path: root/util/nvmutil/lib/file.c

/* SPDX-License-Identifier: MIT
 * Copyright (c) 2026 Leah Rowe <leah@libreboot.org>
 *
 * Pathless i/o, and some stuff you probably never saw.
 * Be nice to the demon.
 */

#if defined(__linux__) && !defined(_GNU_SOURCE)
/* for openat2 syscall on linux */
#define _GNU_SOURCE 1
#endif

#include <sys/types.h>
#include <sys/stat.h>

#include <errno.h>
#include <fcntl.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>

/* for openat2: */
#ifdef __linux__
#include <linux/openat2.h>
#include <sys/syscall.h>
#endif

#include "../include/common.h"

/* check that a file changed
 */

int
same_file(int fd, struct stat *st_old,
    int check_size)
{
	struct stat st;
	int saved_errno = errno;

	/* TODO: null/-1 checks
	 *       like this can be
	 *       generalised
	 */
	if (st_old == NULL) {
		errno = EFAULT;
		goto err_same_file;
	}
	if (fd < 0) {
		errno = EBADF;
		goto err_same_file;
	}

	if (fstat(fd, &st) == -1)
		goto err_same_file;

	if (fd_verify_regular(fd, st_old, &st) < 0)
		goto err_same_file;

	if (check_size &&
	    st.st_size != st_old->st_size)
		goto err_same_file;

	errno = saved_errno;
	return 0;

err_same_file:

	if (errno == saved_errno)
		errno = ESTALE;

	return -1;
}

/* open() but with abort traps
 */
/* TODO: also support other things here than files.
	and then use, throughout the program.
	in particular, use of openat might help
	(split the path)
	(see: link attack mitigations throughout nvmutil)

	make it return, and handle the return value/errno

	(this could return e.g. EINTR)

  TODO: this function is not used by mkhtemp, nor will
       it probably be, it's currently used by nvmutil,
	for opening intel gbe nvm config files. i can
      probably remove it though and unify witth some
      of the verification code now used for mkhtemp

TODO: and don't abort. return -1. and handle in the caller.

minor obstacle: the mkhtemp code always requires absolute
paths, whereas the gbe editor takes relative paths.
 */
void
xopen(int *fd_ptr, const char *path, int flags, struct stat *st)
{
	if ((*fd_ptr = open(path, flags)) < 0)
		err(errno, "%s", path);

	if (fstat(*fd_ptr, st) < 0)
		err(errno, "%s: stat", path);

	if (!S_ISREG(st->st_mode))
		err(errno, "%s: not a regular file", path);

	if (lseek_on_eintr(*fd_ptr, 0, SEEK_CUR, 1, 1) == (off_t)-1)
		err(errno, "%s: file not seekable", path);
}

/* fsync() the directory of a file,
 * useful for atomic writes
 */

int
fsync_dir(const char *path)
{
	int saved_errno = errno;

	size_t pathlen = 0;
	size_t maxlen = 0;

	char *dirbuf = NULL;
	int dirfd = -1;

	char *slash = NULL;
	struct stat st = {0};

	int close_errno;

#if defined(PATH_LEN) && \
    (PATH_LEN) >= 256
	maxlen = PATH_LEN;
#else
	maxlen = 4096;
#endif

	if (path == NULL) {
		errno = EFAULT;
		goto err_fsync_dir;
	}

	if (slen(path, maxlen, &pathlen) < 0)
		goto err_fsync_dir;

	if (pathlen >= maxlen || pathlen < 0) {
		errno = EMSGSIZE;
		goto err_fsync_dir;
	}

	if (pathlen == 0)
	{
		errno = EINVAL;
		goto err_fsync_dir;
	}

	dirbuf = malloc(pathlen + 1);
	if (dirbuf == NULL) {

		errno = ENOMEM;
		goto err_fsync_dir;
	}

	memcpy(dirbuf, path, pathlen + 1);
	slash = strrchr(dirbuf, '/');

	if (slash != NULL) {
		*slash = '\0';
		if (*dirbuf == '\0') {
			dirbuf[0] = '/';
			dirbuf[1] = '\0';
		}
	} else {
		dirbuf[0] = '.';
		dirbuf[1] = '\0';
	}

	dirfd = fs_open(dirbuf,
	    O_RDONLY | O_CLOEXEC | O_NOCTTY
#ifdef O_DIRECTORY
	    | O_DIRECTORY
#endif
#ifdef O_NOFOLLOW
	    | O_NOFOLLOW
#endif
);
	if (dirfd < 0)
		goto err_fsync_dir;

	if (fstat(dirfd, &st) < 0)
		goto err_fsync_dir;

	if (!S_ISDIR(st.st_mode)) {

		errno = ENOTDIR;
		goto err_fsync_dir;
	}

	/* sync file on disk */
	if (fsync_on_eintr(dirfd) == -1)
		goto err_fsync_dir;

	if (close_on_eintr(dirfd) == -1) {

		dirfd = -1;
		goto err_fsync_dir;
	}

	if (dirbuf != NULL) {

		free(dirbuf);
		dirbuf = NULL;
	}

	dirbuf = NULL;

	errno = saved_errno;
	return 0;

err_fsync_dir:

	if (errno == saved_errno)
		errno = EIO;

	if (dirbuf != NULL) {

		free(dirbuf);
		dirbuf = NULL;
	}

	if (dirfd >= 0) {

		close_errno = errno;
		(void) close_on_eintr(dirfd);
		errno = close_errno;
		dirfd = -1;
	}

	return -1;
}

/* hardened tmpfile and tmpdir creation.
 * obsessively hardened, to the point that
 * you could even say it is unhinged.
 *
 * much stricter than mkstemp.
 *
 * userspace sandboxing. TOCTOU-aware,
 * much stricter than typical libc/mkstemp.
 * TODO: write docs! right now the documentation
 * is both tthe code and the specification.
 * this code will likely be hardened more, over
 * time, until a matured stable release can be
 * made. i intend for this to go in linux distros
 * and BSD source trees eventually, as a standalone
 * utility.
 *
 * NOTE TO LINUX DISTROS / BSDs: more testing
 * and auditing needed before putting this
 * in your project. this comment will be removed
 * after the code has matured for a while. this
 * is a rough implementation, already carefully
 * audited by one person: me
 *
 * expect bugs. one day, when this is ready,
 * i will make a lot more of the options configurable
 * at runtime, and add a special compatibility mode
 * so that it can also run like regular mktemp,
 * for compatibility; running mkhtemp with all the
 * hardening means you get very non-standard behaviour,
 * e.g. it's much stricter about ownership/permissions,
 * sticky bits, and regards as fault conditions, what
 * would be considered normal in mkstemp/mktemp.
 *
 * a full manual and specification will be written when
 * this code is fully matured, and then i will probably
 * start spamming your mailing lists myself ;)
 */

