attr.c (21cb47be6fb9ece7e6ee63f6780986faa384a77c) attr.c (2f221d6f7b881d95de1f356a3097d755ab1e47d4)
1// SPDX-License-Identifier: GPL-2.0
2/*
3 * linux/fs/attr.c
4 *
5 * Copyright (C) 1991, 1992 Linus Torvalds
6 * changes by Thomas Schoebel-Theuer
7 */
8

--- 4 unchanged lines hidden (view full) ---

13#include <linux/sched/signal.h>
14#include <linux/capability.h>
15#include <linux/fsnotify.h>
16#include <linux/fcntl.h>
17#include <linux/security.h>
18#include <linux/evm.h>
19#include <linux/ima.h>
20
1// SPDX-License-Identifier: GPL-2.0
2/*
3 * linux/fs/attr.c
4 *
5 * Copyright (C) 1991, 1992 Linus Torvalds
6 * changes by Thomas Schoebel-Theuer
7 */
8

--- 4 unchanged lines hidden (view full) ---

13#include <linux/sched/signal.h>
14#include <linux/capability.h>
15#include <linux/fsnotify.h>
16#include <linux/fcntl.h>
17#include <linux/security.h>
18#include <linux/evm.h>
19#include <linux/ima.h>
20
21static bool chown_ok(const struct inode *inode, kuid_t uid)
21/**
22 * chown_ok - verify permissions to chown inode
23 * @mnt_userns: user namespace of the mount @inode was found from
24 * @inode: inode to check permissions on
25 * @uid: uid to chown @inode to
26 *
27 * If the inode has been found through an idmapped mount the user namespace of
28 * the vfsmount must be passed through @mnt_userns. This function will then
29 * take care to map the inode according to @mnt_userns before checking
30 * permissions. On non-idmapped mounts or if permission checking is to be
31 * performed on the raw inode simply passs init_user_ns.
32 */
33static bool chown_ok(struct user_namespace *mnt_userns,
34 const struct inode *inode,
35 kuid_t uid)
22{
36{
23 if (uid_eq(current_fsuid(), inode->i_uid) &&
24 uid_eq(uid, inode->i_uid))
37 kuid_t kuid = i_uid_into_mnt(mnt_userns, inode);
38 if (uid_eq(current_fsuid(), kuid) && uid_eq(uid, kuid))
25 return true;
39 return true;
26 if (capable_wrt_inode_uidgid(&init_user_ns, inode, CAP_CHOWN))
40 if (capable_wrt_inode_uidgid(mnt_userns, inode, CAP_CHOWN))
27 return true;
41 return true;
28 if (uid_eq(inode->i_uid, INVALID_UID) &&
42 if (uid_eq(kuid, INVALID_UID) &&
29 ns_capable(inode->i_sb->s_user_ns, CAP_CHOWN))
30 return true;
31 return false;
32}
33
43 ns_capable(inode->i_sb->s_user_ns, CAP_CHOWN))
44 return true;
45 return false;
46}
47
34static bool chgrp_ok(const struct inode *inode, kgid_t gid)
48/**
49 * chgrp_ok - verify permissions to chgrp inode
50 * @mnt_userns: user namespace of the mount @inode was found from
51 * @inode: inode to check permissions on
52 * @gid: gid to chown @inode to
53 *
54 * If the inode has been found through an idmapped mount the user namespace of
55 * the vfsmount must be passed through @mnt_userns. This function will then
56 * take care to map the inode according to @mnt_userns before checking
57 * permissions. On non-idmapped mounts or if permission checking is to be
58 * performed on the raw inode simply passs init_user_ns.
59 */
60static bool chgrp_ok(struct user_namespace *mnt_userns,
61 const struct inode *inode, kgid_t gid)
35{
62{
36 if (uid_eq(current_fsuid(), inode->i_uid) &&
37 (in_group_p(gid) || gid_eq(gid, inode->i_gid)))
63 kgid_t kgid = i_gid_into_mnt(mnt_userns, inode);
64 if (uid_eq(current_fsuid(), i_uid_into_mnt(mnt_userns, inode)) &&
65 (in_group_p(gid) || gid_eq(gid, kgid)))
38 return true;
66 return true;
39 if (capable_wrt_inode_uidgid(&init_user_ns, inode, CAP_CHOWN))
67 if (capable_wrt_inode_uidgid(mnt_userns, inode, CAP_CHOWN))
40 return true;
68 return true;
41 if (gid_eq(inode->i_gid, INVALID_GID) &&
69 if (gid_eq(kgid, INVALID_GID) &&
42 ns_capable(inode->i_sb->s_user_ns, CAP_CHOWN))
43 return true;
44 return false;
45}
46
47/**
48 * setattr_prepare - check if attribute changes to a dentry are allowed
70 ns_capable(inode->i_sb->s_user_ns, CAP_CHOWN))
71 return true;
72 return false;
73}
74
75/**
76 * setattr_prepare - check if attribute changes to a dentry are allowed
77 * @mnt_userns: user namespace of the mount the inode was found from
49 * @dentry: dentry to check
50 * @attr: attributes to change
51 *
52 * Check if we are allowed to change the attributes contained in @attr
