+      if (Buffer[0] == '/')
+        NFile = Buffer;
+      else
+        NFile = flNotFile(NFile) + Buffer;
+      
+      // See if we are done
+      if (lstat(NFile.c_str(),&St) != 0)
+        return File;
+      if (S_ISLNK(St.st_mode) == 0)
+        return NFile;      
+   }   
+}
+                                                                       /*}}}*/
+// flCombine - Combine a file and a directory                          /*{{{*/
+// ---------------------------------------------------------------------
+/* If the file is an absolute path then it is just returned, otherwise
+   the directory is pre-pended to it. */
+string flCombine(string Dir,string File)
+{
+   if (File.empty() == true)
+      return string();
+   
+   if (File[0] == '/' || Dir.empty() == true)
+      return File;
+   if (File.length() >= 2 && File[0] == '.' && File[1] == '/')
+      return File;
+   if (Dir[Dir.length()-1] == '/')
+      return Dir + File;
+   return Dir + '/' + File;
+}
+                                                                       /*}}}*/

 // SetCloseExec - Set the close on exec flag                           /*{{{*/
 // ---------------------------------------------------------------------
 /* */
 // SetCloseExec - Set the close on exec flag                           /*{{{*/
 // ---------------------------------------------------------------------
 /* */


@@ -163,32 +331,144 @@ void SetNonBlock(int Fd,bool Block)
                                                                        /*}}}*/
 // WaitFd - Wait for a FD to become readable                           /*{{{*/
 // ---------------------------------------------------------------------
                                                                        /*}}}*/
 // WaitFd - Wait for a FD to become readable                           /*{{{*/
 // ---------------------------------------------------------------------

-/* This waits for a FD to become readable using select. It is usefull for
-   applications making use of non-blocking sockets. */
-bool WaitFd(int Fd, bool write = false, long timeout = 0)
+/* This waits for a FD to become readable using select. It is useful for
+   applications making use of non-blocking sockets. The timeout is 
+   in seconds. */
+bool WaitFd(int Fd,bool write,unsigned long timeout)

 {
    fd_set Set;
    struct timeval tv;
    FD_ZERO(&Set);
    FD_SET(Fd,&Set);
 {
    fd_set Set;
    struct timeval tv;
    FD_ZERO(&Set);
    FD_SET(Fd,&Set);

-   tv.tv_sec = timeout / 1000000;
-   tv.tv_usec = timeout % 1000000;
-   if(write) {
-      if (select(Fd+1,&Set,0,0,&tv) <= 0)
-         return false;
-   } else {
-      if (select(Fd+1,0,&Set,0,&tv) <= 0)
-         return false;
+   tv.tv_sec = timeout;
+   tv.tv_usec = 0;
+   if (write == true) 
+   {      
+      int Res;
+      do
+      {
+        Res = select(Fd+1,0,&Set,0,(timeout != 0?&tv:0));
+      }
+      while (Res < 0 && errno == EINTR);
+      
+      if (Res <= 0)
+        return false;
+   } 
+   else 
+   {
+      int Res;
+      do
+      {
+        Res = select(Fd+1,&Set,0,0,(timeout != 0?&tv:0));
+      }
+      while (Res < 0 && errno == EINTR);
+      
+      if (Res <= 0)
+        return false;

    }
    }

+   

    return true;
 }
                                                                        /*}}}*/
    return true;
 }
                                                                        /*}}}*/

+// ExecFork - Magical fork that sanitizes the context before execing   /*{{{*/
+// ---------------------------------------------------------------------
+/* This is used if you want to cleanse the environment for the forked 
+   child, it fixes up the important signals and nukes all of the fds,
+   otherwise acts like normal fork. */
+pid_t ExecFork()
+{
+   // Fork off the process
+   pid_t Process = fork();
+   if (Process < 0)
+   {
+      cerr << "FATAL -> Failed to fork." << endl;
+      exit(100);
+   }

 
 

