Make the Rust implementation the only one: crate at the root, Go tree removed
This commit is contained in:
Andy Dixon
+885
@@ -0,0 +1,885 @@
|
||||
//! OS-specific filesystem metadata and file operations (Unix; Linux first).
|
||||
//! Nothing else in the program calls libc for filesystem work.
|
||||
|
||||
use std::collections::HashMap;
|
||||
use std::ffi::{CStr, CString, OsStr};
|
||||
use std::fs::File;
|
||||
use std::io::{self, Write};
|
||||
use std::os::fd::{AsRawFd, FromRawFd, OwnedFd, RawFd};
|
||||
use std::os::unix::ffi::OsStrExt;
|
||||
use std::os::unix::fs::{MetadataExt, OpenOptionsExt};
|
||||
use std::path::{Path, PathBuf};
|
||||
use std::sync::atomic::{AtomicBool, Ordering};
|
||||
use std::sync::Mutex;
|
||||
|
||||
/// File mode bits in Go's io/fs.FileMode layout. Kept so snapshots stay
|
||||
/// byte-compatible with the Go implementation.
|
||||
pub mod mode {
|
||||
pub const DIR: u32 = 1 << 31;
|
||||
pub const APPEND: u32 = 1 << 30;
|
||||
pub const EXCLUSIVE: u32 = 1 << 29;
|
||||
pub const TEMPORARY: u32 = 1 << 28;
|
||||
pub const SYMLINK: u32 = 1 << 27;
|
||||
pub const DEVICE: u32 = 1 << 26;
|
||||
pub const NAMED_PIPE: u32 = 1 << 25;
|
||||
pub const SOCKET: u32 = 1 << 24;
|
||||
pub const SETUID: u32 = 1 << 23;
|
||||
pub const SETGID: u32 = 1 << 22;
|
||||
pub const CHAR_DEVICE: u32 = 1 << 21;
|
||||
pub const STICKY: u32 = 1 << 20;
|
||||
pub const IRREGULAR: u32 = 1 << 19;
|
||||
pub const TYPE: u32 = DIR | SYMLINK | NAMED_PIPE | SOCKET | DEVICE | CHAR_DEVICE | IRREGULAR;
|
||||
pub const PERM: u32 = 0o777;
|
||||
|
||||
pub fn is_dir(m: u32) -> bool {
|
||||
m & DIR != 0
|
||||
}
|
||||
pub fn is_regular(m: u32) -> bool {
|
||||
m & TYPE == 0
|
||||
}
|
||||
pub fn is_symlink(m: u32) -> bool {
|
||||
m & SYMLINK != 0
|
||||
}
|
||||
|
||||
/// Formats like Go's FileMode.String, e.g. "drwxr-xr-x".
|
||||
pub fn string(m: u32) -> String {
|
||||
const STR: &[u8] = b"dalTLDpSugct?";
|
||||
let mut out = String::with_capacity(12);
|
||||
for (i, &c) in STR.iter().enumerate() {
|
||||
if m & (1 << (31 - i)) != 0 {
|
||||
out.push(c as char);
|
||||
}
|
||||
}
|
||||
if out.is_empty() {
|
||||
out.push('-');
|
||||
}
|
||||
for (i, c) in "rwxrwxrwx".chars().enumerate() {
|
||||
out.push(if m & (1 << (8 - i)) != 0 { c } else { '-' });
|
||||
}
|
||||
out
|
||||
}
|
||||
}
|
||||
|
||||
/// Converts a Unix st_mode to the Go FileMode layout.
|
||||
pub fn mode_from_unix(m: u32) -> u32 {
|
||||
let mut out = m & 0o777;
|
||||
out |= match m & libc::S_IFMT {
|
||||
libc::S_IFDIR => mode::DIR,
|
||||
libc::S_IFLNK => mode::SYMLINK,
|
||||
libc::S_IFIFO => mode::NAMED_PIPE,
|
||||
libc::S_IFSOCK => mode::SOCKET,
|
||||
libc::S_IFCHR => mode::DEVICE | mode::CHAR_DEVICE,
|
||||
libc::S_IFBLK => mode::DEVICE,
|
||||
_ => 0,
|
||||
};
|
||||
if m & libc::S_ISUID != 0 {
|
||||
out |= mode::SETUID;
|
||||
}
|
||||
if m & libc::S_ISGID != 0 {
|
||||
out |= mode::SETGID;
|
||||
}
|
||||
if m & libc::S_ISVTX != 0 {
|
||||
out |= mode::STICKY;
|
||||
}
|
||||
out
|
||||
}
|
||||
|
||||
/// Metadata of one directory entry.
