| package system // import "github.com/docker/docker/pkg/system" |
| |
| import ( |
| "os" |
| "path/filepath" |
| "regexp" |
| "strconv" |
| "strings" |
| "sync" |
| "syscall" |
| "time" |
| "unsafe" |
| |
| winio "github.com/Microsoft/go-winio" |
| "golang.org/x/sys/windows" |
| ) |
| |
| const ( |
| // SddlAdministratorsLocalSystem is local administrators plus NT AUTHORITY\System |
| SddlAdministratorsLocalSystem = "D:P(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)" |
| ) |
| |
| // MkdirAllWithACL is a wrapper for MkdirAll that creates a directory |
| // with an appropriate SDDL defined ACL. |
| func MkdirAllWithACL(path string, perm os.FileMode, sddl string) error { |
| return mkdirall(path, true, sddl) |
| } |
| |
| // MkdirAll implementation that is volume path aware for Windows. |
| func MkdirAll(path string, _ os.FileMode, sddl string) error { |
| return mkdirall(path, false, sddl) |
| } |
| |
| // mkdirall is a custom version of os.MkdirAll modified for use on Windows |
| // so that it is both volume path aware, and can create a directory with |
| // a DACL. |
| func mkdirall(path string, applyACL bool, sddl string) error { |
| if re := regexp.MustCompile(`^\\\\\?\\Volume{[a-z0-9-]+}$`); re.MatchString(path) { |
| return nil |
| } |
| |
| // The rest of this method is largely copied from os.MkdirAll and should be kept |
| // as-is to ensure compatibility. |
| |
| // Fast path: if we can tell whether path is a directory or file, stop with success or error. |
| dir, err := os.Stat(path) |
| if err == nil { |
| if dir.IsDir() { |
| return nil |
| } |
| return &os.PathError{ |
| Op: "mkdir", |
| Path: path, |
| Err: syscall.ENOTDIR, |
| } |
| } |
| |
| // Slow path: make sure parent exists and then call Mkdir for path. |
| i := len(path) |
| for i > 0 && os.IsPathSeparator(path[i-1]) { // Skip trailing path separator. |
| i-- |
| } |
| |
| j := i |
| for j > 0 && !os.IsPathSeparator(path[j-1]) { // Scan backward over element. |
| j-- |
| } |
| |
| if j > 1 { |
| // Create parent |
| err = mkdirall(path[0:j-1], false, sddl) |
| if err != nil { |
| return err |
| } |
| } |
| |
| // Parent now exists; invoke os.Mkdir or mkdirWithACL and use its result. |
| if applyACL { |
| err = mkdirWithACL(path, sddl) |
| } else { |
| err = os.Mkdir(path, 0) |
| } |
| |
| if err != nil { |
| // Handle arguments like "foo/." by |
| // double-checking that directory doesn't exist. |
| dir, err1 := os.Lstat(path) |
| if err1 == nil && dir.IsDir() { |
| return nil |
| } |
| return err |
| } |
| return nil |
| } |
| |
| // mkdirWithACL creates a new directory. If there is an error, it will be of |
| // type *PathError. . |
| // |
| // This is a modified and combined version of os.Mkdir and windows.Mkdir |
| // in golang to cater for creating a directory am ACL permitting full |
| // access, with inheritance, to any subfolder/file for Built-in Administrators |
| // and Local System. |
| func mkdirWithACL(name string, sddl string) error { |
| sa := windows.SecurityAttributes{Length: 0} |
| sd, err := winio.SddlToSecurityDescriptor(sddl) |
| if err != nil { |
| return &os.PathError{Op: "mkdir", Path: name, Err: err} |
| } |
| sa.Length = uint32(unsafe.Sizeof(sa)) |
| sa.InheritHandle = 1 |
| sa.SecurityDescriptor = uintptr(unsafe.Pointer(&sd[0])) |
| |
| namep, err := windows.UTF16PtrFromString(name) |
