diff options
34 files changed, 294 insertions, 255 deletions
diff --git a/Makefile.am b/Makefile.am index 1b64b6232e..4973d8418c 100644 --- a/Makefile.am +++ b/Makefile.am @@ -771,6 +771,8 @@ libsystemd_shared_la_SOURCES = \ src/shared/device-nodes.h \ src/shared/util.c \ src/shared/util.h \ + src/shared/rm-rf.c \ + src/shared/rm-rf.h \ src/shared/virt.c \ src/shared/virt.h \ src/shared/architecture.c \ diff --git a/src/boot/bootctl.c b/src/boot/bootctl.c index bc1405145e..001cfa76fd 100644 --- a/src/boot/bootctl.c +++ b/src/boot/bootctl.c @@ -41,6 +41,7 @@ #include "efivars.h" #include "build.h" #include "util.h" +#include "rm-rf.h" static int verify_esp(const char *p, uint32_t *part, uint64_t *pstart, uint64_t *psize, sd_id128_t *uuid) { struct statfs sfs; @@ -1095,7 +1096,7 @@ static int remove_binaries(const char *esp_path) { return -ENOMEM; } - r = rm_rf(p, false, false, false); + r = rm_rf(p, REMOVE_ROOT|REMOVE_PHYSICAL); free(p); q = remove_boot_efi(esp_path); diff --git a/src/core/execute.c b/src/core/execute.c index 02df51b5bb..768a32b31f 100644 --- a/src/core/execute.c +++ b/src/core/execute.c @@ -49,6 +49,7 @@ #include <sys/apparmor.h> #endif +#include "rm-rf.h" #include "execute.h" #include "strv.h" #include "macro.h" @@ -2020,7 +2021,7 @@ int exec_context_destroy_runtime_directory(ExecContext *c, const char *runtime_p /* We execute this synchronously, since we need to be * sure this is gone when we start the service * next. */ - rm_rf(p, false, true, false); + (void) rm_rf(p, REMOVE_ROOT); } return 0; @@ -2846,7 +2847,7 @@ int exec_runtime_deserialize_item(ExecRuntime **rt, Unit *u, const char *key, co static void *remove_tmpdir_thread(void *p) { _cleanup_free_ char *path = p; - rm_rf_dangerous(path, false, true, false); + (void) rm_rf(path, REMOVE_ROOT|REMOVE_PHYSICAL); return NULL; } diff --git a/src/core/machine-id-setup.c b/src/core/machine-id-setup.c index 7505dcbcaa..2ffb2a7aa6 100644 --- a/src/core/machine-id-setup.c +++ b/src/core/machine-id-setup.c @@ -313,7 +313,7 @@ int machine_id_commit(const char *root) { if (r < 0) return log_error_errno(r, "We didn't find a valid machine ID in %s.", etc_machine_id); - r = is_fd_on_temporary_fs(fd); + r = fd_is_temporary_fs(fd); if (r < 0) return log_error_errno(r, "Failed to determine whether %s is on a temporary file system: %m", etc_machine_id); if (r == 0) { diff --git a/src/core/manager.c b/src/core/manager.c index 1afd359df2..73417ab1a8 100644 --- a/src/core/manager.c +++ b/src/core/manager.c @@ -52,6 +52,7 @@ #include "locale-setup.h" #include "unit-name.h" #include "missing.h" +#include "rm-rf.h" #include "path-lookup.h" #include "special.h" #include "exit-status.h" @@ -2881,7 +2882,7 @@ static void remove_generator_dir(Manager *m, char **generator) { return; strv_remove(m->lookup_paths.unit_path, *generator); - rm_rf(*generator, false, true, false); + (void) rm_rf(*generator, REMOVE_ROOT); free(*generator); *generator = NULL; diff --git a/src/import/aufs-util.c b/src/import/aufs-util.c index c1301cdb4a..18c42b8b6d 100644 --- a/src/import/aufs-util.c +++ b/src/import/aufs-util.c @@ -22,6 +22,7 @@ #include <ftw.h> #include "util.h" +#include "rm-rf.h" #include "aufs-util.h" static int nftw_cb( @@ -43,7 +44,7 @@ static int nftw_cb( return FTW_CONTINUE; log_debug("Removing whiteout indicator %s.", fpath); - r = rm_rf_dangerous(fpath, false, true, false); + r = rm_rf(fpath, REMOVE_ROOT|REMOVE_PHYSICAL); if (r < 0) return FTW_STOP; @@ -53,7 +54,7 @@ static int nftw_cb( strcpy(mempcpy(p, fpath, ftwbuf->base), original); log_debug("Removing deleted file %s.", p); - r = rm_rf_dangerous(p, false, true, false); + r = rm_rf(p, REMOVE_ROOT|REMOVE_PHYSICAL); if (r < 0) return FTW_STOP; } diff --git a/src/import/import-raw.c b/src/import/import-raw.c index 7d1ac2afd7..3a315139e5 100644 --- a/src/import/import-raw.c +++ b/src/import/import-raw.c @@ -28,6 +28,7 @@ #include "btrfs-util.h" #include "copy.h" #include "mkdir.h" +#include "rm-rf.h" #include "ratelimit.h" #include "machine-pool.h" #include "qcow2-util.h" @@ -242,7 +243,7 @@ static int raw_import_finish(RawImport *i) { if (i->force_local) { (void) btrfs_subvol_remove(i->final_path); - (void) rm_rf_dangerous(i->final_path, false, true, false); + (void) rm_rf(i->final_path, REMOVE_ROOT|REMOVE_PHYSICAL); } r = rename_noreplace(AT_FDCWD, i->temp_path, AT_FDCWD, i->final_path); diff --git a/src/import/import-tar.c b/src/import/import-tar.c index ef2345c7b9..c5346ca2b0 100644 --- a/src/import/import-tar.c +++ b/src/import/import-tar.c @@ -28,6 +28,7 @@ #include "btrfs-util.h" #include "copy.h" #include "mkdir.h" +#include "rm-rf.h" #include "ratelimit.h" #include "machine-pool.h" #include "qcow2-util.h" @@ -87,7 +88,7 @@ TarImport* tar_import_unref(TarImport *i) { if (i->temp_path) { (void) btrfs_subvol_remove(i->temp_path); - (void) rm_rf_dangerous(i->temp_path, false, true, false); + (void) rm_rf(i->temp_path, REMOVE_ROOT|REMOVE_PHYSICAL); free(i->temp_path); } @@ -198,7 +199,7 @@ static int tar_import_finish(TarImport *i) { if (i->force_local) { (void) btrfs_subvol_remove(i->final_path); - (void) rm_rf_dangerous(i->final_path, false, true, false); + (void) rm_rf(i->final_path, REMOVE_ROOT|REMOVE_PHYSICAL); } r = rename_noreplace(AT_FDCWD, i->temp_path, AT_FDCWD, i->final_path); diff --git a/src/import/pull-common.c b/src/import/pull-common.c index 94dd54bd57..d4cebe205e 100644 --- a/src/import/pull-common.c +++ b/src/import/pull-common.c @@ -24,6 +24,7 @@ #include "util.h" #include "strv.h" #include "copy.h" +#include "rm-rf.h" #include "btrfs-util.h" #include "capability.h" #include "pull-job.h" @@ -125,7 +126,7 @@ int pull_make_local_copy(const char *final, const char *image_root, const char * if (force_local) { (void) btrfs_subvol_remove(p); - (void) rm_rf_dangerous(p, false, true, false); + (void) rm_rf(p, REMOVE_ROOT|REMOVE_PHYSICAL); } r = btrfs_subvol_snapshot(final, p, false, false); @@ -418,7 +419,7 @@ finish: unlink(sig_file_path); if (gpg_home_created) - rm_rf_dangerous(gpg_home, false, true, false); + (void) rm_rf(gpg_home, REMOVE_ROOT|REMOVE_PHYSICAL); return r; } diff --git a/src/import/pull-dkr.c b/src/import/pull-dkr.c index 1a7dc310cb..a1e6fe8ff7 100644 --- a/src/import/pull-dkr.c +++ b/src/import/pull-dkr.c @@ -28,6 +28,7 @@ #include "btrfs-util.h" #include "utf8.h" #include "mkdir.h" +#include "rm-rf.h" #include "path-util.h" #include "import-util.h" #include "curl-util.h" @@ -111,7 +112,7 @@ DkrPull* dkr_pull_unref(DkrPull *i) { if (i->temp_path) { (void) btrfs_subvol_remove(i->temp_path); - (void) rm_rf_dangerous(i->temp_path, false, true, false); + (void) rm_rf(i->temp_path, REMOVE_ROOT|REMOVE_PHYSICAL); free(i->temp_path); } diff --git a/src/import/pull-raw.c b/src/import/pull-raw.c index c0c6d57ead..e10b280b66 100644 --- a/src/import/pull-raw.c +++ b/src/import/pull-raw.c @@ -31,6 +31,7 @@ #include "util.h" #include "macro.h" #include "mkdir.h" +#include "rm-rf.h" #include "path-util.h" #include "import-util.h" #include "import-common.h" @@ -278,7 +279,7 @@ static int raw_pull_make_local_copy(RawPull *i) { if (i->force_local) { (void) btrfs_subvol_remove(p); - (void) rm_rf_dangerous(p, false, true, false); + (void) rm_rf(p, REMOVE_ROOT|REMOVE_PHYSICAL); } r = tempfn_random(p, &tp); diff --git a/src/import/pull-tar.c b/src/import/pull-tar.c index 58cafdd789..60dc22fdfa 100644 --- a/src/import/pull-tar.c +++ b/src/import/pull-tar.c @@ -30,6 +30,7 @@ #include "util.h" #include "macro.h" #include "mkdir.h" +#include "rm-rf.h" #include "path-util.h" #include "import-util.h" #include "import-common.h" @@ -88,7 +89,7 @@ TarPull* tar_pull_unref(TarPull *i) { if (i->temp_path) { (void) btrfs_subvol_remove(i->temp_path); - (void) rm_rf_dangerous(i->temp_path, false, true, false); + (void) rm_rf(i->temp_path, REMOVE_ROOT|REMOVE_PHYSICAL); free(i->temp_path); } diff --git a/src/journal/journald-server.c b/src/journal/journald-server.c index 2488884634..78d5b22ae1 100644 --- a/src/journal/journald-server.c +++ b/src/journal/journald-server.c @@ -31,6 +31,7 @@ #include "sd-messages.h" #include "sd-daemon.h" #include "mkdir.h" +#include "rm-rf.h" #include "hashmap.h" #include "journal-file.h" #include "socket-util.h" @@ -1088,7 +1089,7 @@ finish: s->runtime_journal = NULL; if (r >= 0) - rm_rf("/run/log/journal", false, true, false); + (void) rm_rf("/run/log/journal", REMOVE_ROOT); sd_journal_close(j); diff --git a/src/journal/test-journal-init.c b/src/journal/test-journal-init.c index 11fb150fe8..e6599f366d 100644 --- a/src/journal/test-journal-init.c +++ b/src/journal/test-journal-init.c @@ -23,6 +23,7 @@ #include "log.h" #include "util.h" +#include "rm-rf.h" int main(int argc, char *argv[]) { sd_journal *j; @@ -58,7 +59,7 @@ int main(int argc, char *argv[]) { assert_se(j == NULL); } - assert_se(rm_rf_dangerous(t, false, true, false) >= 0); + assert_se(rm_rf(t, REMOVE_ROOT|REMOVE_PHYSICAL) >= 0); return 0; } diff --git a/src/journal/test-journal-interleaving.c b/src/journal/test-journal-interleaving.c index 3e6141771c..c2fc123e42 100644 --- a/src/journal/test-journal-interleaving.c +++ b/src/journal/test-journal-interleaving.c @@ -23,12 +23,12 @@ #include <unistd.h> #include <fcntl.h> -#include "systemd/sd-journal.h" - +#include "sd-journal.h" #include "journal-file.h" #include "journal-vacuum.h" #include "util.h" #include "log.h" +#include "rm-rf.h" /* This program tests skipping around in a multi-file journal. */ @@ -190,7 +190,7 @@ static void test_skip(void (*setup)(void)) { else { journal_directory_vacuum(".", 3000000, 0, NULL, true); - assert_se(rm_rf_dangerous(t, false, true, false) >= 0); + assert_se(rm_rf(t, REMOVE_ROOT|REMOVE_PHYSICAL) >= 0); } puts("------------------------------------------------------------"); @@ -275,7 +275,7 @@ static void test_sequence_numbers(void) { else { journal_directory_vacuum(".", 3000000, 0, NULL, true); - assert_se(rm_rf_dangerous(t, false, true, false) >= 0); + assert_se(rm_rf(t, REMOVE_ROOT|REMOVE_PHYSICAL) >= 0); } } diff --git a/src/journal/test-journal-stream.c b/src/journal/test-journal-stream.c index b8caeb3d41..e1146c692d 100644 --- a/src/journal/test-journal-stream.c +++ b/src/journal/test-journal-stream.c @@ -22,13 +22,13 @@ #include <unistd.h> #include <fcntl.h> -#include "systemd/sd-journal.h" - -#include "journal-file.h" -#include "journal-internal.h" +#include "sd-journal.h" #include "util.h" #include "log.h" #include "macro.h" +#include "rm-rf.h" +#include "journal-file.h" +#include "journal-internal.h" #define N_ENTRIES 200 @@ -180,7 +180,7 @@ int main(int argc, char *argv[]) { SD_JOURNAL_FOREACH_UNIQUE(j, data, l) printf("%.*s\n", (int) l, (const char*) data); - assert_se(rm_rf_dangerous(t, false, true, false) >= 0); + assert_se(rm_rf(t, REMOVE_ROOT|REMOVE_PHYSICAL) >= 0); return 0; } diff --git a/src/journal/test-journal-verify.c b/src/journal/test-journal-verify.c index de9cd9c8b8..8008f7455e 100644 --- a/src/journal/test-journal-verify.c +++ b/src/journal/test-journal-verify.c @@ -25,6 +25,7 @@ #include "util.h" #include "log.h" +#include "rm-rf.h" #include "journal-file.h" #include "journal-verify.h" @@ -144,7 +145,7 @@ int main(int argc, char *argv[]) { log_info("Exiting..."); - assert_se(rm_rf_dangerous(t, false, true, false) >= 0); + assert_se(rm_rf(t, REMOVE_ROOT|REMOVE_PHYSICAL) >= 0); return 0; } diff --git a/src/journal/test-journal.c b/src/journal/test-journal.c index f7cc75b3d5..caaab258c9 100644 --- a/src/journal/test-journal.c +++ b/src/journal/test-journal.c @@ -22,8 +22,8 @@ #include <fcntl.h> #include <unistd.h> - #include "log.h" +#include "rm-rf.h" #include "journal-file.h" #include "journal-authenticate.h" #include "journal-vacuum.h" @@ -118,7 +118,7 @@ static void test_non_empty(void) { else { journal_directory_vacuum(".", 3000000, 0, NULL, true); - assert_se(rm_rf_dangerous(t, false, true, false) >= 0); + assert_se(rm_rf(t, REMOVE_ROOT|REMOVE_PHYSICAL) >= 0); } puts("------------------------------------------------------------"); @@ -157,7 +157,7 @@ static void test_empty(void) { else { journal_directory_vacuum(".", 3000000, 0, NULL, true); - assert_se(rm_rf_dangerous(t, false, true, false) >= 0); + assert_se(rm_rf(t, REMOVE_ROOT|REMOVE_PHYSICAL) >= 0); } journal_file_close(f1); diff --git a/src/login/logind-user.c b/src/login/logind-user.c index 294c1e799c..cba9cb60aa 100644 --- a/src/login/logind-user.c +++ b/src/login/logind-user.c @@ -26,6 +26,7 @@ #include "util.h" #include "mkdir.h" +#include "rm-rf.h" #include "hashmap.h" #include "fileio.h" #include "path-util.h" @@ -521,7 +522,7 @@ static int user_remove_runtime_path(User *u) { if (!u->runtime_path) return 0; - r = rm_rf(u->runtime_path, false, false, false); + r = rm_rf(u->runtime_path, 0); if (r < 0) log_error_errno(r, "Failed to remove runtime directory %s: %m", u->runtime_path); @@ -532,7 +533,7 @@ static int user_remove_runtime_path(User *u) { if (r < 0 && errno != EINVAL && errno != ENOENT) log_error_errno(errno, "Failed to unmount user runtime directory %s: %m", u->runtime_path); - r = rm_rf(u->runtime_path, false, true, false); + r = rm_rf(u->runtime_path, REMOVE_ROOT); if (r < 0) log_error_errno(r, "Failed to remove runtime directory %s: %m", u->runtime_path); diff --git a/src/nspawn/nspawn.c b/src/nspawn/nspawn.c index 7e56cf2056..730541af88 100644 --- a/src/nspawn/nspawn.c +++ b/src/nspawn/nspawn.c @@ -59,6 +59,7 @@ #include "log.h" #include "util.h" #include "mkdir.h" +#include "rm-rf.h" #include "macro.h" #include "missing.h" #include "cgroup-util.h" @@ -4467,7 +4468,7 @@ finish: const char *p; p = strjoina("/run/systemd/nspawn/propagate/", arg_machine); - (void) rm_rf(p, false, true, false); + (void) rm_rf(p, REMOVE_ROOT); } free(arg_directory); diff --git a/src/shared/machine-image.c b/src/shared/machine-image.c index edf986d4db..c5808af81e 100644 --- a/src/shared/machine-image.c +++ b/src/shared/machine-image.c @@ -28,6 +28,7 @@ #include "path-util.h" #include "copy.h" #include "mkdir.h" +#include "rm-rf.h" #include "machine-image.h" static const char image_search_path[] = @@ -366,7 +367,7 @@ int image_remove(Image *i) { /* fall through */ case IMAGE_RAW: - return rm_rf_dangerous(i->path, false, true, false); + return rm_rf(i->path, REMOVE_ROOT|REMOVE_PHYSICAL); default: return -EOPNOTSUPP; diff --git a/src/shared/rm-rf.c b/src/shared/rm-rf.c new file mode 100644 index 0000000000..99d12b11c6 --- /dev/null +++ b/src/shared/rm-rf.c @@ -0,0 +1,173 @@ +/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/ + +/*** + This file is part of systemd. + + Copyright 2015 Lennart Poettering + + systemd is free software; you can redistribute it and/or modify it + under the terms of the GNU Lesser General Public License as published by + the Free Software Foundation; either version 2.1 of the License, or + (at your option) any later version. + + systemd is distributed in the hope that it will be useful, but + WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public License + along with systemd; If not, see <http://www.gnu.org/licenses/>. +***/ + +#include "util.h" +#include "path-util.h" +#include "rm-rf.h" + +int rm_rf_children(int fd, RemoveFlags flags, struct stat *root_dev) { + _cleanup_closedir_ DIR *d = NULL; + int ret = 0, r; + + assert(fd >= 0); + + /* This returns the first error we run into, but nevertheless + * tries to go on. This closes the passed fd. */ + + if (!(flags & REMOVE_PHYSICAL)) { + + r = fd_is_temporary_fs(fd); + if (r < 0) { + safe_close(fd); + return r; + } + + if (!r) { + /* We refuse to clean physical file systems + * with this call, unless explicitly + * requested. This is extra paranoia just to + * be sure we never ever remove non-state + * data */ + + log_error("Attempted to remove disk file system, and we can't allow that."); + safe_close(fd); + return -EPERM; + } + } + + d = fdopendir(fd); + if (!d) { + safe_close(fd); + return errno == ENOENT ? 0 : -errno; + } + + for (;;) { + struct dirent *de; + bool is_dir; + struct stat st; + + errno = 0; + de = readdir(d); + if (!de) { + if (errno != 0 && ret == 0) + ret = -errno; + return ret; + } + + if (streq(de->d_name, ".") || streq(de->d_name, "..")) + continue; + + if (de->d_type == DT_UNKNOWN || (de->d_type == DT_DIR && root_dev)) { + if (fstatat(fd, de->d_name, &st, AT_SYMLINK_NOFOLLOW) < 0) { + if (ret == 0 && errno != ENOENT) + ret = -errno; + continue; + } + + is_dir = S_ISDIR(st.st_mode); + } else + is_dir = de->d_type == DT_DIR; + + if (is_dir) { + int subdir_fd; + + /* if root_dev is set, remove subdirectories only, if device is same as dir */ + if (root_dev && st.st_dev != root_dev->st_dev) + continue; + + subdir_fd = openat(fd, de->d_name, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC|O_NOFOLLOW|O_NOATIME); + if (subdir_fd < 0) { + if (ret == 0 && errno != ENOENT) + ret = -errno; + continue; + } + + /* We pass REMOVE_PHYSICAL here, to avoid + * doing the fstatfs() to check the file + * system type again for each directory */ + r = rm_rf_children(subdir_fd, flags | REMOVE_PHYSICAL, root_dev); + if (r < 0 && ret == 0) + ret = r; + + if (unlinkat(fd, de->d_name, AT_REMOVEDIR) < 0) { + if (ret == 0 && errno != ENOENT) + ret = -errno; + } + + } else if (!