xref: /freebsd/contrib/sendmail/libsmutil/safefile.c (revision d9a42747950146bf03cda7f6e25d219253f8a57a)
1 /*
2  * Copyright (c) 1998-2004 Proofpoint, Inc. and its suppliers.
3  *	All rights reserved.
4  * Copyright (c) 1983, 1995-1997 Eric P. Allman.  All rights reserved.
5  * Copyright (c) 1988, 1993
6  *	The Regents of the University of California.  All rights reserved.
7  *
8  * By using this file, you agree to the terms and conditions set
9  * forth in the LICENSE file which can be found at the top level of
10  * the sendmail distribution.
11  *
12  */
13 
14 #include <sendmail.h>
15 #include <sm/io.h>
16 #include <sm/errstring.h>
17 
18 SM_RCSID("@(#)$Id: safefile.c,v 8.130 2013-11-22 20:51:50 ca Exp $")
19 
20 
21 /*
22 **  SAFEFILE -- return 0 if a file exists and is safe for a user.
23 **
24 **	Parameters:
25 **		fn -- filename to check.
26 **		uid -- user id to compare against.
27 **		gid -- group id to compare against.
28 **		user -- user name to compare against (used for group sets).
29 **		flags -- modifiers:
30 **			SFF_MUSTOWN -- "uid" must own this file.
31 **			SFF_NOSLINK -- file cannot be a symbolic link.
32 **		mode -- mode bits that must match.
33 **		st -- if set, points to a stat structure that will
34 **			get the stat info for the file.
35 **
36 **	Returns:
37 **		0 if fn exists, is owned by uid, and matches mode.
38 **		An errno otherwise.  The actual errno is cleared.
39 **
40 **	Side Effects:
41 **		none.
42 */
43 
44 int
45 safefile(fn, uid, gid, user, flags, mode, st)
46 	char *fn;
47 	UID_T uid;
48 	GID_T gid;
49 	char *user;
50 	long flags;
51 	int mode;
52 	struct stat *st;
53 {
54 	register char *p;
55 	register struct group *gr = NULL;
56 	int file_errno = 0;
57 	bool checkpath;
58 	struct stat stbuf;
59 	struct stat fstbuf;
60 	char fbuf[MAXPATHLEN];
61 
62 	if (tTd(44, 4))
63 		sm_dprintf("safefile(%s, uid=%d, gid=%d, flags=%lx, mode=%o):\n",
64 			fn, (int) uid, (int) gid, flags, mode);
65 	errno = 0;
66 	if (sm_strlcpy(fbuf, fn, sizeof fbuf) >= sizeof fbuf)
67 	{
68 		if (tTd(44, 4))
69 			sm_dprintf("\tpathname too long\n");
70 		return ENAMETOOLONG;
71 	}
72 	fn = fbuf;
73 	if (st == NULL)
74 		st = &fstbuf;
75 
76 	/* ignore SFF_SAFEDIRPATH if we are debugging */
77 	if (RealUid != 0 && RunAsUid == RealUid)
78 		flags &= ~SFF_SAFEDIRPATH;
79 
80 	/* first check to see if the file exists at all */
81 #if HASLSTAT
82 	if ((bitset(SFF_NOSLINK, flags) ? lstat(fn, st)
83 					: stat(fn, st)) < 0)
84 #else
85 	if (stat(fn, st) < 0)
86 #endif
87 	{
88 		file_errno = errno;
89 	}
90 	else if (bitset(SFF_SETUIDOK, flags) &&
91 		 !bitset(S_IXUSR|S_IXGRP|S_IXOTH, st->st_mode) &&
92 		 S_ISREG(st->st_mode))
93 	{
94 		/*
95 		**  If final file is set-user-ID, run as the owner of that
96 		**  file.  Gotta be careful not to reveal anything too
97 		**  soon here!
