| 1 | /* $Id: RTFileDelete-r3-nt.cpp 104285 2024-04-11 00:06:14Z vboxsync $ */
|
|---|
| 2 | /** @file
|
|---|
| 3 | * IPRT - RTFileDelete, Native NT.
|
|---|
| 4 | */
|
|---|
| 5 |
|
|---|
| 6 | /*
|
|---|
| 7 | * Copyright (C) 2024 Oracle and/or its affiliates.
|
|---|
| 8 | *
|
|---|
| 9 | * This file is part of VirtualBox base platform packages, as
|
|---|
| 10 | * available from https://www.virtualbox.org.
|
|---|
| 11 | *
|
|---|
| 12 | * This program is free software; you can redistribute it and/or
|
|---|
| 13 | * modify it under the terms of the GNU General Public License
|
|---|
| 14 | * as published by the Free Software Foundation, in version 3 of the
|
|---|
| 15 | * License.
|
|---|
| 16 | *
|
|---|
| 17 | * This program is distributed in the hope that it will be useful, but
|
|---|
| 18 | * WITHOUT ANY WARRANTY; without even the implied warranty of
|
|---|
| 19 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|---|
| 20 | * General Public License for more details.
|
|---|
| 21 | *
|
|---|
| 22 | * You should have received a copy of the GNU General Public License
|
|---|
| 23 | * along with this program; if not, see <https://www.gnu.org/licenses>.
|
|---|
| 24 | *
|
|---|
| 25 | * The contents of this file may alternatively be used under the terms
|
|---|
| 26 | * of the Common Development and Distribution License Version 1.0
|
|---|
| 27 | * (CDDL), a copy of it is provided in the "COPYING.CDDL" file included
|
|---|
| 28 | * in the VirtualBox distribution, in which case the provisions of the
|
|---|
| 29 | * CDDL are applicable instead of those of the GPL.
|
|---|
| 30 | *
|
|---|
| 31 | * You may elect to license modified versions of this file under the
|
|---|
| 32 | * terms and conditions of either the GPL or the CDDL or both.
|
|---|
| 33 | *
|
|---|
| 34 | * SPDX-License-Identifier: GPL-3.0-only OR CDDL-1.0
|
|---|
| 35 | */
|
|---|
| 36 |
|
|---|
| 37 |
|
|---|
| 38 | /*********************************************************************************************************************************
|
|---|
| 39 | * Header Files *
|
|---|
| 40 | *********************************************************************************************************************************/
|
|---|
| 41 | #define LOG_GROUP RTLOGGROUP_FILE
|
|---|
| 42 | #include "internal-r3-nt.h"
|
|---|
| 43 |
|
|---|
| 44 | #include <iprt/file.h>
|
|---|
| 45 | #include <iprt/err.h>
|
|---|
| 46 |
|
|---|
| 47 | #include "internal/fs.h"
|
|---|
| 48 |
|
|---|
| 49 |
|
|---|
| 50 | RTDECL(int) RTFileDelete(const char *pszFilename)
|
|---|
| 51 | {
|
|---|
| 52 | /*
|
|---|
| 53 | * Convert and normalize the path.
|
|---|
| 54 | */
|
|---|
| 55 | UNICODE_STRING NtName;
|
|---|
| 56 | HANDLE hRootDir;
|
|---|
| 57 | int rc = RTNtPathFromWinUtf8(&NtName, &hRootDir, pszFilename);
|
|---|
| 58 | if (RT_SUCCESS(rc))
|
|---|
| 59 | {
|
|---|
| 60 | ULONG fUnwantedFileAttribs = FILE_ATTRIBUTE_REPARSE_POINT | FILE_ATTRIBUTE_DIRECTORY;
|
|---|
| 61 |
|
|---|
| 62 | /*
|
|---|
| 63 | * Try open it as a file or reparse point.
|
|---|
| 64 | *
|
|---|
| 65 | * Note! This will succeed on directory alternate data streams, despite
|
|---|
| 66 | * the FILE_NON_DIRECTORY_FILE flag.
|
|---|
| 67 | *
|
|---|
| 68 | * OTOH, it will open the reparse point even if an ADS is
|
|---|
| 69 | * specified in the path (i.e. given symlink 'foo' targeting
|
|---|
| 70 | * directory 'bar\', attempts to open 'foo::$INDEX_ALLOCATION'
|
|---|
| 71 | * will result in opening the 'foo' reparse point and any
|
|---|
| 72 | * attempts to delete it will only delete 'foo', the 'bar'
|
|---|
| 73 | * directory will be left untouched - so safe).