(flags & REMOVE_ONLY_DIRECTORIES)) { + + if (unlinkat(fd, de->d_name, 0) < 0) { + if (ret == 0 && errno != ENOENT) + ret = -errno; + } + } + } +} + +int rm_rf(const char *path, RemoveFlags flags) { + int fd, r; + struct statfs s; + + assert(path); + + /* We refuse to clean the root file system with this + * call. This is extra paranoia to never cause a really + * seriously broken system. */ + if (path_equal(path, "/")) { + log_error("Attempted to remove entire root file system, and we can't allow that."); + return -EPERM; + } + + fd = open(path, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC|O_NOFOLLOW|O_NOATIME); + if (fd < 0) { + + if (errno != ENOTDIR && errno != ELOOP) + return -errno; + + if (!(flags & REMOVE_PHYSICAL)) { + if (statfs(path, &s) < 0) + return -errno; + + if (!is_temporary_fs(&s)) { + log_error("Attempted to remove disk file system, and we can't allow that."); + return -EPERM; + } + } + + if ((flags & REMOVE_ROOT) && !(flags & REMOVE_ONLY_DIRECTORIES)) + if (unlink(path) < 0 && errno != ENOENT) + return -errno; + + return 0; + } + + r = rm_rf_children(fd, flags, NULL); + + if (flags & REMOVE_ROOT) { + + if (rmdir(path) < 0 && errno != ENOENT) { + if (r == 0) + r = -errno; + } + } + + return r; +} diff --git a/src/shared/rm-rf.h b/src/shared/rm-rf.h new file mode 100644 index 0000000000..769bbc853d --- /dev/null +++ b/src/shared/rm-rf.h @@ -0,0 +1,33 @@ +/*-*- Mode: C; c-basic-offset: 8; indent-tabs-mode: nil -*-*/ + +#pragma once + +/*** + This file is part of systemd. + + Copyright 2015 Lennart Poettering + + systemd is free software; you can redistribute it and/or modify it + under the terms of the GNU Lesser General Public License as published by + the Free Software Foundation; either version 2.1 of the License, or + (at your option) any later version. + + systemd is distributed in the hope that it will be useful, but + WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + Lesser General Public License for more details. + + You should have received a copy of the GNU Lesser General Public License + along with systemd; If not, see <http://www.gnu.org/licenses/>. +***/ + +#include <sys/stat.h> + +typedef enum RemoveFlags { + REMOVE_ONLY_DIRECTORIES = 1, + REMOVE_ROOT = 2, + REMOVE_PHYSICAL = 4, /* if not set, only removes files on tmpfs, never physical file systems */ +} RemoveFlags; + +int rm_rf_children(int fd, RemoveFlags flags, struct stat *root_dev); +int rm_rf(const char *path, RemoveFlags flags); diff --git a/src/shared/switch-root.c b/src/shared/switch-root.c index 813641ad44..ae3839de16 100644 --- a/src/shared/switch-root.c +++ b/src/shared/switch-root.c @@ -29,10 +29,11 @@ #include "util.h" #include "path-util.h" -#include "switch-root.h" #include "mkdir.h" +#include "rm-rf.h" #include "base-filesystem.h" #include "missing.h" +#include "switch-root.h" int switch_root(const char *new_root, const char *oldroot, bool detach_oldroot, unsigned long mountflags) { @@ -142,7 +143,7 @@ int switch_root(const char *new_root, const char *oldroot, bool detach_oldroot, if (fstat(old_root_fd, &rb) < 0) log_warning_errno(errno, "Failed to stat old root directory, leaving: %m"); else { - rm_rf_children(old_root_fd, false, false, &rb); + (void) rm_rf_children(old_root_fd, 0, &rb); old_root_fd = -1; } } diff --git a/src/shared/util.c b/src/shared/util.c index 605fffcb7a..8b011ccfa1 100644 --- a/src/shared/util.c +++ b/src/shared/util.c @@ -2988,101 +2988,14 @@ int get_ctty(pid_t pid, dev_t *_devnr, char **r) { return 0; } -int rm_rf_children_dangerous(int fd, bool only_dirs, bool honour_sticky, struct stat *root_dev) { - _cleanup_closedir_ DIR *d = NULL; - int ret = 0; - - assert(fd >= 0); - - /* This returns the first error we run into, but nevertheless - * tries to go on. This closes the passed fd. */ - - d = fdopendir(fd); - if (!d) { - safe_close(fd); - - return errno == ENOENT ? 