OpenSolaris_b135/cmd/sendmail/libsmutil/safefile.c
/*
* Copyright (c) 1998-2004 Sendmail, Inc. and its suppliers.
* All rights reserved.
* Copyright (c) 1983, 1995-1997 Eric P. Allman. All rights reserved.
* Copyright (c) 1988, 1993
* The Regents of the University of California. All rights reserved.
*
* By using this file, you agree to the terms and conditions set
* forth in the LICENSE file which can be found at the top level of
* the sendmail distribution.
*
*/
#include <sendmail.h>
#include <sm/io.h>
#include <sm/errstring.h>
SM_RCSID("@(#)$Id: safefile.c,v 8.129 2008/08/04 18:07:04 gshapiro Exp $")
/*
** SAFEFILE -- return 0 if a file exists and is safe for a user.
**
** Parameters:
** fn -- filename to check.
** uid -- user id to compare against.
** gid -- group id to compare against.
** user -- user name to compare against (used for group
** sets).
** flags -- modifiers:
** SFF_MUSTOWN -- "uid" must own this file.
** SFF_NOSLINK -- file cannot be a symbolic link.
** mode -- mode bits that must match.
** st -- if set, points to a stat structure that will
** get the stat info for the file.
**
** Returns:
** 0 if fn exists, is owned by uid, and matches mode.
** An errno otherwise. The actual errno is cleared.
**
** Side Effects:
** none.
*/
int
safefile(fn, uid, gid, user, flags, mode, st)
char *fn;
UID_T uid;
GID_T gid;
char *user;
long flags;
int mode;
struct stat *st;
{
register char *p;
register struct group *gr = NULL;
int file_errno = 0;
bool checkpath;
struct stat stbuf;
struct stat fstbuf;
char fbuf[MAXPATHLEN];
if (tTd(44, 4))
sm_dprintf("safefile(%s, uid=%d, gid=%d, flags=%lx, mode=%o):\n",
fn, (int) uid, (int) gid, flags, mode);
errno = 0;
if (sm_strlcpy(fbuf, fn, sizeof fbuf) >= sizeof fbuf)
{
if (tTd(44, 4))
sm_dprintf("\tpathname too long\n");
return ENAMETOOLONG;
}
fn = fbuf;
if (st == NULL)
st = &fstbuf;
/* ignore SFF_SAFEDIRPATH if we are debugging */
if (RealUid != 0 && RunAsUid == RealUid)
flags &= ~SFF_SAFEDIRPATH;
/* first check to see if the file exists at all */
# if HASLSTAT
if ((bitset(SFF_NOSLINK, flags) ? lstat(fn, st)
: stat(fn, st)) < 0)
# else /* HASLSTAT */
if (stat(fn, st) < 0)
# endif /* HASLSTAT */
{
file_errno = errno;
}
else if (bitset(SFF_SETUIDOK, flags) &&
!bitset(S_IXUSR|S_IXGRP|S_IXOTH, st->st_mode) &&
S_ISREG(st->st_mode))
