VFS rewrite

.github/workflows/asan-build.yml

@@ -57,7 +57,7 @@ jobs:
         CC=clang \
         CFLAGS="-fsanitize=address,undefined -fno-sanitize-recover=undefined -fno-omit-frame-pointer -g -O1 -DNDEBUG" \
         LDFLAGS="-fsanitize=address,undefined" \
-        ./configure --with-rrsync --disable-md2man
+        ./configure --with-rrsync --disable-md2man --enable-strict-confinement
     - name: make
       # check-progs builds rsync plus the test helper programs (tls, trimslash,
       # t_unsafe, ...) that runtests.py requires; plain "make" builds only rsync

.gitignore

@@ -43,19 +43,19 @@ aclocal.m4
 /testrun
 /trimslash
 /t_unsafe
-/wildtest
-/getfsdev
-/simdtest
 /t_acl
 /t_chmod_secure
-/t_clean_fname
+/t_rename_secure
+/t_secure_relpath
+/t_symlink_secure
 /t_hashtable_overflow
 /t_iwildmatch
-/t_rename_secure
+/t_clean_fname
 /t_safe_arg
+/simdtest
+/wildtest
+/getfsdev
 /t_safe_arg_main
-/t_secure_relpath
-/t_symlink_secure
 /rounding.h
 /doc/rsync.pdf
 /doc/rsync.ps

Makefile.in

@@ -18,6 +18,9 @@ CXXFLAGS=@CXXFLAGS@
 EXEEXT=@EXEEXT@
 LDFLAGS=@LDFLAGS@
 LIBOBJDIR=lib/
+AR=@AR@
+ARFLAGS=cr
+RANLIB=@RANLIB@
 
 INSTALLCMD=@INSTALL@
 INSTALLMAN=@INSTALL@
@@ -38,23 +41,24 @@ GENFILES=configure.sh aclocal.m4 config.h.in rsync.1 rsync.1.html \
 	 rsync-ssl.1 rsync-ssl.1.html rsyncd.conf.5 rsyncd.conf.5.html \
 	 @GEN_RRSYNC@
 HEADERS=byteorder.h config.h errcode.h proto.h rsync.h ifuncs.h itypes.h inums.h \
-	lib/pool_alloc.h lib/mdigest.h lib/md-defines.h
+	lib/pool_alloc.h lib/mdigest.h lib/md-defines.h vfs/vfs.h
 LIBOBJ=lib/wildmatch.o lib/compat.o lib/snprintf.o lib/mdfour.o lib/md5.o \
 	lib/permstring.o lib/pool_alloc.o lib/sysacls.o lib/sysxattrs.o lib/acl.o @LIBOBJS@
 zlib_OBJS=zlib/deflate.o zlib/inffast.o zlib/inflate.o zlib/inftrees.o \
 	zlib/trees.o zlib/zutil.o zlib/adler32.o zlib/compress.o zlib/crc32.o
 OBJS1_NO_MAIN=flist.o rsync.o generator.o receiver.o cleanup.o sender.o exclude.o \
-	util1.o util2.o checksum.o match.o syscall.o log.o backup.o delete.o
+	util1.o util2.o checksum.o match.o log.o backup.o delete.o
 OBJS1=$(OBJS1_NO_MAIN) main.o
 OBJS2=options.o io.o compat.o hlink.o token.o uidlist.o socket.o hashtable.o \
 	usage.o fileio.o batch.o clientname.o chmod.o acls.o xattrs.o
 OBJS3=progress.o pipe.o @MD5_ASM@ @ROLL_SIMD@ @ROLL_ASM@
 DAEMON_OBJ = params.o loadparm.o clientserver.o access.o connection.o authenticate.o
 popt_OBJS= popt/popt.o  popt/poptconfig.o \
 	popt/popthelp.o popt/poptparse.o popt/poptint.o
-OBJS=$(OBJS1) $(OBJS2) $(OBJS3) $(DAEMON_OBJ) $(LIBOBJ) @BUILD_ZLIB@ @BUILD_POPT@
+VFS_OBJ=vfs/vfs.o vfs/dirstack.o vfs/secure_open.o vfs/owner_walk.o vfs/dircache.o vfs/stat.o vfs/rename.o vfs/unlink.o vfs/open.o vfs/chmod.o vfs/symlink.o vfs/link.o vfs/mkdir.o vfs/chown.o vfs/mknod.o vfs/times.o vfs/fileio.o vfs/make_path.o vfs/copy_file.o vfs/robust.o
+OBJS=$(OBJS1) $(OBJS2) $(OBJS3) $(DAEMON_OBJ) $(LIBOBJ) @BUILD_ZLIB@ @BUILD_POPT@ libvfs.a
 