98 		*/
99 
100 #ifdef SUID_ROOT_FILES_OK
101 		if (bitset(S_ISUID, st->st_mode))
102 #else
103 		if (bitset(S_ISUID, st->st_mode) && st->st_uid != 0 &&
104 		    st->st_uid != TrustedUid)
105 #endif
106 		{
107 			uid = st->st_uid;
108 			user = NULL;
109 		}
110 #ifdef SUID_ROOT_FILES_OK
111 		if (bitset(S_ISGID, st->st_mode))
112 #else
113 		if (bitset(S_ISGID, st->st_mode) && st->st_gid != 0)
114 #endif
115 			gid = st->st_gid;
116 	}
117 
118 	checkpath = !bitset(SFF_NOPATHCHECK, flags) ||
119 		    (uid == 0 && !bitset(SFF_ROOTOK|SFF_OPENASROOT, flags));
120 	if (bitset(SFF_NOWLINK, flags) && !bitset(SFF_SAFEDIRPATH, flags))
121 	{
122 		int ret;
123 
124 		/* check the directory */
125 		p = strrchr(fn, '/');
126 		if (p == NULL)
127 		{
128 			ret = safedirpath(".", uid, gid, user,
129 					  flags|SFF_SAFEDIRPATH, 0, 0);
130 		}
131 		else
132 		{
133 			*p = '\0';
134 			ret = safedirpath(fn, uid, gid, user,
135 					  flags|SFF_SAFEDIRPATH, 0, 0);
136 			*p = '/';
137 		}
138 		if (ret == 0)
139 		{
140 			/* directory is safe */
141 			checkpath = false;
142 		}
143 		else
144 		{
145 #if HASLSTAT
146 			/* Need lstat() information if called stat() before */
147 			if (!bitset(SFF_NOSLINK, flags) && lstat(fn, st) < 0)
148 			{
149 				ret = errno;
150 				if (tTd(44, 4))
151 					sm_dprintf("\t%s\n", sm_errstring(ret));
152 				return ret;
153 			}
154 #endif /* HASLSTAT */
155 			/* directory is writable: disallow links */
156 			flags |= SFF_NOLINK;
157 		}
158 	}
159 
160 	if (checkpath)
161 	{
162 		int ret;
163 
164 		p = strrchr(fn, '/');
165 		if (p == NULL)
166 		{
167 			ret = safedirpath(".", uid, gid, user, flags, 0, 0);
168 		}
169 		else
170 		{
171 			*p = '\0';
172 			ret = safedirpath(fn, uid, gid, user, flags, 0, 0);
173 			*p = '/';
174 		}
175 		if (ret != 0)
176 			return ret;
177 	}
178 
179 	/*
180 	**  If the target file doesn't exist, check the directory to
181 	**  ensure that it is writable by this user.
182 	*/
183 
184 	if (file_errno != 0)
185 	{
186 		int ret = file_errno;
187 		char *dir = fn;
188 
189 		if (tTd(44, 4))
190 			sm_dprintf("\t%s\n", sm_errstring(ret));
191 
192 		errno = 0;
193 		if (!bitset(SFF_CREAT, flags) || file_errno != ENOENT)
194 			return ret;
195 
196 		/* check to see if legal to create the file */
197 		p = strrchr(dir, '/');
198 		if (p == NULL)
199 			dir = ".";
200 		else if (p == dir)
201 			dir = "/";
202 		else
203 			*p = '\0';
204 		if (stat(dir, &stbuf) >= 0)
205 		{
206 			int md = S_IWRITE|S_IEXEC;
207 
208 			ret = 0;
209 			if (stbuf.st_uid == uid)
210 				/* EMPTY */
211 				;
212 			else if (uid == 0 && stbuf.st_uid == TrustedUid)
213 				/* EMPTY */
214 				;
215 			else
216 			{
217 				md >>= 3;
218 				if (stbuf.st_gid == gid)
219 					/* EMPTY */
220 					;
221 #ifndef NO_GROUP_SET
222 				else if (user != NULL && !DontInitGroups &&
223 					 ((gr != NULL &&
224 					   gr->gr_gid == stbuf.st_gid) ||
225 					  (gr = getgrgid(stbuf.st_gid)) != NULL))
226 				{
227 					register char **gp;
228 
229 					for (gp = gr->gr_mem; *gp != NULL; gp++)
230 						if (strcmp(*gp, user) == 0)
231 							break;
232 					if (*gp == NULL)
233 						md >>= 3;
234 				}
235 #endif /* ! NO_GROUP_SET */
236 				else
237 					md >>= 3;
238 			}
239 			if ((stbuf.st_mode & md) != md)
240 				ret = errno = EACCES;
