Use faccessat, not access, when checking file permissions.

* .bzrignore: Add lib/fcntl.h.
* configure.ac (euidaccess): Remove check; gnulib does this for us now.
(gl_FCNTL_O_FLAGS): Define a dummy version.
* lib/at-func.c, lib/euidaccess.c, lib/faccessat.c, lib/fcntl.in.h:
* lib/getgroups.c, lib/group-member.c, lib/root-uid.h:
* lib/xalloc-oversized.h, m4/euidaccess.m4, m4/faccessat.m4:
* m4/fcntl_h.m4, m4/getgroups.m4, m4/group-member.m4:
New files, from gnulib.
* lib/gnulib.mk, m4/gnulib-comp.m4: Regenerate.
* admin/merge-gnulib (GNULIB_MODULES): Add faccessat.
(GNULIB_TOOL_FLAGS): Avoid at-internal, fchdir, malloc-posix,
openat-die, openat-h, save-cwd.  Do not avoid fcntl-h.
Omit gnulib's m4/fcntl-o.m4.
* nt/inc/ms-w32.h (AT_FDCWD, AT_EACCESS): New symbols.
(access): Remove.
(faccessat): New macro.
* src/Makefile.in (LIB_EACCESS): New macro.
(LIBES): Use it.
* src/callproc.c (init_callproc):
* src/charset.c (init_charset):
* src/fileio.c (check_existing, check_executable):
* src/lread.c (openp, load_path_check):
* src/process.c (allocate_pty):
* src/xrdb.c (file_p):
Use faccessat, not access or euidaccess.  Use symbolic names
instead of integers for the flags, as they're portable now.
* src/charset.c, src/xrdb.c: Include <fcntl.h>, for the new flags used.
* src/fileio.c (Ffile_readable_p):
Use faccessat, not stat + open + close.
(file_directory_p): New function, which uses 'stat' on most places
but 'access' (for efficiency) if WINDOWSNT.
* src/fileio.c (Ffile_directory_p, Fset_file_times):
* src/xrdb.c (file_p): Use file_directory_p.
* src/lisp.h (file_directory_p): New decl.
* src/lread.c (openp): When opening a file, use fstat rather than
stat, as that avoids a permissions race.  When not opening a file,
use file_directory_p rather than stat.
* src/process.c, src/sysdep.c, src/term.c: All uses of '#ifdef O_NONBLOCK'
changed to '#if O_NONBLOCK', to accommodate gnulib O_* tyle.
* src/w32.c (sys_faccessat): Rename from sys_access and switch to
faccessat's API.  All uses changed.

Fixes: debbugs:12632

1 files changed, 29 insertions, 27 deletions

diff --git a/src/lread.c b/src/lread.c
index 6d4c0d990af..dedce50de2a 100644
--- a/src/lread.c
+++ b/src/lread.c
@@ -1404,7 +1404,7 @@ Returns the file's name in absolute form, or nil if not found.
 If SUFFIXES is non-nil, it should be a list of suffixes to append to
 file name when searching.
 If non-nil, PREDICATE is used instead of `file-readable-p'.
-PREDICATE can also be an integer to pass to the access(2) function,
+PREDICATE can also be an integer to pass to the faccessat(2) function,
 in which case file-name-handlers are ignored.
 This function will normally skip directories, so if you want it to find
 directories, make sure the PREDICATE function returns `dir-ok' for them.  */)
@@ -1442,7 +1442,6 @@ static Lisp_Object Qdir_ok;
 int
 openp (Lisp_Object path, Lisp_Object str, Lisp_Object suffixes, Lisp_Object *storeptr, Lisp_Object predicate)
 {
-  int fd;
   ptrdiff_t fn_size = 100;
   char buf[100];
   char *fn = buf;
@@ -1497,7 +1496,6 @@ openp (Lisp_Object path, Lisp_Object str, Lisp_Object suffixes, Lisp_Object *sto
         {
           ptrdiff_t fnlen, lsuffix = SBYTES (XCAR (tail));
           Lisp_Object handler;
-          bool exists;
 
           /* Concatenate path element/specified name with the suffix.
              If the directory starts with /:, remove that.  */
@@ -1521,6 +1519,7 @@ openp (Lisp_Object path, Lisp_Object str, Lisp_Object suffixes, Lisp_Object *sto
           handler = Ffind_file_name_handler (string, Qfile_exists_p);
           if ((!NILP (handler) || !NILP (predicate)) && !NATNUMP (predicate))
             {
+              bool exists;
               if (NILP (predicate))
                 exists = !NILP (Ffile_readable_p (string));
               else
@@ -1542,37 +1541,40 @@ openp (Lisp_Object path, Lisp_Object str, Lisp_Object suffixes, Lisp_Object *sto
             }
           else
             {
-#ifndef WINDOWSNT
-              struct stat st;
-#endif
+              int fd;
               const char *pfn;
 
               encoded_fn = ENCODE_FILE (string);
               pfn = SSDATA (encoded_fn);
-#ifdef WINDOWSNT
-              exists = access (pfn, F_OK) == 0 && access (pfn, D_OK) < 0;
-#else
-              exists = (stat (pfn, &st) == 0 && ! S_ISDIR (st.st_mode));
-#endif
-              if (exists)
-                {
-                  /* Check that we can access or open it.  */
-                  if (NATNUMP (predicate))
-                    fd = (((XFASTINT (predicate) & ~INT_MAX) == 0
-                           && access (pfn, XFASTINT (predicate)) == 0)
-                          ? 1 : -1);
-                  else
-                    fd = emacs_open (pfn, O_RDONLY, 0);
 
-                  if (fd >= 0)
+              /* Check that we can access or open it.  */
+              if (NATNUMP (predicate))
+                fd = (((XFASTINT (predicate) & ~INT_MAX) == 0
+                       && (faccessat (AT_FDCWD, pfn, XFASTINT (predicate),
+                                      AT_EACCESS)
+                           == 0)
+                       && ! file_directory_p (pfn))
+                      ? 1 : -1);
+              else
+                {
+                  struct stat st;
+                  fd = emacs_open (pfn, O_RDONLY, 0);
+                  if (0 <= fd
+                      && (fstat (fd, &st) != 0 || S_ISDIR (st.st_mode)))
                     {
-                      /* We succeeded; return this descriptor and filename.  */
-                      if (storeptr)
-                        *storeptr = string;
-                      UNGCPRO;
-                      return fd;
+                      emacs_close (fd);
+                      fd = -1;
                     }
                 }
+
+              if (fd >= 0)
+                {
+                  /* We succeeded; return this descriptor and filename.  */
+                  if (storeptr)
+                    *storeptr = string;
+                  UNGCPRO;
+                  return fd;
+                }
             }
         }
       if (absolute)
@@ -4088,7 +4090,7 @@ load_path_check (void)
       if (STRINGP (dirfile))
         {
           dirfile = Fdirectory_file_name (dirfile);
-          if (access (SSDATA (dirfile), 0) < 0)
+          if (faccessat (AT_FDCWD, SSDATA (dirfile), F_OK, AT_EACCESS) != 0)
             dir_warning ("Warning: Lisp directory `%s' does not exist.\n",
                          XCAR (path_tail));
         }