53 * in the given dentry. This includes the normal unix access permission
54 * checks, as well as checks for rlimits and others. The function also clears
55 * SGID bit from mode if user is not allowed to set it. Also file capabilities
56 * and IMA extended attributes are cleared if ATTR_KILL_PRIV is set.
57 *
78 * @dentry: dentry to check
79 * @attr: attributes to change
80 *
81 * Check if we are allowed to change the attributes contained in @attr
82 * in the given dentry. This includes the normal unix access permission
83 * checks, as well as checks for rlimits and others. The function also clears
84 * SGID bit from mode if user is not allowed to set it. Also file capabilities
85 * and IMA extended attributes are cleared if ATTR_KILL_PRIV is set.
86 *
87 * If the inode has been found through an idmapped mount the user namespace of
88 * the vfsmount must be passed through @mnt_userns. This function will then
89 * take care to map the inode according to @mnt_userns before checking
90 * permissions. On non-idmapped mounts or if permission checking is to be
91 * performed on the raw inode simply passs init_user_ns.
92 *
58 * Should be called as the first thing in ->setattr implementations,
59 * possibly after taking additional locks.
60 */
93 * Should be called as the first thing in ->setattr implementations,
94 * possibly after taking additional locks.
95 */
61int setattr_prepare(struct dentry *dentry, struct iattr *attr)
96int setattr_prepare(struct user_namespace *mnt_userns, struct dentry *dentry,
97 struct iattr *attr)
62{
63 struct inode *inode = d_inode(dentry);
64 unsigned int ia_valid = attr->ia_valid;
65
66 /*
67 * First check size constraints. These can't be overriden using
68 * ATTR_FORCE.
69 */
70 if (ia_valid & ATTR_SIZE) {
71 int error = inode_newsize_ok(inode, attr->ia_size);
72 if (error)
73 return error;
74 }
75
76 /* If force is set do it anyway. */
77 if (ia_valid & ATTR_FORCE)
78 goto kill_priv;
79
80 /* Make sure a caller can chown. */
98{
99 struct inode *inode = d_inode(dentry);
100 unsigned int ia_valid = attr->ia_valid;
101
102 /*
103 * First check size constraints. These can't be overriden using
104 * ATTR_FORCE.
105 */
106 if (ia_valid & ATTR_SIZE) {
107 int error = inode_newsize_ok(inode, attr->ia_size);
108 if (error)
109 return error;
110 }
111
112 /* If force is set do it anyway. */
113 if (ia_valid & ATTR_FORCE)
114 goto kill_priv;
115
116 /* Make sure a caller can chown. */
81 if ((ia_valid & ATTR_UID) && !chown_ok(inode, attr->ia_uid))
117 if ((ia_valid & ATTR_UID) && !chown_ok(mnt_userns, inode, attr->ia_uid))
82 return -EPERM;
83
84 /* Make sure caller can chgrp. */
118 return -EPERM;
119
120 /* Make sure caller can chgrp. */
85 if ((ia_valid & ATTR_GID) && !chgrp_ok(inode, attr->ia_gid))
121 if ((ia_valid & ATTR_GID) && !chgrp_ok(mnt_userns, inode, attr->ia_gid))
86 return -EPERM;
87
88 /* Make sure a caller can chmod. */
89 if (ia_valid & ATTR_MODE) {
122 return -EPERM;
123
124 /* Make sure a caller can chmod. */
125 if (ia_valid & ATTR_MODE) {
90 if (!inode_owner_or_capable(&init_user_ns, inode))
126 if (!inode_owner_or_capable(mnt_userns, inode))
91 return -EPERM;
92 /* Also check the setgid bit! */
127 return -EPERM;
128 /* Also check the setgid bit! */
93 if (!in_group_p((ia_valid & ATTR_GID) ? attr->ia_gid :
94 inode->i_gid) &&
95 !capable_wrt_inode_uidgid(&init_user_ns, inode, CAP_FSETID))
129 if (!in_group_p((ia_valid & ATTR_GID) ? attr->ia_gid :
130 i_gid_into_mnt(mnt_userns, inode)) &&
131 !capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FSETID))
96 attr->ia_mode &= ~S_ISGID;
97 }
98
99 /* Check for setting the inode time. */
100 if (ia_valid & (ATTR_MTIME_SET | ATTR_ATIME_SET | ATTR_TIMES_SET)) {
132 attr->ia_mode &= ~S_ISGID;
133 }
134
135 /* Check for setting the inode time. */
136 if (ia_valid & (ATTR_MTIME_SET | ATTR_ATIME_SET | ATTR_TIMES_SET)) {
101 if (!inode_owner_or_capable(&init_user_ns, inode))
137 if (!inode_owner_or_capable(mnt_userns, inode))
102 return -EPERM;
103 }
104
105kill_priv:
106 /* User has permission for the change */
107 if (ia_valid & ATTR_KILL_PRIV) {
108 int error;
109

