+++ /dev/null
-// MsgSyncReq: copy files to the remote host
-
-// Copyright (C) 2021 Simon Ruderich
-//
-// This program is free software: you can redistribute it and/or modify
-// it under the terms of the GNU General Public License as published by
-// the Free Software Foundation, either version 3 of the License, or
-// (at your option) any later version.
-//
-// This program is distributed in the hope that it will be useful,
-// but WITHOUT ANY WARRANTY; without even the implied warranty of
-// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
-// GNU General Public License for more details.
-//
-// You should have received a copy of the GNU General Public License
-// along with this program. If not, see <http://www.gnu.org/licenses/>.
-
-// +build !windows
-
-package sync
-
-import (
- "bytes"
- "fmt"
- "io"
- "io/fs"
- "math/rand"
- "net/http"
- "os"
- "os/user"
- "path/filepath"
- "sort"
- "strconv"
- "strings"
- "syscall"
- "time"
-
- "github.com/ianbruene/go-difflib/difflib"
-
- "ruderich.org/simon/safcm"
-)
-
-func (s *Sync) syncFiles() error {
- // To create random file names for symlinks
- rand.Seed(time.Now().UnixNano())
-
- // Sort for deterministic order and so parent directories are present
- // when files in them are created
- var files []*safcm.File
- for _, x := range s.req.Files {
- files = append(files, x)
- }
- sort.Slice(files, func(i, j int) bool {
- return files[i].Path < files[j].Path
- })
-
- for _, x := range files {
- var changed bool
- err := s.syncFile(x, &changed)
- if err != nil {
- return fmt.Errorf("%q: %v", x.Path, err)
- }
- if changed {
- s.queueTriggers(x)
- }
- }
-
- return nil
-}
-
-func (s *Sync) syncFile(file *safcm.File, changed *bool) error {
- // The general strategy is "update by rename": If any property of a
- // file changes it will be written to a temporary file and then
- // renamed "over" the original file. This is simple and prevents race
- // conditions where the file is partially readable while changes to
- // permissions or owner/group are applied. However, this strategy does
- // not work for directories which must be removed first (was
- // directory), must remove the existing file (will be directory) or
- // must be directly modified (changed permissions or owner). In the
- // first two cases the old path is removed. In the last the directory
- // is modified (carefully) in place.
- //
- // The implementation is careful not to follow any symlinks to prevent
- // possible race conditions which can be exploited and are especially
- // dangerous when running with elevated privileges (which will most
- // likely be the case).
-
- err := s.fileResolveIds(file)
- if err != nil {
- return err
- }
-
- change := safcm.FileChange{
- Path: file.Path,
- New: safcm.FileChangeInfo{
- Mode: file.Mode,
- User: file.User,
- Uid: file.Uid,
- Group: file.Group,
- Gid: file.Gid,
- },
- }
-
- debugf := func(format string, a ...interface{}) {
- s.log.Debugf("files: %q (%s): %s",
- file.Path, file.OrigGroup, fmt.Sprintf(format, a...))
- }
- verbosef := func(format string, a ...interface{}) {
- s.log.Verbosef("files: %q (%s): %s",
- file.Path, file.OrigGroup, fmt.Sprintf(format, a...))
- }
-
- var oldStat fs.FileInfo
-reopen:
- oldFh, err := OpenFileNoFollow(file.Path)
- if err != nil {
- err := err.(*fs.PathError)
- if err.Err == syscall.ELOOP || err.Err == syscall.EMLINK {
- // Check if ELOOP was caused not by O_NOFOLLOW but by
- // too many nested symlinks before the final path
- // component.
