tempfile.con commit mingw: ensure temporary file handles are not inherited by child processes (05d1ed6)
   1/*
   2 * State diagram and cleanup
   3 * -------------------------
   4 *
   5 * If the program exits while a temporary file is active, we want to
   6 * make sure that we remove it. This is done by remembering the active
   7 * temporary files in a linked list, `tempfile_list`. An `atexit(3)`
   8 * handler and a signal handler are registered, to clean up any active
   9 * temporary files.
  10 *
  11 * Because the signal handler can run at any time, `tempfile_list` and
  12 * the `tempfile` objects that comprise it must be kept in
  13 * self-consistent states at all times.
  14 *
  15 * The possible states of a `tempfile` object are as follows:
  16 *
  17 * - Uninitialized. In this state the object's `on_list` field must be
  18 *   zero but the rest of its contents need not be initialized. As
  19 *   soon as the object is used in any way, it is irrevocably
  20 *   registered in `tempfile_list`, and `on_list` is set.
  21 *
  22 * - Active, file open (after `create_tempfile()` or
  23 *   `reopen_tempfile()`). In this state:
  24 *
  25 *   - the temporary file exists
  26 *   - `active` is set
  27 *   - `filename` holds the filename of the temporary file
  28 *   - `fd` holds a file descriptor open for writing to it
  29 *   - `fp` holds a pointer to an open `FILE` object if and only if
  30 *     `fdopen_tempfile()` has been called on the object
  31 *   - `owner` holds the PID of the process that created the file
  32 *
  33 * - Active, file closed (after successful `close_tempfile()`). Same
  34 *   as the previous state, except that the temporary file is closed,
  35 *   `fd` is -1, and `fp` is `NULL`.
  36 *
  37 * - Inactive (after `delete_tempfile()`, `rename_tempfile()`, a
  38 *   failed attempt to create a temporary file, or a failed
  39 *   `close_tempfile()`). In this state:
  40 *
  41 *   - `active` is unset
  42 *   - `filename` is empty (usually, though there are transitory
  43 *     states in which this condition doesn't hold). Client code should
  44 *     *not* rely on the filename being empty in this state.
  45 *   - `fd` is -1 and `fp` is `NULL`
  46 *   - the object is left registered in the `tempfile_list`, and
  47 *     `on_list` is set.
  48 *
  49 * A temporary file is owned by the process that created it. The
  50 * `tempfile` has an `owner` field that records the owner's PID. This
  51 * field is used to prevent a forked process from deleting a temporary
  52 * file created by its parent.
  53 */
  54
  55#include "cache.h"
  56#include "tempfile.h"
  57#include "sigchain.h"
  58
  59static struct tempfile *volatile tempfile_list;
  60
  61static void remove_tempfiles(int skip_fclose)
  62{
  63        pid_t me = getpid();
  64
  65        while (tempfile_list) {
  66                if (tempfile_list->owner == me) {
  67                        /* fclose() is not safe to call in a signal handler */
  68                        if (skip_fclose)
  69                                tempfile_list->fp = NULL;
  70                        delete_tempfile(tempfile_list);
  71                }
  72                tempfile_list = tempfile_list->next;
  73        }
  74}
  75
  76static void remove_tempfiles_on_exit(void)
  77{
  78        remove_tempfiles(0);
  79}
  80
  81static void remove_tempfiles_on_signal(int signo)
  82{
  83        remove_tempfiles(1);
  84        sigchain_pop(signo);
  85        raise(signo);
  86}
  87
  88/*
  89 * Initialize *tempfile if necessary and add it to tempfile_list.
  90 */
  91static void prepare_tempfile_object(struct tempfile *tempfile)
  92{
  93        if (!tempfile_list) {
  94                /* One-time initialization */
  95                sigchain_push_common(remove_tempfiles_on_signal);
  96                atexit(remove_tempfiles_on_exit);
  97        }
  98
  99        if (tempfile->active)
 100                die("BUG: prepare_tempfile_object called for active object");
 101        if (!tempfile->on_list) {
 102                /* Initialize *tempfile and add it to tempfile_list: */
 103                tempfile->fd = -1;
 104                tempfile->fp = NULL;
 105                tempfile->active = 0;
 106                tempfile->owner = 0;
 107                strbuf_init(&tempfile->filename, 0);
 108                tempfile->next = tempfile_list;
 109                tempfile_list = tempfile;
 110                tempfile->on_list = 1;
 111        } else if (tempfile->filename.len) {
 112                /* This shouldn't happen, but better safe than sorry. */
 113                die("BUG: prepare_tempfile_object called for improperly-reset object");
 114        }
 115}
 116
 117/* Make sure errno contains a meaningful value on error */
 118int create_tempfile(struct tempfile *tempfile, const char *path)
 119{
 120        prepare_tempfile_object(tempfile);
 121
 122        strbuf_add_absolute_path(&tempfile->filename, path);
 123        tempfile->fd = open(tempfile->filename.buf,
 124                            O_RDWR | O_CREAT | O_EXCL | O_CLOEXEC, 0666);
 125        if (O_CLOEXEC && tempfile->fd < 0 && errno == EINVAL)
 126                /* Try again w/o O_CLOEXEC: the kernel might not support it */
 127                tempfile->fd = open(tempfile->filename.buf,
 128                                    O_RDWR | O_CREAT | O_EXCL, 0666);
 129        if (tempfile->fd < 0) {
 130                strbuf_reset(&tempfile->filename);
 131                return -1;
 132        }
 133        tempfile->owner = getpid();
 134        tempfile->active = 1;
 135        if (adjust_shared_perm(tempfile->filename.buf)) {