{
/*
** If final file is set-user-ID, run as the owner of that
** file. Gotta be careful not to reveal anything too
** soon here!
*/
# ifdef SUID_ROOT_FILES_OK
if (bitset(S_ISUID, st->st_mode))
# else /* SUID_ROOT_FILES_OK */
if (bitset(S_ISUID, st->st_mode) && st->st_uid != 0 &&
st->st_uid != TrustedUid)
# endif /* SUID_ROOT_FILES_OK */
{
uid = st->st_uid;
user = NULL;
}
# ifdef SUID_ROOT_FILES_OK
if (bitset(S_ISGID, st->st_mode))
# else /* SUID_ROOT_FILES_OK */
if (bitset(S_ISGID, st->st_mode) && st->st_gid != 0)
# endif /* SUID_ROOT_FILES_OK */
gid = st->st_gid;
}
checkpath = !bitset(SFF_NOPATHCHECK, flags) ||
(uid == 0 && !bitset(SFF_ROOTOK|SFF_OPENASROOT, flags));
if (bitset(SFF_NOWLINK, flags) && !bitset(SFF_SAFEDIRPATH, flags))
{
int ret;
/* check the directory */
p = strrchr(fn, '/');
if (p == NULL)
{
ret = safedirpath(".", uid, gid, user,
flags|SFF_SAFEDIRPATH, 0, 0);
}
else
{
*p = '\0';
ret = safedirpath(fn, uid, gid, user,
flags|SFF_SAFEDIRPATH, 0, 0);
*p = '/';
}
if (ret == 0)
{
/* directory is safe */
checkpath = false;
}
else
{
# if HASLSTAT
/* Need lstat() information if called stat() before */
if (!bitset(SFF_NOSLINK, flags) && lstat(fn, st) < 0)
{
ret = errno;
if (tTd(44, 4))
sm_dprintf("\t%s\n", sm_errstring(ret));
return ret;
}
# endif /* HASLSTAT */
/* directory is writable: disallow links */
flags |= SFF_NOLINK;
}
}
if (checkpath)
{
int ret;
p = strrchr(fn, '/');
if (p == NULL)
{
ret = safedirpath(".", uid, gid, user, flags, 0, 0);
}
else
{
*p = '\0';
ret = safedirpath(fn, uid, gid, user, flags, 0, 0);
*p = '/';
}
if (ret != 0)
return ret;
}
/*
** If the target file doesn't exist, check the directory to
** ensure that it is writable by this user.
*/
if (file_errno != 0)
{
int ret = file_errno;
char *dir = fn;
if (tTd(44, 4))
sm_dprintf("\t%s\n", sm_errstring(ret));
errno = 0;
if (!bitset(SFF_CREAT, flags) || file_errno != ENOENT)
return ret;
/* check to see if legal to create the file */
p = strrchr(dir, '/');
if (p == NULL)
dir = ".";
else if (p == dir)
dir = "/";
else
*p = '\0';
if (stat(dir, &stbuf) >= 0)
{
int md = S_IWRITE|S_IEXEC;
ret = 0;
if (stbuf.st_uid == uid)
/* EMPTY */
;
else if (uid == 0 && stbuf.st_uid == TrustedUid)
/* EMPTY */
;
else
{
md >>= 3;
if (stbuf.st_gid == gid)
/* EMPTY */
;
# ifndef NO_GROUP_SET
else if (user != NULL && !DontInitGroups &&
((gr != NULL &&
gr->gr_gid == stbuf.st_gid) ||
(gr = getgrgid(stbuf.st_gid)) != NULL))
{
register char **gp;
for (gp = gr->gr_mem; *gp != NULL; gp++)
if (strcmp(*gp, user) == 0)
break;
if (*gp == NULL)
md >>= 3;
}
# endif /* ! NO_GROUP_SET */
else
md >>= 3;
}
if ((stbuf.st_mode & md) != md)
ret = errno = EACCES;
}
else
ret = errno;
if (tTd(44, 4))
sm_dprintf("\t[final dir %s uid %d mode %lo] %s\n",
