Mercurial > dovecot > core-2.2

annotate src/lib/eacces-error.c @ 13059:d339aeb782ed

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
eacces_get_error(): Give even better error message for directory permission errors.
author Timo Sirainen <tss@iki.fi>
date Fri, 03 Jun 2011 17:22:09 +0300
parents 17d8e1f12901
children 8aeff3210f8d
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
12822
44d0474a451e Updated copyright notices to include year 2011.
Timo Sirainen <tss@iki.fi>
parents: 12050
diff changeset
1 /* Copyright (c) 2007-2011 Dovecot authors, see the included COPYING file */
8759
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
2
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
3 #include "lib.h"
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
4 #include "str.h"
10502
13be6ac759ee Added t_get_current_dir() and use it instead of getcwd().
Timo Sirainen <tss@iki.fi>
parents: 10210
diff changeset
5 #include "abspath.h"
12859
02829f7f79c7 Replaced all getpw/gr*() to use i_getpw/gr*() with improved error handling.
Timo Sirainen <tss@iki.fi>
parents: 12854
diff changeset
6 #include "ipwd.h"
9501
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
7 #include "restrict-access.h"
8759
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
8 #include "eacces-error.h"
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
9
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
10 #include <sys/stat.h>
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
11 #include <unistd.h>
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
12
9501
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
13 static bool is_in_group(gid_t gid)
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
14 {
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
15 const gid_t *gids;
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
16 unsigned int i, count;
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
17
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
18 if (getegid() == gid)
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
19 return TRUE;
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
20
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
21 gids = restrict_get_groups_list(&count);
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
22 for (i = 0; i < count; i++) {
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
23 if (gids[i] == gid)
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
24 return TRUE;
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
25 }
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
26 return FALSE;
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
27 }
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
28
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
29 static int test_access(const char *path, int mode, string_t *errmsg)
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
30 {
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
31 struct stat st;
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
32
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
33 if (getuid() == geteuid()) {
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
34 if (access(path, mode) == 0)
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
35 return 0;
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
36
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
37 if (errno != EACCES) {
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
38 str_printfa(errmsg, " access(%s, %d) failed: %m",
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
39 path, mode);
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
40 }
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
41 return -1;
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
42 }
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
43
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
44 /* access() uses real uid, not effective uid.
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
45 we'll have to do these checks manually. */
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
46 switch (mode) {
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
47 case X_OK:
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
48 if (stat(t_strconcat(path, "/test", NULL), &st) == 0)
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
49 return 0;
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
50 if (errno == ENOENT || errno == ENOTDIR)
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
51 return 0;
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
52 if (errno != EACCES)
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
53 str_printfa(errmsg, " stat(%s/test) failed: %m", path);
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
54 return -1;
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
55 case R_OK:
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
56 mode = 04;
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
57 break;
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
58 case W_OK:
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
59 mode = 02;
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
60 break;
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
61 default:
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
62 i_unreached();
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
63 }
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
64
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
65 if (stat(path, &st) < 0) {
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
66 str_printfa(errmsg, " stat(%s) failed: %m", path);
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
67 return -1;
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
68 }
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
69
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
70 if (st.st_uid == geteuid())
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
71 st.st_mode = (st.st_mode & 0700) >> 6;
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
72 else if (is_in_group(st.st_gid))
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
73 st.st_mode = (st.st_mode & 0070) >> 3;
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
74 else
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
75 st.st_mode = (st.st_mode & 0007);
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
76
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
77 if ((st.st_mode & mode) != 0)
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
78 return 0;
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
79 errno = EACCES;
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
80 return -1;
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
81 }
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
82
8759
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
83 static const char *
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
84 eacces_error_get_full(const char *func, const char *path, bool creating)
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
85 {
13057
12e3e8570d77 eaccess_get_error(): Fixes to reporting dir permissions.