241 		}
242 		else
243 			ret = errno;
244 		if (tTd(44, 4))
245 			sm_dprintf("\t[final dir %s uid %d mode %lo] %s\n",
246 				dir, (int) stbuf.st_uid,
247 				(unsigned long) stbuf.st_mode,
248 				sm_errstring(ret));
249 		if (p != NULL)
250 			*p = '/';
251 		st->st_mode = ST_MODE_NOFILE;
252 		return ret;
253 	}
254 
255 #ifdef S_ISLNK
256 	if (bitset(SFF_NOSLINK, flags) && S_ISLNK(st->st_mode))
257 	{
258 		if (tTd(44, 4))
259 			sm_dprintf("\t[slink mode %lo]\tE_SM_NOSLINK\n",
260 				(unsigned long) st->st_mode);
261 		return E_SM_NOSLINK;
262 	}
263 #endif /* S_ISLNK */
264 	if (bitset(SFF_REGONLY, flags) && !S_ISREG(st->st_mode))
265 	{
266 		if (tTd(44, 4))
267 			sm_dprintf("\t[non-reg mode %lo]\tE_SM_REGONLY\n",
268 				(unsigned long) st->st_mode);
269 		return E_SM_REGONLY;
270 	}
271 	if (bitset(SFF_NOGWFILES, flags) &&
272 	    bitset(S_IWGRP, st->st_mode))
273 	{
274 		if (tTd(44, 4))
275 			sm_dprintf("\t[write bits %lo]\tE_SM_GWFILE\n",
276 				(unsigned long) st->st_mode);
277 		return E_SM_GWFILE;
278 	}
279 	if (bitset(SFF_NOWWFILES, flags) &&
280 	    bitset(S_IWOTH, st->st_mode))
281 	{
282 		if (tTd(44, 4))
283 			sm_dprintf("\t[write bits %lo]\tE_SM_WWFILE\n",
284 				(unsigned long) st->st_mode);
285 		return E_SM_WWFILE;
286 	}
287 	if (bitset(SFF_NOGRFILES, flags) && bitset(S_IRGRP, st->st_mode))
288 	{
289 		if (tTd(44, 4))
290 			sm_dprintf("\t[read bits %lo]\tE_SM_GRFILE\n",
291 				(unsigned long) st->st_mode);
292 		return E_SM_GRFILE;
293 	}
294 	if (bitset(SFF_NOWRFILES, flags) && bitset(S_IROTH, st->st_mode))
295 	{
296 		if (tTd(44, 4))
297 			sm_dprintf("\t[read bits %lo]\tE_SM_WRFILE\n",
298 				(unsigned long) st->st_mode);
299 		return E_SM_WRFILE;
300 	}
301 	if (!bitset(SFF_EXECOK, flags) &&
302 	    bitset(S_IWUSR|S_IWGRP|S_IWOTH, mode) &&
303 	    bitset(S_IXUSR|S_IXGRP|S_IXOTH, st->st_mode))
304 	{
305 		if (tTd(44, 4))
306 			sm_dprintf("\t[exec bits %lo]\tE_SM_ISEXEC\n",
307 				(unsigned long) st->st_mode);
308 		return E_SM_ISEXEC;
309 	}
310 	if (bitset(SFF_NOHLINK, flags) && st->st_nlink != 1)
311 	{
312 		if (tTd(44, 4))
313 			sm_dprintf("\t[link count %d]\tE_SM_NOHLINK\n",
314 				(int) st->st_nlink);
315 		return E_SM_NOHLINK;
316 	}
317 
318 	if (uid == 0 && bitset(SFF_OPENASROOT, flags))
319 		/* EMPTY */
320 		;
321 	else if (uid == 0 && !bitset(SFF_ROOTOK, flags))
322 		mode >>= 6;
323 	else if (st->st_uid == uid)
324 		/* EMPTY */
325 		;
326 	else if (uid == 0 && st->st_uid == TrustedUid)
327 		/* EMPTY */
328 		;
329 	else
330 	{
331 		mode >>= 3;
332 		if (st->st_gid == gid)
333 			/* EMPTY */
334 			;
335 #ifndef NO_GROUP_SET
336 		else if (user != NULL && !DontInitGroups &&
337 			 ((gr != NULL && gr->gr_gid == st->st_gid) ||
338 			  (gr = getgrgid(st->st_gid)) != NULL))
339 		{
340 			register char **gp;
341 
342 			for (gp = gr->gr_mem; *gp != NULL; gp++)
343 				if (strcmp(*gp, user) == 0)
344 					break;
345 			if (*gp == NULL)
346 				mode >>= 3;
347 		}
348 #endif /* ! NO_GROUP_SET */
349 		else
350 			mode >>= 3;
351 	}
352 	if (tTd(44, 4))
353 		sm_dprintf("\t[uid %d, nlink %d, stat %lo, mode %lo] ",
354 			(int) st->st_uid, (int) st->st_nlink,
355 			(unsigned long) st->st_mode, (unsigned long) mode);
356 	if ((st->st_uid == uid || st->st_uid == 0 ||
357 	     st->st_uid == TrustedUid ||
