inode.c 11 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350
  1. // SPDX-License-Identifier: GPL-2.0-only
  2. /*
  3. * inode.c - securityfs
  4. *
  5. * Copyright (C) 2005 Greg Kroah-Hartman <gregkh@suse.de>
  6. *
  7. * Based on fs/debugfs/inode.c which had the following copyright notice:
  8. * Copyright (C) 2004 Greg Kroah-Hartman <greg@kroah.com>
  9. * Copyright (C) 2004 IBM Inc.
  10. */
  11. /* #define DEBUG */
  12. #include <linux/sysfs.h>
  13. #include <linux/kobject.h>
  14. #include <linux/fs.h>
  15. #include <linux/fs_context.h>
  16. #include <linux/mount.h>
  17. #include <linux/pagemap.h>
  18. #include <linux/init.h>
  19. #include <linux/namei.h>
  20. #include <linux/security.h>
  21. #include <linux/lsm_hooks.h>
  22. #include <linux/magic.h>
  23. static struct vfsmount *mount;
  24. static int mount_count;
  25. static void securityfs_free_inode(struct inode *inode)
  26. {
  27. if (S_ISLNK(inode->i_mode))
  28. kfree(inode->i_link);
  29. free_inode_nonrcu(inode);
  30. }
  31. static const struct super_operations securityfs_super_operations = {
  32. .statfs = simple_statfs,
  33. .free_inode = securityfs_free_inode,
  34. };
  35. static int securityfs_fill_super(struct super_block *sb, struct fs_context *fc)
  36. {
  37. static const struct tree_descr files[] = {{""}};
  38. int error;
  39. error = simple_fill_super(sb, SECURITYFS_MAGIC, files);
  40. if (error)
  41. return error;
  42. sb->s_op = &securityfs_super_operations;
  43. return 0;
  44. }
  45. static int securityfs_get_tree(struct fs_context *fc)
  46. {
  47. return get_tree_single(fc, securityfs_fill_super);
  48. }
  49. static const struct fs_context_operations securityfs_context_ops = {
  50. .get_tree = securityfs_get_tree,
  51. };
  52. static int securityfs_init_fs_context(struct fs_context *fc)
  53. {
  54. fc->ops = &securityfs_context_ops;
  55. return 0;
  56. }
  57. static struct file_system_type fs_type = {
  58. .owner = THIS_MODULE,
  59. .name = "securityfs",
  60. .init_fs_context = securityfs_init_fs_context,
  61. .kill_sb = kill_litter_super,
  62. };
  63. /**
  64. * securityfs_create_dentry - create a dentry in the securityfs filesystem
  65. *
  66. * @name: a pointer to a string containing the name of the file to create.
  67. * @mode: the permission that the file should have
  68. * @parent: a pointer to the parent dentry for this file. This should be a
  69. * directory dentry if set. If this parameter is %NULL, then the
  70. * file will be created in the root of the securityfs filesystem.
  71. * @data: a pointer to something that the caller will want to get to later
  72. * on. The inode.i_private pointer will point to this value on
  73. * the open() call.
  74. * @fops: a pointer to a struct file_operations that should be used for
  75. * this file.
  76. * @iops: a point to a struct of inode_operations that should be used for
  77. * this file/dir
  78. *
  79. * This is the basic "create a file/dir/symlink" function for
  80. * securityfs. It allows for a wide range of flexibility in creating
  81. * a file, or a directory (if you want to create a directory, the
  82. * securityfs_create_dir() function is recommended to be used
  83. * instead).
  84. *
  85. * This function returns a pointer to a dentry if it succeeds. This
  86. * pointer must be passed to the securityfs_remove() function when the
  87. * file is to be removed (no automatic cleanup happens if your module
  88. * is unloaded, you are responsible here). If an error occurs, the
  89. * function will return the error value (via ERR_PTR).
  90. *
  91. * If securityfs is not enabled in the kernel, the value %-ENODEV is
  92. * returned.