|
||||
#[derive(Debug, Default)]
|
||||
pub struct Meta {
|
||||
pub name: Vec<u8>,
|
||||
pub mode: u32, // Go FileMode layout
|
||||
pub size: i64,
|
||||
pub alloc: i64,
|
||||
pub alloc_known: bool,
|
||||
pub mtime: i64, // unix nanoseconds
|
||||
pub btime: i64, // birth time, 0 if unknown
|
||||
pub uid: u32,
|
||||
pub gid: u32,
|
||||
pub nlink: u32,
|
||||
pub dev: u64,
|
||||
pub ino: u64,
|
||||
pub has_ino: bool,
|
||||
pub err: Option<io::Error>, // stat failed; only name is valid
|
||||
}
|
||||
|
||||
fn cstr(b: &[u8]) -> io::Result<CString> {
|
||||
CString::new(b).map_err(|_| io::Error::from_raw_os_error(libc::EINVAL))
|
||||
}
|
||||
|
||||
fn cvt(r: libc::c_int) -> io::Result<libc::c_int> {
|
||||
if r < 0 {
|
||||
Err(io::Error::last_os_error())
|
||||
} else {
|
||||
Ok(r)
|
||||
}
|
||||
}
|
||||
|
||||
fn open_dir(path: &[u8]) -> io::Result<OwnedFd> {
|
||||
let c = cstr(path)?;
|
||||
let fd = cvt(unsafe { libc::open(c.as_ptr(), libc::O_RDONLY | libc::O_DIRECTORY | libc::O_CLOEXEC) })?;
|
||||
Ok(unsafe { OwnedFd::from_raw_fd(fd) })
|
||||
}
|
||||
|
||||
#[cfg(target_os = "linux")]
|
||||
static NO_STATX: AtomicBool = AtomicBool::new(false);
|
||||
|
||||
#[cfg(target_os = "linux")]
|
||||
fn stat_at(dirfd: RawFd, name: &CStr, flags: libc::c_int) -> io::Result<Meta> {
|
||||
if !NO_STATX.load(Ordering::Relaxed) {
|
||||
let mut st: libc::statx = unsafe { std::mem::zeroed() };
|
||||
let mask = libc::STATX_BASIC_STATS | libc::STATX_BTIME;
|
||||
let r = unsafe { libc::statx(dirfd, name.as_ptr(), flags | libc::AT_STATX_DONT_SYNC, mask, &mut st) };
|
||||
if r == 0 {
|
||||
let mut m = Meta {
|
||||
mode: mode_from_unix(st.stx_mode as u32),
|
||||
size: st.stx_size as i64,
|
||||
alloc: st.stx_blocks as i64 * 512,
|
||||
alloc_known: true,
|
||||
mtime: st.stx_mtime.tv_sec * 1_000_000_000 + st.stx_mtime.tv_nsec as i64,
|
||||
uid: st.stx_uid,
|
||||
gid: st.stx_gid,
|
||||
nlink: st.stx_nlink,
|
||||
dev: libc::makedev(st.stx_dev_major, st.stx_dev_minor),
|
||||
ino: st.stx_ino,
|
||||
has_ino: true,
|
||||
..Default::default()
|
||||
};
|
||||
if st.stx_mask & libc::STATX_BTIME != 0 {
|
||||
m.btime = st.stx_btime.tv_sec * 1_000_000_000 + st.stx_btime.tv_nsec as i64;
|
||||
}
|
||||
return Ok(m);
|
||||
}
|
||||
let err = io::Error::last_os_error();
|
||||
if err.raw_os_error() != Some(libc::ENOSYS) {
|
||||
return Err(err);
|
||||
}
|
||||
NO_STATX.store(true, Ordering::Relaxed);
|
||||
}
|
||||
fstat_at(dirfd, name, flags)
|
||||
}
|
||||
|
||||
#[cfg(not(target_os = "linux"))]
|
||||
fn stat_at(dirfd: RawFd, name: &CStr, flags: libc::c_int) -> io::Result<Meta> {
|
||||
fstat_at(dirfd, name, flags)
|
||||
}
|
||||
|
||||
fn fstat_at(dirfd: RawFd, name: &CStr, flags: libc::c_int) -> io::Result<Meta> {
|
||||
let mut st: libc::stat = unsafe { std::mem::zeroed() };
|
||||
cvt(unsafe { libc::fstatat(dirfd, name.as_ptr(), &mut st, flags) })?;
|
||||
Ok(from_stat(&st))
|
||||
}
|
||||
|
||||
#[allow(clippy::unnecessary_cast)]
|
||||
fn from_stat(st: &libc::stat) -> Meta {
|
||||
Meta {
|
||||
mode: mode_from_unix(st.st_mode as u32),
|
||||
size: st.st_size as i64,
|
||||
alloc: st.st_blocks as i64 * 512,
|
||||
alloc_known: true,
|
||||
mtime: st.st_mtime as i64 * 1_000_000_000 + st.st_mtime_nsec as i64,
|
||||
uid: st.st_uid,
|
||||
gid: st.st_gid,
|
||||
nlink: st.st_nlink as u32,
|
||||
dev: st.st_dev as u64,
|
||||
ino: st.st_ino as u64,
|
||||
has_ino: true,
|
||||
..Default::default()
|
||||
}
|
||||
}
|
||||
|
||||
/// An open directory stream (readdir over the fd we also stat relative to).
|
||||
struct DirStream {
|
||||
dir: *mut libc::DIR,
|
||||
}
|
||||
|
||||
impl Drop for DirStream {
|
||||
fn drop(&mut self) {
|
||||
unsafe { libc::closedir(self.dir) };
|
||||
}
|
||||
}
|
||||
|
||||
/// Streams the entries of a directory in chunks of up to `chunk`, stat-ing
|
||||
/// each entry relative to the directory fd (no repeated path resolution).
|
||||
/// Returning an error from f stops the read and returns it.
