1// Copyright (c) 2012 The Chromium Authors. All rights reserved.
2// Use of this source code is governed by a BSD-style license that can be
3// found in the LICENSE file.
4
5#include "base/files/file_util.h"
6
7#include <dirent.h>
8#include <errno.h>
9#include <fcntl.h>
10#include <libgen.h>
11#include <limits.h>
12#include <stddef.h>
13#include <stdio.h>
14#include <stdlib.h>
15#include <string.h>
16#include <sys/mman.h>
17#include <sys/stat.h>
18#include <sys/time.h>
19#include <sys/types.h>
20#include <time.h>
21#include <unistd.h>
22
23#include <iterator>
24
25#include "base/command_line.h"
26#include "base/containers/stack.h"
27#include "base/environment.h"
28#include "base/files/file_enumerator.h"
29#include "base/files/file_path.h"
30#include "base/files/scoped_file.h"
31#include "base/logging.h"
32#include "base/posix/eintr_wrapper.h"
33#include "base/stl_util.h"
34#include "base/strings/string_split.h"
35#include "base/strings/string_util.h"
36#include "base/strings/stringprintf.h"
37#include "base/strings/utf_string_conversions.h"
38#include "util/build_config.h"
39
40#if defined(OS_MACOSX)
41#include <AvailabilityMacros.h>
42#endif
43
44#if !defined(OS_IOS)
45#include <grp.h>
46#endif
47
48#if !defined(OS_ZOS)
49#include <sys/param.h>
50#endif
51
52// We need to do this on AIX due to some inconsistencies in how AIX
53// handles XOPEN_SOURCE and ALL_SOURCE.
54#if defined(OS_AIX)
55extern "C" char* mkdtemp(char* path);
56#endif
57
58namespace base {
59
60namespace {
61
62#if defined(OS_BSD) || defined(OS_MACOSX) || defined(OS_NACL) || \
63    defined(OS_HAIKU) || defined(OS_MSYS) || defined(OS_ZOS) ||  \
64    defined(OS_ANDROID) && __ANDROID_API__ < 21 || defined(OS_SERENITY)
65int CallStat(const char* path, stat_wrapper_t* sb) {
66  return stat(path, sb);
67}
68int CallLstat(const char* path, stat_wrapper_t* sb) {
69  return lstat(path, sb);
70}
71#else
72int CallStat(const char* path, stat_wrapper_t* sb) {
73  return stat64(path, sb);
74}
75int CallLstat(const char* path, stat_wrapper_t* sb) {
76  return lstat64(path, sb);
77}
78#endif
79
80// Helper for VerifyPathControlledByUser.
81bool VerifySpecificPathControlledByUser(const FilePath& path,
82                                        uid_t owner_uid,
83                                        const std::set<gid_t>& group_gids) {
84  stat_wrapper_t stat_info;
85  if (CallLstat(path.value().c_str(), &stat_info) != 0) {
86    DPLOG(ERROR) << "Failed to get information on path " << path.value();
87    return false;
88  }
89
90  if (S_ISLNK(stat_info.st_mode)) {
91    DLOG(ERROR) << "Path " << path.value() << " is a symbolic link.";
92    return false;
93  }
94
95  if (stat_info.st_uid != owner_uid) {
96    DLOG(ERROR) << "Path " << path.value() << " is owned by the wrong user.";
97    return false;
98  }
99
100  if ((stat_info.st_mode & S_IWGRP) &&
101      !ContainsKey(group_gids, stat_info.st_gid)) {
102    DLOG(ERROR) << "Path " << path.value()
103                << " is writable by an unprivileged group.";
104    return false;
105  }
106
107  if (stat_info.st_mode & S_IWOTH) {
108    DLOG(ERROR) << "Path " << path.value() << " is writable by any user.";
109    return false;
110  }
111
112  return true;
113}
114
115std::string TempFileName() {
116  return std::string(".org.chromium.Chromium.XXXXXX");
117}
118
119#if !defined(OS_MACOSX)
120bool CopyFileContents(File* infile, File* outfile) {
121  static constexpr size_t kBufferSize = 32768;
122  std::vector<char> buffer(kBufferSize);
123
124  for (;;) {
125    ssize_t bytes_read = infile->ReadAtCurrentPos(buffer.data(), buffer.size());
126    if (bytes_read < 0)
127      return false;
128    if (bytes_read == 0)
129      return true;
130    // Allow for partial writes
131    ssize_t bytes_written_per_read = 0;
132    do {
133      ssize_t bytes_written_partial = outfile->WriteAtCurrentPos(
134          &buffer[bytes_written_per_read], bytes_read - bytes_written_per_read);
135      if (bytes_written_partial < 0)
136        return false;
137
138      bytes_written_per_read += bytes_written_partial;
139    } while (bytes_written_per_read < bytes_read);
140  }
141
142  NOTREACHED();
143  return false;
144}
145
146// Appends |mode_char| to |mode| before the optional character set encoding; see
147// https://www.gnu.org/software/libc/manual/html_node/Opening-Streams.html for
148// details.
