1 | /* Copyright (C) 1991-2019 Free Software Foundation, Inc. |
2 | This file is part of the GNU C Library. |
3 | |
4 | The GNU C Library is free software; you can redistribute it and/or |
5 | modify it under the terms of the GNU Lesser General Public |
6 | License as published by the Free Software Foundation; either |
7 | version 2.1 of the License, or (at your option) any later version. |
8 | |
9 | The GNU C Library is distributed in the hope that it will be useful, |
10 | but WITHOUT ANY WARRANTY; without even the implied warranty of |
11 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU |
12 | Lesser General Public License for more details. |
13 | |
14 | You should have received a copy of the GNU Lesser General Public |
15 | License along with the GNU C Library; if not, see |
16 | <http://www.gnu.org/licenses/>. */ |
17 | |
18 | #if !_LIBC |
19 | # include <config.h> |
20 | # include "tempname.h" |
21 | #endif |
22 | |
23 | #include <sys/types.h> |
24 | #include <assert.h> |
25 | |
26 | #include <errno.h> |
27 | #ifndef __set_errno |
28 | # define __set_errno(Val) errno = (Val) |
29 | #endif |
30 | |
31 | #include <stdio.h> |
32 | #ifndef P_tmpdir |
33 | # define P_tmpdir "/tmp" |
34 | #endif |
35 | #ifndef TMP_MAX |
36 | # define TMP_MAX 238328 |
37 | #endif |
38 | #ifndef __GT_FILE |
39 | # define __GT_FILE 0 |
40 | # define __GT_DIR 1 |
41 | # define __GT_NOCREATE 2 |
42 | #endif |
43 | #if !_LIBC && (GT_FILE != __GT_FILE || GT_DIR != __GT_DIR \ |
44 | || GT_NOCREATE != __GT_NOCREATE) |
45 | # error report this to bug-gnulib@gnu.org |
46 | #endif |
47 | |
48 | #include <stddef.h> |
49 | #include <stdlib.h> |
50 | #include <string.h> |
51 | |
52 | #include <fcntl.h> |
53 | #include <sys/time.h> |
54 | #include <stdint.h> |
55 | #include <unistd.h> |
56 | |
57 | #include <sys/stat.h> |
58 | |
59 | #if _LIBC |
60 | # define struct_stat64 struct stat64 |
61 | # define __secure_getenv __libc_secure_getenv |
62 | #else |
63 | # define struct_stat64 struct stat |
64 | # define __gen_tempname gen_tempname |
65 | # define __getpid getpid |
66 | # define __gettimeofday gettimeofday |
67 | # define __mkdir mkdir |
68 | # define __open open |
69 | # define __lxstat64(version, file, buf) lstat (file, buf) |
70 | # define __secure_getenv secure_getenv |
71 | #endif |
72 | |
73 | #ifdef _LIBC |
74 | # include <random-bits.h> |
75 | # define RANDOM_BITS(Var) ((Var) = random_bits ()) |
76 | # else |
77 | # define RANDOM_BITS(Var) \ |
78 | { \ |
79 | struct timeval tv; \ |
80 | __gettimeofday (&tv, NULL); \ |
81 | (Var) = ((uint64_t) tv.tv_usec << 16) ^ tv.tv_sec; \ |
82 | } |
83 | #endif |
84 | |
85 | /* Use the widest available unsigned type if uint64_t is not |
86 | available. The algorithm below extracts a number less than 62**6 |
87 | (approximately 2**35.725) from uint64_t, so ancient hosts where |
88 | uintmax_t is only 32 bits lose about 3.725 bits of randomness, |
89 | which is better than not having mkstemp at all. */ |
90 | #if !defined UINT64_MAX && !defined uint64_t |
91 | # define uint64_t uintmax_t |
92 | #endif |
93 | |
94 | #if _LIBC |
95 | /* Return nonzero if DIR is an existent directory. */ |
96 | static int |
97 | direxists (const char *dir) |
98 | { |
99 | struct_stat64 buf; |
100 | return __xstat64 (_STAT_VER, dir, &buf) == 0 && S_ISDIR (buf.st_mode); |
101 | } |
102 | |
103 | /* Path search algorithm, for tmpnam, tmpfile, etc. If DIR is |
104 | non-null and exists, uses it; otherwise uses the first of $TMPDIR, |
105 | P_tmpdir, /tmp that exists. Copies into TMPL a template suitable |
106 | for use with mk[s]temp. Will fail (-1) if DIR is non-null and |
107 | doesn't exist, none of the searched dirs exists, or there's not |
108 | enough space in TMPL. */ |
109 | int |
110 | __path_search (char *tmpl, size_t tmpl_len, const char *dir, const char *pfx, |
111 | int try_tmpdir) |
112 | { |
113 | const char *d; |
114 | size_t dlen, plen; |
115 | |
116 | if (!pfx || !pfx[0]) |
117 | { |
118 | pfx = "file" ; |
119 | plen = 4; |
120 | } |
121 | else |
122 | { |
123 | plen = strlen (pfx); |
124 | if (plen > 5) |
125 | plen = 5; |
126 | } |
127 | |
128 | if (try_tmpdir) |
129 | { |
130 | d = __secure_getenv ("TMPDIR" ); |
131 | if (d != NULL && direxists (d)) |
132 | dir = d; |
133 | else if (dir != NULL && direxists (dir)) |
134 | /* nothing */ ; |
135 | else |
136 | dir = NULL; |
137 | } |
138 | if (dir == NULL) |
139 | { |
140 | if (direxists (P_tmpdir)) |
141 | dir = P_tmpdir; |
142 | else if (strcmp (P_tmpdir, "/tmp" ) != 0 && direxists ("/tmp" )) |
143 | dir = "/tmp" ; |
144 | else |
