/*
 * Copyright (c) 1998-2004 Sendmail, Inc. and its suppliers.
 *      All rights reserved.
 * Copyright (c) 1983, 1995-1997 Eric P. Allman.  All rights reserved.
 * Copyright (c) 1988, 1993
 *      The Regents of the University of California.  All rights reserved.
 *
 * By using this file, you agree to the terms and conditions set
 * forth in the LICENSE file which can be found at the top level of
 * the sendmail distribution.
 *
 */

#include <sendmail.h>
#include <sm/io.h>
#include <sm/errstring.h>

SM_RCSID("@(#)$Id: safefile.c,v 8.129 2008/08/04 18:07:04 gshapiro Exp $")


/*
**  SAFEFILE -- return 0 if a file exists and is safe for a user.
**
**      Parameters:
**              fn -- filename to check.
**              uid -- user id to compare against.
**              gid -- group id to compare against.
**              user -- user name to compare against (used for group
**                      sets).
**              flags -- modifiers:
**                      SFF_MUSTOWN -- "uid" must own this file.
**                      SFF_NOSLINK -- file cannot be a symbolic link.
**              mode -- mode bits that must match.
**              st -- if set, points to a stat structure that will
**                      get the stat info for the file.
**
**      Returns:
**              0 if fn exists, is owned by uid, and matches mode.
**              An errno otherwise.  The actual errno is cleared.
**
**      Side Effects:
**              none.
*/

int
safefile(fn, uid, gid, user, flags, mode, st)
        char *fn;
        UID_T uid;
        GID_T gid;
        char *user;
        long flags;
        int mode;
        struct stat *st;
{
        register char *p;
        register struct group *gr = NULL;
        int file_errno = 0;
        bool checkpath;
        struct stat stbuf;
        struct stat fstbuf;
        char fbuf[MAXPATHLEN];

        if (tTd(44, 4))
                sm_dprintf("safefile(%s, uid=%d, gid=%d, flags=%lx, mode=%o):\n",
                        fn, (int) uid, (int) gid, flags, mode);
        errno = 0;
        if (sm_strlcpy(fbuf, fn, sizeof fbuf) >= sizeof fbuf)
        {
                if (tTd(44, 4))
                        sm_dprintf("\tpathname too long\n");
                return ENAMETOOLONG;
        }
        fn = fbuf;
        if (st == NULL)
                st = &fstbuf;

        /* ignore SFF_SAFEDIRPATH if we are debugging */
        if (RealUid != 0 && RunAsUid == RealUid)
                flags &= ~SFF_SAFEDIRPATH;

        /* first check to see if the file exists at all */
# if HASLSTAT
        if ((bitset(SFF_NOSLINK, flags) ? lstat(fn, st)
                                        : stat(fn, st)) < 0)
# else /* HASLSTAT */
        if (stat(fn, st) < 0)
# endif /* HASLSTAT */
        {
                file_errno = errno;
        }
        else if (bitset(SFF_SETUIDOK, flags) &&
                 !bitset(S_IXUSR|S_IXGRP|S_IXOTH, st->st_mode) &&
                 S_ISREG(st->st_mode))
        {
                /*
                **  If final file is set-user-ID, run as the owner of that
                **  file.  Gotta be careful not to reveal anything too
                **  soon here!
                */

# ifdef SUID_ROOT_FILES_OK
                if (bitset(S_ISUID, st->st_mode))
# else /* SUID_ROOT_FILES_OK */
                if (bitset(S_ISUID, st->st_mode) && st->st_uid != 0 &&
                    st->st_uid != TrustedUid)
# endif /* SUID_ROOT_FILES_OK */
                {
                        uid = st->st_uid;
                        user = NULL;
                }
# ifdef SUID_ROOT_FILES_OK
                if (bitset(S_ISGID, st->st_mode))
# else /* SUID_ROOT_FILES_OK */
                if (bitset(S_ISGID, st->st_mode) && st->st_gid != 0)
# endif /* SUID_ROOT_FILES_OK */
                        gid = st->st_gid;
        }

        checkpath = !bitset(SFF_NOPATHCHECK, flags) ||
                    (uid == 0 && !bitset(SFF_ROOTOK|SFF_OPENASROOT, flags));
        if (bitset(SFF_NOWLINK, flags) && !bitset(SFF_SAFEDIRPATH, flags))
        {
                int ret;

