mirror of
https://github.com/veracrypt/VeraCrypt.git
synced 2026-06-15 00:56:07 -05:00
Mounir IDRASSI
abd089140b
When normal filesystem unmount fails, the Linux path could stop before cleaning VeraCrypt mapper, loop and FUSE objects. Add an explicit emergency dismount request that is only reached after interactive confirmation. The recovery path lazy-detaches mounted filesystems, uses deferred dmsetup removal for VeraCrypt mapper devices, detaches loop devices, and keeps normal force/ignoreOpenFiles behavior unchanged.
1247 lines
29 KiB
C++
1247 lines
29 KiB
C++
/*
|
|
Derived from source code of TrueCrypt 7.1a, which is
|
|
Copyright (c) 2008-2012 TrueCrypt Developers Association and which is governed
|
|
by the TrueCrypt License 3.0.
|
|
|
|
Modifications and additions to the original source code (contained in this file)
|
|
and all other portions of this file are Copyright (c) 2013-2025 AM Crypto
|
|
and are governed by the Apache License 2.0 the full text of which is
|
|
contained in the file License.txt included in VeraCrypt binary and source
|
|
code distribution packages.
|
|
*/
|
|
|
|
#include "CoreUnix.h"
|
|
#include "Common/Tcdefs.h"
|
|
#include <errno.h>
|
|
#include <iostream>
|
|
#include <signal.h>
|
|
#include <sys/stat.h>
|
|
#include <sys/time.h>
|
|
#include <sys/types.h>
|
|
#include <stdio.h>
|
|
#include <unistd.h>
|
|
#include "Platform/FileStream.h"
|
|
#include "Platform/MemoryStream.h"
|
|
#include "Platform/SystemLog.h"
|
|
#include "Driver/Fuse/FuseService.h"
|
|
#include "Volume/VolumePasswordCache.h"
|
|
|
|
namespace VeraCrypt
|
|
{
|
|
#ifdef TC_LINUX
|
|
static string GetTmpUser ();
|
|
static bool SamePath (const string& path1, const string& path2);
|
|
#endif
|
|
|
|
// Struct to hold terminal emulator information
|
|
struct TerminalInfo {
|
|
const char* name;
|
|
const char** args;
|
|
const char** dependency_path;
|
|
};
|
|
|
|
// Popular terminal emulators data and arguments
|
|
static const char* xterm_args[] = {"-T", "fsck", "-e", NULL};
|
|
|
|
static const char* gnome_args[] = {"--title", "fsck", "--", "sh", "-c", NULL};
|
|
static const char* gnome_deps[] = {"dbus-launch", NULL};
|
|
|
|
static const char* konsole_args[] = {"--hold", "-p", "tabtitle=fsck", "-e", "sh", "-c", NULL};
|
|
static const char* xfce4_args[] = {"--title=fsck", "-x", "sh", "-c", NULL};
|
|
static const char* mate_args[] = {"--title", "fsck", "--", "sh", "-c", NULL};
|
|
static const char* lxterminal_args[] = {"--title=fsck", "-e", "sh", "-c", NULL};
|
|
static const char* terminator_args[] = {"-T", "fsck", "-x", "sh", "-c", NULL};
|
|
static const char* urxvt_args[] = {"-title", "fsck", "-e", "sh", "-c", NULL};
|
|
static const char* st_args[] = {"-t", "fsck", "-e", "sh", "-c", NULL};
|
|
|
|
// List of popular terminal emulators
|
|
static const TerminalInfo TERMINALS[] = {
|
|
{"xterm", xterm_args, NULL},
|
|
{"gnome-terminal", gnome_args, gnome_deps},
|
|
{"konsole", konsole_args, NULL},
|
|
{"xfce4-terminal", xfce4_args, NULL},
|
|
{"mate-terminal", mate_args, NULL},
|
|
{"lxterminal", lxterminal_args, NULL},
|
|
{"terminator", terminator_args, NULL},
|
|
{"urxvt", urxvt_args, NULL},
|
|
{"st", st_args, NULL},
|
|
{NULL, NULL, NULL}
|
|
};
|
|
|
|
CoreUnix::CoreUnix ()
|
|
{
|
|
signal (SIGPIPE, SIG_IGN);
|
|
|
|
char *loc = setlocale (LC_ALL, "");
|
|
if (!loc || string (loc) == "C")
|
|
setlocale (LC_ALL, "en_US.UTF-8");
|
|
}
|
|
|
|
CoreUnix::~CoreUnix ()
|
|
{
|
|
}
|
|
|
|
void CoreUnix::CheckFilesystem (shared_ptr <VolumeInfo> mountedVolume, bool repair) const
|
|
{
|
|
if (!mountedVolume->MountPoint.IsEmpty())
|
|
DismountFilesystem (mountedVolume->MountPoint, false);
|
|
|
|
// Find system fsck first
|
|
std::string errorMsg;
|
|
std::string fsckPath = Process::FindSystemBinary("fsck", errorMsg);
|
|
if (fsckPath.empty()) {
|
|
throw SystemException(SRC_POS, errorMsg);
|
|
}
|
|
|
|