145 | { |
146 | __set_errno (ENOENT); |
147 | return -1; |
148 | } |
149 | } |
150 | |
151 | dlen = strlen (dir); |
152 | while (dlen > 1 && dir[dlen - 1] == '/') |
153 | dlen--; /* remove trailing slashes */ |
154 | |
155 | /* check we have room for "${dir}/${pfx}XXXXXX\0" */ |
156 | if (tmpl_len < dlen + 1 + plen + 6 + 1) |
157 | { |
158 | __set_errno (EINVAL); |
159 | return -1; |
160 | } |
161 | |
162 | sprintf (tmpl, "%.*s/%.*sXXXXXX" , (int) dlen, dir, (int) plen, pfx); |
163 | return 0; |
164 | } |
165 | #endif /* _LIBC */ |
166 | |
167 | /* These are the characters used in temporary file names. */ |
168 | static const char letters[] = |
169 | "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789" ; |
170 | |
171 | /* Generate a temporary file name based on TMPL. TMPL must match the |
172 | rules for mk[s]temp (i.e. end in "XXXXXX", possibly with a suffix). |
173 | The name constructed does not exist at the time of the call to |
174 | __gen_tempname. TMPL is overwritten with the result. |
175 | |
176 | KIND may be one of: |
177 | __GT_NOCREATE: simply verify that the name does not exist |
178 | at the time of the call. |
179 | __GT_FILE: create the file using open(O_CREAT|O_EXCL) |
180 | and return a read-write fd. The file is mode 0600. |
181 | __GT_DIR: create a directory, which will be mode 0700. |
182 | |
183 | We use a clever algorithm to get hard-to-predict names. */ |
184 | int |
185 | __gen_tempname (char *tmpl, int suffixlen, int flags, int kind) |
186 | { |
187 | int len; |
188 | char *XXXXXX; |
189 | uint64_t value; |
190 | unsigned int count; |
191 | int fd = -1; |
192 | int save_errno = errno; |
193 | struct_stat64 st; |
194 | |
195 | /* A lower bound on the number of temporary files to attempt to |
196 | generate. The maximum total number of temporary file names that |
197 | can exist for a given template is 62**6. It should never be |
198 | necessary to try all of these combinations. Instead if a reasonable |
199 | number of names is tried (we define reasonable as 62**3) fail to |
200 | give the system administrator the chance to remove the problems. */ |
201 | #define ATTEMPTS_MIN (62 * 62 * 62) |
202 | |
203 | /* The number of times to attempt to generate a temporary file. To |
204 | conform to POSIX, this must be no smaller than TMP_MAX. */ |
205 | #if ATTEMPTS_MIN < TMP_MAX |
206 | unsigned int attempts = TMP_MAX; |
207 | #else |
208 | unsigned int attempts = ATTEMPTS_MIN; |
209 | #endif |
210 | |
211 | len = strlen (tmpl); |
212 | if (len < 6 + suffixlen || memcmp (&tmpl[len - 6 - suffixlen], "XXXXXX" , 6)) |
213 | { |
214 | __set_errno (EINVAL); |
215 | return -1; |
216 | } |
217 | |
218 | /* This is where the Xs start. */ |
219 | XXXXXX = &tmpl[len - 6 - suffixlen]; |
220 | |
221 | /* Get some more or less random data. */ |
222 | RANDOM_BITS (value); |
223 | value ^= (uint64_t)__getpid () << 32; |
224 | |
225 | for (count = 0; count < attempts; value += 7777, ++count) |
226 | { |
227 | uint64_t v = value; |
228 | |
229 | /* Fill in the random bits. */ |
230 | XXXXXX[0] = letters[v % 62]; |
231 | v /= 62; |
232 | XXXXXX[1] = letters[v % 62]; |
233 | v /= 62; |
234 | XXXXXX[2] = letters[v % 62]; |
235 | v /= 62; |
236 | XXXXXX[3] = letters[v % 62]; |
237 | v /= 62; |
238 | XXXXXX[4] = letters[v % 62]; |
239 | v /= 62; |
240 | XXXXXX[5] = letters[v % 62]; |
241 | |
242 | switch (kind) |
243 | { |
244 | case __GT_FILE: |
245 | fd = __open (tmpl, |
246 | (flags & ~O_ACCMODE) |
247 | | O_RDWR | O_CREAT | O_EXCL, S_IRUSR | S_IWUSR); |
248 | break; |
249 | |
250 | case __GT_DIR: |
251 | fd = __mkdir (tmpl, S_IRUSR | S_IWUSR | S_IXUSR); |
252 | break; |
253 | |
254 | case __GT_NOCREATE: |
255 | /* This case is backward from the other three. __gen_tempname |
256 | succeeds if __xstat fails because the name does not exist. |
257 | Note the continue to bypass the common logic at the bottom |
258 | of the loop. */ |
259 | if (__lxstat64 (_STAT_VER, tmpl, &st) < 0) |
260 | { |
261 | if (errno == ENOENT) |
262 | { |
263 | __set_errno (save_errno); |
264 | return 0; |
265 | } |
266 | else |
267 | /* Give up now. */ |
268 | return -1; |
269 | } |
270 | continue; |
271 | |
272 | default: |
273 | assert (! "invalid KIND in __gen_tempname" ); |
274 | abort (); |
275 | } |
276 | |
277 | if (fd >= 0) |
278 | { |
279 | __set_errno (save_errno); |
280 | return fd; |
281 | } |
282 | else if (errno != EEXIST) |
283 | return -1; |
284 | } |
285 | |
286 | /* We got out of the loop because we ran out of combinations to try. */ |
287 | __set_errno (EEXIST); |
288 | return -1; |
289 | } |
290 | |