X-Git-Url: https://wimlib.net/git/?a=blobdiff_plain;f=src%2Funix_apply.c;h=93e7b56b14a167e7dc06ec02bc61ba8add6347e0;hb=df84fc50295e41ea1616b68685c6d8dea8ffd84e;hp=b17bd35101c39c48a078fea47b57a2bdcfc1e6fa;hpb=7b13472d9515dc87a15bd43a9822ac42217d3af9;p=wimlib diff --git a/src/unix_apply.c b/src/unix_apply.c index b17bd351..93e7b56b 100644 --- a/src/unix_apply.c +++ b/src/unix_apply.c @@ -29,6 +29,9 @@ #include #include #include +#ifdef HAVE_SYS_XATTR_H +# include +#endif #include #include "wimlib/apply.h" @@ -40,6 +43,7 @@ #include "wimlib/reparse.h" #include "wimlib/timestamp.h" #include "wimlib/unix_data.h" +#include "wimlib/xattr.h" /* We don't require O_NOFOLLOW, but the advantage of having it is that if we * need to extract a file to a location at which there exists a symbolic link, @@ -60,6 +64,9 @@ unix_get_supported_features(const char *target, supported_features->unix_data = 1; supported_features->timestamps = 1; supported_features->case_sensitive_filenames = 1; +#ifdef HAVE_XATTR_SUPPORT + supported_features->linux_xattrs = 1; +#endif return 0; } @@ -261,70 +268,165 @@ unix_set_mode(int fd, const char *path, mode_t mode) return WIMLIB_ERR_SET_SECURITY; } +#ifdef HAVE_XATTR_SUPPORT +/* Apply extended attributes to a file */ +static int +apply_linux_xattrs(int fd, const struct wim_inode *inode, + const char *path, struct unix_apply_ctx *ctx, + const void *entries, size_t entries_size) +{ + const void * const entries_end = entries + entries_size; + char name[XATTR_NAME_MAX + 1]; + + for (const struct wimlib_xattr_entry *entry = entries; + (void *)entry < entries_end; entry = xattr_entry_next(entry)) + { + u16 name_len; + const void *value; + u32 value_len; + int res; + + if (!valid_xattr_entry(entry, entries_end - (void *)entry)) { + if (!path) { + path = unix_build_inode_extraction_path(inode, + ctx); + } + ERROR("\"%s\": extended attribute is corrupt", path); + return WIMLIB_ERR_INVALID_XATTR; + } + name_len = le16_to_cpu(entry->name_len); + memcpy(name, entry->name, name_len); + name[name_len] = '\0'; + + value = entry->name + name_len; + value_len = le32_to_cpu(entry->value_len); + + if (fd >= 0) + res = fsetxattr(fd, name, value, value_len, 0); + else + res = lsetxattr(path, name, value, value_len, 0); + + if (unlikely(res != 0)) { + if (!path) { + path = unix_build_inode_extraction_path(inode, + ctx); + } + if (is_security_xattr(name) && + (ctx->common.extract_flags & + WIMLIB_EXTRACT_FLAG_STRICT_ACLS)) + { + ERROR_WITH_ERRNO("\"%s\": unable to set extended attribute \"%s\"", + path, name); + return WIMLIB_ERR_SET_XATTR; + } + WARNING_WITH_ERRNO("\"%s\": unable to set extended attribute \"%s\"", + path, name); + } + } + return 0; +} +#endif /* HAVE_XATTR_SUPPORT */ + /* - * Set metadata on an extracted file. + * Apply UNIX-specific metadata to a file if available. This includes standard + * UNIX permissions (uid, gid, and mode) and possibly extended attributes too. * - * @fd is an open file descriptor to the extracted file, or -1. @path is the - * path to the extracted file, or NULL. If valid, this function uses @fd. - * Otherwise, if valid, it uses @path. Otherwise, it calculates the path to one - * alias of the extracted file and uses it. + * Note that some xattrs which grant privileges, e.g. security.capability, are + * cleared by Linux on chown(), even when running as root. Also, when running + * as non-root, if we need to chmod() the file to readonly, we can't do that + * before setting xattrs because setxattr() requires write permission. These + * restrictions result in the following ordering which we follow: chown(), + * setxattr(), then chmod(). + * + * N.B. the file may be specified by either 'fd' (for regular files) or 'path', + * and it may be a symlink. For symlinks