/* returns opened fd, sets fd and *path at pointers *fd and *path */
/* also sets external stat */

int
new_tmpfile(int *fd, char **path)
{
	return new_tmp_common(fd, path, MKHTEMP_FILE);
}

int
new_tmpdir(int *fd, char **path)
{
	return new_tmp_common(fd, path, MKHTEMP_DIR);
}

static int
new_tmp_common(int *fd, char **path, int type)
{
#if defined(PATH_LEN) && \
    (PATH_LEN) >= 256
	size_t maxlen = PATH_LEN;
#else
	size_t maxlen = 4096;
#endif
	struct stat st;

	char suffix[] =
	    "tmpXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX";
	char *tmpdir = NULL;

	int close_errno;
	size_t dirlen;
	size_t destlen;
	char *dest = NULL; /* final path (will be written into "path") */
	int saved_errno = errno;
	int dirfd = -1;
	const char *fname = NULL;

	struct stat st_dir_initial;

	if (path == NULL || fd == NULL) {
		errno = EFAULT;
		goto err;
	}

	/* don't mess with someone elses file */
	if (*fd >= 0) {
		errno = EEXIST;
		goto err;
	}

	/* regarding **path:
	* the pointer (to the pointer)
	* must nott be null, but we don't
	* care about the pointer it points
	* to. you should expect it to be
	* replaced upon successful return
	*
	* (on error, it will not be touched)
	*/


	*fd = -1;

#if defined(PERMIT_NON_STICKY_ALWAYS) && \
    ((PERMIT_NON_STICKY_ALWAYS) > 0)
	tmpdir = env_tmpdir(PERMIT_NON_STICKY_ALWAYS);
#else
	tmpdir = env_tmpdir(0);
#endif
	if (tmpdir == NULL)
		goto err;

	if (slen(tmpdir, maxlen, &dirlen) < 0)
		goto err;
	if (*tmpdir == '\0')
		goto err;
	if (*tmpdir != '/')
		goto err;

	/* sizeof adds an extra byte, useful
	 * because we also want '.' or '/'
	 */
	destlen = dirlen + sizeof(suffix);
	if (destlen > maxlen - 1) {
		errno = EOVERFLOW;
		goto err;
	}

	dest = malloc(destlen + 1);
	if (dest == NULL) {
		errno = ENOMEM;
		goto err;
	}

	memcpy(dest, tmpdir, dirlen);
	*(dest + dirlen) = '/';
	memcpy(dest + dirlen + 1, suffix, sizeof(suffix) - 1);
	*(dest + destlen) = '\0';

	fname = dest + dirlen + 1;

	dirfd = fs_open(tmpdir,
	    O_RDONLY | O_DIRECTORY);
	if (dirfd < 0)
		goto err;

	if (fstat(dirfd, &st_dir_initial) < 0)
		goto err;

	*fd = mkhtemp(fd, &st, dest, dirfd,
	    fname, &st_dir_initial, type);
	if (*fd < 0)
		goto err;

	if (dirfd >= 0) {
		close_errno = errno;
		(void) close_on_eintr(dirfd);
		errno = close_errno;
		dirfd = -1;
	}

	errno = saved_errno;
	*path = dest;

	return 0;

err:

	if (errno != saved_errno)
		saved_errno = errno;
	else
		saved_errno = errno = EIO;

	if (dest != NULL) {
		free(dest);
		dest = NULL;
	}

	if (dirfd >= 0) {
		close_errno = errno;
		(void) close_on_eintr(dirfd);
		errno = close_errno;
		dirfd = -1;
	}

	if (*fd >= 0) {
		close_errno = errno;
		(void) close_on_eintr(*fd);
		errno = close_errno;
		*fd = -1;
	}

	errno = saved_errno;
	return -1;
}


/* hardened TMPDIR parsing
 */

char *
env_tmpdir(int bypass_all_sticky_checks)
{
	char *t;
	int allow_noworld_unsticky;
	int saved_errno = errno;

	t = getenv("TMPDIR");

	if (t != NULL && *t != '\0') {

		if (tmpdir_policy(t,
		    &allow_noworld_unsticky) < 0) {
			errno = EPERM;
			return NULL; /* errno already set */
		}

		if (!world_writeable_and_sticky(t,
		    allow_noworld_unsticky,
		    bypass_all_sticky_checks)) {
			errno = EPERM;
			return NULL;
		}

		errno = saved_errno;
		return t;
	}

	allow_noworld_unsticky = 0;

	if (world_writeable_and_sticky("/tmp",
	    allow_noworld_unsticky,
	    bypass_all_sticky_checks)) {

		errno = saved_errno;
		return "/tmp";
	}

	if (world_writeable_and_sticky("/var/tmp",
	    allow_noworld_unsticky,
	    bypass_all_sticky_checks)) {

		errno = saved_errno;
		return "/var/tmp";
	}

	if (errno == saved_errno)
		errno = EPERM;

	return NULL;
}

int
tmpdir_policy(const char *path,
    int *allow_noworld_unsticky)
{
	int saved_errno = errno;
	int r;

	if (path == NULL ||
	    allow_noworld_unsticky == NULL) {

		errno = EFAULT;
		return -1;
	}

	*allow_noworld_unsticky = 1;

	r = same_dir(path, "/tmp");
	if (r < 0)
		goto err_tmpdir_policy;
	if (r > 0)
		*allow_noworld_unsticky = 0;

	r = same_dir(path, "/var/tmp");
	if (r < 0)
		goto err_tmpdir_policy;
	if (r > 0)
		*allow_noworld_unsticky = 0;

	errno = saved_errno;
	return 0;

err_tmpdir_policy:

	if (errno == saved_errno)
		errno = EIO;

	return -1;
}

int
same_dir(const char *a, const char *b)
{
	int fd_a = -1;
	int fd_b = -1;

	struct stat st_a;
	struct stat st_b;

	int saved_errno = errno;
	int rval_scmp;

#if defined(PATH_LEN) && \
    (PATH_LEN) >= 256
	size_t maxlen = (PATH_LEN);
#else
	size_t maxlen = 4096;
#endif