Timo Sirainen <tss@iki.fi>
parents: 12929
diff changeset
86 const char *prev_path, *dir = NULL, *p;
10553
b8966b8133f2 eacces_error_get*(): Check and warn if multiple uids/gids have same name.
Timo Sirainen <tss@iki.fi>
parents: 10502
diff changeset
87 const char *pw_name = NULL, *gr_name = NULL;
12859
02829f7f79c7 Replaced all getpw/gr*() to use i_getpw/gr*() with improved error handling.
Timo Sirainen <tss@iki.fi>
parents: 12854
diff changeset
88 struct passwd pw;
02829f7f79c7 Replaced all getpw/gr*() to use i_getpw/gr*() with improved error handling.
Timo Sirainen <tss@iki.fi>
parents: 12854
diff changeset
89 struct group group;
8759
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
90 string_t *errmsg;
13057
12e3e8570d77 eaccess_get_error(): Fixes to reporting dir permissions.
Timo Sirainen <tss@iki.fi>
parents: 12929
diff changeset
91 struct stat st;
13059
d339aeb782ed eacces_get_error(): Give even better error message for directory permission errors.
Timo Sirainen <tss@iki.fi>
parents: 13058
diff changeset
92 int orig_errno, ret, missing_mode = 0;
8759
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
93
9537
b373de4973cd Whenever file's group changing fails, show the group origin in the error message.
Timo Sirainen <tss@iki.fi>
parents: 9534
diff changeset
94 orig_errno = errno;
8759
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
95 errmsg = t_str_new(256);
9589
f564209e9396 eacces_error_get*(): Show current directory if path is relative.
Timo Sirainen <tss@iki.fi>
parents: 9537
diff changeset
96 str_printfa(errmsg, "%s(%s)", func, path);
f564209e9396 eacces_error_get*(): Show current directory if path is relative.
Timo Sirainen <tss@iki.fi>
parents: 9537
diff changeset
97 if (*path != '/') {
13057
12e3e8570d77 eaccess_get_error(): Fixes to reporting dir permissions.
Timo Sirainen <tss@iki.fi>
parents: 12929
diff changeset
98 if (t_get_current_dir(&dir) == 0) {
9589
f564209e9396 eacces_error_get*(): Show current directory if path is relative.
Timo Sirainen <tss@iki.fi>
parents: 9537
diff changeset
99 str_printfa(errmsg, " in directory %s", dir);
13057
12e3e8570d77 eaccess_get_error(): Fixes to reporting dir permissions.
Timo Sirainen <tss@iki.fi>
parents: 12929
diff changeset
100 path = t_strconcat(dir, "/", path, NULL);
12050
8db227a70bec access_get_error(): Fixed to give better error messages with relative paths.
Timo Sirainen <tss@iki.fi>
parents: 12004
diff changeset
101 }
9589
f564209e9396 eacces_error_get*(): Show current directory if path is relative.
Timo Sirainen <tss@iki.fi>
parents: 9537
diff changeset
102 }
f564209e9396 eacces_error_get*(): Show current directory if path is relative.
Timo Sirainen <tss@iki.fi>
parents: 9537
diff changeset
103 str_printfa(errmsg, " failed: Permission denied (euid=%s",
f564209e9396 eacces_error_get*(): Show current directory if path is relative.
Timo Sirainen <tss@iki.fi>
parents: 9537
diff changeset
104 dec2str(geteuid()));
8759
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
105
12859
02829f7f79c7 Replaced all getpw/gr*() to use i_getpw/gr*() with improved error handling.
Timo Sirainen <tss@iki.fi>
parents: 12854
diff changeset
106 switch (i_getpwuid(geteuid(), &pw)) {
02829f7f79c7 Replaced all getpw/gr*() to use i_getpw/gr*() with improved error handling.
Timo Sirainen <tss@iki.fi>
parents: 12854
diff changeset
107 case -1:
02829f7f79c7 Replaced all getpw/gr*() to use i_getpw/gr*() with improved error handling.
