xref: /openbmc/qemu/hw/9pfs/9p-util.h (revision 361f29fe1bc6c847b108442d573fcd2690d6db4b)
1  /*
2   * 9p utilities
3   *
4   * Copyright IBM, Corp. 2017
5   *
6   * Authors:
7   *  Greg Kurz <groug@kaod.org>
8   *
9   * This work is licensed under the terms of the GNU GPL, version 2 or later.
10   * See the COPYING file in the top-level directory.
11   */
12  
13  #ifndef QEMU_9P_UTIL_H
14  #define QEMU_9P_UTIL_H
15  
16  #include "qemu/error-report.h"
17  
18  #ifdef O_PATH
19  #define O_PATH_9P_UTIL O_PATH
20  #else
21  #define O_PATH_9P_UTIL 0
22  #endif
23  
24  #if !defined(CONFIG_LINUX)
25  
26  /*
27   * Generates a Linux device number (a.k.a. dev_t) for given device major
28   * and minor numbers.
29   *
30   * To be more precise: it generates a device number in glibc's format
31   * (MMMM_Mmmm_mmmM_MMmm, 64 bits) actually, which is compatible with
32   * Linux's format (mmmM_MMmm, 32 bits), as described in <bits/sysmacros.h>.
33   */
makedev_dotl(uint32_t dev_major,uint32_t dev_minor)34  static inline uint64_t makedev_dotl(uint32_t dev_major, uint32_t dev_minor)
35  {
36      uint64_t dev;
37  
38      // from glibc sysmacros.h:
39      dev  = (((uint64_t) (dev_major & 0x00000fffu)) <<  8);
40      dev |= (((uint64_t) (dev_major & 0xfffff000u)) << 32);
41      dev |= (((uint64_t) (dev_minor & 0x000000ffu)) <<  0);
42      dev |= (((uint64_t) (dev_minor & 0xffffff00u)) << 12);
43      return dev;
44  }
45  
46  #endif
47  
48  /*
49   * Converts given device number from host's device number format to Linux
50   * device number format. As both the size of type dev_t and encoding of
51   * dev_t is system dependent, we have to convert them for Linux guests if
52   * host is not running Linux.
53   */
host_dev_to_dotl_dev(dev_t dev)54  static inline uint64_t host_dev_to_dotl_dev(dev_t dev)
55  {
56  #ifdef CONFIG_LINUX
57      return dev;
58  #else
59      return makedev_dotl(major(dev), minor(dev));
60  #endif
61  }
62  
63  /* Translates errno from host -> Linux if needed */
errno_to_dotl(int err)64  static inline int errno_to_dotl(int err) {
65  #if defined(CONFIG_LINUX)
66      /* nothing to translate (Linux -> Linux) */
67  #elif defined(CONFIG_DARWIN)
68      /*
69       * translation mandatory for macOS hosts
70       *
71       * FIXME: Only most important errnos translated here yet, this should be
72       * extended to as many errnos being translated as possible in future.
73       */
74      if (err == ENAMETOOLONG) {
75          err = 36; /* ==ENAMETOOLONG on Linux */
76      } else if (err == ENOTEMPTY) {
77          err = 39; /* ==ENOTEMPTY on Linux */
78      } else if (err == ELOOP) {
79          err = 40; /* ==ELOOP on Linux */
80      } else if (err == ENOATTR) {
81          err = 61; /* ==ENODATA on Linux */
82      } else if (err == ENOTSUP) {
83          err = 95; /* ==EOPNOTSUPP on Linux */
84      } else if (err == EOPNOTSUPP) {
85          err = 95; /* ==EOPNOTSUPP on Linux */
86      }
87  #else
88  #error Missing errno translation to Linux for this host system
89  #endif
90      return err;
91  }
92  
93  #ifdef CONFIG_DARWIN
94  #define qemu_fgetxattr(...) fgetxattr(__VA_ARGS__, 0, 0)
95  #else
96  #define qemu_fgetxattr fgetxattr
97  #endif
98  
99  #define qemu_openat     openat
100  #define qemu_fstat      fstat
101  #define qemu_fstatat    fstatat
102  #define qemu_mkdirat    mkdirat
103  #define qemu_renameat   renameat
104  #define qemu_utimensat  utimensat
105  #define qemu_unlinkat   unlinkat
106  
close_preserve_errno(int fd)107  static inline void close_preserve_errno(int fd)
108  {
109      int serrno = errno;
110      close(fd);
111      errno = serrno;
112  }
113  
114  /**
115   * close_if_special_file() - Close @fd if neither regular file nor directory.
116   *
117   * @fd: file descriptor of open file
118   * Return: 0 on regular file or directory, -1 otherwise
119   *
120   * CVE-2023-2861: Prohibit opening any special file directly on host
121   * (especially device files), as a compromised client could potentially gain
122   * access outside exported tree under certain, unsafe setups. We expect
123   * client to handle I/O on special files exclusively on guest side.