	/* optimisation: if both dirs
	   are the same, we don't need
	   to check anything. sehr schnell:
	 */
	if (scmp(a, b, maxlen, &rval_scmp) < 0)
		goto err_same_dir;
	/* bonus: scmp checks null for us */
	if (rval_scmp == 0)
		goto success_same_dir;

	fd_a = fs_open(a, O_RDONLY | O_DIRECTORY);
	if (fd_a < 0)
		goto err_same_dir;

	fd_b = fs_open(b, O_RDONLY | O_DIRECTORY);
	if (fd_b < 0)
		goto err_same_dir;

	if (fstat(fd_a, &st_a) < 0)
		goto err_same_dir;

	if (fstat(fd_b, &st_b) < 0)
		goto err_same_dir;

	if (st_a.st_dev == st_b.st_dev &&
	    st_a.st_ino == st_b.st_ino) {

		(void) close_on_eintr(fd_a);
		(void) close_on_eintr(fd_b);

success_same_dir:

		/* SUCCESS
		 */

		errno = saved_errno;
		return 1;
	}

	(void) close_on_eintr(fd_a);
	(void) close_on_eintr(fd_b);

	/* FAILURE (logical)
	 */

	errno = saved_errno;
	return 0;

err_same_dir:

	/* FAILURE (probably syscall)
	 */

	if (fd_a >= 0)
		(void) close_on_eintr(fd_a);
	if (fd_b >= 0)
		(void) close_on_eintr(fd_b);

	if (errno == saved_errno)
		errno = EIO;

	return -1;
}

/* bypass_all_sticky_checks: if set,
       disable stickiness checks (libc behaviour)
       (if not set: leah behaviour)

   allow_noworld_unsticky:
       allow non-sticky files if not world-writeable
       (still block non-sticky in standard TMPDIR)
*/
int
world_writeable_and_sticky(
    const char *s,
    int allow_noworld_unsticky,
    int bypass_all_sticky_checks)
{
	struct stat st;
	int dirfd = -1;

	int saved_errno = errno;

	if (s == NULL || *s == '\0') {
		errno = EINVAL;
		goto sticky_hell;
	}

	/* mitigate symlink attacks*
	 */
	dirfd = fs_open(s, O_RDONLY | O_DIRECTORY);
	if (dirfd < 0)
		goto sticky_hell;

	if (fstat(dirfd, &st) < 0)
		goto sticky_hell;

	if (!S_ISDIR(st.st_mode)) {
		errno = ENOTDIR;
		goto sticky_hell;
	}

	/* must be fully executable
	 * by everyone, or openat2
	 * becomes unreliable**
	 */
	if (!(st.st_mode & S_IXUSR) ||
	    !(st.st_mode & S_IXGRP) ||
	    !(st.st_mode & S_IXOTH)) {

		errno = EACCES;
		goto sticky_hell;
	}

	/* *normal-**ish mode (libc):
	 */

	if (bypass_all_sticky_checks)
		goto sticky_heaven; /* normal == no security */

	/* unhinged leah mode:
	 */

	if (st.st_mode & S_IWOTH) { /* world writeable */

		/* if world-writeable, only
		 * allow sticky files
		 */
		if (st.st_mode & S_ISVTX)
			goto sticky_heaven; /* sticky */

		errno = EPERM;
		goto sticky_hell; /* not sticky */
	}

	/* non-world-writeable, so
	 * stickiness is do-not-care
	 */
	if (allow_noworld_unsticky)
		goto sticky_heaven; /* sticky! */

	goto sticky_hell; /* heaven visa denied */

sticky_heaven:
/* i like the one in hamburg better */

	if (dirfd >= 0)
		(void) close_on_eintr(dirfd);

	errno = saved_errno;

	return 1;

sticky_hell:

	if (errno == saved_errno)
		errno = EPERM;

	saved_errno = errno;

	if (dirfd >= 0)
		(void) close_on_eintr(dirfd);

	errno = saved_errno;

	return 0;
}

/* mk(h)temp - hardened mktemp.
 * like mkstemp, but (MUCH) harder.
 *
 * designed to resist TOCTOU attacsk
 * e.g. directory race / symlink attack
 * 
 * extremely strict and even implements
 * some limited userspace-level sandboxing,
 * similar to openbsd unveil (which you
 * can also use with this in your program)
 *
 * supports both files and directories.
 * file: type = MKHTEMP_FILE (0)
 * dir: type = MKHTEMP_DIR (1)
 *
 * DESIGN NOTES:
 *
 * caller is expected to handle
 * cleanup e.g. free(), on *st,
 * *template, *fname (all of the
 * pointers). ditto fd cleanup.
 *
 * some limited cleanup is
 * performed here, e.g. directory/file
 * cleanup on error in mkhtemp_try_create
 *
 * we only check if these are not NULL,
 * and the caller is expected to take
 * care; without too many conditions,
 * these functions are more flexible,
 * but some precauttions are taken:
 *
 * when used via the function new_tmpfile
 * or new_tmpdir, thtis is extremely strict,
 * much stricter than previous mktemp
 * variants. for example, it is much
 * stricter about stickiness on world
 * writeable directories, and it enforces
 * file ownership under hardened mode
 * (only lets you touch your own files/dirs)
 */
int
mkhtemp(int *fd,
    struct stat *st,
    char *template,
    int dirfd,
    const char *fname,
    struct stat *st_dir_initial,
    int type)
{
	size_t len = 0;
	size_t xc = 0;
	size_t fname_len = 0;

	char *fname_copy = NULL;
	char *p;

	size_t retries;

	int close_errno;
	int saved_errno = errno;

#if defined(PATH_LEN) && \
    (PATH_LEN) >= 256
	size_t max_len = PATH_LEN;
#else
	size_t max_len = 4096;
#endif
	int r;
	char *end;

	if (fd == NULL ||
	    template == NULL ||
	    fname == NULL ||
	    st_dir_initial == NULL) {

		errno = EFAULT;
		return -1;
	}

	/* we do not mess with an
	   open descriptor.
	 */
	if (*fd >= 0) {
		errno = EEXIST; /* leave their file alone */
		return -1;
	}

	if (dirfd < 0) {
		errno = EBADF;
		return -1;
	}

	if (slen(template, max_len, &len) < 0)
		return -1;

	if (len >= max_len) {
		errno = EMSGSIZE;
		return -1;
	}

	if (slen(fname, max_len, &fname_len) < 0)
		return -1;

	if (fname_len == 0) {
		errno = EINVAL;
		return -1;
	}

	if (strrchr(fname, '/') != NULL) {
		errno = EINVAL;
		return -1;
	}

	/* count trailing X */
	end = template + len;
	while (end > template && *--end == 'X')
		xc++;

	if (xc < 12 || xc > len) {
		errno = EINVAL;
		return -1;
	}

	if (fname_len > len) {
		errno = EOVERFLOW;
		return -1;
	}

	if (memcmp(fname,
	    template + len - fname_len,
	    fname_len) != 0) {
		errno = EINVAL;
		return -1;
	}

	fname_copy = malloc(fname_len + 1);
	if (fname_copy == NULL) {
		errno = ENOMEM;
		goto err;
	}