                /* check the directory */
                p = strrchr(fn, '/');
                if (p == NULL)
                {
                        ret = safedirpath(".", uid, gid, user,
                                          flags|SFF_SAFEDIRPATH, 0, 0);
                }
                else
                {
                        *p = '\0';
                        ret = safedirpath(fn, uid, gid, user,
                                          flags|SFF_SAFEDIRPATH, 0, 0);
                        *p = '/';
                }
                if (ret == 0)
                {
                        /* directory is safe */
                        checkpath = false;
                }
                else
                {
# if HASLSTAT
                        /* Need lstat() information if called stat() before */
                        if (!bitset(SFF_NOSLINK, flags) && lstat(fn, st) < 0)
                        {
                                ret = errno;
                                if (tTd(44, 4))
                                        sm_dprintf("\t%s\n", sm_errstring(ret));
                                return ret;
                        }
# endif /* HASLSTAT */
                        /* directory is writable: disallow links */
                        flags |= SFF_NOLINK;
                }
        }

        if (checkpath)
        {
                int ret;

                p = strrchr(fn, '/');
                if (p == NULL)
                {
                        ret = safedirpath(".", uid, gid, user, flags, 0, 0);
                }
                else
                {
                        *p = '\0';
                        ret = safedirpath(fn, uid, gid, user, flags, 0, 0);
                        *p = '/';
                }
                if (ret != 0)
                        return ret;
        }

        /*
        **  If the target file doesn't exist, check the directory to
        **  ensure that it is writable by this user.
        */

        if (file_errno != 0)
        {
                int ret = file_errno;
                char *dir = fn;

                if (tTd(44, 4))
                        sm_dprintf("\t%s\n", sm_errstring(ret));

                errno = 0;
                if (!bitset(SFF_CREAT, flags) || file_errno != ENOENT)
                        return ret;

                /* check to see if legal to create the file */
                p = strrchr(dir, '/');
                if (p == NULL)
                        dir = ".";
                else if (p == dir)
                        dir = "/";
                else
                        *p = '\0';
                if (stat(dir, &stbuf) >= 0)
                {
                        int md = S_IWRITE|S_IEXEC;

                        ret = 0;
                        if (stbuf.st_uid == uid)
                                /* EMPTY */
                                ;
                        else if (uid == 0 && stbuf.st_uid == TrustedUid)
                                /* EMPTY */
                                ;
                        else
                        {
                                md >>= 3;
                                if (stbuf.st_gid == gid)
                                        /* EMPTY */
                                        ;
# ifndef NO_GROUP_SET
                                else if (user != NULL && !DontInitGroups &&
                                         ((gr != NULL &&
                                           gr->gr_gid == stbuf.st_gid) ||
                                          (gr = getgrgid(stbuf.st_gid)) != NULL))
                                {
                                        register char **gp;

                                        for (gp = gr->gr_mem; *gp != NULL; gp++)
                                                if (strcmp(*gp, user) == 0)
                                                        break;
                                        if (*gp == NULL)
                                                md >>= 3;
                                }
# endif /* ! NO_GROUP_SET */
                                else
                                        md >>= 3;
                        }
                        if ((stbuf.st_mode & md) != md)
                                ret = errno = EACCES;
                }
                else
                        ret = errno;
                if (tTd(44, 4))
                        sm_dprintf("\t[final dir %s uid %d mode %lo] %s\n",
                                dir, (int) stbuf.st_uid,
                                (unsigned long) stbuf.st_mode,
                                sm_errstring(ret));
                if (p != NULL)
                        *p = '/';
                st->st_mode = ST_MODE_NOFILE;
                return ret;
        }

