自学教程：C++ GetErrorStr函数代码示例

int CopyACLs(const char *src, const char *dst){    acl_t acls;    struct stat statbuf;    int ret;    acls = acl_get_file(src, ACL_TYPE_ACCESS);    if (!acls)    {        if (errno == ENOTSUP)        {            return true;        }        else        {            Log(LOG_LEVEL_ERR, "Can't copy ACLs from '%s'. (acl_get_file: %s)", src, GetErrorStr());            return false;        }    }    ret = acl_set_file(dst, ACL_TYPE_ACCESS, acls);    acl_free(acls);    if (ret != 0)    {        if (errno == ENOTSUP)        {            return true;        }        else        {            Log(LOG_LEVEL_ERR, "Can't copy ACLs to '%s'. (acl_set_file: %s)", dst, GetErrorStr());            return false;        }    }    if (stat(src, &statbuf) != 0)    {        Log(LOG_LEVEL_ERR, "Can't copy ACLs from '%s'. (stat: %s)", src, GetErrorStr());        return false;    }    if (!S_ISDIR(statbuf.st_mode))    {        return true;    }    // For directory, copy default ACL too.    acls = acl_get_file(src, ACL_TYPE_DEFAULT);    if (!acls)    {        Log(LOG_LEVEL_ERR, "Can't copy ACLs from '%s'. (acl_get_file: %s)", src, GetErrorStr());        return false;    }    ret = acl_set_file(dst, ACL_TYPE_DEFAULT, acls);    acl_free(acls);    if (ret != 0)    {        Log(LOG_LEVEL_ERR, "Can't copy ACLs to '%s'. (acl_set_file: %s)", dst, GetErrorStr());        return false;    }    return true;}

int CheckDefaultClearACL(EvalContext *ctx, const char *file_path, Attributes a, const Promise *pp, PromiseResult *result){    acl_t acl_existing;    acl_t acl_empty;    acl_entry_t ace_dummy;    int retv;    int retval = false;    acl_existing = NULL;    acl_empty = NULL;    if ((acl_existing = acl_get_file(file_path, ACL_TYPE_DEFAULT)) == NULL)    {        Log(LOG_LEVEL_ERR, "Unable to read default acl for '%s'. (acl_get_file: %s)", file_path, GetErrorStr());        return false;    }    retv = acl_get_entry(acl_existing, ACL_FIRST_ENTRY, &ace_dummy);    switch (retv)    {    case -1:        Log(LOG_LEVEL_VERBOSE, "Couldn't retrieve ACE for '%s'. (acl_get_entry: %s)", file_path, GetErrorStr());        retval = false;        break;    case 0:                    // no entries, as desired        cfPS(ctx, LOG_LEVEL_VERBOSE, PROMISE_RESULT_NOOP, pp, a, "Default ACL on '%s' needs no modification.", file_path);        retval = true;        break;    case 1:                    // entries exist, set empty ACL        if ((acl_empty = acl_init(0)) == NULL)        {            Log(LOG_LEVEL_ERR, "Could not reinitialize ACL for '%s'. (acl_init: %s)", file_path, GetErrorStr());            retval = false;            break;        }        switch (a.transaction.action)        {        case cfa_warn:            cfPS(ctx, LOG_LEVEL_ERR, PROMISE_RESULT_WARN, pp, a, "Default ACL on '%s' needs to be cleared", file_path);            *result = PromiseResultUpdate(*result, PROMISE_RESULT_WARN);            break;        case cfa_fix:            if (!DONTDO)            {                if (acl_set_file(file_path, ACL_TYPE_DEFAULT, acl_empty) != 0)                {                    Log(LOG_LEVEL_ERR, "Could not reset ACL for %s", file_path);                    retval = false;                    break;                }            }            cfPS(ctx, LOG_LEVEL_INFO, PROMISE_RESULT_CHANGE, pp, a, "Default ACL on '%s' successfully cleared", file_path);            *result = PromiseResultUpdate(*result, PROMISE_RESULT_CHANGE);            retval = true;            break;        default:            ProgrammingError("CFEngine: internal error: illegal file action");            retval = false;        }        break;    default:        retval = false;    }    acl_free(acl_empty);    acl_free(acl_existing);    return retval;}

static int ACLEquals(acl_t first, acl_t second){    acl_entry_t ace_first;    acl_entry_t ace_second;    acl_permset_t perms_first;    acl_permset_t perms_second;    int first_cnt;    int second_cnt;    int more_aces;    int retv_perms;    if ((first_cnt = ACECount(first)) == -1)    {        Log(LOG_LEVEL_VERBOSE, "Couldn't count ACEs");        return -1;    }    if ((second_cnt = ACECount(second)) == -1)    {        Log(LOG_LEVEL_VERBOSE, "Couldn't count ACEs");        return -1;    }    if (first_cnt != second_cnt)    {        return 1;    }    if (first_cnt == 0)    {        return 0;    }// check that every ace of first acl exist in second acl    more_aces = acl_get_entry(first, ACL_FIRST_ENTRY, &ace_first);    if (more_aces != 1)         // first must contain at least one entry    {        Log(LOG_LEVEL_ERR, "Unable to read ACE. (acl_get_entry: %s)", GetErrorStr());        return -1;    }    while (more_aces)    {        /* no ace in second match entity-type and id of first */        if ((ace_second = FindACE(second, ace_first)) == NULL)        {            return 1;        }        /* permissions must also match */        if (acl_get_permset(ace_first, &perms_first) != 0)        {            Log(LOG_LEVEL_ERR, "Unable to read permissions. (acl_get_permset: %s)", GetErrorStr());            return -1;        }        if (acl_get_permset(ace_second, &perms_second) != 0)        {            Log(LOG_LEVEL_ERR, "Unable to read permissions. (acl_get_permset: %s)", GetErrorStr());            return -1;        }        retv_perms = PermsetEquals(perms_first, perms_second);        if (retv_perms == -1)        {            return -1;        }        else if (retv_perms == 1)       // permissions differ        {            return 1;        }        more_aces = acl_get_entry(first, ACL_NEXT_ENTRY, &ace_first);    }    return 0;}

static void TransformGidsToGroups(StringSet **list){    StringSet *new_list = StringSetNew();    StringSetIterator i = StringSetIteratorInit(*list);    const char *data;    for (data = StringSetIteratorNext(&i); data; data = StringSetIteratorNext(&i))    {        if (strlen(data) != strspn(data, "0123456789"))        {            // Cannot possibly be a gid.            StringSetAdd(new_list, xstrdup(data));            continue;        }        // In groups vs gids, groups take precedence. So check if it exists.        errno = 0;        struct group *group_info = getgrnam(data);        if (!group_info)        {            switch (errno)            {            case 0:            case ENOENT:            case EBADF:            case ESRCH:            case EWOULDBLOCK:            case EPERM:                // POSIX is apparently ambiguous here. All values mean "not found".                errno = 0;                group_info = getgrgid(atoi(data));                if (!group_info)                {                    switch (errno)                    {                    case 0:                    case ENOENT:                    case EBADF:                    case ESRCH:                    case EWOULDBLOCK:                    case EPERM:                        // POSIX is apparently ambiguous here. All values mean "not found".                        //                        // Neither group nor gid is found. This will lead to an error later, but we don't                        // handle that here.                        break;                    default:                        Log(LOG_LEVEL_ERR, "Error while checking group name '%s'. (getgrgid: '%s')", data, GetErrorStr());                        StringSetDestroy(new_list);                        return;                    }                }                else                {                    // Replace gid with group name.                    StringSetAdd(new_list, xstrdup(group_info->gr_name));                }                break;            default:                Log(LOG_LEVEL_ERR, "Error while checking group name '%s'. (getgrnam: '%s')", data, GetErrorStr());                StringSetDestroy(new_list);                return;            }        }        else        {            StringSetAdd(new_list, xstrdup(data));        }    }    StringSet *old_list = *list;    *list = new_list;    StringSetDestroy(old_list);}

