/[pkgs]/devel/coreutils/coreutils-selinux.patch
ViewVC logotype

Contents of /devel/coreutils/coreutils-selinux.patch

Parent Directory Parent Directory | Revision Log Revision Log

Revision 1.62 - (show annotations) (download) (as text)
Wed Oct 7 08:11:44 2009 UTC (6 weeks, 6 days ago) by ovasik
Branch: MAIN
CVS Tags: coreutils-8_0-1_fc13, coreutils-8_0-2_fc13
Changes since 1.61: +12329 -610 lines
File MIME type: text/x-patch 
defuzz patches
1 diff -urNp coreutils-8.0-orig/configure.ac coreutils-8.0/configure.ac
2 --- coreutils-8.0-orig/configure.ac 2009-10-07 10:09:43.000000000 +0200
3 +++ coreutils-8.0/configure.ac 2009-10-07 10:10:11.000000000 +0200
4 @@ -122,6 +122,13 @@ AC_ARG_ENABLE(pam, dnl
5 LIB_PAM="-ldl -lpam -lpam_misc"
6 AC_SUBST(LIB_PAM)])
7
8 +dnl Give the chance to enable SELINUX
9 +AC_ARG_ENABLE(selinux, dnl
10 +[ --enable-selinux Enable use of the SELINUX libraries],
11 +[AC_DEFINE(WITH_SELINUX, 1, [Define if you want to use SELINUX])
12 +LIB_SELINUX="-lselinux"
13 +AC_SUBST(LIB_SELINUX)])
14 +
15 AC_FUNC_FORK
16
17 optional_bin_progs=
18 diff -urNp coreutils-8.0-orig/configure.ac.orig coreutils-8.0/configure.ac.orig
19 --- coreutils-8.0-orig/configure.ac.orig 2009-10-07 10:09:43.000000000 +0200
20 +++ coreutils-8.0/configure.ac.orig 2009-10-07 10:09:43.000000000 +0200
21 @@ -115,6 +115,13 @@ if test "$gl_gcc_warnings" = yes; then
22 AC_DEFINE([GNULIB_PORTCHECK], [1], [enable some gnulib portability checks])
23 fi
24
25 +dnl Give the chance to enable PAM
26 +AC_ARG_ENABLE(pam, dnl
27 +[ --enable-pam Enable use of the PAM libraries],
28 +[AC_DEFINE(USE_PAM, 1, [Define if you want to use PAM])
29 +LIB_PAM="-ldl -lpam -lpam_misc"
30 +AC_SUBST(LIB_PAM)])
31 +
32 AC_FUNC_FORK
33
34 optional_bin_progs=
35 diff -urNp coreutils-8.0-orig/man/chcon.x coreutils-8.0/man/chcon.x
36 --- coreutils-8.0-orig/man/chcon.x 2009-09-01 13:01:16.000000000 +0200
37 +++ coreutils-8.0/man/chcon.x 2009-10-07 10:10:11.000000000 +0200
38 @@ -1,4 +1,4 @@
39 [NAME]
40 -chcon \- change file security context
41 +chcon \- change file SELinux security context
42 [DESCRIPTION]
43 .\" Add any additional description here
44 diff -urNp coreutils-8.0-orig/man/runcon.x coreutils-8.0/man/runcon.x
45 --- coreutils-8.0-orig/man/runcon.x 2009-09-01 13:01:16.000000000 +0200
46 +++ coreutils-8.0/man/runcon.x 2009-10-07 10:10:11.000000000 +0200
47 @@ -1,5 +1,5 @@
48 [NAME]
49 -runcon \- run command with specified security context
50 +runcon \- run command with specified SELinux security context
51 [DESCRIPTION]
52 Run COMMAND with completely-specified CONTEXT, or with current or
53 transitioned security context modified by one or more of LEVEL,
54 diff -urNp coreutils-8.0-orig/src/copy.c coreutils-8.0/src/copy.c
55 --- coreutils-8.0-orig/src/copy.c 2009-09-29 15:27:54.000000000 +0200
56 +++ coreutils-8.0/src/copy.c 2009-10-07 10:10:11.000000000 +0200
57 @@ -1943,6 +1943,8 @@ copy_internal (char const *src_name, cha
58 {
59 /* Here, we are crossing a file system boundary and cp's -x option
60 is in effect: so don't copy the contents of this directory. */
61 + if (x->preserve_security_context)
62 + restore_default_fscreatecon_or_die ();
63 }
64 else
65 {
66 diff -urNp coreutils-8.0-orig/src/copy.c.orig coreutils-8.0/src/copy.c.orig
67 --- coreutils-8.0-orig/src/copy.c.orig 1970-01-01 01:00:00.000000000 +0100
68 +++ coreutils-8.0/src/copy.c.orig 2009-09-29 15:27:54.000000000 +0200
69 @@ -0,0 +1,2369 @@
70 +/* copy.c -- core functions for copying files and directories
71 + Copyright (C) 89, 90, 91, 1995-2009 Free Software Foundation, Inc.
72 +
73 + This program is free software: you can redistribute it and/or modify
74 + it under the terms of the GNU General Public License as published by
75 + the Free Software Foundation, either version 3 of the License, or
76 + (at your option) any later version.
77 +
78 + This program is distributed in the hope that it will be useful,
79 + but WITHOUT ANY WARRANTY; without even the implied warranty of
80 + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
81 + GNU General Public License for more details.
82 +
83 + You should have received a copy of the GNU General Public License
84 + along with this program. If not, see <http://www.gnu.org/licenses/>. */
85 +
86 +/* Extracted from cp.c and librarified by Jim Meyering. */
87 +
88 +#include <config.h>
89 +#include <stdio.h>
90 +#include <assert.h>
91 +#include <sys/types.h>
92 +#include <selinux/selinux.h>
93 +
94 +#if HAVE_HURD_H
95 +# include <hurd.h>
96 +#endif
97 +#if HAVE_PRIV_H
98 +# include <priv.h>
99 +#endif
100 +
101 +#include "system.h"
102 +#include "acl.h"
103 +#include "backupfile.h"
104 +#include "buffer-lcm.h"
105 +#include "copy.h"
106 +#include "cp-hash.h"
107 +#include "error.h"
108 +#include "fcntl--.h"
109 +#include "file-set.h"
110 +#include "filemode.h"
111 +#include "filenamecat.h"
112 +#include "full-write.h"
113 +#include "hash.h"
114 +#include "hash-triple.h"
115 +#include "ignore-value.h"
116 +#include "quote.h"
117 +#include "same.h"
118 +#include "savedir.h"
119 +#include "stat-time.h"
120 +#include "utimecmp.h"
121 +#include "utimens.h"
122 +#include "write-any-file.h"
123 +#include "areadlink.h"
124 +#include "yesno.h"
125 +
126 +#if USE_XATTR
127 +# include <attr/error_context.h>
128 +# include <attr/libattr.h>
129 +# include <stdarg.h>
130 +# include "verror.h"
131 +#endif
132 +
133 +#if HAVE_SYS_IOCTL_H
134 +# include <sys/ioctl.h>
135 +#endif
136 +
137 +#ifndef HAVE_FCHOWN
138 +# define HAVE_FCHOWN false
139 +# define fchown(fd, uid, gid) (-1)
140 +#endif
141 +
142 +#ifndef HAVE_LCHOWN
143 +# define HAVE_LCHOWN false
144 +# define lchown(name, uid, gid) chown (name, uid, gid)
145 +#endif
146 +
147 +#ifndef HAVE_MKFIFO
148 +static int
149 +rpl_mkfifo (char const *file, mode_t mode)
150 +{
151 + errno = ENOTSUP;
152 + return -1;
153 +}
154 +# define mkfifo rpl_mkfifo
155 +#endif
156 +
157 +#ifndef USE_ACL
158 +# define USE_ACL 0
159 +#endif
160 +
161 +#define SAME_OWNER(A, B) ((A).st_uid == (B).st_uid)
162 +#define SAME_GROUP(A, B) ((A).st_gid == (B).st_gid)
163 +#define SAME_OWNER_AND_GROUP(A, B) (SAME_OWNER (A, B) && SAME_GROUP (A, B))
164 +
165 +struct dir_list
166 +{
167 + struct dir_list *parent;
168 + ino_t ino;
169 + dev_t dev;
170 +};
171 +
172 +/* Initial size of the cp.dest_info hash table. */
173 +#define DEST_INFO_INITIAL_CAPACITY 61
174 +
175 +static bool copy_internal (char const *src_name, char const *dst_name,
176 + bool new_dst, dev_t device,
177 + struct dir_list *ancestors,
178 + const struct cp_options *x,
179 + bool command_line_arg,
180 + bool *first_dir_created_per_command_line_arg,
181 + bool *copy_into_self,
182 + bool *rename_succeeded);
183 +static bool owner_failure_ok (struct cp_options const *x);
184 +
185 +/* Pointers to the file names: they're used in the diagnostic that is issued
186 + when we detect the user is trying to copy a directory into itself. */
187 +static char const *top_level_src_name;
188 +static char const *top_level_dst_name;
189 +
190 +/* Set the timestamp of symlink, FILE, to TIMESPEC.
191 + If this system lacks support for that, simply return 0. */
192 +static inline int
193 +utimens_symlink (char const *file, struct timespec const *timespec)
194 +{
195 + int err = 0;
196 +
197 +#if HAVE_UTIMENSAT
198 + err = utimensat (AT_FDCWD, file, timespec, AT_SYMLINK_NOFOLLOW);
199 + /* When configuring on a system with new headers and libraries, and
200 + running on one with a kernel that is old enough to lack the syscall,
201 + utimensat fails with ENOSYS. Ignore that. */
202 + if (err && errno == ENOSYS)
203 + err = 0;
204 +#else
205 + (void) file;
206 + (void) timespec;
207 +#endif
208 +
209 + return err;
210 +}
211 +
212 +/* Perform the O(1) btrfs clone operation, if possible.
