1 // SPDX-License-Identifier: 0BSD
2
3 ///////////////////////////////////////////////////////////////////////////////
4 //
5 /// \file xzdec.c
6 /// \brief Simple single-threaded tool to uncompress .xz or .lzma files
7 //
8 // Author: Lasse Collin
9 //
10 ///////////////////////////////////////////////////////////////////////////////
11
12 #include "sysdefs.h"
13 #include "lzma.h"
14
15 #include <stdarg.h>
16 #include <errno.h>
17 #include <stdio.h>
18
19 #ifndef _MSC_VER
20 # include <unistd.h>
21 #endif
22
23 #ifdef HAVE_CAP_RIGHTS_LIMIT
24 # include <sys/capsicum.h>
25 #endif
26
27 #ifdef HAVE_LINUX_LANDLOCK
28 # include <linux/landlock.h>
29 # include <sys/prctl.h>
30 # include <sys/syscall.h>
31 # ifdef LANDLOCK_ACCESS_NET_BIND_TCP
32 # define LANDLOCK_ABI_MAX 4
33 # else
34 # define LANDLOCK_ABI_MAX 3
35 # endif
36 #endif
37
38 #if defined(HAVE_CAP_RIGHTS_LIMIT) || defined(HAVE_PLEDGE) \
39 || defined(HAVE_LINUX_LANDLOCK)
40 # define ENABLE_SANDBOX 1
41 #endif
42
43 #include "getopt.h"
44 #include "tuklib_progname.h"
45 #include "tuklib_exit.h"
46
47 #ifdef TUKLIB_DOSLIKE
48 # include <fcntl.h>
49 # include <io.h>
50 # ifdef _MSC_VER
51 # define fileno _fileno
52 # define setmode _setmode
53 # endif
54 #endif
55
56
57 #ifdef LZMADEC
58 # define TOOL_FORMAT "lzma"
59 #else
60 # define TOOL_FORMAT "xz"
61 #endif
62
63
64 /// Error messages are suppressed if this is zero, which is the case when
65 /// --quiet has been given at least twice.
66 static int display_errors = 2;
67
68
69 lzma_attribute((__format__(__printf__, 1, 2)))
70 static void
my_errorf(const char * fmt,...)71 my_errorf(const char *fmt, ...)
72 {
73 va_list ap;
74 va_start(ap, fmt);
75
76 if (display_errors) {
77 fprintf(stderr, "%s: ", progname);
78 vfprintf(stderr, fmt, ap);
79 fprintf(stderr, "\n");
80 }
81
82 va_end(ap);
83 return;
84 }
85
86
87 tuklib_attr_noreturn
88 static void
help(void)89 help(void)
90 {
91 printf(
92 "Usage: %s [OPTION]... [FILE]...\n"
93 "Decompress files in the ." TOOL_FORMAT " format to standard output.\n"
94 "\n"
95 " -d, --decompress (ignored, only decompression is supported)\n"
96 " -k, --keep (ignored, files are never deleted)\n"
97 " -c, --stdout (ignored, output is always written to standard output)\n"
98 " -q, --quiet specify *twice* to suppress errors\n"
99 " -Q, --no-warn (ignored, the exit status 2 is never used)\n"
100 " -h, --help display this help and exit\n"
101 " -V, --version display the version number and exit\n"
102 "\n"
103 "With no FILE, or when FILE is -, read standard input.\n"
104 "\n"
105 "Report bugs to <" PACKAGE_BUGREPORT "> (in English or Finnish).\n"
106 PACKAGE_NAME " home page: <" PACKAGE_URL ">\n", progname);
107
108 tuklib_exit(EXIT_SUCCESS, EXIT_FAILURE, display_errors);
109 }
110
111
112 tuklib_attr_noreturn
113 static void
version(void)114 version(void)
115 {
116 printf(TOOL_FORMAT "dec (" PACKAGE_NAME ") " LZMA_VERSION_STRING "\n"
117 "liblzma %s\n", lzma_version_string());
118
119 tuklib_exit(EXIT_SUCCESS, EXIT_FAILURE, display_errors);
120 }
121
122
123 /// Parses command line options.
