#!/usr/bin/env python # Copyright (c) 2011 The Chromium Authors. All rights reserved. # Use of this source code is governed by a BSD-style license that can be # found in the LICENSE file. """Makes sure files have the right permissions. Some developers have broken SCM configurations that flip the svn:executable permission on for no good reason. Unix developers who run ls --color will then see .cc files in green and get confused. To ignore a particular file, add it to WHITELIST_FILES. To ignore a particular extension, add it to WHITELIST_EXTENSIONS. To ignore whatever regexps your heart desires, add it WHITELIST_REGEX. Note that all directory separators must be slashes (Unix-style) and not backslashes. All directories should be relative to the source root and all file paths should be only lowercase. """ import optparse import os import pipes import re import stat import sys #### USER EDITABLE SECTION STARTS HERE #### # Files with these extensions are allowed to have executable permissions. WHITELIST_EXTENSIONS = [ 'bash', 'bat', 'dylib', 'pl', 'py', 'rb', 'sh', 'sed', ] # Files that end the following paths are whitelisted too. WHITELIST_FILES = [ '/build/gyp_chromium', '/build/linux/dump_app_syms', '/build/linux/pkg-config-wrapper', '/build/mac/strip_from_xcode', '/build/mac/strip_save_dsym', '/chrome/installer/mac/pkg-dmg', '/chrome/tools/build/linux/chrome-wrapper', '/chrome/tools/build/mac/build_app_dmg', '/chrome/tools/build/mac/clean_up_old_versions', '/chrome/tools/build/mac/copy_framework_unversioned', '/chrome/tools/build/mac/dump_product_syms', '/chrome/tools/build/mac/generate_localizer', '/chrome/tools/build/mac/make_sign_sh', '/chrome/tools/build/mac/tweak_info_plist', '/chrome/tools/build/mac/verify_order', '/o3d/build/gyp_o3d', '/o3d/gypbuild', '/o3d/installer/linux/debian.in/rules', '/third_party/icu/source/runconfigureicu', '/third_party/lcov/bin/gendesc', '/third_party/lcov/bin/genhtml', '/third_party/lcov/bin/geninfo', '/third_party/lcov/bin/genpng', '/third_party/lcov/bin/lcov', '/third_party/lcov/bin/mcov', '/third_party/lcov-1.9/bin/gendesc', '/third_party/lcov-1.9/bin/genhtml', '/third_party/lcov-1.9/bin/geninfo', '/third_party/lcov-1.9/bin/genpng', '/third_party/lcov-1.9/bin/lcov', '/third_party/libxml/linux/xml2-config', '/third_party/lzma_sdk/executable/7za.exe', '/third_party/swig/linux/swig', '/third_party/tcmalloc/chromium/src/pprof', '/tools/git/post-checkout', '/tools/git/post-merge', '/tools/ld_bfd/ld', ] # File names that are always whitelisted. (These are all autoconf spew.) WHITELIST_FILENAMES = set(( 'config.guess', 'config.sub', 'configure', 'depcomp', 'install-sh', 'missing', 'mkinstalldirs' )) # File paths that contain these regexps will be whitelisted as well. WHITELIST_REGEX = [ re.compile('/third_party/openssl/'), re.compile('/third_party/sqlite/'), re.compile('/third_party/xdg-utils/'), re.compile('/third_party/yasm/source/patched-yasm/config'), re.compile('/third_party/ffmpeg/patched-ffmpeg/tools'), ] #### USER EDITABLE SECTION ENDS HERE #### WHITELIST_EXTENSIONS_REGEX = re.compile(r'\.(%s)' % '|'.join(WHITELIST_EXTENSIONS)) WHITELIST_FILES_REGEX = re.compile(r'(%s)$' % '|'.join(WHITELIST_FILES)) # Set to true for more output. This is set by the command line options. VERBOSE = False # Using forward slashes as directory separators, ending in a forward slash. # Set by the command line options. BASE_DIRECTORY = '' # The default if BASE_DIRECTORY is not set on the command line. DEFAULT_BASE_DIRECTORY = '../../..' # The directories which contain the sources managed by git. GIT_SOURCE_DIRECTORY = set() # The SVN repository url. SVN_REPO_URL = '' # Whether we are using SVN or GIT. IS_SVN = True # Executable permission mask EXECUTABLE_PERMISSION = stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH def IsWhiteListed(file_path): """Returns True if file_path is in our whitelist of files to ignore.""" if WHITELIST_EXTENSIONS_REGEX.match(os.path.splitext(file_path)[1]): return True if WHITELIST_FILES_REGEX.search(file_path): return True if os.path.basename(file_path) in WHITELIST_FILENAMES: return True for regex in WHITELIST_REGEX: if regex.search(file_path): return True return False def CheckFile(file_path): """Checks file_path's permissions. Args: file_path: The file path to check. Returns: Either a string describing the error if there was one, or None if the file checked out OK. """ if VERBOSE: print 'Checking file: ' + file_path file_path_lower = file_path.lower() if IsWhiteListed(file_path_lower): return None # Not whitelisted, stat the file and check permissions. try: st_mode = os.stat(file_path).st_mode except IOError, e: return 