358 	     !bitset(SFF_MUSTOWN, flags)) &&
359 	    (st->st_mode & mode) == mode)
360 	{
361 		if (tTd(44, 4))
362 			sm_dprintf("\tOK\n");
363 		return 0;
364 	}
365 	if (tTd(44, 4))
366 		sm_dprintf("\tEACCES\n");
367 	return EACCES;
368 }
369 /*
370 **  SAFEDIRPATH -- check to make sure a path to a directory is safe
371 **
372 **	Safe means not writable and owned by the right folks.
373 **
374 **	Parameters:
375 **		fn -- filename to check.
376 **		uid -- user id to compare against.
377 **		gid -- group id to compare against.
378 **		user -- user name to compare against (used for group
379 **			sets).
380 **		flags -- modifiers:
381 **			SFF_ROOTOK -- ok to use root permissions to open.
382 **			SFF_SAFEDIRPATH -- writable directories are considered
383 **				to be fatal errors.
384 **		level -- symlink recursive level.
385 **		offset -- offset into fn to start checking from.
386 **
387 **	Returns:
388 **		0 -- if the directory path is "safe".
389 **		else -- an error number associated with the path.
390 */
391 
392 int
393 safedirpath(fn, uid, gid, user, flags, level, offset)
394 	char *fn;
395 	UID_T uid;
396 	GID_T gid;
397 	char *user;
398 	long flags;
399 	int level;
400 	int offset;
401 {
402 	int ret = 0;
403 	int mode = S_IWOTH;
404 	char save = '\0';
405 	char *saveptr = NULL;
406 	char *p, *enddir;
407 	register struct group *gr = NULL;
408 	char s[MAXLINKPATHLEN];
409 	struct stat stbuf;
410 
411 	/* make sure we aren't in a symlink loop */
412 	if (level > MAXSYMLINKS)
413 		return ELOOP;
414 
415 	if (level < 0 || offset < 0 || offset > strlen(fn))
416 		return EINVAL;
417 
418 	/* special case root directory */
419 	if (*fn == '\0')
420 		fn = "/";
421 
422 	if (tTd(44, 4))
423 		sm_dprintf("safedirpath(%s, uid=%ld, gid=%ld, flags=%lx, level=%d, offset=%d):\n",
424 			fn, (long) uid, (long) gid, flags, level, offset);
425 
426 	if (!bitnset(DBS_GROUPWRITABLEDIRPATHSAFE, DontBlameSendmail))
427 		mode |= S_IWGRP;
428 
429 	/* Make a modifiable copy of the filename */
430 	if (sm_strlcpy(s, fn, sizeof s) >= sizeof s)
431 		return EINVAL;
432 
433 	p = s + offset;
434 	while (p != NULL)
435 	{
436 		/* put back character */
437 		if (saveptr != NULL)
438 		{
439 			*saveptr = save;
440 			saveptr = NULL;
441 			p++;
442 		}
443 
444 		if (*p == '\0')
445 			break;
446 
447 		p = strchr(p, '/');
448 
449 		/* Special case for root directory */
450 		if (p == s)
451 		{
452 			save = *(p + 1);
453 			saveptr = p + 1;
454 			*(p + 1) = '\0';
455 		}
456 		else if (p != NULL)
457 		{
458 			save = *p;
459 			saveptr = p;
460 			*p = '\0';
461 		}
462 
463 		/* Heuristic: . and .. have already been checked */
464 		enddir = strrchr(s, '/');
465 		if (enddir != NULL &&
466 		    (strcmp(enddir, "/..") == 0 ||
467 		     strcmp(enddir, "/.") == 0))
468 			continue;
469 
470 		if (tTd(44, 20))
471 			sm_dprintf("\t[dir %s]\n", s);
472 
473 #if HASLSTAT
474 		ret = lstat(s, &stbuf);
475 #else
476 		ret = stat(s, &stbuf);
477 #endif
478 		if (ret < 0)
479 		{
480 			ret = errno;
481 			break;
482 		}
483 
484 #ifdef S_ISLNK
485 		/* Follow symlinks */
486 		if (S_ISLNK(stbuf.st_mode))
487 		{
488 			int linklen;
489 			char *target;
490 			char buf[MAXPATHLEN];
491 			char fullbuf[MAXLINKPATHLEN];
492 
493 			memset(buf, '\0', sizeof buf);