	/* fname_copy = suffix region only; p points to trailing XXXXXX */
	memcpy(fname_copy,
	    template + len - fname_len,
	    fname_len + 1);
	p = fname_copy + fname_len - xc;

	for (retries = 0; retries < MKHTEMP_RETRY_MAX; retries++) {

		r = mkhtemp_try_create(
		    dirfd,
		    st_dir_initial,
		    fname_copy,
		    p,
		    xc,
		    fd,
		    st,
		    type);

		if (r == 0) {
			if (retries >= MKHTEMP_SPIN_THRESHOLD) {
				/* usleep can return EINTR */
				close_errno = errno;
				usleep((useconds_t)rlong() & 0x3FF);
				errno = close_errno;
			}
			continue;
		}
		if (r < 0)
			goto err;

		/* success: copy final name back */
		memcpy(template + len - fname_len,
		    fname_copy, fname_len);

		errno = saved_errno;
		goto success;
	}

	errno = EEXIST;

err:
	if (*fd >= 0) {
		close_errno = errno;
		(void)close_on_eintr(*fd);
		errno = close_errno;
		*fd = -1;
	}

success:

	if (fname_copy != NULL)
		free(fname_copy);

	return (*fd >= 0) ? *fd : -1;
}

static int
mkhtemp_try_create(int dirfd,
    struct stat *st_dir_initial,
    char *fname_copy,
    char *p,
    size_t xc,
    int *fd,
    struct stat *st,
    int type)
{
	struct stat st_open;
	int saved_errno = errno;
	int close_errno;
	int rval = -1;

	int file_created = 0;
	int dir_created = 0;

	if (fd == NULL || st == NULL || p == NULL || fname_copy == NULL ||
	    st_dir_initial == NULL) {
		errno = EFAULT;
		goto err;
	} else if (*fd >= 0) { /* do not mess with someone else's file */
		errno = EEXIST;
		goto err;
	}

	if (mkhtemp_fill_random(p, xc) < 0)
		goto err;

	if (fd_verify_dir_identity(dirfd, st_dir_initial) < 0)
		goto err;

	if (type == MKHTEMP_FILE) {
		*fd = openat2p(dirfd, fname_copy,
		    O_RDWR | O_CREAT | O_EXCL |
		    O_NOFOLLOW | O_CLOEXEC | O_NOCTTY,
		    0600);

		/* O_CREAT and O_EXCL guarantees
		 * creation upon success
		 */
		if (*fd >= 0)
			file_created = 1;

	} else { /* dir: MKHTEMP_DIR */

		if (mkdirat_on_eintr(dirfd, fname_copy, 0700) < 0)
			goto err;

		/* ^ NOTE: opening the directory here
			will never set errno=EEXIST,
			since we're not creating it */

		dir_created = 1;

		/* do it again (mitigate directory race) */
		if (fd_verify_dir_identity(dirfd, st_dir_initial) < 0)
			goto err;

		*fd = openat2p(dirfd, fname_copy,
		    O_RDONLY | O_DIRECTORY | O_CLOEXEC, 0);
		if (*fd < 0)
			goto err;

		if (fstat(*fd, &st_open) < 0)
			goto err;

		if (!S_ISDIR(st_open.st_mode)) {
			errno = ENOTDIR;
			goto err;
		}

		/* NOTE: could check nlink count here,
		 *       but it's not very reliable here. skipped.
		 */

		if (fd_verify_dir_identity(dirfd, st_dir_initial) < 0)
			goto err;

	}

	/* NOTE: openat2p and mkdirat_on_eintr
	 * already handled EINTR/EAGAIN looping
	 */

	if (*fd < 0) {
		if (errno == EEXIST) {

			rval = 0;
			goto out;
		}
		goto err;
	}

	if (fstat(*fd, &st_open) < 0)
		goto err;

	if (type == MKHTEMP_FILE) {

		if (fd_verify_dir_identity(dirfd, st_dir_initial) < 0)
			goto err;

		if (secure_file(fd, st, &st_open,
		    O_APPEND, 1, 1, 0600) < 0) /* WARNING: only once */
			goto err;

	} else { /* dir: MKHTEMP_DIR */

		if (fd_verify_identity(*fd, &st_open, st_dir_initial) < 0)
			goto err;

		if (!S_ISDIR(st_open.st_mode)) {
			errno = ENOTDIR;
			goto err;
		}

		if (is_owner(&st_open) < 0)
			goto err;

		/* group/world writeable */
		if (st_open.st_mode & (S_IWGRP | S_IWOTH)) {
			errno = EPERM;
			goto err;
		}
	}

	errno = saved_errno;
	rval = 1;
	goto out;

err:
	close_errno = errno;

	if (fd != NULL && *fd >= 0) {
		(void) close_on_eintr(*fd);
		*fd = -1;
	}

	if (file_created)
		(void) unlinkat(dirfd, fname_copy, 0);

	if (dir_created)
		(void) unlinkat(dirfd, fname_copy, AT_REMOVEDIR);

	errno = close_errno;
	rval = -1;
out:
	return rval;
}

int
mkhtemp_fill_random(char *p, size_t xc)
{
	size_t chx = 0;
	int rand_failures = 0;

	size_t r;

	int saved_rand_error = 0;
	static char ch[] =
	    "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";

	/* clamp rand to prevent modulo bias
	 * (reduced risk of entropy leak)
	 */
	size_t limit = ((size_t)-1) - (((size_t)-1) % (sizeof(ch) - 1));

	int saved_errno = errno;

	if (p == NULL) {
		errno = EFAULT;
		goto err_mkhtemp_fill_random;
	}

	for (chx = 0; chx < xc; chx++) {

		do {
			saved_rand_error = errno;
			rand_failures = 0;
retry_rand:
			errno = 0;

