/*

 * Copyright (c) 2001, 2018, Oracle and/or its affiliates. All rights reserved.

 * Copyright (c) 2012, 2018 SAP SE. All rights reserved.

 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.

 *

 * This code is free software; you can redistribute it and/or modify it

 * under the terms of the GNU General Public License version 2 only, as

 * published by the Free Software Foundation.

 *

 * This code is distributed in the hope that it will be useful, but WITHOUT

 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or

 * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License

 * version 2 for more details (a copy is included in the LICENSE file that

 * accompanied this code).

 *

 * You should have received a copy of the GNU General Public License version

 * 2 along with this work; if not, write to the Free Software Foundation,

 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.

 *

 * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA

 * or visit www.oracle.com if you need additional information or have any

 * questions.

 *

 */

#include "precompiled.hpp"

#include "classfile/vmSymbols.hpp"

#include "logging/log.hpp"

#include "memory/allocation.inline.hpp"

#include "memory/resourceArea.hpp"

#include "oops/oop.inline.hpp"

#include "os_aix.inline.hpp"

#include "runtime/handles.inline.hpp"

#include "runtime/os.hpp"

#include "runtime/perfMemory.hpp"

#include "services/memTracker.hpp"

#include "utilities/exceptions.hpp"

// put OS-includes here

# include <sys/types.h>

# include <sys/mman.h>

# include <errno.h>

# include <stdio.h>

# include <unistd.h>

# include <sys/stat.h>

# include <signal.h>

# include <pwd.h>

static char* backing_store_file_name = NULL;  // name of the backing store

                                              // file, if successfully created.

// Standard Memory Implementation Details

// create the PerfData memory region in standard memory.

//

static char* create_standard_memory(size_t size) {

  // allocate an aligned chuck of memory

  char* mapAddress = os::reserve_memory(size);

  if (mapAddress == NULL) {

    return NULL;

  }

  // commit memory

  if (!os::commit_memory(mapAddress, size, !ExecMem)) {

    if (PrintMiscellaneous && Verbose) {

      warning("Could not commit PerfData memory\n");

    }

    os::release_memory(mapAddress, size);

    return NULL;

  }

  return mapAddress;

}

// delete the PerfData memory region

//

static void delete_standard_memory(char* addr, size_t size) {

  // there are no persistent external resources to cleanup for standard

  // memory. since DestroyJavaVM does not support unloading of the JVM,

  // cleanup of the memory resource is not performed. The memory will be

  // reclaimed by the OS upon termination of the process.

  //

  return;

}

// save the specified memory region to the given file

//

// Note: this function might be called from signal handler (by os::abort()),

// don't allocate heap memory.

//

static void save_memory_to_file(char* addr, size_t size) {

  const char* destfile = PerfMemory::get_perfdata_file_path();

  assert(destfile[0] != '\0', "invalid PerfData file path");

  int result;

  RESTARTABLE(::open(destfile, O_CREAT|O_WRONLY|O_TRUNC, S_IREAD|S_IWRITE),

              result);;

  if (result == OS_ERR) {

    if (PrintMiscellaneous && Verbose) {

      warning("Could not create Perfdata save file: %s: %s\n",

              destfile, os::strerror(errno));

    }

  } else {

    int fd = result;

    for (size_t remaining = size; remaining > 0;) {

      RESTARTABLE(::write(fd, addr, remaining), result);

      if (result == OS_ERR) {

        if (PrintMiscellaneous && Verbose) {

          warning("Could not write Perfdata save file: %s: %s\n",

                  destfile, os::strerror(errno));

        }

        break;

      }

      remaining -= (size_t)result;

      addr += result;

    }

    result = ::close(fd);

    if (PrintMiscellaneous && Verbose) {

      if (result == OS_ERR) {

        warning("Could not close %s: %s\n", destfile, os::strerror(errno));

      }

    }

  }

  FREE_C_HEAP_ARRAY(char, destfile);

}

// Shared Memory Implementation Details

// Note: the solaris and linux shared memory implementation uses the mmap

// interface with a backing store file to implement named shared memory.

// Using the file system as the name space for shared memory allows a

// common name space to be supported across a variety of platforms. It

// also provides a name space that Java applications can deal with through

// simple file apis.

//

// The solaris and linux implementations store the backing store file in

// a user specific temporary directory located in the /tmp file system,

// which is always a local file system and is sometimes a RAM based file

// system.

// return the user specific temporary directory name.

//

// the caller is expected to free the allocated memory.

//

static char* get_user_tmp_dir(const char* user) {

  const char* tmpdir = os::get_temp_directory();

  const char* perfdir = PERFDATA_NAME;

  size_t nbytes = strlen(tmpdir) + strlen(perfdir) + strlen(user) + 3;

  char* dirname = NEW_C_HEAP_ARRAY(char, nbytes, mtInternal);

  // construct the path name to user specific tmp directory

  snprintf(dirname, nbytes, "%s/%s_%s", tmpdir, perfdir, user);

  return dirname;

}

// convert the given file name into a process id. if the file

// does not meet the file naming constraints, return 0.

