1 /* 2 * 9p utilities 3 * 4 * Copyright IBM, Corp. 2017 5 * 6 * Authors: 7 * Greg Kurz <groug@kaod.org> 8 * 9 * This work is licensed under the terms of the GNU GPL, version 2 or later. 10 * See the COPYING file in the top-level directory. 11 */ 12 13 #ifndef QEMU_9P_UTIL_H 14 #define QEMU_9P_UTIL_H 15 16 #include "qemu/error-report.h" 17 18 #ifdef O_PATH 19 #define O_PATH_9P_UTIL O_PATH 20 #else 21 #define O_PATH_9P_UTIL 0 22 #endif 23 24 #if !defined(CONFIG_LINUX) 25 26 /* 27 * Generates a Linux device number (a.k.a. dev_t) for given device major 28 * and minor numbers. 29 * 30 * To be more precise: it generates a device number in glibc's format 31 * (MMMM_Mmmm_mmmM_MMmm, 64 bits) actually, which is compatible with 32 * Linux's format (mmmM_MMmm, 32 bits), as described in <bits/sysmacros.h>. 33 */ makedev_dotl(uint32_t dev_major,uint32_t dev_minor)34 static inline uint64_t makedev_dotl(uint32_t dev_major, uint32_t dev_minor) 35 { 36 uint64_t dev; 37 38 // from glibc sysmacros.h: 39 dev = (((uint64_t) (dev_major & 0x00000fffu)) << 8); 40 dev |= (((uint64_t) (dev_major & 0xfffff000u)) << 32); 41 dev |= (((uint64_t) (dev_minor & 0x000000ffu)) << 0); 42 dev |= (((uint64_t) (dev_minor & 0xffffff00u)) << 12); 43 return dev; 44 } 45 46 #endif 47 48 /* 49 * Converts given device number from host's device number format to Linux 50 * device number format. As both the size of type dev_t and encoding of 51 * dev_t is system dependent, we have to convert them for Linux guests if 52 * host is not running Linux. 53 */ host_dev_to_dotl_dev(dev_t dev)54 static inline uint64_t host_dev_to_dotl_dev(dev_t dev) 55 { 56 #ifdef CONFIG_LINUX 57 return dev; 58 #else 59 return makedev_dotl(major(dev), minor(dev)); 60 #endif 61 } 62 63 /* Translates errno from host -> Linux if needed */ errno_to_dotl(int err)64 static inline int errno_to_dotl(int err) { 65 #if defined(CONFIG_LINUX) 66 /* nothing to translate (Linux -> Linux) */ 67 #elif defined(CONFIG_DARWIN) 68 /* 69 * translation mandatory for macOS hosts 70 * 71 * FIXME: Only most important errnos translated here yet, this should be 72 * extended to as many errnos being translated as possible in future. 73 */ 74 if (err == ENAMETOOLONG) { 75 err = 36; /* ==ENAMETOOLONG on Linux */ 76 } else if (err == ENOTEMPTY) { 77 err = 39; /* ==ENOTEMPTY on Linux */ 78 } else if (err == ELOOP) { 79 err = 40; /* ==ELOOP on Linux */ 80 } else if (err == ENOATTR) { 81 err = 61; /* ==ENODATA on Linux */ 82 } else if (err == ENOTSUP) { 83 err = 95; /* ==EOPNOTSUPP on Linux */ 84 } else if (err == EOPNOTSUPP) { 85 err = 95; /* ==EOPNOTSUPP on Linux */ 86 } 87 #else 88 #error Missing errno translation to Linux for this host system 89 #endif 90 return err; 91 } 92 93 #ifdef CONFIG_DARWIN 94 #define qemu_fgetxattr(...) fgetxattr(__VA_ARGS__, 0, 0) 95 #else 96 #define qemu_fgetxattr fgetxattr 97 #endif 98 99 #define qemu_openat openat 100 #define qemu_fstat fstat 101 #define qemu_fstatat fstatat 102 #define qemu_mkdirat mkdirat 103 #define qemu_renameat renameat 104 #define qemu_utimensat utimensat 105 #define qemu_unlinkat unlinkat 106 close_preserve_errno(int fd)107 static inline void close_preserve_errno(int fd) 108 { 109 int serrno = errno; 110 close(fd); 111 errno = serrno; 112 } 113 114 /** 115 * close_if_special_file() - Close @fd if neither regular file nor directory. 116 * 117 * @fd: file descriptor of open file 118 * Return: 0 on regular file or directory, -1 otherwise 119 * 120 * CVE-2023-2861: Prohibit opening any special file directly on host 121 * (especially device files), as a compromised client could potentially gain 122 * access outside exported tree under certain, unsafe setups. We expect 123 * client to handle I/O on special files exclusively on guest side. 124 */ close_if_special_file(int fd)125 static inline int close_if_special_file(int fd) 126 { 127 struct stat stbuf; 128 129 if (qemu_fstat(fd, &stbuf) < 0) { 130 close_preserve_errno(fd); 131 return -1; 132 } 133 if (!S_ISREG(stbuf.st_mode) && !S_ISDIR(stbuf.st_mode)) { 134 error_report_once( 135 "9p: broken or compromised client detected; attempt to open " 136 "special file (i.e. neither regular file, nor directory)" 137 ); 138 close(fd); 139 errno = ENXIO; 140 return -1; 141 } 142 143 return 0; 144 } 145 openat_dir(int