213 + Upon success, return 0. Otherwise, return -1 and set errno. */
214 +static inline int
215 +clone_file (int dest_fd, int src_fd)
216 +{
217 +#ifdef __linux__
218 +# undef BTRFS_IOCTL_MAGIC
219 +# define BTRFS_IOCTL_MAGIC 0x94
220 +# undef BTRFS_IOC_CLONE
221 +# define BTRFS_IOC_CLONE _IOW (BTRFS_IOCTL_MAGIC, 9, int)
222 + return ioctl (dest_fd, BTRFS_IOC_CLONE, src_fd);
223 +#else
224 + (void) dest_fd;
225 + (void) src_fd;
226 + errno = ENOTSUP;
227 + return -1;
228 +#endif
229 +}
230 +
231 +/* FIXME: describe */
232 +/* FIXME: rewrite this to use a hash table so we avoid the quadratic
233 + performance hit that's probably noticeable only on trees deeper
234 + than a few hundred levels. See use of active_dir_map in remove.c */
235 +
236 +static bool
237 +is_ancestor (const struct stat *sb, const struct dir_list *ancestors)
238 +{
239 + while (ancestors != 0)
240 + {
241 + if (ancestors->ino == sb->st_ino && ancestors->dev == sb->st_dev)
242 + return true;
243 + ancestors = ancestors->parent;
244 + }
245 + return false;
246 +}
247 +
248 +static bool
249 +errno_unsupported (int err)
250 +{
251 + return err == ENOTSUP || err == ENODATA;
252 +}
253 +
254 +#if USE_XATTR
255 +static void
256 +copy_attr_error (struct error_context *ctx ATTRIBUTE_UNUSED,
257 + char const *fmt, ...)
258 +{
259 + int err = errno;
260 + va_list ap;
261 +
262 + if (!errno_unsupported (errno))
263 + {
264 + /* use verror module to print error message */
265 + va_start (ap, fmt);
266 + verror (0, err, fmt, ap);
267 + va_end (ap);
268 + }
269 +}
270 +
271 +static void
272 +copy_attr_allerror (struct error_context *ctx ATTRIBUTE_UNUSED,
273 + char const *fmt, ...)
274 +{
275 + int err = errno;
276 + va_list ap;
277 +
278 + /* use verror module to print error message */
279 + va_start (ap, fmt);
280 + verror (0, err, fmt, ap);
281 + va_end (ap);
282 +}
283 +
284 +static char const *
285 +copy_attr_quote (struct error_context *ctx ATTRIBUTE_UNUSED, char const *str)
286 +{
287 + return quote (str);
288 +}
289 +
290 +static void
291 +copy_attr_free (struct error_context *ctx ATTRIBUTE_UNUSED,
292 + char const *str ATTRIBUTE_UNUSED)
293 +{
294 +}
295 +
296 +static bool
297 +copy_attr_by_fd (char const *src_path, int src_fd,
298 + char const *dst_path, int dst_fd, const struct cp_options *x)
299 +{
300 + struct error_context ctx =
301 + {
302 + .error = x->require_preserve_xattr ? copy_attr_allerror : copy_attr_error,
303 + .quote = copy_attr_quote,
304 + .quote_free = copy_attr_free
305 + };
306 + return 0 == attr_copy_fd (src_path, src_fd, dst_path, dst_fd, 0,
307 + (x->reduce_diagnostics
308 + && !x->require_preserve_xattr)? NULL : &ctx);
309 +}
310 +
311 +static bool
312 +copy_attr_by_name (char const *src_path, char const *dst_path,
313 + const struct cp_options *x)
314 +{
315 + struct error_context ctx =
316 + {
317 + .error = x->require_preserve_xattr ? copy_attr_allerror : copy_attr_error,
318 + .quote = copy_attr_quote,
319 + .quote_free = copy_attr_free
320 + };
321 + return 0 == attr_copy_file (src_path, dst_path, 0,
322 + (x-> reduce_diagnostics
323 + && !x->require_preserve_xattr) ? NULL : &ctx);
324 +}
325 +#else /* USE_XATTR */
326 +
327 +static bool
328 +copy_attr_by_fd (char const *src_path ATTRIBUTE_UNUSED,
329 + int src_fd ATTRIBUTE_UNUSED,
330 + char const *dst_path ATTRIBUTE_UNUSED,
331 + int dst_fd ATTRIBUTE_UNUSED,
332 + const struct cp_options *x ATTRIBUTE_UNUSED)
333 +{
334 + return true;
335 +}
336 +
337 +static bool
338 +copy_attr_by_name (char const *src_path ATTRIBUTE_UNUSED,
339 + char const *dst_path ATTRIBUTE_UNUSED,
340 + const struct cp_options *x ATTRIBUTE_UNUSED)
341 +{
342 + return true;
343 +}
344 +#endif /* USE_XATTR */
345 +
346 +/* Read the contents of the directory SRC_NAME_IN, and recursively
347 + copy the contents to DST_NAME_IN. NEW_DST is true if
348 + DST_NAME_IN is a directory that was created previously in the
349 + recursion. SRC_SB and ANCESTORS describe SRC_NAME_IN.
350 + Set *COPY_INTO_SELF if SRC_NAME_IN is a parent of
351 + FIRST_DIR_CREATED_PER_COMMAND_LINE_ARG FIXME
352 + (or the same as) DST_NAME_IN; otherwise, clear it.
353 + Return true if successful. */
354 +
355 +static bool
356 +copy_dir (char const *src_name_in, char const *dst_name_in, bool new_dst,
357 + const struct stat *src_sb, struct dir_list *ancestors,
358 + const struct cp_options *x,
359 + bool *first_dir_created_per_command_line_arg,
360 + bool *copy_into_self)
361 +{
362 + char *name_space;
363 + char *namep;
364 + struct cp_options non_command_line_options = *x;
365 + bool ok = true;
366 +
367 + name_space = savedir (src_name_in);
368 + if (name_space == NULL)
369 + {
370 + /* This diagnostic is a bit vague because savedir can fail in
371 + several different ways. */
372 + error (0, errno, _("cannot access %s"), quote (src_name_in));
373 + return false;
374 + }
375 +
376 + /* For cp's -H option, dereference command line arguments, but do not
377 + dereference symlinks that are found via recursive traversal. */
378 + if (x->dereference == DEREF_COMMAND_LINE_ARGUMENTS)
379 + non_command_line_options.dereference = DEREF_NEVER;
380 +
381 + namep = name_space;
382 + while (*namep != '\0')
383 + {
384 + bool local_copy_into_self;
385 + char *src_name = file_name_concat (src_name_in, namep, NULL);
386 + char *dst_name = file_name_concat (dst_name_in, namep, NULL);
387 +
388 + ok &= copy_internal (src_name, dst_name, new_dst, src_sb->st_dev,
389 + ancestors, &non_command_line_options, false,
390 + first_dir_created_per_command_line_arg,
391 + &local_copy_into_self, NULL);
392 + *copy_into_self |= local_copy_into_self;
393 +
394 + free (dst_name);
395 + free (src_name);
396 +
397 + /* If we're copying into self, there's no point in continuing,
398 + and in fact, that would even infloop, now that we record only
399 + the first created directory per command line argument. */
400 + if (local_copy_into_self)
401 + break;
402 +
403 + namep += strlen (namep) + 1;
404 + }
405 + free (name_space);
406 + return ok;
407 +}
408 +
409 +/* Set the owner and owning group of DEST_DESC to the st_uid and
410 + st_gid fields of SRC_SB. If DEST_DESC is undefined (-1), set
411 + the owner and owning group of DST_NAME instead; for
412 + safety prefer lchown if the system supports it since no
413 + symbolic links should be involved. DEST_DESC must
414 + refer to the same file as DEST_NAME if defined.
415 + Upon failure to set both UID and GID, try to set only the GID.
416 + NEW_DST is true if the file was newly created; otherwise,
417 + DST_SB is the status of the destination.
418 + Return 1 if the initial syscall succeeds, 0 if it fails but it's OK
419 + not to preserve ownership, -1 otherwise. */
420 +
421 +static int
422 +set_owner (const struct cp_options *x, char const *dst_name, int dest_desc,
423 + struct stat const *src_sb, bool new_dst,
424 + struct stat const *dst_sb)
425 +{
426 + uid_t uid = src_sb->st_uid;
427 + gid_t gid = src_sb->st_gid;
428 +
429 + /* Naively changing the ownership of an already-existing file before
430 + changing its permissions would create a window of vulnerability if
431 + the file's old permissions are too generous for the new owner and
432 + group. Avoid the window by first changing to a restrictive
433 + temporary mode if necessary. */
434 +
435 + if (!new_dst && (x->preserve_mode || x->move_mode || x->set_mode))
436 + {
437 + mode_t old_mode = dst_sb->st_mode;
438 + mode_t new_mode =
439 + (x->preserve_mode || x->move_mode ? src_sb->st_mode : x->mode);
440 + mode_t restrictive_temp_mode = old_mode & new_mode & S_IRWXU;
441 +
442 + if ((USE_ACL
443 + || (old_mode & CHMOD_MODE_BITS
444 + & (~new_mode | S_ISUID | S_ISGID | S_ISVTX)))
445 + && qset_acl (dst_name, dest_desc, restrictive_temp_mode) != 0)
446 + {
447 + if (! owner_failure_ok (x))
448 + error (0, errno, _("clearing permissions for %s"), quote (dst_name));
449 + return -x->require_preserve;
450 + }
451 + }
452 +
453 + if (HAVE_FCHOWN && dest_desc != -1)
454 + {
455 + if (fchown (dest_desc, uid, gid) == 0)
456 + return 1;
457 + if (errno == EPERM || errno == EINVAL)
458 + {
459 + /* We've failed to set *both*. Now, try to set just the group
460 + ID, but ignore any failure here, and don't change errno. */
461 + int saved_errno = errno;
462 + ignore_value (fchown (dest_desc, -1, gid));
463 + errno = saved_errno;
464 + }
465 + }
466 + else
467 + {
468 + if (lchown (dst_name, uid, gid) == 0)
469 + return 1;
470 + if (errno == EPERM || errno == EINVAL)
471 + {
472 + /* We've failed to set *both*. Now, try to set just the group
473 + ID, but ignore any failure here, and don't change errno. */
474 + int saved_errno = errno;
475 + ignore_value (lchown (dst_name, -1, gid));
476 + errno = saved_errno;
477 + }
478 + }
479 +
480 + if (! chown_failure_ok (x))
481 + {
482 + error (0, errno, _("failed to preserve ownership for %s"),
483 + quote (dst_name));
484 + if (x->require_preserve)
485 + return -1;
486 + }
487 +
488 + return 0;
489 +}
490 +
491 +/* Set the st_author field of DEST_DESC to the st_author field of
492 + SRC_SB. If DEST_DESC is undefined (-1), set the st_author field
493 + of DST_NAME instead. DEST_DESC must refer to the same file as
494 + DEST_NAME if defined. */
495 +
496 +static void
497 +set_author (const char *dst_name, int dest_desc, const struct stat *src_sb)
498 +{
499 +#if HAVE_STRUCT_STAT_ST_AUTHOR
500 + /* FIXME: Modify the following code so that it does not
501 + follow symbolic links. */
502 +
503 + /* Preserve the st_author field. */
504 + file_t file = (dest_desc < 0
505 + ? file_name_lookup (dst_name, 0, 0)
506 + : getdport (dest_desc));
507 + if (file == MACH_PORT_NULL)
508 + error (0, errno, _("failed to lookup file %s"), quote (dst_name));
509 + else
510 + {
511 + error_t err = file_chauthor (file, src_sb->st_author);
512 + if (err)
513 + error (0, err, _("failed to preserve authorship for %s"),
514 + quote (dst_name));
515 + mach_port_deallocate (mach_task_self (), file);
516 + }
517 +#else
518 + (void) dst_name;
519 + (void) dest_desc;
520 + (void) src_sb;
521 +#endif
522 +}
523 +
524 +/* Change the file mode bits of the file identified by DESC or NAME to MODE.