//

static pid_t filename_to_pid(const char* filename) {

  // a filename that doesn't begin with a digit is not a

  // candidate for conversion.

  //

  if (!isdigit(*filename)) {

    return 0;

  }

  // check if file name can be converted to an integer without

  // any leftover characters.

  //

  char* remainder = NULL;

  errno = 0;

  pid_t pid = (pid_t)strtol(filename, &remainder, 10);

  if (errno != 0) {

    return 0;

  }

  // check for left over characters. If any, then the filename is

  // not a candidate for conversion.

  //

  if (remainder != NULL && *remainder != '\0') {

    return 0;

  }

  // successful conversion, return the pid

  return pid;

}

// Check if the given statbuf is considered a secure directory for

// the backing store files. Returns true if the directory is considered

// a secure location. Returns false if the statbuf is a symbolic link or

// if an error occurred.

//

static bool is_statbuf_secure(struct stat *statp) {

  if (S_ISLNK(statp->st_mode) || !S_ISDIR(statp->st_mode)) {

    // The path represents a link or some non-directory file type,

    // which is not what we expected. Declare it insecure.

    //

    return false;

  }

  // We have an existing directory, check if the permissions are safe.

  //

  if ((statp->st_mode & (S_IWGRP|S_IWOTH)) != 0) {

    // The directory is open for writing and could be subjected

    // to a symlink or a hard link attack. Declare it insecure.

    //

    return false;

  }

  // If user is not root then see if the uid of the directory matches the effective uid of the process.

  uid_t euid = geteuid();

  if ((euid != 0) && (statp->st_uid != euid)) {

    // The directory was not created by this user, declare it insecure.

    //

    return false;

  }

  return true;

}

// Check if the given path is considered a secure directory for

// the backing store files. Returns true if the directory exists

// and is considered a secure location. Returns false if the path

// is a symbolic link or if an error occurred.

//

static bool is_directory_secure(const char* path) {

  struct stat statbuf;

  int result = 0;

  RESTARTABLE(::lstat(path, &statbuf), result);

  if (result == OS_ERR) {

    return false;

  }

  // The path exists, see if it is secure.

  return is_statbuf_secure(&statbuf);

}

// (Taken over from Solaris to support the O_NOFOLLOW case on AIX.)

// Check if the given directory file descriptor is considered a secure

// directory for the backing store files. Returns true if the directory

// exists and is considered a secure location. Returns false if the path

// is a symbolic link or if an error occurred.

static bool is_dirfd_secure(int dir_fd) {

  struct stat statbuf;

  int result = 0;

  RESTARTABLE(::fstat(dir_fd, &statbuf), result);

  if (result == OS_ERR) {

    return false;

  }

  // The path exists, now check its mode.

  return is_statbuf_secure(&statbuf);

}

// Check to make sure fd1 and fd2 are referencing the same file system object.

static bool is_same_fsobject(int fd1, int fd2) {

  struct stat statbuf1;

  struct stat statbuf2;

  int result = 0;

  RESTARTABLE(::fstat(fd1, &statbuf1), result);

  if (result == OS_ERR) {

    return false;

  }

  RESTARTABLE(::fstat(fd2, &statbuf2), result);

  if (result == OS_ERR) {

    return false;

  }

  if ((statbuf1.st_ino == statbuf2.st_ino) &&

      (statbuf1.st_dev == statbuf2.st_dev)) {

    return true;

  } else {

    return false;

  }

}

// Helper functions for open without O_NOFOLLOW which is not present on AIX 5.3/6.1.

// We use the jdk6 implementation here.

#ifndef O_NOFOLLOW

// The O_NOFOLLOW oflag doesn't exist before solaris 5.10, this is to simulate that behaviour

// was done in jdk 5/6 hotspot by Oracle this way

static int open_o_nofollow_impl(const char* path, int oflag, mode_t mode, bool use_mode) {

  struct stat orig_st;

  struct stat new_st;

  bool create;

  int error;

  int fd;

  int result;

  create = false;

  RESTARTABLE(::lstat(path, &orig_st), result);

  if (result == OS_ERR) {

    if (errno == ENOENT && (oflag & O_CREAT) != 0) {

      // File doesn't exist, but_we want to create it, add O_EXCL flag

      // to make sure no-one creates it (or a symlink) before us

      // This works as we expect with symlinks, from posix man page:

      // 'If O_EXCL  and  O_CREAT  are set, and path names a symbolic

      // link, open() shall fail and set errno to [EEXIST]'.

      oflag |= O_EXCL;

      create = true;

    } else {

      // File doesn't exist, and we are not creating it.

      return OS_ERR;

    }

  } else {

    // lstat success, check if existing file is a link.

    if ((orig_st.st_mode & S_IFMT) == S_IFLNK)  {

      // File is a symlink.

      errno = ELOOP;

      return OS_ERR;

    }

  }

  if (use_mode == true) {

    RESTARTABLE(::open(path, oflag, mode), fd);

  } else {

    RESTARTABLE(::open(path, oflag), fd);

  }

  if (fd == OS_ERR) {

    return fd;

  }

  // Can't do inode checks on before/after if we created the file.

  if (create == false) {

    RESTARTABLE(::fstat(fd, &new_st), result);

    if (result == OS_ERR) {

      // Keep errno from fstat, in case close also fails.

      error = errno;

      ::close(fd);

      errno = error;

      return OS_ERR;

    }

    if (orig_st.st_dev != new_st.st_dev || orig_st.st_ino != new_st.st_ino) {

      // File was tampered with during race window.