- x, err := os.Lstat(file.Path)
- if err != nil {
- return err
- }
- if x.Mode().Type() != fs.ModeSymlink {
- debugf("type changed from symlink to %s, retry",
- x.Mode().Type())
- goto reopen
- }
- // ELOOP from symbolic link, this is fine
- oldStat = x
- } else if os.IsNotExist(err) {
- change.Created = true
- debugf("will create")
- } else {
- return err
- }
- } else {
- defer oldFh.Close()
-
- x, err := oldFh.Stat()
- if err != nil {
- return err
- }
- oldStat = x
- }
-
- var oldData []byte
- var changeType, changePerm, changeUserOrGroup, changeData bool
- if !change.Created {
- // Compare permissions
- change.Old.Mode = oldStat.Mode()
- if change.Old.Mode.Type() == fs.ModeSymlink {
- // Some BSD systems permit changing permissions of
- // symlinks but ignore them on traversal. To keep it
- // simple we don't support that and always use 0777
- // for symlink permissions (the value on GNU/Linux).
- //
- // TODO: Add proper support for symlinks on BSD
- change.Old.Mode |= 0777
- }
- if change.Old.Mode != file.Mode {
- if change.Old.Mode.Type() != file.Mode.Type() {
- changeType = true
- debugf("type differs %s -> %s",
- change.Old.Mode.Type(),
- file.Mode.Type())
- } else {
- // Be careful with .Perm() which does not
- // contain the setuid/setgid/sticky bits!
- changePerm = true
- debugf("permission differs %s -> %s",
- change.Old.Mode, file.Mode)
- }
- }
-
- // Compare user/group
- x, ok := oldStat.Sys().(*syscall.Stat_t)
- if !ok {
- return fmt.Errorf("unsupported Stat().Sys()")
- }
- change.Old.Uid = int(x.Uid)
- change.Old.Gid = int(x.Gid)
- if change.Old.Uid != file.Uid || change.Old.Gid != file.Gid {
- changeUserOrGroup = true
- debugf("uid/gid differs %d/%d -> %d/%d",
- change.Old.Uid, change.Old.Gid,
- file.Uid, file.Gid)
- }
- u, g, err := resolveIdsToNames(change.Old.Uid, change.Old.Gid)
- // Errors are not relevant as this is only used to report the
- // change. If the user/group no longer exits only the ids will
- // be reported.
- if err == nil {
- change.Old.User = u
- change.Old.Group = g
- }
-
- // Compare file content (if possible)
- switch change.Old.Mode.Type() {
- case 0: // regular file
- x, err := io.ReadAll(oldFh)
- if err != nil {
- return fmt.Errorf("reading old content: %v",
- err)
- }
- oldData = x
- case fs.ModeSymlink:
- x, err := os.Readlink(file.Path)
- if err != nil {
- return fmt.Errorf("reading old content: %v",
- err)
- }
- oldData = []byte(x)
- }
- if !changeType && file.Mode.Type() != fs.ModeDir {
- if !bytes.Equal(oldData, file.Data) {
- changeData = true
- debugf("content differs")
- }
- }
- }
- oldStat = nil // prevent accidental use
-
- // No changes
- if !change.Created && !changeType &&
- !changePerm && !changeUserOrGroup &&
- !changeData {
- debugf("unchanged")
- return nil
- }
- *changed = true
-
- // Don't show a diff with the full content for newly created files or
- // on type changes. This is just noise for the user as the new file
- // content is obvious. But we always want to see a diff when files are
- // replaced because this destroys data.
- if !change.Created &&
- (change.Old.Mode.Type() == 0 ||
- change.Old.Mode.Type() == fs.ModeSymlink) {
- change.DataDiff, err = diffData(oldData, file.Data)
- if err != nil {
- return err
- }
- }
-
- // Add change here so it is stored even when applying it fails. This
- // way the user knows exactly what was attempted.
- s.resp.FileChanges = append(s.resp.FileChanges, change)
-
- if change.Created {
- verbosef("creating")
- } else {
- verbosef("updating")
- }
-
- if s.req.DryRun {
- debugf("dry-run, skipping changes")
- return nil
- }
-
- // We cannot rename over directories and vice versa
- if changeType && (change.Old.Mode.IsDir() || file.Mode.IsDir()) {
- debugf("removing (due to type change)")
- err := os.RemoveAll(file.Path)
- if err != nil {
- return err
- }
- }
-
- // Directory: create new directory, also type change to directory
- if file.Mode.IsDir() && (change.Created || changeType) {
- debugf("creating directory")
- err := os.Mkdir(file.Path, 0700)
- if err != nil {
- return err
- }
- // We must be careful not to chmod arbitrary files. If the
- // target directory is writable then it might have changed to
- // a symlink at this point. There's no lchmod so open the
- // directory.
