1 /* Support for extended attributes.
3 Copyright (C) 2006-2013 Free Software Foundation, Inc.
5 This file is part of GNU tar.
7 GNU tar is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License as published by
9 the Free Software Foundation; either version 3 of the License, or
10 (at your option) any later version.
12 GNU tar is distributed in the hope that it will be useful,
13 but WITHOUT ANY WARRANTY; without even the implied warranty of
14 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 GNU General Public License for more details.
17 You should have received a copy of the GNU General Public License
18 along with this program. If not, see <http://www.gnu.org/licenses/>.
20 Written by James Antill, on 2006-07-27. */
31 #include "selinux-at.h"
33 struct xattrs_mask_map
40 /* list of fnmatch patterns */
43 /* lists of fnmatch patterns */
44 struct xattrs_mask_map incl;
45 struct xattrs_mask_map excl;
48 /* disable posix acls when problem found in gnulib script m4/acl.m4 */
50 # undef HAVE_POSIX_ACLS
53 #ifdef HAVE_POSIX_ACLS
58 #ifdef HAVE_POSIX_ACLS
60 /* acl-at wrappers, TODO: move to gnulib in future? */
61 static acl_t acl_get_file_at (int, const char *, acl_type_t);
62 static int acl_set_file_at (int, const char *, acl_type_t, acl_t);
63 static int file_has_acl_at (int, char const *, struct stat const *);
66 #define AT_FUNC_NAME acl_get_file_at
67 #define AT_FUNC_RESULT acl_t
68 #define AT_FUNC_FAIL (acl_t)NULL
69 #define AT_FUNC_F1 acl_get_file
70 #define AT_FUNC_POST_FILE_PARAM_DECLS , acl_type_t type
71 #define AT_FUNC_POST_FILE_ARGS , type
77 #undef AT_FUNC_POST_FILE_PARAM_DECLS
78 #undef AT_FUNC_POST_FILE_ARGS
81 #define AT_FUNC_NAME acl_set_file_at
82 #define AT_FUNC_F1 acl_set_file
83 #define AT_FUNC_POST_FILE_PARAM_DECLS , acl_type_t type, acl_t acl
84 #define AT_FUNC_POST_FILE_ARGS , type, acl
88 #undef AT_FUNC_POST_FILE_PARAM_DECLS
89 #undef AT_FUNC_POST_FILE_ARGS
91 /* gnulib file_has_acl_at */
92 #define AT_FUNC_NAME file_has_acl_at
93 #define AT_FUNC_F1 file_has_acl
94 #define AT_FUNC_POST_FILE_PARAM_DECLS , struct stat const *st
95 #define AT_FUNC_POST_FILE_ARGS , st
99 #undef AT_FUNC_POST_FILE_PARAM_DECLS
100 #undef AT_FUNC_POST_FILE_ARGS
102 /* convert unix permissions into an ACL ... needed due to "default" ACLs */
104 perms2acl (int perms)
106 char val[] = "user::---,group::---,other::---";
107 /* 0123456789 123456789 123456789 123456789 */
133 return acl_from_text (val);
137 skip_to_ext_fields (char *ptr)
139 /* skip tag name (user/group/default/mask) */
140 ptr += strcspn (ptr, ":,\n");
146 ptr += strcspn (ptr, ":,\n"); /* skip user/group name */
152 ptr += strcspn (ptr, ":,\n"); /* skip perms */
157 /* The POSIX draft allows extra fields after the three main ones. Star
158 uses this to add a fourth field for user/group which is the numeric ID.