list <string> args;
|
|
|
|
string xargs = fsckPath + " "; // Use absolute fsck path
|
|
|
|
#ifdef TC_LINUX
|
|
if (!repair)
|
|
xargs += "-n ";
|
|
else
|
|
xargs += "-r ";
|
|
#endif
|
|
|
|
xargs += string (mountedVolume->VirtualDevice) + "; echo '[Done]'; read W";
|
|
// Try each terminal
|
|
for (const TerminalInfo* term = TERMINALS; term->name != NULL; ++term) {
|
|
errno = 0;
|
|
std::string termPath = Process::FindSystemBinary(term->name, errorMsg);
|
|
if (termPath.length() > 0) {
|
|
// check dependencies
|
|
if (term->dependency_path) {
|
|
bool depFound = true;
|
|
for (const char** dep = term->dependency_path; *dep != NULL; ++dep) {
|
|
string depPath = Process::FindSystemBinary(*dep, errorMsg);
|
|
if (depPath.empty()) {
|
|
depFound = false;
|
|
break;
|
|
}
|
|
}
|
|
|
|
if (!depFound) {
|
|
continue; // dependency not found, skip
|
|
}
|
|
}
|
|
|
|
// Build args
|
|
std::list<std::string> args;
|
|
for (const char** arg = term->args; *arg != NULL; ++arg) {
|
|
args.push_back(*arg);
|
|
}
|
|
args.push_back(xargs);
|
|
|
|
try {
|
|
Process::Execute (termPath, args, 1000);
|
|
return;
|
|
}
|
|
catch (TimeOut&) {
|
|
return;
|
|
}
|
|
catch (SystemException&) {
|
|
// Continue to next terminal
|
|
}
|
|
}
|
|
}
|
|
|
|
throw TerminalNotFound();
|
|
}
|
|
|
|
void CoreUnix::DismountFilesystem (const DirectoryPath &mountPoint, bool force) const
|
|
{
|
|
list <string> args;
|
|
|
|
#ifdef TC_MACOSX
|
|
if (force)
|
|
args.push_back ("-f");
|
|
#endif
|
|
args.push_back ("--");
|
|
args.push_back (mountPoint);
|
|
|
|
Process::Execute ("umount", args);
|
|
}
|
|
|
|
#ifdef TC_LINUX
|
|
void CoreUnix::DismountFilesystemLazy (const DirectoryPath &mountPoint) const
|
|
{
|
|
list <string> args;
|
|
args.push_back ("-l");
|
|
args.push_back ("--");
|
|
args.push_back (mountPoint);
|
|
|
|
Process::Execute ("umount", args);
|
|
}
|
|
#endif
|
|
|
|
shared_ptr <VolumeInfo> CoreUnix::DismountVolume (shared_ptr <VolumeInfo> mountedVolume, bool ignoreOpenFiles, bool syncVolumeInfo)
|
|
{
|
|
if (!mountedVolume->MountPoint.IsEmpty())
|
|
{
|
|
#ifdef TC_LINUX
|
|
try
|
|
{
|
|
DismountFilesystem (mountedVolume->MountPoint, ignoreOpenFiles);
|
|
}
|
|
catch (ExecutedProcessFailed &e)
|
|
{
|
|
throw FilesystemDismountFailed (e);
|
|
}
|
|
#else
|
|
DismountFilesystem (mountedVolume->MountPoint, ignoreOpenFiles);
|
|
#endif
|
|
|
|
// Delete mount directory if a default path has been used
|
|
if (string (mountedVolume->MountPoint).find (GetDefaultMountPointPrefix()) == 0)
|
|
mountedVolume->MountPoint.Delete();
|
|
}
|
|
|
|
try
|
|
{
|
|
DismountNativeVolume (mountedVolume);
|
|
}
|
|
#ifdef TC_LINUX
|
|
catch (ExecutedProcessFailed &e)
|
|
{
|
|
throw FilesystemDismountFailed (e);
|
|
}
|
|
#endif
|
|
catch (NotApplicable &) { }
|
|
|
|
if (!mountedVolume->LoopDevice.IsEmpty())
|
|
{
|
|
try
|
|
{
|
|
DetachLoopDevice (mountedVolume->LoopDevice);
|
|
}
|
|
catch (ExecutedProcessFailed&) { }
|
|
}
|
|
|
|
if (syncVolumeInfo || mountedVolume->Protection == VolumeProtection::HiddenVolumeReadOnly)
|
|
{
|
|
sync();
|
|
VolumeInfoList ml = GetMountedVolumes (mountedVolume->Path);
|
|
|
|
if (ml.size() > 0)
|
|
mountedVolume = ml.front();
|
|
}
|
|
|
|
list <string> args;
|
|
args.push_back ("--");
|
|
args.push_back (mountedVolume->AuxMountPoint);
|
|
|
|
for (int t = 0; true; t++)
|
|
{
|
|
try
|
|
{
|
|
Process::Execute ("umount", args);
|
|
break;
|
|
}
|
|
catch (ExecutedProcessFailed &e)
|
|
{
|
|
if (t > 10)
|
|
#ifdef TC_LINUX
|
|
throw FilesystemDismountFailed (e);
|
|
#else
|
|
throw;
|
|
#endif
|
|
Thread::Sleep (200);
|
|
}
|
|
}
|
|
|
|
try
|
|
{
|
|
mountedVolume->AuxMountPoint.Delete();
|
|
}
|
|
catch (...) { }
|
|
|
|
VolumeEventArgs eventArgs (mountedVolume);
|
|
VolumeDismountedEvent.Raise (eventArgs);
|
|
|
|
return mountedVolume;
|
|
}
|
|
|
|
#ifdef TC_LINUX
|
|