|
||||
pub fn read_dir<E: From<io::Error>>(path: &[u8], chunk: usize, mut f: impl FnMut(Vec<Meta>) -> Result<(), E>) -> Result<(), E> {
|
||||
let fd = open_dir(path)?;
|
||||
let raw = fd.as_raw_fd();
|
||||
let dir = unsafe { libc::fdopendir(raw) };
|
||||
if dir.is_null() {
|
||||
return Err(io::Error::last_os_error().into());
|
||||
}
|
||||
std::mem::forget(fd); // owned by the DIR stream now
|
||||
let ds = DirStream { dir };
|
||||
let mut out = Vec::with_capacity(chunk);
|
||||
loop {
|
||||
unsafe { *libc::__errno_location() = 0 };
|
||||
let ent = unsafe { libc::readdir(ds.dir) };
|
||||
if ent.is_null() {
|
||||
let e = io::Error::last_os_error();
|
||||
if e.raw_os_error().unwrap_or(0) != 0 {
|
||||
return Err(e.into());
|
||||
}
|
||||
break;
|
||||
}
|
||||
let name = unsafe { CStr::from_ptr((*ent).d_name.as_ptr()) };
|
||||
let nb = name.to_bytes();
|
||||
if nb == b"." || nb == b".." {
|
||||
continue;
|
||||
}
|
||||
let mut m = stat_at(raw, name, libc::AT_SYMLINK_NOFOLLOW).unwrap_or_else(|e| Meta { err: Some(e), ..Default::default() });
|
||||
m.name = nb.to_vec();
|
||||
out.push(m);
|
||||
if out.len() >= chunk {
|
||||
f(std::mem::replace(&mut out, Vec::with_capacity(chunk)))?;
|
||||
}
|
||||
}
|
||||
if !out.is_empty() {
|
||||
f(out)?;
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
fn stat_path(path: &[u8], follow: bool) -> io::Result<Meta> {
|
||||
let c = cstr(path)?;
|
||||
let flags = if follow { 0 } else { libc::AT_SYMLINK_NOFOLLOW };
|
||||
let mut m = stat_at(libc::AT_FDCWD, &c, flags)?;
|
||||
m.name = base_name(path).to_vec();
|
||||
Ok(m)
|
||||
}
|
||||
|
||||
/// Metadata for path without following a final symlink.
|
||||
pub fn lstat(path: &[u8]) -> io::Result<Meta> {
|
||||
stat_path(path, false)
|
||||
}
|
||||
|
||||
/// Metadata for path, following symlinks.
|
||||
pub fn stat(path: &[u8]) -> io::Result<Meta> {
|
||||
stat_path(path, true)
|
||||
}
|
||||
|
||||
/// Joins a directory and an entry name without cleaning.
|
||||
pub fn join_path(dir: &[u8], name: &[u8]) -> Vec<u8> {
|
||||
let mut p = Vec::with_capacity(dir.len() + name.len() + 1);
|
||||
p.extend_from_slice(dir);
|
||||
if dir.last() != Some(&b'/') {
|
||||
p.push(b'/');
|
||||
}
|
||||
p.extend_from_slice(name);
|
||||
p
|
||||
}
|
||||
|
||||
fn base_name(path: &[u8]) -> &[u8] {
|
||||
let mut end = path.len();
|
||||
while end > 1 && path[end - 1] == b'/' {
|
||||
end -= 1;
|
||||
}
|
||||
let p = &path[..end];
|
||||
match p.iter().rposition(|&b| b == b'/') {
|
||||
Some(i) if p.len() > 1 => &p[i + 1..],
|
||||
_ => p,
|
||||
}
|
||||
}
|
||||
|
||||
static NAMES: Mutex<Option<(HashMap<u32, String>, HashMap<u32, String>)>> = Mutex::new(None);
|
||||
|
||||
fn lookup_name(group: bool, id: u32) -> String {
|
||||
let mut g = NAMES.lock().unwrap();
|
||||
let (users, groups) = g.get_or_insert_with(Default::default);
|
||||
let cache = if group { groups } else { users };
|
||||
if let Some(n) = cache.get(&id) {
|
||||
return n.clone();
|
||||
}
|
||||
let mut buf = vec![0u8; 16384];
|
||||
let name = unsafe {
|
||||
if group {
|
||||
let mut gr: libc::group = std::mem::zeroed();
|
||||
let mut res = std::ptr::null_mut();
|
||||
libc::getgrgid_r(id, &mut gr, buf.as_mut_ptr().cast(), buf.len(), &mut res);
|
||||
(!res.is_null()).then(|| CStr::from_ptr(gr.gr_name).to_string_lossy().into_owned())
|
||||
} else {
|
||||
let mut pw: libc::passwd = std::mem::zeroed();
|
||||
let mut res = std::ptr::null_mut();
|
||||
libc::getpwuid_r(id, &mut pw, buf.as_mut_ptr().cast(), buf.len(), &mut res);
|
||||
(!res.is_null()).then(|| CStr::from_ptr(pw.pw_name).to_string_lossy().into_owned())
|
||||
}
|
||||
}
|
||||
.unwrap_or_else(|| id.to_string());
|
||||
cache.insert(id, name.clone());
|
||||
name
|
||||
}
|
||||
|
||||
/// Resolves a uid to a name (cached; falls back to the number).
|
||||
pub fn user_name(uid: u32) -> String {
|
||||
lookup_name(false, uid)
|
||||
}
|
||||
|
||||
/// Resolves a gid to a name (cached; falls back to the number).
|
||||
pub fn group_name(gid: u32) -> String {
|
||||
lookup_name(true, gid)
|
||||
}
|
||||
|
||||
/// Linux pseudo-filesystems whose contents are not disk usage.