494 			linklen = readlink(s, buf, sizeof buf);
495 			if (linklen < 0)
496 			{
497 				ret = errno;
498 				break;
499 			}
500 			if (linklen >= sizeof buf)
501 			{
502 				/* file name too long for buffer */
503 				ret = errno = EINVAL;
504 				break;
505 			}
506 
507 			offset = 0;
508 			if (*buf == '/')
509 			{
510 				target = buf;
511 
512 				/* If path is the same, avoid rechecks */
513 				while (s[offset] == buf[offset] &&
514 				       s[offset] != '\0')
515 					offset++;
516 
517 				if (s[offset] == '\0' && buf[offset] == '\0')
518 				{
519 					/* strings match, symlink loop */
520 					return ELOOP;
521 				}
522 
523 				/* back off from the mismatch */
524 				if (offset > 0)
525 					offset--;
526 
527 				/* Make sure we are at a directory break */
528 				if (offset > 0 &&
529 				    s[offset] != '/' &&
530 				    s[offset] != '\0')
531 				{
532 					while (buf[offset] != '/' &&
533 					       offset > 0)
534 						offset--;
535 				}
536 				if (offset > 0 &&
537 				    s[offset] == '/' &&
538 				    buf[offset] == '/')
539 				{
540 					/* Include the trailing slash */
541 					offset++;
542 				}
543 			}
544 			else
545 			{
546 				char *sptr;
547 
548 				sptr = strrchr(s, '/');
549 				if (sptr != NULL)
550 				{
551 					*sptr = '\0';
552 					offset = sptr + 1 - s;
553 					if (sm_strlcpyn(fullbuf,
554 							sizeof fullbuf, 2,
555 							s, "/") >=
556 						sizeof fullbuf ||
557 					    sm_strlcat(fullbuf, buf,
558 						       sizeof fullbuf) >=
559 						sizeof fullbuf)
560 					{
561 						ret = EINVAL;
562 						break;
563 					}
564 					*sptr = '/';
565 				}
566 				else
567 				{
568 					if (sm_strlcpy(fullbuf, buf,
569 						       sizeof fullbuf) >=
570 						sizeof fullbuf)
571 					{
572 						ret = EINVAL;
573 						break;
574 					}
575 				}
576 				target = fullbuf;
577 			}
578 			ret = safedirpath(target, uid, gid, user, flags,
579 					  level + 1, offset);
580 			if (ret != 0)
581 				break;
582 
583 			/* Don't check permissions on the link file itself */
584 			continue;
585 		}
586 #endif /* S_ISLNK */
587 
588 		if ((uid == 0 || bitset(SFF_SAFEDIRPATH, flags)) &&
589 #ifdef S_ISVTX
590 		    !(bitnset(DBS_TRUSTSTICKYBIT, DontBlameSendmail) &&
591 		      bitset(S_ISVTX, stbuf.st_mode)) &&
592 #endif
593 		    bitset(mode, stbuf.st_mode))
594 		{
595 			if (tTd(44, 4))
596 				sm_dprintf("\t[dir %s] mode %lo ",
597 					s, (unsigned long) stbuf.st_mode);
598 			if (bitset(SFF_SAFEDIRPATH, flags))
599 			{
600 				if (bitset(S_IWOTH, stbuf.st_mode))
601 					ret = E_SM_WWDIR;
602 				else
603 					ret = E_SM_GWDIR;
604 				if (tTd(44, 4))
605 					sm_dprintf("FATAL\n");
606 				break;
607 			}
608 			if (tTd(44, 4))
609 				sm_dprintf("WARNING\n");
610 			if (Verbose > 1)
611 				message("051 WARNING: %s writable directory %s",
612 					bitset(S_IWOTH, stbuf.st_mode)
613 					   ? "World"
614 					   : "Group",
615 					s);
616 		}
617 		if (uid == 0 && !bitset(SFF_ROOTOK|SFF_OPENASROOT, flags))
618 		{
619 			if (bitset(S_IXOTH, stbuf.st_mode))
620 				continue;
621 			ret = EACCES;
622 			break;
623 		}
624 
625 		/*
626 		**  Let OS determine access to file if we are not
627 		**  running as a privileged user.  This allows ACLs
628 		**  to work.  Also, if opening as root, assume we can
629 		**  scan the directory.