shared_ptr <VolumeInfo> CoreUnix::EmergencyDismountVolume (shared_ptr <VolumeInfo> mountedVolume)
|
|
{
|
|
unique_ptr <Exception> firstException;
|
|
|
|
if (!mountedVolume->MountPoint.IsEmpty())
|
|
{
|
|
bool mountPointMounted = true;
|
|
bool mountPointDetached = false;
|
|
|
|
try
|
|
{
|
|
mountPointMounted = !GetMountedFilesystems (DevicePath(), mountedVolume->MountPoint).empty();
|
|
}
|
|
catch (...) { }
|
|
|
|
if (mountPointMounted)
|
|
{
|
|
try
|
|
{
|
|
DismountFilesystemLazy (mountedVolume->MountPoint);
|
|
mountPointDetached = true;
|
|
}
|
|
catch (Exception &e)
|
|
{
|
|
if (!firstException.get())
|
|
firstException.reset (e.CloneNew());
|
|
}
|
|
}
|
|
|
|
if ((!mountPointMounted || mountPointDetached) && string (mountedVolume->MountPoint).find (GetDefaultMountPointPrefix()) == 0)
|
|
{
|
|
try
|
|
{
|
|
mountedVolume->MountPoint.Delete();
|
|
}
|
|
catch (...) { }
|
|
}
|
|
}
|
|
|
|
try
|
|
{
|
|
DismountNativeVolumeDeferred (mountedVolume);
|
|
}
|
|
catch (NotApplicable&) { }
|
|
catch (Exception &e)
|
|
{
|
|
if (!firstException.get())
|
|
firstException.reset (e.CloneNew());
|
|
}
|
|
|
|
if (!mountedVolume->LoopDevice.IsEmpty())
|
|
{
|
|
try
|
|
{
|
|
DetachLoopDevice (mountedVolume->LoopDevice);
|
|
}
|
|
catch (ExecutedProcessFailed &e)
|
|
{
|
|
if (IsLoopDeviceAttached (mountedVolume->LoopDevice) && !firstException.get())
|
|
firstException.reset (e.CloneNew());
|
|
}
|
|
catch (Exception &e)
|
|
{
|
|
if (!firstException.get())
|
|
firstException.reset (e.CloneNew());
|
|
}
|
|
}
|
|
|
|
if (!mountedVolume->AuxMountPoint.IsEmpty())
|
|
{
|
|
bool auxMountPointMounted = true;
|
|
bool auxMountPointDetached = false;
|
|
|
|
try
|
|
{
|
|
auxMountPointMounted = !GetMountedFilesystems (DevicePath(), mountedVolume->AuxMountPoint).empty();
|
|
}
|
|
catch (...) { }
|
|
|
|
if (auxMountPointMounted)
|
|
{
|
|
list <string> args;
|
|
args.push_back ("--");
|
|
args.push_back (mountedVolume->AuxMountPoint);
|
|
|
|
try
|
|
{
|
|
for (int t = 0; true; t++)
|
|
{
|
|
try
|
|
{
|
|
Process::Execute ("umount", args);
|
|
auxMountPointDetached = true;
|
|
break;
|
|
}
|
|
catch (ExecutedProcessFailed&)
|
|
{
|
|
if (t > 10)
|
|
throw;
|
|
Thread::Sleep (200);
|
|
}
|
|
}
|
|
}
|
|
catch (ExecutedProcessFailed&)
|
|
{
|
|
try
|
|
{
|
|
DismountFilesystemLazy (mountedVolume->AuxMountPoint);
|
|
auxMountPointDetached = true;
|
|
}
|
|
catch (Exception &e)
|
|
{
|
|
if (!firstException.get())
|
|
firstException.reset (e.CloneNew());
|
|
}
|
|
}
|
|
catch (Exception &e)
|
|
{
|
|
if (!firstException.get())
|
|
firstException.reset (e.CloneNew());
|
|
}
|
|
}
|
|
|
|
if (!auxMountPointMounted || auxMountPointDetached)
|
|
{
|
|
try
|
|
{
|
|
mountedVolume->AuxMountPoint.Delete();
|
|
}
|
|
catch (...) { }
|
|
}
|
|
}
|
|
|
|
if (firstException.get())
|
|
firstException->Throw();
|
|
|
|
VolumeEventArgs eventArgs (mountedVolume);
|
|
VolumeDismountedEvent.Raise (eventArgs);
|
|
|
|
return mountedVolume;
|
|
}
|
|
#endif
|
|
|
|
bool CoreUnix::FilesystemSupportsLargeFiles (const FilePath &filePath) const
|
|
{
|
|
string path = filePath;
|
|
size_t pos;
|
|
|
|
while ((pos = path.find_last_of ('/')) != string::npos)
|
|
{
|
|
path = path.substr (0, pos);
|
|
|
|
if (path.empty())
|
|
break;
|
|
|
|
try
|
|
{
|
|
MountedFilesystemList filesystems = GetMountedFilesystems (DevicePath(), path);
|
|
if (!filesystems.empty())
|
|
{
|
|
const MountedFilesystem &fs = *filesystems.front();
|
|
|
|
if (fs.Type == "fat"
|
|
|| fs.Type == "fat32"
|
|
|| fs.Type == "vfat"
|
|
|| fs.Type == "fatfs"
|
|
|| fs.Type == "msdos"
|
|
|| fs.Type == "msdosfs"
|
|
|| fs.Type == "umsdos"
|
|
|| fs.Type == "dos"
|
|
|| fs.Type == "dosfs"
|
|
|| fs.Type == "pcfs"
|
|
)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
return true;
|
|
}
|
|
}
|
|
catch (...) { }
|
|
}
|
|
|
|
return true; // Prevent errors if the filesystem cannot be identified
|
|
}
|
|
|
|