|
|---|
| 74 | */
|
|---|
| 75 | HANDLE hPath = RTNT_INVALID_HANDLE_VALUE;
|
|---|
| 76 | IO_STATUS_BLOCK Ios = RTNT_IO_STATUS_BLOCK_INITIALIZER;
|
|---|
| 77 | OBJECT_ATTRIBUTES ObjAttr;
|
|---|
| 78 | InitializeObjectAttributes(&ObjAttr, &NtName, 0 /*fAttrib*/, hRootDir, NULL);
|
|---|
| 79 |
|
|---|
| 80 | ULONG fOpenOptions = FILE_NON_DIRECTORY_FILE | FILE_OPEN_FOR_BACKUP_INTENT | FILE_OPEN_REPARSE_POINT
|
|---|
| 81 | | FILE_SYNCHRONOUS_IO_NONALERT;
|
|---|
| 82 | NTSTATUS rcNt = NtCreateFile(&hPath,
|
|---|
| 83 | DELETE | FILE_READ_ATTRIBUTES | SYNCHRONIZE,
|
|---|
| 84 | &ObjAttr,
|
|---|
| 85 | &Ios,
|
|---|
| 86 | NULL /*AllocationSize*/,
|
|---|
| 87 | FILE_ATTRIBUTE_NORMAL,
|
|---|
| 88 | FILE_SHARE_DELETE | FILE_SHARE_READ | FILE_SHARE_WRITE,
|
|---|
| 89 | FILE_OPEN,
|
|---|
| 90 | fOpenOptions,
|
|---|
| 91 | NULL /*EaBuffer*/,
|
|---|
| 92 | 0 /*EaLength*/);
|
|---|
| 93 | if (NT_SUCCESS(rcNt))
|
|---|
| 94 | {
|
|---|
| 95 | /*
|
|---|
| 96 | * Check if it is a reparse point.
|
|---|
| 97 | *
|
|---|
| 98 | * DeleteFileW and MoveFileExW (on build 19040) will re-open reparse
|
|---|
| 99 | * points other than symlinks, mount points (junctions?) and named
|
|---|
| 100 | * pipe symlinks. We OTOH, will just fail as that could be a
|
|---|
| 101 | * potentially security problem, since unknown reparse point behaviour
|
|---|
| 102 | * could be used for exploits if they work in a similar manner to the
|
|---|
| 103 | * three just mentioned.
|
|---|
| 104 | *
|
|---|
| 105 | * To delete symbolic links, use RTSymlinkDelete.
|
|---|
| 106 | *
|
|---|
| 107 | * Alternative: We could model this on linux instead and also allow
|
|---|
| 108 | * this function unlink symlinks, mount points and global reparse stuff,
|
|---|
| 109 | * but fail on any other reparse point. This would make the APIs work
|
|---|
| 110 | * more or less the same across the platforms. (Code is #if 0'ed below.)
|
|---|
| 111 | *
|
|---|
| 112 | * See @bugref{10632}.
|
|---|
| 113 | */
|
|---|
| 114 | FILE_ATTRIBUTE_TAG_INFORMATION TagInfo = {0, 0};
|
|---|
| 115 | RTNT_IO_STATUS_BLOCK_REINIT(&Ios);
|
|---|
| 116 | rcNt = NtQueryInformationFile(hPath, &Ios, &TagInfo, sizeof(TagInfo), FileAttributeTagInformation);
|
|---|
| 117 | if (NT_SUCCESS(rcNt))
|
|---|
| 118 | {
|
|---|
| 119 | if (TagInfo.FileAttributes & FILE_ATTRIBUTE_REPARSE_POINT)
|
|---|
| 120 | {
|
|---|
| 121 | #if 0
|
|---|
| 122 | if ( TagInfo.ReparseTag == IO_REPARSE_TAG_SYMLINK
|
|---|
| 123 | || TagInfo.ReparseTag == IO_REPARSE_TAG_MOUNT_POINT
|
|---|
| 124 | || TagInfo.ReparseTag == IO_REPARSE_TAG_GLOBAL_REPARSE)
|
|---|
| 125 | fUnwantedFileAttribs = 0; /* Consider all symlinks to be files, even the ones pointing at directories. */
|
|---|
| 126 | else
|
|---|
| 127 | #endif
|
|---|
| 128 | {
|
|---|
| 129 | NtClose(hPath);
|
|---|
| 130 | hPath = RTNT_INVALID_HANDLE_VALUE;
|
|---|
| 131 | rcNt = STATUS_DIRECTORY_IS_A_REPARSE_POINT;
|
|---|
| 132 | rc = VERR_IS_A_SYMLINK;
|
|---|
| 133 | }
|
|---|
| 134 | }
|
|---|
| 135 | }
|
|---|
| 136 | else if (rcNt == STATUS_INVALID_PARAMETER || rcNt == STATUS_NOT_IMPLEMENTED)
|
|---|
| 137 | rcNt = STATUS_SUCCESS;
|
|---|
| 138 | else
|
|---|
| 139 | {
|
|---|
| 140 | NtClose(hPath);
|
|---|
| 141 | hPath = RTNT_INVALID_HANDLE_VALUE;
|
|---|
| 142 | }
|
|---|
| 143 | }
|
|---|
| 144 | /*
|
|---|
| 145 | * Retry w/o the FILE_OPEN_REPARSE_POINT if the file system returns
|
|---|
| 146 | * STATUS_INVALID_PARAMETER as it could be an old one that doesn't
|
|---|
| 147 | * grok the reparse point stuff.