# ifdef S_ISLNK
        if (bitset(SFF_NOSLINK, flags) && S_ISLNK(st->st_mode))
        {
                if (tTd(44, 4))
                        sm_dprintf("\t[slink mode %lo]\tE_SM_NOSLINK\n",
                                (unsigned long) st->st_mode);
                return E_SM_NOSLINK;
        }
# endif /* S_ISLNK */
        if (bitset(SFF_REGONLY, flags) && !S_ISREG(st->st_mode))
        {
                if (tTd(44, 4))
                        sm_dprintf("\t[non-reg mode %lo]\tE_SM_REGONLY\n",
                                (unsigned long) st->st_mode);
                return E_SM_REGONLY;
        }
        if (bitset(SFF_NOGWFILES, flags) &&
            bitset(S_IWGRP, st->st_mode))
        {
                if (tTd(44, 4))
                        sm_dprintf("\t[write bits %lo]\tE_SM_GWFILE\n",
                                (unsigned long) st->st_mode);
                return E_SM_GWFILE;
        }
        if (bitset(SFF_NOWWFILES, flags) &&
            bitset(S_IWOTH, st->st_mode))
        {
                if (tTd(44, 4))
                        sm_dprintf("\t[write bits %lo]\tE_SM_WWFILE\n",
                                (unsigned long) st->st_mode);
                return E_SM_WWFILE;
        }
        if (bitset(SFF_NOGRFILES, flags) && bitset(S_IRGRP, st->st_mode))
        {
                if (tTd(44, 4))
                        sm_dprintf("\t[read bits %lo]\tE_SM_GRFILE\n",
                                (unsigned long) st->st_mode);
                return E_SM_GRFILE;
        }
        if (bitset(SFF_NOWRFILES, flags) && bitset(S_IROTH, st->st_mode))
        {
                if (tTd(44, 4))
                        sm_dprintf("\t[read bits %lo]\tE_SM_WRFILE\n",
                                (unsigned long) st->st_mode);
                return E_SM_WRFILE;
        }
        if (!bitset(SFF_EXECOK, flags) &&
            bitset(S_IWUSR|S_IWGRP|S_IWOTH, mode) &&
            bitset(S_IXUSR|S_IXGRP|S_IXOTH, st->st_mode))
        {
                if (tTd(44, 4))
                        sm_dprintf("\t[exec bits %lo]\tE_SM_ISEXEC\n",
                                (unsigned long) st->st_mode);
                return E_SM_ISEXEC;
        }
        if (bitset(SFF_NOHLINK, flags) && st->st_nlink != 1)
        {
                if (tTd(44, 4))
                        sm_dprintf("\t[link count %d]\tE_SM_NOHLINK\n",
                                (int) st->st_nlink);
                return E_SM_NOHLINK;
        }

        if (uid == 0 && bitset(SFF_OPENASROOT, flags))
                /* EMPTY */
                ;
        else if (uid == 0 && !bitset(SFF_ROOTOK, flags))
                mode >>= 6;
        else if (st->st_uid == uid)
                /* EMPTY */
                ;
        else if (uid == 0 && st->st_uid == TrustedUid)
                /* EMPTY */
                ;
        else
        {
                mode >>= 3;
                if (st->st_gid == gid)
                        /* EMPTY */
                        ;
# ifndef NO_GROUP_SET
                else if (user != NULL && !DontInitGroups &&
                         ((gr != NULL && gr->gr_gid == st->st_gid) ||
                          (gr = getgrgid(st->st_gid)) != NULL))
                {
                        register char **gp;

                        for (gp = gr->gr_mem; *gp != NULL; gp++)
                                if (strcmp(*gp, user) == 0)
                                        break;
                        if (*gp == NULL)
                                mode >>= 3;
                }
# endif /* ! NO_GROUP_SET */
                else
                        mode >>= 3;
        }
        if (tTd(44, 4))
                sm_dprintf("\t[uid %d, nlink %d, stat %lo, mode %lo] ",
                        (int) st->st_uid, (int) st->st_nlink,
                        (unsigned long) st->st_mode, (unsigned long) mode);
        if ((st->st_uid == uid || st->st_uid == 0 ||
             st->st_uid == TrustedUid ||
             !bitset(SFF_MUSTOWN, flags)) &&
            (st->st_mode & mode) == mode)
        {
                if (tTd(44, 4))
                        sm_dprintf("\tOK\n");
                return 0;
        }
        if (tTd(44, 4))
                sm_dprintf("\tEACCES\n");
        return EACCES;
}
/*
**  SAFEDIRPATH -- check to make sure a path to a directory is safe
**
**      Safe means not writable and owned by the right folks.
**
**      Parameters:
**              fn -- filename to check.
**              uid -- user id to compare against.
**              gid -- group id to compare against.
**              user -- user name to compare against (used for group
**                      sets).
**              flags -- modifiers:
**                      SFF_ROOTOK -- ok to use root permissions to open.
**                      SFF_SAFEDIRPATH -- writable directories are considered
**                              to be fatal errors.
**              level -- symlink recursive level.
**              offset -- offset into fn to start checking from.
**
**      Returns:
**              0 -- if the directory path is "safe".
**              else -- an error number associated with the path.
*/

