imrcpan/freebsd
1
0 Fork 0
mirror of https://github.com/freebsd/freebsd-src.git synced 2026-10-28 11:25:21 +01:00
Code Issues Packages Projects Releases Wiki Activity

fts: refactor to use fd-relative operations internally

Browse Source 
Replace all _open() calls with _openat() in __fts_open(), fts_read(),
and fts_children().

Add fts_dirfd to FTSENT. Callers can use
openat(ent->fts_dirfd, ent->fts_name, ...) to access files
safely without relying on fts_accpath, which enables:

1. Capsicum capability mode where path-based operations fail
2. Security-sensitive programs that avoid TOCTOU races

Replace statfs(ent->fts_path) with _fstatfs(ent->fts_dirfd) in
fts_ufslinks() when fts_dirfd is valid, falling back to statfs() for
root-level entries where fts_dirfd is -1

This is a preparatory change for fts_openat() which will allow
callers to provide a pre-opened directory fd, enabling fts(3)
traversal inside Capsicum capability mode.

Sponsored by:	Google LLC (GSoC 2026)
Reviewed by:	asomers, jillest
MFC after:	2 weeks
Pull Request:	https://github.com/freebsd/freebsd-src/pull/2278
This commit is contained in:
Jitendra Bhati authored and Alan Somers committed 2026-06-23 08:53:56 -06:00
1 parent 4c41957002
commit e03ed9daeb
2 files changed
+28 -11
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