      ::close(fd);

      errno = EEXIST;

      if (PrintMiscellaneous && Verbose) {

        warning("possible file tampering attempt detected when opening %s", path);

      }

      return OS_ERR;

    }

  }

  return fd;

}

static int open_o_nofollow(const char* path, int oflag, mode_t mode) {

  return open_o_nofollow_impl(path, oflag, mode, true);

}

static int open_o_nofollow(const char* path, int oflag) {

  return open_o_nofollow_impl(path, oflag, 0, false);

}

#endif

// Open the directory of the given path and validate it.

// Return a DIR * of the open directory.

static DIR *open_directory_secure(const char* dirname) {

  // Open the directory using open() so that it can be verified

  // to be secure by calling is_dirfd_secure(), opendir() and then check

  // to see if they are the same file system object.  This method does not

  // introduce a window of opportunity for the directory to be attacked that

  // calling opendir() and is_directory_secure() does.

  int result;

  DIR *dirp = NULL;

  // No O_NOFOLLOW defined at buildtime, and it is not documented for open;

  // so provide a workaround in this case.

#ifdef O_NOFOLLOW

  RESTARTABLE(::open(dirname, O_RDONLY|O_NOFOLLOW), result);

#else

  // workaround (jdk6 coding)

  result = open_o_nofollow(dirname, O_RDONLY);

#endif

  if (result == OS_ERR) {

    // Directory doesn't exist or is a symlink, so there is nothing to cleanup.

    if (PrintMiscellaneous && Verbose) {

      if (errno == ELOOP) {

        warning("directory %s is a symlink and is not secure\n", dirname);

      } else {

        warning("could not open directory %s: %s\n", dirname, os::strerror(errno));

      }

    }

    return dirp;

  }

  int fd = result;

  // Determine if the open directory is secure.

  if (!is_dirfd_secure(fd)) {

    // The directory is not a secure directory.

    os::close(fd);

    return dirp;

  }

  // Open the directory.

  dirp = ::opendir(dirname);

  if (dirp == NULL) {

    // The directory doesn't exist, close fd and return.

    os::close(fd);

    return dirp;

  }

  // Check to make sure fd and dirp are referencing the same file system object.

  if (!is_same_fsobject(fd, dirp->dd_fd)) {

    // The directory is not secure.

    os::close(fd);

    os::closedir(dirp);

    dirp = NULL;

    return dirp;

  }

  // Close initial open now that we know directory is secure

  os::close(fd);

  return dirp;

}

// NOTE: The code below uses fchdir(), open() and unlink() because

// fdopendir(), openat() and unlinkat() are not supported on all

// versions.  Once the support for fdopendir(), openat() and unlinkat()

// is available on all supported versions the code can be changed

// to use these functions.

// Open the directory of the given path, validate it and set the

// current working directory to it.

// Return a DIR * of the open directory and the saved cwd fd.

//

static DIR *open_directory_secure_cwd(const char* dirname, int *saved_cwd_fd) {

  // Open the directory.

  DIR* dirp = open_directory_secure(dirname);

  if (dirp == NULL) {

    // Directory doesn't exist or is insecure, so there is nothing to cleanup.

    return dirp;

  }

  int fd = dirp->dd_fd;

  // Open a fd to the cwd and save it off.

  int result;

  RESTARTABLE(::open(".", O_RDONLY), result);

  if (result == OS_ERR) {

    *saved_cwd_fd = -1;

  } else {

    *saved_cwd_fd = result;

  }

  // Set the current directory to dirname by using the fd of the directory and

  // handle errors, otherwise shared memory files will be created in cwd.

  result = fchdir(fd);

  if (result == OS_ERR) {

    if (PrintMiscellaneous && Verbose) {

      warning("could not change to directory %s", dirname);

    }

    if (*saved_cwd_fd != -1) {

      ::close(*saved_cwd_fd);

      *saved_cwd_fd = -1;

    }

    // Close the directory.

    os::closedir(dirp);

    return NULL;

  } else {

    return dirp;

  }

}

// Close the directory and restore the current working directory.

//

static void close_directory_secure_cwd(DIR* dirp, int saved_cwd_fd) {

  int result;

  // If we have a saved cwd change back to it and close the fd.

  if (saved_cwd_fd != -1) {

    result = fchdir(saved_cwd_fd);

    ::close(saved_cwd_fd);

  }

  // Close the directory.

  os::closedir(dirp);

}

// Check if the given file descriptor is considered a secure.

static bool is_file_secure(int fd, const char *filename) {

  int result;