int
safedirpath(fn, uid, gid, user, flags, level, offset)
        char *fn;
        UID_T uid;
        GID_T gid;
        char *user;
        long flags;
        int level;
        int offset;
{
        int ret = 0;
        int mode = S_IWOTH;
        char save = '\0';
        char *saveptr = NULL;
        char *p, *enddir;
        register struct group *gr = NULL;
        char s[MAXLINKPATHLEN];
        struct stat stbuf;

        /* make sure we aren't in a symlink loop */
        if (level > MAXSYMLINKS)
                return ELOOP;

        if (level < 0 || offset < 0 || offset > strlen(fn))
                return EINVAL;

        /* special case root directory */
        if (*fn == '\0')
                fn = "/";

        if (tTd(44, 4))
                sm_dprintf("safedirpath(%s, uid=%ld, gid=%ld, flags=%lx, level=%d, offset=%d):\n",
                        fn, (long) uid, (long) gid, flags, level, offset);

        if (!bitnset(DBS_GROUPWRITABLEDIRPATHSAFE, DontBlameSendmail))
                mode |= S_IWGRP;

        /* Make a modifiable copy of the filename */
        if (sm_strlcpy(s, fn, sizeof s) >= sizeof s)
                return EINVAL;

        p = s + offset;
        while (p != NULL)
        {
                /* put back character */
                if (saveptr != NULL)
                {
                        *saveptr = save;
                        saveptr = NULL;
                        p++;
                }

                if (*p == '\0')
                        break;

                p = strchr(p, '/');

                /* Special case for root directory */
                if (p == s)
                {
                        save = *(p + 1);
                        saveptr = p + 1;
                        *(p + 1) = '\0';
                }
                else if (p != NULL)
                {
                        save = *p;
                        saveptr = p;
                        *p = '\0';
                }

                /* Heuristic: . and .. have already been checked */
                enddir = strrchr(s, '/');
                if (enddir != NULL &&
                    (strcmp(enddir, "/..") == 0 ||
                     strcmp(enddir, "/.") == 0))
                        continue;

                if (tTd(44, 20))
                        sm_dprintf("\t[dir %s]\n", s);

# if HASLSTAT
                ret = lstat(s, &stbuf);
# else /* HASLSTAT */
                ret = stat(s, &stbuf);
# endif /* HASLSTAT */
                if (ret < 0)
                {
                        ret = errno;
                        break;
                }

# ifdef S_ISLNK
                /* Follow symlinks */
                if (S_ISLNK(stbuf.st_mode))
                {
                        int linklen;
                        char *target;
                        char buf[MAXPATHLEN];
                        char fullbuf[MAXLINKPATHLEN];

                        memset(buf, '\0', sizeof buf);
                        linklen = readlink(s, buf, sizeof buf);
                        if (linklen < 0)
                        {
                                ret = errno;
                                break;
                        }
                        if (linklen >= sizeof buf)
                        {
                                /* file name too long for buffer */
                                ret = errno = EINVAL;
                                break;
                        }

                        offset = 0;
                        if (*buf == '/')
                        {
                                target = buf;

                                /* If path is the same, avoid rechecks */
                                while (s[offset] == buf[offset] &&
                                       s[offset] != '\0')
                                        offset++;

                                if (s[offset] == '\0' && buf[offset] == '\0')
                                {
                                        /* strings match, symlink loop */
                                        return ELOOP;
                                }

                                /* back off from the mismatch */
                                if (offset > 0)
                                        offset--;

                                /* Make sure we are at a directory break */
                                if (offset > 0 &&
                                    s[offset] != '/' &&
                                    s[offset] != '\0')
                                {
                                        while (buf[offset] != '/' &&
                                               offset > 0)
                                                offset--;
                                }
                                if (offset > 0 &&
                                    s[offset] == '/' &&
                                    buf[offset] == '/')
                                {
                                        /* Include the trailing slash */
                                        offset++;
                                }
                        }
                        else
                        {
                                char *sptr;