630 		*/
631 		if (geteuid() != 0 || bitset(SFF_OPENASROOT, flags))
632 			continue;
633 
634 		if (stbuf.st_uid == uid &&
635 		    bitset(S_IXUSR, stbuf.st_mode))
636 			continue;
637 		if (stbuf.st_gid == gid &&
638 		    bitset(S_IXGRP, stbuf.st_mode))
639 			continue;
640 #ifndef NO_GROUP_SET
641 		if (user != NULL && !DontInitGroups &&
642 		    ((gr != NULL && gr->gr_gid == stbuf.st_gid) ||
643 		     (gr = getgrgid(stbuf.st_gid)) != NULL))
644 		{
645 			register char **gp;
646 
647 			for (gp = gr->gr_mem; gp != NULL && *gp != NULL; gp++)
648 				if (strcmp(*gp, user) == 0)
649 					break;
650 			if (gp != NULL && *gp != NULL &&
651 			    bitset(S_IXGRP, stbuf.st_mode))
652 				continue;
653 		}
654 #endif /* ! NO_GROUP_SET */
655 		if (!bitset(S_IXOTH, stbuf.st_mode))
656 		{
657 			ret = EACCES;
658 			break;
659 		}
660 	}
661 	if (tTd(44, 4))
662 		sm_dprintf("\t[dir %s] %s\n", fn,
663 			ret == 0 ? "OK" : sm_errstring(ret));
664 	return ret;
665 }
666 /*
667 **  SAFEOPEN -- do a file open with extra checking
668 **
669 **	Parameters:
670 **		fn -- the file name to open.
671 **		omode -- the open-style mode flags.
672 **		cmode -- the create-style mode flags.
673 **		sff -- safefile flags.
674 **
675 **	Returns:
676 **		Same as open.
677 */
678 
679 int
680 safeopen(fn, omode, cmode, sff)
681 	char *fn;
682 	int omode;
683 	int cmode;
684 	long sff;
685 {
686 #if !NOFTRUNCATE
687 	bool truncate;
688 #endif
689 	int rval;
690 	int fd;
691 	int smode;
692 	struct stat stb;
693 
694 	if (tTd(44, 10))
695 		sm_dprintf("safeopen: fn=%s, omode=%x, cmode=%x, sff=%lx\n",
696 			   fn, omode, cmode, sff);
697 
698 	if (bitset(O_CREAT, omode))
699 		sff |= SFF_CREAT;
700 	omode &= ~O_CREAT;
701 	switch (omode & O_ACCMODE)
702 	{
703 	  case O_RDONLY:
704 		smode = S_IREAD;
705 		break;
706 
707 	  case O_WRONLY:
708 		smode = S_IWRITE;
709 		break;
710 
711 	  case O_RDWR:
712 		smode = S_IREAD|S_IWRITE;
713 		break;
714 
715 	  default:
716 		smode = 0;
717 		break;
718 	}
719 	if (bitset(SFF_OPENASROOT, sff))
720 		rval = safefile(fn, RunAsUid, RunAsGid, RunAsUserName,
721 				sff, smode, &stb);
722 	else
723 		rval = safefile(fn, RealUid, RealGid, RealUserName,
724 				sff, smode, &stb);
725 	if (rval != 0)
726 	{
727 		errno = rval;
728 		return -1;
729 	}
730 	if (stb.st_mode == ST_MODE_NOFILE && bitset(SFF_CREAT, sff))
731 		omode |= O_CREAT | (bitset(SFF_NOTEXCL, sff) ? 0 : O_EXCL);
732 	else if (bitset(SFF_CREAT, sff) && bitset(O_EXCL, omode))
733 	{
734 		/* The file exists so an exclusive create would fail */
735 		errno = EEXIST;
736 		return -1;
737 	}
738 
739 #if !NOFTRUNCATE
740 	truncate = bitset(O_TRUNC, omode);