static int CheckPosixLinuxACEs(EvalContext *ctx, Rlist *aces, AclMethod method, const char *file_path, acl_type_t acl_type, Attributes a,                               const Promise *pp, PromiseResult *result){    acl_t acl_existing;    acl_t acl_new;    acl_t acl_tmp;    acl_entry_t ace_parsed;    acl_entry_t ace_current;    acl_permset_t perms;    char *cf_ace;    int retv;    int has_mask;    Rlist *rp;    char *acl_type_str;    acl_new = NULL;    acl_existing = NULL;    acl_tmp = NULL;    has_mask = false;    acl_type_str = acl_type == ACL_TYPE_ACCESS ? "Access" : "Default";// read existing acl    if ((acl_existing = acl_get_file(file_path, acl_type)) == NULL)    {        Log(LOG_LEVEL_VERBOSE, "No ACL for '%s' could be read. (acl_get_file: %s)", file_path, GetErrorStr());        return false;    }// allocate memory for temp ace (it needs to reside in a temp acl)    if ((acl_tmp = acl_init(1)) == NULL)    {        Log(LOG_LEVEL_ERR, "New ACL could not be allocated (acl_init: %s)", GetErrorStr());        acl_free((void *) acl_existing);        return false;    }    if (acl_create_entry(&acl_tmp, &ace_parsed) != 0)    {        Log(LOG_LEVEL_ERR, "New ACL could not be allocated (acl_create_entry: %s)", GetErrorStr());        acl_free((void *) acl_existing);        acl_free((void *) acl_tmp);        return false;    }// copy existing aces if we are appending    if (method == ACL_METHOD_APPEND)    {        if ((acl_new = acl_dup(acl_existing)) == NULL)        {            Log(LOG_LEVEL_ERR, "Error copying existing ACL (acl_dup: %s)", GetErrorStr());            acl_free((void *) acl_existing);            acl_free((void *) acl_tmp);            return false;        }    }    else                        // overwrite existing acl    {        if ((acl_new = acl_init(5)) == NULL)    // TODO: Always OK with 5 here ?        {            Log(LOG_LEVEL_ERR, "New ACL could not be allocated (acl_init: %s)", GetErrorStr());            acl_free((void *) acl_existing);            acl_free((void *) acl_tmp);            return false;        }    }    for (rp = aces; rp != NULL; rp = rp->next)    {        cf_ace = RlistScalarValue(rp);        if (!ParseEntityPosixLinux(&cf_ace, ace_parsed, &has_mask))        {            Log(LOG_LEVEL_ERR, "Error parsing entity in 'cf_ace'.");            acl_free((void *) acl_existing);            acl_free((void *) acl_tmp);            acl_free((void *) acl_new);            return false;        }        // check if an ACE with this entity-type and id already exist in the Posix Linux ACL        ace_current = FindACE(acl_new, ace_parsed);        // create new entry in ACL if it did not exist        if (ace_current == NULL)        {            if (acl_create_entry(&acl_new, &ace_current) != 0)            {                Log(LOG_LEVEL_ERR, "Failed to allocate ace (acl_create_entry: %s)", GetErrorStr());                acl_free((void *) acl_existing);                acl_free((void *) acl_tmp);                acl_free((void *) acl_new);                return false;            }//.........这里部分代码省略.........

static bool GetPasswordHash(const char *puser, const struct passwd *passwd_info, const char **result){    // Silence warning.    (void)puser;#ifdef HAVE_GETSPNAM    // If the hash is very short, it's probably a stub. Try getting the shadow password instead.    if (strlen(passwd_info->pw_passwd) <= 4)    {        Log(LOG_LEVEL_VERBOSE, "Getting user '%s' password hash from shadow database.", puser);        struct spwd *spwd_info;        errno = 0;        spwd_info = getspnam(puser);        if (!spwd_info)        {            if (errno)            {                Log(LOG_LEVEL_ERR, "Could not get information from user shadow database. (getspnam: '%s')", GetErrorStr());                return false;            }            else            {                Log(LOG_LEVEL_ERR, "Could not find user when checking password.");                return false;            }        }        else if (spwd_info)        {            *result = spwd_info->sp_pwdp;            return true;        }    }#endif // HAVE_GETSPNAM    Log(LOG_LEVEL_VERBOSE, "Getting user '%s' password hash from passwd database.", puser);    *result = passwd_info->pw_passwd;    return true;}

static bool ChangePasswordHashUsingLckpwdf(const char *puser, const char *password){    bool result = false;    struct stat statbuf;    const char *passwd_file = "/etc/shadow";    if (stat(passwd_file, &statbuf) == -1)    {        passwd_file = "/etc/passwd";    }    Log(LOG_LEVEL_VERBOSE, "Changing password hash for user '%s' by editing '%s'.", puser, passwd_file);    if (lckpwdf() != 0)    {        Log(LOG_LEVEL_ERR, "Not able to obtain lock on password database.");        return false;    }    char backup_file[strlen(passwd_file) + strlen(".cf-backup") + 1];    snprintf(backup_file, sizeof(backup_file), "%s.cf-backup", passwd_file);    unlink(backup_file);    char edit_file[strlen(passwd_file) + strlen(".cf-edit") + 1];    snprintf(edit_file, sizeof(edit_file), "%s.cf-edit", passwd_file);    unlink(edit_file);    if (!CopyRegularFileDisk(passwd_file, backup_file))    {        Log(LOG_LEVEL_ERR, "Could not back up existing password database '%s' to '%s'.", passwd_file, backup_file);        goto unlock_passwd;    }    FILE *passwd_fd = fopen(passwd_file, "r");    if (!passwd_fd)    {        Log(LOG_LEVEL_ERR, "Could not open password database '%s'. (fopen: '%s')", passwd_file, GetErrorStr());        goto unlock_passwd;    }    int edit_fd_int = open(edit_file, O_WRONLY | O_CREAT | O_EXCL, S_IWUSR);    if (edit_fd_int < 0)    {        if (errno == EEXIST)        {            Log(LOG_LEVEL_CRIT, "Temporary file already existed when trying to open '%s'. (open: '%s') "                "This should NEVER happen and could mean that someone is trying to break into your system!!",                edit_file, GetErrorStr());        }        else        {            Log(LOG_LEVEL_ERR, "Could not open password database temporary file '%s'. (open: '%s')", edit_file, GetErrorStr());        }        goto close_passwd_fd;    }    FILE *edit_fd = fdopen(edit_fd_int, "w");    if (!edit_fd)    {        Log(LOG_LEVEL_ERR, "Could not open password database temporary file '%s'. (fopen: '%s')", edit_file, GetErrorStr());        close(edit_fd_int);        goto close_passwd_fd;    }    while (true)    {        size_t line_size = CF_BUFSIZE;        char *line = xmalloc(line_size);        int read_result = getline(&line, &line_size, passwd_fd);        if (read_result < 0)        {            if (!feof(passwd_fd))            {                Log(LOG_LEVEL_ERR, "Error while reading password database: %s", GetErrorStr());                free(line);                goto close_both;            }            else            {                break;            }        }        else if (read_result >= sizeof(line))        {            Log(LOG_LEVEL_ERR, "Unusually long line found in password database while editing user '%s'. Not updating.",                puser);        }        // Editing the password database is risky business, so do as little parsing as possible.        // Just enough to get the hash in there.        char *field_start = NULL;        char *field_end = NULL;        field_start = strchr(line, ':');        if (field_start)        {            field_end = strchr(field_start + 1, ':');        }        if (!field_start || !field_end)        {            Log(LOG_LEVEL_ERR, "Unexpected format found in password database while editing user '%s'. Not updating.",                puser);//.........这里部分代码省略.........

