/*
 * eset_rtp (ESET Real-time file system protection module)
 * Copyright (C) 1992-2025 ESET, spol. s r.o.
 *
 * This program is free software: you can redistribute it and/or modify
 * it under the terms of the GNU General Public License as published by
 * the Free Software Foundation, either version 3 of the License, or
 * (at your option) any later version.
 *
 * This program is distributed in the hope that it will be useful,
 * but WITHOUT ANY WARRANTY; without even the implied warranty of
 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 * GNU General Public License for more details.
 *
 * You should have received a copy of the GNU General Public License
 * along with this program.  If not, see <https://www.gnu.org/licenses/>.
 *
 * In case of any questions, you can contact us at ESET, spol. s r.o., Einsteinova 24, 851 01 Bratislava, Slovakia.
 */

#include "ertp_handlers_unlink.h"

#include <linux/file.h>
#include <linux/namei.h>

#include "ertp.h"
#include "ertp_event_check.h"
#include "ertp_ftrace_utils.h"
#include "ertp_logs.h"

sys_regs_t ertp_original_native_64_unlink;
sys_regs_t ertp_original_native_32_unlink;

sys_regs_t ertp_original_native_64_unlinkat;
sys_regs_t ertp_original_native_32_unlinkat;

static void check_unlink(const struct ertp_path *file_path, struct path *path) {
  struct ertp_check_context context = {
      .signal_handler = ERTP_SIGNAL_HANDLER_WAIT,
  };

  ertp_check_remove(&context, file_path, path);
}

static long ertp_unlink_handler_int(int dfd, const char __user *pathname,
                                    sys_regs_t original_call,
                                    struct pt_regs *regs) {
  int error;
  long ret;
  struct path path;
  struct ertp_path *file_path = NULL;

  error = user_path_at(dfd, pathname, 0, &path);
  if (!error) {
    file_path = ertp_path_file_new(&path);
  }

  ret = original_call(regs);

  if (error) {
    goto exit;
  }

  if (!ret) {
    check_unlink(file_path, &path);
  }

  ertp_path_unref(file_path);
  path_put(&path);

exit:
  return ret;
}

asmlinkage long notrace ertp_handler_native_64_unlink(struct pt_regs *regs) {
  const char __user *pathname = ERTP_SYSCALL64_ARG0(const char __user *, regs);

  return ertp_unlink_handler_int(AT_FDCWD, pathname,
                                 ertp_original_native_64_unlink, regs);
}

asmlinkage long notrace ertp_handler_native_32_unlink(struct pt_regs *regs) {
  const char __user *pathname = ERTP_SYSCALL32_ARG0(const char __user *, regs);

  return ertp_unlink_handler_int(AT_FDCWD, pathname,
                                 ertp_original_native_32_unlink, regs);
}

asmlinkage long notrace ertp_handler_native_64_unlinkat(struct pt_regs *regs) {
  int dfd = ERTP_SYSCALL64_ARG0(int, regs);
  const char __user *pathname = ERTP_SYSCALL64_ARG1(const char __user *, regs);
  int flag = ERTP_SYSCALL64_ARG2(int, regs);

  if (flag == AT_REMOVEDIR) {
    return ertp_original_native_64_unlinkat(regs);
  }

  return ertp_unlink_handler_int(dfd, pathname,
                                 ertp_original_native_64_unlinkat, regs);
}

asmlinkage long notrace ertp_handler_native_32_unlinkat(struct pt_regs *regs) {
  int dfd = ERTP_SYSCALL32_ARG0(int, regs);
  const char __user *pathname = ERTP_SYSCALL32_ARG1(const char __user *, regs);
  int flag = ERTP_SYSCALL32_ARG2(int, regs);

  if (flag == AT_REMOVEDIR) {
    return ertp_original_native_32_unlinkat(regs);
  }

  return ertp_unlink_handler_int(dfd, pathname,
                                 ertp_original_native_32_unlinkat, regs);
}