| if err != nil { |
| return &os.PathError{Op: "mkdir", Path: name, Err: err} |
| } |
| |
| e := windows.CreateDirectory(namep, &sa) |
| if e != nil { |
| return &os.PathError{Op: "mkdir", Path: name, Err: e} |
| } |
| return nil |
| } |
| |
| // IsAbs is a platform-specific wrapper for filepath.IsAbs. On Windows, |
| // golang filepath.IsAbs does not consider a path \windows\system32 as absolute |
| // as it doesn't start with a drive-letter/colon combination. However, in |
| // docker we need to verify things such as WORKDIR /windows/system32 in |
| // a Dockerfile (which gets translated to \windows\system32 when being processed |
| // by the daemon. This SHOULD be treated as absolute from a docker processing |
| // perspective. |
| func IsAbs(path string) bool { |
| if !filepath.IsAbs(path) { |
| if !strings.HasPrefix(path, string(os.PathSeparator)) { |
| return false |
| } |
| } |
| return true |
| } |
| |
| // The origin of the functions below here are the golang OS and windows packages, |
| // slightly modified to only cope with files, not directories due to the |
| // specific use case. |
| // |
| // The alteration is to allow a file on Windows to be opened with |
| // FILE_FLAG_SEQUENTIAL_SCAN (particular for docker load), to avoid eating |
| // the standby list, particularly when accessing large files such as layer.tar. |
| |
| // CreateSequential creates the named file with mode 0666 (before umask), truncating |
| // it if it already exists. If successful, methods on the returned |
| // File can be used for I/O; the associated file descriptor has mode |
| // O_RDWR. |
| // If there is an error, it will be of type *PathError. |
| func CreateSequential(name string) (*os.File, error) { |
| return OpenFileSequential(name, os.O_RDWR|os.O_CREATE|os.O_TRUNC, 0) |
| } |
| |
| // OpenSequential opens the named file for reading. If successful, methods on |
| // the returned file can be used for reading; the associated file |
| // descriptor has mode O_RDONLY. |
| // If there is an error, it will be of type *PathError. |
| func OpenSequential(name string) (*os.File, error) { |
| return OpenFileSequential(name, os.O_RDONLY, 0) |
| } |
| |
| // OpenFileSequential is the generalized open call; most users will use Open |
| // or Create instead. |
| // If there is an error, it will be of type *PathError. |
| func OpenFileSequential(name string, flag int, _ os.FileMode) (*os.File, error) { |
| if name == "" { |
| return nil, &os.PathError{Op: "open", Path: name, Err: syscall.ENOENT} |
| } |
| r, errf := windowsOpenFileSequential(name, flag, 0) |
| if errf == nil { |
| return r, nil |
| } |
| return nil, &os.PathError{Op: "open", Path: name, Err: errf} |
| } |
| |
| func windowsOpenFileSequential(name string, flag int, _ os.FileMode) (file *os.File, err error) { |
| r, e := windowsOpenSequential(name, flag|windows.O_CLOEXEC, 0) |
| if e != nil { |
| return nil, e |
| } |
| return os.NewFile(uintptr(r), name), nil |
| } |
| |
| func makeInheritSa() *windows.SecurityAttributes { |
| var sa windows.SecurityAttributes |
| sa.Length = uint32(unsafe.Sizeof(sa)) |
| sa.InheritHandle = 1 |
| return &sa |
| } |
| |
| func windowsOpenSequential(path string, mode int, _ uint32) (fd windows.Handle, err error) { |
| if len(path) == 0 { |
| return windows.InvalidHandle, windows.ERROR_FILE_NOT_FOUND |