 136                int save_errno = errno;
 137                error("cannot fix permission bits on %s", tempfile->filename.buf);
 138                delete_tempfile(tempfile);
 139                errno = save_errno;
 140                return -1;
 141        }
 142        return tempfile->fd;
 143}
 144
 145void register_tempfile(struct tempfile *tempfile, const char *path)
 146{
 147        prepare_tempfile_object(tempfile);
 148        strbuf_add_absolute_path(&tempfile->filename, path);
 149        tempfile->owner = getpid();
 150        tempfile->active = 1;
 151}
 152
 153int mks_tempfile_sm(struct tempfile *tempfile,
 154                    const char *template, int suffixlen, int mode)
 155{
 156        prepare_tempfile_object(tempfile);
 157
 158        strbuf_add_absolute_path(&tempfile->filename, template);
 159        tempfile->fd = git_mkstemps_mode(tempfile->filename.buf, suffixlen, mode);
 160        if (tempfile->fd < 0) {
 161                strbuf_reset(&tempfile->filename);
 162                return -1;
 163        }
 164        tempfile->owner = getpid();
 165        tempfile->active = 1;
 166        return tempfile->fd;
 167}
 168
 169int mks_tempfile_tsm(struct tempfile *tempfile,
 170                     const char *template, int suffixlen, int mode)
 171{
 172        const char *tmpdir;
 173
 174        prepare_tempfile_object(tempfile);
 175
 176        tmpdir = getenv("TMPDIR");
 177        if (!tmpdir)
 178                tmpdir = "/tmp";
 179
 180        strbuf_addf(&tempfile->filename, "%s/%s", tmpdir, template);
 181        tempfile->fd = git_mkstemps_mode(tempfile->filename.buf, suffixlen, mode);
 182        if (tempfile->fd < 0) {
 183                strbuf_reset(&tempfile->filename);
 184                return -1;
 185        }
 186        tempfile->owner = getpid();
 187        tempfile->active = 1;
 188        return tempfile->fd;
 189}
 190
 191int xmks_tempfile_m(struct tempfile *tempfile, const char *template, int mode)
 192{
 193        int fd;
 194        struct strbuf full_template = STRBUF_INIT;
 195
 196        strbuf_add_absolute_path(&full_template, template);
 197        fd = mks_tempfile_m(tempfile, full_template.buf, mode);
 198        if (fd < 0)
 199                die_errno("Unable to create temporary file '%s'",
 200                          full_template.buf);
 201
 202        strbuf_release(&full_template);
 203        return fd;
 204}
 205
 206FILE *fdopen_tempfile(struct tempfile *tempfile, const char *mode)
 207{
 208        if (!tempfile->active)
 209                die("BUG: fdopen_tempfile() called for inactive object");
 210        if (tempfile->fp)
 211                die("BUG: fdopen_tempfile() called for open object");
 212
 213        tempfile->fp = fdopen(tempfile->fd, mode);
 214        return tempfile->fp;
 215}
 216
 217const char *get_tempfile_path(struct tempfile *tempfile)
 218{
 219        if (!tempfile->active)
 220                die("BUG: get_tempfile_path() called for inactive object");
 221        return tempfile->filename.buf;
 222}
 223
 224int get_tempfile_fd(struct tempfile *tempfile)
 225{
 226        if (!tempfile->active)
 227                die("BUG: get_tempfile_fd() called for inactive object");
 228        return tempfile->fd;
 229}
 230
 231FILE *get_tempfile_fp(struct tempfile *tempfile)
 232{
 233        if (!tempfile->active)
 234                die("BUG: get_tempfile_fp() called for inactive object");
 235        return tempfile->fp;
 236}
 237
 238int close_tempfile(struct tempfile *tempfile)
 239{
 240        int fd = tempfile->fd;
 241        FILE *fp = tempfile->fp;
 242        int err;
 243
 244        if (fd < 0)
 245                return 0;
 246
 247        tempfile->fd = -1;
 248        if (fp) {
 249                tempfile->fp = NULL;
 250
 251                /*
 252                 * Note: no short-circuiting here; we want to fclose()
 253                 * in any case!
 254                 */
 255                err = ferror(fp) | fclose(fp);
 256        } else {
 257                err = close(fd);
 258        }
 259
 260        if (err) {
 261                int save_errno = errno;
 262                delete_tempfile(tempfile);
 263                errno = save_errno;
 264                return -1;
 265        }
 266
 267        return 0;
 268}
 269
 270int reopen_tempfile(struct tempfile *tempfile)
 271{
 272        if (0 <= tempfile->fd)
 273                die("BUG: reopen_tempfile called for an open object");
 274        if (!tempfile->active)
 275                die("BUG: reopen_tempfile called for an inactive object");
 276        tempfile->fd = open(tempfile->filename.buf, O_WRONLY);
 277        return tempfile->fd;
 278}
 279
 280int rename_tempfile(struct tempfile *tempfile, const char *path)
 281{
 282        if (!tempfile->active)
 283                die("BUG: rename_tempfile called for inactive object");
 284
 285        if (close_tempfile(tempfile))
 286                return -1;
 287
 288        if (rename(tempfile->filename.buf, path)) {
 289                int save_errno = errno;
 290                delete_tempfile(tempfile);
 291                errno = save_errno;
 292                return -1;
 293        }
 294
 295        tempfile->active = 0;
 296        strbuf_reset(&tempfile->filename);
 297        return 0;
 298}
 299
 300void delete_tempfile(struct tempfile *tempfile)
 301{
 302        if (!tempfile->active)
 303                return;
 304
 305        if (!close_tempfile(tempfile)) {
 306                unlink_or_warn(tempfile->filename.buf);
 307                tempfile->active = 0;
 308                strbuf_reset(&tempfile->filename);
 309        }
 310}