-TLS_OBJ = tls.o syscall.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/permstring.o lib/sysxattrs.o @BUILD_POPT@
+TLS_OBJ = tls.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/permstring.o lib/sysxattrs.o @BUILD_POPT@ libvfs.a
 
 # Programs we must have to run the test cases
 CHECK_PROGS = rsync$(EXEEXT) tls$(EXEEXT) getgroups$(EXEEXT) getfsdev$(EXEEXT) \
@@ -67,7 +71,7 @@ CHECK_SYMLINKS = testsuite/chown-fake_test.py testsuite/devices-fake_test.py \
 # Objects for CHECK_PROGS to clean
 CHECK_OBJS=tls.o testrun.o getgroups.o getfsdev.o t_stub.o t_unsafe.o t_chmod_secure.o t_rename_secure.o t_symlink_secure.o t_secure_relpath.o t_acl.o t_hashtable_overflow.o t_iwildmatch.o t_clean_fname.o t_safe_arg.o trimslash.o wildtest.o
 # Compile-only feature-shape checks.
-CHECK_COMPILE_OBJS=syscall-no-at-fdcwd.o
+CHECK_COMPILE_OBJS=vfs-no-at-fdcwd.o
 
 # note that the -I. is needed to handle config.h when using VPATH
 .c.o:
@@ -80,9 +84,20 @@ CHECK_COMPILE_OBJS=syscall-no-at-fdcwd.o
 all: Makefile rsync$(EXEEXT) stunnel-rsyncd.conf @MAKE_RRSYNC@ @MAKE_MAN@
 .PHONY: all
 
-syscall-no-at-fdcwd.o: syscall.c $(HEADERS)
-	$(CC) -I. -I$(srcdir) $(CFLAGS) $(CPPFLAGS) \
-	    -DRSYNC_TEST_NO_AT_FDCWD -c $(srcdir)/syscall.c -o $@
+# Compile-check the pre-*at() portability tier.  syscall.c's *at wrappers were
+# split into vfs/, so compile every vfs source with the AT_FDCWD primitives
+# undefined (via vfs/vfs_internal.h's RSYNC_TEST_NO_AT_FDCWD block) and confirm
+# the fallback arms still build.  A shell loop keeps this portable (BSD/Solaris
+# make have no pattern rules); the last object compiled is left as the target.
+# $(VFS_OBJ:.o=.c) is POSIX suffix substitution, portable across makes.
+vfs-no-at-fdcwd.o: $(VFS_OBJ:.o=.c) $(HEADERS) vfs/vfs.h vfs/vfs_internal.h
+	@rm -f $@ $@.tmp
+	@for f in $(VFS_OBJ:.o=.c); do \
+	    echo "  no-AT_FDCWD compile-check: $$f"; \
+	    $(CC) -I. -I$(srcdir) $(CFLAGS) $(CPPFLAGS) \
+	        -DRSYNC_TEST_NO_AT_FDCWD -c $(srcdir)/$$f -o $@.tmp || exit 1; \
+	done
+	@mv $@.tmp $@
 
 .PHONY: install
 install: all
@@ -141,7 +156,17 @@ rrsync: support/rrsync
 
 $(OBJS): $(HEADERS)
 $(CHECK_OBJS): $(HEADERS)
+$(VFS_OBJ): $(HEADERS)
+$(VFS_OBJ): vfs/vfs_internal.h
 tls.o xattrs.o: lib/sysxattrs.h
+
+# The VFS layer is bundled into a static archive linked last on every target so
+# that moving a filesystem family between files never breaks a test harness link
+# (the linker pulls only the members each program references).
+libvfs.a: $(VFS_OBJ)
+	rm -f $@
+	$(AR) $(ARFLAGS) $@ $(VFS_OBJ)
+	$(RANLIB) $@
 usage.o: version.h latest-year.h help-rsync.h help-rsyncd.h git-version.h default-cvsignore.h
 loadparm.o: default-dont-compress.h daemon-parm.h
 
@@ -202,23 +227,23 @@ getgroups$(EXEEXT): getgroups.o
 getfsdev$(EXEEXT): getfsdev.o
 	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ getfsdev.o $(LIBS)
 
-TRIMSLASH_OBJ = trimslash.o syscall.o util2.o t_stub.o lib/compat.o lib/snprintf.o
+TRIMSLASH_OBJ = trimslash.o util2.o t_stub.o lib/compat.o lib/snprintf.o libvfs.a
 trimslash$(EXEEXT): $(TRIMSLASH_OBJ)
 	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(TRIMSLASH_OBJ) $(LIBS)
 