| } |
| pathp, err := windows.UTF16PtrFromString(path) |
| if err != nil { |
| return windows.InvalidHandle, err |
| } |
| var access uint32 |
| switch mode & (windows.O_RDONLY | windows.O_WRONLY | windows.O_RDWR) { |
| case windows.O_RDONLY: |
| access = windows.GENERIC_READ |
| case windows.O_WRONLY: |
| access = windows.GENERIC_WRITE |
| case windows.O_RDWR: |
| access = windows.GENERIC_READ | windows.GENERIC_WRITE |
| } |
| if mode&windows.O_CREAT != 0 { |
| access |= windows.GENERIC_WRITE |
| } |
| if mode&windows.O_APPEND != 0 { |
| access &^= windows.GENERIC_WRITE |
| access |= windows.FILE_APPEND_DATA |
| } |
| sharemode := uint32(windows.FILE_SHARE_READ | windows.FILE_SHARE_WRITE) |
| var sa *windows.SecurityAttributes |
| if mode&windows.O_CLOEXEC == 0 { |
| sa = makeInheritSa() |
| } |
| var createmode uint32 |
| switch { |
| case mode&(windows.O_CREAT|windows.O_EXCL) == (windows.O_CREAT | windows.O_EXCL): |
| createmode = windows.CREATE_NEW |
| case mode&(windows.O_CREAT|windows.O_TRUNC) == (windows.O_CREAT | windows.O_TRUNC): |
| createmode = windows.CREATE_ALWAYS |
| case mode&windows.O_CREAT == windows.O_CREAT: |
| createmode = windows.OPEN_ALWAYS |
| case mode&windows.O_TRUNC == windows.O_TRUNC: |
| createmode = windows.TRUNCATE_EXISTING |
| default: |
| createmode = windows.OPEN_EXISTING |
| } |
| // Use FILE_FLAG_SEQUENTIAL_SCAN rather than FILE_ATTRIBUTE_NORMAL as implemented in golang. |
| //https://msdn.microsoft.com/en-us/library/windows/desktop/aa363858(v=vs.85).aspx |
| const fileFlagSequentialScan = 0x08000000 // FILE_FLAG_SEQUENTIAL_SCAN |
| h, e := windows.CreateFile(pathp, access, sharemode, sa, createmode, fileFlagSequentialScan, 0) |
| return h, e |
| } |
| |
| // Helpers for TempFileSequential |
| var rand uint32 |
| var randmu sync.Mutex |
| |
| func reseed() uint32 { |
| return uint32(time.Now().UnixNano() + int64(os.Getpid())) |
| } |
| func nextSuffix() string { |
| randmu.Lock() |
| r := rand |
| if r == 0 { |
| r = reseed() |
| } |
| r = r*1664525 + 1013904223 // constants from Numerical Recipes |
| rand = r |
| randmu.Unlock() |
| return strconv.Itoa(int(1e9 + r%1e9))[1:] |
| } |
| |
| // TempFileSequential is a copy of ioutil.TempFile, modified to use sequential |
| // file access. Below is the original comment from golang: |
| // TempFile creates a new temporary file in the directory dir |
| // with a name beginning with prefix, opens the file for reading |
| // and writing, and returns the resulting *os.File. |
| // If dir is the empty string, TempFile uses the default directory |
| // for temporary files (see os.TempDir). |
| // Multiple programs calling TempFile simultaneously |
| // will not choose the same file. The caller can use f.Name() |
| // to find the pathname of the file. It is the caller's responsibility |
| // to remove the file when no longer needed. |
| func TempFileSequential(dir, prefix string) (f *os.File, err error) { |
| if dir == "" { |
| dir = os.TempDir() |
| } |
| |
| nconflict := 0 |
| for i := 0; i < 10000; i++ { |
| name := filepath.Join(dir, prefix+nextSuffix()) |
| f, err = OpenFileSequential(name, os.O_RDWR|os.O_CREATE|os.O_EXCL, 0600) |
| if os.IsExist(err) { |
| if nconflict++; nconflict > 10 { |
| randmu.Lock() |
| rand = reseed() |
| randmu.Unlock() |
| } |
| continue |
| } |
| break |
| } |
| return |
| } |