std/sys/fs/
unix.rs

1#![allow(nonstandard_style)]
2#![allow(unsafe_op_in_unsafe_fn)]
3// miri has some special hacks here that make things unused.
4#![cfg_attr(miri, allow(unused))]
5
6#[cfg(test)]
7mod tests;
8
9#[cfg(all(target_os = "linux", target_env = "gnu"))]
10use libc::c_char;
11#[cfg(any(
12    all(target_os = "linux", not(target_env = "musl")),
13    target_os = "android",
14    target_os = "fuchsia",
15    target_os = "hurd",
16    target_os = "illumos",
17))]
18use libc::dirfd;
19#[cfg(any(target_os = "fuchsia", target_os = "illumos"))]
20use libc::fstatat as fstatat64;
21#[cfg(any(all(target_os = "linux", not(target_env = "musl")), target_os = "hurd"))]
22use libc::fstatat64;
23#[cfg(any(
24    target_os = "android",
25    target_os = "solaris",
26    target_os = "fuchsia",
27    target_os = "redox",
28    target_os = "illumos",
29    target_os = "aix",
30    target_os = "nto",
31    target_os = "vita",
32    all(target_os = "linux", target_env = "musl"),
33))]
34use libc::readdir as readdir64;
35#[cfg(not(any(
36    target_os = "android",
37    target_os = "linux",
38    target_os = "solaris",
39    target_os = "illumos",
40    target_os = "l4re",
41    target_os = "fuchsia",
42    target_os = "redox",
43    target_os = "aix",
44    target_os = "nto",
45    target_os = "vita",
46    target_os = "hurd",
47)))]
48use libc::readdir_r as readdir64_r;
49#[cfg(any(all(target_os = "linux", not(target_env = "musl")), target_os = "hurd"))]
50use libc::readdir64;
51#[cfg(target_os = "l4re")]
52use libc::readdir64_r;
53use libc::{c_int, mode_t};
54#[cfg(target_os = "android")]
55use libc::{
56    dirent as dirent64, fstat as fstat64, fstatat as fstatat64, ftruncate64, lseek64,
57    lstat as lstat64, off64_t, open as open64, stat as stat64,
58};
59#[cfg(not(any(
60    all(target_os = "linux", not(target_env = "musl")),
61    target_os = "l4re",
62    target_os = "android",
63    target_os = "hurd",
64)))]
65use libc::{
66    dirent as dirent64, fstat as fstat64, ftruncate as ftruncate64, lseek as lseek64,
67    lstat as lstat64, off_t as off64_t, open as open64, stat as stat64,
68};
69#[cfg(any(
70    all(target_os = "linux", not(target_env = "musl")),
71    target_os = "l4re",
72    target_os = "hurd"
73))]
74use libc::{dirent64, fstat64, ftruncate64, lseek64, lstat64, off64_t, open64, stat64};
75
76use crate::ffi::{CStr, OsStr, OsString};
77use crate::fmt::{self, Write as _};
78use crate::fs::TryLockError;
79use crate::io::{self, BorrowedCursor, Error, IoSlice, IoSliceMut, SeekFrom};
80use crate::os::unix::io::{AsFd, AsRawFd, BorrowedFd, FromRawFd, IntoRawFd};
81use crate::os::unix::prelude::*;
82use crate::path::{Path, PathBuf};
83use crate::sync::Arc;
84use crate::sys::common::small_c_string::run_path_with_cstr;
85use crate::sys::fd::FileDesc;
86pub use crate::sys::fs::common::exists;
87use crate::sys::time::SystemTime;
88#[cfg(all(target_os = "linux", target_env = "gnu"))]
89use crate::sys::weak::syscall;
90#[cfg(target_os = "android")]
91use crate::sys::weak::weak;
92use crate::sys::{cvt, cvt_r};
93use crate::sys_common::{AsInner, AsInnerMut, FromInner, IntoInner};
94use crate::{mem, ptr};
95
96pub struct File(FileDesc);
97
98// FIXME: This should be available on Linux with all `target_env`.
99// But currently only glibc exposes `statx` fn and structs.
100// We don't want to import unverified raw C structs here directly.
101// https://github.com/rust-lang/rust/pull/67774
102macro_rules! cfg_has_statx {
103    ({ $($then_tt:tt)* } else { $($else_tt:tt)* }) => {
104        cfg_select! {
105            all(target_os = "linux", target_env = "gnu") => {
106                $($then_tt)*
107            }
108            _ => {
109                $($else_tt)*
110            }
111        }
112    };
113    ($($block_inner:tt)*) => {
114        #[cfg(all(target_os = "linux", target_env = "gnu"))]
115        {
116            $($block_inner)*
117        }
118    };
119}
120
121cfg_has_statx! {{
122    #[derive(Clone)]
123    pub struct FileAttr {
124        stat: stat64,
125        statx_extra_fields: Option<StatxExtraFields>,
126    }
127
128    #[derive(Clone)]
129    struct StatxExtraFields {
130        // This is needed to check if btime is supported by the filesystem.
131        stx_mask: u32,
132        stx_btime: libc::statx_timestamp,
133        // With statx, we can overcome 32-bit `time_t` too.
134        #[cfg(target_pointer_width = "32")]
135        stx_atime: libc::statx_timestamp,
136        #[cfg(target_pointer_width = "32")]
137        stx_ctime: libc::statx_timestamp,
138        #[cfg(target_pointer_width = "32")]
139        stx_mtime: libc::statx_timestamp,
140
141    }
142
143    // We prefer `statx` on Linux if available, which contains file creation time,
144    // as well as 64-bit timestamps of all kinds.
145    // Default `stat64` contains no creation time and may have 32-bit `time_t`.
146    unsafe fn try_statx(
147        fd: c_int,
148        path: *const c_char,
149        flags: i32,
150        mask: u32,
151    ) -> Option<io::Result<FileAttr>> {
152        use crate::sync::atomic::{Atomic, AtomicU8, Ordering};
153
154        // Linux kernel prior to 4.11 or glibc prior to glibc 2.28 don't support `statx`.
155        // We check for it on first failure and remember availability to avoid having to
156        // do it again.
157        #[repr(u8)]
158        enum STATX_STATE{ Unknown = 0, Present, Unavailable }
159        static STATX_SAVED_STATE: Atomic<u8> = AtomicU8::new(STATX_STATE::Unknown as u8);
160
161        syscall!(
162            fn statx(
163                fd: c_int,
164                pathname: *const c_char,
165                flags: c_int,
166                mask: libc::c_uint,
167                statxbuf: *mut libc::statx,
168            ) -> c_int;
169        );
170
171        let statx_availability = STATX_SAVED_STATE.load(Ordering::Relaxed);
172        if statx_availability == STATX_STATE::Unavailable as u8 {
173            return None;
174        }
175
176        let mut buf: libc::statx = mem::zeroed();
177        if let Err(err) = cvt(statx(fd, path, flags, mask, &mut buf)) {
178            if STATX_SAVED_STATE.load(Ordering::Relaxed) == STATX_STATE::Present as u8 {
179                return Some(Err(err));
180            }
181
182            // We're not yet entirely sure whether `statx` is usable on this kernel
183            // or not. Syscalls can return errors from things other than the kernel
184            // per se, e.g. `EPERM` can be returned if seccomp is used to block the
185            // syscall, or `ENOSYS` might be returned from a faulty FUSE driver.
186            //
187            // Availability is checked by performing a call which expects `EFAULT`
188            // if the syscall is usable.
189            //
190            // See: https://github.com/rust-lang/rust/issues/65662
191            //
192            // FIXME what about transient conditions like `ENOMEM`?
193            let err2 = cvt(statx(0, ptr::null(), 0, libc::STATX_BASIC_STATS | libc::STATX_BTIME, ptr::null_mut()))
194                .err()
195                .and_then(|e| e.raw_os_error());
196            if err2 == Some(libc::EFAULT) {
197                STATX_SAVED_STATE.store(STATX_STATE::Present as u8, Ordering::Relaxed);
198                return Some(Err(err));
199            } else {
200                STATX_SAVED_STATE.store(STATX_STATE::Unavailable as u8, Ordering::Relaxed);
201                return None;
202            }
203        }
204        if statx_availability == STATX_STATE::Unknown as u8 {
205            STATX_SAVED_STATE.store(STATX_STATE::Present as u8, Ordering::Relaxed);
206        }
207
208        // We cannot fill `stat64` exhaustively because of private padding fields.
209        let mut stat: stat64 = mem::zeroed();
210        // `c_ulong` on gnu-mips, `dev_t` otherwise
211        stat.st_dev = libc::makedev(buf.stx_dev_major, buf.stx_dev_minor) as _;
212        stat.st_ino = buf.stx_ino as libc::ino64_t;
213        stat.st_nlink = buf.stx_nlink as libc::nlink_t;
214        stat.st_mode = buf.stx_mode as libc::mode_t;
215        stat.st_uid = buf.stx_uid as libc::uid_t;
216        stat.st_gid = buf.stx_gid as libc::gid_t;
217        stat.st_rdev = libc::makedev(buf.stx_rdev_major, buf.stx_rdev_minor) as _;
218        stat.st_size = buf.stx_size as off64_t;
219        stat.st_blksize = buf.stx_blksize as libc::blksize_t;
220        stat.st_blocks = buf.stx_blocks as libc::blkcnt64_t;
221        stat.st_atime = buf.stx_atime.tv_sec as libc::time_t;
222        // `i64` on gnu-x86_64-x32, `c_ulong` otherwise.
223        stat.st_atime_nsec = buf.stx_atime.tv_nsec as _;
224        stat.st_mtime = buf.stx_mtime.tv_sec as libc::time_t;
225        stat.st_mtime_nsec = buf.stx_mtime.tv_nsec as _;
226        stat.st_ctime = buf.stx_ctime.tv_sec as libc::time_t;
227        stat.st_ctime_nsec = buf.stx_ctime.tv_nsec as _;
228
229        let extra = StatxExtraFields {
230            stx_mask: buf.stx_mask,
231            stx_btime: buf.stx_btime,
232            // Store full times to avoid 32-bit `time_t` truncation.
233            #[cfg(target_pointer_width = "32")]
234            stx_atime: buf.stx_atime,
235            #[cfg(target_pointer_width = "32")]
236            stx_ctime: buf.stx_ctime,
237            #[cfg(target_pointer_width = "32")]
238            stx_mtime: buf.stx_mtime,
239        };
240
241        Some(Ok(FileAttr { stat, statx_extra_fields: Some(extra) }))
242    }
243
244} else {
245    #[derive(Clone)]
246    pub struct FileAttr {
247        stat: stat64,
248    }
249}}
250
251// all DirEntry's will have a reference to this struct
252struct InnerReadDir {
253    dirp: Dir,
254    root: PathBuf,
255}
256
257pub struct ReadDir {
258    inner: Arc<InnerReadDir>,
259    end_of_stream: bool,
260}
261
262impl ReadDir {
263    fn new(inner: InnerReadDir) -> Self {
264        Self { inner: Arc::new(inner), end_of_stream: false }
265    }
266}
267
268struct Dir(*mut libc::DIR);
269
270unsafe impl Send for Dir {}
271unsafe impl Sync for Dir {}
272
273#[cfg(any(
274    target_os = "android",
275    target_os = "linux",
276    target_os = "solaris",
277    target_os = "illumos",
278    target_os = "fuchsia",
279    target_os = "redox",
280    target_os = "aix",
281    target_os = "nto",
282    target_os = "vita",
283    target_os = "hurd",
284))]
285pub struct DirEntry {
286    dir: Arc<InnerReadDir>,
287    entry: dirent64_min,
288    // We need to store an owned copy of the entry name on platforms that use
289    // readdir() (not readdir_r()), because a) struct dirent may use a flexible
290    // array to store the name, b) it lives only until the next readdir() call.
