xref: /openbmc/qemu/hw/9pfs/9p-util.h (revision 28cbbdd2)
1 /*
2  * 9p utilities
3  *
4  * Copyright IBM, Corp. 2017
5  *
6  * Authors:
7  *  Greg Kurz <groug@kaod.org>
8  *
9  * This work is licensed under the terms of the GNU GPL, version 2 or later.
10  * See the COPYING file in the top-level directory.
11  */
12 
13 #ifndef QEMU_9P_UTIL_H
14 #define QEMU_9P_UTIL_H
15 
16 #include "qemu/error-report.h"
17 
18 #ifdef O_PATH
19 #define O_PATH_9P_UTIL O_PATH
20 #else
21 #define O_PATH_9P_UTIL 0
22 #endif
23 
24 #if !defined(CONFIG_LINUX)
25 
26 /*
27  * Generates a Linux device number (a.k.a. dev_t) for given device major
28  * and minor numbers.
29  *
30  * To be more precise: it generates a device number in glibc's format
31  * (MMMM_Mmmm_mmmM_MMmm, 64 bits) actually, which is compatible with
32  * Linux's format (mmmM_MMmm, 32 bits), as described in <bits/sysmacros.h>.
33  */
makedev_dotl(uint32_t dev_major,uint32_t dev_minor)34 static inline uint64_t makedev_dotl(uint32_t dev_major, uint32_t dev_minor)
35 {
36     uint64_t dev;
37 
38     // from glibc sysmacros.h:
39     dev  = (((uint64_t) (dev_major & 0x00000fffu)) <<  8);
40     dev |= (((uint64_t) (dev_major & 0xfffff000u)) << 32);
41     dev |= (((uint64_t) (dev_minor & 0x000000ffu)) <<  0);
42     dev |= (((uint64_t) (dev_minor & 0xffffff00u)) << 12);
43     return dev;
44 }
45 
46 #endif
47 
48 /*
49  * Converts given device number from host's device number format to Linux
50  * device number format. As both the size of type dev_t and encoding of
51  * dev_t is system dependent, we have to convert them for Linux guests if
52  * host is not running Linux.
53  */
host_dev_to_dotl_dev(dev_t dev)54 static inline uint64_t host_dev_to_dotl_dev(dev_t dev)
55 {
56 #ifdef CONFIG_LINUX
57     return dev;
58 #else
59     return makedev_dotl(major(dev), minor(dev));
60 #endif
61 }
62 
63 /* Translates errno from host -> Linux if needed */
errno_to_dotl(int err)64 static inline int errno_to_dotl(int err) {
65 #if defined(CONFIG_LINUX)
66     /* nothing to translate (Linux -> Linux) */
67 #elif defined(CONFIG_DARWIN)
68     /*
69      * translation mandatory for macOS hosts
70      *
71      * FIXME: Only most important errnos translated here yet, this should be
72      * extended to as many errnos being translated as possible in future.
73      */
74     if (err == ENAMETOOLONG) {
75         err = 36; /* ==ENAMETOOLONG on Linux */
76     } else if (err == ENOTEMPTY) {
77         err = 39; /* ==ENOTEMPTY on Linux */
78     } else if (err == ELOOP) {
79         err = 40; /* ==ELOOP on Linux */
80     } else if (err == ENOATTR) {
81         err = 61; /* ==ENODATA on Linux */
82     } else if (err == ENOTSUP) {
83         err = 95; /* ==EOPNOTSUPP on Linux */
84     } else if (err == EOPNOTSUPP) {
85         err = 95; /* ==EOPNOTSUPP on Linux */
86     }
87 #else
88 #error Missing errno translation to Linux for this host system
89 #endif
90     return err;
91 }
92 
93 #ifdef CONFIG_DARWIN
94 #define qemu_fgetxattr(...) fgetxattr(__VA_ARGS__, 0, 0)
95 #else
96 #define qemu_fgetxattr fgetxattr
97 #endif
98 
99 #define qemu_openat     openat
100 #define qemu_fstat      fstat
101 #define qemu_fstatat    fstatat
102 #define qemu_mkdirat    mkdirat
103 #define qemu_renameat   renameat
104 #define qemu_utimensat  utimensat
105 #define qemu_unlinkat   unlinkat
106 
close_preserve_errno(int fd)107 static inline void close_preserve_errno(int fd)
108 {
109     int serrno = errno;
110     close(fd);
111     errno = serrno;
112 }
113 
114 /**
115  * close_if_special_file() - Close @fd if neither regular file nor directory.
116  *
117  * @fd: file descriptor of open file
118  * Return: 0 on regular file or directory, -1 otherwise
119  *
120  * CVE-2023-2861: Prohibit opening any special file directly on host
121  * (especially device files), as a compromised client could potentially gain
122  * access outside exported tree under certain, unsafe setups. We expect
123  * client to handle I/O on special files exclusively on guest side.