525 + Use DESC if DESC is valid and fchmod is available, NAME otherwise. */
526 +
527 +static int
528 +fchmod_or_lchmod (int desc, char const *name, mode_t mode)
529 +{
530 +#if HAVE_FCHMOD
531 + if (0 <= desc)
532 + return fchmod (desc, mode);
533 +#endif
534 + return lchmod (name, mode);
535 +}
536 +
537 +/* Copy a regular file from SRC_NAME to DST_NAME.
538 + If the source file contains holes, copies holes and blocks of zeros
539 + in the source file as holes in the destination file.
540 + (Holes are read as zeroes by the `read' system call.)
541 + When creating the destination, use DST_MODE & ~OMITTED_PERMISSIONS
542 + as the third argument in the call to open, adding
543 + OMITTED_PERMISSIONS after copying as needed.
544 + X provides many option settings.
545 + Return true if successful.
546 + *NEW_DST is as in copy_internal.
547 + SRC_SB is the result of calling XSTAT (aka stat) on SRC_NAME. */
548 +
549 +static bool
550 +copy_reg (char const *src_name, char const *dst_name,
551 + const struct cp_options *x,
552 + mode_t dst_mode, mode_t omitted_permissions, bool *new_dst,
553 + struct stat const *src_sb)
554 +{
555 + char *buf;
556 + char *buf_alloc = NULL;
557 + char *name_alloc = NULL;
558 + int dest_desc;
559 + int dest_errno;
560 + int source_desc;
561 + mode_t src_mode = src_sb->st_mode;
562 + struct stat sb;
563 + struct stat src_open_sb;
564 + bool return_val = true;
565 + bool data_copy_required = true;
566 +
567 + source_desc = open (src_name,
568 + (O_RDONLY | O_BINARY
569 + | (x->dereference == DEREF_NEVER ? O_NOFOLLOW : 0)));
570 + if (source_desc < 0)
571 + {
572 + error (0, errno, _("cannot open %s for reading"), quote (src_name));
573 + return false;
574 + }
575 +
576 + if (fstat (source_desc, &src_open_sb) != 0)
577 + {
578 + error (0, errno, _("cannot fstat %s"), quote (src_name));
579 + return_val = false;
580 + goto close_src_desc;
581 + }
582 +
583 + /* Compare the source dev/ino from the open file to the incoming,
584 + saved ones obtained via a previous call to stat. */
585 + if (! SAME_INODE (*src_sb, src_open_sb))
586 + {
587 + error (0, 0,
588 + _("skipping file %s, as it was replaced while being copied"),
589 + quote (src_name));
590 + return_val = false;
591 + goto close_src_desc;
592 + }
593 +
594 + /* The semantics of the following open calls are mandated
595 + by the specs for both cp and mv. */
596 + if (! *new_dst)
597 + {
598 + dest_desc = open (dst_name, O_WRONLY | O_TRUNC | O_BINARY);
599 + dest_errno = errno;
600 +
601 + /* When using cp --preserve=context to copy to an existing destination,
602 + use the default context rather than that of the source. Why?
603 + 1) the src context may prohibit writing, and
604 + 2) because it's more consistent to use the same context
605 + that is used when the destination file doesn't already exist. */
606 + if (x->preserve_security_context && 0 <= dest_desc)
607 + {
608 + security_context_t con = NULL;
609 + if (getfscreatecon (&con) < 0)
610 + {
611 + if (!x->reduce_diagnostics || x->require_preserve_context)
612 + error (0, errno, _("failed to get file system create context"));
613 + if (x->require_preserve_context)
614 + {
615 + return_val = false;
616 + goto close_src_and_dst_desc;
617 + }
618 + }
619 +
620 + if (con)
621 + {
622 + if (fsetfilecon (dest_desc, con) < 0)
623 + {
624 + if (!x->reduce_diagnostics || x->require_preserve_context)
625 + error (0, errno,
626 + _("failed to set the security context of %s to %s"),
627 + quote_n (0, dst_name), quote_n (1, con));
628 + if (x->require_preserve_context)
629 + {
630 + return_val = false;
631 + freecon (con);
632 + goto close_src_and_dst_desc;
633 + }
634 + }
635 + freecon (con);
636 + }
637 + }
638 +
639 + if (dest_desc < 0 && x->unlink_dest_after_failed_open)
640 + {
641 + if (unlink (dst_name) != 0)
642 + {
643 + error (0, errno, _("cannot remove %s"), quote (dst_name));
644 + return_val = false;
645 + goto close_src_desc;
646 + }
647 + if (x->verbose)
648 + printf (_("removed %s\n"), quote (dst_name));
649 +
650 + /* Tell caller that the destination file was unlinked. */
651 + *new_dst = true;
652 + }
653 + }
654 +
655 + if (*new_dst)
656 + {
657 + int open_flags = O_WRONLY | O_CREAT | O_BINARY;
658 + dest_desc = open (dst_name, open_flags | O_EXCL,
659 + dst_mode & ~omitted_permissions);
660 + dest_errno = errno;
661 +
662 + /* When trying to copy through a dangling destination symlink,
663 + the above open fails with EEXIST. If that happens, and
664 + lstat'ing the DST_NAME shows that it is a symlink, then we
665 + have a problem: trying to resolve this dangling symlink to
666 + a directory/destination-entry pair is fundamentally racy,
667 + so punt. If POSIXLY_CORRECT is set, simply call open again,
668 + but without O_EXCL (potentially dangerous). If not, fail
669 + with a diagnostic. These shenanigans are necessary only
670 + when copying, i.e., not in move_mode. */
671 + if (dest_desc < 0 && dest_errno == EEXIST && ! x->move_mode)
672 + {
673 + struct stat dangling_link_sb;
674 + if (lstat (dst_name, &dangling_link_sb) == 0
675 + && S_ISLNK (dangling_link_sb.st_mode))
676 + {
677 + if (x->open_dangling_dest_symlink)
678 + {
679 + dest_desc = open (dst_name, open_flags,
680 + dst_mode & ~omitted_permissions);
681 + dest_errno = errno;
682 + }
683 + else
684 + {
685 + error (0, 0, _("not writing through dangling symlink %s"),
686 + quote (dst_name));
687 + return_val = false;
688 + goto close_src_desc;
689 + }
690 + }
691 + }
692 + }
693 + else
694 + omitted_permissions = 0;
695 +
696 + if (dest_desc < 0)
697 + {
698 + error (0, dest_errno, _("cannot create regular file %s"),
699 + quote (dst_name));
700 + return_val = false;
701 + goto close_src_desc;
702 + }
703 +
704 + if (fstat (dest_desc, &sb) != 0)
705 + {
706 + error (0, errno, _("cannot fstat %s"), quote (dst_name));
707 + return_val = false;
708 + goto close_src_and_dst_desc;
709 + }
710 +
711 + if (x->reflink_mode)
712 + {
713 + bool clone_ok = clone_file (dest_desc, source_desc) == 0;
714 + if (clone_ok || x->reflink_mode == REFLINK_ALWAYS)
715 + {
716 + if (!clone_ok)
717 + {
718 + error (0, errno, _("failed to clone %s"), quote (dst_name));
719 + return_val = false;
720 + goto close_src_and_dst_desc;
721 + }
722 + data_copy_required = false;
723 + }
724 + }
725 +
726 + if (data_copy_required)
727 + {
728 + typedef uintptr_t word;
729 + off_t n_read_total = 0;
730 +
731 + /* Choose a suitable buffer size; it may be adjusted later. */
732 + size_t buf_alignment = lcm (getpagesize (), sizeof (word));
733 + size_t buf_alignment_slop = sizeof (word) + buf_alignment - 1;
734 + size_t buf_size = io_blksize (sb);
735 +
736 + /* Deal with sparse files. */
737 + bool last_write_made_hole = false;
738 + bool make_holes = false;
739 +
740 + if (S_ISREG (sb.st_mode))
741 + {
742 + /* Even with --sparse=always, try to create holes only
743 + if the destination is a regular file. */
744 + if (x->sparse_mode == SPARSE_ALWAYS)
745 + make_holes = true;
746 +
747 +#if HAVE_STRUCT_STAT_ST_BLOCKS
748 + /* Use a heuristic to determine whether SRC_NAME contains any sparse
749 + blocks. If the file has fewer blocks than would normally be
750 + needed for a file of its size, then at least one of the blocks in
751 + the file is a hole. */
752 + if (x->sparse_mode == SPARSE_AUTO && S_ISREG (src_open_sb.st_mode)
753 + && ST_NBLOCKS (src_open_sb) < src_open_sb.st_size / ST_NBLOCKSIZE)
754 + make_holes = true;
755 +#endif
756 + }
757 +
