tyler/proxmox-backup
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

tape/drive/linux_tape: fix and refactor usage of sg-tape-cmd

Browse Source 
when executing this code as non-root, we use sg-tape-cmd (a setuid binary)
to execute various ioctls on the tape device

we give the command the open tape device fd as stdin, but did not
dup it, so the std::process:Stdio handle closed it on drop,
which let subsequent operation on that file fail (since it was closed)

fix it by dup'ing it before giving it to the command, and also refactor
the calling code, so that we do not forget to do this

Signed-off-by: Dominik Csapak <d.csapak@proxmox.com>
This commit is contained in:
Dominik Csapak 2021-01-28 15:11:20 +01:00 committed by Dietmar Maurer
parent 627d000098
commit 00ac86c31b
1 changed files with 23 additions and 29 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

52
src/tape/drive/linux_tape.rs
View File

@ -2,7 +2,7 @@
use std::fs::{OpenOptions, File};
use std::os::unix::fs::OpenOptionsExt;
use std::os::unix::io::{AsRawFd, FromRawFd};
use std::os::unix::io::{AsRawFd, FromRawFd, RawFd};
use std::convert::TryFrom;
use anyhow::{bail, format_err, Error};
@ -51,6 +51,17 @@ use crate::{
}
};
fn run_sg_tape_cmd(subcmd: &str, args: &[&str], fd: RawFd) -> Result<String, Error> {
let mut command = std::process::Command::new(
"/usr/lib/x86_64-linux-gnu/proxmox-backup/sg-tape-cmd");
command.args(&[subcmd]);
command.args(&["--stdin"]);
command.args(args);
let device_fd = nix::unistd::dup(fd)?;
command.stdin(unsafe { std::process::Stdio::from_raw_fd(device_fd)});
run_command(command, None)
}
/// Linux tape drive status
#[derive(Debug)]
pub struct LinuxDriveStatus {
@ -351,12 +362,7 @@ impl LinuxTapeHandle {
return read_mam_attributes(&mut self.file);
}
let mut command = std::process::Command::new(
"/usr/lib/x86_64-linux-gnu/proxmox-backup/sg-tape-cmd");
command.args(&["cartridge-memory"]);
command.args(&["--stdin"]);
command.stdin(unsafe { std::process::Stdio::from_raw_fd(self.file.as_raw_fd())});
let output = run_command(command, None)?;
let output = run_sg_tape_cmd("cartridge-memory", &[], self.file.as_raw_fd())?;
let result: Result<Vec<MamAttribute>, String> = serde_json::from_str(&output)?;
result.map_err(|err| format_err!("{}", err))
}
@ -371,12 +377,7 @@ impl LinuxTapeHandle {
return read_volume_statistics(&mut self.file);
}
let mut command = std::process::Command::new(
"/usr/lib/x86_64-linux-gnu/proxmox-backup/sg-tape-cmd");
command.args(&["volume-statistics"]);
command.args(&["--stdin"]);
command.stdin(unsafe { std::process::Stdio::from_raw_fd(self.file.as_raw_fd())});
let output = run_command(command, None)?;
let output = run_sg_tape_cmd("volume-statistics", &[], self.file.as_raw_fd())?;
let result: Result<Lp17VolumeStatistics, String> = serde_json::from_str(&output)?;
result.map_err(|err| format_err!("{}", err))
}
@ -533,12 +534,7 @@ impl TapeDriver for LinuxTapeHandle {
return read_tape_alert_flags(&mut self.file);
}
let mut command = std::process::Command::new(
"/usr/lib/x86_64-linux-gnu/proxmox-backup/sg-tape-cmd");
command.args(&["tape-alert-flags"]);
command.args(&["--stdin"]);
command.stdin(unsafe { std::process::Stdio::from_raw_fd(self.file.as_raw_fd())});
let output = run_command(command, None)?;
let output = run_sg_tape_cmd("tape-alert-flags", &[], self.file.as_raw_fd())?;
let result: Result<u64, String> = serde_json::from_str(&output)?;
result
.map_err(|err| format_err!("{}", err))
@ -585,17 +581,15 @@ impl TapeDriver for LinuxTapeHandle {
}
}
let mut command = std::process::Command::new(
"/usr/lib/x86_64-linux-gnu/proxmox-backup/sg-tape-cmd");
command.args(&["encryption"]);
if let Some((fingerprint, uuid)) = key_fingerprint {
let output = if let Some((fingerprint, uuid)) = key_fingerprint {
let fingerprint = crate::tools::format::as_fingerprint(fingerprint.bytes());
command.args(&["--fingerprint", &fingerprint]);
command.args(&["--uuid", &uuid.to_string()]);
}
command.args(&["--stdin"]);
command.stdin(unsafe { std::process::Stdio::from_raw_fd(self.file.as_raw_fd())});
let output = run_command(command, None)?;
run_sg_tape_cmd("encryption", &[
"--fingerprint", &fingerprint,
"--uuid", &uuid.to_string(),
], self.file.as_raw_fd())?
} else {
run_sg_tape_cmd("encryption", &[], self.file.as_raw_fd())?
};
let result: Result<(), String> = serde_json::from_str(&output)?;
result.map_err(|err| format_err!("{}", err))
}