include/fts.h
+1
View File
@@ -133,6 +133,7 @@ struct _ftsent {
struct stat *fts_statp; /* stat(2) information */
char *fts_name; /* file name */
FTS *fts_fts; /* back pointer to main FTS */
int fts_dirfd; /* fd for parent directory */
};
#include <sys/cdefs.h>
lib/libc/gen/fts.c
+27 -11
View File
@@ -67,6 +67,7 @@ static FTSENT *fts_build(FTS *, int);
static void fts_lfree(FTSENT *);
static void fts_load(FTS *, FTSENT *);
static size_t fts_maxarglen(char * const *);
static FTS *__fts_open(FTS *, char * const *, int);
static void fts_padjust(FTS *, FTSENT *);
static int fts_palloc(FTS *, size_t);
static FTSENT *fts_sort(FTS *, FTSENT *, size_t);
@@ -129,7 +130,7 @@ static const char *ufslike_filesystems[] = {
default: 0)
static FTS *
__fts_open(FTS *sp, char * const *argv)
__fts_open(FTS *sp, char * const *argv, int rootfd)
{
FTSENT *p, *root;
FTSENT *parent, *tmp;
@@ -212,9 +213,9 @@ __fts_open(FTS *sp, char * const *argv)
* descriptor we run anyway, just more slowly.
*/
if (!ISSET(FTS_NOCHDIR) &&
(sp->fts_rfd = _open(".", O_RDONLY | O_CLOEXEC, 0)) < 0)
(sp->fts_rfd = _openat(rootfd, ".", O_RDONLY |
O_CLOEXEC, 0)) < 0)
SET(FTS_NOCHDIR);
return (sp);
mem3: fts_lfree(root);
@@ -250,7 +251,7 @@ fts_open(char * const *argv, int options,
sp->fts_compar = compar;
sp->fts_options = options;
return (__fts_open(sp, argv));
return (__fts_open(sp, argv, AT_FDCWD));
}
#ifdef __BLOCKS__
@@ -304,7 +305,7 @@ fts_open_b(char * const *argv, int options, fts_block compar)
sp->fts_compar_b = compar;
sp->fts_options = options | FTS_COMPAR_B;
if ((sp = __fts_open(sp, argv)) == NULL) {
if ((sp = __fts_open(sp, argv, AT_FDCWD)) == NULL) {
#ifdef __BLOCKS__
Block_release(compar);
#else
@@ -356,6 +357,8 @@ fts_close(FTS *sp)
p = p->fts_link != NULL ? p->fts_link : p->fts_parent;
free(freep);
}
if (p->fts_dirfd >= 0)
(void)_close(p->fts_dirfd);
free(p);
}
@@ -439,8 +442,9 @@ fts_read(FTS *sp)
(p->fts_info == FTS_SL || p->fts_info == FTS_SLNONE)) {
p->fts_info = fts_stat(sp, p, 1, -1);
if (p->fts_info == FTS_D && !ISSET(FTS_NOCHDIR)) {
if ((p->fts_symfd = _open(".", O_RDONLY | O_CLOEXEC,
0)) < 0) {
if ((p->fts_symfd = p->fts_dirfd >= 0 ?
_dup(p->fts_dirfd) : _openat(AT_FDCWD, ".",
O_RDONLY | O_CLOEXEC, 0)) < 0) {
p->fts_errno = errno;
p->fts_info = FTS_ERR;
} else
@@ -484,7 +488,7 @@ fts_read(FTS *sp)
* FTS_STOP or the fts_info field of the node.
*/
if (sp->fts_child != NULL) {
if (fts_safe_changedir(sp, p, -1, p->fts_accpath)) {
if (fts_safe_changedir(sp, p, p->fts_dirfd, p->fts_name)) {
p->fts_errno = errno;
p->fts_flags |= FTS_DONTCHDIR;
for (p = sp->fts_child; p != NULL;
@@ -532,7 +536,9 @@ next: tmp = p;
p->fts_info = fts_stat(sp, p, 1, -1);
if (p->fts_info == FTS_D && !ISSET(FTS_NOCHDIR)) {
if ((p->fts_symfd =
_open(".", O_RDONLY | O_CLOEXEC, 0)) < 0) {
p->fts_dirfd >= 0 ?
_dup(p->fts_dirfd) : _openat(AT_FDCWD, ".",
O_RDONLY | O_CLOEXEC, 0)) < 0) {
p->fts_errno = errno;
p->fts_info = FTS_ERR;
} else
@@ -558,6 +564,8 @@ name: t = sp->fts_path + NAPPEND(p->fts_parent);
* can distinguish between error and EOF.
*/
free(tmp);
if (p->fts_dirfd >= 0)
(void)_close(p->fts_dirfd);
free(p);
errno = 0;
return (sp->fts_cur = NULL);
@@ -671,7 +679,9 @@ fts_children(FTS *sp, int instr)
ISSET(FTS_NOCHDIR))
return (sp->fts_child = fts_build(sp, instr));
if ((fd = _open(".", O_RDONLY | O_CLOEXEC, 0)) < 0)
if ((fd = sp->fts_cur->fts_dirfd >= 0 ?
_dup(sp->fts_cur->fts_dirfd) : _openat(AT_FDCWD, ".",
O_RDONLY | O_CLOEXEC, 0)) < 0)
return (NULL);
sp->fts_child = fts_build(sp, instr);
serrno = (sp->fts_child == NULL) ? errno : 0;
@@ -907,6 +917,7 @@ mem1: saved_errno = errno;
}
p->fts_level = level;
p->fts_dirfd = _dup(_dirfd(dirp));
p->fts_parent = sp->fts_cur;
p->fts_pathlen = len + dnamlen;
@@ -1185,6 +1196,7 @@ fts_alloc(FTS *sp, char *name, size_t namelen)
return (NULL);
p->fts_symfd = -1;
p->fts_dirfd = -1;
p->fts_path = sp->fts_path;
p->fts_name = (char *)(p + 1);
p->fts_namelen = namelen;
@@ -1205,6 +1217,8 @@ fts_lfree(FTSENT *head)
/* Free a linked list of structures. */
while ((p = head)) {
head = head->fts_link;
if (p->fts_dirfd >= 0)
(void)_close(p->fts_dirfd);
free(p);
}
}
@@ -1322,7 +1336,9 @@ fts_ufslinks(FTS *sp, const FTSENT *ent)
* avoidance.
*/
if (priv->ftsp_dev != ent->fts_dev) {
if (statfs(ent->fts_path, &priv->ftsp_statfs) != -1) {
if ((ent->fts_dirfd >= 0 ?
_fstatfs(ent->fts_dirfd, &priv->ftsp_statfs) :
statfs(ent->fts_path, &priv->ftsp_statfs)) != -1) {
priv->ftsp_dev = ent->fts_dev;
priv->ftsp_linksreliable = 0;
for (cpp = ufslike_filesystems; *cpp; cpp++) {