fsopen.c 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469
  1. // SPDX-License-Identifier: GPL-2.0-or-later
  2. /* Filesystem access-by-fd.
  3. *
  4. * Copyright (C) 2017 Red Hat, Inc. All Rights Reserved.
  5. * Written by David Howells (dhowells@redhat.com)
  6. */
  7. #include <linux/fs_context.h>
  8. #include <linux/fs_parser.h>
  9. #include <linux/slab.h>
  10. #include <linux/uaccess.h>
  11. #include <linux/syscalls.h>
  12. #include <linux/security.h>
  13. #include <linux/anon_inodes.h>
  14. #include <linux/namei.h>
  15. #include <linux/file.h>
  16. #include <uapi/linux/mount.h>
  17. #include "internal.h"
  18. #include "mount.h"
  19. /*
  20. * Allow the user to read back any error, warning or informational messages.
  21. */
  22. static ssize_t fscontext_read(struct file *file,
  23. char __user *_buf, size_t len, loff_t *pos)
  24. {
  25. struct fs_context *fc = file->private_data;
  26. struct fc_log *log = fc->log.log;
  27. unsigned int logsize = ARRAY_SIZE(log->buffer);
  28. ssize_t ret;
  29. char *p;
  30. bool need_free;
  31. int index, n;
  32. ret = mutex_lock_interruptible(&fc->uapi_mutex);
  33. if (ret < 0)
  34. return ret;
  35. if (log->head == log->tail) {
  36. mutex_unlock(&fc->uapi_mutex);
  37. return -ENODATA;
  38. }
  39. index = log->tail & (logsize - 1);
  40. p = log->buffer[index];
  41. need_free = log->need_free & (1 << index);
  42. log->buffer[index] = NULL;
  43. log->need_free &= ~(1 << index);
  44. log->tail++;
  45. mutex_unlock(&fc->uapi_mutex);
  46. ret = -EMSGSIZE;
  47. n = strlen(p);
  48. if (n > len)
  49. goto err_free;
  50. ret = -EFAULT;
  51. if (copy_to_user(_buf, p, n) != 0)
  52. goto err_free;
  53. ret = n;
  54. err_free:
  55. if (need_free)
  56. kfree(p);
  57. return ret;
  58. }
  59. static int fscontext_release(struct inode *inode, struct file *file)
  60. {
  61. struct fs_context *fc = file->private_data;
  62. if (fc) {
  63. file->private_data = NULL;
  64. put_fs_context(fc);
  65. }
  66. return 0;
  67. }
  68. const struct file_operations fscontext_fops = {
  69. .read = fscontext_read,
  70. .release = fscontext_release,
  71. .llseek = no_llseek,
  72. };
  73. /*
  74. * Attach a filesystem context to a file and an fd.
  75. */
  76. static int fscontext_create_fd(struct fs_context *fc, unsigned int o_flags)
  77. {
  78. int fd;
  79. fd = anon_inode_getfd("[fscontext]", &fscontext_fops, fc,
  80. O_RDWR | o_flags);
  81. if (fd < 0)
  82. put_fs_context(fc);
  83. return fd;
  84. }
  85. static int fscontext_alloc_log(struct fs_context *fc)
  86. {
  87. fc->log.log = kzalloc(sizeof(*fc->log.log), GFP_KERNEL);
  88. if (!fc->log.log)
  89. return -ENOMEM;
  90. refcount_set(&fc->log.log->usage, 1);
  91. fc->log.log->owner = fc->fs_type->owner;
  92. return 0;
  93. }
  94. /*
  95. * Open a filesystem by name so that it can be configured for mounting.
  96. *
  97. * We are allowed to specify a container in which the filesystem will be
  98. * opened, thereby indicating which namespaces will be used (notably, which
  99. * network namespace will be used for network filesystems).