Timo Sirainen <tss@iki.fi>
parents: 12854
diff changeset
108 str_append(errmsg, "(<getpwuid() error>)");
02829f7f79c7 Replaced all getpw/gr*() to use i_getpw/gr*() with improved error handling.
Timo Sirainen <tss@iki.fi>
parents: 12854
diff changeset
109 break;
02829f7f79c7 Replaced all getpw/gr*() to use i_getpw/gr*() with improved error handling.
Timo Sirainen <tss@iki.fi>
parents: 12854
diff changeset
110 case 0:
02829f7f79c7 Replaced all getpw/gr*() to use i_getpw/gr*() with improved error handling.
Timo Sirainen <tss@iki.fi>
parents: 12854
diff changeset
111 str_append(errmsg, "(<unknown>)");
02829f7f79c7 Replaced all getpw/gr*() to use i_getpw/gr*() with improved error handling.
Timo Sirainen <tss@iki.fi>
parents: 12854
diff changeset
112 break;
02829f7f79c7 Replaced all getpw/gr*() to use i_getpw/gr*() with improved error handling.
Timo Sirainen <tss@iki.fi>
parents: 12854
diff changeset
113 default:
02829f7f79c7 Replaced all getpw/gr*() to use i_getpw/gr*() with improved error handling.
Timo Sirainen <tss@iki.fi>
parents: 12854
diff changeset
114 pw_name = t_strdup(pw.pw_name);
10553
b8966b8133f2 eacces_error_get*(): Check and warn if multiple uids/gids have same name.
Timo Sirainen <tss@iki.fi>
parents: 10502
diff changeset
115 str_printfa(errmsg, "(%s)", pw_name);
12859
02829f7f79c7 Replaced all getpw/gr*() to use i_getpw/gr*() with improved error handling.
Timo Sirainen <tss@iki.fi>
parents: 12854
diff changeset
116 break;
10553
b8966b8133f2 eacces_error_get*(): Check and warn if multiple uids/gids have same name.
Timo Sirainen <tss@iki.fi>
parents: 10502
diff changeset
117 }
8759
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
118
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
119 str_printfa(errmsg, " egid=%s", dec2str(getegid()));
12859
02829f7f79c7 Replaced all getpw/gr*() to use i_getpw/gr*() with improved error handling.
Timo Sirainen <tss@iki.fi>
parents: 12854
diff changeset
120 switch (i_getgrgid(getegid(), &group)) {
02829f7f79c7 Replaced all getpw/gr*() to use i_getpw/gr*() with improved error handling.
Timo Sirainen <tss@iki.fi>
parents: 12854
diff changeset
121 case -1:
02829f7f79c7 Replaced all getpw/gr*() to use i_getpw/gr*() with improved error handling.
Timo Sirainen <tss@iki.fi>
parents: 12854
diff changeset
122 str_append(errmsg, "(<getgrgid() error>)");
02829f7f79c7 Replaced all getpw/gr*() to use i_getpw/gr*() with improved error handling.
Timo Sirainen <tss@iki.fi>
parents: 12854
diff changeset
123 break;
02829f7f79c7 Replaced all getpw/gr*() to use i_getpw/gr*() with improved error handling.
Timo Sirainen <tss@iki.fi>
parents: 12854
diff changeset
124 case 0:
02829f7f79c7 Replaced all getpw/gr*() to use i_getpw/gr*() with improved error handling.
Timo Sirainen <tss@iki.fi>
parents: 12854
diff changeset
125 str_append(errmsg, "(<unknown>)");
02829f7f79c7 Replaced all getpw/gr*() to use i_getpw/gr*() with improved error handling.
Timo Sirainen <tss@iki.fi>
parents: 12854
diff changeset
126 break;
02829f7f79c7 Replaced all getpw/gr*() to use i_getpw/gr*() with improved error handling.
