qemu/hw/9pfs/9p-util.h
<<
>>
Prefs
   1/*
   2 * 9p utilities
   3 *
   4 * Copyright IBM, Corp. 2017
   5 *
   6 * Authors:
   7 *  Greg Kurz <groug@kaod.org>
   8 *
   9 * This work is licensed under the terms of the GNU GPL, version 2 or later.
  10 * See the COPYING file in the top-level directory.
  11 */
  12
  13#ifndef QEMU_9P_UTIL_H
  14#define QEMU_9P_UTIL_H
  15
  16#include "qemu/error-report.h"
  17
  18#ifdef O_PATH
  19#define O_PATH_9P_UTIL O_PATH
  20#else
  21#define O_PATH_9P_UTIL 0
  22#endif
  23
  24#if !defined(CONFIG_LINUX)
  25
  26/*
  27 * Generates a Linux device number (a.k.a. dev_t) for given device major
  28 * and minor numbers.
  29 *
  30 * To be more precise: it generates a device number in glibc's format
  31 * (MMMM_Mmmm_mmmM_MMmm, 64 bits) actually, which is compatible with
  32 * Linux's format (mmmM_MMmm, 32 bits), as described in <bits/sysmacros.h>.
  33 */
  34static inline uint64_t makedev_dotl(uint32_t dev_major, uint32_t dev_minor)
  35{
  36    uint64_t dev;
  37
  38    // from glibc sysmacros.h:
  39    dev  = (((uint64_t) (dev_major & 0x00000fffu)) <<  8);
  40    dev |= (((uint64_t) (dev_major & 0xfffff000u)) << 32);
  41    dev |= (((uint64_t) (dev_minor & 0x000000ffu)) <<  0);
  42    dev |= (((uint64_t) (dev_minor & 0xffffff00u)) << 12);
  43    return dev;
  44}
  45
  46#endif
  47
  48/*
  49 * Converts given device number from host's device number format to Linux
  50 * device number format. As both the size of type dev_t and encoding of
  51 * dev_t is system dependant, we have to convert them for Linux guests if
  52 * host is not running Linux.
  53 */
  54static inline uint64_t host_dev_to_dotl_dev(dev_t dev)
  55{
  56#ifdef CONFIG_LINUX
  57    return dev;
  58#else
  59    return makedev_dotl(major(dev), minor(dev));
  60#endif
  61}
  62
  63/* Translates errno from host -> Linux if needed */
  64static inline int errno_to_dotl(int err) {
  65#if defined(CONFIG_LINUX)
  66    /* nothing to translate (Linux -> Linux) */
  67#elif defined(CONFIG_DARWIN)
  68    /*
  69     * translation mandatory for macOS hosts
  70     *
  71     * FIXME: Only most important errnos translated here yet, this should be
  72     * extended to as many errnos being translated as possible in future.
  73     */
  74    if (err == ENAMETOOLONG) {
  75        err = 36; /* ==ENAMETOOLONG on Linux */
  76    } else if (err == ENOTEMPTY) {
  77        err = 39; /* ==ENOTEMPTY on Linux */
  78    } else if (err == ELOOP) {
  79        err = 40; /* ==ELOOP on Linux */
  80    } else if (err == ENOATTR) {
  81        err = 61; /* ==ENODATA on Linux */
  82    } else if (err == ENOTSUP) {
  83        err = 95; /* ==EOPNOTSUPP on Linux */
  84    } else if (err == EOPNOTSUPP) {
  85        err = 95; /* ==EOPNOTSUPP on Linux */
  86    }
  87#else
  88#error Missing errno translation to Linux for this host system
  89#endif
  90    return err;
  91}
  92
  93#ifdef CONFIG_DARWIN
  94#define qemu_fgetxattr(...) fgetxattr(__VA_ARGS__, 0, 0)
  95#else
  96#define qemu_fgetxattr fgetxattr
  97#endif
  98
  99#define qemu_openat     openat
 100#define qemu_fstat      fstat
 101#define qemu_fstatat    fstatat
 102#define qemu_mkdirat    mkdirat
 103#define qemu_renameat   renameat
 104#define qemu_utimensat  utimensat
 105#define qemu_unlinkat   unlinkat
 106
 107static inline void close_preserve_errno(int fd)
 108{
 109    int serrno = errno;
 110    close(fd);
 111    errno = serrno;
 112}
 113
 114/**
 115 * close_if_special_file() - Close @fd if neither regular file nor directory.
 116 *
 117 * @fd: file descriptor of open file
 118 * Return: 0 on regular file or directory, -1 otherwise
 119 *
 120 * CVE-2023-2861: Prohibit opening any special file directly on host
 121 * (especially device files), as a compromised client could potentially gain
 122 * access outside exported tree under certain, unsafe setups. We expect
 123 * client to handle I/O on special files exclusively on guest side.