we need lchown() and lsetxattr() but + * need to skip the chmod(), since mode bits are not meaningful for symlinks. */ static int -unix_set_metadata(int fd, const struct wim_inode *inode, - const char *path, struct unix_apply_ctx *ctx) +apply_unix_metadata(int fd, const struct wim_inode *inode, + const char *path, struct unix_apply_ctx *ctx) { + bool have_dat; + struct wimlib_unix_data dat; +#ifdef HAVE_XATTR_SUPPORT + const void *entries; + u32 entries_size; +#endif int ret; - struct wimlib_unix_data unix_data; - if (fd < 0 && !path) - path = unix_build_inode_extraction_path(inode, ctx); + have_dat = inode_get_unix_data(inode, &dat); - if ((ctx->common.extract_flags & WIMLIB_EXTRACT_FLAG_UNIX_DATA) - && inode_get_unix_data(inode, &unix_data)) - { - u32 uid = unix_data.uid; - u32 gid = unix_data.gid; - u32 mode = unix_data.mode; - - ret = unix_set_owner_and_group(fd, path, uid, gid); + if (have_dat) { + ret = unix_set_owner_and_group(fd, path, dat.uid, dat.gid); if (ret) { if (!path) path = unix_build_inode_extraction_path(inode, ctx); if (ctx->common.extract_flags & WIMLIB_EXTRACT_FLAG_STRICT_ACLS) { - ERROR_WITH_ERRNO("Can't set uid=%"PRIu32" and " - "gid=%"PRIu32" on \"%s\"", - uid, gid, path); + ERROR_WITH_ERRNO("\"%s\": unable to set uid=%"PRIu32" and gid=%"PRIu32, + path, dat.uid, dat.gid); return ret; - } else { - WARNING_WITH_ERRNO("Can't set uid=%"PRIu32" and " - "gid=%"PRIu32" on \"%s\"", - uid, gid, path); } + WARNING_WITH_ERRNO("\"%s\": unable to set uid=%"PRIu32" and gid=%"PRIu32, + path, dat.uid, dat.gid); } + } - ret = 0; - if (!inode_is_symlink(inode)) - ret = unix_set_mode(fd, path, mode); +#ifdef HAVE_XATTR_SUPPORT + entries = inode_get_linux_xattrs(inode, &entries_size); + if (entries) { + ret = apply_linux_xattrs(fd, inode, path, ctx, + entries, entries_size); + if (ret) + return ret; + } +#endif + + if (have_dat && !inode_is_symlink(inode)) { + ret = unix_set_mode(fd, path, dat.mode); if (ret) { if (!path) path = unix_build_inode_extraction_path(inode, ctx); if (ctx->common.extract_flags & WIMLIB_EXTRACT_FLAG_STRICT_ACLS) { - ERROR_WITH_ERRNO("Can't set mode=0%"PRIo32" " - "on \"%s\"", mode, path); + ERROR_WITH_ERRNO("\"%s\": unable to set mode=0%"PRIo32, + path, dat.mode); return ret; - } else { - WARNING_WITH_ERRNO("Can't set mode=0%"PRIo32" " - "on \"%s\"", mode, path); } + WARNING_WITH_ERRNO("\"%s\": unable to set mode=0%"PRIo32, + path, dat.mode); } } - ret = unix_set_timestamps(fd, path, - inode->i_last_access_time, + return 0; +} + +/* + * Set metadata on an extracted file. + * + * @fd is an open file descriptor to the extracted file, or -1. @path is the + * path to the extracted file, or NULL. If valid, this function uses @fd. + * Otherwise, if valid, it uses @path. Otherwise, it calculates the path to one + * alias of the extracted file and uses it. + */ +static int +unix_set_metadata(int fd, const struct wim_inode *inode, + const char *path, struct unix_apply_ctx *ctx) +{ + int ret; + + if (fd < 0 && !path) + path = unix_build_inode_extraction_path(inode, ctx); + + if (ctx->common.extract_flags & WIMLIB_EXTRACT_FLAG_UNIX_DATA) { + ret = apply_unix_metadata(fd, inode, path, ctx); + if (ret) + return ret; + } + + ret = unix_set_timestamps(fd, path, inode->i_last_access_time, inode->i_last_write_time); if (ret) { if (!path) @@ -332,12 +434,12 @@ unix_set_metadata(int fd, const struct wim_inode *inode, if (ctx->common.extract_flags & WIMLIB_EXTRACT_FLAG_STRICT_TIMESTAMPS) { - ERROR_WITH_ERRNO("Can't set timestamps on \"%s\"", path); + ERROR_WITH_ERRNO("\"%s\": unable to set timestamps", path); return ret; - } else { - WARNING_WITH_ERRNO("Can't set timestamps on \"%s\"", path); } + WARNING_WITH_ERRNO("\"%s\": unable to set timestamps", path); } + return 0; }