|
|---|
| 148 | */
|
|---|
| 149 | else if (rcNt == STATUS_INVALID_PARAMETER)
|
|---|
| 150 | {
|
|---|
| 151 | fOpenOptions &= ~FILE_OPEN_REPARSE_POINT;
|
|---|
| 152 | hPath = RTNT_INVALID_HANDLE_VALUE;
|
|---|
| 153 | RTNT_IO_STATUS_BLOCK_REINIT(&Ios);
|
|---|
| 154 | rcNt = NtCreateFile(&hPath,
|
|---|
| 155 | DELETE | FILE_READ_ATTRIBUTES | SYNCHRONIZE,
|
|---|
| 156 | &ObjAttr,
|
|---|
| 157 | &Ios,
|
|---|
| 158 | NULL /*AllocationSize*/,
|
|---|
| 159 | FILE_ATTRIBUTE_NORMAL,
|
|---|
| 160 | FILE_SHARE_DELETE | FILE_SHARE_READ | FILE_SHARE_WRITE,
|
|---|
| 161 | FILE_OPEN,
|
|---|
| 162 | fOpenOptions,
|
|---|
| 163 | NULL /*EaBuffer*/,
|
|---|
| 164 | 0 /*EaLength*/);
|
|---|
| 165 | }
|
|---|
| 166 | /* else:
|
|---|
| 167 | DeleteFileW will retry opening the file w/o FILE_READ_ATTRIBUTES here when
|
|---|
| 168 | the status code is STATUS_ACCESS_DENIED. We OTOH will not do that as we will
|
|---|
| 169 | be querying attributes to check that it is a file and not a directory. */
|
|---|
| 170 |
|
|---|
| 171 | if (NT_SUCCESS(rcNt))
|
|---|
| 172 | {
|
|---|
| 173 | /*
|
|---|
| 174 | * Recheck that this is a file and not a directory or a reparse point we
|
|---|
| 175 | * don't approve of.
|
|---|
| 176 | *
|
|---|
| 177 | * This prevents us from accidentally deleting a directory via the
|
|---|
| 178 | * ::$INDEX_ALLOCATION stream, at the cost of not being able to delete
|
|---|
| 179 | * any alternate data streams on directories using this API.
|
|---|
| 180 | *
|
|---|
| 181 | * See @bugref{10632}.
|
|---|
| 182 | */
|
|---|
| 183 | FILE_BASIC_INFORMATION BasicInfo = {};
|
|---|
| 184 | RTNT_IO_STATUS_BLOCK_REINIT(&Ios);
|
|---|
| 185 | rcNt = NtQueryInformationFile(hPath, &Ios, &BasicInfo, sizeof(BasicInfo), FileBasicInformation);
|
|---|
| 186 | if (NT_SUCCESS(rcNt))
|
|---|
| 187 | {
|
|---|
| 188 | if (!(BasicInfo.FileAttributes & fUnwantedFileAttribs))
|
|---|
| 189 | {
|
|---|
| 190 | /*
|
|---|
| 191 | * Okay, it is a file. Delete it.
|
|---|
| 192 | */
|
|---|
| 193 | FILE_DISPOSITION_INFORMATION DeleteInfo = { TRUE };
|
|---|
| 194 | rcNt = NtSetInformationFile(hPath, &Ios, &DeleteInfo, sizeof(DeleteInfo), FileDispositionInformation);
|
|---|
| 195 | }
|
|---|
| 196 | else if (BasicInfo.FileAttributes & FILE_ATTRIBUTE_DIRECTORY)
|
|---|
| 197 | rc = VERR_IS_A_DIRECTORY;
|
|---|
| 198 | else
|
|---|
| 199 | rc = VERR_IS_A_SYMLINK;
|
|---|
| 200 | }
|
|---|
| 201 | else
|
|---|
| 202 | rc = RTErrConvertFromNtStatus(rcNt);
|
|---|
| 203 |
|
|---|
| 204 | rcNt = NtClose(hPath);
|
|---|
| 205 | if (!NT_SUCCESS(rcNt) && RT_SUCCESS_NP(rc))
|
|---|
| 206 | rc = RTErrConvertFromNtStatus(rcNt);
|
|---|
| 207 | }
|
|---|
| 208 | else if (RT_SUCCESS_NP(rc))
|
|---|
| 209 | rc = RTErrConvertFromNtStatus(rcNt);
|
|---|
| 210 | RTNtPathFree(&NtName, &hRootDir);
|
|---|
| 211 | }
|
|---|
| 212 | return rc;
|
|---|
| 213 | }
|
|---|
| 214 |
|
|---|