bool CoreUnix::FilesystemSupportsUnixPermissions (const DevicePath &devicePath) const
|
|
{
|
|
File device;
|
|
device.Open (devicePath);
|
|
|
|
Buffer bootSector (device.GetDeviceSectorSize());
|
|
device.SeekAt (0);
|
|
device.ReadCompleteBuffer (bootSector);
|
|
|
|
uint8 *b = bootSector.Ptr();
|
|
|
|
return memcmp (b + 3, "NTFS", 4) != 0
|
|
&& memcmp (b + 54, "FAT", 3) != 0
|
|
&& memcmp (b + 82, "FAT32", 5) != 0
|
|
&& memcmp (b + 3, "EXFAT", 5) != 0;
|
|
}
|
|
|
|
string CoreUnix::GetDefaultMountPointPrefix () const
|
|
{
|
|
const char *envPrefix = getenv ("VERACRYPT_MOUNT_PREFIX");
|
|
if (envPrefix && !string (envPrefix).empty())
|
|
return envPrefix;
|
|
|
|
if (FilesystemPath ("/media").IsDirectory())
|
|
return "/media/veracrypt";
|
|
#ifdef TC_LINUX
|
|
if (FilesystemPath ("/run/media").IsDirectory())
|
|
return "/run/media/veracrypt";
|
|
#endif
|
|
if (FilesystemPath ("/mnt").IsDirectory())
|
|
return "/mnt/veracrypt";
|
|
|
|
return GetTempDirectory() + "/veracrypt_mnt";
|
|
}
|
|
|
|
uint32 CoreUnix::GetDeviceSectorSize (const DevicePath &devicePath) const
|
|
{
|
|
File dev;
|
|
dev.Open (devicePath);
|
|
return dev.GetDeviceSectorSize();
|
|
}
|
|
|
|
uint64 CoreUnix::GetDeviceSize (const DevicePath &devicePath) const
|
|
{
|
|
File dev;
|
|
dev.Open (devicePath);
|
|
return dev.Length();
|
|
}
|
|
|
|
DirectoryPath CoreUnix::GetDeviceMountPoint (const DevicePath &devicePath) const
|
|
{
|
|
DevicePath devPath = devicePath;
|
|
#ifdef TC_MACOSX
|
|
if (string (devPath).find ("/dev/rdisk") != string::npos)
|
|
devPath = string ("/dev/") + string (devicePath).substr (6);
|
|
#endif
|
|
MountedFilesystemList mountedFilesystems = GetMountedFilesystems (devPath);
|
|
|
|
if (mountedFilesystems.size() < 1)
|
|
return DirectoryPath();
|
|
|
|
return mountedFilesystems.front()->MountPoint;
|
|
}
|
|
|
|
VolumeInfoList CoreUnix::GetMountedVolumes (const VolumePath &volumePath) const
|
|
{
|
|
VolumeInfoList volumes;
|
|
|
|
foreach_ref (const MountedFilesystem &mf, GetMountedFilesystems ())
|
|
{
|
|
if (string (mf.MountPoint).find (GetFuseMountDirPrefix()) == string::npos)
|
|
continue;
|
|
|
|
shared_ptr <VolumeInfo> mountedVol;
|
|
// Introduce a retry mechanism with a timeout for control file access.
|
|
// The list is already filtered to VeraCrypt auxiliary mounts; in
|
|
// FUSE-T builds, the mount table device name varies by backend.
|
|
#ifdef VC_MACOSX_FUSET
|
|
int controlFileRetries = volumePath.IsEmpty() ? 1 : 10; // Up to 10 attempts with 500ms sleeps for specific volume lookups
|
|
string controlFileError;
|
|
while (!mountedVol && (controlFileRetries-- > 0))
|
|
#endif
|
|
{
|
|
try
|
|
{
|
|
shared_ptr <File> controlFile (new File);
|
|
controlFile->Open (string (mf.MountPoint) + FuseService::GetControlPath());
|
|
|
|
FileStream controlFileReader (controlFile);
|
|
string controlFileData = controlFileReader.ReadToEnd();
|
|
if (controlFileData.empty() || controlFileData.size() > 1024 * 1024)
|
|
throw ParameterIncorrect (SRC_POS);
|
|
|
|
shared_ptr <Stream> controlFileStream (new MemoryStream (ConstBufferPtr ((const uint8 *) controlFileData.data(), controlFileData.size())));
|
|
mountedVol = Serializable::DeserializeNew <VolumeInfo> (controlFileStream);
|
|
}
|
|
catch (const std::exception& e)
|
|
{
|
|
#ifdef VC_MACOSX_FUSET
|
|
controlFileError = StringConverter::ToSingle (StringConverter::ToExceptionString (e));
|
|
if (controlFileRetries > 0)
|
|
{
|
|
// FUSE-T's SMB backend can briefly expose the auxiliary mount
|
|
// before the control file is readable and deserializable.
|
|
Thread::Sleep (500);
|
|
}
|
|
#else
|
|
(void) e;
|
|
#endif
|
|
}
|
|
#ifdef VC_MACOSX_FUSET
|
|
catch (...)
|
|
{
|
|
controlFileError = "unknown exception";
|
|
if (controlFileRetries > 0)
|
|
{
|
|
// FUSE-T's SMB backend can briefly expose the auxiliary mount
|
|
// before the control file is readable and deserializable.