Timo Sirainen <tss@iki.fi>
parents: 12854
diff changeset
127 default:
02829f7f79c7 Replaced all getpw/gr*() to use i_getpw/gr*() with improved error handling.
Timo Sirainen <tss@iki.fi>
parents: 12854
diff changeset
128 gr_name = t_strdup(group.gr_name);
10553
b8966b8133f2 eacces_error_get*(): Check and warn if multiple uids/gids have same name.
Timo Sirainen <tss@iki.fi>
parents: 10502
diff changeset
129 str_printfa(errmsg, "(%s)", gr_name);
12859
02829f7f79c7 Replaced all getpw/gr*() to use i_getpw/gr*() with improved error handling.
Timo Sirainen <tss@iki.fi>
parents: 12854
diff changeset
130 break;
10553
b8966b8133f2 eacces_error_get*(): Check and warn if multiple uids/gids have same name.
Timo Sirainen <tss@iki.fi>
parents: 10502
diff changeset
131 }
8759
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
132
13057
12e3e8570d77 eaccess_get_error(): Fixes to reporting dir permissions.
Timo Sirainen <tss@iki.fi>
parents: 12929
diff changeset
133 prev_path = path; ret = -1;
12e3e8570d77 eaccess_get_error(): Fixes to reporting dir permissions.
Timo Sirainen <tss@iki.fi>
parents: 12929
diff changeset
134 while (strcmp(prev_path, "/") != 0) {
12e3e8570d77 eaccess_get_error(): Fixes to reporting dir permissions.
Timo Sirainen <tss@iki.fi>
parents: 12929
diff changeset
135 if ((p = strrchr(prev_path, '/')) == NULL)
12e3e8570d77 eaccess_get_error(): Fixes to reporting dir permissions.
Timo Sirainen <tss@iki.fi>
parents: 12929
diff changeset
136 break;
12e3e8570d77 eaccess_get_error(): Fixes to reporting dir permissions.
Timo Sirainen <tss@iki.fi>
parents: 12929
diff changeset
137
12e3e8570d77 eaccess_get_error(): Fixes to reporting dir permissions.
Timo Sirainen <tss@iki.fi>
parents: 12929
diff changeset
138 dir = t_strdup_until(prev_path, p);
8759
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
139 ret = stat(dir, &st);
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
140 if (ret == 0)
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
141 break;
12854
46d46fa3929f eacces_error_get*(): Handle errors to / directory better.
Timo Sirainen <tss@iki.fi>
parents: 12822
diff changeset
142 if (errno == EACCES && strcmp(dir, "/") != 0) {
8759
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
143 /* see if we have access to parent directory */
12854
46d46fa3929f eacces_error_get*(): Handle errors to / directory better.
Timo Sirainen <tss@iki.fi>
parents: 12822
diff changeset
144 } else if (errno == ENOENT && creating &&
46d46fa3929f eacces_error_get*(): Handle errors to / directory better.
Timo Sirainen <tss@iki.fi>
parents: 12822
diff changeset
145 strcmp(dir, "/") != 0) {
8759
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
146 /* probably mkdir_parents() failed here, find the first
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
147 parent directory we couldn't create */
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
148 } else {
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
149 /* some other error, can't handle it */
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
150 str_printfa(errmsg, " stat(%s) failed: %m", dir);
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
151 break;
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
152 }
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
153 prev_path = dir;
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
154 }
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
155
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
156 if (ret == 0) {
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
157 /* dir is the first parent directory we can stat() */
9501
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
158 if (test_access(dir, X_OK, errmsg) < 0) {
13059
d339aeb782ed eacces_get_error(): Give even better error message for directory permission errors.
Timo Sirainen <tss@iki.fi>
parents: 13058
diff changeset
159 if (errno == EACCES) {
8759
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
160 str_printfa(errmsg, " missing +x perm: %s", dir);
13059
d339aeb782ed eacces_get_error(): Give even better error message for directory permission errors.