124   */
close_if_special_file(int fd)125  static inline int close_if_special_file(int fd)
126  {
127      struct stat stbuf;
128  
129      if (qemu_fstat(fd, &stbuf) < 0) {
130          close_preserve_errno(fd);
131          return -1;
132      }
133      if (!S_ISREG(stbuf.st_mode) && !S_ISDIR(stbuf.st_mode)) {
134          error_report_once(
135              "9p: broken or compromised client detected; attempt to open "
136              "special file (i.e. neither regular file, nor directory)"
137          );
138          close(fd);
139          errno = ENXIO;
140          return -1;
141      }
142  
143      return 0;
144  }
145  
openat_dir(int dirfd,const char * name)146  static inline int openat_dir(int dirfd, const char *name)
147  {
148      return qemu_openat(dirfd, name,
149                         O_DIRECTORY | O_RDONLY | O_NOFOLLOW | O_PATH_9P_UTIL);
150  }
151  
openat_file(int dirfd,const char * name,int flags,mode_t mode)152  static inline int openat_file(int dirfd, const char *name, int flags,
153                                mode_t mode)
154  {
155      int fd, serrno, ret;
156  
157  #ifndef CONFIG_DARWIN
158  again:
159  #endif
160      fd = qemu_openat(dirfd, name, flags | O_NOFOLLOW | O_NOCTTY | O_NONBLOCK,
161                       mode);
162      if (fd == -1) {
163  #ifndef CONFIG_DARWIN
164          if (errno == EPERM && (flags & O_NOATIME)) {
165              /*
166               * The client passed O_NOATIME but we lack permissions to honor it.
167               * Rather than failing the open, fall back without O_NOATIME. This
168               * doesn't break the semantics on the client side, as the Linux
169               * open(2) man page notes that O_NOATIME "may not be effective on
170               * all filesystems". In particular, NFS and other network
171               * filesystems ignore it entirely.
172               */
173              flags &= ~O_NOATIME;
174              goto again;
175          }
176  #endif
177          return -1;
178      }
179  
180      /* Only if O_PATH is not set ... */
181      if (!(flags & O_PATH_9P_UTIL)) {
182          /*
183           * Prevent I/O on special files (device files, etc.) on host side,
184           * however it is safe and required to allow opening them with O_PATH,
185           * as this is limited to (required) path based operations only.
186           */
187          if (close_if_special_file(fd) < 0) {
188              return -1;
189          }
190  
191          serrno = errno;
192          /*
193           * O_NONBLOCK was only needed to open the file. Let's drop it. We don't
194           * do that with O_PATH since fcntl(F_SETFL) isn't supported, and
195           * openat() ignored it anyway.
196           */
197          ret = fcntl(fd, F_SETFL, flags);
198          assert(!ret);
199          errno = serrno;
200      }
201      return fd;
202  }
203  
204  ssize_t fgetxattrat_nofollow(int dirfd, const char *path, const char *name,
205                               void *value, size_t size);
206  int fsetxattrat_nofollow(int dirfd, const char *path, const char *name,
207                           void *value, size_t size, int flags);
208  ssize_t flistxattrat_nofollow(int dirfd, const char *filename,
209                                char *list, size_t size);
210  ssize_t fremovexattrat_nofollow(int dirfd, const char *filename,
211                                  const char *name);
212  
213  /*
214   * Darwin has d_seekoff, which appears to function similarly to d_off.
215   * However, it does not appear to be supported on all file systems,
216   * so ensure it is manually injected earlier and call here when
217   * needed.
218   */
qemu_dirent_off(struct dirent * dent)219  static inline off_t qemu_dirent_off(struct dirent *dent)
220  {
221  #ifdef CONFIG_DARWIN
222      return dent->d_seekoff;
223  #else
224      return dent->d_off;
225  #endif
226  }
227  
228  /**
229   * qemu_dirent_dup() - Duplicate directory entry @dent.
230   *
231   * @dent: original directory entry to be duplicated
232   * Return: duplicated directory entry which should be freed with g_free()
233   *
234   * It is highly recommended to use this function instead of open coding
235   * duplication of dirent objects, because the actual struct dirent
236   * size may be bigger or shorter than sizeof(struct dirent) and correct
237   * handling is platform specific (see gitlab issue #841).
238   */
qemu_dirent_dup(struct dirent * dent)239  static inline struct dirent *qemu_dirent_dup(struct dirent *dent)
240  {
241      size_t sz = 0;
242  #if defined _DIRENT_HAVE_D_RECLEN
243      /* Avoid use of strlen() if platform supports d_reclen. */
244      sz = dent->d_reclen;
245  #endif
246      /*
247       * Test sz for zero even if d_reclen is available
248       * because some drivers may set d_reclen to zero.
249       */
250      if (sz == 0) {
251          /* Fallback to the most portable way. */
252          sz = offsetof(struct dirent, d_name) +
253                        strlen(dent->d_name) + 1;
254      }
255      return g_memdup(dent, sz);
256  }
257  
258  /*
259   * As long as mknodat is not available on macOS, this workaround
260   * using pthread_fchdir_np is needed. qemu_mknodat is defined in
261   * os-posix.c. pthread_fchdir_np is weakly linked here as a guard
262   * in case it disappears in future macOS versions, because it is
263   * is a private API.
264   */
265  #if defined CONFIG_DARWIN && defined CONFIG_PTHREAD_FCHDIR_NP
266  int pthread_fchdir_np(int fd) __attribute__((weak_import));
267  #endif
268  int qemu_mknodat(int dirfd, const char *filename, mode_t mode, dev_t dev);
269  
270  #endif
271