- debugf("chmodding %s", file.Mode)
- dh, err := OpenFileNoFollow(file.Path)
- if err != nil {
- return err
- }
- err = dh.Chmod(file.Mode)
- if err != nil {
- dh.Close()
- return err
- }
- // Less restrictive access is not relevant here because there
- // are no files present yet.
- debugf("chowning %d/%d", file.Uid, file.Gid)
- err = dh.Chown(file.Uid, file.Gid)
- if err != nil {
- dh.Close()
- return err
- }
- dh.Close()
- return nil
- }
- // Directory: changed permission or user/group
- if file.Mode.IsDir() {
- // We don't know if the new permission or if the new
- // user/group is more restrictive (e.g. root:root 0750 ->
- // user:group 0700; applying group first gives group
- // unexpected access). To prevent a short window where the
- // access might be too lax we temporarily deny all access.
- if changePerm && changeUserOrGroup {
- // Only drop group and other permission because user
- // has access anyway (either before or after the
- // change). This also prevents temporary errors during
- // the error when the user tries to access this
- // directory (access for the group will fail though).
- mode := change.Old.Mode & fs.ModePerm & 0700
- debugf("chmodding %#o (temporary)", mode)
- err := oldFh.Chmod(mode)
- if err != nil {
- return err
- }
- }
- if changeUserOrGroup {
- debugf("chowning %d/%d", file.Uid, file.Gid)
- err := oldFh.Chown(file.Uid, file.Gid)
- if err != nil {
- return err
- }
- }
- if changePerm {
- debugf("chmodding %s", file.Mode)
- err := oldFh.Chmod(file.Mode)
- if err != nil {
- return err
- }
- }
- return nil
- }
-
- dir := filepath.Dir(file.Path)
- // Create hidden file which should be ignored by most other tools and
- // thus not affect anything during creation
- base := "." + filepath.Base(file.Path)
-
- var tmpPath string
- switch file.Mode.Type() {
- case 0: // regular file
- debugf("creating temporary file %q",
- filepath.Join(dir, base+"*"))
- tmpPath, err = WriteTemp(dir, base, file.Data,
- file.Uid, file.Gid, file.Mode)
- if err != nil {
- return err
- }
-
- case fs.ModeSymlink:
- i := 0
- retry:
- // Similar to os.CreateTemp() but for symlinks which we cannot
- // open as file
- tmpPath = filepath.Join(dir,
- base+strconv.Itoa(rand.Int()))
- debugf("creating temporary symlink %q", tmpPath)
- err := os.Symlink(string(file.Data), tmpPath)
- if err != nil {
- if os.IsExist(err) && i < 10000 {
- i++
- goto retry
- }
- return err
- }
- err = os.Lchown(tmpPath, file.Uid, file.Gid)
- if err != nil {
- os.Remove(tmpPath)
- return err
- }
- // Permissions are irrelevant for symlinks (on most systems)
-
- default:
- panic(fmt.Sprintf("invalid file type %s", file.Mode))
- }
-
- debugf("renaming %q", tmpPath)
- err = os.Rename(tmpPath, file.Path)
- if err != nil {
- os.Remove(tmpPath)
- return err
- }
- err = SyncPath(dir)
- if err != nil {
- return err
- }
-
- return nil
-}
-
-func (s *Sync) fileResolveIds(file *safcm.File) error {
- if file.User != "" && file.Uid != -1 {
- return fmt.Errorf("cannot set both User (%q) and Uid (%d)",
- file.User, file.Uid)
- }
- if file.Group != "" && file.Gid != -1 {
- return fmt.Errorf("cannot set both Group (%q) and Gid (%d)",
- file.Group, file.Gid)
- }
-
- if file.User == "" && file.Uid == -1 {
- file.User = s.defaultUser
- }
- if file.User != "" {
- x, err := user.Lookup(file.User)
- if err != nil {
- return err