                                sptr = strrchr(s, '/');
                                if (sptr != NULL)
                                {
                                        *sptr = '\0';
                                        offset = sptr + 1 - s;
                                        if (sm_strlcpyn(fullbuf,
                                                        sizeof fullbuf, 2,
                                                        s, "/") >=
                                                sizeof fullbuf ||
                                            sm_strlcat(fullbuf, buf,
                                                       sizeof fullbuf) >=
                                                sizeof fullbuf)
                                        {
                                                ret = EINVAL;
                                                break;
                                        }
                                        *sptr = '/';
                                }
                                else
                                {
                                        if (sm_strlcpy(fullbuf, buf,
                                                       sizeof fullbuf) >=
                                                sizeof fullbuf)
                                        {
                                                ret = EINVAL;
                                                break;
                                        }
                                }
                                target = fullbuf;
                        }
                        ret = safedirpath(target, uid, gid, user, flags,
                                          level + 1, offset);
                        if (ret != 0)
                                break;

                        /* Don't check permissions on the link file itself */
                        continue;
                }
#endif /* S_ISLNK */

                if ((uid == 0 || bitset(SFF_SAFEDIRPATH, flags)) &&
#ifdef S_ISVTX
                    !(bitnset(DBS_TRUSTSTICKYBIT, DontBlameSendmail) &&
                      bitset(S_ISVTX, stbuf.st_mode)) &&
#endif /* S_ISVTX */
                    bitset(mode, stbuf.st_mode))
                {
                        if (tTd(44, 4))
                                sm_dprintf("\t[dir %s] mode %lo ",
                                        s, (unsigned long) stbuf.st_mode);
                        if (bitset(SFF_SAFEDIRPATH, flags))
                        {
                                if (bitset(S_IWOTH, stbuf.st_mode))
                                        ret = E_SM_WWDIR;
                                else
                                        ret = E_SM_GWDIR;
                                if (tTd(44, 4))
                                        sm_dprintf("FATAL\n");
                                break;
                        }
                        if (tTd(44, 4))
                                sm_dprintf("WARNING\n");
                        if (Verbose > 1)
                                message("051 WARNING: %s writable directory %s",
                                        bitset(S_IWOTH, stbuf.st_mode)
                                           ? "World"
                                           : "Group",
                                        s);
                }
                if (uid == 0 && !bitset(SFF_ROOTOK|SFF_OPENASROOT, flags))
                {
                        if (bitset(S_IXOTH, stbuf.st_mode))
                                continue;
                        ret = EACCES;
                        break;
                }

                /*
                **  Let OS determine access to file if we are not
                **  running as a privileged user.  This allows ACLs
                **  to work.  Also, if opening as root, assume we can
                **  scan the directory.
                */
                if (geteuid() != 0 || bitset(SFF_OPENASROOT, flags))
                        continue;

                if (stbuf.st_uid == uid &&
                    bitset(S_IXUSR, stbuf.st_mode))
                        continue;
                if (stbuf.st_gid == gid &&
                    bitset(S_IXGRP, stbuf.st_mode))
                        continue;
# ifndef NO_GROUP_SET
                if (user != NULL && !DontInitGroups &&
                    ((gr != NULL && gr->gr_gid == stbuf.st_gid) ||
                     (gr = getgrgid(stbuf.st_gid)) != NULL))
                {
                        register char **gp;

                        for (gp = gr->gr_mem; gp != NULL && *gp != NULL; gp++)
                                if (strcmp(*gp, user) == 0)
                                        break;
                        if (gp != NULL && *gp != NULL &&
                            bitset(S_IXGRP, stbuf.st_mode))
                                continue;
                }
# endif /* ! NO_GROUP_SET */
                if (!bitset(S_IXOTH, stbuf.st_mode))
                {
                        ret = EACCES;
                        break;
                }
        }
        if (tTd(44, 4))
                sm_dprintf("\t[dir %s] %s\n", fn,
                        ret == 0 ? "OK" : sm_errstring(ret));
        return ret;
}
/*
**  SAFEOPEN -- do a file open with extra checking
**
**      Parameters:
**              fn -- the file name to open.
**              omode -- the open-style mode flags.
**              cmode -- the create-style mode flags.
**              sff -- safefile flags.
**
**      Returns:
**              Same as open.
*/