int LoadProcessTable(Item **procdata){    FILE *prp;    char pscomm[CF_MAXLINKSIZE];    Item *rootprocs = NULL;    Item *otherprocs = NULL;    if (PROCESSTABLE)    {        Log(LOG_LEVEL_VERBOSE, "Reusing cached process table");        return true;    }    CheckPsLineLimitations();    const char *psopts = GetProcessOptions();    snprintf(pscomm, CF_MAXLINKSIZE, "%s %s", VPSCOMM[VPSHARDCLASS], psopts);    Log(LOG_LEVEL_VERBOSE, "Observe process table with %s", pscomm);    if ((prp = cf_popen(pscomm, "r", false)) == NULL)    {        Log(LOG_LEVEL_ERR, "Couldn't open the process list with command '%s'. (popen: %s)", pscomm, GetErrorStr());        return false;    }    size_t vbuff_size = CF_BUFSIZE;    char *vbuff = xmalloc(vbuff_size);# ifdef HAVE_GETZONEID    char *names[CF_PROCCOLS];    int start[CF_PROCCOLS];    int end[CF_PROCCOLS];    Seq *pidlist = SeqNew(1, NULL);    Seq *rootpidlist = SeqNew(1, NULL);    bool global_zone = IsGlobalZone();    if (global_zone)    {        int res = ZLoadProcesstable(pidlist, rootpidlist);        if (res == false)        {            Log(LOG_LEVEL_ERR, "Unable to load solaris zone process table.");            return false;        }    }# endif    for (;;)    {        ssize_t res = CfReadLine(&vbuff, &vbuff_size, prp);        if (res == -1)        {            if (!feof(prp))            {                Log(LOG_LEVEL_ERR, "Unable to read process list with command '%s'. (fread: %s)", pscomm, GetErrorStr());                cf_pclose(prp);                free(vbuff);                return false;            }            else            {                break;            }        }        Chop(vbuff, vbuff_size);# ifdef HAVE_GETZONEID        if (global_zone)        {            if (strstr(vbuff, "PID") != NULL)            {   /* this is the banner so get the column header names for later use*/                GetProcessColumnNames(vbuff, &names[0], start, end);            }            else            {               int gpid = ExtractPid(vbuff, names, end);               if (!IsGlobalProcess(gpid, pidlist, rootpidlist))               {                    continue;               }            }        }# endif        AppendItem(procdata, vbuff, "");    }    cf_pclose(prp);/* Now save the data */    snprintf(vbuff, CF_MAXVARSIZE, "%s/state/cf_procs", CFWORKDIR);//.........这里部分代码省略.........

static void TransformGidsToGroups(StringSet **list){    StringSet *new_list = StringSetNew();    StringSetIterator i = StringSetIteratorInit(*list);    const char *data;    for (data = StringSetIteratorNext(&i); data; data = StringSetIteratorNext(&i))    {        if (strlen(data) != strspn(data, "0123456789"))        {            // Cannot possibly be a gid.            StringSetAdd(new_list, xstrdup(data));            continue;        }        // In groups vs gids, groups take precedence. So check if it exists.        struct group *group_info = GetGrEntry(data, &EqualGroupName);        if (!group_info)        {            if (errno == 0)            {                group_info = GetGrEntry(data, &EqualGid);                if (!group_info)                {                    if (errno != 0)                    {                        Log(LOG_LEVEL_ERR, "Error while checking group name '%s': %s", data, GetErrorStr());                        StringSetDestroy(new_list);                        return;                    }                    // Neither group nor gid is found. This will lead to an error later, but we don't                    // handle that here.                }                else                {                    // Replace gid with group name.                    StringSetAdd(new_list, xstrdup(group_info->gr_name));                }            }            else            {                Log(LOG_LEVEL_ERR, "Error while checking group name '%s': '%s'", data, GetErrorStr());                StringSetDestroy(new_list);                return;            }        }        else        {            StringSetAdd(new_list, xstrdup(data));        }    }    StringSet *old_list = *list;    *list = new_list;    StringSetDestroy(old_list);}

static bool MissingInputFile(const char *input_file){    struct stat sb;    if (stat(input_file, &sb) == -1)    {        Log(LOG_LEVEL_ERR, "There is no readable input file at '%s'. (stat: %s)", input_file, GetErrorStr());        return true;    }    return false;}

/* Load processes using zone-aware ps * to obtain solaris list of global * process ids for root and non-root * users to lookup later */int ZLoadProcesstable(Seq *pidlist, Seq *rootpidlist){    char *names[CF_PROCCOLS];    int start[CF_PROCCOLS];    int end[CF_PROCCOLS];    int index = 0;    const char *pscmd = "/usr/bin/ps -Aleo zone,user,pid";    FILE *psf = cf_popen(pscmd, "r", false);    if (psf == NULL)    {        Log(LOG_LEVEL_ERR, "ZLoadProcesstable: Couldn't open the process list with command %s.", pscmd);        return false;    }    size_t pbuff_size = CF_BUFSIZE;    char *pbuff = xmalloc(pbuff_size);    while (true)    {        ssize_t res = CfReadLine(&pbuff, &pbuff_size, psf);        if (res == -1)        {            if (!feof(psf))            {                Log(LOG_LEVEL_ERR, "IsGlobalProcess(char **, int): Unable to read process list with command '%s'. (fread: %s)", pscmd, GetErrorStr());                cf_pclose(psf);                free(pbuff);                return false;            }            else            {                break;            }        }        Chop(pbuff, pbuff_size);        if (strstr(pbuff, "PID")) /* This line is the header. */        {            GetProcessColumnNames(pbuff, &names[0], start, end);        }        else        {            int pid = ExtractPid(pbuff, &names[0], end);            size_t zone_offset = strspn(pbuff, " ");            size_t zone_end_offset = strcspn(pbuff + zone_offset, " ") + zone_offset;            size_t user_offset = strspn(pbuff + zone_end_offset, " ") + zone_end_offset;            size_t user_end_offset = strcspn(pbuff + user_offset, " ") + user_offset;            bool is_global = (zone_end_offset - zone_offset == 6                                  && strncmp(pbuff + zone_offset, "global", 6) == 0);            bool is_root = (user_end_offset - user_offset == 4                                && strncmp(pbuff + user_offset, "root", 4) == 0);            if (is_global && is_root)            {                SeqAppend(rootpidlist, (void*)(intptr_t)pid);            }            else if (is_global && !is_root)            {                SeqAppend(pidlist, (void*)(intptr_t)pid);            }        }    }    cf_pclose(psf);    free(pbuff);    return true;}