|
||||
#[cfg(target_os = "linux")]
|
||||
const VIRTUAL_FS: [i64; 19] = [
|
||||
0x9fa0, // proc
|
||||
0x62656572, // sysfs
|
||||
0x1cd1, // devpts
|
||||
0x27e0eb, // cgroup
|
||||
0x63677270, // cgroup2
|
||||
0x64626720, // debugfs
|
||||
0x74726163, // tracefs
|
||||
0x73636673, // securityfs
|
||||
0x6165676c, // pstore
|
||||
0xcafe4a11, // bpf
|
||||
0x62656570, // configfs
|
||||
0x65735543, // fusectl
|
||||
0x19800202, // mqueue
|
||||
0xde5e81e4, // efivarfs
|
||||
0x42494e4d, // binfmt_misc
|
||||
0xf97cff8c, // selinuxfs
|
||||
0x958458f6, // hugetlbfs
|
||||
0x6e736673, // nsfs
|
||||
0x50495045, // pipefs
|
||||
];
|
||||
|
||||
/// Whether path is the root of a pseudo filesystem (proc, sysfs, cgroup, …)
|
||||
/// that should not be scanned as disk usage.
|
||||
#[cfg(target_os = "linux")]
|
||||
pub fn is_virtual_fs(path: &[u8]) -> bool {
|
||||
let Ok(c) = cstr(path) else { return false };
|
||||
let mut st: libc::statfs = unsafe { std::mem::zeroed() };
|
||||
if unsafe { libc::statfs(c.as_ptr(), &mut st) } != 0 {
|
||||
return false;
|
||||
}
|
||||
VIRTUAL_FS.contains(&(st.f_type as i64))
|
||||
}
|
||||
|
||||
#[cfg(not(target_os = "linux"))]
|
||||
pub fn is_virtual_fs(_: &[u8]) -> bool {
|
||||
false
|
||||
}
|
||||
|
||||
/// What the scan recorded for an item about to be trashed or deleted. The
|
||||
/// operation refuses an item whose owner or file type no longer matches.
|
||||
#[derive(Clone, Copy, Debug)]
|
||||
pub struct Expect {
|
||||
pub uid: u32,
|
||||
pub mode: u32, // only the type bits are compared
|
||||
}
|
||||
|
||||
const CHANGED: &str = "item changed since the scan (owner or type differs); rescan first";
|
||||
|
||||
fn other(msg: impl Into<String>) -> io::Error {
|
||||
io::Error::other(msg.into())
|
||||
}
|
||||
|
||||
/// Guards helper invocations: an absolute path can never be parsed as an
|
||||
/// option by the helper program.
|
||||
fn check_abs(path: &Path) -> io::Result<()> {
|
||||
if !path.is_absolute() {
|
||||
return Err(other("refusing relative path"));
|
||||
}
|
||||
std::fs::symlink_metadata(path).map(|_| ())
|
||||
}
|
||||
|
||||
/// Opens a file whose content is about to be read. It does not follow a
|
||||
/// final symlink, and O_NONBLOCK keeps a FIFO swapped in since the scan from
|
||||
/// blocking open(2) forever; callers still check the file type.
|
||||
pub fn open_content(path: &Path) -> io::Result<File> {
|
||||
std::fs::OpenOptions::new().read(true).custom_flags(libc::O_NOFOLLOW | libc::O_NONBLOCK).open(path)
|
||||
}
|
||||
|
||||
/// Runs a helper program with an argument vector (never a shell), detached
|
||||
/// from the terminal so it cannot disturb the TUI.
|
||||
fn start_detached(name: &str, arg: &Path) -> io::Result<()> {
|
||||
use std::process::{Command, Stdio};
|
||||
let mut child = Command::new(name).arg(arg).stdin(Stdio::null()).stdout(Stdio::null()).stderr(Stdio::null()).spawn()?;
|
||||
std::thread::spawn(move || child.wait());
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// The user-facing name of the trash.
|
||||
pub const TRASH_NAME: &str = "trash";
|
||||
|
||||
/// Opens the item's directory in the desktop file manager.
|
||||
pub fn reveal(path: &Path) -> io::Result<()> {
|
||||
check_abs(path)?;
|
||||
let md = std::fs::symlink_metadata(path)?;
|
||||
let target = if md.is_dir() { path } else { path.parent().unwrap_or(path) };
|
||||
let opener = if cfg!(target_os = "macos") { "open" } else { "xdg-open" };
|
||||
start_detached(opener, target)
|
||||
}
|
||||
|
||||
/// Whether there is no graphical session (no X or Wayland display), so there
|
||||
/// is no file manager to open and no desktop trash anyone will empty.
|
||||
pub fn headless() -> bool {
|
||||
if cfg!(target_os = "macos") {
|
||||
return false;
|
||||
}
|
||||
std::env::var_os("DISPLAY").is_none_or(|v| v.is_empty()) && std::env::var_os("WAYLAND_DISPLAY").is_none_or(|v| v.is_empty())
|
||||
}
|
||||
|
||||
fn split_parent(path: &Path) -> io::Result<(&Path, &OsStr)> {
|
||||
match (path.parent(), path.file_name()) {
|
||||
(Some(d), Some(b)) => Ok((d, b)),
|
||||
_ => Err(other("refusing to operate on a filesystem root")),
|
||||
}
|
||||
}
|
||||
|
||||
fn check_expect(dirfd: RawFd, base: &CStr, want: Expect) -> io::Result<libc::stat> {
|
||||
let mut st: libc::stat = unsafe { std::mem::zeroed() };
|
||||
cvt(unsafe { libc::fstatat(dirfd, base.as_ptr(), &mut st, libc::AT_SYMLINK_NOFOLLOW) })?;
|
||||
if st.st_uid != want.uid || mode_from_unix(st.st_mode as u32) & mode::TYPE != want.mode & mode::TYPE {
|
||||
return Err(other(CHANGED));
|
||||
}
|
||||
Ok(st)
|
||||
}
|
||||
|
||||
/// Permanently removes path (recursively for a directory) if it still
|
||||
/// matches want. The check and the removal both go through descriptors
|
||||
/// opened from the parent directory without following symlinks, so a
|
||||
/// symlink swapped in since the scan cannot redirect the removal outside it.