0 : -errno; - } - - for (;;) { - struct dirent *de; - bool is_dir, keep_around; - struct stat st; - int r; - - errno = 0; - de = readdir(d); - if (!de) { - if (errno != 0 && ret == 0) - ret = -errno; - return ret; - } - - if (streq(de->d_name, ".") || streq(de->d_name, "..")) - continue; - - if (de->d_type == DT_UNKNOWN || - honour_sticky || - (de->d_type == DT_DIR && root_dev)) { - if (fstatat(fd, de->d_name, &st, AT_SYMLINK_NOFOLLOW) < 0) { - if (ret == 0 && errno != ENOENT) - ret = -errno; - continue; - } - - is_dir = S_ISDIR(st.st_mode); - keep_around = - honour_sticky && - (st.st_uid == 0 || st.st_uid == getuid()) && - (st.st_mode & S_ISVTX); - } else { - is_dir = de->d_type == DT_DIR; - keep_around = false; - } - - if (is_dir) { - int subdir_fd; - - /* if root_dev is set, remove subdirectories only, if device is same as dir */ - if (root_dev && st.st_dev != root_dev->st_dev) - continue; - - subdir_fd = openat(fd, de->d_name, - O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC|O_NOFOLLOW|O_NOATIME); - if (subdir_fd < 0) { - if (ret == 0 && errno != ENOENT) - ret = -errno; - continue; - } - - r = rm_rf_children_dangerous(subdir_fd, only_dirs, honour_sticky, root_dev); - if (r < 0 && ret == 0) - ret = r; - - if (!keep_around) - if (unlinkat(fd, de->d_name, AT_REMOVEDIR) < 0) { - if (ret == 0 && errno != ENOENT) - ret = -errno; - } - - } else if (!only_dirs && !keep_around) { - - if (unlinkat(fd, de->d_name, 0) < 0) { - if (ret == 0 && errno != ENOENT) - ret = -errno; - } - } - } -} - -_pure_ static int is_temporary_fs(struct statfs *s) { +bool is_temporary_fs(const struct statfs *s) { assert(s); return F_TYPE_EQUAL(s->f_type, TMPFS_MAGIC) || F_TYPE_EQUAL(s->f_type, RAMFS_MAGIC); } -int is_fd_on_temporary_fs(int fd) { +int fd_is_temporary_fs(int fd) { struct statfs s; if (fstatfs(fd, &s) < 0) @@ -3091,114 +3004,6 @@ int is_fd_on_temporary_fs(int fd) { return is_temporary_fs(&s); } -int rm_rf_children(int fd, bool only_dirs, bool honour_sticky, struct stat *root_dev) { - struct statfs s; - - assert(fd >= 0); - - if (fstatfs(fd, &s) < 0) { - safe_close(fd); - return -errno; - } - - /* We refuse to clean disk file systems with this call. This - * is extra paranoia just to be sure we never ever remove - * non-state data */ - if (!is_temporary_fs(&s)) { - log_error("Attempted to remove disk file system, and we can't allow that."); - safe_close(fd); - return -EPERM; - } - - return rm_rf_children_dangerous(fd, only_dirs, honour_sticky, root_dev); -} - -static int file_is_priv_sticky(const char *p) { - struct stat st; - - assert(p); - - if (lstat(p, &st) < 0) - return -errno; - - return - (st.st_uid == 0 || st.st_uid == getuid()) && - (st.st_mode & S_ISVTX); -} - -static int rm_rf_internal(const char *path, bool only_dirs, bool delete_root, bool honour_sticky, bool dangerous) { - int fd, r; - struct statfs s; - - assert(path); - - /* We refuse to clean the root file system with this - * call. This is extra paranoia to never cause a really - * seriously broken system. */ - if (path_equal(path, "/")) { - log_error("Attempted to remove entire root file system, and we can't allow that."); - return -EPERM; - } - - fd = open(path, O_RDONLY|O_NONBLOCK|O_DIRECTORY|O_CLOEXEC|O_NOFOLLOW|O_NOATIME); - if (fd < 0) { - - if (errno != ENOTDIR && errno != ELOOP) - return -errno; - - if (!dangerous) { - if (statfs(path, &s) < 0) - return -errno; - - if (!is_temporary_fs(&s)) { - log_error("Attempted to remove disk file system, and we can't allow that."); - return -EPERM; - } - } - - if (delete_root && !only_dirs) - if (unlink(path) < 0 && errno != ENOENT) - return -errno; - - return 0; - } - - if (!dangerous) { - if (fstatfs(fd, &s) < 0) { - safe_close(fd); - return -errno; - } - - if (!is_temporary_fs(&s)) { - log_error("Attempted to remove disk file system, and we can't allow that."); - safe_close(fd); - return -EPERM; - } - } - - r = rm_rf_children_dangerous(fd, only_dirs, honour_sticky, NULL); - if (delete_root) { - - if (honour_sticky && file_is_priv_sticky(path) > 0) - return r; - - if (rmdir(path) < 0 && errno != ENOENT) { - if (r == 0) - r = -errno; - } - } - - return