291    name: crate::ffi::CString,
292}
293
294// Define a minimal subset of fields we need from `dirent64`, especially since
295// we're not using the immediate `d_name` on these targets. Keeping this as an
296// `entry` field in `DirEntry` helps reduce the `cfg` boilerplate elsewhere.
297#[cfg(any(
298    target_os = "android",
299    target_os = "linux",
300    target_os = "solaris",
301    target_os = "illumos",
302    target_os = "fuchsia",
303    target_os = "redox",
304    target_os = "aix",
305    target_os = "nto",
306    target_os = "vita",
307    target_os = "hurd",
308))]
309struct dirent64_min {
310    d_ino: u64,
311    #[cfg(not(any(
312        target_os = "solaris",
313        target_os = "illumos",
314        target_os = "aix",
315        target_os = "nto",
316        target_os = "vita",
317    )))]
318    d_type: u8,
319}
320
321#[cfg(not(any(
322    target_os = "android",
323    target_os = "linux",
324    target_os = "solaris",
325    target_os = "illumos",
326    target_os = "fuchsia",
327    target_os = "redox",
328    target_os = "aix",
329    target_os = "nto",
330    target_os = "vita",
331    target_os = "hurd",
332)))]
333pub struct DirEntry {
334    dir: Arc<InnerReadDir>,
335    // The full entry includes a fixed-length `d_name`.
336    entry: dirent64,
337}
338
339#[derive(Clone)]
340pub struct OpenOptions {
341    // generic
342    read: bool,
343    write: bool,
344    append: bool,
345    truncate: bool,
346    create: bool,
347    create_new: bool,
348    // system-specific
349    custom_flags: i32,
350    mode: mode_t,
351}
352
353#[derive(Clone, PartialEq, Eq)]
354pub struct FilePermissions {
355    mode: mode_t,
356}
357
358#[derive(Copy, Clone, Debug, Default)]
359pub struct FileTimes {
360    accessed: Option<SystemTime>,
361    modified: Option<SystemTime>,
362    #[cfg(target_vendor = "apple")]
363    created: Option<SystemTime>,
364}
365
366#[derive(Copy, Clone, Eq)]
367pub struct FileType {
368    mode: mode_t,
369}
370
371impl PartialEq for FileType {
372    fn eq(&self, other: &Self) -> bool {
373        self.masked() == other.masked()
374    }
375}
376
377impl core::hash::Hash for FileType {
378    fn hash<H: core::hash::Hasher>(&self, state: &mut H) {
379        self.masked().hash(state);
380    }
381}
382
383pub struct DirBuilder {
384    mode: mode_t,
385}
386
387#[derive(Copy, Clone)]
388struct Mode(mode_t);
389
390cfg_has_statx! {{
391    impl FileAttr {
392        fn from_stat64(stat: stat64) -> Self {
393            Self { stat, statx_extra_fields: None }
394        }
395
396        #[cfg(target_pointer_width = "32")]
397        pub fn stx_mtime(&self) -> Option<&libc::statx_timestamp> {
398            if let Some(ext) = &self.statx_extra_fields {
399                if (ext.stx_mask & libc::STATX_MTIME) != 0 {
400                    return Some(&ext.stx_mtime);
401                }
402            }
403            None
404        }
405
406        #[cfg(target_pointer_width = "32")]
407        pub fn stx_atime(&self) -> Option<&libc::statx_timestamp> {
408            if let Some(ext) = &self.statx_extra_fields {
409                if (ext.stx_mask & libc::STATX_ATIME) != 0 {
410                    return Some(&ext.stx_atime);
411                }
412            }
413            None
414        }
415
416        #[cfg(target_pointer_width = "32")]
417        pub fn stx_ctime(&self) -> Option<&libc::statx_timestamp> {
418            if let Some(ext) = &self.statx_extra_fields {
419                if (ext.stx_mask & libc::STATX_CTIME) != 0 {
420                    return Some(&ext.stx_ctime);
421                }
422            }
423            None
424        }
425    }
426} else {
427    impl FileAttr {
428        fn from_stat64(stat: stat64) -> Self {
429            Self { stat }
430        }
431    }
432}}
433
434impl FileAttr {
435    pub fn size(&self) -> u64 {
436        self.stat.st_size as u64
437    }
438    pub fn perm(&self) -> FilePermissions {
439        FilePermissions { mode: (self.stat.st_mode as mode_t) }
440    }
441
442    pub fn file_type(&self) -> FileType {
443        FileType { mode: self.stat.st_mode as mode_t }
444    }
445}
446
447#[cfg(target_os = "netbsd")]
448impl FileAttr {
449    pub fn modified(&self) -> io::Result<SystemTime> {
450        SystemTime::new(self.stat.st_mtime as i64, self.stat.st_mtimensec as i64)
451    }
452
453    pub fn accessed(&self) -> io::Result<SystemTime> {
454        SystemTime::new(self.stat.st_atime as i64, self.stat.st_atimensec as i64)
455    }
456
457    pub fn created(&self) -> io::Result<SystemTime> {
458        SystemTime::new(self.stat.st_birthtime as i64, self.stat.st_birthtimensec as i64)
459    }
460}
461
462#[cfg(target_os = "aix")]
463impl FileAttr {
464    pub fn modified(&self) -> io::Result<SystemTime> {
465        SystemTime::new(self.stat.st_mtime.tv_sec as i64, self.stat.st_mtime.tv_nsec as i64)
466    }
467
468    pub fn accessed(&self) -> io::Result<SystemTime> {
469        SystemTime::new(self.stat.st_atime.tv_sec as i64, self.stat.st_atime.tv_nsec as i64)
470    }
471
472    pub fn created(&self) -> io::Result<SystemTime> {
473        SystemTime::new(self.stat.st_ctime.tv_sec as i64, self.stat.st_ctime.tv_nsec as i64)
474    }
475}
476
477#[cfg(not(any(target_os = "netbsd", target_os = "nto", target_os = "aix")))]
478impl FileAttr {
479    #[cfg(not(any(
480        target_os = "vxworks",
481        target_os = "espidf",
482        target_os = "horizon",
483        target_os = "vita",
484        target_os = "hurd",
485        target_os = "rtems",
486        target_os = "nuttx",
487    )))]
488    pub fn modified(&self) -> io::Result<SystemTime> {
489        #[cfg(target_pointer_width = "32")]
490        cfg_has_statx! {
491            if let Some(mtime) = self.stx_mtime() {
492                return SystemTime::new(mtime.tv_sec, mtime.tv_nsec as i64);
493            }
494        }
495
496        SystemTime::new(self.stat.st_mtime as i64, self.stat.st_mtime_nsec as i64)
497    }
498
499    #[cfg(any(
500        target_os = "vxworks",
501        target_os = "espidf",
502        target_os = "vita",
503        target_os = "rtems",
504    ))]
505    pub fn modified(&self) -> io::Result<SystemTime> {
506        SystemTime::new(self.stat.st_mtime as i64, 0)
507    }
508
509    #[cfg(any(target_os = "horizon", target_os = "hurd", target_os = "nuttx"))]
510    pub fn modified(&self) -> io::Result<SystemTime> {
511        SystemTime::new(self.stat.st_mtim.tv_sec as i64, self.stat.st_mtim.tv_nsec as i64)
512    }
513
514    #[cfg(not(any(
515        target_os = "vxworks",
516        target_os = "espidf",
517        target_os = "horizon",
518        target_os = "vita",
519        target_os = "hurd",
520        target_os = "rtems",
521        target_os = "nuttx",
522    )))]
523    pub fn accessed(&self) -> io::Result<SystemTime> {
524        #[cfg(target_pointer_width = "32")]
525        cfg_has_statx! {
526            if let Some(atime) = self.stx_atime() {
527                return SystemTime::new(atime.tv_sec, atime.tv_nsec as i64);
528            }
529        }
530
531        SystemTime::new(self.stat.st_atime as i64, self.stat.st_atime_nsec as i64)
532    }
533
534    #[cfg(any(
535        target_os = "vxworks",
536        target_os = "espidf",
537        target_os = "vita",
538        target_os = "rtems"
539    ))]
540    pub fn accessed(&self) -> io::Result<SystemTime> {
541        SystemTime::new(self.stat.st_atime as i64, 0)
542    }
543
544    #[cfg(any(target_os = "horizon", target_os = "hurd", target_os = "nuttx"))]
545    pub fn accessed(&self) -> io::Result<SystemTime> {
546        SystemTime::new(self.stat.st_atim.tv_sec as i64, self.stat.st_atim.tv_nsec as i64)
547    }
548
549    #[cfg(any(
550        target_os = "freebsd",
551        target_os = "openbsd",
552        target_vendor = "apple",
553        target_os = "cygwin",
554    ))]
555    pub fn created(&self) -> io::Result<SystemTime> {
556        SystemTime::new(self.stat.st_birthtime as i64, self.stat.st_birthtime_nsec as i64)
557    }
558
559    #[cfg(not(any(
560        target_os = "freebsd",
561        target_os = "openbsd",
562        target_os = "vita",
563        target_vendor = "apple",
564        target_os = "cygwin",
565    )))]
566    pub fn created(&self) -> io::Result<SystemTime> {
567        cfg_has_statx! {
568            if let Some(ext) = &self.statx_extra_fields {
569                return if (ext.stx_mask & libc::STATX_BTIME) != 0 {
570                    SystemTime::new(ext.stx_btime.tv_sec, ext.stx_btime.tv_nsec as i64)
571                } else {
572                    Err(io::const_error!(
573                        io::ErrorKind::Unsupported,
574                        "creation time is not available for the filesystem",
575                    ))
576                };
577            }
578        }
579
580        Err(io::const_error!(
581            io::ErrorKind::Unsupported,
582            "creation time is not available on this platform currently",
583        ))
584    }
585
586    #[cfg(target_os = "vita")]
587    pub fn created(&self) -> io::Result<SystemTime> {
588        SystemTime::new(self.stat.st_ctime as i64, 0)
589    }
590}
591
592#[cfg(target_os = "nto")]
593impl FileAttr {
594    pub fn modified(&self) -> io::Result<SystemTime> {
595        SystemTime::new(self.stat.st_mtim.tv_sec, self.stat.st_mtim.tv_nsec)
596    }
597
598    pub fn accessed(&self) -> io::Result<SystemTime> {
599        SystemTime::new(self.stat.st_atim.tv_sec, self.stat.st_atim.tv_nsec)
600    }
601
602    pub fn created(&self) -> io::Result<SystemTime> {
603        SystemTime::new(self.stat.st_ctim.tv_sec, self.stat.st_ctim.tv_nsec)
604    }
605}
606
607impl AsInner<stat64> for FileAttr {
608    #[inline]
609    fn as_inner(&self) -> &stat64 {
610        &self.stat
611    }
612}
613
614impl FilePermissions {
615    pub fn readonly(&self) -> bool {
616        // check if any class (owner, group, others) has write permission
617        self.mode & 0o222 == 0
618    }
619
620    pub fn set_readonly(&mut self, readonly: bool) {
621        if readonly {
622            // remove write permission for all classes; equivalent to `chmod a-w <file>`
623            self.mode &= !0o222;
624        } else {
625            // add write permission for all classes; equivalent to `chmod a+w <file>`
626            self.mode |= 0o222;
627        }
628    }
629    pub fn mode(&self) -> u32 {
630        self.mode as u32
631    }
632}
633
634impl FileTimes {
635    pub fn set_accessed(&mut self, t: SystemTime) {
636        self.accessed = Some(t);
637    }
638
639    pub fn set_modified(&mut self, t: SystemTime) {
640        self.modified = Some(t);
641    }
642
643    #[cfg(target_vendor = "apple")]
644    pub fn set_created(&mut self, t: SystemTime) {
645        self.created = Some(t);
646    }
647}
648
649impl FileType {
650    pub fn is_dir(&self) -> bool {
651        self.is(libc::S_IFDIR)
652    }
653    pub fn is_file(&self) -> bool {
654        self.is(libc::S_IFREG)
655    }
656    pub fn is_symlink(&self) -> bool {
657        self.is(libc::S_IFLNK)
658    }
659
660    pub fn is(&self, mode: mode_t) -> bool {
661        self.masked() == mode
662    }
663
664    fn masked(&self) -> mode_t {
665        self.mode & libc::S_IFMT
666    }
667}
668
669impl fmt::Debug for FileType {
670    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
671        let FileType { mode } = self;
672        f.debug_struct("FileType").field("mode", &Mode(*mode)).finish()
673    }
674}
675
676impl FromInner<u32> for FilePermissions {
677    fn from_inner(mode: u32) -> FilePermissions {
678        FilePermissions { mode: mode as mode_t }
679    }
680}
681
682impl fmt::Debug for FilePermissions {
683    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
684        let FilePermissions { mode } = self;
685        f.debug_struct("FilePermissions").field("mode", &Mode(*mode)).finish()
686    }
687}
688
689impl fmt::Debug for ReadDir {
690    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
691        // This will only be called from std::fs::ReadDir, which will add a "ReadDir()" frame.