|
||||
pub fn delete(path: &Path, want: Expect) -> io::Result<()> {
|
||||
check_abs(path)?;
|
||||
let (dir, base) = split_parent(path)?;
|
||||
let dfd = open_dir(dir.as_os_str().as_bytes())?;
|
||||
let cbase = cstr(base.as_bytes())?;
|
||||
let st = check_expect(dfd.as_raw_fd(), &cbase, want)?;
|
||||
remove_at(dfd.as_raw_fd(), &cbase, st.st_mode & libc::S_IFMT == libc::S_IFDIR)
|
||||
}
|
||||
|
||||
fn remove_at(dirfd: RawFd, name: &CStr, is_dir: bool) -> io::Result<()> {
|
||||
if !is_dir {
|
||||
return cvt(unsafe { libc::unlinkat(dirfd, name.as_ptr(), 0) }).map(|_| ());
|
||||
}
|
||||
let fd = cvt(unsafe {
|
||||
libc::openat(dirfd, name.as_ptr(), libc::O_RDONLY | libc::O_DIRECTORY | libc::O_NOFOLLOW | libc::O_CLOEXEC)
|
||||
})?;
|
||||
let sub = unsafe { OwnedFd::from_raw_fd(fd) };
|
||||
// Collect names first: removing while iterating a DIR stream is unspecified.
|
||||
let mut names = Vec::new();
|
||||
let dup = cvt(unsafe { libc::dup(sub.as_raw_fd()) })?;
|
||||
let dir = unsafe { libc::fdopendir(dup) };
|
||||
if dir.is_null() {
|
||||
unsafe { libc::close(dup) };
|
||||
return Err(io::Error::last_os_error());
|
||||
}
|
||||
let ds = DirStream { dir };
|
||||
loop {
|
||||
let ent = unsafe { libc::readdir(ds.dir) };
|
||||
if ent.is_null() {
|
||||
break;
|
||||
}
|
||||
let n = unsafe { CStr::from_ptr((*ent).d_name.as_ptr()) };
|
||||
if n.to_bytes() != b"." && n.to_bytes() != b".." {
|
||||
let t = unsafe { (*ent).d_type };
|
||||
let is_dir = match t {
|
||||
libc::DT_UNKNOWN => fstat_at(sub.as_raw_fd(), n, libc::AT_SYMLINK_NOFOLLOW).is_ok_and(|m| mode::is_dir(m.mode)),
|
||||
t => t == libc::DT_DIR,
|
||||
};
|
||||
names.push((n.to_owned(), is_dir));
|
||||
}
|
||||
}
|
||||
drop(ds);
|
||||
for (n, d) in names {
|
||||
remove_at(sub.as_raw_fd(), &n, d)?;
|
||||
}
|
||||
cvt(unsafe { libc::unlinkat(dirfd, name.as_ptr(), libc::AT_REMOVEDIR) }).map(|_| ())
|
||||
}
|
||||
|
||||
/// Moves path to dst if it still matches want. The parent directory is
|
||||
/// opened once and both the check and the rename are relative to that
|
||||
/// descriptor, so a parent swapped for a symlink since the scan (or between
|
||||
/// check and rename) cannot redirect the move to another user's file.
|
||||
fn rename_checked(path: &Path, dst: &Path, want: Expect) -> io::Result<()> {
|
||||
let (dir, base) = split_parent(path)?;
|
||||
let dfd = open_dir(dir.as_os_str().as_bytes())?;
|
||||
let cbase = cstr(base.as_bytes())?;
|
||||
check_expect(dfd.as_raw_fd(), &cbase, want)?;
|
||||
let cdst = cstr(dst.as_os_str().as_bytes())?;
|
||||
cvt(unsafe { libc::renameat(dfd.as_raw_fd(), cbase.as_ptr(), libc::AT_FDCWD, cdst.as_ptr()) }).map(|_| ())
|
||||
}
|
||||
|
||||
/// Creates dir (mode 0700) if missing; an existing entry must be a real
|
||||
/// directory (not a symlink) owned by us. With strict (trash on a shared
|
||||
/// filesystem) it must also be inaccessible to others, as the freedesktop.org
|
||||
/// spec requires.
|
||||
fn ensure_private_dir(dir: &Path, strict: bool) -> io::Result<()> {
|
||||
use std::os::unix::fs::DirBuilderExt;
|
||||
if let Err(e) = std::fs::DirBuilder::new().mode(0o700).create(dir) {
|
||||
if e.kind() != io::ErrorKind::AlreadyExists {
|
||||
return Err(e);
|
||||
}
|
||||
}
|
||||
let md = std::fs::symlink_metadata(dir)?;
|
||||
if !md.is_dir() {
|
||||
return Err(other("not a directory (symlink?)"));
|
||||
}
|
||||
if md.uid() != unsafe { libc::getuid() } {
|
||||
return Err(other("owned by another user"));
|
||||
}
|
||||
if strict && md.mode() & 0o077 != 0 {
|
||||
return Err(other("accessible to other users"));
|
||||
}
|
||||
Ok(())
|
||||
}
|
||||
|
||||
/// The top directory of the filesystem containing path.