dir, (int) stbuf.st_uid,
(unsigned long) stbuf.st_mode,
sm_errstring(ret));
if (p != NULL)
*p = '/';
st->st_mode = ST_MODE_NOFILE;
return ret;
}
# ifdef S_ISLNK
if (bitset(SFF_NOSLINK, flags) && S_ISLNK(st->st_mode))
{
if (tTd(44, 4))
sm_dprintf("\t[slink mode %lo]\tE_SM_NOSLINK\n",
(unsigned long) st->st_mode);
return E_SM_NOSLINK;
}
# endif /* S_ISLNK */
if (bitset(SFF_REGONLY, flags) && !S_ISREG(st->st_mode))
{
if (tTd(44, 4))
sm_dprintf("\t[non-reg mode %lo]\tE_SM_REGONLY\n",
(unsigned long) st->st_mode);
return E_SM_REGONLY;
}
if (bitset(SFF_NOGWFILES, flags) &&
bitset(S_IWGRP, st->st_mode))
{
if (tTd(44, 4))
sm_dprintf("\t[write bits %lo]\tE_SM_GWFILE\n",
(unsigned long) st->st_mode);
return E_SM_GWFILE;
}
if (bitset(SFF_NOWWFILES, flags) &&
bitset(S_IWOTH, st->st_mode))
{
if (tTd(44, 4))
sm_dprintf("\t[write bits %lo]\tE_SM_WWFILE\n",
(unsigned long) st->st_mode);
return E_SM_WWFILE;
}
if (bitset(SFF_NOGRFILES, flags) && bitset(S_IRGRP, st->st_mode))
{
if (tTd(44, 4))
sm_dprintf("\t[read bits %lo]\tE_SM_GRFILE\n",
(unsigned long) st->st_mode);
return E_SM_GRFILE;
}
if (bitset(SFF_NOWRFILES, flags) && bitset(S_IROTH, st->st_mode))
{
if (tTd(44, 4))
sm_dprintf("\t[read bits %lo]\tE_SM_WRFILE\n",
(unsigned long) st->st_mode);
return E_SM_WRFILE;
}
if (!bitset(SFF_EXECOK, flags) &&
bitset(S_IWUSR|S_IWGRP|S_IWOTH, mode) &&
bitset(S_IXUSR|S_IXGRP|S_IXOTH, st->st_mode))
{
if (tTd(44, 4))
sm_dprintf("\t[exec bits %lo]\tE_SM_ISEXEC\n",
(unsigned long) st->st_mode);
return E_SM_ISEXEC;
}
if (bitset(SFF_NOHLINK, flags) && st->st_nlink != 1)
{
if (tTd(44, 4))
sm_dprintf("\t[link count %d]\tE_SM_NOHLINK\n",
(int) st->st_nlink);
return E_SM_NOHLINK;
}
if (uid == 0 && bitset(SFF_OPENASROOT, flags))
/* EMPTY */
;
else if (uid == 0 && !bitset(SFF_ROOTOK, flags))
mode >>= 6;
else if (st->st_uid == uid)
/* EMPTY */
;
else if (uid == 0 && st->st_uid == TrustedUid)
/* EMPTY */
;
else
{
mode >>= 3;
if (st->st_gid == gid)
/* EMPTY */
;
# ifndef NO_GROUP_SET
else if (user != NULL && !DontInitGroups &&
((gr != NULL && gr->gr_gid == st->st_gid) ||
(gr = getgrgid(st->st_gid)) != NULL))
{
register char **gp;
for (gp = gr->gr_mem; *gp != NULL; gp++)
if (strcmp(*gp, user) == 0)
break;
if (*gp == NULL)
mode >>= 3;
}
# endif /* ! NO_GROUP_SET */
else
mode >>= 3;
}
if (tTd(44, 4))
sm_dprintf("\t[uid %d, nlink %d, stat %lo, mode %lo] ",
(int) st->st_uid, (int) st->st_nlink,
(unsigned long) st->st_mode, (unsigned long) mode);
if ((st->st_uid == uid || st->st_uid == 0 ||
st->st_uid == TrustedUid ||
!bitset(SFF_MUSTOWN, flags)) &&
(st->st_mode & mode) == mode)
{
if (tTd(44, 4))
sm_dprintf("\tOK\n");
return 0;
}
if (tTd(44, 4))
sm_dprintf("\tEACCES\n");
return EACCES;