Timo Sirainen <tss@iki.fi>
parents: 13058
diff changeset
161 missing_mode = 1;
d339aeb782ed eacces_get_error(): Give even better error message for directory permission errors.
Timo Sirainen <tss@iki.fi>
parents: 13058
diff changeset
162 }
9501
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
163 } else if (creating && test_access(dir, W_OK, errmsg) < 0) {
13059
d339aeb782ed eacces_get_error(): Give even better error message for directory permission errors.
Timo Sirainen <tss@iki.fi>
parents: 13058
diff changeset
164 if (errno == EACCES) {
8759
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
165 str_printfa(errmsg, " missing +w perm: %s", dir);
13059
d339aeb782ed eacces_get_error(): Give even better error message for directory permission errors.
Timo Sirainen <tss@iki.fi>
parents: 13058
diff changeset
166 missing_mode = 2;
d339aeb782ed eacces_get_error(): Give even better error message for directory permission errors.
Timo Sirainen <tss@iki.fi>
parents: 13058
diff changeset
167 }
9501
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
168 } else if (prev_path == path &&
e22e36a61fdd eacces_error_get*() works now properly when process's real uid != effective uid.
Timo Sirainen <tss@iki.fi>
parents: 8759
diff changeset
169 test_access(path, R_OK, errmsg) < 0) {
8759
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
170 if (errno == EACCES)
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
171 str_printfa(errmsg, " missing +r perm: %s", path);
9534
8760bc0b1c3a eacces_error_get(): Check also if user had write permissions to the given file.
Timo Sirainen <tss@iki.fi>
parents: 9501
diff changeset
172 } else if (!creating && test_access(path, W_OK, errmsg) < 0) {
8760bc0b1c3a eacces_error_get(): Check also if user had write permissions to the given file.
Timo Sirainen <tss@iki.fi>
parents: 9501
diff changeset
173 /* this produces a wrong error if the operation didn't
8760bc0b1c3a eacces_error_get(): Check also if user had write permissions to the given file.
Timo Sirainen <tss@iki.fi>
parents: 9501
diff changeset
174 actually need write permissions, but we don't know
8760bc0b1c3a eacces_error_get(): Check also if user had write permissions to the given file.
Timo Sirainen <tss@iki.fi>
parents: 9501
diff changeset
175 it here.. */
13059
d339aeb782ed eacces_get_error(): Give even better error message for directory permission errors.
Timo Sirainen <tss@iki.fi>
parents: 13058
diff changeset
176 if (errno == EACCES) {
9534
8760bc0b1c3a eacces_error_get(): Check also if user had write permissions to the given file.
Timo Sirainen <tss@iki.fi>
parents: 9501
diff changeset
177 str_printfa(errmsg, " missing +w perm: %s", path);
13059
d339aeb782ed eacces_get_error(): Give even better error message for directory permission errors.
Timo Sirainen <tss@iki.fi>
parents: 13058
diff changeset
178 missing_mode = 4;
d339aeb782ed eacces_get_error(): Give even better error message for directory permission errors.
Timo Sirainen <tss@iki.fi>
parents: 13058
diff changeset
179 }
d339aeb782ed eacces_get_error(): Give even better error message for directory permission errors.
Timo Sirainen <tss@iki.fi>
parents: 13058
diff changeset
180 } else {
d339aeb782ed eacces_get_error(): Give even better error message for directory permission errors.
Timo Sirainen <tss@iki.fi>
parents: 13058
diff changeset
181 str_append(errmsg, " UNIX perms appear ok "
d339aeb782ed eacces_get_error(): Give even better error message for directory permission errors.
Timo Sirainen <tss@iki.fi>
parents: 13058
diff changeset
182 "(ACL/MAC wrong?)");
d339aeb782ed eacces_get_error(): Give even better error message for directory permission errors.