|
||||
fn mount_top(path: &Path, dev: u64) -> PathBuf {
|
||||
let mut cur = path.parent().unwrap_or(path).to_path_buf();
|
||||
loop {
|
||||
let Some(parent) = cur.parent() else { return cur };
|
||||
match std::fs::metadata(parent) {
|
||||
Ok(m) if m.dev() == dev => cur = parent.to_path_buf(),
|
||||
_ => return cur,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
fn percent_encode_path(p: &[u8]) -> String {
|
||||
let mut s = String::with_capacity(p.len());
|
||||
for &b in p {
|
||||
if b.is_ascii_alphanumeric() || b"-._~/!$&'()*+,;=:@".contains(&b) {
|
||||
s.push(b as char);
|
||||
} else {
|
||||
s.push_str(&format!("%{b:02X}"));
|
||||
}
|
||||
}
|
||||
s
|
||||
}
|
||||
|
||||
fn local_timestamp() -> String {
|
||||
let mut t: libc::time_t = unsafe { libc::time(std::ptr::null_mut()) };
|
||||
let mut tm: libc::tm = unsafe { std::mem::zeroed() };
|
||||
unsafe { libc::localtime_r(&mut t, &mut tm) };
|
||||
format!("{:04}-{:02}-{:02}T{:02}:{:02}:{:02}", tm.tm_year + 1900, tm.tm_mon + 1, tm.tm_mday, tm.tm_hour, tm.tm_min, tm.tm_sec)
|
||||
}
|
||||
|
||||
/// Moves path to the freedesktop.org trash: the home trash when on the same
|
||||
/// filesystem, otherwise $topdir/.Trash-$uid on the item's filesystem. It
|
||||
/// never copies across filesystems and never deletes.
|
||||
pub fn trash(path: &Path, want: Expect) -> io::Result<()> {
|
||||
check_abs(path)?;
|
||||
let dev = std::fs::symlink_metadata(path)?.dev();
|
||||
let data_home = match std::env::var_os("XDG_DATA_HOME").filter(|v| !v.is_empty()) {
|
||||
Some(d) => PathBuf::from(d),
|
||||
None => {
|
||||
let home = std::env::var_os("HOME").filter(|v| !v.is_empty()).ok_or_else(|| other("$HOME is not defined"))?;
|
||||
PathBuf::from(home).join(".local/share")
|
||||
}
|
||||
};
|
||||
let home = data_home.join("Trash");
|
||||
let (trash, info_path): (PathBuf, Vec<u8>) = match std::fs::metadata(&data_home) {
|
||||
Ok(m) if m.dev() == dev => (home.clone(), path.as_os_str().as_bytes().to_vec()),
|
||||
_ => {
|
||||
let top = mount_top(path, dev);
|
||||
let rel = path.strip_prefix(&top).map_err(|e| other(e.to_string()))?;
|
||||
(top.join(format!(".Trash-{}", unsafe { libc::getuid() })), rel.as_os_str().as_bytes().to_vec())
|
||||
}
|
||||
};
|
||||
let shared = trash != home;
|
||||
if !shared {
|
||||
use std::os::unix::fs::DirBuilderExt;
|
||||
std::fs::DirBuilder::new().recursive(true).mode(0o700).create(&trash)?;
|
||||
} else if let Err(e) = ensure_private_dir(&trash, true) {
|
||||
// On a shared filesystem another user could plant a symlink or a
|
||||
// world-writable directory here; refuse rather than follow it.
|
||||
return Err(other(format!("trash directory {} is unsafe: {e}", trash.display())));
|
||||
}
|
||||
let (files, info) = (trash.join("files"), trash.join("info"));
|
||||
for d in [&files, &info] {
|
||||
ensure_private_dir(d, shared).map_err(|e| other(format!("trash directory {} is unsafe: {e}", d.display())))?;
|
||||
}
|
||||
let base = path.file_name().ok_or_else(|| other("no file name"))?;
|
||||
for i in 1..10000 {
|
||||
let mut name = base.to_os_string();
|
||||
if i > 1 {
|
||||
name.push(format!(".{i}"));
|
||||
}
|
||||
let dst = files.join(&name);
|
||||
if std::fs::symlink_metadata(&dst).is_ok() {
|
||||
continue; // never overwrite an earlier trashed item (even without .trashinfo)
|
||||
}
|
||||
let mut info_name = name.clone();
|
||||
info_name.push(".trashinfo");
|
||||
let ip = info.join(info_name);
|
||||
let mut f = match std::fs::OpenOptions::new().write(true).create_new(true).mode(0o600).open(&ip) {
|
||||
Ok(f) => f,
|
||||
Err(e) if e.kind() == io::ErrorKind::AlreadyExists => continue,
|
||||
Err(e) => return Err(e),
|
||||
};
|
||||
let w = write!(f, "[Trash Info]\nPath={}\nDeletionDate={}\n", percent_encode_path(&info_path), local_timestamp()).and_then(|_| f.sync_all());
|
||||
drop(f);
|
||||
if let Err(e) = w.and_then(|_| rename_checked(path, &dst, want)) {
|
||||
let _ = std::fs::remove_file(&ip);
|
||||
return Err(e);
|
||||
}
|
||||
return Ok(());
|
||||
}
|
||||
Err(other("trash: too many items with the same name"))
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn mode_string_matches_go() {
|
||||
assert_eq!(mode::string(mode::DIR | 0o755), "drwxr-xr-x");
|
||||
assert_eq!(mode::string(0o644), "-rw-r--r--");
|
||||
assert_eq!(mode::string(mode::SYMLINK | 0o777), "Lrwxrwxrwx");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn delete_refuses_changed_type() {
|
||||
let d = std::env::temp_dir().join(format!("mapsize-del-{}", std::process::id()));
|
||||
std::fs::create_dir_all(d.join("sub/inner")).unwrap();
|
||||
std::fs::write(d.join("sub/inner/f"), b"x").unwrap();
|
||||
let uid = unsafe { libc::getuid() };
|
||||
assert!(delete(&d.join("sub"), Expect { uid, mode: 0 }).is_err());
|
||||
delete(&d.join("sub"), Expect { uid, mode: mode::DIR }).unwrap();
|
||||
assert!(!d.join("sub").exists());
|
||||
std::fs::remove_dir_all(&d).unwrap();
|
||||
}
|
||||
}
|
||||
|
||||
/// Shell-style glob match, a port of Go's filepath.Match: `*` and `?` do not
|
||||
/// match '/', `[^...]` negates, `\\` escapes. A malformed pattern matches
|
||||
/// nothing.