692        // Thus the result will be e g 'ReadDir("/home")'
693        fmt::Debug::fmt(&*self.inner.root, f)
694    }
695}
696
697impl Iterator for ReadDir {
698    type Item = io::Result<DirEntry>;
699
700    #[cfg(any(
701        target_os = "android",
702        target_os = "linux",
703        target_os = "solaris",
704        target_os = "fuchsia",
705        target_os = "redox",
706        target_os = "illumos",
707        target_os = "aix",
708        target_os = "nto",
709        target_os = "vita",
710        target_os = "hurd",
711    ))]
712    fn next(&mut self) -> Option<io::Result<DirEntry>> {
713        use crate::sys::os::{errno, set_errno};
714
715        if self.end_of_stream {
716            return None;
717        }
718
719        unsafe {
720            loop {
721                // As of POSIX.1-2017, readdir() is not required to be thread safe; only
722                // readdir_r() is. However, readdir_r() cannot correctly handle platforms
723                // with unlimited or variable NAME_MAX. Many modern platforms guarantee
724                // thread safety for readdir() as long an individual DIR* is not accessed
725                // concurrently, which is sufficient for Rust.
726                set_errno(0);
727                let entry_ptr: *const dirent64 = readdir64(self.inner.dirp.0);
728                if entry_ptr.is_null() {
729                    // We either encountered an error, or reached the end. Either way,
730                    // the next call to next() should return None.
731                    self.end_of_stream = true;
732
733                    // To distinguish between errors and end-of-directory, we had to clear
734                    // errno beforehand to check for an error now.
735                    return match errno() {
736                        0 => None,
737                        e => Some(Err(Error::from_raw_os_error(e))),
738                    };
739                }
740
741                // The dirent64 struct is a weird imaginary thing that isn't ever supposed
742                // to be worked with by value. Its trailing d_name field is declared
743                // variously as [c_char; 256] or [c_char; 1] on different systems but
744                // either way that size is meaningless; only the offset of d_name is
745                // meaningful. The dirent64 pointers that libc returns from readdir64 are
746                // allowed to point to allocations smaller _or_ LARGER than implied by the
747                // definition of the struct.
748                //
749                // As such, we need to be even more careful with dirent64 than if its
750                // contents were "simply" partially initialized data.
751                //
752                // Like for uninitialized contents, converting entry_ptr to `&dirent64`
753                // would not be legal. However, we can use `&raw const (*entry_ptr).d_name`
754                // to refer the fields individually, because that operation is equivalent
755                // to `byte_offset` and thus does not require the full extent of `*entry_ptr`
756                // to be in bounds of the same allocation, only the offset of the field
757                // being referenced.
758
759                // d_name is guaranteed to be null-terminated.
760                let name = CStr::from_ptr((&raw const (*entry_ptr).d_name).cast());
761                let name_bytes = name.to_bytes();
762                if name_bytes == b"." || name_bytes == b".." {
763                    continue;
764                }
765
766                // When loading from a field, we can skip the `&raw const`; `(*entry_ptr).d_ino` as
767                // a value expression will do the right thing: `byte_offset` to the field and then
768                // only access those bytes.
769                #[cfg(not(target_os = "vita"))]
770                let entry = dirent64_min {
771                    d_ino: (*entry_ptr).d_ino as u64,
772                    #[cfg(not(any(
773                        target_os = "solaris",
774                        target_os = "illumos",
775                        target_os = "aix",
776                        target_os = "nto",
777                    )))]
778                    d_type: (*entry_ptr).d_type as u8,
779                };
780
781                #[cfg(target_os = "vita")]
782                let entry = dirent64_min { d_ino: 0u64 };
783
784                return Some(Ok(DirEntry {
785                    entry,
786                    name: name.to_owned(),
787                    dir: Arc::clone(&self.inner),
788                }));
789            }
790        }
791    }
792
793    #[cfg(not(any(
794        target_os = "android",
795        target_os = "linux",
796        target_os = "solaris",
797        target_os = "fuchsia",
798        target_os = "redox",
799        target_os = "illumos",
800        target_os = "aix",
801        target_os = "nto",
802        target_os = "vita",
803        target_os = "hurd",
804    )))]
805    fn next(&mut self) -> Option<io::Result<DirEntry>> {
806        if self.end_of_stream {
807            return None;
808        }
809
810        unsafe {
811            let mut ret = DirEntry { entry: mem::zeroed(), dir: Arc::clone(&self.inner) };
812            let mut entry_ptr = ptr::null_mut();
813            loop {
814                let err = readdir64_r(self.inner.dirp.0, &mut ret.entry, &mut entry_ptr);
815                if err != 0 {
816                    if entry_ptr.is_null() {
817                        // We encountered an error (which will be returned in this iteration), but
818                        // we also reached the end of the directory stream. The `end_of_stream`
819                        // flag is enabled to make sure that we return `None` in the next iteration
820                        // (instead of looping forever)
821                        self.end_of_stream = true;
822                    }
823                    return Some(Err(Error::from_raw_os_error(err)));
824                }
825                if entry_ptr.is_null() {
826                    return None;
827                }
828                if ret.name_bytes() != b"." && ret.name_bytes() != b".." {
829                    return Some(Ok(ret));
830                }
831            }
832        }
833    }
834}
835
836/// Aborts the process if a file desceriptor is not open, if debug asserts are enabled
837///
838/// Many IO syscalls can't be fully trusted about EBADF error codes because those
839/// might get bubbled up from a remote FUSE server rather than the file descriptor
840/// in the current process being invalid.
841///
842/// So we check file flags instead which live on the file descriptor and not the underlying file.
843/// The downside is that it costs an extra syscall, so we only do it for debug.
844#[inline]
845pub(crate) fn debug_assert_fd_is_open(fd: RawFd) {
846    use crate::sys::os::errno;
847
848    // this is similar to assert_unsafe_precondition!() but it doesn't require const
849    if core::ub_checks::check_library_ub() {
850        if unsafe { libc::fcntl(fd, libc::F_GETFD) } == -1 && errno() == libc::EBADF {
851            rtabort!("IO Safety violation: owned file descriptor already closed");
852        }
853    }
854}
855
856impl Drop for Dir {
857    fn drop(&mut self) {
858        // dirfd isn't supported everywhere
859        #[cfg(not(any(
860            miri,
861            target_os = "redox",
862            target_os = "nto",
863            target_os = "vita",
864            target_os = "hurd",
865            target_os = "espidf",
866            target_os = "horizon",
867            target_os = "vxworks",
868            target_os = "rtems",
869            target_os = "nuttx",
870        )))]
871        {
872            let fd = unsafe { libc::dirfd(self.0) };
873            debug_assert_fd_is_open(fd);
874        }
875        let r = unsafe { libc::closedir(self.0) };
876        assert!(
877            r == 0 || crate::io::Error::last_os_error().is_interrupted(),
878            "unexpected error during closedir: {:?}",
879            crate::io::Error::last_os_error()
880        );
881    }
882}
883
884impl DirEntry {
885    pub fn path(&self) -> PathBuf {
886        self.dir.root.join(self.file_name_os_str())
887    }
888
889    pub fn file_name(&self) -> OsString {
890        self.file_name_os_str().to_os_string()
891    }
892
893    #[cfg(all(
894        any(
895            all(target_os = "linux", not(target_env = "musl")),
896            target_os = "android",
897            target_os = "fuchsia",
898            target_os = "hurd",
899            target_os = "illumos",
900        ),
901        not(miri) // no dirfd on Miri
902    ))]
903    pub fn metadata(&self) -> io::Result<FileAttr> {
904        let fd = cvt(unsafe { dirfd(self.dir.dirp.0) })?;
905        let name = self.name_cstr().as_ptr();
906
907        cfg_has_statx! {
908            if let Some(ret) = unsafe { try_statx(
909                fd,
910                name,
911                libc::AT_SYMLINK_NOFOLLOW | libc::AT_STATX_SYNC_AS_STAT,
912                libc::STATX_BASIC_STATS | libc::STATX_BTIME,
913            ) } {
914                return ret;
915            }
916        }
917
918        let mut stat: stat64 = unsafe { mem::zeroed() };
919        cvt(unsafe { fstatat64(fd, name, &mut stat, libc::AT_SYMLINK_NOFOLLOW) })?;
920        Ok(FileAttr::from_stat64(stat))
921    }
922
923    #[cfg(any(
924        not(any(
925            all(target_os = "linux", not(target_env = "musl")),
926            target_os = "android",
927            target_os = "fuchsia",
928            target_os = "hurd",
929            target_os = "illumos",
930        )),
931        miri
932    ))]
933    pub fn metadata(&self) -> io::Result<FileAttr> {
934        run_path_with_cstr(&self.path(), &lstat)
935    }
936
937    #[cfg(any(
938        target_os = "solaris",
939        target_os = "illumos",
940        target_os = "haiku",
941        target_os = "vxworks",
942        target_os = "aix",
943        target_os = "nto",
944        target_os = "vita",
945    ))]
946    pub fn file_type(&self) -> io::Result<FileType> {
947        self.metadata().map(|m| m.file_type())
948    }
949
950    #[cfg(not(any(
951        target_os = "solaris",
952        target_os = "illumos",
953        target_os = "haiku",
954        target_os = "vxworks",
955        target_os = "aix",
956        target_os = "nto",
957        target_os = "vita",
958    )))]
959    pub fn file_type(&self) -> io::Result<FileType> {
960        match self.entry.d_type {
961            libc::DT_CHR => Ok(FileType { mode: libc::S_IFCHR }),
962            libc::DT_FIFO => Ok(FileType { mode: libc::S_IFIFO }),
963            libc::DT_LNK => Ok(FileType { mode: libc::S_IFLNK }),
964            libc::DT_REG => Ok(FileType { mode: libc::S_IFREG }),
965            libc::DT_SOCK => Ok(FileType { mode: libc::S_IFSOCK }),
966            libc::DT_DIR => Ok(FileType { mode: libc::S_IFDIR }),
967            libc::DT_BLK => Ok(FileType { mode: libc::S_IFBLK }),
968            _ => self.metadata().map(|m| m.file_type()),
969        }
970    }
971
972    #[cfg(any(
973        target_os = "linux",
974        target_os = "cygwin",
975        target_os = "emscripten",
976        target_os = "android",
977        target_os = "solaris",
978        target_os = "illumos",
979        target_os = "haiku",
980        target_os = "l4re",
981        target_os = "fuchsia",
982        target_os = "redox",
983        target_os = "vxworks",
984        target_os = "espidf",
985        target_os = "horizon",
986        target_os = "vita",
987        target_os = "aix",
988        target_os = "nto",
989        target_os = "hurd",
990        target_os = "rtems",
991        target_vendor = "apple",
992    ))]
993    pub fn ino(&self) -> u64 {
994        self.entry.d_ino as u64
995    }
996
997    #[cfg(any(
998        target_os = "freebsd",
999        target_os = "openbsd",
1000        target_os = "netbsd",
1001        target_os = "dragonfly"
1002    ))]
1003    pub fn ino(&self) -> u64 {
1004        self.entry.d_fileno as u64
1005    }
1006
1007    #[cfg(target_os = "nuttx")]
1008    pub fn ino(&self) -> u64 {
1009        // Leave this 0 for now, as NuttX does not provide an inode number
1010        // in its directory entries.