}
/*
** SAFEDIRPATH -- check to make sure a path to a directory is safe
**
** Safe means not writable and owned by the right folks.
**
** Parameters:
** fn -- filename to check.
** uid -- user id to compare against.
** gid -- group id to compare against.
** user -- user name to compare against (used for group
** sets).
** flags -- modifiers:
** SFF_ROOTOK -- ok to use root permissions to open.
** SFF_SAFEDIRPATH -- writable directories are considered
** to be fatal errors.
** level -- symlink recursive level.
** offset -- offset into fn to start checking from.
**
** Returns:
** 0 -- if the directory path is "safe".
** else -- an error number associated with the path.
*/
int
safedirpath(fn, uid, gid, user, flags, level, offset)
char *fn;
UID_T uid;
GID_T gid;
char *user;
long flags;
int level;
int offset;
{
int ret = 0;
int mode = S_IWOTH;
char save = '\0';
char *saveptr = NULL;
char *p, *enddir;
register struct group *gr = NULL;
char s[MAXLINKPATHLEN];
struct stat stbuf;
/* make sure we aren't in a symlink loop */
if (level > MAXSYMLINKS)
return ELOOP;
if (level < 0 || offset < 0 || offset > strlen(fn))
return EINVAL;
/* special case root directory */
if (*fn == '\0')
fn = "/";
if (tTd(44, 4))
sm_dprintf("safedirpath(%s, uid=%ld, gid=%ld, flags=%lx, level=%d, offset=%d):\n",
fn, (long) uid, (long) gid, flags, level, offset);
if (!bitnset(DBS_GROUPWRITABLEDIRPATHSAFE, DontBlameSendmail))
mode |= S_IWGRP;
/* Make a modifiable copy of the filename */
if (sm_strlcpy(s, fn, sizeof s) >= sizeof s)
return EINVAL;
p = s + offset;
while (p != NULL)
{
/* put back character */
if (saveptr != NULL)
{
*saveptr = save;
saveptr = NULL;
p++;
}
if (*p == '\0')
break;
p = strchr(p, '/');
/* Special case for root directory */
if (p == s)
{
save = *(p + 1);
saveptr = p + 1;
*(p + 1) = '\0';
}
else if (p != NULL)
{
save = *p;
saveptr = p;
*p = '\0';
}
/* Heuristic: . and .. have already been checked */
enddir = strrchr(s, '/');
if (enddir != NULL &&
(strcmp(enddir, "/..") == 0 ||
strcmp(enddir, "/.") == 0))
continue;
if (tTd(44, 20))
sm_dprintf("\t[dir %s]\n", s);
# if HASLSTAT
ret = lstat(s, &stbuf);
# else /* HASLSTAT */
ret = stat(s, &stbuf);
# endif /* HASLSTAT */
if (ret < 0)
{
ret = errno;
break;
}
# ifdef S_ISLNK
/* Follow symlinks */
if (S_ISLNK(stbuf.st_mode))
{
int linklen;
char *target;
char buf[MAXPATHLEN];
char fullbuf[MAXLINKPATHLEN];
memset(buf, '\0', sizeof buf);
linklen = readlink(s, buf, sizeof buf);
if (linklen < 0)
{
ret = errno;
break;
}
if (linklen >= sizeof buf)
{
/* file name too long for buffer */
ret = errno = EINVAL;
break;
}
offset = 0;
if (*buf == '/')
{
target = buf;
/* If path is the same, avoid rechecks */
while (s[offset] == buf[offset] &&