int
safeopen(fn, omode, cmode, sff)
        char *fn;
        int omode;
        int cmode;
        long sff;
{
#if !NOFTRUNCATE
        bool truncate;
#endif /* !NOFTRUNCATE */
        int rval;
        int fd;
        int smode;
        struct stat stb;

        if (tTd(44, 10))
                sm_dprintf("safeopen: fn=%s, omode=%x, cmode=%x, sff=%lx\n",
                           fn, omode, cmode, sff);

        if (bitset(O_CREAT, omode))
                sff |= SFF_CREAT;
        omode &= ~O_CREAT;
        switch (omode & O_ACCMODE)
        {
          case O_RDONLY:
                smode = S_IREAD;
                break;

          case O_WRONLY:
                smode = S_IWRITE;
                break;

          case O_RDWR:
                smode = S_IREAD|S_IWRITE;
                break;

          default:
                smode = 0;
                break;
        }
        if (bitset(SFF_OPENASROOT, sff))
                rval = safefile(fn, RunAsUid, RunAsGid, RunAsUserName,
                                sff, smode, &stb);
        else
                rval = safefile(fn, RealUid, RealGid, RealUserName,
                                sff, smode, &stb);
        if (rval != 0)
        {
                errno = rval;
                return -1;
        }
        if (stb.st_mode == ST_MODE_NOFILE && bitset(SFF_CREAT, sff))
                omode |= O_CREAT | (bitset(SFF_NOTEXCL, sff) ? 0 : O_EXCL);
        else if (bitset(SFF_CREAT, sff) && bitset(O_EXCL, omode))
        {
                /* The file exists so an exclusive create would fail */
                errno = EEXIST;
                return -1;
        }

#if !NOFTRUNCATE
        truncate = bitset(O_TRUNC, omode);
        if (truncate)
                omode &= ~O_TRUNC;
#endif /* !NOFTRUNCATE */

        fd = dfopen(fn, omode, cmode, sff);
        if (fd < 0)
                return fd;
        if (filechanged(fn, fd, &stb))
        {
                syserr("554 5.3.0 cannot open: file %s changed after open", fn);
                (void) close(fd);
                errno = E_SM_FILECHANGE;
                return -1;
        }

#if !NOFTRUNCATE
        if (truncate &&
            ftruncate(fd, (off_t) 0) < 0)
        {
                int save_errno;

                save_errno = errno;
                syserr("554 5.3.0 cannot open: file %s could not be truncated",
                       fn);
                (void) close(fd);
                errno = save_errno;
                return -1;
        }
#endif /* !NOFTRUNCATE */

        return fd;
}
/*
**  SAFEFOPEN -- do a file open with extra checking
**
**      Parameters:
**              fn -- the file name to open.
**              omode -- the open-style mode flags.
**              cmode -- the create-style mode flags.
**              sff -- safefile flags.
**
**      Returns:
**              Same as fopen.
*/

SM_FILE_T *
safefopen(fn, omode, cmode, sff)
        char *fn;
        int omode;
        int cmode;
        long sff;
{
        int fd;
        int save_errno;
        SM_FILE_T *fp;
        int fmode;

        switch (omode & O_ACCMODE)
        {
          case O_RDONLY:
                fmode = SM_IO_RDONLY;
                break;

          case O_WRONLY:
                if (bitset(O_APPEND, omode))
                        fmode = SM_IO_APPEND;
                else
                        fmode = SM_IO_WRONLY;
                break;

          case O_RDWR:
                if (bitset(O_TRUNC, omode))
                        fmode = SM_IO_RDWRTR;
                else if (bitset(O_APPEND, omode))
                        fmode = SM_IO_APPENDRW;
                else
                        fmode = SM_IO_RDWR;
                break;

          default:
                syserr("554 5.3.5 safefopen: unknown omode %o", omode);
                fmode = 0;
        }
        fd = safeopen(fn, omode, cmode, sff);
        if (fd < 0)
        {
                save_errno = errno;
                if (tTd(44, 10))
                        sm_dprintf("safefopen: safeopen failed: %s\n",
                                   sm_errstring(errno));
                errno = save_errno;
                return NULL;
        }
        fp = sm_io_open(SmFtStdiofd, SM_TIME_DEFAULT,
                        (void *) &fd, fmode, NULL);
        if (fp != NULL)
                return fp;