1011        0
1012    }
1013
1014    #[cfg(any(
1015        target_os = "netbsd",
1016        target_os = "openbsd",
1017        target_os = "freebsd",
1018        target_os = "dragonfly",
1019        target_vendor = "apple",
1020    ))]
1021    fn name_bytes(&self) -> &[u8] {
1022        use crate::slice;
1023        unsafe {
1024            slice::from_raw_parts(
1025                self.entry.d_name.as_ptr() as *const u8,
1026                self.entry.d_namlen as usize,
1027            )
1028        }
1029    }
1030    #[cfg(not(any(
1031        target_os = "netbsd",
1032        target_os = "openbsd",
1033        target_os = "freebsd",
1034        target_os = "dragonfly",
1035        target_vendor = "apple",
1036    )))]
1037    fn name_bytes(&self) -> &[u8] {
1038        self.name_cstr().to_bytes()
1039    }
1040
1041    #[cfg(not(any(
1042        target_os = "android",
1043        target_os = "linux",
1044        target_os = "solaris",
1045        target_os = "illumos",
1046        target_os = "fuchsia",
1047        target_os = "redox",
1048        target_os = "aix",
1049        target_os = "nto",
1050        target_os = "vita",
1051        target_os = "hurd",
1052    )))]
1053    fn name_cstr(&self) -> &CStr {
1054        unsafe { CStr::from_ptr(self.entry.d_name.as_ptr()) }
1055    }
1056    #[cfg(any(
1057        target_os = "android",
1058        target_os = "linux",
1059        target_os = "solaris",
1060        target_os = "illumos",
1061        target_os = "fuchsia",
1062        target_os = "redox",
1063        target_os = "aix",
1064        target_os = "nto",
1065        target_os = "vita",
1066        target_os = "hurd",
1067    ))]
1068    fn name_cstr(&self) -> &CStr {
1069        &self.name
1070    }
1071
1072    pub fn file_name_os_str(&self) -> &OsStr {
1073        OsStr::from_bytes(self.name_bytes())
1074    }
1075}
1076
1077impl OpenOptions {
1078    pub fn new() -> OpenOptions {
1079        OpenOptions {
1080            // generic
1081            read: false,
1082            write: false,
1083            append: false,
1084            truncate: false,
1085            create: false,
1086            create_new: false,
1087            // system-specific
1088            custom_flags: 0,
1089            mode: 0o666,
1090        }
1091    }
1092
1093    pub fn read(&mut self, read: bool) {
1094        self.read = read;
1095    }
1096    pub fn write(&mut self, write: bool) {
1097        self.write = write;
1098    }
1099    pub fn append(&mut self, append: bool) {
1100        self.append = append;
1101    }
1102    pub fn truncate(&mut self, truncate: bool) {
1103        self.truncate = truncate;
1104    }
1105    pub fn create(&mut self, create: bool) {
1106        self.create = create;
1107    }
1108    pub fn create_new(&mut self, create_new: bool) {
1109        self.create_new = create_new;
1110    }
1111
1112    pub fn custom_flags(&mut self, flags: i32) {
1113        self.custom_flags = flags;
1114    }
1115    pub fn mode(&mut self, mode: u32) {
1116        self.mode = mode as mode_t;
1117    }
1118
1119    fn get_access_mode(&self) -> io::Result<c_int> {
1120        match (self.read, self.write, self.append) {
1121            (true, false, false) => Ok(libc::O_RDONLY),
1122            (false, true, false) => Ok(libc::O_WRONLY),
1123            (true, true, false) => Ok(libc::O_RDWR),
1124            (false, _, true) => Ok(libc::O_WRONLY | libc::O_APPEND),
1125            (true, _, true) => Ok(libc::O_RDWR | libc::O_APPEND),
1126            (false, false, false) => Err(Error::from_raw_os_error(libc::EINVAL)),
1127        }
1128    }
1129
1130    fn get_creation_mode(&self) -> io::Result<c_int> {
1131        match (self.write, self.append) {
1132            (true, false) => {}
1133            (false, false) => {
1134                if self.truncate || self.create || self.create_new {
1135                    return Err(Error::from_raw_os_error(libc::EINVAL));
1136                }
1137            }
1138            (_, true) => {
1139                if self.truncate && !self.create_new {
1140                    return Err(Error::from_raw_os_error(libc::EINVAL));
1141                }
1142            }
1143        }
1144
1145        Ok(match (self.create, self.truncate, self.create_new) {
1146            (false, false, false) => 0,
1147            (true, false, false) => libc::O_CREAT,
1148            (false, true, false) => libc::O_TRUNC,
1149            (true, true, false) => libc::O_CREAT | libc::O_TRUNC,
1150            (_, _, true) => libc::O_CREAT | libc::O_EXCL,
1151        })
1152    }
1153}
1154
1155impl fmt::Debug for OpenOptions {
1156    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
1157        let OpenOptions { read, write, append, truncate, create, create_new, custom_flags, mode } =
1158            self;
1159        f.debug_struct("OpenOptions")
1160            .field("read", read)
1161            .field("write", write)
1162            .field("append", append)
1163            .field("truncate", truncate)
1164            .field("create", create)
1165            .field("create_new", create_new)
1166            .field("custom_flags", custom_flags)
1167            .field("mode", &Mode(*mode))
1168            .finish()
1169    }
1170}
1171
1172impl File {
1173    pub fn open(path: &Path, opts: &OpenOptions) -> io::Result<File> {
1174        run_path_with_cstr(path, &|path| File::open_c(path, opts))
1175    }
1176
1177    pub fn open_c(path: &CStr, opts: &OpenOptions) -> io::Result<File> {
1178        let flags = libc::O_CLOEXEC
1179            | opts.get_access_mode()?
1180            | opts.get_creation_mode()?
1181            | (opts.custom_flags as c_int & !libc::O_ACCMODE);
1182        // The third argument of `open64` is documented to have type `mode_t`. On
1183        // some platforms (like macOS, where `open64` is actually `open`), `mode_t` is `u16`.
1184        // However, since this is a variadic function, C integer promotion rules mean that on
1185        // the ABI level, this still gets passed as `c_int` (aka `u32` on Unix platforms).