r; -} - -int rm_rf(const char *path, bool only_dirs, bool delete_root, bool honour_sticky) { - return rm_rf_internal(path, only_dirs, delete_root, honour_sticky, false); -} - -int rm_rf_dangerous(const char *path, bool only_dirs, bool delete_root, bool honour_sticky) { - return rm_rf_internal(path, only_dirs, delete_root, honour_sticky, true); -} - int chmod_and_chown(const char *path, mode_t mode, uid_t uid, gid_t gid) { assert(path); diff --git a/src/shared/util.h b/src/shared/util.h index 124c7c06d4..882355665c 100644 --- a/src/shared/util.h +++ b/src/shared/util.h @@ -41,6 +41,7 @@ #include <locale.h> #include <mntent.h> #include <sys/inotify.h> +#include <sys/statfs.h> #if SIZEOF_PID_T == 4 # define PID_PRI PRIi32 @@ -461,12 +462,8 @@ int get_ctty(pid_t, dev_t *_devnr, char **r); int chmod_and_chown(const char *path, mode_t mode, uid_t uid, gid_t gid); int fchmod_and_fchown(int fd, mode_t mode, uid_t uid, gid_t gid); -int is_fd_on_temporary_fs(int fd); - -int rm_rf_children(int fd, bool only_dirs, bool honour_sticky, struct stat *root_dev); -int rm_rf_children_dangerous(int fd, bool only_dirs, bool honour_sticky, struct stat *root_dev); -int rm_rf(const char *path, bool only_dirs, bool delete_root, bool honour_sticky); -int rm_rf_dangerous(const char *path, bool only_dirs, bool delete_root, bool honour_sticky); +bool is_temporary_fs(const struct statfs *s) _pure_; +int fd_is_temporary_fs(int fd); int pipe_eof(int fd); diff --git a/src/test/test-conf-files.c b/src/test/test-conf-files.c index 894c7f742f..01ece022c1 100644 --- a/src/test/test-conf-files.c +++ b/src/test/test-conf-files.c @@ -26,7 +26,7 @@ #include "macro.h" #include "strv.h" #include "util.h" - +#include "rm-rf.h" static void setup_test_dir(char *tmp_dir, const char *files, ...) { va_list ap; @@ -74,7 +74,7 @@ static void test_conf_files_list(bool use_root) { assert_se(streq_ptr(found_files[1], expect_b)); assert_se(found_files[2] == NULL); - assert_se(rm_rf_dangerous(tmp_dir, false, true, false) == 0); + assert_se(rm_rf(tmp_dir, REMOVE_ROOT|REMOVE_PHYSICAL) == 0); } int main(int argc, char **argv) { diff --git a/src/test/test-copy.c b/src/test/test-copy.c index 5c96f61005..403d85bff0 100644 --- a/src/test/test-copy.c +++ b/src/test/test-copy.c @@ -26,6 +26,7 @@ #include "strv.h" #include "macro.h" #include "util.h" +#include "rm-rf.h" static void test_copy_file(void) { _cleanup_free_ char *buf = NULL; @@ -86,8 +87,8 @@ static void test_copy_tree(void) { "link2", "dir1/file"); char **p, **link; - rm_rf_dangerous(copy_dir, false, true, false); - rm_rf_dangerous(original_dir, false, true, false); + (void) rm_rf(copy_dir, REMOVE_ROOT|REMOVE_PHYSICAL); + (void) rm_rf(original_dir, REMOVE_ROOT|REMOVE_PHYSICAL); STRV_FOREACH(p, files) { char *f = strjoina(original_dir, *p); @@ -128,8 +129,8 @@ static void test_copy_tree(void) { assert_se(copy_tree(original_dir, copy_dir, false) < 0); assert_se(copy_tree("/tmp/inexistent/foo/bar/fsdoi", copy_dir, false) < 0); - rm_rf_dangerous(copy_dir, false, true, false); - rm_rf_dangerous(original_dir, false, true, false); + (void) rm_rf(copy_dir, REMOVE_ROOT|REMOVE_PHYSICAL); + (void) rm_rf(original_dir, REMOVE_ROOT|REMOVE_PHYSICAL); } int main(int argc, char *argv[]) { diff --git a/src/test/test-execute.c b/src/test/test-execute.c index 428fd32600..c6210aaa87 100644 --- a/src/test/test-execute.c +++ b/src/test/test-execute.c @@ -24,6 +24,7 @@ #include "util.h" #include "macro.h" #include "mkdir.h" +#include "rm-rf.h" typedef void (*test_function_t)(Manager *m); @@ -72,7 +73,7 @@ static void test_exec_workingdirectory(Manager *m) { test(m, "exec-workingdirectory.service", 0, CLD_EXITED); - rm_rf_dangerous("/tmp/test-exec_workingdirectory", false, true, false); + (void) rm_rf("/tmp/test-exec_workingdirectory", REMOVE_ROOT|REMOVE_PHYSICAL); } static void test_exec_personality(Manager *m) { diff --git a/src/test/test-path-lookup.c b/src/test/test-path-lookup.c index a951b01b97..66b0b99741 100644 --- a/src/test/test-path-lookup.c +++ b/src/test/test-path-lookup.c @@ -24,6 +24,7 @@ #include "path-lookup.h" #include "log.h" #include "strv.h" +#include "rm-rf.h" static void test_paths(SystemdRunningAs