'Failed to stat file: %s' % e except OSError, e: return 'Failed to stat file: %s' % e if EXECUTABLE_PERMISSION & st_mode: error = 'Contains executable permission' if VERBOSE: return '%s: %06o' % (error, st_mode) return error return None def ShouldCheckDirectory(dir_path): """Determine if we should check the content of dir_path.""" if not IS_SVN: return dir_path in GIT_SOURCE_DIRECTORY repo_url = GetSvnRepositoryRoot(dir_path) if not repo_url: return False return repo_url == SVN_REPO_URL def CheckDirectory(dir_path): """Check the files in dir_path; recursively check its subdirectories.""" # Collect a list of all files and directories to check. files_to_check = [] dirs_to_check = [] success = True contents = os.listdir(dir_path) for cur in contents: full_path = os.path.join(dir_path, cur) if os.path.isdir(full_path) and ShouldCheckDirectory(full_path): dirs_to_check.append(full_path) elif os.path.isfile(full_path): files_to_check.append(full_path) # First check all files in this directory. for cur_file in files_to_check: file_status = CheckFile(cur_file) if file_status is not None: print 'ERROR in %s\n%s' % (cur_file, file_status) success = False # Next recurse into the subdirectories. for cur_dir in dirs_to_check: if not CheckDirectory(cur_dir): success = False return success def GetGitSourceDirectory(root): """Returns a set of the directories to be checked. Args: root: The repository root where a .git directory must exist. Returns: A set of directories which contain sources managed by git. """ git_source_directory = set() popen_out = os.popen('cd %s && git ls-files --full-name .' % pipes.quote(root)) for line in popen_out: dir_path = os.path.join(root, os.path.dirname(line)) git_source_directory.add(dir_path) git_source_directory.add(root) return git_source_directory def GetSvnRepositoryRoot(dir_path): """Returns the repository root for a directory. Args: dir_path: A directory where a .svn subdirectory should exist. Returns: The svn repository that contains dir_path or None. """ svn_dir = os.path.join(dir_path, '.svn') if not os.path.isdir(svn_dir): return None popen_out = os.popen('cd %s && svn info' % pipes.quote(dir_path)) for line in popen_out: if line.startswith('Repository Root: '): return line[len('Repository Root: '):].rstrip() return None def main(argv): usage = """Usage: python %prog [--root ] [tocheck] tocheck Specifies the directory, relative to root, to check. This defaults to "." so it checks everything. Examples: python checkperms.py python checkperms.py --root /path/to/source chrome""" option_parser = optparse.OptionParser(usage=usage) option_parser.add_option('--root', dest='base_directory', default=DEFAULT_BASE_DIRECTORY, help='Specifies the repository root. This defaults ' 'to %default relative to the script file, which ' 'will normally be the repository root.') option_parser.add_option('-v', '--verbose', action='store_true', help='Print debug logging') options, args = option_parser.parse_args() global VERBOSE if options.verbose: VERBOSE = True # Optional base directory of the repository. global BASE_DIRECTORY if (not options.base_directory or options.base_directory == DEFAULT_BASE_DIRECTORY): BASE_DIRECTORY = os.path.abspath( os.path.join(os.path.abspath(argv[0]), DEFAULT_BASE_DIRECTORY)) else: BASE_DIRECTORY = os.path.abspath(argv[2]) # Figure out which directory we have to check. if not args: # No directory to check specified, use the repository root. start_dir = BASE_DIRECTORY elif len(args) == 1: # Directory specified. Start here. It's supposed to be relative to the # base directory. start_dir = os.path.abspath(os.path.join(BASE_DIRECTORY, args[0])) else: # More than one argument, we don't handle this. option_parser.print_help() return 1 print 'Using base directory:', BASE_DIRECTORY print 'Checking directory:', start_dir BASE_DIRECTORY = BASE_DIRECTORY.replace('\\', '/') start_dir = start_dir.replace('\\', '/') success = True if os.path.exists(os.path.join(BASE_DIRECTORY, '.svn')): global SVN_REPO_URL SVN_REPO_URL = GetSvnRepositoryRoot(BASE_DIRECTORY) if not SVN_REPO_URL: print 'Cannot determine the SVN repo URL' success = False elif os.path.exists(os.path.join(BASE_DIRECTORY, '.git')): global IS_SVN IS_SVN = False global GIT_SOURCE_DIRECTORY GIT_SOURCE_DIRECTORY = GetGitSourceDirectory(BASE_DIRECTORY) if not GIT_SOURCE_DIRECTORY: print 'Cannot determine the list of GIT directories' success = False else: print 'Cannot determine the SCM used in %s' % BASE_DIRECTORY success = False if success: success = CheckDirectory(start_dir) if not success: print '\nFAILED\n' return 1 print '\nSUCCESS\n' return 0 if '__main__' == __name__: sys.exit(main(sys.argv))