-T_UNSAFE_OBJ = t_unsafe.o syscall.o util1.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o
+T_UNSAFE_OBJ = t_unsafe.o util1.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o libvfs.a
 t_unsafe$(EXEEXT): $(T_UNSAFE_OBJ)
 	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(T_UNSAFE_OBJ) $(LIBS)
 
-T_HASHTABLE_OVERFLOW_OBJ = t_hashtable_overflow.o hashtable.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o
+T_HASHTABLE_OVERFLOW_OBJ = t_hashtable_overflow.o hashtable.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o libvfs.a
 t_hashtable_overflow$(EXEEXT): $(T_HASHTABLE_OVERFLOW_OBJ)
 	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(T_HASHTABLE_OVERFLOW_OBJ) $(LIBS)
 
 T_IWILDMATCH_OBJ = t_iwildmatch.o lib/wildmatch.o
 t_iwildmatch$(EXEEXT): $(T_IWILDMATCH_OBJ)
 	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(T_IWILDMATCH_OBJ) $(LIBS)
 
-T_CLEAN_FNAME_OBJ = t_clean_fname.o syscall.o util1.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o
+T_CLEAN_FNAME_OBJ = t_clean_fname.o util1.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o libvfs.a
 t_clean_fname$(EXEEXT): $(T_CLEAN_FNAME_OBJ)
 	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(T_CLEAN_FNAME_OBJ) $(LIBS)
 
@@ -231,23 +256,23 @@ t_clean_fname$(EXEEXT): $(T_CLEAN_FNAME_OBJ)
 # GNU-make-only; BSD and Solaris make expand it to nothing.
 t_safe_arg_main.o: main.c $(HEADERS)
 	$(CC) -I. -I$(srcdir) $(CFLAGS) $(CPPFLAGS) -Dmain=rsync_unused_main -c $(srcdir)/main.c -o t_safe_arg_main.o
-T_SAFE_ARG_OBJ = t_safe_arg.o t_safe_arg_main.o $(OBJS1_NO_MAIN) $(OBJS2) $(OBJS3) $(DAEMON_OBJ) $(LIBOBJ) @BUILD_ZLIB@ @BUILD_POPT@
+T_SAFE_ARG_OBJ = t_safe_arg.o t_safe_arg_main.o $(OBJS1_NO_MAIN) $(OBJS2) $(OBJS3) $(DAEMON_OBJ) $(LIBOBJ) @BUILD_ZLIB@ @BUILD_POPT@ libvfs.a
 t_safe_arg$(EXEEXT): $(T_SAFE_ARG_OBJ)
 	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(T_SAFE_ARG_OBJ) $(LIBS)
 
-T_CHMOD_SECURE_OBJ = t_chmod_secure.o syscall.o util1.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o lib/permstring.o
+T_CHMOD_SECURE_OBJ = t_chmod_secure.o util1.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o lib/permstring.o libvfs.a
 t_chmod_secure$(EXEEXT): $(T_CHMOD_SECURE_OBJ)
 	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(T_CHMOD_SECURE_OBJ) $(LIBS)
 
-T_RENAME_SECURE_OBJ = t_rename_secure.o syscall.o util1.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o lib/permstring.o
+T_RENAME_SECURE_OBJ = t_rename_secure.o util1.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o lib/permstring.o libvfs.a
 t_rename_secure$(EXEEXT): $(T_RENAME_SECURE_OBJ)
 	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(T_RENAME_SECURE_OBJ) $(LIBS)
 
-T_SYMLINK_SECURE_OBJ = t_symlink_secure.o syscall.o util1.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o lib/permstring.o
+T_SYMLINK_SECURE_OBJ = t_symlink_secure.o util1.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o lib/permstring.o libvfs.a
 t_symlink_secure$(EXEEXT): $(T_SYMLINK_SECURE_OBJ)
 	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(T_SYMLINK_SECURE_OBJ) $(LIBS)
 
-T_SECURE_RELPATH_OBJ = t_secure_relpath.o syscall.o util1.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o lib/permstring.o
+T_SECURE_RELPATH_OBJ = t_secure_relpath.o util1.o util2.o t_stub.o lib/compat.o lib/snprintf.o lib/wildmatch.o lib/permstring.o libvfs.a
 t_secure_relpath$(EXEEXT): $(T_SECURE_RELPATH_OBJ)
 	$(CC) $(CFLAGS) $(LDFLAGS) -o $@ $(T_SECURE_RELPATH_OBJ) $(LIBS)
 