758 + /* If not making a sparse file, try to use a more-efficient
759 + buffer size. */
760 + if (! make_holes)
761 + {
762 + /* Compute the least common multiple of the input and output
763 + buffer sizes, adjusting for outlandish values. */
764 + size_t blcm_max = MIN (SIZE_MAX, SSIZE_MAX) - buf_alignment_slop;
765 + size_t blcm = buffer_lcm (io_blksize (src_open_sb), buf_size,
766 + blcm_max);
767 +
768 + /* Do not bother with a buffer larger than the input file, plus one
769 + byte to make sure the file has not grown while reading it. */
770 + if (S_ISREG (src_open_sb.st_mode) && src_open_sb.st_size < buf_size)
771 + buf_size = src_open_sb.st_size + 1;
772 +
773 + /* However, stick with a block size that is a positive multiple of
774 + blcm, overriding the above adjustments. Watch out for
775 + overflow. */
776 + buf_size += blcm - 1;
777 + buf_size -= buf_size % blcm;
778 + if (buf_size == 0 || blcm_max < buf_size)
779 + buf_size = blcm;
780 + }
781 +
782 + /* Make a buffer with space for a sentinel at the end. */
783 + buf_alloc = xmalloc (buf_size + buf_alignment_slop);
784 + buf = ptr_align (buf_alloc, buf_alignment);
785 +
786 + for (;;)
787 + {
788 + word *wp = NULL;
789 +
790 + ssize_t n_read = read (source_desc, buf, buf_size);
791 + if (n_read < 0)
792 + {
793 +#ifdef EINTR
794 + if (errno == EINTR)
795 + continue;
796 +#endif
797 + error (0, errno, _("reading %s"), quote (src_name));
798 + return_val = false;
799 + goto close_src_and_dst_desc;
800 + }
801 + if (n_read == 0)
802 + break;
803 +
804 + n_read_total += n_read;
805 +
806 + if (make_holes)
807 + {
808 + char *cp;
809 +
810 + /* Sentinel to stop loop. */
811 + buf[n_read] = '\1';
812 +#ifdef lint
813 + /* Usually, buf[n_read] is not the byte just before a "word"
814 + (aka uintptr_t) boundary. In that case, the word-oriented
815 + test below (*wp++ == 0) would read some uninitialized bytes
816 + after the sentinel. To avoid false-positive reports about
817 + this condition (e.g., from a tool like valgrind), set the
818 + remaining bytes -- to any value. */
819 + memset (buf + n_read + 1, 0, sizeof (word) - 1);
820 +#endif
821 +
822 + /* Find first nonzero *word*, or the word with the sentinel. */
823 +
824 + wp = (word *) buf;
825 + while (*wp++ == 0)
826 + continue;
827 +
828 + /* Find the first nonzero *byte*, or the sentinel. */
829 +
830 + cp = (char *) (wp - 1);
831 + while (*cp++ == 0)
832 + continue;
833 +
834 + if (cp <= buf + n_read)
835 + /* Clear to indicate that a normal write is needed. */
836 + wp = NULL;
837 + else
838 + {
839 + /* We found the sentinel, so the whole input block was zero.
840 + Make a hole. */
841 + if (lseek (dest_desc, n_read, SEEK_CUR) < 0)
842 + {
843 + error (0, errno, _("cannot lseek %s"), quote (dst_name));
844 + return_val = false;
845 + goto close_src_and_dst_desc;
846 + }
847 + last_write_made_hole = true;
848 + }
849 + }
850 +
851 + if (!wp)
852 + {
853 + size_t n = n_read;
854 + if (full_write (dest_desc, buf, n) != n)
855 + {
856 + error (0, errno, _("writing %s"), quote (dst_name));
857 + return_val = false;
858 + goto close_src_and_dst_desc;
859 + }
860 + last_write_made_hole = false;
861 +
862 + /* It is tempting to return early here upon a short read from a
863 + regular file. That would save the final read syscall for each
864 + file. Unfortunately that doesn't work for certain files in
865 + /proc with linux kernels from at least 2.6.9 .. 2.6.29. */
866 + }
867 + }
868 +
869 + /* If the file ends with a `hole', we need to do something to record
870 + the length of the file. On modern systems, calling ftruncate does
871 + the job. On systems without native ftruncate support, we have to
872 + write a byte at the ending position. Otherwise the kernel would
873 + truncate the file at the end of the last write operation. */
874 +
875 + if (last_write_made_hole)
876 + {
877 + if (HAVE_FTRUNCATE
878 + ? /* ftruncate sets the file size,
879 + so there is no need for a write. */
880 + ftruncate (dest_desc, n_read_total) < 0
881 + : /* Seek backwards one character and write a null. */
882 + (lseek (dest_desc, (off_t) -1, SEEK_CUR) < 0L
883 + || full_write (dest_desc, "", 1) != 1))
884 + {
885 + error (0, errno, _("writing %s"), quote (dst_name));
886 + return_val = false;
887 + goto close_src_and_dst_desc;
888 + }
889 + }
890 + }
891 +
892 + if (x->preserve_timestamps)
893 + {
894 + struct timespec timespec[2];
895 + timespec[0] = get_stat_atime (src_sb);
896 + timespec[1] = get_stat_mtime (src_sb);
897 +
898 + if (gl_futimens (dest_desc, dst_name, timespec) != 0)
899 + {
900 + error (0, errno, _("preserving times for %s"), quote (dst_name));
901 + if (x->require_preserve)
902 + {
903 + return_val = false;
904 + goto close_src_and_dst_desc;
905 + }
906 + }
907 + }
908 +
909 + /* To allow copying xattrs on read-only files, temporarily chmod u+rw.
910 + This workaround is required as an inode permission check is done
911 + by xattr_permission() in fs/xattr.c of the GNU/Linux kernel tree. */
912 + if (x->preserve_xattr)
913 + {
914 + bool access_changed = false;
915 +
916 + if (!(sb.st_mode & S_IWUSR) && geteuid() != 0)
917 + access_changed = fchmod_or_lchmod (dest_desc, dst_name, 0600) == 0;
918 +
919 + if (!copy_attr_by_fd (src_name, source_desc, dst_name, dest_desc, x)
920 + && x->require_preserve_xattr)
921 + return_val = false;
922 +
923 + if (access_changed)
924 + fchmod_or_lchmod (dest_desc, dst_name, dst_mode & ~omitted_permissions);
925 + }
926 +
927 + if (x->preserve_ownership && ! SAME_OWNER_AND_GROUP (*src_sb, sb))
928 + {
929 + switch (set_owner (x, dst_name, dest_desc, src_sb, *new_dst, &sb))
930 + {
931 + case -1:
932 + return_val = false;
933 + goto close_src_and_dst_desc;
934 +
935 + case 0:
936 + src_mode &= ~ (S_ISUID | S_ISGID | S_ISVTX);
937 + break;
938 + }
939 + }
940 +
941 + set_author (dst_name, dest_desc, src_sb);
942 +
943 + if (x->preserve_mode || x->move_mode)
944 + {
945 + if (copy_acl (src_name, source_desc, dst_name, dest_desc, src_mode) != 0
946 + && x->require_preserve)
947 + return_val = false;
948 + }
949 + else if (x->set_mode)
950 + {
951 + if (set_acl (dst_name, dest_desc, x->mode) != 0)
952 + return_val = false;
953 + }
954 + else if (omitted_permissions)
955 + {
956 + omitted_permissions &= ~ cached_umask ();
957 + if (omitted_permissions
958 + && fchmod_or_lchmod (dest_desc, dst_name, dst_mode) != 0)
959 + {
960 + error (0, errno, _("preserving permissions for %s"),
961 + quote (dst_name));
962 + if (x->require_preserve)
963 + return_val = false;
964 + }
965 + }
966 +
967 +close_src_and_dst_desc:
968 + if (close (dest_desc) < 0)
969 + {
970 + error (0, errno, _("closing %s"), quote (dst_name));
971 + return_val = false;
972 + }
973 +close_src_desc:
974 + if (close (source_desc) < 0)
975 + {
976 + error (0, errno, _("closing %s"), quote (src_name));
977 + return_val = false;
978 + }
979 +
980 + free (buf_alloc);
981 + free (name_alloc);
982 + return return_val;
983 +}
984 +
985 +/* Return true if it's ok that the source and destination
986 + files are the `same' by some measure. The goal is to avoid
987 + making the `copy' operation remove both copies of the file
988 + in that case, while still allowing the user to e.g., move or
989 + copy a regular file onto a symlink that points to it.
990 + Try to minimize the cost of this function in the common case.
991 + Set *RETURN_NOW if we've determined that the caller has no more
992 + work to do and should return successfully, right away.