Timo Sirainen <tss@iki.fi>
parents: 13058
diff changeset
183 }
8759
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
184 }
13059
d339aeb782ed eacces_get_error(): Give even better error message for directory permission errors.
Timo Sirainen <tss@iki.fi>
parents: 13058
diff changeset
185 if (ret < 0)
d339aeb782ed eacces_get_error(): Give even better error message for directory permission errors.
Timo Sirainen <tss@iki.fi>
parents: 13058
diff changeset
186 ;
d339aeb782ed eacces_get_error(): Give even better error message for directory permission errors.
Timo Sirainen <tss@iki.fi>
parents: 13058
diff changeset
187 else if (st.st_uid != geteuid()) {
13057
12e3e8570d77 eaccess_get_error(): Fixes to reporting dir permissions.
Timo Sirainen <tss@iki.fi>
parents: 12929
diff changeset
188 if (pw_name != NULL && i_getpwuid(st.st_uid, &pw) > 0 &&
12859
02829f7f79c7 Replaced all getpw/gr*() to use i_getpw/gr*() with improved error handling.
Timo Sirainen <tss@iki.fi>
parents: 12854
diff changeset
189 strcmp(pw.pw_name, pw_name) == 0) {
10819
6a8ee83cbc8c eacces_error_get*(): Mention if euid is parent directory's owner.
Timo Sirainen <tss@iki.fi>
parents: 10582
diff changeset
190 str_printfa(errmsg, ", conflicting dir uid=%s(%s)",
13057
12e3e8570d77 eaccess_get_error(): Fixes to reporting dir permissions.
Timo Sirainen <tss@iki.fi>
parents: 12929
diff changeset
191 dec2str(st.st_uid), pw_name);
10819
6a8ee83cbc8c eacces_error_get*(): Mention if euid is parent directory's owner.
Timo Sirainen <tss@iki.fi>
parents: 10582
diff changeset
192 } else {
13058
17d8e1f12901 eaccess_get_error(): Show also directory mode.
Timo Sirainen <tss@iki.fi>
parents: 13057
diff changeset
193 str_printfa(errmsg, ", dir owned by %s:%s mode=0%o",
17d8e1f12901 eaccess_get_error(): Show also directory mode.
Timo Sirainen <tss@iki.fi>
parents: 13057
diff changeset
194 dec2str(st.st_uid), dec2str(st.st_gid),
17d8e1f12901 eaccess_get_error(): Show also directory mode.
Timo Sirainen <tss@iki.fi>
parents: 13057
diff changeset
195 st.st_mode & 0777);
10553
b8966b8133f2 eacces_error_get*(): Check and warn if multiple uids/gids have same name.
Timo Sirainen <tss@iki.fi>
parents: 10502
diff changeset
196 }
13059
d339aeb782ed eacces_get_error(): Give even better error message for directory permission errors.
Timo Sirainen <tss@iki.fi>
parents: 13058
diff changeset
197 } else if (missing_mode != 0 &&
d339aeb782ed eacces_get_error(): Give even better error message for directory permission errors.
Timo Sirainen <tss@iki.fi>
parents: 13058
diff changeset
198 (((st.st_mode & 0700) >> 6) & missing_mode) == 0) {
d339aeb782ed eacces_get_error(): Give even better error message for directory permission errors.
Timo Sirainen <tss@iki.fi>
parents: 13058
diff changeset
199 str_append(errmsg, ", dir owner missing perms");
10819
6a8ee83cbc8c eacces_error_get*(): Mention if euid is parent directory's owner.
Timo Sirainen <tss@iki.fi>
parents: 10582
diff changeset
200 } else {
13059
d339aeb782ed eacces_get_error(): Give even better error message for directory permission errors.
Timo Sirainen <tss@iki.fi>
parents: 13058
diff changeset
201 str_append(errmsg, ", UNIX perms appear ok (ACL/MAC wrong?)");
10553
b8966b8133f2 eacces_error_get*(): Check and warn if multiple uids/gids have same name.