			/* on bsd: uses arc4random
			   on linux: uses getrandom
			   on OLD linux: /dev/urandom
			   on old/other unix: /dev/urandom
			 */
			r = rlong();

			if (errno > 0) {
				if (++rand_failures <= 8)
					goto retry_rand;

				goto err_mkhtemp_fill_random;
			}

			rand_failures = 0;
			errno = saved_rand_error;

		} while (r >= limit);

		p[chx] = ch[r % (sizeof(ch) - 1)];
	}

	errno = saved_errno;
	return 0;

err_mkhtemp_fill_random:

	if (errno == saved_errno)
		errno = ECANCELED;

	return -1;
}

/* WARNING: **ONCE** per file.
 *
 *	!!! DO NOT RUN TWICE PER FILE. BEWARE OF THE DEMON !!!
 *	               watch out for spikes!
 */
int secure_file(int *fd,
    struct stat *st,
    struct stat *expected,
    int bad_flags,
    int check_seek,
    int do_lock,
    mode_t mode)
{
	int flags;
	struct stat st_now;
	int saved_errno = errno;
	/* you have been warned */
	if (fd == NULL) {
		errno = EFAULT;
		goto err_demons;
	}
	if (*fd < 0) {
		errno = EBADF;
		goto err_demons;
	}

	if (st == NULL) {
		errno = EFAULT;
		goto err_demons;
	}

	flags = fcntl(*fd, F_GETFL);

	if (flags == -1)
		goto err_demons;

	if (bad_flags > 0) {

		/* e.g. O_APPEND breaks pwrite/pread
		 * by allowing offsets to be ignored */
		if (flags & bad_flags) {
			errno = EPERM;
			goto err_demons;
		}
	}

	if (expected != NULL) {
		if (fd_verify_regular(*fd, expected, st) < 0)
			goto err_demons;
	} else {
		if (fstat(*fd, &st_now) == -1)
			goto err_demons;

		if (!S_ISREG(st_now.st_mode)) {
			errno = EBADF;
			goto err_demons;
		}

		*st = st_now;
	}

	if (check_seek) {

		/* check if it's seekable */
		if (lseek(*fd, 0, SEEK_CUR) == (off_t)-1)
			goto err_demons;
	}

	/* don't release the demon
	 */
	if (st->st_nlink != 1) { /***********/
		                 /* ( >:3 ) */
		errno = ELOOP;   /*  /| |\  */  /* don't let him out */
		goto err_demons; /*   / \   */
	                         /***********/
	}

	if (st->st_uid != geteuid() && /* someone else's file */
	    geteuid() != 0) { /* override for root */

		errno = EPERM;
		goto err_demons;
	}
	if (is_owner(st) < 0)
		goto err_demons;

	/* world-writeable or group-ownership.
	 * if these are set, then others could
	 * modify the file (not secure)
	 */
	if (st->st_mode & (S_IWGRP | S_IWOTH)) {
		errno = EPERM;
		goto err_demons;
	}

	if (do_lock) {
		if (lock_file(*fd, flags) == -1)
			goto err_demons;

		if (expected != NULL) {
			if (fd_verify_identity(*fd, expected, &st_now) < 0)
				goto err_demons;
		}
	}

	if (fchmod(*fd, mode) == -1)
		goto err_demons;

	errno = saved_errno;
	return 0;

err_demons:

	if (errno == saved_errno)
		errno = EIO;

	return -1;
}

int
fd_verify_regular(int fd,
    const struct stat *expected,
    struct stat *out)
{
	if (fd_verify_identity(fd, expected, out) < 0)
		return -1;

	if (!S_ISREG(out->st_mode)) {
		errno = EBADF;
		return -1;
	}

	return 0; /* regular file */
}

int
fd_verify_identity(int fd,
    const struct stat *expected,
    struct stat *out)
{
	struct stat st_now;
	int saved_errno = errno;

	if (fd < 0 || expected == NULL) {
		errno = EFAULT;
		return -1;
	}

	if (fstat(fd, &st_now) < 0)
		return -1;

	if (st_now.st_dev != expected->st_dev ||
	    st_now.st_ino != expected->st_ino) {
		errno = ESTALE;
		return -1;
	}

	if (out != NULL)
		*out = st_now;

	errno = saved_errno;
	return 0;
}

int
fd_verify_dir_identity(int fd,
    const struct stat *expected)
{
	struct stat st_now;
	int saved_errno = errno;

	if (fd < 0 || expected == NULL) {
		errno = EFAULT;
		return -1;
	}

	if (fstat(fd, &st_now) < 0)
		return -1;

	if (st_now.st_dev != expected->st_dev ||
	    st_now.st_ino != expected->st_ino) {
		errno = ESTALE;
		return -1;
	}

	if (!S_ISDIR(st_now.st_mode)) {
		errno = ENOTDIR;
		return -1;
	}

	errno = saved_errno;
	return 0;
}

int
is_owner(struct stat *st)
{
	if (st == NULL) {

		errno = EFAULT;
		return -1;
	}

#if ALLOW_ROOT_OVERRIDE
	if (st->st_uid != geteuid() && /* someone else's file */
	    geteuid() != 0) { /* override for root */
#else
	if (st->st_uid != geteuid()) { /* someone else's file */
#endif				       /* and no root override */
		errno = EPERM;
		return -1;
	}

	return 0;
}

int
lock_file(int fd, int flags)
{
	struct flock fl;
	int saved_errno = errno;

	if (fd < 0) {
		errno = EBADF;
		goto err_lock_file;
	}

	if (flags < 0) {
		errno = EINVAL;
		goto err_lock_file;
	}

	memset(&fl, 0, sizeof(fl));

	if ((flags & O_ACCMODE) == O_RDONLY)
		fl.l_type = F_RDLCK;
	else
		fl.l_type = F_WRLCK;

	fl.l_whence = SEEK_SET;

	if (fcntl(fd, F_SETLK, &fl) == -1)
		goto err_lock_file;

	saved_errno = errno;
	return 0;

err_lock_file:

	if (errno == saved_errno)
		errno = EIO;

	return -1;
}

/*
 * Safe I/O functions wrapping around
 * read(), write() and providing a portable
 * analog of both pread() and pwrite().
 * These functions are designed for maximum
 * robustness, checking NULL inputs, overflowed
 * outputs, and all kinds of errors that the
 * standard libc functions don't.
 *
 * Looping on EINTR and EAGAIN is supported.
 * EINTR/EAGAIN looping is done indefinitely.
 */