|
|
Thread::Sleep (500);
|
|
}
|
|
}
|
|
#endif
|
|
}
|
|
|
|
if (!mountedVol)
|
|
{
|
|
#ifdef VC_MACOSX_FUSET
|
|
if (!volumePath.IsEmpty())
|
|
{
|
|
stringstream logMessage;
|
|
logMessage << "Failed to read VeraCrypt auxiliary mount control file after retries: "
|
|
<< string (mf.MountPoint) << FuseService::GetControlPath();
|
|
if (!controlFileError.empty())
|
|
logMessage << ": " << controlFileError;
|
|
SystemLog::WriteError (logMessage.str());
|
|
}
|
|
#endif
|
|
continue; // Skip to the next mounted filesystem
|
|
}
|
|
|
|
if (!volumePath.IsEmpty() && wstring (mountedVol->Path).compare (volumePath) != 0)
|
|
continue;
|
|
|
|
mountedVol->AuxMountPoint = mf.MountPoint;
|
|
|
|
if (!mountedVol->VirtualDevice.IsEmpty())
|
|
{
|
|
MountedFilesystemList mpl = GetMountedFilesystems (mountedVol->VirtualDevice);
|
|
|
|
if (mpl.size() > 0)
|
|
mountedVol->MountPoint = mpl.front()->MountPoint;
|
|
}
|
|
|
|
volumes.push_back (mountedVol);
|
|
|
|
if (!volumePath.IsEmpty())
|
|
break;
|
|
}
|
|
|
|
return volumes;
|
|
}
|
|
|
|
gid_t CoreUnix::GetRealGroupId () const
|
|
{
|
|
const char *env = getenv ("SUDO_GID");
|
|
if (env)
|
|
{
|
|
try
|
|
{
|
|
string s (env);
|
|
return static_cast <gid_t> (StringConverter::ToUInt64 (s));
|
|
}
|
|
catch (...) { }
|
|
}
|
|
|
|
return getgid();
|
|
}
|
|
|
|
uid_t CoreUnix::GetRealUserId () const
|
|
{
|
|
const char *env = getenv ("SUDO_UID");
|
|
if (env)
|
|
{
|
|
try
|
|
{
|
|
string s (env);
|
|
return static_cast <uid_t> (StringConverter::ToUInt64 (s));
|
|
}
|
|
catch (...) { }
|
|
}
|
|
|
|
return getuid();
|
|
}
|
|
|
|
string CoreUnix::GetTempDirectory () const
|
|
{
|
|
const char *tmpdir = getenv ("TMPDIR");
|
|
string envDir = tmpdir ? tmpdir : "/tmp";
|
|
|
|
#ifdef TC_LINUX
|
|
/*
|
|
* If pam_tmpdir.so is in use, a different temporary directory is
|
|
* allocated for each user ID. We need to mount to the directory used
|
|
* by the non-root user.
|
|
*/
|
|
if (getuid () == 0 && envDir.size () >= 2
|
|
&& envDir.substr (envDir.size () - 2) == "/0") {
|
|
string tmpuser = GetTmpUser ();
|
|
if (SamePath (envDir, tmpuser + "/0")) {
|
|
/* Substitute the sudo'ing user for 0 */
|
|
char uid[40];
|
|
FILE *fp = fopen ("/proc/self/loginuid", "r");
|
|
if (fp != NULL) {
|
|
if (fgets (uid, sizeof (uid), fp) != nullptr) {
|
|
envDir = tmpuser + "/" + uid;
|
|
}
|
|
fclose (fp);
|
|
}
|
|
}
|
|
}
|
|
#endif
|
|
|
|
return envDir;
|
|
}
|
|
|
|
#ifdef TC_LINUX
|
|
static string GetTmpUser ()
|
|
{
|
|
string tmpuser = "/tmp/user";
|
|
FILE *fp = fopen ("/etc/security/tmpdir.conf", "r");
|
|
if (fp == NULL) {
|
|
return tmpuser;
|
|
}
|
|
while (true) {
|
|
/* Parses the same way as pam_tmpdir */
|
|
char line[1024];
|
|
if (fgets (line, sizeof (line), fp) == nullptr) {
|
|
break;
|
|
}
|
|
if (line[0] == '#') {
|
|
continue;
|
|
}
|
|
size_t len = strlen (line);
|
|
if (len > 0 && line[len-1] == '\n') {
|
|
line[len-1] = '\0';
|
|
}
|
|
char *eq = strchr (line, '=');
|
|
if (eq == nullptr) {
|
|
continue;
|
|
}
|
|
*eq = '\0';
|
|
const char *key = line;
|
|
const char *value = eq + 1;
|
|
if (strcmp (key, "tmpdir") == 0) {
|
|
tmpuser = value;
|
|
break;
|
|
}
|
|
}
|
|
fclose (fp);
|
|
return tmpuser;
|
|
}
|
|
|
|
static bool SamePath (const string& path1, const string& path2)
|
|
{
|
|
size_t i1 = 0;
|
|
size_t i2 = 0;
|
|
while (i1 < path1.size () && i2 < path2.size ()) {
|
|
if (path1[i1] != path2[i2]) {
|
|
return false;
|
|
}
|
|
/* Any two substrings consisting entirely of slashes compare equal */
|
|
if (path1[i1] == '/') {
|
|
while (i1 < path1.size () && path1[i1] == '/') {
|
|
++i1;
|
|
}
|
|
while (i2 < path2.size () && path2[i2] == '/') {
|
|
++i2;
|
|
}
|
|
}
|
|
else
|
|
{
|
|
++i1;
|
|
++i2;
|
|
}
|
|
}
|
|
return (i1 == path1.size () && i2 == path2.size ());
|
|
}
|
|
#endif
|
|
|
|
bool CoreUnix::IsMountPointAvailable (const DirectoryPath &mountPoint) const
|
|
{
|
|
return GetMountedFilesystems (DevicePath(), mountPoint).size() == 0;
|
|
}
|
|
|
|
#ifdef TC_LINUX
|
|
string CoreUnix::DetectFilesystemType (const DevicePath &devicePath) const
|
|
{
|
|
list <string> args;
|
|
args.push_back ("-p");
|
|
args.push_back ("-o");
|
|
args.push_back ("value");
|
|
args.push_back ("-s");
|
|
args.push_back ("TYPE");
|
|
args.push_back ("--");
|
|
args.push_back (devicePath);
|
|
|
|
try
|
|
{
|
|
return StringConverter::ToLower (StringConverter::Trim (Process::Execute ("blkid", args, 2000)));
|
|
}
|
|
catch (...)