-// FileFd::FileFd - Open a file                                                /*{{{*/
+   // Spawn the subprocess
+   if (Process == 0)
+   {
+      // Setup the signals
+      signal(SIGPIPE,SIG_DFL);
+      signal(SIGQUIT,SIG_DFL);
+      signal(SIGINT,SIG_DFL);
+      signal(SIGWINCH,SIG_DFL);
+      signal(SIGCONT,SIG_DFL);
+      signal(SIGTSTP,SIG_DFL);
+
+      set<int> KeepFDs;
+      Configuration::Item const *Opts = _config->Tree("APT::Keep-Fds");
+      if (Opts != 0 && Opts->Child != 0)
+      {
+        Opts = Opts->Child;
+        for (; Opts != 0; Opts = Opts->Next)
+        {
+           if (Opts->Value.empty() == true)
+              continue;
+           int fd = atoi(Opts->Value.c_str());
+           KeepFDs.insert(fd);
+        }
+      }
+
+      // Close all of our FDs - just in case
+      for (int K = 3; K != 40; K++)
+      {
+        if(KeepFDs.find(K) == KeepFDs.end())
+           fcntl(K,F_SETFD,FD_CLOEXEC);
+      }
+   }
+   
+   return Process;
+}
+                                                                       /*}}}*/
+// ExecWait - Fancy waitpid                                            /*{{{*/
+// ---------------------------------------------------------------------
+/* Waits for the given sub process. If Reap is set then no errors are 
+   generated. Otherwise a failed subprocess will generate a proper descriptive
+   message */
+bool ExecWait(pid_t Pid,const char *Name,bool Reap)
+{
+   if (Pid <= 1)
+      return true;
+   
+   // Wait and collect the error code
+   int Status;
+   while (waitpid(Pid,&Status,0) != Pid)
+   {
+      if (errno == EINTR)
+        continue;
+
+      if (Reap == true)
+        return false;
+      
+      return _error->Error(_("Waited for %s but it wasn't there"),Name);
+   }
+
+   
+   // Check for an error code.
+   if (WIFEXITED(Status) == 0 || WEXITSTATUS(Status) != 0)
+   {
+      if (Reap == true)
+        return false;
+      if (WIFSIGNALED(Status) != 0 && WTERMSIG(Status) == SIGSEGV)
+        return _error->Error(_("Sub-process %s received a segmentation fault."),Name);
+
+      if (WIFEXITED(Status) != 0)
+        return _error->Error(_("Sub-process %s returned an error code (%u)"),Name,WEXITSTATUS(Status));
+      
+      return _error->Error(_("Sub-process %s exited unexpectedly"),Name);
+   }      
+   
+   return true;
+}
+                                                                       /*}}}*/
+
+// FileFd::Open - Open a file                                          /*{{{*/

 // ---------------------------------------------------------------------
 /* The most commonly used open mode combinations are given with Mode */
 // ---------------------------------------------------------------------
 /* The most commonly used open mode combinations are given with Mode */

-FileFd::FileFd(string FileName,OpenMode Mode, unsigned long Perms)
+bool FileFd::Open(string FileName,OpenMode Mode, unsigned long Perms)

 {
 {

+   Close();

    Flags = AutoClose;
    switch (Mode)
    {
    Flags = AutoClose;
    switch (Mode)
    {


@@ -199,7 +479,7 @@ FileFd::FileFd(string FileName,OpenMode Mode, unsigned long Perms)
       case WriteEmpty:
       {
         struct stat Buf;
       case WriteEmpty:
       {
         struct stat Buf;

-        if (stat(FileName.c_str(),&Buf) == 0 && S_ISLNK(Buf.st_mode))
+        if (lstat(FileName.c_str(),&Buf) == 0 && S_ISLNK(Buf.st_mode))

            unlink(FileName.c_str());
         iFd = open(FileName.c_str(),O_RDWR | O_CREAT | O_TRUNC,Perms);
         break;
            unlink(FileName.c_str());
         iFd = open(FileName.c_str(),O_RDWR | O_CREAT | O_TRUNC,Perms);
         break;


@@ -212,15 +492,19 @@ FileFd::FileFd(string FileName,OpenMode Mode, unsigned long Perms)
       case WriteAny:
       iFd = open(FileName.c_str(),O_RDWR | O_CREAT,Perms);
       break;      
       case WriteAny:
       iFd = open(FileName.c_str(),O_RDWR | O_CREAT,Perms);
       break;      

+
+      case WriteTemp:
+      unlink(FileName.c_str());
+      iFd = open(FileName.c_str(),O_RDWR | O_CREAT | O_EXCL,Perms);
+      break;

    }  
 
    if (iFd < 0)
    }  
 
    if (iFd < 0)

-      _error->Errno("open","Could not open file %s",FileName.c_str());
-   else
-   {
-      this->FileName = FileName;
-      SetCloseExec(iFd,true);
-   }   
+      return _error->Errno("open",_("Could not open file %s"),FileName.c_str());
+   
+   this->FileName = FileName;
+   SetCloseExec(iFd,true);
+   return true;

 }
                                                                        /*}}}*/
 // FileFd::~File - Closes the file                                     /*{{{*/
 }
                                                                        /*}}}*/
 // FileFd::~File - Closes the file                                     /*{{{*/


@@ -234,16 +518,45 @@ FileFd::~FileFd()
                                                                        /*}}}*/
 // FileFd::Read - Read a bit of the file                               /*{{{*/
 // ---------------------------------------------------------------------
                                                                        /*}}}*/
 // FileFd::Read - Read a bit of the file                               /*{{{*/
 // ---------------------------------------------------------------------

-/* */
-bool FileFd::Read(void *To,unsigned long Size)
+/* We are carefull to handle interruption by a signal while reading 
+   gracefully. */
+bool FileFd::Read(void *To,unsigned long Size,unsigned long *Actual)

 {
 {

-   if (read(iFd,To,Size) != (signed)Size)
+   int Res;
+   errno = 0;
+   if (Actual != 0)
+      *Actual = 0;
+   
+   do