//.........这里部分代码省略.........    else    {        chmod(vbuff, sb.st_mode | 0700);    }    snprintf(ebuff, sizeof(ebuff), "%s%cstate%ccf_procs",             CFWORKDIR, FILE_SEPARATOR, FILE_SEPARATOR);    MakeParentDirectory(ebuff, force);    if (stat(ebuff, &statbuf) == -1)    {        CreateEmptyFile(ebuff);    }    snprintf(ebuff, sizeof(ebuff), "%s%cstate%ccf_rootprocs",             CFWORKDIR, FILE_SEPARATOR, FILE_SEPARATOR);    if (stat(ebuff, &statbuf) == -1)    {        CreateEmptyFile(ebuff);    }    snprintf(ebuff, sizeof(ebuff), "%s%cstate%ccf_otherprocs",             CFWORKDIR, FILE_SEPARATOR, FILE_SEPARATOR);    if (stat(ebuff, &statbuf) == -1)    {        CreateEmptyFile(ebuff);    }    snprintf(ebuff, sizeof(ebuff), "%s%cstate%cprevious_state%c",             CFWORKDIR, FILE_SEPARATOR, FILE_SEPARATOR, FILE_SEPARATOR);    MakeParentDirectory(ebuff, force);    snprintf(ebuff, sizeof(ebuff), "%s%cstate%cdiff%c",             CFWORKDIR, FILE_SEPARATOR, FILE_SEPARATOR, FILE_SEPARATOR);    MakeParentDirectory(ebuff, force);    snprintf(ebuff, sizeof(ebuff), "%s%cstate%cuntracked%c",            CFWORKDIR, FILE_SEPARATOR, FILE_SEPARATOR, FILE_SEPARATOR);    MakeParentDirectory(ebuff, force);    OpenNetwork();    CryptoInitialize();    CheckWorkingDirectories(ctx);    /* Initialize keys and networking. cf-key, doesn't need keys. In fact it       must function properly even without them, so that it generates them! */    if (config->agent_type != AGENT_TYPE_KEYGEN)    {        LoadSecretKeys();        char *bootstrapped_policy_server = ReadPolicyServerFile(CFWORKDIR);        PolicyHubUpdateKeys(bootstrapped_policy_server);        free(bootstrapped_policy_server);        cfnet_init();    }    size_t cwd_size = PATH_MAX;    while (true)    {        char cwd[cwd_size];        if (!getcwd(cwd, cwd_size))        {            if (errno == ERANGE)            {                cwd_size *= 2;                continue;            }            Log(LOG_LEVEL_WARNING, "Could not determine current directory. (getcwd: '%s')", GetErrorStr());            break;        }        EvalContextSetLaunchDirectory(ctx, cwd);        break;    }    if (!MINUSF)    {        GenericAgentConfigSetInputFile(config, GetInputDir(), "promises.cf");    }    VIFELAPSED = 1;    VEXPIREAFTER = 1;    setlinebuf(stdout);    if (config->agent_specific.agent.bootstrap_policy_server)    {        snprintf(vbuff, CF_BUFSIZE, "%s%cfailsafe.cf", GetInputDir(), FILE_SEPARATOR);        if (stat(vbuff, &statbuf) == -1)        {            GenericAgentConfigSetInputFile(config, GetInputDir(), "failsafe.cf");        }        else        {            GenericAgentConfigSetInputFile(config, GetInputDir(), vbuff);        }    }}

/** * @brief Writes a file with a contained release ID based on git SHA, *        or file checksum if git SHA is not available. * @param filename the release_id file * @param dirname the directory to checksum or get the Git hash * @return True if successful */static bool WriteReleaseIdFile(const char *filename, const char *dirname){    char release_id[GENERIC_AGENT_CHECKSUM_SIZE];    bool have_release_id =        GeneratePolicyReleaseID(release_id, sizeof(release_id), dirname);    if (!have_release_id)    {        return false;    }    int fd = creat(filename, 0600);    if (fd == -1)    {        Log(LOG_LEVEL_ERR, "While writing policy release ID file '%s', could not create file (creat: %s)", filename, GetErrorStr());        return false;    }    JsonElement *info = JsonObjectCreate(3);    JsonObjectAppendString(info, "releaseId", release_id);    Writer *w = FileWriter(fdopen(fd, "w"));    JsonWrite(w, info, 0);    WriterClose(w);    JsonDestroy(info);    Log(LOG_LEVEL_VERBOSE, "Saved policy release ID file '%s'", filename);    return true;}

/** * @brief Writes a file with a contained timestamp to mark a policy file as validated * @param filename the filename * @return True if successful. */static bool WritePolicyValidatedFile(ARG_UNUSED const GenericAgentConfig *config, const char *filename){    if (!MakeParentDirectory(filename, true))    {        Log(LOG_LEVEL_ERR, "While writing policy validated marker file '%s', could not create directory (MakeParentDirectory: %s)", filename, GetErrorStr());        return false;    }    int fd = creat(filename, 0600);    if (fd == -1)    {        Log(LOG_LEVEL_ERR, "While writing policy validated marker file '%s', could not create file (creat: %s)", filename, GetErrorStr());        return false;    }    JsonElement *info = JsonObjectCreate(3);    JsonObjectAppendInteger(info, "timestamp", time(NULL));    Writer *w = FileWriter(fdopen(fd, "w"));    JsonWrite(w, info, 0);    WriterClose(w);    JsonDestroy(info);    Log(LOG_LEVEL_VERBOSE, "Saved policy validated marker file '%s'", filename);    return true;}

static bool ConsiderFile(const char *nodename, const char *path, struct stat *stat){    int i;    const char *sp;    if (strlen(nodename) < 1)    {        Log(LOG_LEVEL_ERR, "Empty (null) filename detected in %s", path);        return true;    }    if (IsItemIn(SUSPICIOUSLIST, nodename))    {        if (stat && (S_ISREG(stat->st_mode) || S_ISLNK(stat->st_mode)))        {            Log(LOG_LEVEL_ERR, "Suspicious file %s found in %s", nodename, path);            return false;        }    }    if (strcmp(nodename, "...") == 0)    {        Log(LOG_LEVEL_VERBOSE, "Possible DFS/FS cell node detected in %s...", path);        return true;    }    for (i = 0; SKIPFILES[i] != NULL; i++)    {        if (strcmp(nodename, SKIPFILES[i]) == 0)        {            Log(LOG_LEVEL_DEBUG, "Filename '%s/%s' is classified as ignorable", path, nodename);            return false;        }    }    if ((strcmp("[", nodename) == 0) && (strcmp("/usr/bin", path) == 0))    {#if defined(__linux__)        return true;#endif    }    for (sp = nodename; *sp != '/0'; sp++)    {        if ((*sp > 31) && (*sp < 127))        {            break;        }    }    for (sp = nodename; *sp != '/0'; sp++)      /* Check for files like ".. ." */    {        if ((*sp != '.') && (!isspace((int)*sp)))        {            return true;        }    }    if (stat == NULL)    {        Log(LOG_LEVEL_VERBOSE, "Couldn't stat '%s/%s'. (cf_lstat: %s)", path, nodename, GetErrorStr());        return true;    }    if ((stat->st_size == 0) && LogGetGlobalLevel() < LOG_LEVEL_INFO)   /* No sense in warning about empty files */    {        return false;    }    Log(LOG_LEVEL_ERR, "Suspicious looking file object '%s' masquerading as hidden file in '%s'", nodename, path);    if (S_ISLNK(stat->st_mode))    {        Log(LOG_LEVEL_INFO, "   %s is a symbolic link", nodename);    }    else if (S_ISDIR(stat->st_mode))    {        Log(LOG_LEVEL_INFO, "   %s is a directory", nodename);    }    Log(LOG_LEVEL_VERBOSE, "[%s] has size %ld and full mode %o", nodename, (unsigned long) (stat->st_size),        (unsigned int) (stat->st_mode));    return true;}

bool CopyFileExtendedAttributesDisk(const char *source, const char *destination){#if defined(WITH_XATTR)    // Extended attributes include both POSIX ACLs and SELinux contexts.    ssize_t attr_raw_names_size;    char attr_raw_names[CF_BUFSIZE];    attr_raw_names_size = llistxattr(source, attr_raw_names, sizeof(attr_raw_names));    if (attr_raw_names_size < 0)    {        if (errno == ENOTSUP || errno == ENODATA)        {            return true;        }        else        {            Log(LOG_LEVEL_ERR, "Can't copy extended attributes from '%s' to '%s'. (llistxattr: %s)",                source, destination, GetErrorStr());            return false;        }    }    int pos;    for (pos = 0; pos < attr_raw_names_size;)    {        const char *current = attr_raw_names + pos;        pos += strlen(current) + 1;        char data[CF_BUFSIZE];        int datasize = lgetxattr(source, current, data, sizeof(data));        if (datasize < 0)        {            if (errno == ENOTSUP)            {                continue;            }            else            {                Log(LOG_LEVEL_ERR, "Can't copy extended attributes from '%s' to '%s'. (lgetxattr: %s: %s)",                    source, destination, GetErrorStr(), current);                return false;            }        }        int ret = lsetxattr(destination, current, data, datasize, 0);        if (ret < 0)        {            if (errno == ENOTSUP)            {                continue;            }            else            {                Log(LOG_LEVEL_ERR, "Can't copy extended attributes from '%s' to '%s'. (lsetxattr: %s: %s)",                    source, destination, GetErrorStr(), current);                return false;            }        }    }#else // !WITH_XATTR    // ACLs are included in extended attributes, but fall back to CopyACLs if xattr is not available.    if (!CopyACLs(source, destination))    {        return false;    }#endif    return true;}