993 +
994 + Set *UNLINK_SRC if we've determined that the caller wants to do
995 + `rename (a, b)' where `a' and `b' are distinct hard links to the same
996 + file. In that case, the caller should try to unlink `a' and then return
997 + successfully. Ideally, we wouldn't have to do that, and we'd be
998 + able to rely on rename to remove the source file. However, POSIX
999 + mistakenly requires that such a rename call do *nothing* and return
1000 + successfully. */
1001 +
1002 +static bool
1003 +same_file_ok (char const *src_name, struct stat const *src_sb,
1004 + char const *dst_name, struct stat const *dst_sb,
1005 + const struct cp_options *x, bool *return_now, bool *unlink_src)
1006 +{
1007 + const struct stat *src_sb_link;
1008 + const struct stat *dst_sb_link;
1009 + struct stat tmp_dst_sb;
1010 + struct stat tmp_src_sb;
1011 +
1012 + bool same_link;
1013 + bool same = SAME_INODE (*src_sb, *dst_sb);
1014 +
1015 + *return_now = false;
1016 + *unlink_src = false;
1017 +
1018 + /* FIXME: this should (at the very least) be moved into the following
1019 + if-block. More likely, it should be removed, because it inhibits
1020 + making backups. But removing it will result in a change in behavior
1021 + that will probably have to be documented -- and tests will have to
1022 + be updated. */
1023 + if (same && x->hard_link)
1024 + {
1025 + *return_now = true;
1026 + return true;
1027 + }
1028 +
1029 + if (x->dereference == DEREF_NEVER)
1030 + {
1031 + same_link = same;
1032 +
1033 + /* If both the source and destination files are symlinks (and we'll
1034 + know this here IFF preserving symlinks), then it's ok -- as long
1035 + as they are distinct. */
1036 + if (S_ISLNK (src_sb->st_mode) && S_ISLNK (dst_sb->st_mode))
1037 + return ! same_name (src_name, dst_name);
1038 +
1039 + src_sb_link = src_sb;
1040 + dst_sb_link = dst_sb;
1041 + }
1042 + else
1043 + {
1044 + if (!same)
1045 + return true;
1046 +
1047 + if (lstat (dst_name, &tmp_dst_sb) != 0
1048 + || lstat (src_name, &tmp_src_sb) != 0)
1049 + return true;
1050 +
1051 + src_sb_link = &tmp_src_sb;
1052 + dst_sb_link = &tmp_dst_sb;
1053 +
1054 + same_link = SAME_INODE (*src_sb_link, *dst_sb_link);
1055 +
1056 + /* If both are symlinks, then it's ok, but only if the destination
1057 + will be unlinked before being opened. This is like the test
1058 + above, but with the addition of the unlink_dest_before_opening
1059 + conjunct because otherwise, with two symlinks to the same target,
1060 + we'd end up truncating the source file. */
1061 + if (S_ISLNK (src_sb_link->st_mode) && S_ISLNK (dst_sb_link->st_mode)
1062 + && x->unlink_dest_before_opening)
1063 + return true;
1064 + }
1065 +
1066 + /* The backup code ensures there's a copy, so it's usually ok to
1067 + remove any destination file. One exception is when both
1068 + source and destination are the same directory entry. In that
1069 + case, moving the destination file aside (in making the backup)
1070 + would also rename the source file and result in an error. */
1071 + if (x->backup_type != no_backups)
1072 + {
1073 + if (!same_link)
1074 + {
1075 + /* In copy mode when dereferencing symlinks, if the source is a
1076 + symlink and the dest is not, then backing up the destination
1077 + (moving it aside) would make it a dangling symlink, and the
1078 + subsequent attempt to open it in copy_reg would fail with
1079 + a misleading diagnostic. Avoid that by returning zero in
1080 + that case so the caller can make cp (or mv when it has to
1081 + resort to reading the source file) fail now. */
1082 +
1083 + /* FIXME-note: even with the following kludge, we can still provoke
1084 + the offending diagnostic. It's just a little harder to do :-)
1085 + $ rm -f a b c; touch c; ln -s c b; ln -s b a; cp -b a b
1086 + cp: cannot open `a' for reading: No such file or directory
1087 + That's misleading, since a subsequent `ls' shows that `a'
1088 + is still there.
1089 + One solution would be to open the source file *before* moving
1090 + aside the destination, but that'd involve a big rewrite. */
1091 + if ( ! x->move_mode
1092 + && x->dereference != DEREF_NEVER
1093 + && S_ISLNK (src_sb_link->st_mode)
1094 + && ! S_ISLNK (dst_sb_link->st_mode))
1095 + return false;
1096 +
1097 + return true;
1098 + }
1099 +
1100 + return ! same_name (src_name, dst_name);
1101 + }
1102 +
1103 +#if 0
1104 + /* FIXME: use or remove */
1105 +
1106 + /* If we're making a backup, we'll detect the problem case in
1107 + copy_reg because SRC_NAME will no longer exist. Allowing
1108 + the test to be deferred lets cp do some useful things.
1109 + But when creating hardlinks and SRC_NAME is a symlink
1110 + but DST_NAME is not we must test anyway. */
1111 + if (x->hard_link
1112 + || !S_ISLNK (src_sb_link->st_mode)
1113 + || S_ISLNK (dst_sb_link->st_mode))
1114 + return true;
1115 +
1116 + if (x->dereference != DEREF_NEVER)
1117 + return true;
1118 +#endif
1119 +
1120 + /* They may refer to the same file if we're in move mode and the
1121 + target is a symlink. That is ok, since we remove any existing
1122 + destination file before opening it -- via `rename' if they're on
1123 + the same file system, via `unlink (DST_NAME)' otherwise.
1124 + It's also ok if they're distinct hard links to the same file. */
1125 + if (x->move_mode || x->unlink_dest_before_opening)
1126 + {
1127 + if (S_ISLNK (dst_sb_link->st_mode))
1128 + return true;
1129 +
1130 + if (same_link
1131 + && 1 < dst_sb_link->st_nlink
1132 + && ! same_name (src_name, dst_name))
1133 + {
1134 + if (x->move_mode)
1135 + {
1136 + *unlink_src = true;
1137 + *return_now = true;
1138 + }
1139 + return true;
1140 + }
1141 + }
1142 +
1143 + /* If neither is a symlink, then it's ok as long as they aren't
1144 + hard links to the same file. */
1145 + if (!S_ISLNK (src_sb_link->st_mode) && !S_ISLNK (dst_sb_link->st_mode))
1146 + {
1147 + if (!SAME_INODE (*src_sb_link, *dst_sb_link))
1148 + return true;
1149 +
1150 + /* If they are the same file, it's ok if we're making hard links. */
1151 + if (x->hard_link)
1152 + {
1153 + *return_now = true;
1154 + return true;
1155 + }
1156 + }
1157 +
1158 + /* It's ok to remove a destination symlink. But that works only when we
1159 + unlink before opening the destination and when the source and destination
1160 + files are on the same partition. */
1161 + if (x->unlink_dest_before_opening
1162 + && S_ISLNK (dst_sb_link->st_mode))
1163 + return dst_sb_link->st_dev == src_sb_link->st_dev;
1164 +
1165 + if (x->dereference == DEREF_NEVER)
1166 + {
1167 + if ( ! S_ISLNK (src_sb_link->st_mode))
1168 + tmp_src_sb = *src_sb_link;
1169 + else if (stat (src_name, &tmp_src_sb) != 0)
1170 + return true;
1171 +
1172 + if ( ! S_ISLNK (dst_sb_link->st_mode))
1173 + tmp_dst_sb = *dst_sb_link;
1174 + else if (stat (dst_name, &tmp_dst_sb) != 0)
1175 + return true;
1176 +
1177 + if ( ! SAME_INODE (tmp_src_sb, tmp_dst_sb))
1178 + return true;
1179 +
1180 + /* FIXME: shouldn't this be testing whether we're making symlinks? */
1181 + if (x->hard_link)
1182 + {
1183 + *return_now = true;
1184 + return true;
1185 + }
1186 + }
1187 +
1188 + return false;
1189 +}
1190 +
1191 +/* Return true if FILE, with mode MODE, is writable in the sense of 'mv'.
1192 + Always consider a symbolic link to be writable. */
1193 +static bool
1194 +writable_destination (char const *file, mode_t mode)
1195 +{
1196 + return (S_ISLNK (mode)
1197 + || can_write_any_file ()
1198 + || euidaccess (file, W_OK) == 0);
1199 +}
1200 +
1201 +static void
1202 +overwrite_prompt (char const *dst_name, struct stat const *dst_sb)
1203 +{
1204 + if (! writable_destination (dst_name, dst_sb->st_mode))
1205 + {
1206 + char perms[12]; /* "-rwxrwxrwx " ls-style modes. */
1207 + strmode (dst_sb->st_mode, perms);
1208 + perms[10] = '\0';
1209 + fprintf (stderr,
1210 + _("%s: try to overwrite %s, overriding mode %04lo (%s)? "),
1211 + program_name, quote (dst_name),
1212 + (unsigned long int) (dst_sb->st_mode & CHMOD_MODE_BITS),
1213 + &perms[1]);
1214 + }
1215 + else
1216 + {
1217 + fprintf (stderr, _("%s: overwrite %s? "),
1218 + program_name, quote (dst_name));
1219 + }
1220 +}
1221 +
1222 +/* Initialize the hash table implementing a set of F_triple entries
1223 + corresponding to destination files. */
1224 +extern void
1225 +dest_info_init (struct cp_options *x)
1226 +{
1227 + x->dest_info
1228 + = hash_initialize (DEST_INFO_INITIAL_CAPACITY,
1229 + NULL,
1230 + triple_hash,
1231 + triple_compare,
1232 + triple_free);
1233 +}
1234 +
1235 +/* Initialize the hash table implementing a set of F_triple entries
1236 + corresponding to source files listed on the command line. */
1237 +extern void
1238 +src_info_init (struct cp_options *x)
1239 +{
1240 +
1241 + /* Note that we use triple_hash_no_name here.
1242 + Contrast with the use of triple_hash above.
1243 + That is necessary because a source file may be specified
1244 + in many different ways. We want to warn about this
1245 + cp a a d/
1246 + as well as this:
1247 + cp a ./a d/
1248 + */
1249 + x->src_info
1250 + = hash_initialize (DEST_INFO_INITIAL_CAPACITY,
1251 + NULL,
1252 + triple_hash_no_name,
1253 + triple_compare,
1254 + triple_free);
1255 +}
1256 +
1257 +/* When effecting a move (e.g., for mv(1)), and given the name DST_NAME
1258 + of the destination and a corresponding stat buffer, DST_SB, return
1259 + true if the logical `move' operation should _not_ proceed.