    {
    {

-      Flags |= Fail;
-      return _error->Errno("read","Read error");
-   }   
+      Res = read(iFd,To,Size);
+      if (Res < 0 && errno == EINTR)
+        continue;
+      if (Res < 0)
+      {
+        Flags |= Fail;
+        return _error->Errno("read",_("Read error"));
+      }

       
       

-   return true;
+      To = (char *)To + Res;
+      Size -= Res;
+      if (Actual != 0)
+        *Actual += Res;
+   }
+   while (Res > 0 && Size > 0);
+   
+   if (Size == 0)
+      return true;
+   
+   // Eof handling
+   if (Actual != 0)
+   {
+      Flags |= HitEof;
+      return true;
+   }
+   
+   Flags |= Fail;
+   return _error->Error(_("read, still have %lu to read but none left"),Size);

 }
                                                                        /*}}}*/
 // FileFd::Write - Write to the file                                   /*{{{*/
 }
                                                                        /*}}}*/
 // FileFd::Write - Write to the file                                   /*{{{*/


@@ -251,13 +564,29 @@ bool FileFd::Read(void *To,unsigned long Size)
 /* */
 bool FileFd::Write(const void *From,unsigned long Size)
 {
 /* */
 bool FileFd::Write(const void *From,unsigned long Size)
 {

-   if (write(iFd,From,Size) != (signed)Size)
+   int Res;
+   errno = 0;
+   do

    {
    {

-      Flags |= Fail;
-      return _error->Errno("write","Write error");
+      Res = write(iFd,From,Size);
+      if (Res < 0 && errno == EINTR)
+        continue;
+      if (Res < 0)
+      {
+        Flags |= Fail;
+        return _error->Errno("write",_("Write error"));
+      }
+      
+      From = (char *)From + Res;
+      Size -= Res;

    }
    }

+   while (Res > 0 && Size > 0);

    
    

-   return true;
+   if (Size == 0)
+      return true;
+   
+   Flags |= Fail;
+   return _error->Error(_("write, still have %lu to write but couldn't"),Size);

 }
                                                                        /*}}}*/
 // FileFd::Seek - Seek in the file                                     /*{{{*/
 }
                                                                        /*}}}*/
 // FileFd::Seek - Seek in the file                                     /*{{{*/


@@ -268,7 +597,35 @@ bool FileFd::Seek(unsigned long To)
    if (lseek(iFd,To,SEEK_SET) != (signed)To)
    {
       Flags |= Fail;
    if (lseek(iFd,To,SEEK_SET) != (signed)To)
    {
       Flags |= Fail;

-      return _error->Error("Unable to seek to %u",To);
+      return _error->Error("Unable to seek to %lu",To);
+   }
+   
+   return true;
+}
+                                                                       /*}}}*/
+// FileFd::Skip - Seek in the file                                     /*{{{*/
+// ---------------------------------------------------------------------
+/* */
+bool FileFd::Skip(unsigned long Over)
+{
+   if (lseek(iFd,Over,SEEK_CUR) < 0)
+   {
+      Flags |= Fail;
+      return _error->Error("Unable to seek ahead %lu",Over);
+   }
+   
+   return true;
+}
+                                                                       /*}}}*/
+// FileFd::Truncate - Truncate the file                                /*{{{*/
+// ---------------------------------------------------------------------
+/* */
+bool FileFd::Truncate(unsigned long To)
+{
+   if (ftruncate(iFd,To) != 0)
+   {
+      Flags |= Fail;
+      return _error->Error("Unable to truncate to %lu",To);

    }
    
    return true;
    }
    
    return true;


@@ -304,13 +661,25 @@ bool FileFd::Close()
    bool Res = true;
    if ((Flags & AutoClose) == AutoClose)
       if (iFd >= 0 && close(iFd) != 0)
    bool Res = true;
    if ((Flags & AutoClose) == AutoClose)
       if (iFd >= 0 && close(iFd) != 0)

-        Res &= _error->Errno("close","Problem closing the file");
+        Res &= _error->Errno("close",_("Problem closing the file"));

    iFd = -1;
    
    if ((Flags & Fail) == Fail && (Flags & DelOnFail) == DelOnFail &&
        FileName.empty() == false)
       if (unlink(FileName.c_str()) != 0)
    iFd = -1;
    
    if ((Flags & Fail) == Fail && (Flags & DelOnFail) == DelOnFail &&
        FileName.empty() == false)
       if (unlink(FileName.c_str()) != 0)

-        Res &= _error->Warning("unlnk","Problem unlinking the file");
+        Res &= _error->WarningE("unlnk",_("Problem unlinking the file"));

    return Res;
 }
                                                                        /*}}}*/
    return Res;
 }
                                                                        /*}}}*/

+// FileFd::Sync - Sync the file                                                /*{{{*/
+// ---------------------------------------------------------------------
+/* */
+bool FileFd::Sync()
+{
+#ifdef _POSIX_SYNCHRONIZED_IO
+   if (fsync(iFd) != 0)
+      return _error->Errno("sync",_("Problem syncing the file"));
+#endif
+   return true;
+}
+                                                                       /*}}}*/