Add access attributes to buffer formatters

Several local helpers write into caller-supplied buffers but did not declare the relationship between the pointer argument and the size argument. That made it harder for GCC to diagnose undersized buffers at compile time and for fortified builds to catch misuse around functions such as format_fs_error_time.

Add __attr_access write-only annotations to the filesystem error time formatter and similar local helpers that format status, timing, deferred-age, and CLI signal error text. Also reject buffers smaller than the requested minimum in format_fs_error_time before it writes fallback text.

Author: stevegrubb

src/cli/fapolicyd-cli.c

@@ -51,6 +51,7 @@
 #include "fapolicyd-backend.h"
 #include "string-util.h"
 #include "daemon-config.h"
+#include "gcc-attributes.h"
 #include "message.h"
 #include "llist.h"
 #include "avl.h"
@@ -65,6 +66,15 @@ bool verbose = false;
 static bool lint_rules = false;
 static bool assume_yes = false;
 
+static int send_state_report_signal(unsigned int pid, report_intent_t intent,
+		char *reason, size_t reason_len)
+	__attr_access ((__write_only__, 3, 4));
+static int send_timing_signal(unsigned int pid, report_intent_t intent,
+		char *reason, size_t reason_len)
+	__attr_access ((__write_only__, 3, 4));
+static int get_daemon_pid(unsigned int *pid, char *reason, size_t reason_len)
+	__attr_access ((__write_only__, 2, 3));
+
 static const char *usage =
 "Fapolicyd CLI Tool\n\n"
 "--check-config        Check the daemon config for syntax errors\n"

src/daemon/decision-defer.c

@@ -50,6 +50,7 @@
 #include <string.h>
 #include <time.h>
 #include "decision-defer.h"
+#include "gcc-attributes.h"
 
 struct decision_defer_entry {
 	/* Event envelope and permission fd owned while this entry is used. */
@@ -62,6 +63,9 @@ struct decision_defer_entry {
 	int used;
 };
 
+static void format_age(uint64_t age_ns, char *buf, size_t buf_size)
+	__attr_access ((__write_only__, 2, 3));
+
 /*
  * defer_now_ns - read monotonic time for defer age reporting.
  * Returns monotonic nanoseconds, or zero if the clock cannot be read.

src/daemon/fanotify-fs-error.c

@@ -55,6 +55,7 @@
 #include "escape.h"
 #include "failure-action.h"
 #include "fanotify-fs-error.h"
+#include "gcc-attributes.h"
 #include "message.h"
 #include "notify.h"
 
@@ -107,7 +108,8 @@ static const char *fs_error_status(
 		const struct fanotify_fs_error_details *details);
 static const char *fs_error_code_text(int error);
 static const char *format_fs_error_time(time_t when, char *buf,
-					size_t buf_size);
+					size_t buf_size)
+	__attr_access ((__write_only__, 2, 3));
 #if FAPOLICYD_HAVE_FANOTIFY_FS_ERROR
 static int parse_fs_error_record(
 		const struct fanotify_event_metadata *metadata,
@@ -173,7 +175,7 @@ static const char *format_fs_error_time(time_t when, char *buf,
 {
 	struct tm tm;
 
-	if (buf_size == 0)
+	if (buf_size < 11)
 		return buf;
 
 	if (when == 0) {

src/daemon/state-report.c

@@ -23,6 +23,7 @@
 #include "decision-timing.h"
 #include "failure-action.h"
 #include "fanotify-fs-error.h"
+#include "gcc-attributes.h"
 #include "message.h"
 #include "notify.h"
 #include "paths.h"
@@ -39,6 +40,9 @@ extern conf_t config;
 
 static time_t last_metrics_reset;
 
+static const char *format_metrics_reset_time(char *buf, size_t buf_size)
+	__attr_access ((__write_only__, 1, 2));
+
 /*
  * state_report_operating_mode - write health and control state.
  * @f: report stream.

src/library/decision-timing.c

@@ -62,6 +62,7 @@
 #include <time.h>
 #include <unistd.h>
 #include "decision-timing.h"
+#include "gcc-attributes.h"
 #include "message.h"
 #include "paths.h"
 
@@ -265,6 +266,17 @@ static atomic_bool missing_helper_driver_logged;
 
 __thread struct decision_timing_context decision_timing_tls;
 
+static const char *format_report_time(long when, char *buf, size_t buf_len)
+	__attr_access ((__write_only__, 2, 3));
+static void format_count(unsigned long long value, char *buf, size_t buf_len)
+	__attr_access ((__write_only__, 2, 3));
+static void format_scaled_time(double value, const char *unit, char *buf,
+		size_t buf_len) __attr_access ((__write_only__, 3, 4));
+static void format_human_duration(unsigned long long ns, char *buf,
+		size_t buf_len) __attr_access ((__write_only__, 2, 3));
+static void format_hms_duration(unsigned long long ns, char *buf,
+		size_t buf_len) __attr_access ((__write_only__, 2, 3));
+
 /*
  * ns_now - read monotonic time in nanoseconds.
  * Returns monotonic nanoseconds, or 0 if the clock cannot be read.