124  */
close_if_special_file(int fd)125 static inline int close_if_special_file(int fd)
126 {
127     struct stat stbuf;
128 
129     if (qemu_fstat(fd, &stbuf) < 0) {
130         close_preserve_errno(fd);
131         return -1;
132     }
133     if (!S_ISREG(stbuf.st_mode) && !S_ISDIR(stbuf.st_mode)) {
134         error_report_once(
135             "9p: broken or compromised client detected; attempt to open "
136             "special file (i.e. neither regular file, nor directory)"
137         );
138         close(fd);
139         errno = ENXIO;
140         return -1;
141     }
142 
143     return 0;
144 }
145 
openat_dir(int dirfd,const char * name)146 static inline int openat_dir(int dirfd, const char *name)
147 {
148     return qemu_openat(dirfd, name,
149                        O_DIRECTORY | O_RDONLY | O_NOFOLLOW | O_PATH_9P_UTIL);
150 }
151 
openat_file(int dirfd,const char * name,int flags,mode_t mode)152 static inline int openat_file(int dirfd, const char *name, int flags,
153                               mode_t mode)
154 {
155     int fd, serrno, ret;
156 
157 #ifndef CONFIG_DARWIN
158 again:
159 #endif
160     fd = qemu_openat(dirfd, name, flags | O_NOFOLLOW | O_NOCTTY | O_NONBLOCK,
161                      mode);
162     if (fd == -1) {
163 #ifndef CONFIG_DARWIN
164         if (errno == EPERM && (flags & O_NOATIME)) {
165             /*
166              * The client passed O_NOATIME but we lack permissions to honor it.
167              * Rather than failing the open, fall back without O_NOATIME. This
168              * doesn't break the semantics on the client side, as the Linux
169              * open(2) man page notes that O_NOATIME "may not be effective on
170              * all filesystems". In particular, NFS and other network
171              * filesystems ignore it entirely.
172              */
173             flags &= ~O_NOATIME;
174             goto again;
175         }
176 #endif
177         return -1;
178     }
179 
180     if (close_if_special_file(fd) < 0) {
181         return -1;
182     }
183 
184     serrno = errno;
185     /* O_NONBLOCK was only needed to open the file. Let's drop it. We don't
186      * do that with O_PATH since fcntl(F_SETFL) isn't supported, and openat()
187      * ignored it anyway.
188      */
189     if (!(flags & O_PATH_9P_UTIL)) {
190         ret = fcntl(fd, F_SETFL, flags);
191         assert(!ret);
192     }
193     errno = serrno;
194     return fd;
195 }
196 
197 ssize_t fgetxattrat_nofollow(int dirfd, const char *path, const char *name,
198                              void *value, size_t size);
199 int fsetxattrat_nofollow(int dirfd, const char *path, const char *name,
200                          void *value, size_t size, int flags);
201 ssize_t flistxattrat_nofollow(int dirfd, const char *filename,
202                               char *list, size_t size);
203 ssize_t fremovexattrat_nofollow(int dirfd, const char *filename,
204                                 const char *name);
205 
206 /*
207  * Darwin has d_seekoff, which appears to function similarly to d_off.
208  * However, it does not appear to be supported on all file systems,
209  * so ensure it is manually injected earlier and call here when
210  * needed.
211  */
qemu_dirent_off(struct dirent * dent)212 static inline off_t qemu_dirent_off(struct dirent *dent)
213 {
214 #ifdef CONFIG_DARWIN
215     return dent->d_seekoff;
216 #else
217     return dent->d_off;
218 #endif
219 }
220 
221 /**
222  * qemu_dirent_dup() - Duplicate directory entry @dent.
223  *
224  * @dent: original directory entry to be duplicated
225  * Return: duplicated directory entry which should be freed with g_free()
226  *
227  * It is highly recommended to use this function instead of open coding
228  * duplication of dirent objects, because the actual struct dirent
229  * size may be bigger or shorter than sizeof(struct dirent) and correct
230  * handling is platform specific (see gitlab issue #841).
231  */
qemu_dirent_dup(struct dirent * dent)232 static inline struct dirent *qemu_dirent_dup(struct dirent *dent)
233 {
234     size_t sz = 0;
235 #if defined _DIRENT_HAVE_D_RECLEN
236     /* Avoid use of strlen() if platform supports d_reclen. */
237     sz = dent->d_reclen;
238 #endif
239     /*
240      * Test sz for zero even if d_reclen is available
241      * because some drivers may set d_reclen to zero.
242      */
243     if (sz == 0) {
244         /* Fallback to the most portable way. */
245         sz = offsetof(struct dirent, d_name) +
246                       strlen(dent->d_name) + 1;
247     }
248     return g_memdup(dent, sz);
249 }
250 
251 /*
252  * As long as mknodat is not available on macOS, this workaround
253  * using pthread_fchdir_np is needed. qemu_mknodat is defined in
254  * os-posix.c. pthread_fchdir_np is weakly linked here as a guard
255  * in case it disappears in future macOS versions, because it is
256  * is a private API.
257  */
258 #if defined CONFIG_DARWIN && defined CONFIG_PTHREAD_FCHDIR_NP
259 int pthread_fchdir_np(int fd) __attribute__((weak_import));
260 #endif
261 int qemu_mknodat(int dirfd, const char *filename, mode_t mode, dev_t dev);
262 
263 #endif
264