  93. */
  94. static struct dentry *securityfs_create_dentry(const char *name, umode_t mode,
  95. struct dentry *parent, void *data,
  96. const struct file_operations *fops,
  97. const struct inode_operations *iops)
  98. {
  99. struct dentry *dentry;
  100. struct inode *dir, *inode;
  101. int error;
  102. if (!(mode & S_IFMT))
  103. mode = (mode & S_IALLUGO) | S_IFREG;
  104. pr_debug("securityfs: creating file '%s'\n",name);
  105. error = simple_pin_fs(&fs_type, &mount, &mount_count);
  106. if (error)
  107. return ERR_PTR(error);
  108. if (!parent)
  109. parent = mount->mnt_root;
  110. dir = d_inode(parent);
  111. inode_lock(dir);
  112. dentry = lookup_one_len(name, parent, strlen(name));
  113. if (IS_ERR(dentry))
  114. goto out;
  115. if (d_really_is_positive(dentry)) {
  116. error = -EEXIST;
  117. goto out1;
  118. }
  119. inode = new_inode(dir->i_sb);
  120. if (!inode) {
  121. error = -ENOMEM;
  122. goto out1;
  123. }
  124. inode->i_ino = get_next_ino();
  125. inode->i_mode = mode;
  126. inode->i_atime = inode->i_mtime = inode->i_ctime = current_time(inode);
  127. inode->i_private = data;
  128. if (S_ISDIR(mode)) {
  129. inode->i_op = &simple_dir_inode_operations;
  130. inode->i_fop = &simple_dir_operations;
  131. inc_nlink(inode);
  132. inc_nlink(dir);
  133. } else if (S_ISLNK(mode)) {
  134. inode->i_op = iops ? iops : &simple_symlink_inode_operations;
  135. inode->i_link = data;
  136. } else {
  137. inode->i_fop = fops;
  138. }
  139. d_instantiate(dentry, inode);
  140. dget(dentry);
  141. inode_unlock(dir);
  142. return dentry;
  143. out1:
  144. dput(dentry);
  145. dentry = ERR_PTR(error);
  146. out:
  147. inode_unlock(dir);
  148. simple_release_fs(&mount, &mount_count);
  149. return dentry;
  150. }
  151. /**
  152. * securityfs_create_file - create a file in the securityfs filesystem
  153. *
  154. * @name: a pointer to a string containing the name of the file to create.
  155. * @mode: the permission that the file should have
  156. * @parent: a pointer to the parent dentry for this file. This should be a
  157. * directory dentry if set. If this parameter is %NULL, then the
  158. * file will be created in the root of the securityfs filesystem.
  159. * @data: a pointer to something that the caller will want to get to later
  160. * on. The inode.i_private pointer will point to this value on
  161. * the open() call.
  162. * @fops: a pointer to a struct file_operations that should be used for
  163. * this file.
  164. *
  165. * This function creates a file in securityfs with the given @name.
  166. *
  167. * This function returns a pointer to a dentry if it succeeds. This
  168. * pointer must be passed to the securityfs_remove() function when the file is
  169. * to be removed (no automatic cleanup happens if your module is unloaded,
  170. * you are responsible here). If an error occurs, the function will return
  171. * the error value (via ERR_PTR).
  172. *
  173. * If securityfs is not enabled in the kernel, the value %-ENODEV is
  174. * returned.
  175. */
  176. struct dentry *securityfs_create_file(const char *name, umode_t mode,
  177. struct dentry *parent, void *data,
  178. const struct file_operations *fops)
  179. {
  180. return securityfs_create_dentry(name, mode, parent, data, fops, NULL);
  181. }
  182. EXPORT_SYMBOL_GPL(securityfs_create_file);
  183. /**
  184. * securityfs_create_dir - create a directory in the securityfs filesystem
  185. *
  186. * @name: a pointer to a string containing the name of the directory to
  187. * create.
  188. * @parent: a pointer to the parent dentry for this file. This should be a
  189. * directory dentry if set. If this parameter is %NULL, then the
  190. * directory will be created in the root of the securityfs filesystem.
  191. *
  192. * This function creates a directory in securityfs with the given @name.
  193. *
  194. * This function returns a pointer to a dentry if it succeeds. This
  195. * pointer must be passed to the securityfs_remove() function when the file is
  196. * to be removed (no automatic cleanup happens if your module is unloaded,
  197. * you are responsible here). If an error occurs, the function will return
  198. * the error value (via ERR_PTR).
  199. *
  200. * If securityfs is not enabled in the kernel, the value %-ENODEV is
  201. * returned.
  202. */
  203. struct dentry *securityfs_create_dir(const char *name, struct dentry *parent)
  204. {
  205. return securityfs_create_file(name, S_IFDIR | 0755, parent, NULL, NULL);
  206. }
  207. EXPORT_SYMBOL_GPL(securityfs_create_dir);
  208. /**
  209. * securityfs_create_symlink - create a symlink in the securityfs filesystem
  210. *
  211. * @name: a pointer to a string containing the name of the symlink to
  212. * create.
