[pbs-devel] [PATCH v5 proxmox] Add tempfile() helper function

[pbs-devel] [PATCH v5 proxmox] Add tempfile() helper function

[Mira Limbeck]

The tempfile() helper function tries to create a temporary file in /tmp
with the O_TMPFILE option. If that fails it falls back to using
mkstemp(). This happens in /tmp/proxmox-<UID> which is either created,
or if it already exists, checked for the right owner and permissions.

As O_TMPFILE was introduced in kernel 3.11 this fallback can help with
CentOS 7 and its 3.10 kernel as well as with WSL (Windows Subsystem for
Linux).

Signed-off-by: Mira Limbeck <m.limbeck@proxmox.com>
---
v5:
 - switched from AtomicBool to static mut bool
 - split O_TMPFILE and mkstemp code paths into separate functions
 - improved error handling
 - removed eprintln!()
 - fixed fd leak
v4:
 - changed directory from proxmox-backup-<UID> to proxmox-<UID>
 - added check for owner and permissions
v3:
 - O_TMPFILE support is tested on first run of tempfile()
 - EISDIR is handled specifically to test for O_TMPFILE support
 - AtomicBool is used as it provides a safe interface, but 'static mut'
     could also be used
 - mkstemp() now creates the tempfile in a subdirectory called
   proxmox-backup-<UID>

 proxmox/src/tools/fs.rs | 85 ++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 83 insertions(+), 2 deletions(-)

diff --git a/proxmox/src/tools/fs.rs b/proxmox/src/tools/fs.rs
index b1a95b5..3e9ef1e 100644
--- a/proxmox/src/tools/fs.rs
+++ b/proxmox/src/tools/fs.rs
@@ -1,17 +1,19 @@
 //! File related utilities such as `replace_file`.
 
 use std::ffi::CStr;
-use std::fs::{File, OpenOptions};
+use std::fs::{DirBuilder, File, OpenOptions};
 use std::io::{self, BufRead, BufReader, Write};
+use std::os::unix::fs::{DirBuilderExt, MetadataExt, OpenOptionsExt, PermissionsExt};
 use std::os::unix::io::{AsRawFd, FromRawFd, RawFd};
 use std::path::Path;
 use std::time::Duration;
 
 use anyhow::{bail, format_err, Error};
+use lazy_static::lazy_static;
 use nix::errno::Errno;
 use nix::fcntl::OFlag;
 use nix::sys::stat;
-use nix::unistd::{self, Gid, Uid};
+use nix::unistd::{self, geteuid, mkstemp, unlink, Gid, Uid};
 use serde_json::Value;
 
 use crate::sys::error::SysResult;
@@ -518,3 +520,82 @@ pub fn open_file_locked<P: AsRef<Path>>(path: P, timeout: Duration) -> Result<Fi
         Err(err) => bail!("Unable to acquire lock {:?} - {}", path, err),
     }
 }
+
+// Only ever set to 'false' if O_TMPFILE is not supported. As we never set it to 'true' again
+// once it is set to 'false', the eventual consistency provided by a static mut bool (x86) is
+// enough. Worst-case: multiple threads will try O_TMPFILE first before switching to mkstemp().
+static mut O_TMPFILE_SUPPORT: bool = true;
+lazy_static! {
+    static ref MKSTEMP_PATH: String = {
+        let uid = geteuid();
+        format!("/tmp/proxmox-{}", uid)
+    };
+    static ref MKSTEMP_FILE: String = format!("{}/tmpfile_XXXXXX", MKSTEMP_PATH.as_str());
+}
+
+/// Create a new tempfile by using O_TMPFILE with a fallback to mkstemp() if it fails
+/// (e.g. not supported).
+pub fn tempfile() -> Result<File, Error> {
+    if unsafe { O_TMPFILE_SUPPORT } {
+        create_tempfile_otmpfile()
+    } else {
+        create_tempfile_mkstemp()
+    }
+    .map_err(|err| format_err!("create tempfile failed: {}", err))
+}
+
+fn create_tempfile_otmpfile() -> Result<File, Error> {
+    match std::fs::OpenOptions::new()
+        .write(true)
+        .read(true)
+        .custom_flags(libc::O_TMPFILE)
+        .open("/tmp")
+    {
+        Ok(file) => Ok(file),
+        Err(ref err) if err.raw_os_error() == Some(libc::EISDIR) => {
+            unsafe {
+                O_TMPFILE_SUPPORT = false;
+            }
+            create_tempfile_mkstemp()
+        }
+        Err(err) => Err(err.into()),
+    }
+}
+
+fn create_tempfile_mkstemp() -> Result<File, Error> {
+    if let Err(err) = DirBuilder::new().mode(0o700).create(MKSTEMP_PATH.as_str()) {
+        if err.kind() != std::io::ErrorKind::AlreadyExists {
+            bail!(
+                "create directory '{}' failed: '{}'",
+                MKSTEMP_PATH.as_str(),
+                err
+            );
+        } else {
+            // check owner
+            let metadata = std::fs::metadata(MKSTEMP_PATH.as_str())?;
+            if metadata.uid() != geteuid().as_raw() {
+                bail!(
+                    "directory '{}' has wrong owner: {}",
+                    MKSTEMP_PATH.as_str(),
+                    metadata.uid()
+                );
+            }
+
+            // check permissions
+            let perm = metadata.permissions();
+            if (perm.mode() & 0o077) != 0 {
+                bail!(
+                    "directory '{}' has invalid permissions: {:o}",
+                    MKSTEMP_PATH.as_str(),
+                    perm.mode() & 0o777
+                );
+            }
+        }
+    }
+
+    let (fd, path) =
+        mkstemp(MKSTEMP_FILE.as_str()).map_err(|err| format_err!("mkstemp() failed: {}", err))?;
+    let file = unsafe { File::from_raw_fd(fd) };
+    unlink(path.as_path()).map_err(|err| format_err!("unlink() failed: {}", err))?;
+    Ok(file)
+}
-- 
2.20.1