dirfd,const char * name)146 static inline int openat_dir(int dirfd, const char *name) 147 { 148 return qemu_openat(dirfd, name, 149 O_DIRECTORY | O_RDONLY | O_NOFOLLOW | O_PATH_9P_UTIL); 150 } 151 openat_file(int dirfd,const char * name,int flags,mode_t mode)152 static inline int openat_file(int dirfd, const char *name, int flags, 153 mode_t mode) 154 { 155 int fd, serrno, ret; 156 157 #ifndef CONFIG_DARWIN 158 again: 159 #endif 160 fd = qemu_openat(dirfd, name, flags | O_NOFOLLOW | O_NOCTTY | O_NONBLOCK, 161 mode); 162 if (fd == -1) { 163 #ifndef CONFIG_DARWIN 164 if (errno == EPERM && (flags & O_NOATIME)) { 165 /* 166 * The client passed O_NOATIME but we lack permissions to honor it. 167 * Rather than failing the open, fall back without O_NOATIME. This 168 * doesn't break the semantics on the client side, as the Linux 169 * open(2) man page notes that O_NOATIME "may not be effective on 170 * all filesystems". In particular, NFS and other network 171 * filesystems ignore it entirely. 172 */ 173 flags &= ~O_NOATIME; 174 goto again; 175 } 176 #endif 177 return -1; 178 } 179 180 /* Only if O_PATH is not set ... */ 181 if (!(flags & O_PATH_9P_UTIL)) { 182 /* 183 * Prevent I/O on special files (device files, etc.) on host side, 184 * however it is safe and required to allow opening them with O_PATH, 185 * as this is limited to (required) path based operations only. 186 */ 187 if (close_if_special_file(fd) < 0) { 188 return -1; 189 } 190 191 serrno = errno; 192 /* 193 * O_NONBLOCK was only needed to open the file. Let's drop it. We don't 194 * do that with O_PATH since fcntl(F_SETFL) isn't supported, and 195 * openat() ignored it anyway. 196 */ 197 ret = fcntl(fd, F_SETFL, flags); 198 assert(!ret); 199 errno = serrno; 200 } 201 return fd; 202 } 203 204 ssize_t fgetxattrat_nofollow(int dirfd, const char *path, const char *name, 205 void *value, size_t size); 206 int fsetxattrat_nofollow(int dirfd, const char *path, const char *name, 207 void *value, size_t size, int flags); 208 ssize_t flistxattrat_nofollow(int dirfd, const char *filename, 209 char *list, size_t size); 210 ssize_t fremovexattrat_nofollow(int dirfd, const char *filename, 211 const char *name); 212 213 /* 214 * Darwin has d_seekoff, which appears to function similarly to d_off. 215 * However, it does not appear to be supported on all file systems, 216 * so ensure it is manually injected earlier and call here when 217 * needed. 218 */ qemu_dirent_off(struct dirent * dent)219 static inline off_t qemu_dirent_off(struct dirent *dent) 220 { 221 #ifdef CONFIG_DARWIN 222 return dent->d_seekoff; 223 #else 224 return dent->d_off; 225 #endif 226 } 227 228 /** 229 * qemu_dirent_dup() - Duplicate directory entry @dent. 230 * 231 * @dent: original directory entry to be duplicated 232 * Return: duplicated directory entry which should be freed with g_free() 233 * 234 * It is highly recommended to use this function instead of open coding 235 * duplication of dirent objects, because the actual struct dirent 236 * size may be bigger or shorter than sizeof(struct dirent) and correct 237 * handling is platform specific (see gitlab issue #841). 238 */ qemu_dirent_dup(struct dirent * dent)239 static inline struct dirent *qemu_dirent_dup(struct dirent *dent) 240 { 241 size_t sz = 0; 242 #if defined _DIRENT_HAVE_D_RECLEN 243 /* Avoid use of strlen() if platform supports d_reclen. */ 244 sz = dent->d_reclen; 245 #endif 246 /* 247 * Test sz for zero even if d_reclen is available 248 * because some drivers may set d_reclen to zero. 249 */ 250 if (sz == 0) { 251 /* Fallback to the most portable way. */ 252 sz = offsetof(struct dirent, d_name) + 253 strlen(dent->d_name) + 1; 254 } 255 return g_memdup(dent, sz); 256 } 257 258 /* 259 * As long as mknodat is not available on macOS, this workaround 260 * using pthread_fchdir_np is needed. qemu_mknodat is defined in 261 * os-posix.c. pthread_fchdir_np is weakly linked here as a guard 262 * in case it disappears in future macOS versions, because it is 263 * is a private API. 264 */ 265 #if defined CONFIG_DARWIN && defined CONFIG_PTHREAD_FCHDIR_NP 266 int pthread_fchdir_np(int fd) __attribute__((weak_import)); 267 #endif 268 int qemu_mknodat(int dirfd, const char *filename, mode_t mode, dev_t dev); 269 270 #endif 271