159 This function removes such extra fields by overwriting them with the
160 characters that follow. */
162 fixup_extra_acl_fields (char *ptr)
169 const char *old = src;
172 src = skip_to_ext_fields (src);
175 memmove (dst, old, len);
178 if (*src == ':') /* We have extra fields, skip them all */
179 src += strcspn (src, "\n,");
181 if ((*src == '\n') || (*src == ','))
182 *dst++ = *src++; /* also done when dst == src, but that's ok */
190 /* "system.posix_acl_access" */
192 xattrs__acls_set (struct tar_stat_info const *st,
193 char const *file_name, int type,
194 char *ptr, size_t len, bool def)
200 /* assert (strlen (ptr) == len); */
201 ptr = fixup_extra_acl_fields (ptr);
203 acl = acl_from_text (ptr);
206 else if (acls_option > 0)
207 acl = perms2acl (st->stat.st_mode);
209 return; /* don't call acl functions unless we first hit an ACL, or
210 --acls was passed explicitly */
214 call_arg_warn ("acl_from_text", file_name);
218 if (acl_set_file_at (chdir_fd, file_name, type, acl) == -1)
219 /* warn even if filesystem does not support acls */
220 WARNOPT (WARN_XATTR_WRITE,
222 _ ("acl_set_file_at: Cannot set POSIX ACLs for file '%s'"),
229 xattrs__acls_get_a (int parentfd, const char *file_name,
230 struct tar_stat_info *st,
231 char **ret_ptr, size_t * ret_len)
237 if (!(acl = acl_get_file_at (parentfd, file_name, ACL_TYPE_ACCESS)))
239 if (errno != ENOTSUP)
240 call_arg_warn ("acl_get_file_at", file_name);
244 val = acl_to_text (acl, &len);
249 call_arg_warn ("acl_to_text", file_name);
253 *ret_ptr = xstrdup (val);
259 /* "system.posix_acl_default" */
261 xattrs__acls_get_d (int parentfd, char const *file_name,
262 struct tar_stat_info *st,
263 char **ret_ptr, size_t * ret_len)
269 if (!(acl = acl_get_file_at (parentfd, file_name, ACL_TYPE_DEFAULT)))
271 if (errno != ENOTSUP)
272 call_arg_warn ("acl_get_file_at", file_name);
276 val = acl_to_text (acl, &len);
281 call_arg_warn ("acl_to_text", file_name);
285 *ret_ptr = xstrdup (val);
290 #endif /* HAVE_POSIX_ACLS */
293 acls_one_line (const char *prefix, char delim,
294 const char *aclstring, size_t len)
296 /* support both long and short text representation of posix acls */
298 int pref_len = strlen (prefix);
299 const char *oldstring = aclstring;
302 if (!aclstring || !len)
308 int move = strcspn (aclstring, ",\n");
312 if (oldstring != aclstring)
313 obstack_1grow (&stk, delim);
315 obstack_grow (&stk, prefix, pref_len);
316 obstack_grow (&stk, aclstring, move);
318 aclstring += move + 1;
321 obstack_1grow (&stk, '\0');
323 fprintf (stdlis, "%s", (char *) obstack_finish (&stk));
325 obstack_free (&stk, NULL);
329 xattrs_acls_get (int parentfd, char const *file_name,
330 struct tar_stat_info *st, int fd, int xisfile)
334 #ifndef HAVE_POSIX_ACLS
337 WARN ((0, 0, _("POSIX ACL support is not available")));
340 int err = file_has_acl_at (parentfd, file_name, &st->stat);
345 call_arg_warn ("file_has_acl_at", file_name);
349 xattrs__acls_get_a (parentfd, file_name, st,
350 &st->acls_a_ptr, &st->acls_a_len);
352 xattrs__acls_get_d (parentfd, file_name, st,
353 &st->acls_d_ptr, &st->acls_d_len);
359 xattrs_acls_set (struct tar_stat_info const *st,
360 char const *file_name, char typeflag)
362 if (acls_option > 0 && typeflag != SYMTYPE)
364 #ifndef HAVE_POSIX_ACLS
367 WARN ((0, 0, _("POSIX ACL support is not available")));
370 xattrs__acls_set (st, file_name, ACL_TYPE_ACCESS,
371 st->acls_a_ptr, st->acls_a_len, false);
372 if (typeflag == DIRTYPE || typeflag == GNUTYPE_DUMPDIR)
373 xattrs__acls_set (st, file_name, ACL_TYPE_DEFAULT,
374 st->acls_d_ptr, st->acls_d_len, true);
380 mask_map_realloc (struct xattrs_mask_map *map)
382 if (map->used == map->size)
386 map->masks = x2nrealloc (map->masks, &map->size, sizeof (map->masks[0]));