[pbs-devel] [PATCH v5 proxmox-backup] Replace all occurences of open() with O_TMPFILE

[Mira Limbeck]

with the tempfile() helper function from proxmox::tools. This abstracts
away the open() and adds a fallback to mkstemp() should open() with
O_TMPFILE fail.

This helps in getting the backup client to work under WSL (Windows
Subsystem for Linux).

Signed-off-by: Mira Limbeck <m.limbeck@proxmox.com>
---
This requires the tempfile() addition in the proxmox crate to work.

v5:
 - no changes
v4:
 - no changes
v3:
 - no changes

 src/bin/proxmox_backup_client/catalog.rs | 20 ++++----------------
 src/client/backup_reader.rs              | 21 ++++-----------------
 src/client/backup_writer.rs              | 15 +++------------
 3 files changed, 11 insertions(+), 45 deletions(-)

diff --git a/src/bin/proxmox_backup_client/catalog.rs b/src/bin/proxmox_backup_client/catalog.rs
index b419728e..15df232b 100644
--- a/src/bin/proxmox_backup_client/catalog.rs
+++ b/src/bin/proxmox_backup_client/catalog.rs
@@ -1,4 +1,3 @@
-use std::os::unix::fs::OpenOptionsExt;
 use std::io::{Seek, SeekFrom};
 use std::sync::Arc;
 
@@ -6,6 +5,7 @@ use anyhow::{bail, format_err, Error};
 use serde_json::Value;
 
 use proxmox::api::{api, cli::*};
+use proxmox::tools::fs::tempfile;
 
 use proxmox_backup::tools;
 
@@ -103,11 +103,7 @@ async fn dump_catalog(param: Value) -> Result<Value, Error> {
 
     let mut reader = BufferedDynamicReader::new(index, chunk_reader);
 
-    let mut catalogfile = std::fs::OpenOptions::new()
-        .write(true)
-        .read(true)
-        .custom_flags(libc::O_TMPFILE)
-        .open("/tmp")?;
+    let mut catalogfile = tempfile()?;
 
     std::io::copy(&mut reader, &mut catalogfile)
         .map_err(|err| format_err!("unable to download catalog - {}", err))?;
@@ -192,11 +188,7 @@ async fn catalog_shell(param: Value) -> Result<(), Error> {
         true,
     ).await?;
 
-    let mut tmpfile = std::fs::OpenOptions::new()
-        .write(true)
-        .read(true)
-        .custom_flags(libc::O_TMPFILE)
-        .open("/tmp")?;
+    let mut tmpfile = tempfile()?;
 
     let (manifest, _) = client.download_manifest().await?;
 