int ExpandLinks(char *dest, const char *from, int level){    char buff[CF_BUFSIZE];    char node[CF_MAXLINKSIZE];    struct stat statbuf;    int lastnode = false;    memset(dest, 0, CF_BUFSIZE);    if (level >= CF_MAXLINKLEVEL)    {        Log(LOG_LEVEL_ERR, "Too many levels of symbolic links to evaluate absolute path");        return false;    }    const char *sp = from;    while (*sp != '/0')    {        if (*sp == FILE_SEPARATOR)        {            sp++;            continue;        }        sscanf(sp, "%[^/]", node);        sp += strlen(node);        if (*sp == '/0')        {            lastnode = true;        }        if (strcmp(node, ".") == 0)        {            continue;        }        if (strcmp(node, "..") == 0)        {            continue;        }        else        {            strcat(dest, "/");        }        strcat(dest, node);        if (lstat(dest, &statbuf) == -1)        /* File doesn't exist so we can stop here */        {            Log(LOG_LEVEL_ERR, "Can't stat '%s' in ExpandLinks. (lstat: %s)", dest, GetErrorStr());            return false;        }        if (S_ISLNK(statbuf.st_mode))        {            memset(buff, 0, CF_BUFSIZE);            if (readlink(dest, buff, CF_BUFSIZE - 1) == -1)            {                Log(LOG_LEVEL_ERR, "Expand links can't stat '%s'. (readlink: %s)", dest, GetErrorStr());                return false;            }            else            {                if (buff[0] == '.')                {                    ChopLastNode(dest);                    AddSlash(dest);                    /* TODO pass and use parameter dest_size. */                    size_t ret = strlcat(dest, buff, CF_BUFSIZE);                    if (ret >= CF_BUFSIZE)                    {                        Log(LOG_LEVEL_ERR,                            "Internal limit reached in ExpandLinks(),"                            " path too long: '%s' + '%s'",                            dest, buff);                        return false;                    }                }                else if (IsAbsoluteFileName(buff))                {                    strcpy(dest, buff);                    DeleteSlash(dest);                    if (strcmp(dest, from) == 0)                    {                        Log(LOG_LEVEL_DEBUG, "No links to be expanded");                        return true;                    }                    if ((!lastnode) && (!ExpandLinks(buff, dest, level + 1)))                    {                        return false;                    }                }                else                {//.........这里部分代码省略.........

//.........这里部分代码省略.........        if (a.contain.umask == 0)        {            Log(LOG_LEVEL_VERBOSE, "Programming '%s' running with umask 0! Use umask= to set", cmdline);        }#endif /* !__MINGW32__ */        if (a.contain.shelltype == SHELL_TYPE_POWERSHELL)        {#ifdef __MINGW32__            pfp =                cf_popen_powershell_setuid(cmdline, "r", a.contain.owner, a.contain.group, a.contain.chdir, a.contain.chroot,                                  a.transaction.background);#else // !__MINGW32__            Log(LOG_LEVEL_ERR, "Powershell is only supported on Windows");            return ACTION_RESULT_FAILED;#endif // !__MINGW32__        }        else if (a.contain.shelltype == SHELL_TYPE_USE)        {            pfp =                cf_popen_shsetuid(cmdline, "r", a.contain.owner, a.contain.group, a.contain.chdir, a.contain.chroot,                                  a.transaction.background);        }        else        {            pfp =                cf_popensetuid(cmdline, "r", a.contain.owner, a.contain.group, a.contain.chdir, a.contain.chroot,                               a.transaction.background);        }        if (pfp == NULL)        {            Log(LOG_LEVEL_ERR, "Couldn't open pipe to command '%s'. (cf_popen: %s)", cmdline, GetErrorStr());            return ACTION_RESULT_FAILED;        }        for (;;)        {            ssize_t res = CfReadLine(line, CF_BUFSIZE, pfp);            if (res == 0)            {                break;            }            if (res == -1)            {                Log(LOG_LEVEL_ERR, "Unable to read output from command '%s'. (fread: %s)", cmdline, GetErrorStr());                cf_pclose(pfp);                return ACTION_RESULT_FAILED;            }            if (strstr(line, "cfengine-die"))            {                break;            }            if (a.contain.preview)            {                PreviewProtocolLine(line, cmdline);            }            if (a.module)            {                ModuleProtocol(ctx, cmdline, line, !a.contain.nooutput, PromiseGetNamespace(pp));

void VerifyOneUsersPromise (const char *puser, User u, PromiseResult *result, enum cfopaction action,                            EvalContext *ctx, const Attributes *a, const Promise *pp){    bool res;    struct passwd *passwd_info;    errno = 0;    passwd_info = getpwnam(puser);    // Apparently POSIX is ambiguous here. All the values below mean "not found".    if (!passwd_info && errno != 0 && errno != ENOENT && errno != EBADF && errno != ESRCH            && errno != EWOULDBLOCK && errno != EPERM)    {        Log(LOG_LEVEL_ERR, "Could not get information from user database. (getpwnam: '%s')", GetErrorStr());        return;    }    if (u.policy == USER_STATE_PRESENT || u.policy == USER_STATE_LOCKED)    {        if (passwd_info)        {            uint32_t cmap = 0;            if (VerifyIfUserNeedsModifs (puser, u, passwd_info, &cmap))            {                res = DoModifyUser (puser, u, passwd_info, cmap, action);                if (res)                {                    *result = PROMISE_RESULT_CHANGE;                }                else                {                    *result = PROMISE_RESULT_FAIL;                }            }            else            {                *result = PROMISE_RESULT_NOOP;            }        }        else        {            res = DoCreateUser (puser, u, action, ctx, a, pp);            if (res)            {                *result = PROMISE_RESULT_CHANGE;            }            else            {                *result = PROMISE_RESULT_FAIL;            }        }    }    else if (u.policy == USER_STATE_ABSENT)    {        if (passwd_info)        {            res = DoRemoveUser (puser, action);            if (res)            {                *result = PROMISE_RESULT_CHANGE;            }            else            {                *result = PROMISE_RESULT_FAIL;            }        }        else        {            *result = PROMISE_RESULT_NOOP;        }    }}

//.........这里部分代码省略.........    while (!IsPendingTermination())    {        time_t now = time(NULL);        /* Note that this loop logic is single threaded, but ACTIVE_THREADS           might still change in threads pertaining to service handling */        if (ThreadLock(cft_server_children))        {            if (ACTIVE_THREADS == 0)            {                CheckFileChanges(ctx, policy, config);            }            ThreadUnlock(cft_server_children);        }        // Check whether we should try to establish peering with a hub        if ((COLLECT_INTERVAL > 0) && ((now - last_collect) > COLLECT_INTERVAL))        {            TryCollectCall();            last_collect = now;            continue;        }        /* check if listening is working */        if (sd != -1)        {            // Look for normal incoming service requests            FD_ZERO(&rset);            FD_SET(sd, &rset);            /* Set 1 second timeout for select, so that signals are handled in             * a timely manner */            timeout.tv_sec = 1;            timeout.tv_usec = 0;            Log(LOG_LEVEL_DEBUG, "Waiting at incoming select...");            ret_val = select((sd + 1), &rset, NULL, NULL, &timeout);            if (ret_val == -1)      /* Error received from call to select */            {                if (errno == EINTR)                {                    continue;                }                else                {                    Log(LOG_LEVEL_ERR, "select failed. (select: %s)", GetErrorStr());                    exit(1);                }            }            else if (!ret_val) /* No data waiting, we must have timed out! */            {                continue;            }            Log(LOG_LEVEL_VERBOSE, "Accepting a connection");            if ((sd_reply = accept(sd, (struct sockaddr *) &cin, &addrlen)) != -1)            {                /* Just convert IP address to string, no DNS lookup. */                char ipaddr[CF_MAX_IP_LEN] = "";                getnameinfo((struct sockaddr *) &cin, addrlen,                            ipaddr, sizeof(ipaddr),                            NULL, 0, NI_NUMERICHOST);                ServerEntryPoint(ctx, sd_reply, ipaddr);            }        }    }    PolicyDestroy(server_cfengine_policy);}/*********************************************************************//* Level 2                                                           *//*********************************************************************/int InitServer(size_t queue_size){    int sd = -1;    if ((sd = OpenReceiverChannel()) == -1)    {        Log(LOG_LEVEL_ERR, "Unable to start server");        exit(1);    }    if (listen(sd, queue_size) == -1)    {        Log(LOG_LEVEL_ERR, "listen failed. (listen: %s)", GetErrorStr());        exit(1);    }    return sd;}