1260 + Otherwise, return false.
1261 + Depending on options specified in X, this code may issue an
1262 + interactive prompt asking whether it's ok to overwrite DST_NAME. */
1263 +static bool
1264 +abandon_move (const struct cp_options *x,
1265 + char const *dst_name,
1266 + struct stat const *dst_sb)
1267 +{
1268 + assert (x->move_mode);
1269 + return (x->interactive == I_ALWAYS_NO
1270 + || ((x->interactive == I_ASK_USER
1271 + || (x->interactive == I_UNSPECIFIED
1272 + && x->stdin_tty
1273 + && ! writable_destination (dst_name, dst_sb->st_mode)))
1274 + && (overwrite_prompt (dst_name, dst_sb), 1)
1275 + && ! yesno ()));
1276 +}
1277 +
1278 +/* Print --verbose output on standard output, e.g. `new' -> `old'.
1279 + If BACKUP_DST_NAME is non-NULL, then also indicate that it is
1280 + the name of a backup file. */
1281 +static void
1282 +emit_verbose (char const *src, char const *dst, char const *backup_dst_name)
1283 +{
1284 + printf ("%s -> %s", quote_n (0, src), quote_n (1, dst));
1285 + if (backup_dst_name)
1286 + printf (_(" (backup: %s)"), quote (backup_dst_name));
1287 + putchar ('\n');
1288 +}
1289 +
1290 +/* A wrapper around "setfscreatecon (NULL)" that exits upon failure. */
1291 +static void
1292 +restore_default_fscreatecon_or_die (void)
1293 +{
1294 + if (setfscreatecon (NULL) != 0)
1295 + error (EXIT_FAILURE, errno,
1296 + _("failed to restore the default file creation context"));
1297 +}
1298 +
1299 +/* Copy the file SRC_NAME to the file DST_NAME. The files may be of
1300 + any type. NEW_DST should be true if the file DST_NAME cannot
1301 + exist because its parent directory was just created; NEW_DST should
1302 + be false if DST_NAME might already exist. DEVICE is the device
1303 + number of the parent directory, or 0 if the parent of this file is
1304 + not known. ANCESTORS points to a linked, null terminated list of
1305 + devices and inodes of parent directories of SRC_NAME. COMMAND_LINE_ARG
1306 + is true iff SRC_NAME was specified on the command line.
1307 + FIRST_DIR_CREATED_PER_COMMAND_LINE_ARG is both input and output.
1308 + Set *COPY_INTO_SELF if SRC_NAME is a parent of (or the
1309 + same as) DST_NAME; otherwise, clear it.
1310 + Return true if successful. */
1311 +static bool
1312 +copy_internal (char const *src_name, char const *dst_name,
1313 + bool new_dst,
1314 + dev_t device,
1315 + struct dir_list *ancestors,
1316 + const struct cp_options *x,
1317 + bool command_line_arg,
1318 + bool *first_dir_created_per_command_line_arg,
1319 + bool *copy_into_self,
1320 + bool *rename_succeeded)
1321 +{
1322 + struct stat src_sb;
1323 + struct stat dst_sb;
1324 + mode_t src_mode;
1325 + mode_t dst_mode IF_LINT (= 0);
1326 + mode_t dst_mode_bits;
1327 + mode_t omitted_permissions;
1328 + bool restore_dst_mode = false;
1329 + char *earlier_file = NULL;
1330 + char *dst_backup = NULL;
1331 + bool backup_succeeded = false;
1332 + bool delayed_ok;
1333 + bool copied_as_regular = false;
1334 + bool dest_is_symlink = false;
1335 + bool have_dst_lstat = false;
1336 +
1337 + if (x->move_mode && rename_succeeded)
1338 + *rename_succeeded = false;
1339 +
1340 + *copy_into_self = false;
1341 +
1342 + if (XSTAT (x, src_name, &src_sb) != 0)
1343 + {
1344 + error (0, errno, _("cannot stat %s"), quote (src_name));
1345 + return false;
1346 + }
1347 +
1348 + src_mode = src_sb.st_mode;
1349 +
1350 + if (S_ISDIR (src_mode) && !x->recursive)
1351 + {
1352 + error (0, 0, _("omitting directory %s"), quote (src_name));
1353 + return false;
1354 + }
1355 +
1356 + /* Detect the case in which the same source file appears more than
1357 + once on the command line and no backup option has been selected.
1358 + If so, simply warn and don't copy it the second time.
1359 + This check is enabled only if x->src_info is non-NULL. */
1360 + if (command_line_arg)
1361 + {
1362 + if ( ! S_ISDIR (src_sb.st_mode)
1363 + && x->backup_type == no_backups
1364 + && seen_file (x->src_info, src_name, &src_sb))
1365 + {
1366 + error (0, 0, _("warning: source file %s specified more than once"),
1367 + quote (src_name));
1368 + return true;
1369 + }
1370 +
1371 + record_file (x->src_info, src_name, &src_sb);
1372 + }
1373 +
1374 + if (!new_dst)
1375 + {
1376 + /* Regular files can be created by writing through symbolic
1377 + links, but other files cannot. So use stat on the
1378 + destination when copying a regular file, and lstat otherwise.
1379 + However, if we intend to unlink or remove the destination
1380 + first, use lstat, since a copy won't actually be made to the
1381 + destination in that case. */
1382 + bool use_stat =
1383 + ((S_ISREG (src_mode)
1384 + || (x->copy_as_regular
1385 + && ! (S_ISDIR (src_mode) || S_ISLNK (src_mode))))
1386 + && ! (x->move_mode || x->symbolic_link || x->hard_link
1387 + || x->backup_type != no_backups
1388 + || x->unlink_dest_before_opening));
1389 + if ((use_stat
1390 + ? stat (dst_name, &dst_sb)
1391 + : lstat (dst_name, &dst_sb))
1392 + != 0)
1393 + {
1394 + if (errno != ENOENT)
1395 + {
1396 + error (0, errno, _("cannot stat %s"), quote (dst_name));
1397 + return false;
1398 + }
1399 + else
1400 + {
1401 + new_dst = true;
1402 + }
1403 + }
1404 + else
1405 + { /* Here, we know that dst_name exists, at least to the point
1406 + that it is stat'able or lstat'able. */
1407 + bool return_now;
1408 + bool unlink_src;
1409 +
1410 + have_dst_lstat = !use_stat;
1411 + if (! same_file_ok (src_name, &src_sb, dst_name, &dst_sb,
1412 + x, &return_now, &unlink_src))
1413 + {
1414 + error (0, 0, _("%s and %s are the same file"),
1415 + quote_n (0, src_name), quote_n (1, dst_name));
1416 + return false;
1417 + }
1418 +
1419 + if (!S_ISDIR (src_mode) && x->update)
1420 + {
1421 + /* When preserving time stamps (but not moving within a file
1422 + system), don't worry if the destination time stamp is
1423 + less than the source merely because of time stamp
1424 + truncation. */
1425 + int options = ((x->preserve_timestamps
1426 + && ! (x->move_mode
1427 + && dst_sb.st_dev == src_sb.st_dev))
1428 + ? UTIMECMP_TRUNCATE_SOURCE
1429 + : 0);
1430 +
1431 + if (0 <= utimecmp (dst_name, &dst_sb, &src_sb, options))
1432 + {
1433 + /* We're using --update and the destination is not older
1434 + than the source, so do not copy or move. Pretend the
1435 + rename succeeded, so the caller (if it's mv) doesn't
1436 + end up removing the source file. */
1437 + if (rename_succeeded)
1438 + *rename_succeeded = true;
1439 + return true;
1440 + }
1441 + }
1442 +
1443 + /* When there is an existing destination file, we may end up
1444 + returning early, and hence not copying/moving the file.
1445 + This may be due to an interactive `negative' reply to the
1446 + prompt about the existing file. It may also be due to the
1447 + use of the --reply=no option.
1448 +
1449 + cp and mv treat -i and -f differently. */
1450 + if (x->move_mode)
1451 + {
1452 + if (abandon_move (x, dst_name, &dst_sb)
1453 + || (unlink_src && unlink (src_name) == 0))
1454 + {
1455 + /* Pretend the rename succeeded, so the caller (mv)
1456 + doesn't end up removing the source file. */
1457 + if (rename_succeeded)
1458 + *rename_succeeded = true;
1459 + if (unlink_src && x->verbose)
1460 + printf (_("removed %s\n"), quote (src_name));
1461 + return true;
1462 + }
1463 + if (unlink_src)
1464 + {
1465 + error (0, errno, _("cannot remove %s"), quote (src_name));
1466 + return false;
1467 + }
1468 + }
1469 + else
1470 + {
1471 + if (! S_ISDIR (src_mode)
1472 + && (x->interactive == I_ALWAYS_NO
1473 + || (x->interactive == I_ASK_USER
1474 + && (overwrite_prompt (dst_name, &dst_sb), 1)
1475 + && ! yesno ())))
1476 + return true;
1477 + }
1478 +
1479 + if (return_now)
1480 + return true;
1481 +
1482 + if (!S_ISDIR (dst_sb.st_mode))
1483 + {
1484 + if (S_ISDIR (src_mode))
1485 + {
1486 + if (x->move_mode && x->backup_type != no_backups)
1487 + {
1488 + /* Moving a directory onto an existing
1489 + non-directory is ok only with --backup. */
1490 + }
1491 + else
1492 + {
1493 + error (0, 0,
1494 + _("cannot overwrite non-directory %s with directory %s"),
1495 + quote_n (0, dst_name), quote_n (1, src_name));
1496 + return false;
1497 + }
1498 + }
1499 +
1500 + /* Don't let the user destroy their data, even if they try hard:
1501 + This mv command must fail (likewise for cp):
1502 + rm -rf a b c; mkdir a b c; touch a/f b/f; mv a/f b/f c
1503 + Otherwise, the contents of b/f would be lost.