1186        let fd = cvt_r(|| unsafe { open64(path.as_ptr(), flags, opts.mode as c_int) })?;
1187        Ok(File(unsafe { FileDesc::from_raw_fd(fd) }))
1188    }
1189
1190    pub fn file_attr(&self) -> io::Result<FileAttr> {
1191        let fd = self.as_raw_fd();
1192
1193        cfg_has_statx! {
1194            if let Some(ret) = unsafe { try_statx(
1195                fd,
1196                c"".as_ptr() as *const c_char,
1197                libc::AT_EMPTY_PATH | libc::AT_STATX_SYNC_AS_STAT,
1198                libc::STATX_BASIC_STATS | libc::STATX_BTIME,
1199            ) } {
1200                return ret;
1201            }
1202        }
1203
1204        let mut stat: stat64 = unsafe { mem::zeroed() };
1205        cvt(unsafe { fstat64(fd, &mut stat) })?;
1206        Ok(FileAttr::from_stat64(stat))
1207    }
1208
1209    pub fn fsync(&self) -> io::Result<()> {
1210        cvt_r(|| unsafe { os_fsync(self.as_raw_fd()) })?;
1211        return Ok(());
1212
1213        #[cfg(target_vendor = "apple")]
1214        unsafe fn os_fsync(fd: c_int) -> c_int {
1215            libc::fcntl(fd, libc::F_FULLFSYNC)
1216        }
1217        #[cfg(not(target_vendor = "apple"))]
1218        unsafe fn os_fsync(fd: c_int) -> c_int {
1219            libc::fsync(fd)
1220        }
1221    }
1222
1223    pub fn datasync(&self) -> io::Result<()> {
1224        cvt_r(|| unsafe { os_datasync(self.as_raw_fd()) })?;
1225        return Ok(());
1226
1227        #[cfg(target_vendor = "apple")]
1228        unsafe fn os_datasync(fd: c_int) -> c_int {
1229            libc::fcntl(fd, libc::F_FULLFSYNC)
1230        }
1231        #[cfg(any(
1232            target_os = "freebsd",
1233            target_os = "fuchsia",
1234            target_os = "linux",
1235            target_os = "cygwin",
1236            target_os = "android",
1237            target_os = "netbsd",
1238            target_os = "openbsd",
1239            target_os = "nto",
1240            target_os = "hurd",
1241        ))]
1242        unsafe fn os_datasync(fd: c_int) -> c_int {
1243            libc::fdatasync(fd)
1244        }
1245        #[cfg(not(any(
1246            target_os = "android",
1247            target_os = "fuchsia",
1248            target_os = "freebsd",
1249            target_os = "linux",
1250            target_os = "cygwin",
1251            target_os = "netbsd",
1252            target_os = "openbsd",
1253            target_os = "nto",
1254            target_os = "hurd",
1255            target_vendor = "apple",
1256        )))]
1257        unsafe fn os_datasync(fd: c_int) -> c_int {
1258            libc::fsync(fd)
1259        }
1260    }
1261
1262    #[cfg(any(
1263        target_os = "freebsd",
1264        target_os = "fuchsia",
1265        target_os = "linux",
1266        target_os = "netbsd",
1267        target_os = "openbsd",
1268        target_vendor = "apple",
1269    ))]
1270    pub fn lock(&self) -> io::Result<()> {
1271        cvt(unsafe { libc::flock(self.as_raw_fd(), libc::LOCK_EX) })?;
1272        return Ok(());
1273    }
1274
1275    #[cfg(not(any(
1276        target_os = "freebsd",
1277        target_os = "fuchsia",
1278        target_os = "linux",
1279        target_os = "netbsd",
1280        target_os = "openbsd",
1281        target_vendor = "apple",
1282    )))]
1283    pub fn lock(&self) -> io::Result<()> {
1284        Err(io::const_error!(io::ErrorKind::Unsupported, "lock() not supported"))
1285    }
1286
1287    #[cfg(any(
1288        target_os = "freebsd",
1289        target_os = "fuchsia",
1290        target_os = "linux",
1291        target_os = "netbsd",
1292        target_os = "openbsd",
1293        target_vendor = "apple",
1294    ))]
1295    pub fn lock_shared(&self) -> io::Result<()> {
1296        cvt(unsafe { libc::flock(self.as_raw_fd(), libc::LOCK_SH) })?;
1297        return Ok(());
1298    }
1299
1300    #[cfg(not(any(
1301        target_os = "freebsd",
1302        target_os = "fuchsia",
1303        target_os = "linux",
1304        target_os = "netbsd",
1305        target_os = "openbsd",
1306        target_vendor = "apple",
1307    )))]
1308    pub fn lock_shared(&self) -> io::Result<()> {
1309        Err(io::const_error!(io::ErrorKind::Unsupported, "lock_shared() not supported"))
1310    }
1311
1312    #[cfg(any(
1313        target_os = "freebsd",
1314        target_os = "fuchsia",
1315        target_os = "linux",
1316        target_os = "netbsd",
1317        target_os = "openbsd",
1318        target_vendor = "apple",
1319    ))]
1320    pub fn try_lock(&self) -> Result<(), TryLockError> {
1321        let result = cvt(unsafe { libc::flock(self.as_raw_fd(), libc::LOCK_EX | libc::LOCK_NB) });
1322        if let Err(err) = result {
1323            if err.kind() == io::ErrorKind::WouldBlock {
1324                Err(TryLockError::WouldBlock)
1325            } else {
1326                Err(TryLockError::Error(err))
1327            }
1328        } else {
1329            Ok(())
1330        }
1331    }
1332
1333    #[cfg(not(any(
1334        target_os = "freebsd",
1335        target_os = "fuchsia",
1336        target_os = "linux",
1337        target_os = "netbsd",
1338        target_os = "openbsd",
1339        target_vendor = "apple",
1340    )))]
1341    pub fn try_lock(&self) -> Result<(), TryLockError> {
1342        Err(TryLockError::Error(io::const_error!(
1343            io::ErrorKind::Unsupported,
1344            "try_lock() not supported"
1345        )))
1346    }
1347
1348    #[cfg(any(
1349        target_os = "freebsd",
1350        target_os = "fuchsia",
1351        target_os = "linux",
1352        target_os = "netbsd",
1353        target_os = "openbsd",
1354        target_vendor = "apple",
1355    ))]
1356    pub fn try_lock_shared(&self) -> Result<(), TryLockError> {
1357        let result = cvt(unsafe { libc::flock(self.as_raw_fd(), libc::LOCK_SH | libc::LOCK_NB) });
1358        if let Err(err) = result {
1359            if err.kind() == io::ErrorKind::WouldBlock {
1360                Err(TryLockError::WouldBlock)
1361            } else {
1362                Err(TryLockError::Error(err))
1363            }
1364        } else {
1365            Ok(())
1366        }
1367    }
1368
1369    #[cfg(not(any(
1370        target_os = "freebsd",
1371        target_os = "fuchsia",
1372        target_os = "linux",
1373        target_os = "netbsd",
1374        target_os = "openbsd",
1375        target_vendor = "apple",
1376    )))]
1377    pub fn try_lock_shared(&self) -> Result<(), TryLockError> {
1378        Err(TryLockError::Error(io::const_error!(
1379            io::ErrorKind::Unsupported,
1380            "try_lock_shared() not supported"
1381        )))
1382    }
1383
1384    #[cfg(any(
1385        target_os = "freebsd",
1386        target_os = "fuchsia",
1387        target_os = "linux",
1388        target_os = "netbsd",
1389        target_os = "openbsd",
1390        target_vendor = "apple",
1391    ))]
1392    pub fn unlock(&self) -> io::Result<()> {
1393        cvt(unsafe { libc::flock(self.as_raw_fd(), libc::LOCK_UN) })?;
1394        return Ok(());
1395    }
1396
1397    #[cfg(not(any(
1398        target_os = "freebsd",
1399        target_os = "fuchsia",
1400        target_os = "linux",
1401        target_os = "netbsd",
1402        target_os = "openbsd",
1403        target_vendor = "apple",
1404    )))]
1405    pub fn unlock(&self) -> io::Result<()> {
1406        Err(io::const_error!(io::ErrorKind::Unsupported, "unlock() not supported"))
1407    }
1408
1409    pub fn truncate(&self, size: u64) -> io::Result<()> {
1410        let size: off64_t =
1411            size.try_into().map_err(|e| io::Error::new(io::ErrorKind::InvalidInput, e))?;
1412        cvt_r(|| unsafe { ftruncate64(self.as_raw_fd(), size) }).map(drop)
1413    }
1414
1415    pub fn read(&self, buf: &mut [u8]) -> io::Result<usize> {
1416        self.0.read(buf)
1417    }
1418
1419    pub fn read_vectored(&self, bufs: &mut [IoSliceMut<'_>]) -> io::Result<usize> {
1420        self.0.read_vectored(bufs)
1421    }
1422
1423    #[inline]
1424    pub fn is_read_vectored(&self) -> bool {
1425        self.0.is_read_vectored()
1426    }
1427
1428    pub fn read_at(&self, buf: &mut [u8], offset: u64) -> io::Result<usize> {
1429        self.0.read_at(buf, offset)
1430    }
1431
1432    pub fn read_buf(&self, cursor: BorrowedCursor<'_>) -> io::Result<()> {
1433        self.0.read_buf(cursor)
1434    }
1435
1436    pub fn read_vectored_at(&self, bufs: &mut [IoSliceMut<'_>], offset: u64) -> io::Result<usize> {
1437        self.0.read_vectored_at(bufs, offset)
1438    }
1439
1440    pub fn write(&self, buf: &[u8]) -> io::Result<usize> {
1441        self.0.write(buf)
1442    }
1443
1444    pub fn write_vectored(&self, bufs: &[IoSlice<'_>]) -> io::Result<usize> {
1445        self.0.write_vectored(bufs)
1446    }
1447
1448    #[inline]
1449    pub fn is_write_vectored(&self) -> bool {
1450        self.0.is_write_vectored()
1451    }
1452
1453    pub fn write_at(&self, buf: &[u8], offset: u64) -> io::Result<usize> {
1454        self.0.write_at(buf, offset)
1455    }
1456
1457    pub fn write_vectored_at(&self, bufs: &[IoSlice<'_>], offset: u64) -> io::Result<usize> {
1458        self.0.write_vectored_at(bufs, offset)
1459    }
1460
1461    #[inline]
1462    pub fn flush(&self) -> io::Result<()> {
1463        Ok(())
1464    }
1465
1466    pub fn seek(&self, pos: SeekFrom) -> io::Result<u64> {
1467        let (whence, pos) = match pos {
1468            // Casting to `i64` is fine, too large values will end up as
1469            // negative which will cause an error in `lseek64`.
1470            SeekFrom::Start(off) => (libc::SEEK_SET, off as i64),
1471            SeekFrom::End(off) => (libc::SEEK_END, off),
1472            SeekFrom::Current(off) => (libc::SEEK_CUR, off),
1473        };
1474        let n = cvt(unsafe { lseek64(self.as_raw_fd(), pos as off64_t, whence) })?;
1475        Ok(n as u64)
1476    }
1477
1478    pub fn size(&self) -> Option<io::Result<u64>> {
1479        match self.file_attr().map(|attr| attr.size()) {
1480            // Fall back to default implementation if the returned size is 0,
1481            // we might be in a proc mount.
1482            Ok(0) => None,
1483            result => Some(result),
1484        }
1485    }
1486
1487    pub fn tell(&self) -> io::Result<u64> {
1488        self.seek(SeekFrom::Current(0))
1489    }
1490
1491    pub fn duplicate(&self) -> io::Result<File> {
1492        self.0.duplicate().map(File)
1493    }
1494
1495    pub fn set_permissions(&self, perm: FilePermissions) -> io::Result<()> {
1496        cvt_r(|| unsafe { libc::fchmod(self.as_raw_fd(), perm.mode) })?;
1497        Ok(())
1498    }
1499
1500    pub fn set_times(&self, times: FileTimes) -> io::Result<()> {
1501        #[cfg(not(any(
1502            target_os = "redox",
1503            target_os = "espidf",
1504            target_os = "horizon",
1505            target_os = "nuttx",
1506        )))]
1507        let to_timespec = |time: Option<SystemTime>| match time {
1508            Some(time) if let Some(ts) = time.t.to_timespec() => Ok(ts),
1509            Some(time) if time > crate::sys::time::UNIX_EPOCH => Err(io::const_error!(
1510                io::ErrorKind::InvalidInput,
1511                "timestamp is too large to set as a file time",
1512            )),
1513            Some(_) => Err(io::const_error!(
1514                io::ErrorKind::InvalidInput,
1515                "timestamp is too small to set as a file time",
1516            )),
1517            None => Ok(libc::timespec { tv_sec: 0, tv_nsec: libc::UTIME_OMIT as _ }),
1518        };
1519        cfg_select! {
1520            any(target_os = "redox", target_os = "espidf", target_os = "horizon", target_os = "nuttx") => {
1521                // Redox doesn't appear to support `UTIME_OMIT`.
1522                // ESP-IDF and HorizonOS do not support `futimens` at all and the behavior for those OS is therefore
1523                // the same as for Redox.