static bool GroupGetUserMembership (const char *user, StringSet *result){    bool ret = true;    struct group *group_info;    setgrent();    while (true)    {        errno = 0;        group_info = getgrent();        if (!group_info)        {            if (errno)            {                Log(LOG_LEVEL_ERR, "Error while getting group list. (getgrent: '%s')", GetErrorStr());                ret = false;            }            break;        }        for (int i = 0; group_info->gr_mem[i] != NULL; i++)        {            if (strcmp(user, group_info->gr_mem[i]) == 0)            {                StringSetAdd(result, xstrdup(group_info->gr_name));                break;            }        }    }    endgrent();    return ret;}

int OpenReceiverChannel(void){    struct addrinfo *response, *ap;    struct addrinfo query = {        .ai_flags = AI_PASSIVE,        .ai_family = AF_UNSPEC,        .ai_socktype = SOCK_STREAM    };    /* Listen to INADDR(6)_ANY if BINDINTERFACE unset. */    char *ptr = NULL;    if (BINDINTERFACE[0] != '/0')    {        ptr = BINDINTERFACE;    }    /* Resolve listening interface. */    if (getaddrinfo(ptr, STR_CFENGINEPORT, &query, &response) != 0)    {        Log(LOG_LEVEL_ERR, "DNS/service lookup failure. (getaddrinfo: %s)", GetErrorStr());        return -1;    }    int sd = -1;    for (ap = response; ap != NULL; ap = ap->ai_next)    {        if ((sd = socket(ap->ai_family, ap->ai_socktype, ap->ai_protocol)) == -1)        {            continue;        }        int yes = 1;        if (setsockopt(sd, SOL_SOCKET, SO_REUSEADDR,                       &yes, sizeof(yes)) == -1)        {            Log(LOG_LEVEL_ERR, "Socket option SO_REUSEADDR was not accepted. (setsockopt: %s)", GetErrorStr());            exit(1);        }        struct linger cflinger = {            .l_onoff = 1,            .l_linger = 60        };        if (setsockopt(sd, SOL_SOCKET, SO_LINGER,                       &cflinger, sizeof(cflinger)) == -1)        {            Log(LOG_LEVEL_ERR, "Socket option SO_LINGER was not accepted. (setsockopt: %s)", GetErrorStr());            exit(1);        }        if (bind(sd, ap->ai_addr, ap->ai_addrlen) != -1)        {            if (LogGetGlobalLevel() >= LOG_LEVEL_DEBUG)            {                /* Convert IP address to string, no DNS lookup performed. */                char txtaddr[CF_MAX_IP_LEN] = "";                getnameinfo(ap->ai_addr, ap->ai_addrlen,                            txtaddr, sizeof(txtaddr),                            NULL, 0, NI_NUMERICHOST);                Log(LOG_LEVEL_DEBUG, "Bound to address '%s' on '%s' = %d", txtaddr,                    CLASSTEXT[VSYSTEMHARDCLASS], VSYSTEMHARDCLASS);            }            break;        }        else        {            Log(LOG_LEVEL_ERR, "Could not bind server address. (bind: %s)", GetErrorStr());            cf_closesocket(sd);        }    }    if (sd < 0)    {        Log(LOG_LEVEL_ERR, "Couldn't open/bind a socket");        exit(1);    }    freeaddrinfo(response);    return sd;}/*********************************************************************//* Level 3                                                           *//*********************************************************************/void CheckFileChanges(EvalContext *ctx, Policy **policy, GenericAgentConfig *config){    Log(LOG_LEVEL_DEBUG, "Checking file updates for input file '%s'", config->input_file);    if (NewPromiseProposals(ctx, config, InputFiles(ctx, *policy)))    {        Log(LOG_LEVEL_VERBOSE, "New promises detected...");        if (CheckPromises(config))        {            Log(LOG_LEVEL_INFO, "Rereading policy file '%s'", config->input_file);            /* Free & reload -- lock this to avoid access errors during reload */                        EvalContextHeapClear(ctx);//.........这里部分代码省略.........

static bool VerifyIfUserNeedsModifs (const char *puser, User u, const struct passwd *passwd_info,                                     uint32_t *changemap){    if (u.description != NULL && strcmp (u.description, passwd_info->pw_gecos))    {        CFUSR_SETBIT (*changemap, i_comment);    }    if (u.uid != NULL && (atoi (u.uid) != passwd_info->pw_uid))    {        CFUSR_SETBIT (*changemap, i_uid);    }    if (u.home_dir != NULL && strcmp (u.home_dir, passwd_info->pw_dir))    {        CFUSR_SETBIT (*changemap, i_home);    }    if (u.shell != NULL && strcmp (u.shell, passwd_info->pw_shell))    {        CFUSR_SETBIT (*changemap, i_shell);    }    bool account_is_locked = IsAccountLocked(puser, passwd_info);    if ((!account_is_locked && u.policy == USER_STATE_LOCKED)            || (account_is_locked && u.policy != USER_STATE_LOCKED))    {        CFUSR_SETBIT(*changemap, i_locked);    }    // Don't bother with passwords if the account is going to be locked anyway.    if (u.password != NULL && strcmp (u.password, "")            && u.policy != USER_STATE_LOCKED)    {        if (!IsPasswordCorrect(puser, u.password, u.password_format, passwd_info))        {            CFUSR_SETBIT (*changemap, i_password);        }    }    if (SafeStringLength(u.group_primary))    {        bool group_could_be_gid = (strlen(u.group_primary) == strspn(u.group_primary, "0123456789"));        int gid;        // We try name first, even if it looks like a gid. Only fall back to gid.        struct group *group_info;        errno = 0;        group_info = getgrnam(u.group_primary);        // Apparently POSIX is ambiguous here. All the values below mean "not found".        if (!group_info && errno != 0 && errno != ENOENT && errno != EBADF && errno != ESRCH                && errno != EWOULDBLOCK && errno != EPERM)        {            Log(LOG_LEVEL_ERR, "Could not obtain information about group '%s'. (getgrnam: '%s')", u.group_primary, GetErrorStr());            gid = -1;        }        else if (!group_info)        {            if (group_could_be_gid)            {                gid = atoi(u.group_primary);            }            else            {                Log(LOG_LEVEL_ERR, "No such group '%s'.", u.group_primary);                gid = -1;            }        }        else        {            gid = group_info->gr_gid;        }        if (gid != passwd_info->pw_gid)        {            CFUSR_SETBIT (*changemap, i_group);        }    }    if (u.groups_secondary != NULL)    {        StringSet *wanted_groups = StringSetNew();        for (Rlist *ptr = u.groups_secondary; ptr; ptr = ptr->next)        {            if (strcmp(RvalScalarValue(ptr->val), CF_NULL_VALUE) != 0)            {                StringSetAdd(wanted_groups, xstrdup(RvalScalarValue(ptr->val)));            }        }        TransformGidsToGroups(&wanted_groups);        StringSet *current_groups = StringSetNew();        if (!GroupGetUserMembership (puser, current_groups))        {            CFUSR_SETBIT (*changemap, i_groups);        }        else if (!StringSetIsEqual (current_groups, wanted_groups))        {            CFUSR_SETBIT (*changemap, i_groups);        }        StringSetDestroy(current_groups);        StringSetDestroy(wanted_groups);    }    ////////////////////////////////////////////    if (*changemap == 0)    {//.........这里部分代码省略.........