149#if !defined(OS_ZOS)
150std::string AppendModeCharacter(std::string_view mode, char mode_char) {
151  std::string result(mode);
152  size_t comma_pos = result.find(',');
153  result.insert(comma_pos == std::string::npos ? result.length() : comma_pos, 1,
154                mode_char);
155  return result;
156}
157#endif  // !OS_ZOS
158
159#endif  // !OS_MACOSX
160}  // namespace
161
162FilePath MakeAbsoluteFilePath(const FilePath& input) {
163  char full_path[PATH_MAX];
164  if (realpath(input.value().c_str(), full_path) == nullptr)
165    return FilePath();
166  return FilePath(full_path);
167}
168
169// TODO(erikkay): The Windows version of this accepts paths like "foo/bar/*"
170// which works both with and without the recursive flag.  I'm not sure we need
171// that functionality. If not, remove from file_util_win.cc, otherwise add it
172// here.
173bool DeleteFile(const FilePath& path, bool recursive) {
174  const char* path_str = path.value().c_str();
175  stat_wrapper_t file_info;
176  if (CallLstat(path_str, &file_info) != 0) {
177    // The Windows version defines this condition as success.
178    return (errno == ENOENT || errno == ENOTDIR);
179  }
180  if (!S_ISDIR(file_info.st_mode))
181    return (unlink(path_str) == 0);
182  if (!recursive)
183    return (rmdir(path_str) == 0);
184
185  bool success = true;
186  stack<std::string> directories;
187  directories.push(path.value());
188  FileEnumerator traversal(path, true,
189                           FileEnumerator::FILES | FileEnumerator::DIRECTORIES |
190                               FileEnumerator::SHOW_SYM_LINKS);
191  for (FilePath current = traversal.Next(); !current.empty();
192       current = traversal.Next()) {
193    if (traversal.GetInfo().IsDirectory())
194      directories.push(current.value());
195    else
196      success &= (unlink(current.value().c_str()) == 0);
197  }
198
199  while (!directories.empty()) {
200    FilePath dir = FilePath(directories.top());
201    directories.pop();
202    success &= (rmdir(dir.value().c_str()) == 0);
203  }
204  return success;
205}
206
207bool ReplaceFile(const FilePath& from_path,
208                 const FilePath& to_path,
209                 File::Error* error) {
210  if (rename(from_path.value().c_str(), to_path.value().c_str()) == 0)
211    return true;
212  if (error)
213    *error = File::GetLastFileError();
214  return false;
215}
216
217bool CreateLocalNonBlockingPipe(int fds[2]) {
218#if defined(OS_LINUX) || defined(OS_BSD)
219  return pipe2(fds, O_CLOEXEC | O_NONBLOCK) == 0;
220#else
221  int raw_fds[2];
222  if (pipe(raw_fds) != 0)
223    return false;
224  ScopedFD fd_out(raw_fds[0]);
225  ScopedFD fd_in(raw_fds[1]);
226  if (!SetCloseOnExec(fd_out.get()))
227    return false;
228  if (!SetCloseOnExec(fd_in.get()))
229    return false;
230  if (!SetNonBlocking(fd_out.get()))
231    return false;
232  if (!SetNonBlocking(fd_in.get()))
233    return false;
234  fds[0] = fd_out.release();
235  fds[1] = fd_in.release();
236  return true;
237#endif
238}
239
240bool SetNonBlocking(int fd) {
241  const int flags = fcntl(fd, F_GETFL);
242  if (flags == -1)
243    return false;
244  if (flags & O_NONBLOCK)
245    return true;
246  if (HANDLE_EINTR(fcntl(fd, F_SETFL, flags | O_NONBLOCK)) == -1)
247    return false;
248  return true;
249}
250
251bool SetCloseOnExec(int fd) {
252  const int flags = fcntl(fd, F_GETFD);
253  if (flags == -1)
254    return false;
255  if (flags & FD_CLOEXEC)
256    return true;
257  if (HANDLE_EINTR(fcntl(fd, F_SETFD, flags | FD_CLOEXEC)) == -1)
258    return false;
259  return true;
260}
261
