[PATCH v9 0/2] MR3381: server: Try isolate wineserver directory.
try following locations for wineserver directory: - `${XDG_RUNTIME_DIR}/wine` - `/run/user/${uid}/wine` - `${TMPDIR}/wine` - only if `${TMPDIR}` is owned by user - `${TMPDIR}/.wine-${uid}` - `/tmp/.wine-${uid}` Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=39013 Signed-off-by: Konstantin Demin <rockdrilla(a)gmail.com> -- v9: ntdll: Try isolate wineserver directory. server: check directory access permissions. https://gitlab.winehq.org/wine/wine/-/merge_requests/3381
From: Konstantin Demin <rockdrilla(a)gmail.com> wineserver directory must be fully accessible by user Signed-off-by: Konstantin Demin <rockdrilla(a)gmail.com> --- server/request.c | 1 + 1 file changed, 1 insertion(+) diff --git a/server/request.c b/server/request.c index 432a5918892..273c9d84b5f 100644 --- a/server/request.c +++ b/server/request.c @@ -591,6 +591,7 @@ static void create_dir( const char *name, struct stat *st ) if (!S_ISDIR(st->st_mode)) fatal_error( "%s is not a directory\n", name ); if (st->st_uid != getuid()) fatal_error( "%s is not owned by you\n", name ); if (st->st_mode & 077) fatal_error( "%s must not be accessible by other users\n", name ); + if ((st->st_mode & 0700) != 0700) fatal_error( "%s must be writeable by you\n", name ); } /* create the server directory and chdir to it */ -- GitLab https://gitlab.winehq.org/wine/wine/-/merge_requests/3381
From: Konstantin Demin <rockdrilla(a)gmail.com> try following locations for wineserver directory: - ${XDG_RUNTIME_DIR}/wine - /run/user/${uid}/wine - ${TMPDIR}/wine - only if ${TMPDIR} is owned by user - ${TMPDIR}/.wine-${uid} - /tmp/.wine-${uid} Wine-Bug: https://bugs.winehq.org/show_bug.cgi?id=39013 Signed-off-by: Konstantin Demin <rockdrilla(a)gmail.com> --- dlls/ntdll/unix/server.c | 19 ++- include/Makefile.in | 1 + include/wine/server_tmpdir.h | 222 +++++++++++++++++++++++++++++++++++ server/request.c | 12 +- 4 files changed, 251 insertions(+), 3 deletions(-) create mode 100644 include/wine/server_tmpdir.h diff --git a/dlls/ntdll/unix/server.c b/dlls/ntdll/unix/server.c index 258a959de72..28c9cd5f4fa 100644 --- a/dlls/ntdll/unix/server.c +++ b/dlls/ntdll/unix/server.c @@ -81,6 +81,10 @@ #include "unix_private.h" #include "ddk/wdm.h" +#ifndef __ANDROID__ +#include "wine/server_tmpdir.h" +#endif + WINE_DEFAULT_DEBUG_CHANNEL(server); WINE_DECLARE_DEBUG_CHANNEL(syscall); @@ -1303,12 +1307,25 @@ int server_pipe( int fd[2] ) */ static const char *init_server_dir( dev_t dev, ino_t ino ) { +#ifndef __ANDROID__ + char *tmp_dir = NULL; +#endif char *dir = NULL; #ifdef __ANDROID__ /* there's no /tmp dir on Android */ asprintf( &dir, "%s/.wineserver/server-%llx-%llx", config_dir, (unsigned long long)dev, (unsigned long long)ino ); #else - asprintf( &dir, "/tmp/.wine-%u/server-%llx-%llx", getuid(), (unsigned long long)dev, (unsigned long long)ino ); + tmp_dir = wineserver_tmpdir(); + if (!tmp_dir) + { + if (errno == ENOMEM) fatal_error( "out of memory\n" ); + fatal_error( "error while building wineserver directory\n" ); + } + + if (asprintf( &dir, "%s/server-%llx-%llx", tmp_dir, (unsigned long long) dev, (unsigned long long) ino ) < 0) + fatal_error( "out of memory\n" ); + + free( tmp_dir ); #endif return dir; } diff --git a/include/Makefile.in b/include/Makefile.in index 6b33733a6f2..2b399be8541 100644 --- a/include/Makefile.in +++ b/include/Makefile.in @@ -984,6 +984,7 @@ SOURCES = \ wine/schrpc.idl \ wine/server.h \ wine/server_protocol.h \ + wine/server_tmpdir.h \ wine/strmbase.h \ wine/svcctl.idl \ wine/test.h \ diff --git a/include/wine/server_tmpdir.h b/include/wine/server_tmpdir.h new file mode 100644 index 00000000000..fbfb402b188 --- /dev/null +++ b/include/wine/server_tmpdir.h @@ -0,0 +1,222 @@ +/* + * SPDX-License-Identifier: Apache-2.0 + * (c) 2022-2025, Konstantin Demin + */ + +#ifndef __WINE_WINE_SERVER_TMPDIR_H +#define __WINE_WINE_SERVER_TMPDIR_H 1 + +#ifndef __ANDROID__ + +#include <errno.h> +#include <stdio.h> +#include <stdlib.h> +#include <string.h> +#include <unistd.h> + +#include <dirent.h> +#include <pthread.h> +#include <sys/stat.h> +#include <sys/types.h> + + +static int wineserver_trydir(const char * name, struct stat * st, int per_user) +{ + if ((!name) || (!st)) return 1; + + (void) memset( st, 0, sizeof(struct stat) ); + if (lstat( name, st ) == -1) return 2; + + if (!S_ISDIR( st->st_mode )) + { + errno = ENOTDIR; + return 3; + } + + if (per_user) + { + if (st->st_uid != getuid()) return 4; + if (st->st_mode & 077) return 5; + if ((st->st_mode & 0700) != 0700) return 6; + } + + return 0; +} + +static char * wineserver_stralloc(size_t * len) +{ + size_t x = 0; + void * p = NULL; + + if (!len) return NULL; + if (!(x = (*len))) return NULL; + + /* reserve space for NUL */ + x++; + /* perform naive alignment */ + x -= x % sizeof( size_t ); + /* reserve (extra) space */ + x += sizeof( size_t ); + + /* in case of integer overflow */ + if (x < (*len)) return NULL; + + p = calloc(1, x); + if (!p) return NULL; + + *len = x; + return (char *) p; +} + +/* + * try following locations for wineserver directory: + * - ${XDG_RUNTIME_DIR}/wine + * - /run/user/${uid}/wine + * - ${TMPDIR}/wine - only if ${TMPDIR} is per-user + * - ${TMPDIR}/.wine-${uid} + * - /tmp/.wine-${uid} + */ + +static char * wineserver_tmpdir_impl(void) +{ + const int wineserver_max_uid_len = 11; /* maximum uid length */ + + const char *rootdir = NULL; + char *workdir = NULL, *tmp1 = NULL; + size_t len1 = 0, len2 = 0; + struct stat st1; + + /* try "${XDG_RUNTIME_DIR}/wine" */ + do { + tmp1 = getenv( "XDG_RUNTIME_DIR" ); + if (!tmp1) break; + if (!tmp1[0]) break; + + rootdir = tmp1; + len1 = strlen( tmp1 ); + + if (wineserver_trydir( rootdir, &st1, 1 )) break; + + len2 = len1 + sizeof( "/wine" ); + workdir = wineserver_stralloc( &len2 ); + if ((!workdir) || (!len2)) + { + errno = ENOMEM; + return NULL; + } + + /* NB: safe enough - space is already allocated */ + (void) sprintf( workdir, "%s/wine", rootdir ); + return workdir; + } while (0); + + /* try "/run/user/${uid}/wine" */ + do { + rootdir = "/run/user"; + if (wineserver_trydir( rootdir, &st1, 0 )) break; + + len1 = sizeof( "/run/user/" ) + wineserver_max_uid_len + sizeof( "/wine" ); + workdir = wineserver_stralloc( &len1 ); + if ((!workdir) || (!len1)) + { + errno = ENOMEM; + return NULL; + } + + /* NB: safe enough - space is already allocated */ + (void) sprintf( workdir, "%s/%u", rootdir, getuid() ); + if (wineserver_trydir( workdir, &st1, 1 )) + { + free( workdir ); workdir = NULL; + break; + } + + len2 = strlen( workdir ); + /* NB: safe enough - space is already allocated */ + (void) strcpy( workdir + len2, "/wine" ); + return workdir; + } while (0); + + /* try somewhere in ${TMPDIR}/ */ + do { + tmp1 = getenv( "TMPDIR" ); + if (!tmp1) break; + if (!tmp1[0]) break; + + rootdir = tmp1; + len1 = strlen( tmp1 ); + + if (wineserver_trydir( rootdir, &st1, 0 )) break; + + if (wineserver_trydir( rootdir, &st1, 1 )) + { + /* ${TMPDIR} is NOT per-user - try "${TMPDIR}/.wine-${uid}" */ + + len2 = len1 + sizeof( "/.wine-" ) + wineserver_max_uid_len; + workdir = wineserver_stralloc( &len2 ); + if ((!workdir) || (!len2)) + { + errno = ENOMEM; + return NULL; + } + + /* NB: safe enough - space is already allocated */ + (void) sprintf(workdir, "%s/.wine-%u", rootdir, getuid()); + } + else + { + /* ${TMPDIR} is per-user - try "${TMPDIR}/wine" */ + + len2 = len1 + sizeof( "/wine" ); + workdir = wineserver_stralloc( &len2 ); + if ((!workdir) || (!len2)) + { + errno = ENOMEM; + return NULL; + } + + /* NB: safe enough - space is already allocated */ + (void) sprintf(workdir, "%s/wine", rootdir); + } + + return workdir; + } while (0); + + /* LAST RESORT: try "/tmp/.wine-${uid}" */ + do { + rootdir = "/tmp"; + if (wineserver_trydir( rootdir, &st1, 0 )) break; + + len1 = sizeof( "/tmp/.wine-" ) + wineserver_max_uid_len; + workdir = wineserver_stralloc( &len1 ); + if ((!workdir) || (!len1)) + { + errno = ENOMEM; + return NULL; + } + + /* NB: safe enough - space is already allocated */ + (void) sprintf( workdir, "%s/.wine-%u", rootdir, getuid() ); + return workdir; + } while (0); + + return NULL; +} + +static char * __wineserver_tmpdir = NULL; +static __attribute__((noinline)) void wineserver_tmpdir_once(void) +{ + __wineserver_tmpdir = wineserver_tmpdir_impl(); +} + +static __attribute__((noinline)) char * wineserver_tmpdir(void) +{ + static pthread_once_t _once = PTHREAD_ONCE_INIT; + + (void) pthread_once( &_once, wineserver_tmpdir_once ); + return __wineserver_tmpdir; +} + +#endif /* !__ANDROID__ */ + +#endif /* __WINE_WINE_SERVER_TMPDIR_H */ diff --git a/server/request.c b/server/request.c index 273c9d84b5f..4c09e8d87ad 100644 --- a/server/request.c +++ b/server/request.c @@ -62,6 +62,10 @@ #include "handle.h" #include "request_handlers.h" +#ifndef __ANDROID__ +#include "wine/server_tmpdir.h" +#endif + /* Some versions of glibc don't define this */ #ifndef SCM_RIGHTS #define SCM_RIGHTS 1 @@ -645,8 +649,12 @@ static char *create_server_dir( int force ) if (asprintf( &base_dir, "%s/.wineserver", config_dir ) == -1) fatal_error( "out of memory\n" ); #else - if (asprintf( &base_dir, "/tmp/.wine-%u", getuid() ) == -1) - fatal_error( "out of memory\n" ); + base_dir = wineserver_tmpdir(); + if (!base_dir) + { + if (errno == ENOMEM) fatal_error( "out of memory\n" ); + fatal_error( "error while building wineserver directory\n" ); + } #endif create_dir( base_dir, &st2 ); -- GitLab https://gitlab.winehq.org/wine/wine/-/merge_requests/3381
That looks too complicated, and doesn't address the objections about relying on environment variables. -- https://gitlab.winehq.org/wine/wine/-/merge_requests/3381#note_120110
On Thu Oct 30 10:37:31 2025 +0000, Alexandre Julliard wrote:
That looks too complicated, and doesn't address the objections about relying on environment variables. Incidentally I'm refactoring it right now to simplify it as possible.
-- https://gitlab.winehq.org/wine/wine/-/merge_requests/3381#note_120112
participants (3)
-
Alexandre Julliard (＠julliard) -
Konstantin Demin
-
Konstantin Demin (＠rockdrilla)