124 static void
parse_options(int argc,char ** argv)125 parse_options(int argc, char **argv)
126 {
127 static const char short_opts[] = "cdkM:hqQV";
128 static const struct option long_opts[] = {
129 { "stdout", no_argument, NULL, 'c' },
130 { "to-stdout", no_argument, NULL, 'c' },
131 { "decompress", no_argument, NULL, 'd' },
132 { "uncompress", no_argument, NULL, 'd' },
133 { "keep", no_argument, NULL, 'k' },
134 { "quiet", no_argument, NULL, 'q' },
135 { "no-warn", no_argument, NULL, 'Q' },
136 { "help", no_argument, NULL, 'h' },
137 { "version", no_argument, NULL, 'V' },
138 { NULL, 0, NULL, 0 }
139 };
140
141 int c;
142
143 while ((c = getopt_long(argc, argv, short_opts, long_opts, NULL))
144 != -1) {
145 switch (c) {
146 case 'c':
147 case 'd':
148 case 'k':
149 case 'Q':
150 break;
151
152 case 'q':
153 if (display_errors > 0)
154 --display_errors;
155
156 break;
157
158 case 'h':
159 help();
160
161 case 'V':
162 version();
163
164 default:
165 exit(EXIT_FAILURE);
166 }
167 }
168
169 return;
170 }
171
172
173 static void
uncompress(lzma_stream * strm,FILE * file,const char * filename)174 uncompress(lzma_stream *strm, FILE *file, const char *filename)
175 {
176 lzma_ret ret;
177
178 // Initialize the decoder
179 #ifdef LZMADEC
180 ret = lzma_alone_decoder(strm, UINT64_MAX);
181 #else
182 ret = lzma_stream_decoder(strm, UINT64_MAX, LZMA_CONCATENATED);
183 #endif
184
185 // The only reasonable error here is LZMA_MEM_ERROR.
186 if (ret != LZMA_OK) {
187 my_errorf("%s", ret == LZMA_MEM_ERROR ? strerror(ENOMEM)
188 : "Internal error (bug)");
189 exit(EXIT_FAILURE);
190 }
191
192 // Input and output buffers
193 uint8_t in_buf[BUFSIZ];
194 uint8_t out_buf[BUFSIZ];
195
196 strm->avail_in = 0;
197 strm->next_out = out_buf;
198 strm->avail_out = BUFSIZ;
199
200 lzma_action action = LZMA_RUN;
201
202 while (true) {
203 if (strm->avail_in == 0) {
204 strm->next_in = in_buf;
205 strm->avail_in = fread(in_buf, 1, BUFSIZ, file);
206
207 if (ferror(file)) {
208 // POSIX says that fread() sets errno if
209 // an error occurred. ferror() doesn't
210 // touch errno.
211 my_errorf("%s: Error reading input file: %s",
212 filename, strerror(errno));
213 exit(EXIT_FAILURE);
214 }
215
216 #ifndef LZMADEC
217 // When using LZMA_CONCATENATED, we need to tell
218 // liblzma when it has got all the input.
219 if (feof(file))
220 action = LZMA_FINISH;
221 #endif
222 }
223
224 ret = lzma_code(strm, action);
225
226 // Write and check write error before checking decoder error.
227 // This way as much data as possible gets written to output
228 // even if decoder detected an error.
229 if (strm->avail_out == 0 || ret != LZMA_OK) {
230 const size_t write_size = BUFSIZ - strm->avail_out;
231
232 if (fwrite(out_buf, 1, write_size, stdout)
233 != write_size) {
234 // Wouldn't be a surprise if writing to stderr
235 // would fail too but at least try to show an
236 // error message.
237 my_errorf("Cannot write to standard output: "
238 "%s", strerror(errno));
239 exit(EXIT_FAILURE);
240 }
241
242 strm->next_out = out_buf;
243 strm->avail_out = BUFSIZ;
244 }
245
246 if (ret != LZMA_OK) {
247 if (ret == LZMA_STREAM_END) {
248 #ifdef LZMADEC
249 // Check that there's no trailing garbage.