|
||||
pub fn glob_match(pattern: &[u8], name: &[u8]) -> bool {
|
||||
// Fast path for the common "*.ext" shape: * cannot cross '/'.
|
||||
if let Some(suffix) = pattern.strip_prefix(b"*") {
|
||||
if !suffix.iter().any(|b| b"*?[\\".contains(b)) {
|
||||
return name.ends_with(suffix) && !name[..name.len() - suffix.len()].contains(&b'/');
|
||||
}
|
||||
}
|
||||
glob(pattern, name).unwrap_or(false)
|
||||
}
|
||||
|
||||
struct BadPattern;
|
||||
|
||||
fn decode_rune(s: &[u8]) -> (u32, usize) {
|
||||
match s.utf8_chunks().next() {
|
||||
Some(c) if !c.valid().is_empty() => {
|
||||
let ch = c.valid().chars().next().unwrap();
|
||||
(ch as u32, ch.len_utf8())
|
||||
}
|
||||
_ => (0xFFFD, 1),
|
||||
}
|
||||
}
|
||||
|
||||
fn glob(mut pattern: &[u8], mut name: &[u8]) -> Result<bool, BadPattern> {
|
||||
'pattern: while !pattern.is_empty() {
|
||||
let (star, chunk, rest) = scan_chunk(pattern);
|
||||
pattern = rest;
|
||||
if star && chunk.is_empty() {
|
||||
// Trailing * matches the rest of the string unless it has a /.
|
||||
return Ok(!name.contains(&b'/'));
|
||||
}
|
||||
let r = match_chunk(chunk, name);
|
||||
if let Ok(Some(t)) = r {
|
||||
// The last chunk must exhaust the name.
|
||||
if t.is_empty() || !pattern.is_empty() {
|
||||
name = t;
|
||||
continue;
|
||||
}
|
||||
}
|
||||
r?;
|
||||
if star {
|
||||
// Look for a match skipping i+1 bytes; cannot skip /.
|
||||
let mut i = 0;
|
||||
while i < name.len() && name[i] != b'/' {
|
||||
if let Some(t) = match_chunk(chunk, &name[i + 1..])? {
|
||||
if !(pattern.is_empty() && !t.is_empty()) {
|
||||
name = t;
|
||||
continue 'pattern;
|
||||
}
|
||||
}
|
||||
i += 1;
|
||||
}
|
||||
}
|
||||
// Before failing, check the rest of the pattern is well-formed.
|
||||
while !pattern.is_empty() {
|
||||
let (_, chunk, rest) = scan_chunk(pattern);
|
||||
pattern = rest;
|
||||
match_chunk(chunk, b"")?;
|
||||
}
|
||||
return Ok(false);
|
||||
}
|
||||
Ok(name.is_empty())
|
||||
}
|
||||
|
||||
fn scan_chunk(mut pattern: &[u8]) -> (bool, &[u8], &[u8]) {
|
||||
let mut star = false;
|
||||
while pattern.first() == Some(&b'*') {
|
||||
pattern = &pattern[1..];
|
||||
star = true;
|
||||
}
|
||||
let mut in_range = false;
|
||||
let mut i = 0;
|
||||
while i < pattern.len() {
|
||||
match pattern[i] {
|
||||
b'\\' if i + 1 < pattern.len() => i += 1,
|
||||
b'[' => in_range = true,
|
||||
b']' => in_range = false,
|
||||
b'*' if !in_range => break,
|
||||
_ => {}
|
||||
}
|
||||
i += 1;
|
||||
}
|
||||
(star, &pattern[..i], &pattern[i..])
|
||||
}
|
||||
|
||||
/// Matches one chunk against the start of s, returning the rest of s.
|
||||
fn match_chunk<'a>(mut chunk: &[u8], mut s: &'a [u8]) -> Result<Option<&'a [u8]>, BadPattern> {
|
||||
// After a failure, keep parsing chunk to validate it, but stop reading s.