  100. */
  101. SYSCALL_DEFINE2(fsopen, const char __user *, _fs_name, unsigned int, flags)
  102. {
  103. struct file_system_type *fs_type;
  104. struct fs_context *fc;
  105. const char *fs_name;
  106. int ret;
  107. if (!ns_capable(current->nsproxy->mnt_ns->user_ns, CAP_SYS_ADMIN))
  108. return -EPERM;
  109. if (flags & ~FSOPEN_CLOEXEC)
  110. return -EINVAL;
  111. fs_name = strndup_user(_fs_name, PAGE_SIZE);
  112. if (IS_ERR(fs_name))
  113. return PTR_ERR(fs_name);
  114. fs_type = get_fs_type(fs_name);
  115. kfree(fs_name);
  116. if (!fs_type)
  117. return -ENODEV;
  118. fc = fs_context_for_mount(fs_type, 0);
  119. put_filesystem(fs_type);
  120. if (IS_ERR(fc))
  121. return PTR_ERR(fc);
  122. fc->phase = FS_CONTEXT_CREATE_PARAMS;
  123. ret = fscontext_alloc_log(fc);
  124. if (ret < 0)
  125. goto err_fc;
  126. return fscontext_create_fd(fc, flags & FSOPEN_CLOEXEC ? O_CLOEXEC : 0);
  127. err_fc:
  128. put_fs_context(fc);
  129. return ret;
  130. }
  131. /*
  132. * Pick a superblock into a context for reconfiguration.
  133. */
  134. SYSCALL_DEFINE3(fspick, int, dfd, const char __user *, path, unsigned int, flags)
  135. {
  136. struct fs_context *fc;
  137. struct path target;
  138. unsigned int lookup_flags;
  139. int ret;
  140. if (!ns_capable(current->nsproxy->mnt_ns->user_ns, CAP_SYS_ADMIN))
  141. return -EPERM;
  142. if ((flags & ~(FSPICK_CLOEXEC |
  143. FSPICK_SYMLINK_NOFOLLOW |
  144. FSPICK_NO_AUTOMOUNT |
  145. FSPICK_EMPTY_PATH)) != 0)
  146. return -EINVAL;
  147. lookup_flags = LOOKUP_FOLLOW | LOOKUP_AUTOMOUNT;
  148. if (flags & FSPICK_SYMLINK_NOFOLLOW)
  149. lookup_flags &= ~LOOKUP_FOLLOW;
  150. if (flags & FSPICK_NO_AUTOMOUNT)
  151. lookup_flags &= ~LOOKUP_AUTOMOUNT;
  152. if (flags & FSPICK_EMPTY_PATH)
  153. lookup_flags |= LOOKUP_EMPTY;
  154. ret = user_path_at(dfd, path, lookup_flags, &target);
  155. if (ret < 0)
  156. goto err;
  157. ret = -EINVAL;
  158. if (target.mnt->mnt_root != target.dentry)
  159. goto err_path;
  160. fc = fs_context_for_reconfigure(target.dentry, 0, 0);
  161. if (IS_ERR(fc)) {
  162. ret = PTR_ERR(fc);
  163. goto err_path;
  164. }
  165. fc->phase = FS_CONTEXT_RECONF_PARAMS;
  166. ret = fscontext_alloc_log(fc);
  167. if (ret < 0)
  168. goto err_fc;
  169. path_put(&target);
  170. return fscontext_create_fd(fc, flags & FSPICK_CLOEXEC ? O_CLOEXEC : 0);
  171. err_fc:
  172. put_fs_context(fc);
  173. err_path:
  174. path_put(&target);
  175. err:
  176. return ret;
  177. }
  178. /*
  179. * Check the state and apply the configuration. Note that this function is
  180. * allowed to 'steal' the value by setting param->xxx to NULL before returning.