|
|
{
|
|
return string();
|
|
}
|
|
}
|
|
#endif
|
|
|
|
void CoreUnix::MountFilesystem (const DevicePath &devicePath, const DirectoryPath &mountPoint, const string &filesystemType, bool readOnly, const string &systemMountOptions) const
|
|
{
|
|
if (GetMountedFilesystems (DevicePath(), mountPoint).size() > 0)
|
|
throw MountPointUnavailable (SRC_POS);
|
|
|
|
list <string> args;
|
|
string options;
|
|
|
|
if (!filesystemType.empty())
|
|
{
|
|
#ifdef TC_SOLARIS
|
|
args.push_back ("-F");
|
|
#else
|
|
args.push_back ("-t");
|
|
#endif
|
|
args.push_back (filesystemType);
|
|
}
|
|
|
|
if (readOnly)
|
|
options = "-oro";
|
|
|
|
if (!systemMountOptions.empty())
|
|
{
|
|
if (options.empty())
|
|
options = "-o";
|
|
else
|
|
options += ",";
|
|
|
|
options += systemMountOptions;
|
|
}
|
|
|
|
if (!options.empty())
|
|
args.push_back (options);
|
|
|
|
args.push_back ("--");
|
|
args.push_back (devicePath);
|
|
args.push_back (mountPoint);
|
|
|
|
Process::Execute ("mount", args);
|
|
}
|
|
|
|
VolumeSlotNumber CoreUnix::MountPointToSlotNumber (const DirectoryPath &mountPoint) const
|
|
{
|
|
string mountPointStr (mountPoint);
|
|
if (mountPointStr.find (GetDefaultMountPointPrefix()) == 0)
|
|
{
|
|
try
|
|
{
|
|
return StringConverter::ToUInt32 (StringConverter::GetTrailingNumber (mountPointStr));
|
|
}
|
|
catch (...) { }
|
|
}
|
|
return GetFirstFreeSlotNumber();
|
|
}
|
|
|
|
shared_ptr <VolumeInfo> CoreUnix::MountVolume (MountOptions &options)
|
|
{
|
|
CoalesceSlotNumberAndMountPoint (options);
|
|
|
|
if (IsVolumeMounted (*options.Path))
|
|
throw VolumeAlreadyMounted (SRC_POS);
|
|
|
|
if (options.MountPoint && !options.MountPoint->IsEmpty())
|
|
{
|
|
// Reject if the mount point is a system directory
|
|
if (IsProtectedSystemDirectory(*options.MountPoint))
|
|
throw MountPointBlocked (SRC_POS);
|
|
|
|
// Reject if the mount point is in the user's PATH and the user has not explicitly allowed insecure mount points
|
|
if (!GetAllowInsecureMount() && IsDirectoryOnUserPath(*options.MountPoint))
|
|
throw MountPointNotAllowed (SRC_POS);
|
|
}
|
|
|
|
Cipher::EnableHwSupport (!options.NoHardwareCrypto);
|
|
|
|
shared_ptr <Volume> volume;
|
|
|
|
while (true)
|
|
{
|
|
try
|
|
{
|
|
volume = OpenVolume (
|
|
options.Path,
|
|
options.PreserveTimestamps,
|
|
options.Password,
|
|
options.Pim,
|
|
options.Kdf,
|
|
options.Keyfiles,
|
|
options.EMVSupportEnabled,
|
|
options.Protection,
|
|
options.ProtectionPassword,
|
|
options.ProtectionPim,
|
|
options.ProtectionKdf,
|
|
options.ProtectionKeyfiles,
|
|
options.SharedAccessAllowed,
|
|
VolumeType::Unknown,
|
|
options.UseBackupHeaders,
|
|
options.PartitionInSystemEncryptionScope
|
|
);
|
|
|
|
options.Password.reset();
|
|
}
|
|
catch (SystemException &e)
|
|
{
|
|
if (options.Protection != VolumeProtection::ReadOnly
|
|
&& (e.GetErrorCode() == EROFS || e.GetErrorCode() == EACCES || e.GetErrorCode() == EPERM))
|
|
{
|
|
// Read-only filesystem
|
|
options.Protection = VolumeProtection::ReadOnly;
|
|
continue;
|
|
}
|
|
|
|
options.Password.reset();
|
|
throw;
|
|
}
|
|
|
|
break;
|
|
}
|
|
|
|
if (options.Path->IsDevice())
|
|
{
|
|
const uint32 devSectorSize = volume->GetFile()->GetDeviceSectorSize();
|
|
const size_t volSectorSize = volume->GetSectorSize();
|
|
if (devSectorSize != volSectorSize)
|
|
throw DeviceSectorSizeMismatch (SRC_POS, StringConverter::ToWide(devSectorSize) + L" != " + StringConverter::ToWide((uint32) volSectorSize));
|
|
}
|
|
|
|
// Find a free mount point for FUSE service
|
|
MountedFilesystemList mountedFilesystems = GetMountedFilesystems ();
|
|
string fuseMountPoint;
|
|
for (int i = 1; true; i++)
|
|
{
|
|
stringstream path;
|
|
path << GetTempDirectory() << "/" << GetFuseMountDirPrefix() << i;
|
|
FilesystemPath fsPath (path.str());
|
|
|
|
bool inUse = false;
|
|
|
|
foreach_ref (const MountedFilesystem &mf, mountedFilesystems)
|
|
{
|
|
if (mf.MountPoint == path.str())
|
|
{
|
|
inUse = true;
|
|
break;
|
|
}
|
|
}
|
|
|
|
if (!inUse)
|
|
{
|
|
try
|
|
{
|
|
if (fsPath.IsDirectory())
|
|
fsPath.Delete();
|
|
|
|
throw_sys_sub_if (mkdir (path.str().c_str(), S_IRUSR | S_IXUSR) == -1, path.str());
|
|
|
|
fuseMountPoint = fsPath;
|
|
break;
|
|
}
|
|
catch (...)