250 if (strm->avail_in != 0
251 || fread(in_buf, 1, 1, file)
252 != 0
253 || !feof(file))
254 ret = LZMA_DATA_ERROR;
255 else
256 return;
257 #else
258 // lzma_stream_decoder() already guarantees
259 // that there's no trailing garbage.
260 assert(strm->avail_in == 0);
261 assert(action == LZMA_FINISH);
262 assert(feof(file));
263 return;
264 #endif
265 }
266
267 const char *msg;
268 switch (ret) {
269 case LZMA_MEM_ERROR:
270 msg = strerror(ENOMEM);
271 break;
272
273 case LZMA_FORMAT_ERROR:
274 msg = "File format not recognized";
275 break;
276
277 case LZMA_OPTIONS_ERROR:
278 // FIXME: Better message?
279 msg = "Unsupported compression options";
280 break;
281
282 case LZMA_DATA_ERROR:
283 msg = "File is corrupt";
284 break;
285
286 case LZMA_BUF_ERROR:
287 msg = "Unexpected end of input";
288 break;
289
290 default:
291 msg = "Internal error (bug)";
292 break;
293 }
294
295 my_errorf("%s: %s", filename, msg);
296 exit(EXIT_FAILURE);
297 }
298 }
299 }
300
301
302 #ifdef ENABLE_SANDBOX
303 static void
sandbox_enter(int src_fd)304 sandbox_enter(int src_fd)
305 {
306 #if defined(HAVE_CAP_RIGHTS_LIMIT)
307 // Capsicum needs FreeBSD 10.2 or later.
308 cap_rights_t rights;
309
310 if (cap_enter())
311 goto error;
312
313 if (cap_rights_limit(src_fd, cap_rights_init(&rights, CAP_READ)))
314 goto error;
315
316 // If not reading from stdin, remove all capabilities from it.
317 if (src_fd != STDIN_FILENO && cap_rights_limit(
318 STDIN_FILENO, cap_rights_clear(&rights)))
319 goto error;
320
321 if (cap_rights_limit(STDOUT_FILENO, cap_rights_init(&rights,
322 CAP_WRITE)))
323 goto error;
324
325 if (cap_rights_limit(STDERR_FILENO, cap_rights_init(&rights,
326 CAP_WRITE)))
327 goto error;
328
329 #elif defined(HAVE_PLEDGE)
330 // pledge() was introduced in OpenBSD 5.9.
331 if (pledge("stdio", ""))
332 goto error;
333
334 (void)src_fd;
335
336 #elif defined(HAVE_LINUX_LANDLOCK)
337 int landlock_abi = syscall(SYS_landlock_create_ruleset,
338 (void *)NULL, 0, LANDLOCK_CREATE_RULESET_VERSION);
339
340 if (landlock_abi > 0) {
341 if (landlock_abi > LANDLOCK_ABI_MAX)
342 landlock_abi = LANDLOCK_ABI_MAX;
343
344 const struct landlock_ruleset_attr attr = {
345 .handled_access_fs = (1ULL
346 << (12 + my_min(3, landlock_abi))) - 1,
347 # if LANDLOCK_ABI_MAX >= 4
348 .handled_access_net = landlock_abi < 4 ? 0 :
349 (LANDLOCK_ACCESS_NET_BIND_TCP
350 | LANDLOCK_ACCESS_NET_CONNECT_TCP),
351 # endif
352 };
353
354 const int ruleset_fd = syscall(SYS_landlock_create_ruleset,
355 &attr, sizeof(attr), 0U);
356 if (ruleset_fd < 0)
357 goto error;
358
359 // All files we need should have already been opened. Thus,
360 // we don't need to add any rules using landlock_add_rule(2)
361 // before activating the sandbox.
362 if (syscall(SYS_landlock_restrict_self, ruleset_fd, 0U) != 0)
363 goto error;
364 }
365
366 (void)src_fd;
367
368 #else
369 # error ENABLE_SANDBOX is defined but no sandboxing method was found.