/* rw_file_exact() - Read perfectly or die
 *
 * Read/write, and absolutely insist on an
 * absolute read; e.g. if 100 bytes are
 * requested, this MUST return 100.
 *
 * This function will never return zero.
 * It will only return below (error),
 * or above (success). On error, -1 is
 * returned and errno is set accordingly.
 *
 * Zero-byte returns are not allowed.
 * It will re-spin a finite number of
 * times upon zero-return, to recover,
 * otherwise it will return an error.
 */

ssize_t
rw_file_exact(int fd, unsigned char *mem, size_t nrw,
    off_t off, int rw_type, int loop_eagain,
    int loop_eintr, size_t max_retries,
    int off_reset)
{
	ssize_t rval;
	ssize_t rc;

	size_t nrw_cur;

	off_t off_cur;
	void *mem_cur;

	size_t retries_on_zero;

	int saved_errno = errno;

	rval = 0;

	rc = 0;
	retries_on_zero = 0;

	if (io_args(fd, mem, nrw, off, rw_type) == -1)
		goto err_rw_file_exact;

	while (1) {
	
		/* Prevent theoretical overflow */
		if (rval >= 0 && (size_t)rval > (nrw - rc)) {
			errno = EOVERFLOW;
			goto err_rw_file_exact;
		}

		rc += rval;
		if ((size_t)rc >= nrw)
			break;

		mem_cur = (void *)(mem + (size_t)rc);
		nrw_cur = (size_t)(nrw - (size_t)rc);

		if (off < 0) {
			errno = EOVERFLOW;
			goto err_rw_file_exact;
		}

		off_cur = off + (off_t)rc;

		rval = prw(fd, mem_cur, nrw_cur, off_cur,
		    rw_type, loop_eagain, loop_eintr,
		    off_reset);

		if (rval < 0)
			goto err_rw_file_exact;

		if (rval == 0) {
			if (retries_on_zero++ < max_retries)
				continue;

			errno = EIO;
			goto err_rw_file_exact;
		}

		retries_on_zero = 0;
	}

	if ((size_t)rc != nrw) {

		errno = EIO;
		goto err_rw_file_exact;
	}

	rval = rw_over_nrw(rc, nrw);
	if (rval < 0)
		goto err_rw_file_exact;

	errno = saved_errno;

	return rval;

err_rw_file_exact:

	if (errno == saved_errno)
		errno = EIO;

	return -1;
}

/* prw() - portable read-write with more
 * safety checks than barebones libc
 *
 * portable pwrite/pread on request, or real
 * pwrite/pread libc functions can be used.
 * the portable (non-libc) pread/pwrite is not
 * thread-safe, because it does not prevent or
 * mitigate race conditions on file descriptors
 *
 * If you need real pwrite/pread, just compile
 * with flag: REAL_POS_IO=1
 *
 * A fallback is provided for regular read/write.
 * rw_type can be IO_READ (read), IO_WRITE (write),
 * IO_PREAD (pread) or IO_PWRITE
 *
 * loop_eagain does a retry loop on EAGAIN if set
 * loop_eintr does a retry loop on EINTR if set
 *
 * race conditions on non-libc pread/pwrite:
 * if a file offset changes, abort, to mitage.
 *
 * off_reset 1: reset the file offset *once* if
 *              a change was detected, assuming
 *              nothing else is touching it now
 * off_reset 0: never reset if changed
 */

ssize_t
prw(int fd, void *mem, size_t nrw,
    off_t off, int rw_type,
    int loop_eagain, int loop_eintr,
    int off_reset)
{
	ssize_t rval;
	ssize_t r;
	int positional_rw;
	struct stat st;
#if !defined(REAL_POS_IO) || \
    REAL_POS_IO < 1
	off_t verified;
	off_t off_orig;
	off_t off_last;
#endif
	int saved_errno = errno;

	if (io_args(fd, mem, nrw, off, rw_type)
	    == -1)
		goto err_prw;

	r = -1;

	/* do not use loop_eagain on
	 * normal files
	 */

	if (!loop_eagain) {
		/* check whether the file
		 * changed
		 */

		if (check_file(fd, &st) == -1)
			goto err_prw;
	}

	if (rw_type >= IO_PREAD)
		positional_rw = 1; /* pread/pwrite */
	else
		positional_rw = 0; /* read/write */

try_rw_again:

	if (!positional_rw) {
#if defined(REAL_POS_IO) && \
    REAL_POS_IO > 0
real_pread_pwrite:
#endif
		if (rw_type == IO_WRITE)
			r = write(fd, mem, nrw);
		else if (rw_type == IO_READ)
			r = read(fd, mem, nrw);
#if defined(REAL_POS_IO) && \
    REAL_POS_IO > 0
		else if (rw_type == IO_PWRITE)
			r = pwrite(fd, mem, nrw, off);
		else if (rw_type == IO_PREAD)
			r = pread(fd, mem, nrw, off);
#endif

		if (r == -1 && (errno == try_err(loop_eintr, EINTR)
		    || errno == try_err(loop_eagain, EAGAIN)))
			goto try_rw_again;

		rval = rw_over_nrw(r, nrw);
		if (rval < 0)
			goto err_prw;

		errno = saved_errno;

		return rval;
	}

#if defined(REAL_POS_IO) && \
    REAL_POS_IO > 0
	goto real_pread_pwrite;
#else
	if ((off_orig = lseek_on_eintr(fd, (off_t)0, SEEK_CUR,
	    loop_eagain, loop_eintr)) == (off_t)-1) {
		r = -1;
	} else if (lseek_on_eintr(fd, off, SEEK_SET,
	    loop_eagain, loop_eintr) == (off_t)-1) {
		r = -1;
	} else {
		verified = lseek_on_eintr(fd, (off_t)0, SEEK_CUR,
		    loop_eagain, loop_eintr);

		/* abort if the offset changed,
		 * indicating race condition. if
		 * off_reset enabled, reset *ONCE*
		 */

		if (off_reset && off != verified)
			lseek_on_eintr(fd, off, SEEK_SET,
			    loop_eagain, loop_eintr);

		do {
			/* check offset again, repeatedly.
			 * even if off_reset is set, this
			 * aborts if offsets change again
			 */

			verified = lseek_on_eintr(fd, (off_t)0, SEEK_CUR,
			    loop_eagain, loop_eintr);

			if (off != verified) {

				errno = EBUSY;
				goto err_prw;
			}

			if (rw_type == IO_PREAD)
				r = read(fd, mem, nrw);
			else if (rw_type == IO_PWRITE)
				r = write(fd, mem, nrw);

			if (rw_over_nrw(r, nrw) == -1)
				break;