741 	if (truncate)
742 		omode &= ~O_TRUNC;
743 #endif
744 
745 	fd = dfopen(fn, omode, cmode, sff);
746 	if (fd < 0)
747 		return fd;
748 	if (filechanged(fn, fd, &stb))
749 	{
750 		syserr("554 5.3.0 cannot open: file %s changed after open", fn);
751 		(void) close(fd);
752 		errno = E_SM_FILECHANGE;
753 		return -1;
754 	}
755 
756 #if !NOFTRUNCATE
757 	if (truncate &&
758 	    ftruncate(fd, (off_t) 0) < 0)
759 	{
760 		int save_errno;
761 
762 		save_errno = errno;
763 		syserr("554 5.3.0 cannot open: file %s could not be truncated",
764 		       fn);
765 		(void) close(fd);
766 		errno = save_errno;
767 		return -1;
768 	}
769 #endif /* !NOFTRUNCATE */
770 
771 	return fd;
772 }
773 /*
774 **  SAFEFOPEN -- do a file open with extra checking
775 **
776 **	Parameters:
777 **		fn -- the file name to open.
778 **		omode -- the open-style mode flags.
779 **		cmode -- the create-style mode flags.
780 **		sff -- safefile flags.
781 **
782 **	Returns:
783 **		Same as fopen.
784 */
785 
786 SM_FILE_T *
787 safefopen(fn, omode, cmode, sff)
788 	char *fn;
789 	int omode;
790 	int cmode;
791 	long sff;
792 {
793 	int fd;
794 	int save_errno;
795 	SM_FILE_T *fp;
796 	int fmode;
797 
798 	switch (omode & O_ACCMODE)
799 	{
800 	  case O_RDONLY:
801 		fmode = SM_IO_RDONLY;
802 		break;
803 
804 	  case O_WRONLY:
805 		if (bitset(O_APPEND, omode))
806 			fmode = SM_IO_APPEND;
807 		else
808 			fmode = SM_IO_WRONLY;
809 		break;
810 
811 	  case O_RDWR:
812 		if (bitset(O_TRUNC, omode))
813 			fmode = SM_IO_RDWRTR;
814 		else if (bitset(O_APPEND, omode))
815 			fmode = SM_IO_APPENDRW;
816 		else
817 			fmode = SM_IO_RDWR;
818 		break;
819 
820 	  default:
821 		syserr("554 5.3.5 safefopen: unknown omode %o", omode);
822 		fmode = 0;
823 	}
824 	fd = safeopen(fn, omode, cmode, sff);
825 	if (fd < 0)
826 	{
827 		save_errno = errno;
828 		if (tTd(44, 10))
829 			sm_dprintf("safefopen: safeopen failed: %s\n",
830 				   sm_errstring(errno));
831 		errno = save_errno;
832 		return NULL;
833 	}
834 	fp = sm_io_open(SmFtStdiofd, SM_TIME_DEFAULT,
835 			(void *) &fd, fmode, NULL);
836 	if (fp != NULL)
837 		return fp;
838 
839 	save_errno = errno;
840 	if (tTd(44, 10))
841 	{
842 		sm_dprintf("safefopen: fdopen(%s, %d) failed: omode=%x, sff=%lx, err=%s\n",
843 			   fn, fmode, omode, sff, sm_errstring(errno));
844 	}
845 	(void) close(fd);
846 	errno = save_errno;
847 	return NULL;
848 }
849 /*
850 **  FILECHANGED -- check to see if file changed after being opened
851 **
852 **	Parameters:
853 **		fn -- pathname of file to check.
854 **		fd -- file descriptor to check.
855 **		stb -- stat structure from before open.