        save_errno = errno;
        if (tTd(44, 10))
        {
                sm_dprintf("safefopen: fdopen(%s, %d) failed: omode=%x, sff=%lx, err=%s\n",
                           fn, fmode, omode, sff, sm_errstring(errno));
        }
        (void) close(fd);
        errno = save_errno;
        return NULL;
}
/*
**  FILECHANGED -- check to see if file changed after being opened
**
**      Parameters:
**              fn -- pathname of file to check.
**              fd -- file descriptor to check.
**              stb -- stat structure from before open.
**
**      Returns:
**              true -- if a problem was detected.
**              false -- if this file is still the same.
*/

bool
filechanged(fn, fd, stb)
        char *fn;
        int fd;
        struct stat *stb;
{
        struct stat sta;

        if (stb->st_mode == ST_MODE_NOFILE)
        {
# if HASLSTAT && BOGUS_O_EXCL
                /* only necessary if exclusive open follows symbolic links */
                if (lstat(fn, stb) < 0 || stb->st_nlink != 1)
                        return true;
# else /* HASLSTAT && BOGUS_O_EXCL */
                return false;
# endif /* HASLSTAT && BOGUS_O_EXCL */
        }
        if (fstat(fd, &sta) < 0)
                return true;

        if (sta.st_nlink != stb->st_nlink ||
            sta.st_dev != stb->st_dev ||
            sta.st_ino != stb->st_ino ||
# if HAS_ST_GEN && 0            /* AFS returns garbage in st_gen */
            sta.st_gen != stb->st_gen ||
# endif /* HAS_ST_GEN && 0 */
            sta.st_uid != stb->st_uid ||
            sta.st_gid != stb->st_gid)
        {
                if (tTd(44, 8))
                {
                        sm_dprintf("File changed after opening:\n");
                        sm_dprintf(" nlink      = %ld/%ld\n",
                                (long) stb->st_nlink, (long) sta.st_nlink);
                        sm_dprintf(" dev        = %ld/%ld\n",
                                (long) stb->st_dev, (long) sta.st_dev);
                        sm_dprintf(" ino        = %llu/%llu\n",
                                (ULONGLONG_T) stb->st_ino,
                                (ULONGLONG_T) sta.st_ino);
# if HAS_ST_GEN
                        sm_dprintf(" gen        = %ld/%ld\n",
                                (long) stb->st_gen, (long) sta.st_gen);
# endif /* HAS_ST_GEN */
                        sm_dprintf(" uid        = %ld/%ld\n",
                                (long) stb->st_uid, (long) sta.st_uid);
                        sm_dprintf(" gid        = %ld/%ld\n",
                                (long) stb->st_gid, (long) sta.st_gid);
                }
                return true;
        }

        return false;
}
/*
**  DFOPEN -- determined file open
**
**      This routine has the semantics of open, except that it will
**      keep trying a few times to make this happen.  The idea is that
**      on very loaded systems, we may run out of resources (inodes,
**      whatever), so this tries to get around it.
*/

int
dfopen(filename, omode, cmode, sff)
        char *filename;
        int omode;
        int cmode;
        long sff;
{
        register int tries;
        int fd = -1;
        struct stat st;

        for (tries = 0; tries < 10; tries++)
        {
                (void) sleep((unsigned) (10 * tries));
                errno = 0;
                fd = open(filename, omode, cmode);
                if (fd >= 0)
                        break;
                switch (errno)
                {
                  case ENFILE:          /* system file table full */
                  case EINTR:           /* interrupted syscall */
#ifdef ETXTBSY
                  case ETXTBSY:         /* Apollo: net file locked */
#endif /* ETXTBSY */
                        continue;
                }
                break;
        }
        if (!bitset(SFF_NOLOCK, sff) &&
            fd >= 0 &&
            fstat(fd, &st) >= 0 &&
            S_ISREG(st.st_mode))
        {
                int locktype;

                /* lock the file to avoid accidental conflicts */
                if ((omode & O_ACCMODE) != O_RDONLY)
                        locktype = LOCK_EX;
                else
                        locktype = LOCK_SH;
                if (bitset(SFF_NBLOCK, sff))
                        locktype |= LOCK_NB;

                if (!lockfile(fd, filename, NULL, locktype))
                {
                        int save_errno = errno;

                        (void) close(fd);
                        fd = -1;
                        errno = save_errno;
                }
                else
                        errno = 0;
        }
        return fd;
}