1504 + In the case of `cp', b/f would be lost if the user simulated
1505 + a move using cp and rm.
1506 + Note that it works fine if you use --backup=numbered. */
1507 + if (command_line_arg
1508 + && x->backup_type != numbered_backups
1509 + && seen_file (x->dest_info, dst_name, &dst_sb))
1510 + {
1511 + error (0, 0,
1512 + _("will not overwrite just-created %s with %s"),
1513 + quote_n (0, dst_name), quote_n (1, src_name));
1514 + return false;
1515 + }
1516 + }
1517 +
1518 + if (!S_ISDIR (src_mode))
1519 + {
1520 + if (S_ISDIR (dst_sb.st_mode))
1521 + {
1522 + if (x->move_mode && x->backup_type != no_backups)
1523 + {
1524 + /* Moving a non-directory onto an existing
1525 + directory is ok only with --backup. */
1526 + }
1527 + else
1528 + {
1529 + error (0, 0,
1530 + _("cannot overwrite directory %s with non-directory"),
1531 + quote (dst_name));
1532 + return false;
1533 + }
1534 + }
1535 + }
1536 +
1537 + if (x->move_mode)
1538 + {
1539 + /* Don't allow user to move a directory onto a non-directory. */
1540 + if (S_ISDIR (src_sb.st_mode) && !S_ISDIR (dst_sb.st_mode)
1541 + && x->backup_type == no_backups)
1542 + {
1543 + error (0, 0,
1544 + _("cannot move directory onto non-directory: %s -> %s"),
1545 + quote_n (0, src_name), quote_n (0, dst_name));
1546 + return false;
1547 + }
1548 + }
1549 +
1550 + if (x->backup_type != no_backups
1551 + /* Don't try to back up a destination if the last
1552 + component of src_name is "." or "..". */
1553 + && ! dot_or_dotdot (last_component (src_name))
1554 + /* Create a backup of each destination directory in move mode,
1555 + but not in copy mode. FIXME: it might make sense to add an
1556 + option to suppress backup creation also for move mode.
1557 + That would let one use mv to merge new content into an
1558 + existing hierarchy. */
1559 + && (x->move_mode || ! S_ISDIR (dst_sb.st_mode)))
1560 + {
1561 + char *tmp_backup = find_backup_file_name (dst_name,
1562 + x->backup_type);
1563 +
1564 + /* Detect (and fail) when creating the backup file would
1565 + destroy the source file. Before, running the commands
1566 + cd /tmp; rm -f a a~; : > a; echo A > a~; cp --b=simple a~ a
1567 + would leave two zero-length files: a and a~. */
1568 + /* FIXME: but simply change e.g., the final a~ to `./a~'
1569 + and the source will still be destroyed. */
1570 + if (STREQ (tmp_backup, src_name))
1571 + {
1572 + const char *fmt;
1573 + fmt = (x->move_mode
1574 + ? _("backing up %s would destroy source; %s not moved")
1575 + : _("backing up %s would destroy source; %s not copied"));
1576 + error (0, 0, fmt,
1577 + quote_n (0, dst_name),
1578 + quote_n (1, src_name));
1579 + free (tmp_backup);
1580 + return false;
1581 + }
1582 +
1583 + /* FIXME: use fts:
1584 + Using alloca for a file name that may be arbitrarily
1585 + long is not recommended. In fact, even forming such a name
1586 + should be discouraged. Eventually, this code will be rewritten
1587 + to use fts, so using alloca here will be less of a problem. */
1588 + ASSIGN_STRDUPA (dst_backup, tmp_backup);
1589 + free (tmp_backup);
1590 + if (rename (dst_name, dst_backup) != 0)
1591 + {
1592 + if (errno != ENOENT)
1593 + {
1594 + error (0, errno, _("cannot backup %s"), quote (dst_name));
1595 + return false;
1596 + }
1597 + else
1598 + {
1599 + dst_backup = NULL;
1600 + }
1601 + }
1602 + else
1603 + {
1604 + backup_succeeded = true;
1605 + }
1606 + new_dst = true;
1607 + }
1608 + else if (! S_ISDIR (dst_sb.st_mode)
1609 + /* Never unlink dst_name when in move mode. */
1610 + && ! x->move_mode
1611 + && (x->unlink_dest_before_opening
1612 + || (x->preserve_links && 1 < dst_sb.st_nlink)
1613 + || (x->dereference == DEREF_NEVER
1614 + && ! S_ISREG (src_sb.st_mode))
1615 + ))
1616 + {
1617 + if (unlink (dst_name) != 0 && errno != ENOENT)
1618 + {
1619 + error (0, errno, _("cannot remove %s"), quote (dst_name));
1620 + return false;
1621 + }
1622 + new_dst = true;
1623 + if (x->verbose)
1624 + printf (_("removed %s\n"), quote (dst_name));
1625 + }
1626 + }
1627 + }
1628 +
1629 + /* Ensure we don't try to copy through a symlink that was
1630 + created by a prior call to this function. */
1631 + if (command_line_arg
1632 + && x->dest_info
1633 + && ! x->move_mode
1634 + && x->backup_type == no_backups)
1635 + {
1636 + bool lstat_ok = true;
1637 + struct stat tmp_buf;
1638 + struct stat *dst_lstat_sb;
1639 +
1640 + /* If we called lstat above, good: use that data.
1641 + Otherwise, call lstat here, in case dst_name is a symlink. */
1642 + if (have_dst_lstat)
1643 + dst_lstat_sb = &dst_sb;
1644 + else
1645 + {
1646 + if (lstat (dst_name, &tmp_buf) == 0)
1647 + dst_lstat_sb = &tmp_buf;
1648 + else
1649 + lstat_ok = false;
1650 + }
1651 +
1652 + /* Never copy through a symlink we've just created. */
1653 + if (lstat_ok
1654 + && S_ISLNK (dst_lstat_sb->st_mode)
1655 + && seen_file (x->dest_info, dst_name, dst_lstat_sb))
1656 + {
1657 + error (0, 0,
1658 + _("will not copy %s through just-created symlink %s"),
1659 + quote_n (0, src_name), quote_n (1, dst_name));
1660 + return false;
1661 + }
1662 + }
1663 +
1664 + /* If the source is a directory, we don't always create the destination
1665 + directory. So --verbose should not announce anything until we're
1666 + sure we'll create a directory. */
1667 + if (x->verbose && !S_ISDIR (src_mode))
1668 + emit_verbose (src_name, dst_name, backup_succeeded ? dst_backup : NULL);
1669 +
1670 + /* Associate the destination file name with the source device and inode
1671 + so that if we encounter a matching dev/ino pair in the source tree
1672 + we can arrange to create a hard link between the corresponding names
1673 + in the destination tree.
1674 +
1675 + When using the --link (-l) option, there is no need to take special
1676 + measures, because (barring race conditions) files that are hard-linked
1677 + in the source tree will also be hard-linked in the destination tree.
1678 +
1679 + Sometimes, when preserving links, we have to record dev/ino even
1680 + though st_nlink == 1:
1681 + - when in move_mode, since we may be moving a group of N hard-linked
1682 + files (via two or more command line arguments) to a different
1683 + partition; the links may be distributed among the command line
1684 + arguments (possibly hierarchies) so that the link count of
1685 + the final, once-linked source file is reduced to 1 when it is
1686 + considered below. But in this case (for mv) we don't need to
1687 + incur the expense of recording the dev/ino => name mapping; all we
1688 + really need is a lookup, to see if the dev/ino pair has already
1689 + been copied.
1690 + - when using -H and processing a command line argument;
1691 + that command line argument could be a symlink pointing to another
1692 + command line argument. With `cp -H --preserve=link', we hard-link
1693 + those two destination files.
1694 + - likewise for -L except that it applies to all files, not just
1695 + command line arguments.
1696 +
1697 + Also, with --recursive, record dev/ino of each command-line directory.