@@ -224,11 +216,7 @@ async fn catalog_shell(param: Value) -> Result<(), Error> {
     let file_info = manifest.lookup_file_info(&CATALOG_NAME)?;
     let chunk_reader = RemoteChunkReader::new(client.clone(), crypt_config, file_info.chunk_crypt_mode(), most_used);
     let mut reader = BufferedDynamicReader::new(index, chunk_reader);
-    let mut catalogfile = std::fs::OpenOptions::new()
-        .write(true)
-        .read(true)
-        .custom_flags(libc::O_TMPFILE)
-        .open("/tmp")?;
+    let mut catalogfile = tempfile()?;
 
     std::io::copy(&mut reader, &mut catalogfile)
         .map_err(|err| format_err!("unable to download catalog - {}", err))?;
diff --git a/src/client/backup_reader.rs b/src/client/backup_reader.rs
index d4185716..45370141 100644
--- a/src/client/backup_reader.rs
+++ b/src/client/backup_reader.rs
@@ -2,13 +2,12 @@ use anyhow::{format_err, Error};
 use std::io::{Read, Write, Seek, SeekFrom};
 use std::fs::File;
 use std::sync::Arc;
-use std::os::unix::fs::OpenOptionsExt;
 
 use chrono::{DateTime, Utc};
 use futures::future::AbortHandle;
 use serde_json::{json, Value};
 
-use proxmox::tools::digest_to_hex;
+use proxmox::tools::{digest_to_hex, fs::tempfile};
 
 use crate::backup::*;
 
@@ -148,11 +147,7 @@ impl BackupReader {
         name: &str,
     ) -> Result<DataBlobReader<File>, Error> {
 
-        let mut tmpfile = std::fs::OpenOptions::new()
-            .write(true)
-            .read(true)
-            .custom_flags(libc::O_TMPFILE)
-            .open("/tmp")?;
+        let mut tmpfile = tempfile()?;
 
         self.download(name, &mut tmpfile).await?;
 
@@ -174,11 +169,7 @@ impl BackupReader {
         name: &str,
     ) -> Result<DynamicIndexReader, Error> {
 
-        let mut tmpfile = std::fs::OpenOptions::new()
-            .write(true)
-            .read(true)
-            .custom_flags(libc::O_TMPFILE)
-            .open("/tmp")?;
+        let mut tmpfile = tempfile()?;
 
         self.download(name, &mut tmpfile).await?;
 
@@ -202,11 +193,7 @@ impl BackupReader {
         name: &str,
     ) -> Result<FixedIndexReader, Error> {
 
-        let mut tmpfile = std::fs::OpenOptions::new()
-            .write(true)
-            .read(true)
-            .custom_flags(libc::O_TMPFILE)
-            .open("/tmp")?;
+        let mut tmpfile = tempfile()?;
 
         self.download(name, &mut tmpfile).await?;
 
diff --git a/src/client/backup_writer.rs b/src/client/backup_writer.rs
index 38686f67..e04ad56a 100644
--- a/src/client/backup_writer.rs
+++ b/src/client/backup_writer.rs
@@ -1,5 +1,4 @@
 use std::collections::HashSet;
-use std::os::unix::fs::OpenOptionsExt;
 use std::sync::atomic::{AtomicUsize, Ordering};
 use std::sync::{Arc, Mutex};
 
@@ -12,7 +11,7 @@ use serde_json::{json, Value};
 use tokio::io::AsyncReadExt;
 use tokio::sync::{mpsc, oneshot};
 
-use proxmox::tools::digest_to_hex;
+use proxmox::tools::{digest_to_hex, fs::tempfile};
 
 use super::merge_known_chunks::{MergedChunkInfo, MergeKnownChunks};
 use crate::backup::*;
@@ -408,11 +407,7 @@ impl BackupWriter {
         known_chunks: Arc<Mutex<HashSet<[u8;32]>>>,
     ) -> Result<FixedIndexReader, Error> {
 
-        let mut tmpfile = std::fs::OpenOptions::new()
-            .write(true)
-            .read(true)
-            .custom_flags(libc::O_TMPFILE)
-            .open("/tmp")?;
+        let mut tmpfile = tempfile()?;
 
         let param = json!({ "archive-name": archive_name });
         self.h2.download("previous", Some(param), &mut tmpfile).await?;
@@ -443,11 +438,7 @@ impl BackupWriter {
         known_chunks: Arc<Mutex<HashSet<[u8;32]>>>,
     ) -> Result<DynamicIndexReader, Error> {
 
-        let mut tmpfile = std::fs::OpenOptions::new()
-            .write(true)
-            .read(true)
-            .custom_flags(libc::O_TMPFILE)
-            .open("/tmp")?;
+        let mut tmpfile = tempfile()?;
 
         let param = json!({ "archive-name": archive_name });
         self.h2.download("previous", Some(param), &mut tmpfile).await?;
-- 
2.20.1