		} while (r == -1 &&
		    (errno == try_err(loop_eintr, EINTR) ||
		     errno == try_err(loop_eagain, EAGAIN)));
	}

	saved_errno = errno;

	off_last = lseek_on_eintr(fd, off_orig, SEEK_SET,
	    loop_eagain, loop_eintr);

	if (off_last != off_orig) {
		errno = saved_errno;
		goto err_prw;
	}

	errno = saved_errno;

	rval = rw_over_nrw(r, nrw);
	if (rval < 0)
		goto err_prw;

	errno = saved_errno;

	return rval;

#endif

err_prw:

	if (errno == saved_errno)
		errno = EIO;

	return -1;
}

int
io_args(int fd, void *mem, size_t nrw,
    off_t off, int rw_type)
{
	int saved_errno = errno;

	/* obviously */
	if (mem == NULL) {

		errno = EFAULT;
		goto err_io_args;
	}

	/* uninitialised fd */
	if (fd < 0) {

		errno = EBADF;
		goto err_io_args;
	}

	/* negative offset */
	if (off < 0) {

		errno = ERANGE;
		goto err_io_args;
	}

	/* prevent zero-byte rw */
	if (!nrw)
		goto err_io_args;

	/* prevent overflow */
	if (nrw > (size_t)SSIZE_MAX) {

		errno = ERANGE;
		goto err_io_args;
	}

	/* prevent overflow */
	if (((size_t)off + nrw) < (size_t)off) {

		errno = ERANGE;
		goto err_io_args;
	}

	if (rw_type > IO_PWRITE) {

		errno = EINVAL;
		goto err_io_args;
	}

	errno = saved_errno;

	return 0;

err_io_args:

	if (errno == saved_errno)
		errno = EINVAL;

	return -1;
}

int
check_file(int fd, struct stat *st)
{
	int saved_errno = errno;

	if (fd < 0) {
		errno = EBADF;
		goto err_is_file;
	}

	if (st == NULL) {
		errno = EFAULT;
		goto err_is_file;
	}

	if (fstat(fd, st) == -1)	
		goto err_is_file;

	if (!S_ISREG(st->st_mode)) {

		errno = EBADF;
		goto err_is_file;
	}

	errno = saved_errno;

	return 0;

err_is_file:

	if (errno == saved_errno)
		errno = EINVAL;

	return -1;
}

/* POSIX can say whatever it wants.
 * specification != implementation
 */

ssize_t
rw_over_nrw(ssize_t r, size_t nrw)
{
	int saved_errno = errno;

	/* not a libc bug, but we
	 * don't like the number zero
	 */
	if (!nrw)
		goto err_rw_over_nrw;

	if (r == -1)
		return r;

	if ((size_t)
	    r > SSIZE_MAX) {

		/* Theoretical buggy libc
		 * check. Extremely academic.
		 *
		 * Specifications never
		 * allow this return value
		 * to exceed SSIZE_T, but
		 * spec != implementation
		 *
		 * Check this after using
		 * [p]read() or [p]write()
		 *
		 * NOTE: here, we assume
		 * ssize_t integers are the
		 * same size as SSIZE_T
		 */

		errno = ERANGE;
		goto err_rw_over_nrw;
	}

	/* Theoretical buggy libc:
	 * Should never return a number of
	 * bytes above the requested length.
	 */
	if ((size_t)r > nrw) {

		errno = ERANGE;
		goto err_rw_over_nrw;
	}

	errno = saved_errno;

	return r;

err_rw_over_nrw:

	if (errno == saved_errno)
		errno = EIO;

	return -1;
}

#if !defined(REAL_POS_IO) || \
    REAL_POS_IO < 1
off_t
lseek_on_eintr(int fd, off_t off, int whence,
    int loop_eagain, int loop_eintr)
{
	off_t old;

	old = -1;

	do {
		old = lseek(fd, off, whence);
	} while (old == (off_t)-1 && (
	    errno == try_err(loop_eintr, EINTR) ||
	    errno == try_err(loop_eintr, ETXTBSY) ||
	    errno == try_err(loop_eagain, EAGAIN) ||
	    errno == try_err(loop_eagain, EWOULDBLOCK)));

	return old;
}
#endif

int
try_err(int loop_err, int errval)
{
	if (loop_err)
		return errval;

	return -1;
}

int
close_on_eintr(int fd)
{
	int r;
	int saved_errno = errno;

	do {
		r = close(fd);
	} while (r == -1 && (
	    errno == EINTR || errno == EAGAIN ||
	    errno == EWOULDBLOCK || errno == ETXTBSY));

	if (r >= 0)
		errno = saved_errno;

	return r;
}

int
fsync_on_eintr(int fd)
{
	int r;
	int saved_errno = errno;

	do {
		r = fsync(fd);
	} while (r == -1 && (errno == EINTR || errno == EAGAIN ||
	    errno == ETXTBSY || errno == EWOULDBLOCK));

	if (r >= 0)
		errno = saved_errno;

	return r;
}

int
fs_rename_at(int olddirfd, const char *old,
    int newdirfd, const char *new)
{
	if (new == NULL || old == NULL) {

		errno = EFAULT;
		return -1;
	}

	if (olddirfd < 0 || newdirfd < 0) {

		errno = EBADF;
		return -1;
	}

	return renameat(olddirfd, old, newdirfd, new);
}

/* secure open, based on
 * relative path to root
 *
 * always a fixed fd for /
 * see: rootfs()
 */
int
fs_open(const char *path, int flags)
{
	struct filesystem *fs;
	const char *rel;

	if (path == NULL) {
		errno = EFAULT;
		return -1;
	}

	if (path[0] != '/') {
		errno = EINVAL;
		return -1;
	}

	fs = rootfs();
	if (fs == NULL)
		return -1;

	rel = path + 1;

	return fs_resolve_at(fs->rootfd, rel, flags);
}

/* singleton function
 * that returns a fixed
 * descriptor of /
 *
 * used throughout, for
 * repeated integrity checks
 */
struct filesystem *
rootfs(void)
{
	static struct filesystem global_fs;
	static int fs_initialised = 0;