int IsNewerFileTree(char *dir, time_t reftime){    const struct dirent *dirp;    char path[CF_BUFSIZE] = { 0 };    Dir *dirh;    struct stat sb;// Assumes that race conditions on the file path are unlikely and unimportant    if (lstat(dir, &sb) == -1)    {        Log(LOG_LEVEL_ERR, "Unable to stat directory '%s' in IsNewerFileTree. (stat: %s)", dir, GetErrorStr());        // return true to provoke update        return true;    }    if (S_ISDIR(sb.st_mode))    {        if (sb.st_mtime > reftime)        {            Log(LOG_LEVEL_VERBOSE, " >> Detected change in %s", dir);            return true;        }    }    if ((dirh = DirOpen(dir)) == NULL)    {        Log(LOG_LEVEL_ERR, "Unable to open directory '%s' in IsNewerFileTree. (opendir: %s)", dir, GetErrorStr());        return false;    }    else    {        for (dirp = DirRead(dirh); dirp != NULL; dirp = DirRead(dirh))        {            if (!strcmp(dirp->d_name, ".") || !strcmp(dirp->d_name, ".."))            {                continue;            }            strncpy(path, dir, CF_BUFSIZE - 1);            if (!JoinPath(path, dirp->d_name))            {                Log(LOG_LEVEL_ERR, "Internal limit: Buffer ran out of space adding %s to %s in IsNewerFileTree", dir,                      path);                DirClose(dirh);                return false;            }            if (lstat(path, &sb) == -1)            {                Log(LOG_LEVEL_ERR, "Unable to stat directory '%s' in IsNewerFileTree. (lstat: %s)", path, GetErrorStr());                DirClose(dirh);                // return true to provoke update                return true;            }            if (S_ISDIR(sb.st_mode))            {                if (sb.st_mtime > reftime)                {                    Log(LOG_LEVEL_VERBOSE, " >> Detected change in %s", path);                    DirClose(dirh);                    return true;                }                else                {                    if (IsNewerFileTree(path, reftime))                    {                        DirClose(dirh);                        return true;                    }                }            }        }    }    DirClose(dirh);    return false;}

static int CheckDefaultEqualsAccessACL(EvalContext *ctx, const char *file_path, Attributes a, const Promise *pp, PromiseResult *result){    acl_t acl_access;    acl_t acl_default;    int equals;    int retval = false;    acl_access = NULL;    acl_default = NULL;    if ((acl_access = acl_get_file(file_path, ACL_TYPE_ACCESS)) == NULL)    {        Log(LOG_LEVEL_ERR, "Could not find an ACL for '%s'. (acl_get_file: %s)", file_path, GetErrorStr());        return false;    }    acl_default = acl_get_file(file_path, ACL_TYPE_DEFAULT);    if (acl_default == NULL)    {        Log(LOG_LEVEL_ERR, "Could not find default ACL for '%s'. (acl_get_file: %s)", file_path, GetErrorStr());        acl_free(acl_access);        return false;    }    equals = ACLEquals(acl_access, acl_default);    switch (equals)    {    case 0:                    // they equal, as desired        cfPS(ctx, LOG_LEVEL_VERBOSE, PROMISE_RESULT_NOOP, pp, a, "Default ACL on '%s' needs no modification.", file_path);        retval = true;        break;    case 1:                    // set access ACL as default ACL        switch (a.transaction.action)        {        case cfa_warn:            cfPS(ctx, LOG_LEVEL_WARNING, PROMISE_RESULT_WARN, pp, a, "Default ACL on '%s' needs to be copied from access ACL.",                 file_path);            *result = PromiseResultUpdate(*result, PROMISE_RESULT_WARN);            break;        case cfa_fix:            if (!DONTDO)            {                if ((acl_set_file(file_path, ACL_TYPE_DEFAULT, acl_access)) != 0)                {                    Log(LOG_LEVEL_ERR, "Could not set default ACL to access");                    acl_free(acl_access);                    acl_free(acl_default);                    return false;                }            }            cfPS(ctx, LOG_LEVEL_INFO, PROMISE_RESULT_CHANGE, pp, a, "Default ACL on '%s' successfully copied from access ACL.",                 file_path);            *result = PromiseResultUpdate(*result, PROMISE_RESULT_CHANGE);            retval = true;            break;        default:            ProgrammingError("CFEngine: internal error: illegal file action");            retval = false;        }        break;    default:        retval = false;        Log(LOG_LEVEL_ERR, "Unable to compare access and default ACEs");    }    acl_free(acl_access);    acl_free(acl_default);    return retval;}

ENTERPRISE_VOID_FUNC_2ARG_DEFINE_STUB(void, LogTotalCompliance, const char *, version, int, background_tasks){    double total = (double) (PR_KEPT + PR_NOTKEPT + PR_REPAIRED) / 100.0;    char string[CF_BUFSIZE] = { 0 };    snprintf(string, CF_BUFSIZE,             "Outcome of version %s (" CF_AGENTC "-%d): Promises observed to be kept %.2f%%, Promises repaired %.2f%%, Promises not repaired %.2f%%",             version, background_tasks,             (double) PR_KEPT / total,             (double) PR_REPAIRED / total,             (double) PR_NOTKEPT / total);    Log(LOG_LEVEL_VERBOSE, "Logging total compliance, total '%s'", string);    char filename[CF_BUFSIZE];    snprintf(filename, CF_BUFSIZE, "%s/%s", GetLogDir(), CF_PROMISE_LOG);    MapName(filename);    FILE *fout = fopen(filename, "a");    if (fout == NULL)    {        Log(LOG_LEVEL_ERR, "In total compliance logging, could not open file '%s'. (fopen: %s)", filename, GetErrorStr());    }    else    {        fprintf(fout, "%jd,%jd: %s/n", (intmax_t)CFSTARTTIME, (intmax_t)time(NULL), string);        fclose(fout);    }}

static acl_entry_t FindACE(acl_t acl, acl_entry_t ace_find){    acl_entry_t ace_curr;    acl_tag_t tag_curr;    acl_tag_t tag_find;    id_t *id_curr;    id_t *id_find;    int more_aces;    int retv_tag;    id_find = NULL;    more_aces = acl_get_entry(acl, ACL_FIRST_ENTRY, &ace_curr);    if (more_aces == -1)    {        Log(LOG_LEVEL_ERR, "Error reading acl. (acl_get_entry: %s)", GetErrorStr());        return NULL;    }    else if (more_aces == 0)    {        return NULL;    }/* find the tag type and id we are looking for */    if (acl_get_tag_type(ace_find, &tag_find) != 0)    {        Log(LOG_LEVEL_ERR, "Error reading tag type. (acl_get_tag_type: %s)", GetErrorStr());        return NULL;    }    if (tag_find == ACL_USER || tag_find == ACL_GROUP)    {        id_find = acl_get_qualifier(ace_find);        if (id_find == NULL)        {            Log(LOG_LEVEL_ERR, "Error reading tag type. (acl_get_qualifier: %s)", GetErrorStr());            return NULL;        }    }/* check if any of the aces match */    while (more_aces)    {        if ((retv_tag = acl_get_tag_type(ace_curr, &tag_curr)) != 0)        {            Log(LOG_LEVEL_ERR, "Unable to get tag type. (acl_get_tag_type: %s)", GetErrorStr());            acl_free(id_find);            return NULL;        }        if (tag_curr == tag_find)        {            if (id_find == NULL)            {                return ace_curr;            }            id_curr = acl_get_qualifier(ace_curr);            if (id_curr == NULL)            {                Log(LOG_LEVEL_ERR, "Couldn't extract qualifier. (acl_get_qualifier: %s)", GetErrorStr());                return NULL;            }            if (*id_curr == *id_find)            {                acl_free(id_find);                acl_free(id_curr);                return ace_curr;            }            acl_free(id_curr);        }        more_aces = acl_get_entry(acl, ACL_NEXT_ENTRY, &ace_curr);    }    if (id_find != NULL)    {        acl_free(id_find);    }    return NULL;}