391 xattrs_mask_add (const char *mask, bool incl)
393 struct xattrs_mask_map *mask_map =
394 incl ? &xattrs_setup.incl : &xattrs_setup.excl;
395 /* ensure there is enough space */
396 mask_map_realloc (mask_map);
397 /* just assign pointers -- we silently expect that pointer "mask" is valid
398 through the whole program (pointer to argv array) */
399 mask_map->masks[mask_map->used++] = mask;
403 clear_mask_map (struct xattrs_mask_map *mask_map)
406 free (mask_map->masks);
410 xattrs_clear_setup (void)
412 clear_mask_map (&xattrs_setup.incl);
413 clear_mask_map (&xattrs_setup.excl);
416 /* get all xattrs from file given by FILE_NAME or FD (when non-zero). This
417 includes all the user.*, security.*, system.*, etc. available domains */
419 xattrs_xattrs_get (int parentfd, char const *file_name,
420 struct tar_stat_info *st, int fd)
422 if (xattrs_option > 0)
427 WARN ((0, 0, _("XATTR support is not available")));
430 static size_t xsz = 1024;
431 static char *xatrs = NULL;
435 xatrs = x2nrealloc (xatrs, &xsz, 1);
439 llistxattrat (parentfd, file_name, xatrs, xsz)) == -1) :
440 ((xret = flistxattr (fd, xatrs, xsz)) == -1))
441 && (errno == ERANGE))
443 xatrs = x2nrealloc (xatrs, &xsz, 1);
447 call_arg_warn ((fd == 0) ? "llistxattrat" : "flistxattr", file_name);
450 const char *attr = xatrs;
451 static size_t asz = 1024;
452 static char *val = NULL;
455 val = x2nrealloc (val, &asz, 1);
459 size_t len = strlen (attr);
462 /* Archive all xattrs during creation, decide at extraction time
463 * which ones are of interest/use for the target filesystem. */
465 ? ((aret = lgetxattrat (parentfd, file_name, attr,
467 : ((aret = fgetxattr (fd, attr, val, asz)) == -1))
468 && (errno == ERANGE))
470 val = x2nrealloc (val, &asz, 1);
474 xheader_xattr_add (st, attr, val, aret);
475 else if (errno != ENOATTR)
476 call_arg_warn ((fd == 0) ? "lgetxattrat"
477 : "fgetxattr", file_name);
489 xattrs__fd_set (struct tar_stat_info const *st,
490 char const *file_name, char typeflag,
491 const char *attr, const char *ptr, size_t len)
495 const char *sysname = "setxattrat";
498 if (typeflag != SYMTYPE)
499 ret = setxattrat (chdir_fd, file_name, attr, ptr, len, 0);
502 sysname = "lsetxattr";
503 ret = lsetxattrat (chdir_fd, file_name, attr, ptr, len, 0);
507 WARNOPT (WARN_XATTR_WRITE,
509 _("%s: Cannot set '%s' extended attribute for file '%s'"),
510 sysname, attr, file_name));
515 /* lgetfileconat is called against FILE_NAME iff the FD parameter is set to
516 zero, otherwise the fgetfileconat is used against correct file descriptor */
518 xattrs_selinux_get (int parentfd, char const *file_name,
519 struct tar_stat_info *st, int fd)
521 if (selinux_context_option > 0)
523 #if HAVE_SELINUX_SELINUX_H != 1
526 WARN ((0, 0, _("SELinux support is not available")));
530 fgetfilecon (fd, &st->cntx_name)
531 : lgetfileconat (parentfd, file_name, &st->cntx_name);
533 if (result == -1 && errno != ENODATA && errno != ENOTSUP)
534 call_arg_warn (fd ? "fgetfilecon" : "lgetfileconat", file_name);
540 xattrs_selinux_set (struct tar_stat_info const *st,
541 char const *file_name, char typeflag)
543 if (selinux_context_option > 0)
545 #if HAVE_SELINUX_SELINUX_H != 1
548 WARN ((0, 0, _("SELinux support is not available")));
551 const char *sysname = "setfilecon";
557 if (typeflag != SYMTYPE)
559 ret = setfileconat (chdir_fd, file_name, st->cntx_name);
560 sysname = "setfileconat";
564 ret = lsetfileconat (chdir_fd, file_name, st->cntx_name);
565 sysname = "lsetfileconat";
569 WARNOPT (WARN_XATTR_WRITE,
571 _("%s: Cannot set SELinux context for file '%s'"),
572 sysname, file_name));
578 xattrs_matches_mask (const char *kw, struct xattrs_mask_map *mm)
585 for (i = 0; i < mm->used; i++)
586 if (fnmatch (mm->masks[i], kw, 0) == 0)
592 #define USER_DOT_PFX "user."