|
|
{
|
|
if (i > 255)
|
|
throw TemporaryDirectoryFailure (SRC_POS, StringConverter::ToWide (path.str()));
|
|
}
|
|
}
|
|
}
|
|
|
|
try
|
|
{
|
|
FuseService::Mount (volume, options.SlotNumber, fuseMountPoint);
|
|
}
|
|
catch (...)
|
|
{
|
|
try
|
|
{
|
|
DirectoryPath (fuseMountPoint).Delete();
|
|
}
|
|
catch (...) { }
|
|
throw;
|
|
}
|
|
|
|
DevicePath mountedVirtualDevice;
|
|
|
|
try
|
|
{
|
|
// Create a mount directory if a default path has been specified
|
|
bool mountDirCreated = false;
|
|
string mountPoint;
|
|
if (!options.NoFilesystem && options.MountPoint)
|
|
{
|
|
mountPoint = *options.MountPoint;
|
|
|
|
#ifndef TC_MACOSX
|
|
if (mountPoint.find (GetDefaultMountPointPrefix()) == 0 && !options.MountPoint->IsDirectory())
|
|
{
|
|
Directory::Create (*options.MountPoint);
|
|
try
|
|
{
|
|
throw_sys_sub_if (chown (mountPoint.c_str(), GetRealUserId(), GetRealGroupId()) == -1, mountPoint);
|
|
} catch (ParameterIncorrect&) { }
|
|
|
|
mountDirCreated = true;
|
|
}
|
|
#endif
|
|
}
|
|
|
|
try
|
|
{
|
|
try
|
|
{
|
|
MountVolumeNative (volume, options, fuseMountPoint);
|
|
}
|
|
catch (NotApplicable&)
|
|
{
|
|
mountedVirtualDevice = MountAuxVolumeImage (fuseMountPoint, options);
|
|
}
|
|
}
|
|
catch (...)
|
|
{
|
|
if (mountDirCreated)
|
|
remove (mountPoint.c_str());
|
|
throw;
|
|
}
|
|
|
|
#ifndef TC_MACOSX
|
|
// set again correct ownership of the mount point to avoid any issues
|
|
if (!options.NoFilesystem && options.MountPoint)
|
|
{
|
|
mountPoint = *options.MountPoint;
|
|
|
|
if (mountPoint.find (GetDefaultMountPointPrefix()) == 0)
|
|
{
|
|
try
|
|
{
|
|
throw_sys_sub_if (chown (mountPoint.c_str(), GetRealUserId(), GetRealGroupId()) == -1, mountPoint);
|
|
} catch (...) { }
|
|
}
|
|
}
|
|
#endif
|
|
|
|
}
|
|
catch (...)
|
|
{
|
|
try
|
|
{
|
|
VolumeInfoList mountedVolumes = GetMountedVolumes (*options.Path);
|
|
if (mountedVolumes.size() > 0)
|
|
{
|
|
shared_ptr <VolumeInfo> mountedVolume (mountedVolumes.front());
|
|
DismountVolume (mountedVolume);
|
|
}
|
|
}
|
|
catch (...) { }
|
|
throw;
|
|
}
|
|
|
|
#ifdef VC_MACOSX_FUSET
|
|
VolumeInfoList mountedVolumes = GetMountedVolumes (*options.Path);
|
|
shared_ptr <VolumeInfo> mountedVolume;
|
|
if (mountedVolumes.size() == 1)
|
|
{
|
|
mountedVolume = mountedVolumes.front();
|
|
if (!mountedVirtualDevice.IsEmpty())
|
|
{
|
|
if (mountedVolume->VirtualDevice.IsEmpty())
|
|
mountedVolume->VirtualDevice = mountedVirtualDevice;
|
|
|
|
if (!options.NoFilesystem && mountedVolume->MountPoint.IsEmpty())
|
|
{
|
|
for (int mountPointRetries = 20; mountPointRetries > 0; --mountPointRetries)
|
|
{
|
|
try
|
|
{
|
|
mountedVolume->MountPoint = GetDeviceMountPoint (mountedVirtualDevice);
|
|
if (!mountedVolume->MountPoint.IsEmpty())
|
|
break;
|
|
}
|
|
catch (...) { }
|
|
|
|
Thread::Sleep (500);
|
|
}
|
|
}
|
|
}
|
|
}
|
|
else if (!mountedVirtualDevice.IsEmpty())
|
|
{
|
|
mountedVolume.reset (new VolumeInfo);
|
|
mountedVolume->Set (*volume);
|
|
mountedVolume->ProgramVersion = VERSION_NUM;
|
|
mountedVolume->SlotNumber = options.SlotNumber;
|
|
mountedVolume->AuxMountPoint = fuseMountPoint;
|
|
mountedVolume->VirtualDevice = mountedVirtualDevice;
|
|
|
|
struct timeval tv;
|
|
gettimeofday (&tv, NULL);
|
|
mountedVolume->SerialInstanceNumber = (uint64) tv.tv_sec * 1000000ULL + tv.tv_usec;
|
|
|
|
if (!options.NoFilesystem)
|
|
{
|
|
for (int mountPointRetries = 20; mountPointRetries > 0; --mountPointRetries)
|
|
{
|
|
try
|
|
{
|
|
mountedVolume->MountPoint = GetDeviceMountPoint (mountedVirtualDevice);
|
|
if (!mountedVolume->MountPoint.IsEmpty())
|
|
break;
|
|
}
|
|
catch (...) { }
|
|
|
|
Thread::Sleep (500);
|
|
}
|
|
}
|
|
}
|
|
#else
|
|
VolumeInfoList mountedVolumes = GetMountedVolumes (*options.Path);
|
|
shared_ptr <VolumeInfo> mountedVolume;
|
|
if (mountedVolumes.size() == 1)
|
|
mountedVolume = mountedVolumes.front();
|
|
#endif
|
|
if (!mountedVolume)
|
|
throw ParameterIncorrect (SRC_POS);
|
|
|
|
VolumeEventArgs eventArgs (mountedVolume);
|
|
VolumeMountedEvent.Raise (eventArgs);
|
|
|
|
return mountedVolume;
|
|
}
|
|
|
|
DevicePath CoreUnix::MountAuxVolumeImage (const DirectoryPath &auxMountPoint, const MountOptions &options) const
|
|
{
|
|
DevicePath loopDev = AttachFileToLoopDevice (string (auxMountPoint) + FuseService::GetVolumeImagePath(), options.Protection == VolumeProtection::ReadOnly);
|
|
|
|
try
|
|
{
|
|
FuseService::SendAuxDeviceInfo (auxMountPoint, loopDev, loopDev);
|
|
}
|
|
catch (...)