262bool PathExists(const FilePath& path) {
263  return access(path.value().c_str(), F_OK) == 0;
264}
265
266bool PathIsWritable(const FilePath& path) {
267  return access(path.value().c_str(), W_OK) == 0;
268}
269
270bool DirectoryExists(const FilePath& path) {
271  stat_wrapper_t file_info;
272  if (CallStat(path.value().c_str(), &file_info) != 0)
273    return false;
274  return S_ISDIR(file_info.st_mode);
275}
276
277ScopedFD CreateAndOpenFdForTemporaryFileInDir(const FilePath& directory,
278                                              FilePath* path) {
279  *path = directory.Append(TempFileName());
280  const std::string& tmpdir_string = path->value();
281  // this should be OK since mkstemp just replaces characters in place
282  char* buffer = const_cast<char*>(tmpdir_string.c_str());
283
284  return ScopedFD(HANDLE_EINTR(mkstemp(buffer)));
285}
286
287#if !defined(OS_FUCHSIA)
288bool CreateSymbolicLink(const FilePath& target_path,
289                        const FilePath& symlink_path) {
290  DCHECK(!symlink_path.empty());
291  DCHECK(!target_path.empty());
292  return ::symlink(target_path.value().c_str(), symlink_path.value().c_str()) !=
293         -1;
294}
295
296bool ReadSymbolicLink(const FilePath& symlink_path, FilePath* target_path) {
297  DCHECK(!symlink_path.empty());
298  DCHECK(target_path);
299  char buf[PATH_MAX];
300  ssize_t count = ::readlink(symlink_path.value().c_str(), buf, std::size(buf));
301
302  if (count <= 0) {
303    target_path->clear();
304    return false;
305  }
306
307  *target_path = FilePath(FilePath::StringType(buf, count));
308  return true;
309}
310
311bool GetPosixFilePermissions(const FilePath& path, int* mode) {
312  DCHECK(mode);
313
314  stat_wrapper_t file_info;
315  // Uses stat(), because on symbolic link, lstat() does not return valid
316  // permission bits in st_mode
317  if (CallStat(path.value().c_str(), &file_info) != 0)
318    return false;
319
320  *mode = file_info.st_mode & FILE_PERMISSION_MASK;
321  return true;
322}
323
324bool SetPosixFilePermissions(const FilePath& path, int mode) {
325  DCHECK_EQ(mode & ~FILE_PERMISSION_MASK, 0);
326
327  // Calls stat() so that we can preserve the higher bits like S_ISGID.
328  stat_wrapper_t stat_buf;
329  if (CallStat(path.value().c_str(), &stat_buf) != 0)
330    return false;
331
332  // Clears the existing permission bits, and adds the new ones.
333  mode_t updated_mode_bits = stat_buf.st_mode & ~FILE_PERMISSION_MASK;
334  updated_mode_bits |= mode & FILE_PERMISSION_MASK;
335
336  if (HANDLE_EINTR(chmod(path.value().c_str(), updated_mode_bits)) != 0)
337    return false;
338
339  return true;
340}
341
342bool ExecutableExistsInPath(Environment* env,
343                            const FilePath::StringType& executable) {
344  std::string path;
345  if (!env->GetVar("PATH", &path)) {
346    LOG(ERROR) << "No $PATH variable. Assuming no " << executable << ".";
347    return false;
348  }
349
350  for (const std::string_view& cur_path :
351       SplitStringPiece(path, ":", KEEP_WHITESPACE, SPLIT_WANT_NONEMPTY)) {
352    FilePath file(cur_path);
353    int permissions;
354    if (GetPosixFilePermissions(file.Append(executable), &permissions) &&
355        (permissions & FILE_PERMISSION_EXECUTE_BY_USER))
356      return true;
357  }
358  return false;
359}
360
361#endif  // !OS_FUCHSIA
362
363bool GetTempDir(FilePath* path) {
364  const char* tmp = getenv("TMPDIR");
365  if (tmp) {
366    *path = FilePath(tmp);
367    return true;
368  }
369
370  *path = FilePath("/tmp");
371  return true;
372}
373
374#if !defined(OS_MACOSX)  // Mac implementation is in file_util_mac.mm.