Timo Sirainen <tss@iki.fi>
parents: 10502
diff changeset
202 }
13057
12e3e8570d77 eaccess_get_error(): Fixes to reporting dir permissions.
Timo Sirainen <tss@iki.fi>
parents: 12929
diff changeset
203 if (ret == 0 && gr_name != NULL && st.st_gid != getegid()) {
12e3e8570d77 eaccess_get_error(): Fixes to reporting dir permissions.
Timo Sirainen <tss@iki.fi>
parents: 12929
diff changeset
204 if (i_getgrgid(st.st_gid, &group) > 0 &&
12859
02829f7f79c7 Replaced all getpw/gr*() to use i_getpw/gr*() with improved error handling.
Timo Sirainen <tss@iki.fi>
parents: 12854
diff changeset
205 strcmp(group.gr_name, gr_name) == 0) {
10819
6a8ee83cbc8c eacces_error_get*(): Mention if euid is parent directory's owner.
Timo Sirainen <tss@iki.fi>
parents: 10582
diff changeset
206 str_printfa(errmsg, ", conflicting dir gid=%s(%s)",
13057
12e3e8570d77 eaccess_get_error(): Fixes to reporting dir permissions.
Timo Sirainen <tss@iki.fi>
parents: 12929
diff changeset
207 dec2str(st.st_gid), gr_name);
10553
b8966b8133f2 eacces_error_get*(): Check and warn if multiple uids/gids have same name.
Timo Sirainen <tss@iki.fi>
parents: 10502
diff changeset
208 }
b8966b8133f2 eacces_error_get*(): Check and warn if multiple uids/gids have same name.
Timo Sirainen <tss@iki.fi>
parents: 10502
diff changeset
209 }
8759
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
210 str_append_c(errmsg, ')');
9537
b373de4973cd Whenever file's group changing fails, show the group origin in the error message.
Timo Sirainen <tss@iki.fi>
parents: 9534
diff changeset
211 errno = orig_errno;
8759
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
212 return str_c(errmsg);
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
213 }
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
214
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
215 const char *eacces_error_get(const char *func, const char *path)
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
216 {
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
217 return eacces_error_get_full(func, path, FALSE);
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
218 }
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
219
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
220 const char *eacces_error_get_creating(const char *func, const char *path)
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
221 {
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
222 return eacces_error_get_full(func, path, TRUE);
6ec819adfde3 Moved user-friendly EACCES error message generation to lib/.
Timo Sirainen <tss@iki.fi>
parents:
diff changeset
223 }
9537
b373de4973cd Whenever file's group changing fails, show the group origin in the error message.
Timo Sirainen <tss@iki.fi>
parents: 9534
diff changeset
224
b373de4973cd Whenever file's group changing fails, show the group origin in the error message.
Timo Sirainen <tss@iki.fi>
parents: 9534
diff changeset
225 const char *eperm_error_get_chgrp(const char *func, const char *path,
b373de4973cd Whenever file's group changing fails, show the group origin in the error message.
Timo Sirainen <tss@iki.fi>
parents: 9534
diff changeset
226 gid_t gid, const char *gid_origin)
b373de4973cd Whenever file's group changing fails, show the group origin in the error message.
Timo Sirainen <tss@iki.fi>
parents: 9534
diff changeset
227 {
b373de4973cd Whenever file's group changing fails, show the group origin in the error message.
Timo Sirainen <tss@iki.fi>
parents: 9534
diff changeset
228 string_t *errmsg;
b373de4973cd Whenever file's group changing fails, show the group origin in the error message.
Timo Sirainen <tss@iki.fi>
parents: 9534
diff changeset
229 const struct group *group;
b373de4973cd Whenever file's group changing fails, show the group origin in the error message.