running_as, bool personal) { char template[] = "/tmp/test-path-lookup.XXXXXXX"; @@ -42,7 +43,7 @@ static void test_paths(SystemdRunningAs running_as, bool personal) { assert_se(strv_contains(lp.unit_path, exists)); assert_se(strv_contains(lp.unit_path, not)); - assert_se(rm_rf_dangerous(template, false, true, false) >= 0); + assert_se(rm_rf(template, REMOVE_ROOT|REMOVE_PHYSICAL) >= 0); } static void print_generator_paths(SystemdRunningAs running_as) { diff --git a/src/test/test-path-util.c b/src/test/test-path-util.c index 6396fcb398..759515e564 100644 --- a/src/test/test-path-util.c +++ b/src/test/test-path-util.c @@ -26,6 +26,7 @@ #include "util.h" #include "macro.h" #include "strv.h" +#include "rm-rf.h" #define test_path_compare(a, b, result) { \ assert_se(path_compare(a, b) == result); \ @@ -256,7 +257,7 @@ static void test_strv_resolve(void) { assert_se(streq(search_dirs[1], "/dir2")); assert_se(streq(search_dirs[2], "/dir2")); - assert_se(rm_rf_dangerous(tmp_dir, false, true, false) == 0); + assert_se(rm_rf(tmp_dir, REMOVE_ROOT|REMOVE_PHYSICAL) == 0); } static void test_path_startswith(void) { diff --git a/src/test/test-path.c b/src/test/test-path.c index a3295aa997..219b585b7c 100644 --- a/src/test/test-path.c +++ b/src/test/test-path.c @@ -26,6 +26,7 @@ #include "macro.h" #include "strv.h" #include "mkdir.h" +#include "rm-rf.h" typedef void (*test_function_t)(Manager *m); @@ -47,7 +48,12 @@ static int setup_test(Manager **m) { assert_se(manager_startup(tmp, NULL, NULL) >= 0); STRV_FOREACH(test_path, tests_path) { - rm_rf_dangerous(strjoina("/tmp/test-path_", *test_path), false, true, false); + _cleanup_free_ char *p = NULL; + + p = strjoin("/tmp/test-path_", *test_path, NULL); + assert_se(p); + + (void) rm_rf(p, REMOVE_ROOT|REMOVE_PHYSICAL); } *m = tmp; @@ -104,7 +110,7 @@ static void check_stop_unlink(Manager *m, Unit *unit, const char *test_path, con } assert_se(UNIT_VTABLE(unit)->stop(unit) >= 0); - rm_rf_dangerous(test_path, false, true, false); + (void) rm_rf(test_path, REMOVE_ROOT|REMOVE_PHYSICAL); } static void test_path_exists(Manager *m) { @@ -228,7 +234,7 @@ static void test_path_makedirectory_directorymode(Manager *m) { assert_se((s.st_mode & S_IRWXO) == 0004); assert_se(UNIT_VTABLE(unit)->stop(unit) >= 0); - rm_rf_dangerous(test_path, false, true, false); + (void) rm_rf(test_path, REMOVE_ROOT|REMOVE_PHYSICAL); } int main(int argc, char *argv[]) { diff --git a/src/test/test-util.c b/src/test/test-util.c index d32ddd3a68..e9d1522a65 100644 --- a/src/test/test-util.c +++ b/src/test/test-util.c @@ -31,6 +31,7 @@ #include "util.h" #include "mkdir.h" +#include "rm-rf.h" #include "strv.h" #include "def.h" #include "fileio.h" @@ -1017,7 +1018,7 @@ static void test_readlink_and_make_absolute(void) { free(r); assert_se(unlink(name_alias) >= 0); - assert_se(rm_rf_dangerous(tempdir, false, true, false) >= 0); + assert_se(rm_rf(tempdir, REMOVE_ROOT|REMOVE_PHYSICAL) >= 0); } static void test_read_one_char(void) { @@ -1274,8 +1275,8 @@ static void test_execute_directory(void) { assert_se(access("it_works2", F_OK) >= 0); assert_se(access("failed", F_OK) < 0); - rm_rf_dangerous(template_lo, false, true, false); - rm_rf_dangerous(template_hi, false, true, false); + (void) rm_rf(template_lo, REMOVE_ROOT|REMOVE_PHYSICAL); + (void) rm_rf(template_hi, REMOVE_ROOT|REMOVE_PHYSICAL); } static void test_unquote_first_word(void) { diff --git a/src/tmpfiles/tmpfiles.c b/src/tmpfiles/tmpfiles.c index 494fd1ac21..20972f6310 100644 --- a/src/tmpfiles/tmpfiles.c +++ b/src/tmpfiles/tmpfiles.c @@ -52,6 +52,7 @@ #include "specifier.h" #include "build.h" #include "copy.h" +#include "rm-rf.h" #include "selinux-util.h" #include "btrfs-util.h" #include "acl-util.h" @@ -1359,7 +1360,7 @@ static int remove_item_instance(Item *i, const char *instance) { /* FIXME: we probably should use dir_cleanup() here * instead of rm_rf() so that 'x' is honoured. */ log_debug("rm -rf \"%s\"", instance); - r = rm_rf_dangerous(instance, false, i->type == RECURSIVE_REMOVE_PATH, false); + r = rm_rf(instance, (i->type == RECURSIVE_REMOVE_PATH ? REMOVE_ROOT : 0) | REMOVE_PHYSICAL); if (r < 0 && r != -ENOENT) return log_error_errno(r, "rm_rf(%s): %m", instance); |