1524                let _ = times;
1525                Err(io::const_error!(
1526                    io::ErrorKind::Unsupported,
1527                    "setting file times not supported",
1528                ))
1529            }
1530            target_vendor = "apple" => {
1531                let mut buf = [mem::MaybeUninit::<libc::timespec>::uninit(); 3];
1532                let mut num_times = 0;
1533                let mut attrlist: libc::attrlist = unsafe { mem::zeroed() };
1534                attrlist.bitmapcount = libc::ATTR_BIT_MAP_COUNT;
1535                if times.created.is_some() {
1536                    buf[num_times].write(to_timespec(times.created)?);
1537                    num_times += 1;
1538                    attrlist.commonattr |= libc::ATTR_CMN_CRTIME;
1539                }
1540                if times.modified.is_some() {
1541                    buf[num_times].write(to_timespec(times.modified)?);
1542                    num_times += 1;
1543                    attrlist.commonattr |= libc::ATTR_CMN_MODTIME;
1544                }
1545                if times.accessed.is_some() {
1546                    buf[num_times].write(to_timespec(times.accessed)?);
1547                    num_times += 1;
1548                    attrlist.commonattr |= libc::ATTR_CMN_ACCTIME;
1549                }
1550                cvt(unsafe { libc::fsetattrlist(
1551                    self.as_raw_fd(),
1552                    (&raw const attrlist).cast::<libc::c_void>().cast_mut(),
1553                    buf.as_ptr().cast::<libc::c_void>().cast_mut(),
1554                    num_times * size_of::<libc::timespec>(),
1555                    0
1556                ) })?;
1557                Ok(())
1558            }
1559            target_os = "android" => {
1560                let times = [to_timespec(times.accessed)?, to_timespec(times.modified)?];
1561                // futimens requires Android API level 19
1562                cvt(unsafe {
1563                    weak!(
1564                        fn futimens(fd: c_int, times: *const libc::timespec) -> c_int;
1565                    );
1566                    match futimens.get() {
1567                        Some(futimens) => futimens(self.as_raw_fd(), times.as_ptr()),
1568                        None => return Err(io::const_error!(
1569                            io::ErrorKind::Unsupported,
1570                            "setting file times requires Android API level >= 19",
1571                        )),
1572                    }
1573                })?;
1574                Ok(())
1575            }
1576            _ => {
1577                #[cfg(all(target_os = "linux", target_env = "gnu", target_pointer_width = "32", not(target_arch = "riscv32")))]
1578                {
1579                    use crate::sys::{time::__timespec64, weak::weak};
1580
1581                    // Added in glibc 2.34
1582                    weak!(
1583                        fn __futimens64(fd: c_int, times: *const __timespec64) -> c_int;
1584                    );
1585
1586                    if let Some(futimens64) = __futimens64.get() {
1587                        let to_timespec = |time: Option<SystemTime>| time.map(|time| time.t.to_timespec64())
1588                            .unwrap_or(__timespec64::new(0, libc::UTIME_OMIT as _));
1589                        let times = [to_timespec(times.accessed), to_timespec(times.modified)];
1590                        cvt(unsafe { futimens64(self.as_raw_fd(), times.as_ptr()) })?;
1591                        return Ok(());
1592                    }
1593                }
1594                let times = [to_timespec(times.accessed)?, to_timespec(times.modified)?];
1595                cvt(unsafe { libc::futimens(self.as_raw_fd(), times.as_ptr()) })?;
1596                Ok(())
1597            }
1598        }
1599    }
1600}
1601
1602impl DirBuilder {
1603    pub fn new() -> DirBuilder {
1604        DirBuilder { mode: 0o777 }
1605    }
1606
1607    pub fn mkdir(&self, p: &Path) -> io::Result<()> {
1608        run_path_with_cstr(p, &|p| cvt(unsafe { libc::mkdir(p.as_ptr(), self.mode) }).map(|_| ()))
1609    }
1610
1611    pub fn set_mode(&mut self, mode: u32) {
1612        self.mode = mode as mode_t;
1613    }
1614}
1615
1616impl fmt::Debug for DirBuilder {
1617    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
1618        let DirBuilder { mode } = self;
1619        f.debug_struct("DirBuilder").field("mode", &Mode(*mode)).finish()
1620    }
1621}
1622
1623impl AsInner<FileDesc> for File {
1624    #[inline]
1625    fn as_inner(&self) -> &FileDesc {
1626        &self.0
1627    }
1628}
1629
1630impl AsInnerMut<FileDesc> for File {
1631    #[inline]
1632    fn as_inner_mut(&mut self) -> &mut FileDesc {
1633        &mut self.0
1634    }
1635}
1636
1637impl IntoInner<FileDesc> for File {
1638    fn into_inner(self) -> FileDesc {
1639        self.0
1640    }
1641}
1642
1643impl FromInner<FileDesc> for File {
1644    fn from_inner(file_desc: FileDesc) -> Self {
1645        Self(file_desc)
1646    }
1647}
1648
1649impl AsFd for File {
1650    #[inline]
1651    fn as_fd(&self) -> BorrowedFd<'_> {
1652        self.0.as_fd()
1653    }
1654}
1655
1656impl AsRawFd for File {
1657    #[inline]
1658    fn as_raw_fd(&self) -> RawFd {
1659        self.0.as_raw_fd()
1660    }
1661}
1662
1663impl IntoRawFd for File {
1664    fn into_raw_fd(self) -> RawFd {
1665        self.0.into_raw_fd()
1666    }
1667}
1668
1669impl FromRawFd for File {
1670    unsafe fn from_raw_fd(raw_fd: RawFd) -> Self {
1671        Self(FromRawFd::from_raw_fd(raw_fd))
1672    }
1673}
1674
1675impl fmt::Debug for File {
1676    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
1677        #[cfg(any(target_os = "linux", target_os = "illumos", target_os = "solaris"))]
1678        fn get_path(fd: c_int) -> Option<PathBuf> {
1679            let mut p = PathBuf::from("/proc/self/fd");
1680            p.push(&fd.to_string());
1681            run_path_with_cstr(&p, &readlink).ok()
1682        }
1683
1684        #[cfg(any(target_vendor = "apple", target_os = "netbsd"))]
1685        fn get_path(fd: c_int) -> Option<PathBuf> {
1686            // FIXME: The use of PATH_MAX is generally not encouraged, but it
1687            // is inevitable in this case because Apple targets and NetBSD define `fcntl`
1688            // with `F_GETPATH` in terms of `MAXPATHLEN`, and there are no
1689            // alternatives. If a better method is invented, it should be used
1690            // instead.
1691            let mut buf = vec![0; libc::PATH_MAX as usize];
1692            let n = unsafe { libc::fcntl(fd, libc::F_GETPATH, buf.as_ptr()) };
1693            if n == -1 {
1694                cfg_select! {
1695                    target_os = "netbsd" => {
1696                        // fallback to procfs as last resort
1697                        let mut p = PathBuf::from("/proc/self/fd");
1698                        p.push(&fd.to_string());
1699                        return run_path_with_cstr(&p, &readlink).ok()
1700                    }
1701                    _ => {
1702                        return None;
1703                    }
1704                }
1705            }
1706            let l = buf.iter().position(|&c| c == 0).unwrap();
1707            buf.truncate(l as usize);
1708            buf.shrink_to_fit();
1709            Some(PathBuf::from(OsString::from_vec(buf)))
1710        }
1711
1712        #[cfg(target_os = "freebsd")]
1713        fn get_path(fd: c_int) -> Option<PathBuf> {
1714            let info = Box::<libc::kinfo_file>::new_zeroed();
1715            let mut info = unsafe { info.assume_init() };
1716            info.kf_structsize = size_of::<libc::kinfo_file>() as libc::c_int;
1717            let n = unsafe { libc::fcntl(fd, libc::F_KINFO, &mut *info) };
1718            if n == -1 {
1719                return None;
1720            }
1721            let buf = unsafe { CStr::from_ptr(info.kf_path.as_mut_ptr()).to_bytes().to_vec() };
1722            Some(PathBuf::from(OsString::from_vec(buf)))
1723        }
1724
1725        #[cfg(target_os = "vxworks")]
1726        fn get_path(fd: c_int) -> Option<PathBuf> {
1727            let mut buf = vec![0; libc::PATH_MAX as usize];
1728            let n = unsafe { libc::ioctl(fd, libc::FIOGETNAME, buf.as_ptr()) };
1729            if n == -1 {
1730                return None;
1731            }
1732            let l = buf.iter().position(|&c| c == 0).unwrap();
1733            buf.truncate(l as usize);
1734            Some(PathBuf::from(OsString::from_vec(buf)))
1735        }
1736
1737        #[cfg(not(any(
1738            target_os = "linux",
1739            target_os = "vxworks",
1740            target_os = "freebsd",
1741            target_os = "netbsd",
1742            target_os = "illumos",
1743            target_os = "solaris",
1744            target_vendor = "apple",
1745        )))]
1746        fn get_path(_fd: c_int) -> Option<PathBuf> {
1747            // FIXME(#24570): implement this for other Unix platforms
1748            None
1749        }
1750
1751        fn get_mode(fd: c_int) -> Option<(bool, bool)> {
1752            let mode = unsafe { libc::fcntl(fd, libc::F_GETFL) };
1753            if mode == -1 {
1754                return None;
1755            }
1756            match mode & libc::O_ACCMODE {
1757                libc::O_RDONLY => Some((true, false)),
1758                libc::O_RDWR => Some((true, true)),
1759                libc::O_WRONLY => Some((false, true)),
1760                _ => None,
1761            }
1762        }
1763
1764        let fd = self.as_raw_fd();
1765        let mut b = f.debug_struct("File");
1766        b.field("fd", &fd);
1767        if let Some(path) = get_path(fd) {
1768            b.field("path", &path);
1769        }
1770        if let Some((read, write)) = get_mode(fd) {
1771            b.field("read", &read).field("write", &write);
1772        }
1773        b.finish()
1774    }
1775}
1776
1777// Format in octal, followed by the mode format used in `ls -l`.