375FilePath GetHomeDir() {
376  const char* home_dir = getenv("HOME");
377  if (home_dir && home_dir[0])
378    return FilePath(home_dir);
379
380  FilePath rv;
381  if (GetTempDir(&rv))
382    return rv;
383
384  // Last resort.
385  return FilePath("/tmp");
386}
387#endif  // !defined(OS_MACOSX)
388
389File CreateAndOpenTemporaryFileInDir(const FilePath& dir, FilePath* temp_file) {
390  ScopedFD fd = CreateAndOpenFdForTemporaryFileInDir(dir, temp_file);
391  return fd.is_valid() ? File(std::move(fd)) : File(File::GetLastFileError());
392}
393
394static bool CreateTemporaryDirInDirImpl(const FilePath& base_dir,
395                                        const FilePath::StringType& name_tmpl,
396                                        FilePath* new_dir) {
397  DCHECK(name_tmpl.find("XXXXXX") != FilePath::StringType::npos)
398      << "Directory name template must contain \"XXXXXX\".";
399
400  FilePath sub_dir = base_dir.Append(name_tmpl);
401  std::string sub_dir_string = sub_dir.value();
402
403  // this should be OK since mkdtemp just replaces characters in place
404  char* buffer = const_cast<char*>(sub_dir_string.c_str());
405#if !defined(OS_ZOS)
406  char* dtemp = mkdtemp(buffer);
407  if (!dtemp) {
408    DPLOG(ERROR) << "mkdtemp";
409    return false;
410  }
411#else
412  // TODO(gabylb) - zos: currently no mkdtemp on z/OS.
413  // Get a unique temp filename, which should also be unique as a directory name
414  char* dtemp = mktemp(buffer);
415  if (!dtemp) {
416    DPLOG(ERROR) << "mktemp";
417    return false;
418  }
419  if (mkdir(dtemp, S_IRWXU)) {
420    DPLOG(ERROR) << "mkdir";
421    return false;
422  }
423#endif
424  *new_dir = FilePath(dtemp);
425  return true;
426}
427
428bool CreateTemporaryDirInDir(const FilePath& base_dir,
429                             const FilePath::StringType& prefix,
430                             FilePath* new_dir) {
431  FilePath::StringType mkdtemp_template = prefix;
432  mkdtemp_template.append(FILE_PATH_LITERAL("XXXXXX"));
433  return CreateTemporaryDirInDirImpl(base_dir, mkdtemp_template, new_dir);
434}
435
436bool CreateNewTempDirectory(const FilePath::StringType& prefix,
437                            FilePath* new_temp_path) {
438  FilePath tmpdir;
439  if (!GetTempDir(&tmpdir))
440    return false;
441
442  return CreateTemporaryDirInDirImpl(tmpdir, TempFileName(), new_temp_path);
443}
444
445bool CreateDirectoryAndGetError(const FilePath& full_path, File::Error* error) {
446  std::vector<FilePath> subpaths;
447
448  // Collect a list of all parent directories.
449  FilePath last_path = full_path;
450  subpaths.push_back(full_path);
451  for (FilePath path = full_path.DirName(); path.value() != last_path.value();
452       path = path.DirName()) {
453    subpaths.push_back(path);
454    last_path = path;
455  }
456
457  // Iterate through the parents and create the missing ones.
458  for (std::vector<FilePath>::reverse_iterator i = subpaths.rbegin();
459       i != subpaths.rend(); ++i) {
460    if (DirectoryExists(*i))
461      continue;
462    if (mkdir(i->value().c_str(), 0777) == 0)
463      continue;
464    // Mkdir failed, but it might have failed with EEXIST, or some other error
465    // due to the the directory appearing out of thin air. This can occur if
466    // two processes are trying to create the same file system tree at the same
467    // time. Check to see if it exists and make sure it is a directory.