|
||||
let mut failed = false;
|
||||
while !chunk.is_empty() {
|
||||
if !failed && s.is_empty() {
|
||||
failed = true;
|
||||
}
|
||||
match chunk[0] {
|
||||
b'[' => {
|
||||
let mut r = 0;
|
||||
if !failed {
|
||||
let (c, n) = decode_rune(s);
|
||||
r = c;
|
||||
s = &s[n..];
|
||||
}
|
||||
chunk = &chunk[1..];
|
||||
let negated = chunk.first() == Some(&b'^');
|
||||
if negated {
|
||||
chunk = &chunk[1..];
|
||||
}
|
||||
let (mut matched, mut nrange) = (false, 0);
|
||||
loop {
|
||||
if chunk.first() == Some(&b']') && nrange > 0 {
|
||||
chunk = &chunk[1..];
|
||||
break;
|
||||
}
|
||||
let (lo, rest) = get_esc(chunk)?;
|
||||
chunk = rest;
|
||||
let mut hi = lo;
|
||||
if chunk[0] == b'-' {
|
||||
(hi, chunk) = get_esc(&chunk[1..])?;
|
||||
}
|
||||
if lo <= r && r <= hi {
|
||||
matched = true;
|
||||
}
|
||||
nrange += 1;
|
||||
}
|
||||
if matched == negated {
|
||||
failed = true;
|
||||
}
|
||||
}
|
||||
b'?' => {
|
||||
if !failed {
|
||||
if s[0] == b'/' {
|
||||
failed = true;
|
||||
}
|
||||
s = &s[decode_rune(s).1..];
|
||||
}
|
||||
chunk = &chunk[1..];
|
||||
}
|
||||
c => {
|
||||
let c = if c == b'\\' {
|
||||
chunk = &chunk[1..];
|
||||
*chunk.first().ok_or(BadPattern)?
|
||||
} else {
|
||||
c
|
||||
};
|
||||
if !failed {
|
||||
if c != s[0] {
|
||||
failed = true;
|
||||
}
|
||||
s = &s[1..];
|
||||
}
|
||||
chunk = &chunk[1..];
|
||||
}
|
||||
}
|
||||
}
|
||||
Ok((!failed).then_some(s))
|
||||
}
|
||||
|
||||
fn get_esc(mut chunk: &[u8]) -> Result<(u32, &[u8]), BadPattern> {
|
||||
if chunk.is_empty() || chunk[0] == b'-' || chunk[0] == b']' {
|
||||
return Err(BadPattern);
|
||||
}
|
||||
if chunk[0] == b'\\' {
|
||||
chunk = &chunk[1..];
|
||||
if chunk.is_empty() {
|
||||
return Err(BadPattern);
|
||||
}
|
||||
}
|
||||
let (r, n) = decode_rune(chunk);
|
||||
if (r == 0xFFFD && n == 1) || chunk.len() == n {
|
||||
return Err(BadPattern);
|
||||
}
|
||||
Ok((r, &chunk[n..]))
|
||||
}
|
||||
|
||||
/// Lexically cleans a path like Go's filepath.Clean.
|
||||
pub fn clean_path(p: &[u8]) -> Vec<u8> {
|
||||
if p.is_empty() {
|
||||
return b".".to_vec();
|
||||
}
|
||||
let rooted = p[0] == b'/';
|
||||
let mut parts: Vec<&[u8]> = Vec::new();
|
||||
for c in p.split(|&b| b == b'/') {
|
||||
match c {
|
||||
b"" | b"." => {}
|
||||
b".." => {
|
||||
if parts.last().is_some_and(|l| *l != b"..") {
|
||||
parts.pop();
|
||||
} else if !rooted {
|
||||
parts.push(c);
|
||||
}
|
||||
}
|
||||
_ => parts.push(c),
|
||||
}
|
||||
}
|
||||
let mut out = Vec::with_capacity(p.len());
|
||||
if rooted {
|
||||
out.push(b'/');
|
||||
}
|
||||
out.extend_from_slice(&parts.join(&b'/'));
|
||||
if out.is_empty() {
|
||||
out.push(b'.');
|
||||
}
|
||||
out
|
||||
}
|
||||
|
||||
/// Makes a path absolute (relative to the working directory) and cleans it.
|
||||
pub fn abs_path(p: &[u8]) -> io::Result<Vec<u8>> {
|
||||
if p.first() == Some(&b'/') {
|
||||
return Ok(clean_path(p));
|
||||
}
|
||||
let cwd = std::env::current_dir()?;
|
||||
Ok(clean_path(&join_path(cwd.as_os_str().as_bytes(), p)))
|
||||
}
|
||||
|
||||
#[cfg(test)]
|
||||
mod path_tests {
|
||||
use super::*;
|
||||
|
||||
#[test]
|
||||
fn clean_and_glob() {
|
||||
assert_eq!(clean_path(b"/a/b/../c/./"), b"/a/c");
|
||||
assert_eq!(clean_path(b"/.."), b"/");
|
||||
assert_eq!(clean_path(b"a/../../b"), b"../b");
|
||||
assert!(glob_match(b"*.log", b"x.log"));
|
||||
assert!(!glob_match(b"*.log", b"d/x.log"));
|
||||
assert!(glob_match(b"/tmp/*/x", b"/tmp/a/x"));
|
||||
assert!(!glob_match(b"[", b"["));
|
||||
assert!(glob_match(b"a[^b-d]?", "ax\u{e9}".as_bytes()));
|
||||
assert!(!glob_match(b"a[^b-d]c", b"abc"));
|
||||
assert!(glob_match(b"\\*x", b"*x"));
|
||||
assert!(glob_match(b"*.dat", b"f1.dat"));
|
||||
assert!(!glob_match(b"*.dat", b"f1.dax"));
|
||||
assert!(glob_match(b"a*b*c", b"axxbyyc"));
|
||||
assert!(glob_match(b"*/x", b"a/x") && !glob_match(b"*/x", b"a/b/x"));
|
||||
assert!(glob_match(b"*", b"abc") && !glob_match(b"*", b"a/c"));
|
||||
assert!(!glob_match(b"*.dat", b"x.dat/y.da") && !glob_match(b"*.dat", b"d/x.dat"));
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user