  181. */
  182. static int vfs_fsconfig_locked(struct fs_context *fc, int cmd,
  183. struct fs_parameter *param)
  184. {
  185. struct super_block *sb;
  186. int ret;
  187. ret = finish_clean_context(fc);
  188. if (ret)
  189. return ret;
  190. switch (cmd) {
  191. case FSCONFIG_CMD_CREATE:
  192. if (fc->phase != FS_CONTEXT_CREATE_PARAMS)
  193. return -EBUSY;
  194. if (!mount_capable(fc))
  195. return -EPERM;
  196. fc->phase = FS_CONTEXT_CREATING;
  197. ret = vfs_get_tree(fc);
  198. if (ret)
  199. break;
  200. sb = fc->root->d_sb;
  201. ret = security_sb_kern_mount(sb);
  202. if (unlikely(ret)) {
  203. fc_drop_locked(fc);
  204. break;
  205. }
  206. up_write(&sb->s_umount);
  207. fc->phase = FS_CONTEXT_AWAITING_MOUNT;
  208. return 0;
  209. case FSCONFIG_CMD_RECONFIGURE:
  210. if (fc->phase != FS_CONTEXT_RECONF_PARAMS)
  211. return -EBUSY;
  212. fc->phase = FS_CONTEXT_RECONFIGURING;
  213. sb = fc->root->d_sb;
  214. if (!ns_capable(sb->s_user_ns, CAP_SYS_ADMIN)) {
  215. ret = -EPERM;
  216. break;
  217. }
  218. down_write(&sb->s_umount);
  219. ret = reconfigure_super(fc);
  220. up_write(&sb->s_umount);
  221. if (ret)
  222. break;
  223. vfs_clean_context(fc);
  224. return 0;
  225. default:
  226. if (fc->phase != FS_CONTEXT_CREATE_PARAMS &&
  227. fc->phase != FS_CONTEXT_RECONF_PARAMS)
  228. return -EBUSY;
  229. return vfs_parse_fs_param(fc, param);
  230. }
  231. fc->phase = FS_CONTEXT_FAILED;
  232. return ret;
  233. }
  234. /**
  235. * sys_fsconfig - Set parameters and trigger actions on a context
  236. * @fd: The filesystem context to act upon
  237. * @cmd: The action to take
  238. * @_key: Where appropriate, the parameter key to set
  239. * @_value: Where appropriate, the parameter value to set
  240. * @aux: Additional information for the value
  241. *
  242. * This system call is used to set parameters on a context, including
  243. * superblock settings, data source and security labelling.
  244. *
  245. * Actions include triggering the creation of a superblock and the
  246. * reconfiguration of the superblock attached to the specified context.
  247. *
  248. * When setting a parameter, @cmd indicates the type of value being proposed
  249. * and @_key indicates the parameter to be altered.
  250. *
  251. * @_value and @aux are used to specify the value, should a value be required:
  252. *
  253. * (*) fsconfig_set_flag: No value is specified. The parameter must be boolean
  254. * in nature. The key may be prefixed with "no" to invert the
  255. * setting. @_value must be NULL and @aux must be 0.
  256. *
  257. * (*) fsconfig_set_string: A string value is specified. The parameter can be
  258. * expecting boolean, integer, string or take a path. A conversion to an
  259. * appropriate type will be attempted (which may include looking up as a
  260. * path). @_value points to a NUL-terminated string and @aux must be 0.
  261. *
  262. * (*) fsconfig_set_binary: A binary blob is specified. @_value points to the
  263. * blob and @aux indicates its size. The parameter must be expecting a
  264. * blob.
  265. *
  266. * (*) fsconfig_set_path: A non-empty path is specified. The parameter must be
  267. * expecting a path object. @_value points to a NUL-terminated string that
  268. * is the path and @aux is a file descriptor at which to start a relative
  269. * lookup or AT_FDCWD.
  270. *
  271. * (*) fsconfig_set_path_empty: As fsconfig_set_path, but with AT_EMPTY_PATH
  272. * implied.
  273. *
  274. * (*) fsconfig_set_fd: An open file descriptor is specified. @_value must be
  275. * NULL and @aux indicates the file descriptor.