@@ -348,10 +373,10 @@ rrsync.1: support/rrsync.1.md md-convert Makefile
 
 .PHONY: clean
 clean: cleantests
-	rm -f *~ $(OBJS) $(CHECK_PROGS) $(CHECK_OBJS) $(CHECK_COMPILE_OBJS) $(CHECK_SYMLINKS) @MAKE_RRSYNC@ \
+	rm -f *~ $(OBJS) $(VFS_OBJ) libvfs.a $(CHECK_PROGS) $(CHECK_OBJS) $(CHECK_COMPILE_OBJS) $(CHECK_COMPILE_OBJS:.o=.o.tmp) $(CHECK_SYMLINKS) @MAKE_RRSYNC@ \
 		git-version.h rounding rounding.h *.old rsync*.1 rsync*.5 @MAKE_RRSYNC_1@ \
 		*.html daemon-parm.h help-*.h default-*.h proto.h proto.h-tstamp
-	rm -f *.gcno *.gcda lib/*.gcno lib/*.gcda zlib/*.gcno zlib/*.gcda popt/*.gcno popt/*.gcda
+	rm -f *.gcno *.gcda lib/*.gcno lib/*.gcda zlib/*.gcno zlib/*.gcda popt/*.gcno popt/*.gcda vfs/*.gcno vfs/*.gcda
 	rm -rf coverage coverage-tcp coverage-all coverage-fallback
 
 .PHONY: cleantests

acls.c

@@ -1213,7 +1213,7 @@ static int set_rsync_acl(int fd, int dirfd, const char *leaf, const char *fname,
 		 * the legacy path fallback (op_pin am_root != 0 rule). */
 		if (fd >= 0)
 			rc = sys_acl_delete_def_fd(fd);
-		else if (secure_relpath_active() && am_root) {
+		else if (vfs_relpath_active() && am_root) {
 			errno = ELOOP;
 			rc = -1;
 		} else
@@ -1334,7 +1334,7 @@ static int set_rsync_acl(int fd, int dirfd, const char *leaf, const char *fname,
 				sxp->st.st_mode = cur_mode;
 			return 0;
 		}
-		if (secure_relpath_active() && am_root) {
+		if (vfs_relpath_active() && am_root) {
 			/* Real root always can open its own freshly-staged reg/dir/fifo leaf,
 			 * so a missing held fd on a confined receiver means the leaf was raced
 			 * to a symlink; sys_acl_set_file() follows the leaf, so refuse rather

authenticate.c

@@ -156,7 +156,7 @@ static const char *check_secret(int module, const char *user, const char *group,
 	if (!fname || !*fname)
 		return "no secrets file";
 	{
-		int fd = open_no_attacker_symlinks(fname, O_RDONLY, 0);
+		int fd = vfs_open_owner_walk(fname, O_RDONLY, 0, 0);
 		if (fd < 0)
 			return "no secrets file";
 		fh = fdopen(fd, "r");
@@ -166,7 +166,7 @@ static const char *check_secret(int module, const char *user, const char *group,
 		}
 	}
 
-	if (do_fstat(fileno(fh), &st) == -1) {
+	if (vfs_fstat(fileno(fh), &st) == -1) {
 		rsyserr(FLOG, errno, "fstat(%s)", fname);
 		ok = 0;
 	} else if (lp_strict_modes(module)) {
@@ -239,10 +239,10 @@ static const char *getpassf(const char *filename)
 
 		/* --password-file=PATH client open.  Its first line is sent as the
 		 * auth response, so a planted symlink leaks the target's content
-		 * (e.g. shadow hashes) to a malicious daemon; the do_stat()
+		 * (e.g. shadow hashes) to a malicious daemon; the vfs_stat()
 		 * other-access check runs on the target mode and passes 0640
 		 * root:shadow.  Refuse symlinks not owned by uid 0 or our euid. */
-		if ((fd = open_no_attacker_symlinks(filename, O_RDONLY, 0)) < 0) {
+		if ((fd = vfs_open_owner_walk(filename, O_RDONLY, 0, 0)) < 0) {
 			rsyserr(FERROR, errno, "could not open password file %s", filename);
 			exit_cleanup(RERR_SYNTAX);
 		}
@@ -252,7 +252,7 @@ static const char *getpassf(const char *filename)
 		 * path between open and check can't make the owner/mode test
 		 * validate a different inode than the one we read the password
 		 * from. */
-		if (do_fstat(fd, &st) == -1) {
+		if (vfs_fstat(fd, &st) == -1) {
 			rsyserr(FERROR, errno, "fstat(%s)", filename);
 			exit_cleanup(RERR_SYNTAX);
 		}