[pbs-devel] [PATCH v5 proxmox] Add tempfile() helper function

[Mira Limbeck <m.limbeck@proxmox.com>]

The tempfile() helper function tries to create a temporary file in /tmp
with the O_TMPFILE option. If that fails it falls back to using
mkstemp(). This happens in /tmp/proxmox-<UID> which is either created,
or if it already exists, checked for the right owner and permissions.

As O_TMPFILE was introduced in kernel 3.11 this fallback can help with
CentOS 7 and its 3.10 kernel as well as with WSL (Windows Subsystem for
Linux).

Signed-off-by: Mira Limbeck <m.limbeck@proxmox.com>
---
v5:
 - switched from AtomicBool to static mut bool
 - split O_TMPFILE and mkstemp code paths into separate functions
 - improved error handling
 - removed eprintln!()
 - fixed fd leak
v4:
 - changed directory from proxmox-backup-<UID> to proxmox-<UID>
 - added check for owner and permissions
v3:
 - O_TMPFILE support is tested on first run of tempfile()
 - EISDIR is handled specifically to test for O_TMPFILE support
 - AtomicBool is used as it provides a safe interface, but 'static mut'
     could also be used
 - mkstemp() now creates the tempfile in a subdirectory called
   proxmox-backup-<UID>

 proxmox/src/tools/fs.rs | 85 ++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 83 insertions(+), 2 deletions(-)

diff --git a/proxmox/src/tools/fs.rs b/proxmox/src/tools/fs.rs
index b1a95b5..3e9ef1e 100644
--- a/proxmox/src/tools/fs.rs
+++ b/proxmox/src/tools/fs.rs
@@ -1,17 +1,19 @@
 //! File related utilities such as `replace_file`.
 
 use std::ffi::CStr;
-use std::fs::{File, OpenOptions};
+use std::fs::{DirBuilder, File, OpenOptions};
 use std::io::{self, BufRead, BufReader, Write};
+use std::os::unix::fs::{DirBuilderExt, MetadataExt, OpenOptionsExt, PermissionsExt};
 use std::os::unix::io::{AsRawFd, FromRawFd, RawFd};
 use std::path::Path;
 use std::time::Duration;
 
 use anyhow::{bail, format_err, Error};
+use lazy_static::lazy_static;
 use nix::errno::Errno;
 use nix::fcntl::OFlag;
 use nix::sys::stat;
-use nix::unistd::{self, Gid, Uid};
+use nix::unistd::{self, geteuid, mkstemp, unlink, Gid, Uid};
 use serde_json::Value;
 
 use crate::sys::error::SysResult;
@@ -518,3 +520,82 @@ pub fn open_file_locked<P: AsRef<Path>>(path: P, timeout: Duration) -> Result<Fi
         Err(err) => bail!("Unable to acquire lock {:?} - {}", path, err),
     }
 }
+
+// Only ever set to 'false' if O_TMPFILE is not supported. As we never set it to 'true' again
+// once it is set to 'false', the eventual consistency provided by a static mut bool (x86) is
+// enough. Worst-case: multiple threads will try O_TMPFILE first before switching to mkstemp().
+static mut O_TMPFILE_SUPPORT: bool = true;
+lazy_static! {
+    static ref MKSTEMP_PATH: String = {
+        let uid = geteuid();
+        format!("/tmp/proxmox-{}", uid)
+    };
+    static ref MKSTEMP_FILE: String = format!("{}/tmpfile_XXXXXX", MKSTEMP_PATH.as_str());
+}
+
+/// Create a new tempfile by using O_TMPFILE with a fallback to mkstemp() if it fails
+/// (e.g. not supported).
+pub fn tempfile() -> Result<File, Error> {
+    if unsafe { O_TMPFILE_SUPPORT } {
+        create_tempfile_otmpfile()
+    } else {
+        create_tempfile_mkstemp()
+    }
+    .map_err(|err| format_err!("create tempfile failed: {}", err))
+}
+
+fn create_tempfile_otmpfile() -> Result<File, Error> {
+    match std::fs::OpenOptions::new()
+        .write(true)
+        .read(true)
+        .custom_flags(libc::O_TMPFILE)
+        .open("/tmp")
+    {
+        Ok(file) => Ok(file),
+        Err(ref err) if err.raw_os_error() == Some(libc::EISDIR) => {
+            unsafe {
+                O_TMPFILE_SUPPORT = false;
+            }
+            create_tempfile_mkstemp()
+        }
+        Err(err) => Err(err.into()),
+    }
+}
+
+fn create_tempfile_mkstemp() -> Result<File, Error> {
+    if let Err(err) = DirBuilder::new().mode(0o700).create(MKSTEMP_PATH.as_str()) {
+        if err.kind() != std::io::ErrorKind::AlreadyExists {
+            bail!(
+                "create directory '{}' failed: '{}'",
+                MKSTEMP_PATH.as_str(),
+                err
+            );
+        } else {
+            // check owner
+            let metadata = std::fs::metadata(MKSTEMP_PATH.as_str())?;
+            if metadata.uid() != geteuid().as_raw() {
+                bail!(
+                    "directory '{}' has wrong owner: {}",
+                    MKSTEMP_PATH.as_str(),
+                    metadata.uid()
+                );
+            }
+
+            // check permissions
+            let perm = metadata.permissions();
+            if (perm.mode() & 0o077) != 0 {
+                bail!(
+                    "directory '{}' has invalid permissions: {:o}",
+                    MKSTEMP_PATH.as_str(),
+                    perm.mode() & 0o777
+                );
+            }
+        }
+    }
+
+    let (fd, path) =
+        mkstemp(MKSTEMP_FILE.as_str()).map_err(|err| format_err!("mkstemp() failed: {}", err))?;
+    let file = unsafe { File::from_raw_fd(fd) };
+    unlink(path.as_path()).map_err(|err| format_err!("unlink() failed: {}", err))?;
+    Ok(file)
+}
-- 
2.20.1