s[offset] != '\0')
offset++;
if (s[offset] == '\0' && buf[offset] == '\0')
{
/* strings match, symlink loop */
return ELOOP;
}
/* back off from the mismatch */
if (offset > 0)
offset--;
/* Make sure we are at a directory break */
if (offset > 0 &&
s[offset] != '/' &&
s[offset] != '\0')
{
while (buf[offset] != '/' &&
offset > 0)
offset--;
}
if (offset > 0 &&
s[offset] == '/' &&
buf[offset] == '/')
{
/* Include the trailing slash */
offset++;
}
}
else
{
char *sptr;
sptr = strrchr(s, '/');
if (sptr != NULL)
{
*sptr = '\0';
offset = sptr + 1 - s;
if (sm_strlcpyn(fullbuf,
sizeof fullbuf, 2,
s, "/") >=
sizeof fullbuf ||
sm_strlcat(fullbuf, buf,
sizeof fullbuf) >=
sizeof fullbuf)
{
ret = EINVAL;
break;
}
*sptr = '/';
}
else
{
if (sm_strlcpy(fullbuf, buf,
sizeof fullbuf) >=
sizeof fullbuf)
{
ret = EINVAL;
break;
}
}
target = fullbuf;
}
ret = safedirpath(target, uid, gid, user, flags,
level + 1, offset);
if (ret != 0)
break;
/* Don't check permissions on the link file itself */
continue;
}
#endif /* S_ISLNK */
if ((uid == 0 || bitset(SFF_SAFEDIRPATH, flags)) &&
#ifdef S_ISVTX
!(bitnset(DBS_TRUSTSTICKYBIT, DontBlameSendmail) &&
bitset(S_ISVTX, stbuf.st_mode)) &&
#endif /* S_ISVTX */
bitset(mode, stbuf.st_mode))
{
if (tTd(44, 4))
sm_dprintf("\t[dir %s] mode %lo ",
s, (unsigned long) stbuf.st_mode);
if (bitset(SFF_SAFEDIRPATH, flags))
{
if (bitset(S_IWOTH, stbuf.st_mode))
ret = E_SM_WWDIR;
else
ret = E_SM_GWDIR;
if (tTd(44, 4))
sm_dprintf("FATAL\n");
break;
}
if (tTd(44, 4))
sm_dprintf("WARNING\n");
if (Verbose > 1)
message("051 WARNING: %s writable directory %s",
bitset(S_IWOTH, stbuf.st_mode)
? "World"
: "Group",
s);
}
if (uid == 0 && !bitset(SFF_ROOTOK|SFF_OPENASROOT, flags))
{
if (bitset(S_IXOTH, stbuf.st_mode))
continue;
ret = EACCES;
break;
}
/*
** Let OS determine access to file if we are not
** running as a privileged user. This allows ACLs
** to work. Also, if opening as root, assume we can
** scan the directory.
*/
if (geteuid() != 0 || bitset(SFF_OPENASROOT, flags))
continue;
if (stbuf.st_uid == uid &&
bitset(S_IXUSR, stbuf.st_mode))
continue;
if (stbuf.st_gid == gid &&
bitset(S_IXGRP, stbuf.st_mode))
continue;
# ifndef NO_GROUP_SET
if (user != NULL && !DontInitGroups &&
((gr != NULL && gr->gr_gid == stbuf.st_gid) ||
(gr = getgrgid(stbuf.st_gid)) != NULL))
{
register char **gp;
for (gp = gr->gr_mem; gp != NULL && *gp != NULL; gp++)
if (strcmp(*gp, user) == 0)
break;
if (gp != NULL && *gp != NULL &&
bitset(S_IXGRP, stbuf.st_mode))
continue;
}
# endif /* ! NO_GROUP_SET */
if (!bitset(S_IXOTH, stbuf.st_mode))
{
ret = EACCES;
break;
}
}
if (tTd(44, 4))
sm_dprintf("\t[dir %s] %s\n", fn,
ret == 0 ? "OK" : sm_errstring(ret));
return ret;