468    int saved_errno = errno;
469    if (!DirectoryExists(*i)) {
470      if (error)
471        *error = File::OSErrorToFileError(saved_errno);
472      return false;
473    }
474  }
475  return true;
476}
477
478bool NormalizeFilePath(const FilePath& path, FilePath* normalized_path) {
479  FilePath real_path_result = MakeAbsoluteFilePath(path);
480  if (real_path_result.empty())
481    return false;
482
483  // To be consistent with windows, fail if |real_path_result| is a
484  // directory.
485  if (DirectoryExists(real_path_result))
486    return false;
487
488  *normalized_path = real_path_result;
489  return true;
490}
491
492// TODO(rkc): Refactor GetFileInfo and FileEnumerator to handle symlinks
493// correctly. http://code.google.com/p/chromium-os/issues/detail?id=15948
494bool IsLink(const FilePath& file_path) {
495  stat_wrapper_t st;
496  // If we can't lstat the file, it's safe to assume that the file won't at
497  // least be a 'followable' link.
498  if (CallLstat(file_path.value().c_str(), &st) != 0)
499    return false;
500  return S_ISLNK(st.st_mode);
501}
502
503bool GetFileInfo(const FilePath& file_path, File::Info* results) {
504  stat_wrapper_t file_info;
505  if (CallStat(file_path.value().c_str(), &file_info) != 0)
506    return false;
507
508  results->FromStat(file_info);
509  return true;
510}
511
512FILE* OpenFile(const FilePath& filename, const char* mode) {
513  // 'e' is unconditionally added below, so be sure there is not one already
514  // present before a comma in |mode|.
515  DCHECK(
516      strchr(mode, 'e') == nullptr ||
517      (strchr(mode, ',') != nullptr && strchr(mode, 'e') > strchr(mode, ',')));
518  FILE* result = nullptr;
519#if defined(OS_MACOSX) || defined(OS_ZOS)
520  // macOS does not provide a mode character to set O_CLOEXEC; see
521  // https://developer.apple.com/legacy/library/documentation/Darwin/Reference/ManPages/man3/fopen.3.html.
522  const char* the_mode = mode;
523#else
524  std::string mode_with_e(AppendModeCharacter(mode, 'e'));
525  const char* the_mode = mode_with_e.c_str();
526#endif
527  do {
528    result = fopen(filename.value().c_str(), the_mode);
529  } while (!result && errno == EINTR);
530#if defined(OS_MACOSX) || defined(OS_ZOS)
531  // Mark the descriptor as close-on-exec.
532  if (result)
533    SetCloseOnExec(fileno(result));
534#endif
535  return result;
536}
537
538FILE* FileToFILE(File file, const char* mode) {
539  FILE* stream = fdopen(file.GetPlatformFile(), mode);
540  if (stream)
541    file.TakePlatformFile();
542  return stream;
543}
544
545int ReadFile(const FilePath& filename, char* data, int max_size) {
546  int fd = HANDLE_EINTR(open(filename.value().c_str(), O_RDONLY));
547  if (fd < 0)
548    return -1;
549
550  ssize_t bytes_read = HANDLE_EINTR(read(fd, data, max_size));
551  if (IGNORE_EINTR(close(fd)) < 0)
552    return -1;
553  return bytes_read;
554}
555
556int WriteFile(const FilePath& filename, const char* data, int size) {
557  int fd = HANDLE_EINTR(creat(filename.value().c_str(), 0666));
558  if (fd < 0)
559    return -1;
560
561  int bytes_written = WriteFileDescriptor(fd, data, size) ? size : -1;
562  if (IGNORE_EINTR(close(fd)) < 0)
563    return -1;
564  return bytes_written;
565}
566
567bool WriteFileDescriptor(const int fd, const char* data, int size) {
568  // Allow for partial writes.
569  ssize_t bytes_written_total = 0;
570  for (ssize_t bytes_written_partial = 0; bytes_written_total < size;
571       bytes_written_total += bytes_written_partial) {
572    bytes_written_partial = HANDLE_EINTR(
573        write(fd, data + bytes_written_total, size - bytes_written_total));
574    if (bytes_written_partial < 0)
575      return false;
576  }
577
578  return true;
579}
580
581bool AppendToFile(const FilePath& filename, const char* data, int size) {
582  bool ret = true;
583  int fd = HANDLE_EINTR(open(filename.value().c_str(), O_WRONLY | O_APPEND));
584  if (fd < 0) {
585    return false;
586  }
587
588  // This call will either write all of the data or return false.