- }
- id, err := strconv.Atoi(x.Uid)
- if err != nil {
- return err
- }
- file.Uid = id
- }
-
- if file.Group == "" && file.Gid == -1 {
- file.Group = s.defaultGroup
- }
- if file.Group != "" {
- x, err := user.LookupGroup(file.Group)
- if err != nil {
- return err
- }
- id, err := strconv.Atoi(x.Gid)
- if err != nil {
- return err
- }
- file.Gid = id
- }
-
- return nil
-}
-
-func resolveIdsToNames(uid, gid int) (string, string, error) {
- u, err := user.LookupId(strconv.Itoa(uid))
- if err != nil {
- return "", "", err
- }
- g, err := user.LookupGroupId(strconv.Itoa(gid))
- if err != nil {
- return "", "", err
- }
- return u.Username, g.Name, nil
-}
-
-func diffData(oldData []byte, newData []byte) (string, error) {
- oldBin := !strings.HasPrefix(http.DetectContentType(oldData), "text/")
- newBin := !strings.HasPrefix(http.DetectContentType(newData), "text/")
- if oldBin && newBin {
- return fmt.Sprintf("Binary files differ (%d -> %d bytes), "+
- "cannot show diff", len(oldData), len(newData)), nil
- }
- if oldBin {
- oldData = []byte(fmt.Sprintf("<binary content, %d bytes>\n",
- len(oldData)))
- }
- if newBin {
- newData = []byte(fmt.Sprintf("<binary content, %d bytes>\n",
- len(newData)))
- }
-
- // TODO: difflib shows empty context lines at the end of the file
- // which should not be there
- // TODO: difflib has issues with missing newlines in either side
- result, err := difflib.GetUnifiedDiffString(difflib.LineDiffParams{
- A: difflib.SplitLines(string(oldData)),
- B: difflib.SplitLines(string(newData)),
- Context: 3,
- })
- if err != nil {
- return "", err
- }
- return result, nil
-}
-
-func OpenFileNoFollow(path string) (*os.File, error) {
- return os.OpenFile(path,
- // O_NOFOLLOW prevents symlink attacks
- // O_NONBLOCK is necessary to prevent blocking on FIFOs
- os.O_RDONLY|syscall.O_NOFOLLOW|syscall.O_NONBLOCK, 0)
-}
-
-func WriteTemp(dir, base string, data []byte, uid, gid int, mode fs.FileMode) (
- string, error) {
-
- fh, err := os.CreateTemp(dir, base)
- if err != nil {
- return "", err
- }
- tmpPath := fh.Name()
-
- _, err = fh.Write(data)
- if err != nil {
- fh.Close()
- os.Remove(tmpPath)
- return "", err
- }
- // CreateTemp() creates the file with 0600
- err = fh.Chown(uid, gid)
- if err != nil {
- fh.Close()
- os.Remove(tmpPath)
- return "", err
- }
- err = fh.Chmod(mode)
- if err != nil {
- fh.Close()
- os.Remove(tmpPath)
- return "", err
- }
- err = fh.Sync()
- if err != nil {
- fh.Close()
- os.Remove(tmpPath)
- return "", err
- }
- err = fh.Close()
- if err != nil {
- fh.Close()
- os.Remove(tmpPath)
- return "", err
- }
-
- return tmpPath, nil
-}
-
-// SyncPath syncs path, which should be a directory. To guarantee durability
-// it must be called on a parent directory after adding, renaming or removing
-// files therein.
-//
-// Calling sync on the files itself is not enough according to POSIX; man 2
-// fsync: "Calling fsync() does not necessarily ensure that the entry in the
-// directory containing the file has also reached disk. For that an explicit
-// fsync() on a file descriptor for the directory is also needed."
-func SyncPath(path string) error {
- x, err := os.Open(path)
- if err != nil {
- return err
- }
- err = x.Sync()
- closeErr := x.Close()
- if err != nil {
- return err
- }
- return closeErr
-}
ruderich.org/simon / safcm / safcm.git / blobdiff