 124 */
 125static inline int close_if_special_file(int fd)
 126{
 127    struct stat stbuf;
 128
 129    if (qemu_fstat(fd, &stbuf) < 0) {
 130        close_preserve_errno(fd);
 131        return -1;
 132    }
 133    if (!S_ISREG(stbuf.st_mode) && !S_ISDIR(stbuf.st_mode)) {
 134        error_report_once(
 135            "9p: broken or compromised client detected; attempt to open "
 136            "special file (i.e. neither regular file, nor directory)"
 137        );
 138        close(fd);
 139        errno = ENXIO;
 140        return -1;
 141    }
 142
 143    return 0;
 144}
 145
 146static inline int openat_dir(int dirfd, const char *name)
 147{
 148    return qemu_openat(dirfd, name,
 149                       O_DIRECTORY | O_RDONLY | O_NOFOLLOW | O_PATH_9P_UTIL);
 150}
 151
 152static inline int openat_file(int dirfd, const char *name, int flags,
 153                              mode_t mode)
 154{
 155    int fd, serrno, ret;
 156
 157#ifndef CONFIG_DARWIN
 158again:
 159#endif
 160    fd = qemu_openat(dirfd, name, flags | O_NOFOLLOW | O_NOCTTY | O_NONBLOCK,
 161                     mode);
 162    if (fd == -1) {
 163#ifndef CONFIG_DARWIN
 164        if (errno == EPERM && (flags & O_NOATIME)) {
 165            /*
 166             * The client passed O_NOATIME but we lack permissions to honor it.
 167             * Rather than failing the open, fall back without O_NOATIME. This
 168             * doesn't break the semantics on the client side, as the Linux
 169             * open(2) man page notes that O_NOATIME "may not be effective on
 170             * all filesystems". In particular, NFS and other network
 171             * filesystems ignore it entirely.
 172             */
 173            flags &= ~O_NOATIME;
 174            goto again;
 175        }
 176#endif
 177        return -1;
 178    }
 179
 180    if (close_if_special_file(fd) < 0) {
 181        return -1;
 182    }
 183
 184    serrno = errno;
 185    /* O_NONBLOCK was only needed to open the file. Let's drop it. We don't
 186     * do that with O_PATH since fcntl(F_SETFL) isn't supported, and openat()
 187     * ignored it anyway.
 188     */
 189    if (!(flags & O_PATH_9P_UTIL)) {
 190        ret = fcntl(fd, F_SETFL, flags);
 191        assert(!ret);
 192    }
 193    errno = serrno;
 194    return fd;
 195}
 196
 197ssize_t fgetxattrat_nofollow(int dirfd, const char *path, const char *name,
 198                             void *value, size_t size);
 199int fsetxattrat_nofollow(int dirfd, const char *path, const char *name,
 200                         void *value, size_t size, int flags);
 201ssize_t flistxattrat_nofollow(int dirfd, const char *filename,
 202                              char *list, size_t size);
 203ssize_t fremovexattrat_nofollow(int dirfd, const char *filename,
 204                                const char *name);
 205
 206/*
 207 * Darwin has d_seekoff, which appears to function similarly to d_off.
 208 * However, it does not appear to be supported on all file systems,
 209 * so ensure it is manually injected earlier and call here when
 210 * needed.
 211 */
 212static inline off_t qemu_dirent_off(struct dirent *dent)
 213{
 214#ifdef CONFIG_DARWIN
 215    return dent->d_seekoff;
 216#else
 217    return dent->d_off;
 218#endif
 219}
 220
 221/**
 222 * qemu_dirent_dup() - Duplicate directory entry @dent.
 223 *
 224 * @dent: original directory entry to be duplicated
 225 * Return: duplicated directory entry which should be freed with g_free()
 226 *
 227 * It is highly recommended to use this function instead of open coding
 228 * duplication of dirent objects, because the actual struct dirent
 229 * size may be bigger or shorter than sizeof(struct dirent) and correct
 230 * handling is platform specific (see gitlab issue #841).
 231 */
 232static inline struct dirent *qemu_dirent_dup(struct dirent *dent)
 233{
 234    size_t sz = 0;
 235#if defined _DIRENT_HAVE_D_RECLEN
 236    /* Avoid use of strlen() if platform supports d_reclen. */
 237    sz = dent->d_reclen;
 238#endif
 239    /*
 240     * Test sz for zero even if d_reclen is available
 241     * because some drivers may set d_reclen to zero.
 242     */
 243    if (sz == 0) {
 244        /* Fallback to the most portable way. */
 245        sz = offsetof(struct dirent, d_name) +
 246                      strlen(dent->d_name) + 1;
 247    }
 248    return g_memdup(dent, sz);
 249}
 250
 251/*
 252 * As long as mknodat is not available on macOS, this workaround
 253 * using pthread_fchdir_np is needed. qemu_mknodat is defined in
 254 * os-posix.c. pthread_fchdir_np is weakly linked here as a guard
 255 * in case it disappears in future macOS versions, because it is
 256 * is a private API.
 257 */
 258#if defined CONFIG_DARWIN && defined CONFIG_PTHREAD_FCHDIR_NP
 259int pthread_fchdir_np(int fd) __attribute__((weak_import));
 260#endif
 261int qemu_mknodat(int dirfd, const char *filename, mode_t mode, dev_t dev);
 262
 263#endif
 264