1778//
1779// References:
1780//   https://pubs.opengroup.org/onlinepubs/009696899/utilities/ls.html
1781//   https://www.gnu.org/software/libc/manual/html_node/Testing-File-Type.html
1782//   https://www.gnu.org/software/libc/manual/html_node/Permission-Bits.html
1783//
1784// Example:
1785//   0o100664 (-rw-rw-r--)
1786impl fmt::Debug for Mode {
1787    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
1788        let Self(mode) = *self;
1789        write!(f, "0o{mode:06o}")?;
1790
1791        let entry_type = match mode & libc::S_IFMT {
1792            libc::S_IFDIR => 'd',
1793            libc::S_IFBLK => 'b',
1794            libc::S_IFCHR => 'c',
1795            libc::S_IFLNK => 'l',
1796            libc::S_IFIFO => 'p',
1797            libc::S_IFREG => '-',
1798            _ => return Ok(()),
1799        };
1800
1801        f.write_str(" (")?;
1802        f.write_char(entry_type)?;
1803
1804        // Owner permissions
1805        f.write_char(if mode & libc::S_IRUSR != 0 { 'r' } else { '-' })?;
1806        f.write_char(if mode & libc::S_IWUSR != 0 { 'w' } else { '-' })?;
1807        let owner_executable = mode & libc::S_IXUSR != 0;
1808        let setuid = mode as c_int & libc::S_ISUID as c_int != 0;
1809        f.write_char(match (owner_executable, setuid) {
1810            (true, true) => 's',  // executable and setuid
1811            (false, true) => 'S', // setuid
1812            (true, false) => 'x', // executable
1813            (false, false) => '-',
1814        })?;
1815
1816        // Group permissions
1817        f.write_char(if mode & libc::S_IRGRP != 0 { 'r' } else { '-' })?;
1818        f.write_char(if mode & libc::S_IWGRP != 0 { 'w' } else { '-' })?;
1819        let group_executable = mode & libc::S_IXGRP != 0;
1820        let setgid = mode as c_int & libc::S_ISGID as c_int != 0;
1821        f.write_char(match (group_executable, setgid) {
1822            (true, true) => 's',  // executable and setgid
1823            (false, true) => 'S', // setgid
1824            (true, false) => 'x', // executable
1825            (false, false) => '-',
1826        })?;
1827
1828        // Other permissions
1829        f.write_char(if mode & libc::S_IROTH != 0 { 'r' } else { '-' })?;
1830        f.write_char(if mode & libc::S_IWOTH != 0 { 'w' } else { '-' })?;
1831        let other_executable = mode & libc::S_IXOTH != 0;
1832        let sticky = mode as c_int & libc::S_ISVTX as c_int != 0;
1833        f.write_char(match (entry_type, other_executable, sticky) {
1834            ('d', true, true) => 't',  // searchable and restricted deletion
1835            ('d', false, true) => 'T', // restricted deletion
1836            (_, true, _) => 'x',       // executable
1837            (_, false, _) => '-',
1838        })?;
1839
1840        f.write_char(')')
1841    }
1842}
1843
1844pub fn readdir(path: &Path) -> io::Result<ReadDir> {
1845    let ptr = run_path_with_cstr(path, &|p| unsafe { Ok(libc::opendir(p.as_ptr())) })?;
1846    if ptr.is_null() {
1847        Err(Error::last_os_error())
1848    } else {
1849        let root = path.to_path_buf();
1850        let inner = InnerReadDir { dirp: Dir(ptr), root };
1851        Ok(ReadDir::new(inner))
1852    }
1853}
1854
1855pub fn unlink(p: &CStr) -> io::Result<()> {
1856    cvt(unsafe { libc::unlink(p.as_ptr()) }).map(|_| ())
1857}
1858
1859pub fn rename(old: &CStr, new: &CStr) -> io::Result<()> {
1860    cvt(unsafe { libc::rename(old.as_ptr(), new.as_ptr()) }).map(|_| ())
1861}
1862
1863pub fn set_perm(p: &CStr, perm: FilePermissions) -> io::Result<()> {
1864    cvt_r(|| unsafe { libc::chmod(p.as_ptr(), perm.mode) }).map(|_| ())
1865}
1866
1867pub fn rmdir(p: &CStr) -> io::Result<()> {
1868    cvt(unsafe { libc::rmdir(p.as_ptr()) }).map(|_| ())
1869}
1870
1871pub fn readlink(c_path: &CStr) -> io::Result<PathBuf> {
1872    let p = c_path.as_ptr();
1873
1874    let mut buf = Vec::with_capacity(256);
1875
1876    loop {
1877        let buf_read =
1878            cvt(unsafe { libc::readlink(p, buf.as_mut_ptr() as *mut _, buf.capacity()) })? as usize;
1879
1880        unsafe {
1881            buf.set_len(buf_read);
1882        }
1883
1884        if buf_read != buf.capacity() {
1885            buf.shrink_to_fit();
1886
1887            return Ok(PathBuf::from(OsString::from_vec(buf)));
1888        }
1889
1890        // Trigger the internal buffer resizing logic of `Vec` by requiring
1891        // more space than the current capacity. The length is guaranteed to be
1892        // the same as the capacity due to the if statement above.
1893        buf.reserve(1);
1894    }
1895}
1896
1897pub fn symlink(original: &CStr, link: &CStr) -> io::Result<()> {
1898    cvt(unsafe { libc::symlink(original.as_ptr(), link.as_ptr()) }).map(|_| ())
1899}
1900
1901pub fn link(original: &CStr, link: &CStr) -> io::Result<()> {
1902    cfg_select! {
1903        any(target_os = "vxworks", target_os = "redox", target_os = "android", target_os = "espidf", target_os = "horizon", target_os = "vita", target_env = "nto70") => {
1904            // VxWorks, Redox and ESP-IDF lack `linkat`, so use `link` instead. POSIX leaves
1905            // it implementation-defined whether `link` follows symlinks, so rely on the
1906            // `symlink_hard_link` test in library/std/src/fs/tests.rs to check the behavior.
1907            // Android has `linkat` on newer versions, but we happen to know `link`
1908            // always has the correct behavior, so it's here as well.
1909            cvt(unsafe { libc::link(original.as_ptr(), link.as_ptr()) })?;
1910        }
1911        _ => {
1912            // Where we can, use `linkat` instead of `link`; see the comment above
1913            // this one for details on why.
1914            cvt(unsafe { libc::linkat(libc::AT_FDCWD, original.as_ptr(), libc::AT_FDCWD, link.as_ptr(), 0) })?;
1915        }
1916    }
1917    Ok(())
1918}
1919
1920pub fn stat(p: &CStr) -> io::Result<FileAttr> {
1921    cfg_has_statx! {
1922        if let Some(ret) = unsafe { try_statx(
1923            libc::AT_FDCWD,
1924            p.as_ptr(),
1925            libc::AT_STATX_SYNC_AS_STAT,
1926            libc::STATX_BASIC_STATS | libc::STATX_BTIME,
1927        ) } {
1928            return ret;
1929        }
1930    }
1931
1932    let mut stat: stat64 = unsafe { mem::zeroed() };
1933    cvt(unsafe { stat64(p.as_ptr(), &mut stat) })?;
1934    Ok(FileAttr::from_stat64(stat))
1935}
1936
1937pub fn lstat(p: &CStr) -> io::Result<FileAttr> {
1938    cfg_has_statx! {
1939        if let Some(ret) = unsafe { try_statx(
1940            libc::AT_FDCWD,
1941            p.as_ptr(),
1942            libc::AT_SYMLINK_NOFOLLOW | libc::AT_STATX_SYNC_AS_STAT,
1943            libc::STATX_BASIC_STATS | libc::STATX_BTIME,
1944        ) } {
1945            return ret;
1946        }
1947    }
1948
1949    let mut stat: stat64 = unsafe { mem::zeroed() };
1950    cvt(unsafe { lstat64(p.as_ptr(), &mut stat) })?;
1951    Ok(FileAttr::from_stat64(stat))
1952}
1953
1954pub fn canonicalize(path: &CStr) -> io::Result<PathBuf> {
1955    let r = unsafe { libc::realpath(path.as_ptr(), ptr::null_mut()) };
1956    if r.is_null() {
1957        return Err(io::Error::last_os_error());
1958    }
1959    Ok(PathBuf::from(OsString::from_vec(unsafe {
1960        let buf = CStr::from_ptr(r).to_bytes().to_vec();
1961        libc::free(r as *mut _);
1962        buf
1963    })))
1964}
1965
1966fn open_from(from: &Path) -> io::Result<(crate::fs::File, crate::fs::Metadata)> {
1967    use crate::fs::File;
1968    use crate::sys::fs::common::NOT_FILE_ERROR;
1969
1970    let reader = File::open(from)?;
1971    let metadata = reader.metadata()?;
1972    if !metadata.is_file() {
1973        return Err(NOT_FILE_ERROR);
1974    }
1975    Ok((reader, metadata))
1976}
1977
1978#[cfg(target_os = "espidf")]
1979fn open_to_and_set_permissions(
1980    to: &Path,
1981    _reader_metadata: &crate::fs::Metadata,
1982) -> io::Result<(crate::fs::File, crate::fs::Metadata)> {
1983    use crate::fs::OpenOptions;
1984    let writer = OpenOptions::new().open(to)?;
1985    let writer_metadata = writer.metadata()?;
1986    Ok((writer, writer_metadata))
1987}
1988
1989#[cfg(not(target_os = "espidf"))]
1990fn open_to_and_set_permissions(
1991    to: &Path,
1992    reader_metadata: &crate::fs::Metadata,
1993) -> io::Result<(crate::fs::File, crate::fs::Metadata)> {
1994    use crate::fs::OpenOptions;
1995    use crate::os::unix::fs::{OpenOptionsExt, PermissionsExt};
1996
1997    let perm = reader_metadata.permissions();
1998    let writer = OpenOptions::new()
1999        // create the file with the correct mode right away
2000        .mode(perm.mode())
2001        .write(true)
2002        .create(true)
2003        .truncate(true)
2004        .open(to)?;
2005    let writer_metadata = writer.metadata()?;
2006    // fchmod is broken on vita
2007    #[cfg(not(target_os = "vita"))]
2008    if writer_metadata.is_file() {
2009        // Set the correct file permissions, in case the file already existed.
2010        // Don't set the permissions on already existing non-files like
2011        // pipes/FIFOs or device nodes.
2012        writer.set_permissions(perm)?;
2013    }
2014    Ok((writer, writer_metadata))
2015}
2016
2017mod cfm {
2018    use crate::fs::{File, Metadata};
2019    use crate::io::{BorrowedCursor, IoSlice, IoSliceMut, Read, Result, Write};
2020
2021    #[allow(dead_code)]
2022    pub struct CachedFileMetadata(pub File, pub Metadata);
2023
2024    impl Read for CachedFileMetadata {
2025        fn read(&mut self, buf: &mut [u8]) -> Result<usize> {
2026            self.0.read(buf)
2027        }
2028        fn read_vectored(&mut self, bufs: &mut [IoSliceMut<'_>]) -> Result<usize> {
2029            self.0.read_vectored(bufs)
2030        }
2031        fn read_buf(&mut self, cursor: BorrowedCursor<'_>) -> Result<()> {
2032            self.0.read_buf(cursor)
2033        }
2034        #[inline]
2035        fn is_read_vectored(&self) -> bool {
2036            self.0.is_read_vectored()
2037        }
2038        fn read_to_end(&mut self, buf: &mut Vec<u8>) -> Result<usize> {
2039            self.0.read_to_end(buf)
2040        }
2041        fn read_to_string(&mut self, buf: &mut String) -> Result<usize> {
2042            self.0.read_to_string(buf)
2043        }
2044    }
2045    impl Write for CachedFileMetadata {
2046        fn write(&mut self, buf: &[u8]) -> Result<usize> {
2047            self.0.write(buf)
2048        }
2049        fn write_vectored(&mut self, bufs: &[IoSlice<'_>]) -> Result<usize> {
2050            self.0.write_vectored(bufs)
2051        }
2052        #[inline]
2053        fn is_write_vectored(&self) -> bool {
2054            self.0.is_write_vectored()
2055        }
2056        #[inline]
2057        fn flush(&mut self) -> Result<()> {
2058            self.0.flush()
2059        }
2060    }
2061}
2062#[cfg(any(target_os = "linux", target_os = "android"))]
2063pub(crate) use cfm::CachedFileMetadata;
2064
2065#[cfg(not(target_vendor = "apple"))]
2066pub fn copy(from: &Path, to: &Path) -> io::Result<u64> {
2067    let (reader, reader_metadata) = open_from(from)?;
2068    let (writer, writer_metadata) = open_to_and_set_permissions(to, &reader_metadata)?;
2069
2070    io::copy(
2071        &mut cfm::CachedFileMetadata(reader, reader_metadata),
2072        &mut cfm::CachedFileMetadata(writer, writer_metadata),
2073    )
2074}
2075
2076#[cfg(target_vendor = "apple")]
2077pub fn copy(from: &Path, to: &Path) -> io::Result<u64> {
2078    const COPYFILE_ALL: libc::copyfile_flags_t = libc::COPYFILE_METADATA | libc::COPYFILE_DATA;
2079
2080    struct FreeOnDrop(libc::copyfile_state_t);
2081    impl Drop for FreeOnDrop {
2082        fn drop(&mut self) {
2083            // The code below ensures that `FreeOnDrop` is never a null pointer
2084            unsafe {
2085                // `copyfile_state_free` returns -1 if the `to` or `from` files
2086                // cannot be closed. However, this is not considered an error.