  276. */
  277. SYSCALL_DEFINE5(fsconfig,
  278. int, fd,
  279. unsigned int, cmd,
  280. const char __user *, _key,
  281. const void __user *, _value,
  282. int, aux)
  283. {
  284. struct fs_context *fc;
  285. struct fd f;
  286. int ret;
  287. int lookup_flags = 0;
  288. struct fs_parameter param = {
  289. .type = fs_value_is_undefined,
  290. };
  291. if (fd < 0)
  292. return -EINVAL;
  293. switch (cmd) {
  294. case FSCONFIG_SET_FLAG:
  295. if (!_key || _value || aux)
  296. return -EINVAL;
  297. break;
  298. case FSCONFIG_SET_STRING:
  299. if (!_key || !_value || aux)
  300. return -EINVAL;
  301. break;
  302. case FSCONFIG_SET_BINARY:
  303. if (!_key || !_value || aux <= 0 || aux > 1024 * 1024)
  304. return -EINVAL;
  305. break;
  306. case FSCONFIG_SET_PATH:
  307. case FSCONFIG_SET_PATH_EMPTY:
  308. if (!_key || !_value || (aux != AT_FDCWD && aux < 0))
  309. return -EINVAL;
  310. break;
  311. case FSCONFIG_SET_FD:
  312. if (!_key || _value || aux < 0)
  313. return -EINVAL;
  314. break;
  315. case FSCONFIG_CMD_CREATE:
  316. case FSCONFIG_CMD_RECONFIGURE:
  317. if (_key || _value || aux)
  318. return -EINVAL;
  319. break;
  320. default:
  321. return -EOPNOTSUPP;
  322. }
  323. f = fdget(fd);
  324. if (!f.file)
  325. return -EBADF;
  326. ret = -EINVAL;
  327. if (f.file->f_op != &fscontext_fops)
  328. goto out_f;
  329. fc = f.file->private_data;
  330. if (fc->ops == &legacy_fs_context_ops) {
  331. switch (cmd) {
  332. case FSCONFIG_SET_BINARY:
  333. case FSCONFIG_SET_PATH:
  334. case FSCONFIG_SET_PATH_EMPTY:
  335. case FSCONFIG_SET_FD:
  336. ret = -EOPNOTSUPP;
  337. goto out_f;
  338. }
  339. }
  340. if (_key) {
  341. param.key = strndup_user(_key, 256);
  342. if (IS_ERR(param.key)) {
  343. ret = PTR_ERR(param.key);
  344. goto out_f;
  345. }
  346. }
  347. switch (cmd) {
  348. case FSCONFIG_SET_FLAG:
  349. param.type = fs_value_is_flag;
  350. break;
  351. case FSCONFIG_SET_STRING:
  352. param.type = fs_value_is_string;
  353. param.string = strndup_user(_value, 256);
  354. if (IS_ERR(param.string)) {
  355. ret = PTR_ERR(param.string);
  356. goto out_key;
  357. }
  358. param.size = strlen(param.string);
  359. break;
  360. case FSCONFIG_SET_BINARY:
  361. param.type = fs_value_is_blob;
  362. param.size = aux;
  363. param.blob = memdup_user_nul(_value, aux);
  364. if (IS_ERR(param.blob)) {
  365. ret = PTR_ERR(param.blob);
  366. goto out_key;
  367. }
  368. break;
  369. case FSCONFIG_SET_PATH_EMPTY:
  370. lookup_flags = LOOKUP_EMPTY;
  371. fallthrough;
  372. case FSCONFIG_SET_PATH:
  373. param.type = fs_value_is_filename;
  374. param.name = getname_flags(_value, lookup_flags, NULL);
  375. if (IS_ERR(param.name)) {
  376. ret = PTR_ERR(param.name);
  377. goto out_key;
  378. }
  379. param.dirfd = aux;
  380. param.size = strlen(param.name->name);
  381. break;
  382. case FSCONFIG_SET_FD:
  383. param.type = fs_value_is_file;
  384. ret = -EBADF;
  385. param.file = fget(aux);
  386. if (!param.file)
  387. goto out_key;
  388. break;
  389. default:
  390. break;
  391. }
  392. ret = mutex_lock_interruptible(&fc->uapi_mutex);
  393. if (ret == 0) {
  394. ret = vfs_fsconfig_locked(fc, cmd, &param);
  395. mutex_unlock(&fc->uapi_mutex);
  396. }
  397. /* Clean up the our record of any value that we obtained from
  398. * userspace. Note that the value may have been stolen by the LSM or
  399. * filesystem, in which case the value pointer will have been cleared.
  400. */
  401. switch (cmd) {
  402. case FSCONFIG_SET_STRING:
  403. case FSCONFIG_SET_BINARY:
  404. kfree(param.string);
  405. break;
  406. case FSCONFIG_SET_PATH:
  407. case FSCONFIG_SET_PATH_EMPTY:
  408. if (param.name)
  409. putname(param.name);
  410. break;
  411. case FSCONFIG_SET_FD:
  412. if (param.file)
  413. fput(param.file);
  414. break;
  415. default:
  416. break;
  417. }
  418. out_key:
  419. kfree(param.key);
  420. out_f:
  421. fdput(f);
  422. return ret;
  423. }