595 xattrs_kw_included (const char *kw, bool archiving)
597 if (xattrs_setup.incl.size)
598 return xattrs_matches_mask (kw, &xattrs_setup.incl);
602 return strncmp (kw, USER_DOT_PFX, sizeof (USER_DOT_PFX) - 1) == 0;
606 xattrs_kw_excluded (const char *kw, bool archiving)
608 return xattrs_setup.excl.size ?
609 xattrs_matches_mask (kw, &xattrs_setup.excl) : false;
612 /* Check whether the xattr with keyword KW should be discarded from list of
613 attributes that are going to be archived/excluded (set ARCHIVING=true for
614 archiving, false for excluding) */
616 xattrs_masked_out (const char *kw, bool archiving)
618 return xattrs_kw_included (kw, archiving) ?
619 xattrs_kw_excluded (kw, archiving) : true;
623 xattrs_xattrs_set (struct tar_stat_info const *st,
624 char const *file_name, char typeflag, int later_run)
626 if (xattrs_option > 0)
631 WARN ((0, 0, _("XATTR support is not available")));
636 if (!st->xattr_map_size)
639 for (; scan < st->xattr_map_size; ++scan)
641 char *keyword = st->xattr_map[scan].xkey;
642 keyword += strlen ("SCHILY.xattr.");
644 /* TODO: this 'later_run' workaround is temporary solution -> once
645 capabilities should become fully supported by it's API and there
646 should exist something like xattrs_capabilities_set() call.
647 For a regular files: all extended attributes are restored during
648 the first run except 'security.capability' which is restored in
650 if (typeflag == REGTYPE
651 && later_run == !!strcmp (keyword, "security.capability"))
654 if (xattrs_masked_out (keyword, false /* extracting */ ))
655 /* we don't want to restore this keyword */
658 xattrs__fd_set (st, file_name, typeflag, keyword,
659 st->xattr_map[scan].xval_ptr,
660 st->xattr_map[scan].xval_len);
667 xattrs_print_char (struct tar_stat_info const *st, char *output)
671 if (verbose_option < 2)
677 if (xattrs_option > 0 || selinux_context_option > 0 || acls_option > 0)
684 if (xattrs_option > 0 && st->xattr_map_size)
685 for (i = 0; i < st->xattr_map_size; ++i)
687 char *keyword = st->xattr_map[i].xkey + strlen ("SCHILY.xattr.");
688 if (!xattrs_masked_out (keyword, false /* like extracting */ ))
695 if (selinux_context_option > 0 && st->cntx_name)
698 if (acls_option && (st->acls_a_len || st->acls_d_len))
703 xattrs_print (struct tar_stat_info const *st)
705 if (verbose_option < 3)
709 if (selinux_context_option && st->cntx_name)
710 fprintf (stdlis, " s: %s\n", st->cntx_name);
713 if (acls_option && (st->acls_a_len || st->acls_d_len))
715 fprintf (stdlis, " a: ");
716 acls_one_line ("", ',', st->acls_a_ptr, st->acls_a_len);
717 acls_one_line ("default:", ',', st->acls_d_ptr, st->acls_d_len);
718 fprintf (stdlis, "\n");
722 if (xattrs_option && st->xattr_map_size)
726 for (i = 0; i < st->xattr_map_size; ++i)
728 char *keyword = st->xattr_map[i].xkey + strlen ("SCHILY.xattr.");
729 if (!xattrs_masked_out (keyword, false /* like extracting */ ))
730 fprintf (stdlis, " x: %lu %s\n",
731 (unsigned long) st->xattr_map[i].xval_len, keyword);