Merge pull request #5809 from keszybz/glob-safe

Implement `safe_glob` that ignores "." and ".."

src/basic/dirent-util.c

@@ -75,3 +75,14 @@ bool dirent_is_file_with_suffix(const struct dirent *de, const char *suffix) {
 
         return endswith(de->d_name, suffix);
 }
+
+struct dirent* readdir_no_dot(DIR *dirp) {
+        struct dirent* d;
+
+        for (;;) {
+                d = readdir(dirp);
+                if (d && dot_or_dot_dot(d->d_name))
+                        continue;
+                return d;
+        }
+}

src/basic/dirent-util.h

@@ -31,6 +31,8 @@ int dirent_ensure_type(DIR *d, struct dirent *de);
 bool dirent_is_file(const struct dirent *de) _pure_;
 bool dirent_is_file_with_suffix(const struct dirent *de, const char *suffix) _pure_;
 
+struct dirent* readdir_no_dot(DIR *dirp);
+
 #define FOREACH_DIRENT(de, d, on_error)                                 \
         for (errno = 0, de = readdir(d);; errno = 0, de = readdir(d))   \
                 if (!de) {                                              \

src/basic/glob-util.c

@@ -17,54 +17,70 @@
   along with systemd; If not, see <http://www.gnu.org/licenses/>.
 ***/
 
+#include <dirent.h>
 #include <errno.h>
 #include <glob.h>
+#include <sys/types.h>
 
+#include "dirent-util.h"
 #include "glob-util.h"
 #include "macro.h"
+#include "path-util.h"
 #include "strv.h"
 
+int safe_glob(const char *path, int flags, glob_t *pglob) {
+        int k;
+
+        /* We want to set GLOB_ALTDIRFUNC ourselves, don't allow it to be set. */
+        assert(!(flags & GLOB_ALTDIRFUNC));
+
+        if (!pglob->gl_closedir)
+                pglob->gl_closedir = (void (*)(void *)) closedir;
+        if (!pglob->gl_readdir)
+                pglob->gl_readdir = (struct dirent *(*)(void *)) readdir_no_dot;
+        if (!pglob->gl_opendir)
+                pglob->gl_opendir = (void *(*)(const char *)) opendir;
+        if (!pglob->gl_lstat)
+                pglob->gl_lstat = lstat;
+        if (!pglob->gl_stat)
+                pglob->gl_stat = stat;
+
+        errno = 0;
+        k = glob(path, flags | GLOB_ALTDIRFUNC, NULL, pglob);
+
+        if (k == GLOB_NOMATCH)
+                return -ENOENT;
+        if (k == GLOB_NOSPACE)
+                return -ENOMEM;
+        if (k != 0)
+                return errno > 0 ? -errno : -EIO;
+        if (strv_isempty(pglob->gl_pathv))
+                return -ENOENT;
+
+        return 0;
+}
+
 int glob_exists(const char *path) {
         _cleanup_globfree_ glob_t g = {};
         int k;
 
         assert(path);
 
-        errno = 0;
-        k = glob(path, GLOB_NOSORT|GLOB_BRACE, NULL, &g);
-
-        if (k == GLOB_NOMATCH)
-                return 0;
-        if (k == GLOB_NOSPACE)
-                return -ENOMEM;
-        if (k != 0)
-                return errno > 0 ? -errno : -EIO;
-
-        return !strv_isempty(g.gl_pathv);
+        k = safe_glob(path, GLOB_NOSORT|GLOB_BRACE, &g);
+        if (k == -ENOENT)
+                return false;
+        if (k < 0)
+                return k;
+        return true;
 }
 
 int glob_extend(char ***strv, const char *path) {
         _cleanup_globfree_ glob_t g = {};
         int k;
-        char **p;
 
-        errno = 0;
-        k = glob(path, GLOB_NOSORT|GLOB_BRACE, NULL, &g);
+        k = safe_glob(path, GLOB_NOSORT|GLOB_BRACE, &g);
+        if (k < 0)
+                return k;
 
-        if (k == GLOB_NOMATCH)
-                return -ENOENT;
-        if (k == GLOB_NOSPACE)
-                return -ENOMEM;
-        if (k != 0)
-                return errno > 0 ? -errno : -EIO;
-        if (strv_isempty(g.gl_pathv))
-                return -ENOENT;
-
-        STRV_FOREACH(p, g.gl_pathv) {
-                k = strv_extend(strv, *p);
-                if (k < 0)
-                        return k;
-        }
-
-        return 0;
+        return strv_extend_strv(strv, g.gl_pathv, false);
 }

src/basic/glob-util.h

@@ -19,12 +19,16 @@
   along with systemd; If not, see <http://www.gnu.org/licenses/>.
 ***/
 
+#include <glob.h>
 #include <stdbool.h>
 #include <string.h>
 
 #include "macro.h"
 #include "string-util.h"
 
+/* Note: this function modifies pglob to set various functions. */
+int safe_glob(const char *path, int flags, glob_t *pglob);
+
 int glob_exists(const char *path);
 int glob_extend(char ***strv, const char *path);
 

src/basic/rm-rf.c

@@ -182,18 +182,11 @@ int rm_rf(const char *path, RemoveFlags flags) {
         /* We refuse to clean the root file system with this
          * call. This is extra paranoia to never cause a really
          * seriously broken system. */
-        if (path_equal(path, "/")) {
+        if (path_equal_or_files_same(path, "/")) {
                 log_error("Attempted to remove entire root file system, and we can't allow that.");
                 return -EPERM;
         }
 
-        /* Another safe-check. Removing "/path/.." could easily remove entire root as well.
-         * It's especially easy to do using globs in tmpfiles, like "/path/.*", which the glob()
-         * function expands to both "/path/." and "/path/..".
-         * Return -EINVAL to be consistent with rmdir("/path/."). */
-        if (endswith(path, "/..") || endswith(path, "/../"))
-                return -EINVAL;
-
         if ((flags & (REMOVE_SUBVOLUME|REMOVE_ROOT|REMOVE_PHYSICAL)) == (REMOVE_SUBVOLUME|REMOVE_ROOT|REMOVE_PHYSICAL)) {
                 /* Try to remove as subvolume first */
                 r = btrfs_subvol_remove(path, BTRFS_REMOVE_RECURSIVE|BTRFS_REMOVE_QUOTA);