2087                libc::copyfile_state_free(self.0);
2088            }
2089        }
2090    }
2091
2092    let (reader, reader_metadata) = open_from(from)?;
2093
2094    let clonefile_result = run_path_with_cstr(to, &|to| {
2095        cvt(unsafe { libc::fclonefileat(reader.as_raw_fd(), libc::AT_FDCWD, to.as_ptr(), 0) })
2096    });
2097    match clonefile_result {
2098        Ok(_) => return Ok(reader_metadata.len()),
2099        Err(e) => match e.raw_os_error() {
2100            // `fclonefileat` will fail on non-APFS volumes, if the
2101            // destination already exists, or if the source and destination
2102            // are on different devices. In all these cases `fcopyfile`
2103            // should succeed.
2104            Some(libc::ENOTSUP) | Some(libc::EEXIST) | Some(libc::EXDEV) => (),
2105            _ => return Err(e),
2106        },
2107    }
2108
2109    // Fall back to using `fcopyfile` if `fclonefileat` does not succeed.
2110    let (writer, writer_metadata) = open_to_and_set_permissions(to, &reader_metadata)?;
2111
2112    // We ensure that `FreeOnDrop` never contains a null pointer so it is
2113    // always safe to call `copyfile_state_free`
2114    let state = unsafe {
2115        let state = libc::copyfile_state_alloc();
2116        if state.is_null() {
2117            return Err(crate::io::Error::last_os_error());
2118        }
2119        FreeOnDrop(state)
2120    };
2121
2122    let flags = if writer_metadata.is_file() { COPYFILE_ALL } else { libc::COPYFILE_DATA };
2123
2124    cvt(unsafe { libc::fcopyfile(reader.as_raw_fd(), writer.as_raw_fd(), state.0, flags) })?;
2125
2126    let mut bytes_copied: libc::off_t = 0;
2127    cvt(unsafe {
2128        libc::copyfile_state_get(
2129            state.0,
2130            libc::COPYFILE_STATE_COPIED as u32,
2131            (&raw mut bytes_copied) as *mut libc::c_void,
2132        )
2133    })?;
2134    Ok(bytes_copied as u64)
2135}
2136
2137pub fn chown(path: &Path, uid: u32, gid: u32) -> io::Result<()> {
2138    run_path_with_cstr(path, &|path| {
2139        cvt(unsafe { libc::chown(path.as_ptr(), uid as libc::uid_t, gid as libc::gid_t) })
2140            .map(|_| ())
2141    })
2142}
2143
2144pub fn fchown(fd: c_int, uid: u32, gid: u32) -> io::Result<()> {
2145    cvt(unsafe { libc::fchown(fd, uid as libc::uid_t, gid as libc::gid_t) })?;
2146    Ok(())
2147}
2148
2149#[cfg(not(target_os = "vxworks"))]
2150pub fn lchown(path: &Path, uid: u32, gid: u32) -> io::Result<()> {
2151    run_path_with_cstr(path, &|path| {
2152        cvt(unsafe { libc::lchown(path.as_ptr(), uid as libc::uid_t, gid as libc::gid_t) })
2153            .map(|_| ())
2154    })
2155}
2156
2157#[cfg(target_os = "vxworks")]
2158pub fn lchown(path: &Path, uid: u32, gid: u32) -> io::Result<()> {
2159    let (_, _, _) = (path, uid, gid);
2160    Err(io::const_error!(io::ErrorKind::Unsupported, "lchown not supported by vxworks"))
2161}
2162
2163#[cfg(not(any(target_os = "fuchsia", target_os = "vxworks")))]
2164pub fn chroot(dir: &Path) -> io::Result<()> {
2165    run_path_with_cstr(dir, &|dir| cvt(unsafe { libc::chroot(dir.as_ptr()) }).map(|_| ()))
2166}
2167
2168#[cfg(target_os = "vxworks")]
2169pub fn chroot(dir: &Path) -> io::Result<()> {
2170    let _ = dir;
2171    Err(io::const_error!(io::ErrorKind::Unsupported, "chroot not supported by vxworks"))
2172}
2173
2174pub fn mkfifo(path: &Path, mode: u32) -> io::Result<()> {
2175    run_path_with_cstr(path, &|path| {
2176        cvt(unsafe { libc::mkfifo(path.as_ptr(), mode.try_into().unwrap()) }).map(|_| ())
2177    })
2178}
2179
2180pub use remove_dir_impl::remove_dir_all;
2181
2182// Fallback for REDOX, ESP-ID, Horizon, Vita, Vxworks and Miri
2183#[cfg(any(
2184    target_os = "redox",
2185    target_os = "espidf",
2186    target_os = "horizon",
2187    target_os = "vita",
2188    target_os = "nto",
2189    target_os = "vxworks",
2190    miri
2191))]
2192mod remove_dir_impl {
2193    pub use crate::sys::fs::common::remove_dir_all;
2194}
2195
2196// Modern implementation using openat(), unlinkat() and fdopendir()
2197#[cfg(not(any(
2198    target_os = "redox",
2199    target_os = "espidf",
2200    target_os = "horizon",
2201    target_os = "vita",
2202    target_os = "nto",
2203    target_os = "vxworks",
2204    miri
2205)))]
2206mod remove_dir_impl {
2207    #[cfg(not(all(target_os = "linux", target_env = "gnu")))]
2208    use libc::{fdopendir, openat, unlinkat};
2209    #[cfg(all(target_os = "linux", target_env = "gnu"))]
2210    use libc::{fdopendir, openat64 as openat, unlinkat};
2211
2212    use super::{Dir, DirEntry, InnerReadDir, ReadDir, lstat};
2213    use crate::ffi::CStr;
2214    use crate::io;
2215    use crate::os::unix::io::{AsRawFd, FromRawFd, IntoRawFd};
2216    use crate::os::unix::prelude::{OwnedFd, RawFd};
2217    use crate::path::{Path, PathBuf};
2218    use crate::sys::common::small_c_string::run_path_with_cstr;
2219    use crate::sys::{cvt, cvt_r};
2220    use crate::sys_common::ignore_notfound;
2221
2222    pub fn openat_nofollow_dironly(parent_fd: Option<RawFd>, p: &CStr) -> io::Result<OwnedFd> {
2223        let fd = cvt_r(|| unsafe {
2224            openat(
2225                parent_fd.unwrap_or(libc::AT_FDCWD),
2226                p.as_ptr(),
2227                libc::O_CLOEXEC | libc::O_RDONLY | libc::O_NOFOLLOW | libc::O_DIRECTORY,
2228            )
2229        })?;
2230        Ok(unsafe { OwnedFd::from_raw_fd(fd) })
2231    }
2232
2233    fn fdreaddir(dir_fd: OwnedFd) -> io::Result<(ReadDir, RawFd)> {
2234        let ptr = unsafe { fdopendir(dir_fd.as_raw_fd()) };
2235        if ptr.is_null() {
2236            return Err(io::Error::last_os_error());
2237        }
2238        let dirp = Dir(ptr);
2239        // file descriptor is automatically closed by libc::closedir() now, so give up ownership
2240        let new_parent_fd = dir_fd.into_raw_fd();
2241        // a valid root is not needed because we do not call any functions involving the full path
2242        // of the `DirEntry`s.
2243        let dummy_root = PathBuf::new();
2244        let inner = InnerReadDir { dirp, root: dummy_root };
2245        Ok((ReadDir::new(inner), new_parent_fd))
2246    }
2247
2248    #[cfg(any(
2249        target_os = "solaris",
2250        target_os = "illumos",
2251        target_os = "haiku",
2252        target_os = "vxworks",
2253        target_os = "aix",
2254    ))]
2255    fn is_dir(_ent: &DirEntry) -> Option<bool> {
2256        None
2257    }
2258
2259    #[cfg(not(any(
2260        target_os = "solaris",
2261        target_os = "illumos",
2262        target_os = "haiku",
2263        target_os = "vxworks",
2264        target_os = "aix",
2265    )))]
2266    fn is_dir(ent: &DirEntry) -> Option<bool> {
2267        match ent.entry.d_type {
2268            libc::DT_UNKNOWN => None,
2269            libc::DT_DIR => Some(true),
2270            _ => Some(false),
2271        }
2272    }
2273
2274    fn is_enoent(result: &io::Result<()>) -> bool {
2275        if let Err(err) = result
2276            && matches!(err.raw_os_error(), Some(libc::ENOENT))
2277        {
2278            true
2279        } else {
2280            false
2281        }
2282    }
2283
2284    fn remove_dir_all_recursive(parent_fd: Option<RawFd>, path: &CStr) -> io::Result<()> {
2285        // try opening as directory
2286        let fd = match openat_nofollow_dironly(parent_fd, &path) {
2287            Err(err) if matches!(err.raw_os_error(), Some(libc::ENOTDIR | libc::ELOOP)) => {
2288                // not a directory - don't traverse further
2289                // (for symlinks, older Linux kernels may return ELOOP instead of ENOTDIR)
2290                return match parent_fd {
2291                    // unlink...
2292                    Some(parent_fd) => {
2293                        cvt(unsafe { unlinkat(parent_fd, path.as_ptr(), 0) }).map(drop)
2294                    }
2295                    // ...unless this was supposed to be the deletion root directory
2296                    None => Err(err),
2297                };
2298            }
2299            result => result?,
2300        };
2301
2302        // open the directory passing ownership of the fd
2303        let (dir, fd) = fdreaddir(fd)?;
2304        for child in dir {
2305            let child = child?;
2306            let child_name = child.name_cstr();
2307            // we need an inner try block, because if one of these
2308            // directories has already been deleted, then we need to
2309            // continue the loop, not return ok.
2310            let result: io::Result<()> = try {
2311                match is_dir(&child) {
2312                    Some(true) => {
2313                        remove_dir_all_recursive(Some(fd), child_name)?;
2314                    }
2315                    Some(false) => {
2316                        cvt(unsafe { unlinkat(fd, child_name.as_ptr(), 0) })?;
2317                    }
2318                    None => {
2319                        // POSIX specifies that calling unlink()/unlinkat(..., 0) on a directory can succeed
2320                        // if the process has the appropriate privileges. This however can causing orphaned
2321                        // directories requiring an fsck e.g. on Solaris and Illumos. So we try recursing
2322                        // into it first instead of trying to unlink() it.
2323                        remove_dir_all_recursive(Some(fd), child_name)?;
2324                    }
2325                }
2326            };
2327            if result.is_err() && !is_enoent(&result) {
2328                return result;
2329            }
2330        }
2331
2332        // unlink the directory after removing its contents
2333        ignore_notfound(cvt(unsafe {
2334            unlinkat(parent_fd.unwrap_or(libc::AT_FDCWD), path.as_ptr(), libc::AT_REMOVEDIR)
2335        }))?;
2336        Ok(())
2337    }
2338
2339    fn remove_dir_all_modern(p: &CStr) -> io::Result<()> {
2340        // We cannot just call remove_dir_all_recursive() here because that would not delete a passed
2341        // symlink. No need to worry about races, because remove_dir_all_recursive() does not recurse
2342        // into symlinks.
2343        let attr = lstat(p)?;
2344        if attr.file_type().is_symlink() {
2345            super::unlink(p)
2346        } else {
2347            remove_dir_all_recursive(None, &p)
2348        }
2349    }
2350
2351    pub fn remove_dir_all(p: &Path) -> io::Result<()> {
2352        run_path_with_cstr(p, &remove_dir_all_modern)
2353    }
2354}