}
/*
** SAFEOPEN -- do a file open with extra checking
**
** Parameters:
** fn -- the file name to open.
** omode -- the open-style mode flags.
** cmode -- the create-style mode flags.
** sff -- safefile flags.
**
** Returns:
** Same as open.
*/
int
safeopen(fn, omode, cmode, sff)
char *fn;
int omode;
int cmode;
long sff;
{
#if !NOFTRUNCATE
bool truncate;
#endif /* !NOFTRUNCATE */
int rval;
int fd;
int smode;
struct stat stb;
if (tTd(44, 10))
sm_dprintf("safeopen: fn=%s, omode=%x, cmode=%x, sff=%lx\n",
fn, omode, cmode, sff);
if (bitset(O_CREAT, omode))
sff |= SFF_CREAT;
omode &= ~O_CREAT;
switch (omode & O_ACCMODE)
{
case O_RDONLY:
smode = S_IREAD;
break;
case O_WRONLY:
smode = S_IWRITE;
break;
case O_RDWR:
smode = S_IREAD|S_IWRITE;
break;
default:
smode = 0;
break;
}
if (bitset(SFF_OPENASROOT, sff))
rval = safefile(fn, RunAsUid, RunAsGid, RunAsUserName,
sff, smode, &stb);
else
rval = safefile(fn, RealUid, RealGid, RealUserName,
sff, smode, &stb);
if (rval != 0)
{
errno = rval;
return -1;
}
if (stb.st_mode == ST_MODE_NOFILE && bitset(SFF_CREAT, sff))
omode |= O_CREAT | (bitset(SFF_NOTEXCL, sff) ? 0 : O_EXCL);
else if (bitset(SFF_CREAT, sff) && bitset(O_EXCL, omode))
{
/* The file exists so an exclusive create would fail */
errno = EEXIST;
return -1;
}
#if !NOFTRUNCATE
truncate = bitset(O_TRUNC, omode);
if (truncate)
omode &= ~O_TRUNC;
#endif /* !NOFTRUNCATE */
fd = dfopen(fn, omode, cmode, sff);
if (fd < 0)
return fd;
if (filechanged(fn, fd, &stb))
{
syserr("554 5.3.0 cannot open: file %s changed after open", fn);
(void) close(fd);
errno = E_SM_FILECHANGE;
return -1;
}
#if !NOFTRUNCATE
if (truncate &&
ftruncate(fd, (off_t) 0) < 0)
{
int save_errno;
save_errno = errno;
syserr("554 5.3.0 cannot open: file %s could not be truncated",
fn);
(void) close(fd);
errno = save_errno;
return -1;
}
#endif /* !NOFTRUNCATE */
return fd;
}
/*
** SAFEFOPEN -- do a file open with extra checking
**
** Parameters:
** fn -- the file name to open.
** omode -- the open-style mode flags.
** cmode -- the create-style mode flags.
** sff -- safefile flags.
**
** Returns:
** Same as fopen.
*/
SM_FILE_T *
safefopen(fn, omode, cmode, sff)
char *fn;
int omode;
int cmode;
long sff;
{
int fd;
int save_errno;
SM_FILE_T *fp;
int fmode;
switch (omode & O_ACCMODE)
{
case O_RDONLY:
fmode = SM_IO_RDONLY;
break;
case O_WRONLY:
if (bitset(O_APPEND, omode))
fmode = SM_IO_APPEND;
else
fmode = SM_IO_WRONLY;
break;
case O_RDWR:
if (bitset(O_TRUNC, omode))
fmode = SM_IO_RDWRTR;
else if (bitset(O_APPEND, omode))
fmode = SM_IO_APPENDRW;
else
fmode = SM_IO_RDWR;
break;
default:
syserr("554 5.3.5 safefopen: unknown omode %o", omode);
fmode = 0;
}
fd = safeopen(fn, omode, cmode, sff);
if (fd < 0)
{
save_errno = errno;
if (tTd(44, 10))
sm_dprintf("safefopen: safeopen failed: %s\n",
sm_errstring(errno));
errno = save_errno;
return NULL;
}
fp = sm_io_open(SmFtStdiofd, SM_TIME_DEFAULT,
(void *) &fd, fmode, NULL);
if (fp != NULL)
return fp;
save_errno = errno;
if (tTd(44, 10))
{
sm_dprintf("safefopen: fdopen(%s, %d) failed: omode=%x, sff=%lx, err=%s\n",
fn, fmode, omode, sff, sm_errstring(errno));
}
(void) close(fd);
errno = save_errno;
return NULL;