589  if (!WriteFileDescriptor(fd, data, size)) {
590    ret = false;
591  }
592
593  if (IGNORE_EINTR(close(fd)) < 0) {
594    return false;
595  }
596
597  return ret;
598}
599
600bool GetCurrentDirectory(FilePath* dir) {
601  char system_buffer[PATH_MAX] = "";
602  if (!getcwd(system_buffer, sizeof(system_buffer))) {
603    NOTREACHED();
604    return false;
605  }
606  *dir = FilePath(system_buffer);
607  return true;
608}
609
610bool SetCurrentDirectory(const FilePath& path) {
611  return chdir(path.value().c_str()) == 0;
612}
613
614bool VerifyPathControlledByUser(const FilePath& base,
615                                const FilePath& path,
616                                uid_t owner_uid,
617                                const std::set<gid_t>& group_gids) {
618  if (base != path && !base.IsParent(path)) {
619    DLOG(ERROR) << "|base| must be a subdirectory of |path|.  base = \""
620                << base.value() << "\", path = \"" << path.value() << "\"";
621    return false;
622  }
623
624  std::vector<FilePath::StringType> base_components;
625  std::vector<FilePath::StringType> path_components;
626
627  base.GetComponents(&base_components);
628  path.GetComponents(&path_components);
629
630  std::vector<FilePath::StringType>::const_iterator ib, ip;
631  for (ib = base_components.begin(), ip = path_components.begin();
632       ib != base_components.end(); ++ib, ++ip) {
633    // |base| must be a subpath of |path|, so all components should match.
634    // If these CHECKs fail, look at the test that base is a parent of
635    // path at the top of this function.
636    DCHECK(ip != path_components.end());
637    DCHECK(*ip == *ib);
638  }
639
640  FilePath current_path = base;
641  if (!VerifySpecificPathControlledByUser(current_path, owner_uid, group_gids))
642    return false;
643
644  for (; ip != path_components.end(); ++ip) {
645    current_path = current_path.Append(*ip);
646    if (!VerifySpecificPathControlledByUser(current_path, owner_uid,
647                                            group_gids))
648      return false;
649  }
650  return true;
651}
652
653#if defined(OS_MACOSX) && !defined(OS_IOS)
654bool VerifyPathControlledByAdmin(const FilePath& path) {
655  const unsigned kRootUid = 0;
656  const FilePath kFileSystemRoot("/");
657
658  // The name of the administrator group on mac os.
659  const char* const kAdminGroupNames[] = {"admin", "wheel"};
660
661  std::set<gid_t> allowed_group_ids;
662  for (int i = 0, ie = std::size(kAdminGroupNames); i < ie; ++i) {
663    struct group* group_record = getgrnam(kAdminGroupNames[i]);
664    if (!group_record) {
665      DPLOG(ERROR) << "Could not get the group ID of group \""
666                   << kAdminGroupNames[i] << "\".";
667      continue;
668    }
669
670    allowed_group_ids.insert(group_record->gr_gid);
671  }
672
673  return VerifyPathControlledByUser(kFileSystemRoot, path, kRootUid,
674                                    allowed_group_ids);
675}
676#endif  // defined(OS_MACOSX) && !defined(OS_IOS)
677
678int GetMaximumPathComponentLength(const FilePath& path) {
679  return pathconf(path.value().c_str(), _PC_NAME_MAX);
680}
681
682#if !defined(OS_MACOSX)
683// Mac has its own implementation, this is for all other Posix systems.
684bool CopyFile(const FilePath& from_path, const FilePath& to_path) {
685  File infile;
686  infile = File(from_path, File::FLAG_OPEN | File::FLAG_READ);
687  if (!infile.IsValid())
688    return false;
689
690  File outfile(to_path, File::FLAG_WRITE | File::FLAG_CREATE_ALWAYS);
691  if (!outfile.IsValid())
692    return false;
693
694  return CopyFileContents(&infile, &outfile);
695}
696#endif  // !defined(OS_MACOSX)
697
698}  // namespace base
699