  213. * @parent: a pointer to the parent dentry for the symlink. This should be a
  214. * directory dentry if set. If this parameter is %NULL, then the
  215. * directory will be created in the root of the securityfs filesystem.
  216. * @target: a pointer to a string containing the name of the symlink's target.
  217. * If this parameter is %NULL, then the @iops parameter needs to be
  218. * setup to handle .readlink and .get_link inode_operations.
  219. * @iops: a pointer to the struct inode_operations to use for the symlink. If
  220. * this parameter is %NULL, then the default simple_symlink_inode
  221. * operations will be used.
  222. *
  223. * This function creates a symlink in securityfs with the given @name.
  224. *
  225. * This function returns a pointer to a dentry if it succeeds. This
  226. * pointer must be passed to the securityfs_remove() function when the file is
  227. * to be removed (no automatic cleanup happens if your module is unloaded,
  228. * you are responsible here). If an error occurs, the function will return
  229. * the error value (via ERR_PTR).
  230. *
  231. * If securityfs is not enabled in the kernel, the value %-ENODEV is
  232. * returned.
  233. */
  234. struct dentry *securityfs_create_symlink(const char *name,
  235. struct dentry *parent,
  236. const char *target,
  237. const struct inode_operations *iops)
  238. {
  239. struct dentry *dent;
  240. char *link = NULL;
  241. if (target) {
  242. link = kstrdup(target, GFP_KERNEL);
  243. if (!link)
  244. return ERR_PTR(-ENOMEM);
  245. }
  246. dent = securityfs_create_dentry(name, S_IFLNK | 0444, parent,
  247. link, NULL, iops);
  248. if (IS_ERR(dent))
  249. kfree(link);
  250. return dent;
  251. }
  252. EXPORT_SYMBOL_GPL(securityfs_create_symlink);
  253. /**
  254. * securityfs_remove - removes a file or directory from the securityfs filesystem
  255. *
  256. * @dentry: a pointer to a the dentry of the file or directory to be removed.
  257. *
  258. * This function removes a file or directory in securityfs that was previously
  259. * created with a call to another securityfs function (like
  260. * securityfs_create_file() or variants thereof.)
  261. *
  262. * This function is required to be called in order for the file to be
  263. * removed. No automatic cleanup of files will happen when a module is
  264. * removed; you are responsible here.
  265. */
  266. void securityfs_remove(struct dentry *dentry)
  267. {
  268. struct inode *dir;
  269. if (!dentry || IS_ERR(dentry))
  270. return;
  271. dir = d_inode(dentry->d_parent);
  272. inode_lock(dir);
  273. if (simple_positive(dentry)) {
  274. if (d_is_dir(dentry))
  275. simple_rmdir(dir, dentry);
  276. else
  277. simple_unlink(dir, dentry);
  278. dput(dentry);
  279. }
  280. inode_unlock(dir);
  281. simple_release_fs(&mount, &mount_count);
  282. }
  283. EXPORT_SYMBOL_GPL(securityfs_remove);
  284. #ifdef CONFIG_SECURITY
  285. static struct dentry *lsm_dentry;
  286. static ssize_t lsm_read(struct file *filp, char __user *buf, size_t count,
  287. loff_t *ppos)
  288. {
  289. return simple_read_from_buffer(buf, count, ppos, lsm_names,
  290. strlen(lsm_names));
  291. }
  292. static const struct file_operations lsm_ops = {
  293. .read = lsm_read,
  294. .llseek = generic_file_llseek,
  295. };
  296. #endif
  297. static int __init securityfs_init(void)
  298. {
  299. int retval;
  300. retval = sysfs_create_mount_point(kernel_kobj, "security");
  301. if (retval)
  302. return retval;
  303. retval = register_filesystem(&fs_type);
  304. if (retval) {
  305. sysfs_remove_mount_point(kernel_kobj, "security");
  306. return retval;
  307. }
  308. #ifdef CONFIG_SECURITY
  309. lsm_dentry = securityfs_create_file("lsm", 0444, NULL, NULL,
  310. &lsm_ops);
  311. #endif
  312. return 0;
  313. }
  314. core_initcall(securityfs_init);