}
/*
** FILECHANGED -- check to see if file changed after being opened
**
** Parameters:
** fn -- pathname of file to check.
** fd -- file descriptor to check.
** stb -- stat structure from before open.
**
** Returns:
** true -- if a problem was detected.
** false -- if this file is still the same.
*/
bool
filechanged(fn, fd, stb)
char *fn;
int fd;
struct stat *stb;
{
struct stat sta;
if (stb->st_mode == ST_MODE_NOFILE)
{
# if HASLSTAT && BOGUS_O_EXCL
/* only necessary if exclusive open follows symbolic links */
if (lstat(fn, stb) < 0 || stb->st_nlink != 1)
return true;
# else /* HASLSTAT && BOGUS_O_EXCL */
return false;
# endif /* HASLSTAT && BOGUS_O_EXCL */
}
if (fstat(fd, &sta) < 0)
return true;
if (sta.st_nlink != stb->st_nlink ||
sta.st_dev != stb->st_dev ||
sta.st_ino != stb->st_ino ||
# if HAS_ST_GEN && 0 /* AFS returns garbage in st_gen */
sta.st_gen != stb->st_gen ||
# endif /* HAS_ST_GEN && 0 */
sta.st_uid != stb->st_uid ||
sta.st_gid != stb->st_gid)
{
if (tTd(44, 8))
{
sm_dprintf("File changed after opening:\n");
sm_dprintf(" nlink = %ld/%ld\n",
(long) stb->st_nlink, (long) sta.st_nlink);
sm_dprintf(" dev = %ld/%ld\n",
(long) stb->st_dev, (long) sta.st_dev);
sm_dprintf(" ino = %llu/%llu\n",
(ULONGLONG_T) stb->st_ino,
(ULONGLONG_T) sta.st_ino);
# if HAS_ST_GEN
sm_dprintf(" gen = %ld/%ld\n",
(long) stb->st_gen, (long) sta.st_gen);
# endif /* HAS_ST_GEN */
sm_dprintf(" uid = %ld/%ld\n",
(long) stb->st_uid, (long) sta.st_uid);
sm_dprintf(" gid = %ld/%ld\n",
(long) stb->st_gid, (long) sta.st_gid);
}
return true;
}
return false;
}
/*
** DFOPEN -- determined file open
**
** This routine has the semantics of open, except that it will
** keep trying a few times to make this happen. The idea is that
** on very loaded systems, we may run out of resources (inodes,
** whatever), so this tries to get around it.
*/
int
dfopen(filename, omode, cmode, sff)
char *filename;
int omode;
int cmode;
long sff;
{
register int tries;
int fd = -1;
struct stat st;
for (tries = 0; tries < 10; tries++)
{
(void) sleep((unsigned) (10 * tries));
errno = 0;
fd = open(filename, omode, cmode);
if (fd >= 0)
break;
switch (errno)
{
case ENFILE: /* system file table full */
case EINTR: /* interrupted syscall */
#ifdef ETXTBSY
case ETXTBSY: /* Apollo: net file locked */
#endif /* ETXTBSY */
continue;
}
break;
}
if (!bitset(SFF_NOLOCK, sff) &&
fd >= 0 &&
fstat(fd, &st) >= 0 &&
S_ISREG(st.st_mode))
{
int locktype;
/* lock the file to avoid accidental conflicts */
if ((omode & O_ACCMODE) != O_RDONLY)
locktype = LOCK_EX;
else
locktype = LOCK_SH;
if (bitset(SFF_NBLOCK, sff))
locktype |= LOCK_NB;
if (!lockfile(fd, filename, NULL, locktype))
{
int save_errno = errno;
(void) close(fd);
fd = -1;
errno = save_errno;
}
else
errno = 0;
}
return fd;
}