this was an intense audit of nvmutil that somehow evolved
into writing a new, hardened implementation of mktemp.

it all works, a few memory bugs to solve on bsd, but i don't
see the point in keeping it. mktemp is fine, and nvmutil
already works.

lbutils implemented atomic writes and integrity checking,
in a manner completely overengineered for what it was
actually doing (modifying a few bytes in 8KB GbE files)

just delete it. i'll bring it back if i ever finish the
code. i don't want to leave dead/unfinished code in the tree.

Signed-off-by: Leah Rowe <leah@libreboot.org>

Signed-off-by: Leah Rowe <leah@libreboot.org>

Signed-off-by: Leah Rowe <leah@libreboot.org>

i wasn't using strict mode enough in make:

make strict

now it compiles cleanly. mostly removing
unused variables, fixing implicit conversions,
etc.

Signed-off-by: Leah Rowe <leah@libreboot.org>

where possible, try not to clobber sys errno. override
it only when relatively safe.

also: when a syscall succeeds, it may set errno. this
is rare, but permitted (nothing specified against it
in specs, and the specs say that errno is undefined
on success).

i'm not libc, but i'm wrapping around it, so i need
to be careful in how i handle the errno value.

also:

i removed the requirement for directories to be
executable, in mkhtemp.c, because this isn't required
and will only break certain setups.

in world_writeable and sticky, i made the checks stricter:
the faccessat check was being skipped on some paths, so
i've closed that loophole now.

i also generally cleaned up some code, as part of the errno
handling refactoring, where it made sense to do so, plus a
few other bits of code cleanup.

Signed-off-by: Leah Rowe <leah@libreboot.org>

just use PATH_MAX like a normal person

with additional safety

Signed-off-by: Leah Rowe <leah@libreboot.org>

i previously used error status and set return values
indirectly. i still do that, but where possible, i
also now return the real value.

this is because these string functions can no longer
return with error status; on error, they all abort.
this forces the program maintainer to keep their code
reliable, and removes the need to check the error status
after using syscalls, because these libc wrappers mitigate
that and make use of libc for you, including errors.

this is part of a general effort to promote safe use
of the C programming language, especially in libreboot!

Signed-off-by: Leah Rowe <leah@libreboot.org>

on the conditions where these functions encounter
an unexpected error, we currently return -1

this means that the caller must check. which means
the caller won't check. nobody does. i often forget.

force the caller (me) to be correct, instead.

the current calling convention is that the real
return value is stored in a pointer, provided inside
the function signature, on a given string function,
and the function's return value is merely an indicator.

this calling convention is retained for now; the next
patch will change it, such that the real value is also
the function's return value. this is more flexible.

Signed-off-by: Leah Rowe <leah@libreboot.org>

operate per word, not per byte

this is also done on sdup, which uses a slightly
inefficient method: the new string allocation is
that of the maximum size, rather than what we
need. for example, if you wanted a 20 character
string (21 including null), you would still allocate
4096 bytes if that was the maximum length.

it's a bit naughty, and i have half a mind to
keep sdup on the old implementation, but i'll leave
it be for now.

Signed-off-by: Leah Rowe <leah@libreboot.org>

Signed-off-by: Leah Rowe <leah@libreboot.org>