Timo Sirainen <tss@iki.fi>
parents: 9534
diff changeset
230 int orig_errno = errno;
b373de4973cd Whenever file's group changing fails, show the group origin in the error message.
Timo Sirainen <tss@iki.fi>
parents: 9534
diff changeset
231
b373de4973cd Whenever file's group changing fails, show the group origin in the error message.
Timo Sirainen <tss@iki.fi>
parents: 9534
diff changeset
232 errmsg = t_str_new(256);
b373de4973cd Whenever file's group changing fails, show the group origin in the error message.
Timo Sirainen <tss@iki.fi>
parents: 9534
diff changeset
233
12928
1319931cfda0 eperm_error_get_chgrp(): Improved error message and added a link to wiki.
Timo Sirainen <tss@iki.fi>
parents: 12859
diff changeset
234 str_printfa(errmsg, "%s(%s, group=%s", func, path, dec2str(gid));
9537
b373de4973cd Whenever file's group changing fails, show the group origin in the error message.
Timo Sirainen <tss@iki.fi>
parents: 9534
diff changeset
235 group = getgrgid(gid);
b373de4973cd Whenever file's group changing fails, show the group origin in the error message.
Timo Sirainen <tss@iki.fi>
parents: 9534
diff changeset
236 if (group != NULL)
b373de4973cd Whenever file's group changing fails, show the group origin in the error message.
Timo Sirainen <tss@iki.fi>
parents: 9534
diff changeset
237 str_printfa(errmsg, "(%s)", group->gr_name);
b373de4973cd Whenever file's group changing fails, show the group origin in the error message.
Timo Sirainen <tss@iki.fi>
parents: 9534
diff changeset
238
b373de4973cd Whenever file's group changing fails, show the group origin in the error message.
Timo Sirainen <tss@iki.fi>
parents: 9534
diff changeset
239 str_printfa(errmsg, ") failed: Operation not permitted (egid=%s",
b373de4973cd Whenever file's group changing fails, show the group origin in the error message.
Timo Sirainen <tss@iki.fi>
parents: 9534
diff changeset
240 dec2str(getegid()));
b373de4973cd Whenever file's group changing fails, show the group origin in the error message.
Timo Sirainen <tss@iki.fi>
parents: 9534
diff changeset
241 group = getgrgid(getegid());
b373de4973cd Whenever file's group changing fails, show the group origin in the error message.
Timo Sirainen <tss@iki.fi>
parents: 9534
diff changeset
242 if (group != NULL)
b373de4973cd Whenever file's group changing fails, show the group origin in the error message.
Timo Sirainen <tss@iki.fi>
parents: 9534
diff changeset
243 str_printfa(errmsg, "(%s)", group->gr_name);
b373de4973cd Whenever file's group changing fails, show the group origin in the error message.
Timo Sirainen <tss@iki.fi>
parents: 9534
diff changeset
244 if (gid_origin != NULL)
b373de4973cd Whenever file's group changing fails, show the group origin in the error message.
Timo Sirainen <tss@iki.fi>
parents: 9534
diff changeset
245 str_printfa(errmsg, ", group based on %s", gid_origin);
12929
ab12bc9fcc21 eperm_error_get_chgrp(): Changed wiki link.
Timo Sirainen <tss@iki.fi>
parents: 12928
diff changeset
246 str_append(errmsg, " - see http://wiki2.dovecot.org/Errors/ChgrpNoPerm)");
9537
b373de4973cd Whenever file's group changing fails, show the group origin in the error message.
Timo Sirainen <tss@iki.fi>
parents: 9534
diff changeset
247 errno = orig_errno;
b373de4973cd Whenever file's group changing fails, show the group origin in the error message.
Timo Sirainen <tss@iki.fi>
parents: 9534
diff changeset
248 return str_c(errmsg);
b373de4973cd Whenever file's group changing fails, show the group origin in the error message.
Timo Sirainen <tss@iki.fi>
parents: 9534
diff changeset
249 }