	if (!fs_initialised) {

		global_fs.rootfd =
		    open("/", O_RDONLY | O_DIRECTORY | O_CLOEXEC);

		if (global_fs.rootfd < 0)
			return NULL;

		fs_initialised = 1;
	}

	return &global_fs;
}

/* filesystem sandboxing.
 * (in userspace)
 */
int
fs_resolve_at(int dirfd, const char *path, int flags)
{
	int nextfd = -1;
	int curfd;
	const char *p;
	char name[256];
	int saved_errno = errno;
	int r;
	int is_last;

	if (dirfd < 0 || path == NULL || *path == '\0') {
		errno = EINVAL;
		return -1;
	}

	p = path;
	curfd = dirfd; /* start here */

	for (;;) {
		r = fs_next_component(&p, name, sizeof(name));
		if (r < 0)
			goto err;
		if (r == 0)
			break;

		is_last = (*p == '\0');

		nextfd = fs_open_component(curfd, name, flags, is_last);
		if (nextfd < 0)
			goto err;

		/* close previous fd IF it is not the original input */
		if (curfd != dirfd) {
			(void) close_on_eintr(curfd);
		}

		curfd = nextfd;
		nextfd = -1;
	}

	errno = saved_errno;
	return curfd;

err:
	saved_errno = errno;

	if (nextfd >= 0)
		(void) close_on_eintr(nextfd);

	/* close curfd only if it's not the original */
	if (curfd != dirfd && curfd >= 0)
		(void) close_on_eintr(curfd);

	errno = saved_errno;
	return -1;
}

int
fs_next_component(const char **p,
    char *name, size_t namesz)
{
	const char *s = *p;
	size_t len = 0;
#if defined(PATH_LEN) && \
(PATH_LEN) >= 256
	size_t maxlen = PATH_LEN;
#else
	size_t maxlen = 4096;
#endif

	while (*s == '/')
		s++;

	if (*s == '\0') {
		*p = s;
		return 0;
	}

	while (s[len] != '/' && s[len] != '\0')
		len++;

	if (len == 0 || len >= namesz ||
	    len >= maxlen) {
		errno = ENAMETOOLONG;
		return -1;
	}

	memcpy(name, s, len);
	name[len] = '\0';

	/* reject . and .. */
	if ((name[0] == '.' && name[1] == '\0') ||
	    (name[0] == '.' && name[1] == '.' && name[2] == '\0')) {
		errno = EPERM;
		return -1;
	}

	*p = s + len;
	return 1;
}

int
fs_open_component(int dirfd, const char *name,
    int flags, int is_last)
{
	int fd;
	struct stat st;

	fd = openat2p(dirfd, name,
	    (is_last ? flags : (O_RDONLY | O_DIRECTORY)) |
	    O_NOFOLLOW | O_CLOEXEC, (flags & O_CREAT) ? 0600 : 0);

	/* the patient always lies
	 */
	if (!is_last) {

		if (fd < 0) {
			errno = EBADF;
			return -1;
		}

		if (fstat(fd, &st) < 0)
			return -1;

		if (!S_ISDIR(st.st_mode)) {

			(void) close_on_eintr(fd);
			errno = ENOTDIR;
			return -1;
		}
	}

	return fd;
}

int
fs_dirname_basename(const char *path,
    char **dir, char **base,
    int allow_relative)
{
	char *buf;
	char *slash;
	size_t len;
	int rval;
#if defined(PATH_LEN) && \
(PATH_LEN) >= 256
	size_t maxlen = PATH_LEN;
#else
	size_t maxlen = 4096;
#endif

	if (path == NULL || dir == NULL || base == NULL)
		return -1;

	if (slen(path, maxlen, &len) < 0)
		return -1;

	buf = malloc(len + 1);
	if (buf == NULL)
		return -1;

	memcpy(buf, path, len + 1);

	/* strip trailing slashes */
	while (len > 1 && buf[len - 1] == '/')
		buf[--len] = '\0';

	slash = strrchr(buf, '/');

	if (slash) {

		*slash = '\0';
		*dir = buf;
		*base = slash + 1;

		if (**dir == '\0') {
			(*dir)[0] = '/';
			(*dir)[1] = '\0';
		}
	} else if (allow_relative) {

		*dir = strdup(".");
		*base = buf;
	} else {
		errno = EINVAL;
		free(buf);
		return -1;
	}

	return 0;
}

/* portable wrapper for use of openat2 on linux,
 * with fallback for others e.g. openbsd
 *
 * BONUS: arg checks
 * TODO: consider EINTR/EAGAIN retry loop
 */
int
openat2p(int dirfd, const char *path,
    int flags, mode_t mode)
{
#ifdef __linux__
	struct open_how how = {
		.flags = flags,
		.mode = mode,
		.resolve =
		    RESOLVE_BENEATH |
		    RESOLVE_NO_SYMLINKS |
		    RESOLVE_NO_MAGICLINKS
	};
	int saved_errno = errno;
	int rval;
#endif

	if (dirfd < 0) {
		errno = EBADF;
		return -1;
	}

	if (path == NULL) {
		errno = EFAULT;
		return -1;
	}

retry:
	errno = 0;

#ifdef __linux__
	/* more secure than regular openat,
	 * but linux-only at the time of writing
	 */
	rval = syscall(SYS_openat2, dirfd, path, &how, sizeof(how));
#else
	/* less secure, but e.g. openbsd
	 * doesn't have openat2 yet
	 */
	rval = openat(dirfd, path, flags, mode);
#endif
	if (rval == -1 && (
	    errno == EINTR ||
	    errno == EAGAIN ||
	    errno == EWOULDBLOCK ||
	    errno == ETXTBSY))
		goto retry;

	if (rval >= 0)
		errno = saved_errno;

	return rval;
}

int
mkdirat_on_eintr( /* <-- say that 10 times to please the demon */
    int dirfd, 
    const char *path, mode_t mode)
{
	int saved_errno = errno;
	int rval;

	if (dirfd < 0) {
		errno = EBADF;
		return -1;
	}

	if (path == NULL) {
		errno = EFAULT;
		return -1;
	}

retry:
	errno = 0;
	rval = mkdirat(dirfd, path, mode);

	if (rval == -1 && (
	    errno == EINTR ||
	    errno == EAGAIN ||
	    errno == EWOULDBLOCK ||
	    errno == ETXTBSY))
		goto retry;

	if (rval >= 0)
		errno = saved_errno;

	return rval;
}