github.com/nullne/docker@v1.13.0-rc1/pkg/system/filesys_windows.go (about) 1 // +build windows 2 3 package system 4 5 import ( 6 "os" 7 "path/filepath" 8 "regexp" 9 "strings" 10 "syscall" 11 "unsafe" 12 13 winio "github.com/Microsoft/go-winio" 14 ) 15 16 // MkdirAllWithACL is a wrapper for MkdirAll that creates a directory 17 // ACL'd for Builtin Administrators and Local System. 18 func MkdirAllWithACL(path string, perm os.FileMode) error { 19 return mkdirall(path, true) 20 } 21 22 // MkdirAll implementation that is volume path aware for Windows. 23 func MkdirAll(path string, _ os.FileMode) error { 24 return mkdirall(path, false) 25 } 26 27 // mkdirall is a custom version of os.MkdirAll modified for use on Windows 28 // so that it is both volume path aware, and can create a directory with 29 // a DACL. 30 func mkdirall(path string, adminAndLocalSystem bool) error { 31 if re := regexp.MustCompile(`^\\\\\?\\Volume{[a-z0-9-]+}$`); re.MatchString(path) { 32 return nil 33 } 34 35 // The rest of this method is largely copied from os.MkdirAll and should be kept 36 // as-is to ensure compatibility. 37 38 // Fast path: if we can tell whether path is a directory or file, stop with success or error. 39 dir, err := os.Stat(path) 40 if err == nil { 41 if dir.IsDir() { 42 return nil 43 } 44 return &os.PathError{ 45 Op: "mkdir", 46 Path: path, 47 Err: syscall.ENOTDIR, 48 } 49 } 50 51 // Slow path: make sure parent exists and then call Mkdir for path. 52 i := len(path) 53 for i > 0 && os.IsPathSeparator(path[i-1]) { // Skip trailing path separator. 54 i-- 55 } 56 57 j := i 58 for j > 0 && !os.IsPathSeparator(path[j-1]) { // Scan backward over element. 59 j-- 60 } 61 62 if j > 1 { 63 // Create parent 64 err = mkdirall(path[0:j-1], false) 65 if err != nil { 66 return err 67 } 68 } 69 70 // Parent now exists; invoke os.Mkdir or mkdirWithACL and use its result. 71 if adminAndLocalSystem { 72 err = mkdirWithACL(path) 73 } else { 74 err = os.Mkdir(path, 0) 75 } 76 77 if err != nil { 78 // Handle arguments like "foo/." by 79 // double-checking that directory doesn't exist. 80 dir, err1 := os.Lstat(path) 81 if err1 == nil && dir.IsDir() { 82 return nil 83 } 84 return err 85 } 86 return nil 87 } 88 89 // mkdirWithACL creates a new directory. If there is an error, it will be of 90 // type *PathError. . 91 // 92 // This is a modified and combined version of os.Mkdir and syscall.Mkdir 93 // in golang to cater for creating a directory am ACL permitting full 94 // access, with inheritance, to any subfolder/file for Built-in Administrators 95 // and Local System. 96 func mkdirWithACL(name string) error { 97 sa := syscall.SecurityAttributes{Length: 0} 98 sddl := "D:P(A;OICI;GA;;;BA)(A;OICI;GA;;;SY)" 99 sd, err := winio.SddlToSecurityDescriptor(sddl) 100 if err != nil { 101 return &os.PathError{"mkdir", name, err} 102 } 103 sa.Length = uint32(unsafe.Sizeof(sa)) 104 sa.InheritHandle = 1 105 sa.SecurityDescriptor = uintptr(unsafe.Pointer(&sd[0])) 106 107 namep, err := syscall.UTF16PtrFromString(name) 108 if err != nil { 109 return &os.PathError{"mkdir", name, err} 110 } 111 112 e := syscall.CreateDirectory(namep, &sa) 113 if e != nil { 114 return &os.PathError{"mkdir", name, e} 115 } 116 return nil 117 } 118 119 // IsAbs is a platform-specific wrapper for filepath.IsAbs. On Windows, 120 // golang filepath.IsAbs does not consider a path \windows\system32 as absolute 121 // as it doesn't start with a drive-letter/colon combination. However, in 122 // docker we need to verify things such as WORKDIR /windows/system32 in 123 // a Dockerfile (which gets translated to \windows\system32 when being processed 124 // by the daemon. This SHOULD be treated as absolute from a docker processing 125 // perspective. 126 func IsAbs(path string) bool { 127 if !filepath.IsAbs(path) { 128 if !strings.HasPrefix(path, string(os.PathSeparator)) { 129 return false 130 } 131 } 132 return true 133 }