1698 + We'll use that info to detect this problem: cp -R dir dir. */
1699 +
1700 + if (x->move_mode && src_sb.st_nlink == 1)
1701 + {
1702 + earlier_file = src_to_dest_lookup (src_sb.st_ino, src_sb.st_dev);
1703 + }
1704 + else if (x->preserve_links
1705 + && !x->hard_link
1706 + && (1 < src_sb.st_nlink
1707 + || (command_line_arg
1708 + && x->dereference == DEREF_COMMAND_LINE_ARGUMENTS)
1709 + || x->dereference == DEREF_ALWAYS))
1710 + {
1711 + earlier_file = remember_copied (dst_name, src_sb.st_ino, src_sb.st_dev);
1712 + }
1713 + else if (x->recursive && S_ISDIR (src_mode))
1714 + {
1715 + if (command_line_arg)
1716 + earlier_file = remember_copied (dst_name, src_sb.st_ino, src_sb.st_dev);
1717 + else
1718 + earlier_file = src_to_dest_lookup (src_sb.st_ino, src_sb.st_dev);
1719 + }
1720 +
1721 + /* Did we copy this inode somewhere else (in this command line argument)
1722 + and therefore this is a second hard link to the inode? */
1723 +
1724 + if (earlier_file)
1725 + {
1726 + /* Avoid damaging the destination file system by refusing to preserve
1727 + hard-linked directories (which are found at least in Netapp snapshot
1728 + directories). */
1729 + if (S_ISDIR (src_mode))
1730 + {
1731 + /* If src_name and earlier_file refer to the same directory entry,
1732 + then warn about copying a directory into itself. */
1733 + if (same_name (src_name, earlier_file))
1734 + {
1735 + error (0, 0, _("cannot copy a directory, %s, into itself, %s"),
1736 + quote_n (0, top_level_src_name),
1737 + quote_n (1, top_level_dst_name));
1738 + *copy_into_self = true;
1739 + goto un_backup;
1740 + }
1741 + else if (x->dereference == DEREF_ALWAYS)
1742 + {
1743 + /* This happens when e.g., encountering a directory for the
1744 + second or subsequent time via symlinks when cp is invoked
1745 + with -R and -L. E.g.,
1746 + rm -rf a b c d; mkdir a b c d; ln -s ../c a; ln -s ../c b;
1747 + cp -RL a b d
1748 + */
1749 + }
1750 + else
1751 + {
1752 + error (0, 0, _("will not create hard link %s to directory %s"),
1753 + quote_n (0, dst_name), quote_n (1, earlier_file));
1754 + goto un_backup;
1755 + }
1756 + }
1757 + else
1758 + {
1759 + /* We want to guarantee that symlinks are not followed. */
1760 + bool link_failed = (linkat (AT_FDCWD, earlier_file, AT_FDCWD,
1761 + dst_name, 0) != 0);
1762 +
1763 + /* If the link failed because of an existing destination,
1764 + remove that file and then call link again. */
1765 + if (link_failed && errno == EEXIST)
1766 + {
1767 + if (unlink (dst_name) != 0)
1768 + {
1769 + error (0, errno, _("cannot remove %s"), quote (dst_name));
1770 + goto un_backup;
1771 + }
1772 + if (x->verbose)
1773 + printf (_("removed %s\n"), quote (dst_name));
1774 + link_failed = (linkat (AT_FDCWD, earlier_file, AT_FDCWD,
1775 + dst_name, 0) != 0);
1776 + }
1777 +
1778 + if (link_failed)
1779 + {
1780 + error (0, errno, _("cannot create hard link %s to %s"),
1781 + quote_n (0, dst_name), quote_n (1, earlier_file));
1782 + goto un_backup;
1783 + }
1784 +
1785 + return true;
1786 + }
1787 + }
1788 +
1789 + if (x->move_mode)
1790 + {
1791 + if (rename (src_name, dst_name) == 0)
1792 + {
1793 + if (x->verbose && S_ISDIR (src_mode))
1794 + emit_verbose (src_name, dst_name,
1795 + backup_succeeded ? dst_backup : NULL);
1796 +
1797 + if (rename_succeeded)
1798 + *rename_succeeded = true;
1799 +
1800 + if (command_line_arg)
1801 + {
1802 + /* Record destination dev/ino/name, so that if we are asked
1803 + to overwrite that file again, we can detect it and fail. */
1804 + /* It's fine to use the _source_ stat buffer (src_sb) to get the
1805 + _destination_ dev/ino, since the rename above can't have
1806 + changed those, and `mv' always uses lstat.
1807 + We could limit it further by operating
1808 + only on non-directories. */
1809 + record_file (x->dest_info, dst_name, &src_sb);
1810 + }
1811 +
1812 + return true;
1813 + }
1814 +
1815 + /* FIXME: someday, consider what to do when moving a directory into
1816 + itself but when source and destination are on different devices. */
1817 +
1818 + /* This happens when attempting to rename a directory to a
1819 + subdirectory of itself. */
1820 + if (errno == EINVAL)
1821 + {
1822 + /* FIXME: this is a little fragile in that it relies on rename(2)
1823 + failing with a specific errno value. Expect problems on
1824 + non-POSIX systems. */
1825 + error (0, 0, _("cannot move %s to a subdirectory of itself, %s"),
1826 + quote_n (0, top_level_src_name),
1827 + quote_n (1, top_level_dst_name));
1828 +
1829 + /* Note that there is no need to call forget_created here,
1830 + (compare with the other calls in this file) since the
1831 + destination directory didn't exist before. */
1832 +
1833 + *copy_into_self = true;
1834 + /* FIXME-cleanup: Don't return true here; adjust mv.c accordingly.
1835 + The only caller that uses this code (mv.c) ends up setting its
1836 + exit status to nonzero when copy_into_self is nonzero. */
1837 + return true;
1838 + }
1839 +
1840 + /* WARNING: there probably exist systems for which an inter-device
1841 + rename fails with a value of errno not handled here.
1842 + If/as those are reported, add them to the condition below.
1843 + If this happens to you, please do the following and send the output
1844 + to the bug-reporting address (e.g., in the output of cp --help):
1845 + touch k; perl -e 'rename "k","/tmp/k" or print "$!(",$!+0,")\n"'
1846 + where your current directory is on one partion and /tmp is the other.
1847 + Also, please try to find the E* errno macro name corresponding to
1848 + the diagnostic and parenthesized integer, and include that in your
1849 + e-mail. One way to do that is to run a command like this
1850 + find /usr/include/. -type f \
1851 + | xargs grep 'define.*\<E[A-Z]*\>.*\<18\>' /dev/null
1852 + where you'd replace `18' with the integer in parentheses that
1853 + was output from the perl one-liner above.
1854 + If necessary, of course, change `/tmp' to some other directory. */
1855 + if (errno != EXDEV)
1856 + {
1857 + /* There are many ways this can happen due to a race condition.
1858 + When something happens between the initial XSTAT and the
1859 + subsequent rename, we can get many different types of errors.
1860 + For example, if the destination is initially a non-directory
1861 + or non-existent, but it is created as a directory, the rename
1862 + fails. If two `mv' commands try to rename the same file at
1863 + about the same time, one will succeed and the other will fail.
1864 + If the permissions on the directory containing the source or
1865 + destination file are made too restrictive, the rename will
1866 + fail. Etc. */
1867 + error (0, errno,
1868 + _("cannot move %s to %s"),
1869 + quote_n (0, src_name), quote_n (1, dst_name));
1870 + forget_created (src_sb.st_ino, src_sb.st_dev);
1871 + return false;
1872 + }
1873 +
1874 + /* The rename attempt has failed. Remove any existing destination
1875 + file so that a cross-device `mv' acts as if it were really using
1876 + the rename syscall. */
1877 + if (unlink (dst_name) != 0 && errno != ENOENT)
1878 + {
1879 + error (0, errno,
1880 + _("inter-device move failed: %s to %s; unable to remove target"),
1881 + quote_n (0, src_name), quote_n (1, dst_name));
1882 + forget_created (src_sb.st_ino, src_sb.st_dev);
1883 + return false;
1884 + }
1885 +
1886 + new_dst = true;
1887 + }
1888 +
1889 + /* If the ownership might change, or if it is a directory (whose
1890 + special mode bits may change after the directory is created),
1891 + omit some permissions at first, so unauthorized users cannot nip
1892 + in before the file is ready. */
1893 + dst_mode_bits = (x->set_mode ? x->mode : src_mode) & CHMOD_MODE_BITS;
1894 + omitted_permissions =
1895 + (dst_mode_bits
1896 + & (x->preserve_ownership ? S_IRWXG | S_IRWXO
1897 + : S_ISDIR (src_mode) ? S_IWGRP | S_IWOTH
1898 + : 0));
1899 +
1900 + delayed_ok = true;
1901 +
1902 + if (x->preserve_security_context)
1903 + {
1904 + security_context_t con;
1905 +
1906 + if (0 <= lgetfilecon (src_name, &con))
1907 + {
1908 + if (setfscreatecon (con) < 0)
1909 + {
1910 + if (!x->reduce_diagnostics || x->require_preserve_context)
1911 + error (0, errno,
1912 + _("failed to set default file creation context to %s"),
1913 + quote (con));
1914 + if (x->require_preserve_context)
1915 + {
1916 + freecon (con);
1917 + return false;
1918 + }
1919 + }
1920 + freecon (con);
1921 + }
1922 + else
1923 + {
1924 + if (!errno_unsupported (errno) || x->require_preserve_context)
1925 + {
1926 + if (!x->reduce_diagnostics || x->require_preserve_context)
1927 + error (0, errno,
1928 + _("failed to get security context of %s"),
1929 + quote (src_name));
1930 + if (x->require_preserve_context)
1931 + return false;
1932 + }
1933 + }
1934 + }
1935 +
1936 + if (S_ISDIR (src_mode))
1937 + {
1938 + struct dir_list *dir;
1939 +
1940 + /* If this directory has been copied before during the
1941 + recursion, there is a symbolic link to an ancestor
1942 + directory of the symbolic link. It is impossible to
1943 + continue to copy this, unless we've got an infinite disk. */
1944 +
1945 + if (is_ancestor (&src_sb, ancestors))
1946 + {
1947 + error (0, 0, _("cannot copy cyclic symbolic link %s"),
1948 + quote (src_name));
1949 + goto un_backup;
1950 + }
1951 +
1952 + /* Insert the current directory in the list of parents. */
1953 +
1954 + dir = alloca (sizeof *dir);
1955 + dir->parent = ancestors;
1956 + dir->ino = src_sb.st_ino;
1957 + dir->dev = src_sb.st_dev;
1958 +
1959 + if (new_dst || !S_ISDIR (dst_sb.st_mode))
1960 + {
1961 + /* POSIX says mkdir's behavior is implementation-defined when
1962 + (src_mode & ~S_IRWXUGO) != 0. However, common practice is
1963 + to ask mkdir to copy all the CHMOD_MODE_BITS, letting mkdir
1964 + decide what to do with S_ISUID | S_ISGID | S_ISVTX. */
1965 + if (mkdir (dst_name, dst_mode_bits & ~omitted_permissions) != 0)
1966 + {
1967 + error (0, errno, _("cannot create directory %s"),
1968 + quote (dst_name));
1969 + goto un_backup;
1970 + }
1971 +
1972 + /* We need search and write permissions to the new directory
1973 + for writing the directory's contents. Check if these
1974 + permissions are there. */
1975 +
1976 + if (lstat (dst_name, &dst_sb) != 0)
1977 + {
1978 + error (0, errno, _("cannot stat %s"), quote (dst_name));
1979 + goto un_backup;
1980 + }
1981 + else if ((dst_sb.st_mode & S_IRWXU) != S_IRWXU)
1982 + {
1983 + /* Make the new directory searchable and writable. */
1984 +
1985 + dst_mode = dst_sb.st_mode;
1986 + restore_dst_mode = true;
1987 +
1988 + if (lchmod (dst_name, dst_mode | S_IRWXU) != 0)
1989 + {
1990 +