void RemoteSysLog(int log_priority, const char *log_string){    time_t now = time(NULL);    struct addrinfo query = { 0 }, *response = NULL;    char strport[PRINTSIZE(unsigned)];    xsnprintf(strport, sizeof(strport), "%u", (unsigned) SYSLOG_PORT);    query.ai_family = AF_UNSPEC;    query.ai_socktype = SOCK_DGRAM;    int err = getaddrinfo(SYSLOG_HOST, strport, &query, &response);    if (err != 0)    {        Log(LOG_LEVEL_INFO,            "Unable to find syslog_host or service: (%s/%s) %s",            SYSLOG_HOST, strport, gai_strerror(err));        if (response != NULL)        {            freeaddrinfo(response);        }        return;    }    for (const struct addrinfo *ap = response; ap != NULL; ap = ap->ai_next)    {        /* No DNS lookup, just convert IP address to string. */        char txtaddr[CF_MAX_IP_LEN] = "";        getnameinfo(ap->ai_addr, ap->ai_addrlen,                    txtaddr, sizeof(txtaddr),                    NULL, 0, NI_NUMERICHOST);        Log(LOG_LEVEL_VERBOSE,            "Connect to syslog '%s' = '%s' on port '%s'",            SYSLOG_HOST, txtaddr, strport);        int sd = socket(ap->ai_family, ap->ai_socktype, IPPROTO_UDP);        if (sd == -1)        {            Log(LOG_LEVEL_INFO, "Couldn't open a socket. (socket: %s)", GetErrorStr());            continue;        }        else        {            const size_t rfc3164_len = 1024;            char message[rfc3164_len];            char timebuffer[26];            pid_t pid = getpid();            snprintf(message, sizeof(message), "<%i>%.15s %s %s[%d]: %s",                     log_priority | SYSLOG_FACILITY,                     cf_strtimestamp_local(now, timebuffer) + 4,                     VFQNAME, VPREFIX, pid, log_string);            err = sendto(sd, message, strlen(message),                         0, ap->ai_addr, ap->ai_addrlen);            if (err == -1)            {                Log(LOG_LEVEL_VERBOSE, "Couldn't send '%s' to syslog server '%s'. (sendto: %s)",                    message, SYSLOG_HOST, GetErrorStr());            }            else            {                Log(LOG_LEVEL_VERBOSE, "Syslog message: '%s' to server '%s'", message, SYSLOG_HOST);            }            close(sd);        }    }    freeaddrinfo(response);}

static int ParseEntityPosixLinux(char **str, acl_entry_t ace, int *is_mask){    struct passwd *pwd;    struct group *grp;    acl_tag_t etype;    size_t idsz;    id_t id;    char *ids;    char *id_end;    int result = true;    int i;    ids = NULL;// TODO: Support numeric id in addition to (user/group) name ?// Posix language: tag type, qualifier, permissions    if (strncmp(*str, "user:", 5) == 0)    {        *str += 5;        // create null-terminated string for entity id        id_end = index(*str, ':');        if (id_end == NULL)     // entity id already null-terminated        {            idsz = strlen(*str);        }        else                    // copy entity-id to new null-terminated string        {            idsz = id_end - *str;        }        ids = xmalloc(idsz + 1);        for (i = 0; i < idsz; i++)            ids[i] = (*str)[i];        ids[idsz] = '/0';        *str += idsz;        // file object owner        if (strncmp(ids, "*", 2) == 0)        {            etype = ACL_USER_OBJ;            id = 0;        }        else        {            etype = ACL_USER;            pwd = getpwnam(ids);            if (pwd == NULL)            {                Log(LOG_LEVEL_ERR, "Couldn't find user id for '%s'. (getpwnnam: %s)", ids, GetErrorStr());                free(ids);                return false;            }            id = pwd->pw_uid;        }    }    else if (strncmp(*str, "group:", 6) == 0)    {        *str += 6;        // create null-terminated string for entity id        id_end = index(*str, ':');        if (id_end == NULL)     // entity id already null-terminated        {            idsz = strlen(*str);        }        else                    // copy entity-id to new null-terminated string        {            idsz = id_end - *str;        }        ids = xmalloc(idsz + 1);        for (i = 0; i < idsz; i++)            ids[i] = (*str)[i];        ids[idsz] = '/0';        *str += idsz;        // file group        if (strncmp(ids, "*", 2) == 0)        {            etype = ACL_GROUP_OBJ;            id = 0;             // TODO: Correct file group id ??        }        else        {            etype = ACL_GROUP;            grp = getgrnam(ids);            if (grp == NULL)            {                Log(LOG_LEVEL_ERR, "Error looking up group id for %s", ids);//.........这里部分代码省略.........

static PromiseResult VerifyFilePromise(EvalContext *ctx, char *path, const Promise *pp){    struct stat osb, oslb, dsb;    CfLock thislock;    int exists;    Attributes a = GetFilesAttributes(ctx, pp);    if (!FileSanityChecks(path, a, pp))    {        ClearFilesAttributes(&a);        return PROMISE_RESULT_NOOP;    }    EvalContextVariablePutSpecial(ctx, SPECIAL_SCOPE_THIS, "promiser", path, CF_DATA_TYPE_STRING, "source=promise");    thislock = AcquireLock(ctx, path, VUQNAME, CFSTARTTIME, a.transaction, pp, false);    if (thislock.lock == NULL)    {        ClearFilesAttributes(&a);        return PROMISE_RESULT_SKIPPED;    }    LoadSetuid();    PromiseResult result = PROMISE_RESULT_NOOP;    if (lstat(path, &oslb) == -1)       /* Careful if the object is a link */    {        if ((a.create) || (a.touch))        {            if (!CfCreateFile(ctx, path, pp, a, &result))            {                goto exit;            }            else            {                exists = (lstat(path, &oslb) != -1);            }        }        exists = false;    }    else    {        if ((a.create) || (a.touch))        {            cfPS(ctx, LOG_LEVEL_VERBOSE, PROMISE_RESULT_NOOP, pp, a, "File '%s' exists as promised", path);        }        exists = true;    }    if ((a.havedelete) && (!exists))    {        cfPS(ctx, LOG_LEVEL_VERBOSE, PROMISE_RESULT_NOOP, pp, a, "File '%s' does not exist as promised", path);        goto exit;    }    if (!a.havedepthsearch)     /* if the search is trivial, make sure that we are in the parent dir of the leaf */    {        char basedir[CF_BUFSIZE];        Log(LOG_LEVEL_DEBUG, "Direct file reference '%s', no search implied", path);        snprintf(basedir, sizeof(basedir), "%s", path);        if (strcmp(ReadLastNode(basedir), ".") == 0)        {            // Handle /.  notation for deletion of directories            ChopLastNode(basedir);            ChopLastNode(path);        }        ChopLastNode(basedir);        if (safe_chdir(basedir))        {            Log(LOG_LEVEL_ERR, "Failed to chdir into '%s'. (chdir: '%s')", basedir, GetErrorStr());        }    }    /* If file or directory exists but it is not selected by body file_select     * (if we have one) then just exit. But continue if it's a directory and     * depth_search is on, so that we can file_select into it. */    if (exists        && (a.haveselect && !SelectLeaf(ctx, path, &oslb, a.select))        && !(a.havedepthsearch && S_ISDIR(oslb.st_mode)))    {        goto exit;    }    if (stat(path, &osb) == -1)    {        if ((a.create) || (a.touch))        {            if (!CfCreateFile(ctx, path, pp, a, &result))            {                goto exit;            }            else            {                exists = true;            }//.........这里部分代码省略.........