1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
|
/*
* libdpkg - Debian packaging suite library routines
* path-remove.c - path removal functions
*
* Copyright © 1994-1995 Ian Jackson <ijackson@chiark.greenend.org.uk>
* Copyright © 2007-2015 Guillem Jover <guillem@debian.org>
*
* This is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* This is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <https://www.gnu.org/licenses/>.
*/
#include <config.h>
#include <compat.h>
#include <sys/stat.h>
#include <errno.h>
#include <string.h>
#include <unistd.h>
#include <dpkg/i18n.h>
#include <dpkg/dpkg.h>
#include <dpkg/path.h>
#include <dpkg/debug.h>
#include <dpkg/subproc.h>
int
secure_unlink_statted(const char *pathname, const struct stat *stab)
{
if (S_ISREG(stab->st_mode) ? (stab->st_mode & 07000) :
!(S_ISLNK(stab->st_mode) || S_ISDIR(stab->st_mode) ||
S_ISFIFO(stab->st_mode) || S_ISSOCK(stab->st_mode))) {
if (chmod(pathname, 0600))
return -1;
}
if (unlink(pathname))
return -1;
return 0;
}
/**
* Securely unlink a pathname.
*
* If the pathname to remove is:
*
* 1. a sticky or set-id file, or
* 2. an unknown object (i.e., not a file, link, directory, fifo or socket)
*
* we change its mode so that a malicious user cannot use it, even if it's
* linked to another file.
*/
int
secure_unlink(const char *pathname)
{
struct stat stab;
if (lstat(pathname, &stab))
return -1;
return secure_unlink_statted(pathname, &stab);
}
/**
* Securely remove a pathname.
*
* This is a secure version of remove(3) using secure_unlink() instead of
* unlink(2).
*
* @retval 0 On success.
* @retval -1 On failure, just like unlink(2) & rmdir(2).
*/
int
secure_remove(const char *pathname)
{
int rc, e;
if (!rmdir(pathname)) {
debug(dbg_eachfiledetail, "secure_remove '%s' rmdir OK",
pathname);
return 0;
}
if (errno != ENOTDIR) {
e = errno;
debug(dbg_eachfiledetail, "secure_remove '%s' rmdir %s",
pathname, strerror(e));
errno = e;
return -1;
}
rc = secure_unlink(pathname);
e = errno;
debug(dbg_eachfiledetail, "secure_remove '%s' unlink %s",
pathname, rc ? strerror(e) : "OK");
errno = e;
return rc;
}
/**
* Remove a pathname and anything below it.
*
* This function removes pathname and all its contents recursively.
*/
void
path_remove_tree(const char *pathname)
{
pid_t pid;
const char *u;
u = path_skip_slash_dotslash(pathname);
if (u[0] == '\0')
internerr("pathname '%s' reduces to nothing", pathname);
debug(dbg_eachfile, "%s '%s'", __func__, pathname);
if (!rmdir(pathname))
return; /* Deleted it OK, it was a directory. */
if (errno == ENOENT || errno == ELOOP)
return;
if (errno == ENOTDIR) {
/* Either it's a file, or one of the path components is. If
* one of the path components is this will fail again ... */
if (secure_unlink(pathname) == 0)
return; /* OK, it was. */
if (errno == ENOTDIR)
return;
}
/* Trying to remove a directory or a file on a read-only filesystem,
* even if non-existent, always returns EROFS. */
if (errno == EROFS) {
if (access(pathname, F_OK) < 0 && errno == ENOENT)
return;
errno = EROFS;
}
if (errno != ENOTEMPTY && errno != EEXIST) /* Huh? */
ohshite(_("unable to securely remove '%.255s'"), pathname);
pid = subproc_fork();
if (pid == 0) {
execlp(RM, "rm", "-rf", "--", pathname, NULL);
ohshite(_("unable to execute %s (%s)"),
_("rm command for cleanup"), RM);
}
debug(dbg_eachfile, "%s running rm -rf '%s'", __func__, pathname);
subproc_reap(pid, _("rm command for cleanup"), 0);
}
|