|
|
{
|
|
try
|
|
{
|
|
DetachLoopDevice (loopDev);
|
|
}
|
|
catch (...) { }
|
|
throw;
|
|
}
|
|
|
|
if (!options.NoFilesystem && options.MountPoint && !options.MountPoint->IsEmpty())
|
|
{
|
|
wstring filesystemType = options.FilesystemType;
|
|
|
|
#ifdef TC_LINUX
|
|
if (options.MountNtfsWithNtfs3 && filesystemType.empty()
|
|
&& DetectFilesystemType (loopDev) == "ntfs")
|
|
{
|
|
filesystemType = L"ntfs3";
|
|
}
|
|
#endif
|
|
|
|
MountFilesystem (loopDev, *options.MountPoint,
|
|
StringConverter::ToSingle (filesystemType),
|
|
options.Protection == VolumeProtection::ReadOnly,
|
|
StringConverter::ToSingle (options.FilesystemOptions));
|
|
}
|
|
|
|
return loopDev;
|
|
}
|
|
|
|
void CoreUnix::SetFileOwner (const FilesystemPath &path, const UserId &owner) const
|
|
{
|
|
throw_sys_if (chown (string (path).c_str(), owner.SystemId, (gid_t) -1) == -1);
|
|
}
|
|
|
|
DirectoryPath CoreUnix::SlotNumberToMountPoint (VolumeSlotNumber slotNumber) const
|
|
{
|
|
if (slotNumber < GetFirstSlotNumber() || slotNumber > GetLastSlotNumber())
|
|
throw ParameterIncorrect (SRC_POS);
|
|
|
|
stringstream s;
|
|
s << GetDefaultMountPointPrefix() << slotNumber;
|
|
return s.str();
|
|
}
|
|
|
|
bool CoreUnix::IsProtectedSystemDirectory (const DirectoryPath &directory) const
|
|
{
|
|
static const char* systemDirs[] = {
|
|
"/usr",
|
|
"/bin",
|
|
"/sbin",
|
|
"/lib",
|
|
#ifdef TC_LINUX
|
|
"/lib32",
|
|
"/lib64",
|
|
"/libx32",
|
|
#endif
|
|
"/etc",
|
|
"/boot",
|
|
"/root",
|
|
"/proc",
|
|
"/sys",
|
|
"/dev",
|
|
NULL
|
|
};
|
|
|
|
// Resolve any symlinks in the path
|
|
string path(directory);
|
|
char* resolvedPathCStr = realpath(path.c_str(), NULL);
|
|
if (resolvedPathCStr)
|
|
{
|
|
path = resolvedPathCStr;
|
|
free(resolvedPathCStr); // Free the allocated memory
|
|
}
|
|
|
|
// reject of the path is the root directory "/"
|
|
if (path == "/")
|
|
return true;
|
|
|
|
// Check if resolved path matches any system directory
|
|
for (int i = 0; systemDirs[i] != NULL; ++i)
|
|
{
|
|
if (path == systemDirs[i] || path.find(string(systemDirs[i]) + "/") == 0)
|
|
return true;
|
|
}
|
|
|
|
return false;
|
|
}
|
|
|
|
bool CoreUnix::IsDirectoryOnUserPath(const DirectoryPath &directory) const
|
|
{
|
|
// Obtain the PATH environment variable
|
|
const char* pathEnv = UserEnvPATH.c_str();
|
|
if (!pathEnv[0])
|
|
return false;
|
|
|
|
// Resolve the given directory
|
|
string dirPath(directory);
|
|
char* resolvedDir = realpath(dirPath.c_str(), NULL);
|
|
if (resolvedDir)
|
|
{
|
|
dirPath = resolvedDir;
|
|
free(resolvedDir);
|
|
}
|
|
|
|
// Split PATH and compare each entry
|
|
stringstream ss(pathEnv);
|
|
string token;
|
|
while (getline(ss, token, ':'))
|
|
{
|
|
// remove any trailing slashes from the token
|
|
while (!token.empty() && token.back() == '/')
|
|
token.pop_back();
|
|
|
|
if (token.empty())
|
|
continue;
|
|
|
|
// check if the directory is the same as the entry or a subdirectory
|
|
if (dirPath == token || dirPath.find(token + "/") == 0)
|
|
return true;
|
|
|
|
// handle the case where the PATH entry is a symlink
|
|
char* resolvedEntry = realpath(token.c_str(), NULL);
|
|
if (!resolvedEntry)
|
|
continue; // skip to the next entry since the path does not exist
|
|
|
|
string entryPath(resolvedEntry);
|
|
free(resolvedEntry);
|
|
|
|
// remove any trailing slashes from the token
|
|
while (!entryPath.empty() && entryPath.back() == '/')
|
|
entryPath.pop_back();
|
|
|
|
// perform check again if the resolved path is different from the original (symlink)
|
|
if (dirPath == entryPath || dirPath.find(entryPath + "/") == 0)
|
|
return true;
|
|
}
|
|
|
|
return false;
|
|
}
|
|
}
|