370 #endif
371
372 return;
373
374 error:
375 #ifdef HAVE_CAP_RIGHTS_LIMIT
376 // If a kernel is configured without capability mode support or
377 // used in an emulator that does not implement the capability
378 // system calls, then the Capsicum system calls will fail and set
379 // errno to ENOSYS. In that case xzdec will silently run without
380 // the sandbox.
381 if (errno == ENOSYS)
382 return;
383 #endif
384
385 my_errorf("Failed to enable the sandbox");
386 exit(EXIT_FAILURE);
387 }
388 #endif
389
390
391 int
main(int argc,char ** argv)392 main(int argc, char **argv)
393 {
394 #ifdef HAVE_PLEDGE
395 // OpenBSD's pledge(2) sandbox.
396 // Initially enable the sandbox slightly more relaxed so that
397 // the process can still open files. This allows the sandbox to
398 // be enabled when parsing command line arguments and decompressing
399 // all files (the more strict sandbox only restricts the last file
400 // that is decompressed).
401 if (pledge("stdio rpath", "")) {
402 my_errorf("Failed to enable the sandbox");
403 exit(EXIT_FAILURE);
404 }
405 #endif
406
407 #ifdef HAVE_LINUX_LANDLOCK
408 // Prevent the process from gaining new privileges. This must be done
409 // before landlock_restrict_self(2) but since we will never need new
410 // privileges, this call can be done here already.
411 //
412 // This is supported since Linux 3.5. Ignore the return value to
413 // keep compatibility with old kernels. landlock_restrict_self(2)
414 // will fail if the no_new_privs attribute isn't set, thus if prctl()
415 // fails here the error will still be detected when it matters.
416 (void)prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0);
417 #endif
418
419 // Initialize progname which we will be used in error messages.
420 tuklib_progname_init(argv);
421
422 // Parse the command line options.
423 parse_options(argc, argv);
424
425 // The same lzma_stream is used for all files that we decode. This way
426 // we don't need to reallocate memory for every file if they use same
427 // compression settings.
428 lzma_stream strm = LZMA_STREAM_INIT;
429
430 // Some systems require setting stdin and stdout to binary mode.
431 #ifdef TUKLIB_DOSLIKE
432 setmode(fileno(stdin), O_BINARY);
433 setmode(fileno(stdout), O_BINARY);
434 #endif
435
436 if (optind == argc) {
437 // No filenames given, decode from stdin.
438 #ifdef ENABLE_SANDBOX
439 sandbox_enter(STDIN_FILENO);
440 #endif
441 uncompress(&strm, stdin, "(stdin)");
442 } else {
443 // Loop through the filenames given on the command line.
444 do {
445 FILE *src_file;
446 const char *src_name;
447
448 // "-" indicates stdin.
449 if (strcmp(argv[optind], "-") == 0) {
450 src_file = stdin;
451 src_name = "(stdin)";
452 } else {
453 src_name = argv[optind];
454 src_file = fopen(src_name, "rb");
455 if (src_file == NULL) {
456 my_errorf("%s: %s", src_name,
457 strerror(errno));
458 exit(EXIT_FAILURE);
459 }
460 }
461 #ifdef ENABLE_SANDBOX
462 // Enable the strict sandbox for the last file.
463 // Then the process can no longer open additional
464 // files. The typical xzdec use case is to decompress
465 // a single file so this way the strictest sandboxing
466 // is used in most cases.
467 if (optind == argc - 1)
468 sandbox_enter(fileno(src_file));
469 #endif
470 uncompress(&strm, src_file, src_name);
471
472 if (src_file != stdin)
473 (void)fclose(src_file);
474 } while (++optind < argc);
475 }
476
477 #ifndef NDEBUG
478 // Free the memory only when debugging. Freeing wastes some time,
479 // but allows detecting possible memory leaks with Valgrind.
480 lzma_end(&strm);
481 #endif
482
483 tuklib_exit(EXIT_SUCCESS, EXIT_FAILURE, display_errors);
484 }
485