856 **
857 **	Returns:
858 **		true -- if a problem was detected.
859 **		false -- if this file is still the same.
860 */
861 
862 bool
863 filechanged(fn, fd, stb)
864 	char *fn;
865 	int fd;
866 	struct stat *stb;
867 {
868 	struct stat sta;
869 
870 	if (stb->st_mode == ST_MODE_NOFILE)
871 	{
872 #if HASLSTAT && BOGUS_O_EXCL
873 		/* only necessary if exclusive open follows symbolic links */
874 		if (lstat(fn, stb) < 0 || stb->st_nlink != 1)
875 			return true;
876 #else
877 		return false;
878 #endif
879 	}
880 	if (fstat(fd, &sta) < 0)
881 		return true;
882 
883 	if (sta.st_nlink != stb->st_nlink ||
884 	    sta.st_dev != stb->st_dev ||
885 	    sta.st_ino != stb->st_ino ||
886 #if HAS_ST_GEN && 0		/* AFS returns garbage in st_gen */
887 	    sta.st_gen != stb->st_gen ||
888 #endif
889 	    sta.st_uid != stb->st_uid ||
890 	    sta.st_gid != stb->st_gid)
891 	{
892 		if (tTd(44, 8))
893 		{
894 			sm_dprintf("File changed after opening:\n");
895 			sm_dprintf(" nlink	= %ld/%ld\n",
896 				(long) stb->st_nlink, (long) sta.st_nlink);
897 			sm_dprintf(" dev	= %ld/%ld\n",
898 				(long) stb->st_dev, (long) sta.st_dev);
899 			sm_dprintf(" ino	= %llu/%llu\n",
900 				(ULONGLONG_T) stb->st_ino,
901 				(ULONGLONG_T) sta.st_ino);
902 #if HAS_ST_GEN
903 			sm_dprintf(" gen	= %ld/%ld\n",
904 				(long) stb->st_gen, (long) sta.st_gen);
905 #endif
906 			sm_dprintf(" uid	= %ld/%ld\n",
907 				(long) stb->st_uid, (long) sta.st_uid);
908 			sm_dprintf(" gid	= %ld/%ld\n",
909 				(long) stb->st_gid, (long) sta.st_gid);
910 		}
911 		return true;
912 	}
913 
914 	return false;
915 }
916 /*
917 **  DFOPEN -- determined file open
918 **
919 **	This routine has the semantics of open, except that it will
920 **	keep trying a few times to make this happen.  The idea is that
921 **	on very loaded systems, we may run out of resources (inodes,
922 **	whatever), so this tries to get around it.
923 */
924 
925 int
926 dfopen(filename, omode, cmode, sff)
927 	char *filename;
928 	int omode;
929 	int cmode;
930 	long sff;
931 {
932 	register int tries;
933 	int fd = -1;
934 	struct stat st;
935 
936 	for (tries = 0; tries < 10; tries++)
937 	{
938 		(void) sleep((unsigned) (10 * tries));
939 		errno = 0;
940 		fd = open(filename, omode, cmode);
941 		if (fd >= 0)
942 			break;
943 		switch (errno)
944 		{
945 		  case ENFILE:		/* system file table full */
946 		  case EINTR:		/* interrupted syscall */
947 #ifdef ETXTBSY
948 		  case ETXTBSY:		/* Apollo: net file locked */
949 #endif
950 			continue;
951 		}
952 		break;
953 	}
954 	if (!bitset(SFF_NOLOCK, sff) &&
955 	    fd >= 0 &&
956 	    fstat(fd, &st) >= 0 &&
957 	    S_ISREG(st.st_mode))
958 	{
959 		int locktype;
960 
961 		/* lock the file to avoid accidental conflicts */
962 		if ((omode & O_ACCMODE) != O_RDONLY)
963 			locktype = LOCK_EX;
964 		else
965 			locktype = LOCK_SH;
966 		if (bitset(SFF_NBLOCK, sff))
967 			locktype |= LOCK_NB;
968 
969 		if (!lockfile(fd, filename, NULL, locktype))
970 		{
971 			int save_errno = errno;
972 
973 			(void) close(fd);
974 			fd = -1;
975 			errno = save_errno;
976 		}
977 		else
978 			errno = 0;
979 	}
980 	return fd;
981 }
982