--- 47 unchanged lines hidden (view full) ---

157 send_sig(SIGXFSZ, current, 0);
158out_big:
159 return -EFBIG;
160}
161EXPORT_SYMBOL(inode_newsize_ok);
162
163/**
164 * setattr_copy - copy simple metadata updates into the generic inode
138 return -EPERM;
139 }
140
141kill_priv:
142 /* User has permission for the change */
143 if (ia_valid & ATTR_KILL_PRIV) {
144 int error;
145

--- 47 unchanged lines hidden (view full) ---

193 send_sig(SIGXFSZ, current, 0);
194out_big:
195 return -EFBIG;
196}
197EXPORT_SYMBOL(inode_newsize_ok);
198
199/**
200 * setattr_copy - copy simple metadata updates into the generic inode
201 * @mnt_userns: user namespace of the mount the inode was found from
165 * @inode: the inode to be updated
166 * @attr: the new attributes
167 *
168 * setattr_copy must be called with i_mutex held.
169 *
170 * setattr_copy updates the inode's metadata with that specified
202 * @inode: the inode to be updated
203 * @attr: the new attributes
204 *
205 * setattr_copy must be called with i_mutex held.
206 *
207 * setattr_copy updates the inode's metadata with that specified
171 * in attr. Noticeably missing is inode size update, which is more complex
208 * in attr on idmapped mounts. If file ownership is changed setattr_copy
209 * doesn't map ia_uid and ia_gid. It will asssume the caller has already
210 * provided the intended values. Necessary permission checks to determine
211 * whether or not the S_ISGID property needs to be removed are performed with
212 * the correct idmapped mount permission helpers.
213 * Noticeably missing is inode size update, which is more complex
172 * as it requires pagecache updates.
173 *
214 * as it requires pagecache updates.
215 *
216 * If the inode has been found through an idmapped mount the user namespace of
217 * the vfsmount must be passed through @mnt_userns. This function will then
218 * take care to map the inode according to @mnt_userns before checking
219 * permissions. On non-idmapped mounts or if permission checking is to be
220 * performed on the raw inode simply passs init_user_ns.
221 *
174 * The inode is not marked as dirty after this operation. The rationale is
175 * that for "simple" filesystems, the struct inode is the inode storage.
176 * The caller is free to mark the inode dirty afterwards if needed.
177 */
222 * The inode is not marked as dirty after this operation. The rationale is
223 * that for "simple" filesystems, the struct inode is the inode storage.
224 * The caller is free to mark the inode dirty afterwards if needed.
225 */
178void setattr_copy(struct inode *inode, const struct iattr *attr)
226void setattr_copy(struct user_namespace *mnt_userns, struct inode *inode,
227 const struct iattr *attr)
179{
180 unsigned int ia_valid = attr->ia_valid;
181
182 if (ia_valid & ATTR_UID)
183 inode->i_uid = attr->ia_uid;
184 if (ia_valid & ATTR_GID)
185 inode->i_gid = attr->ia_gid;
186 if (ia_valid & ATTR_ATIME)
187 inode->i_atime = attr->ia_atime;
188 if (ia_valid & ATTR_MTIME)
189 inode->i_mtime = attr->ia_mtime;
190 if (ia_valid & ATTR_CTIME)
191 inode->i_ctime = attr->ia_ctime;
192 if (ia_valid & ATTR_MODE) {
193 umode_t mode = attr->ia_mode;
228{
229 unsigned int ia_valid = attr->ia_valid;
230
231 if (ia_valid & ATTR_UID)
232 inode->i_uid = attr->ia_uid;
233 if (ia_valid & ATTR_GID)
234 inode->i_gid = attr->ia_gid;
235 if (ia_valid & ATTR_ATIME)
236 inode->i_atime = attr->ia_atime;
237 if (ia_valid & ATTR_MTIME)
238 inode->i_mtime = attr->ia_mtime;
239 if (ia_valid & ATTR_CTIME)
240 inode->i_ctime = attr->ia_ctime;
241 if (ia_valid & ATTR_MODE) {
242 umode_t mode = attr->ia_mode;
194
195 if (!in_group_p(inode->i_gid) &&
196 !capable_wrt_inode_uidgid(&init_user_ns, inode, CAP_FSETID))
243 kgid_t kgid = i_gid_into_mnt(mnt_userns, inode);
244 if (!in_group_p(kgid) &&
245 !capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FSETID))
197 mode &= ~S_ISGID;
198 inode->i_mode = mode;
199 }
200}
201EXPORT_SYMBOL(setattr_copy);
202
203/**
204 * notify_change - modify attributes of a filesytem object
246 mode &= ~S_ISGID;
247 inode->i_mode = mode;
248 }
249}
250EXPORT_SYMBOL(setattr_copy);
251
252/**
253 * notify_change - modify attributes of a filesytem object
254 * @mnt_userns: user namespace of the mount the inode was found from
205 * @dentry: object affected
206 * @attr: new attributes
207 * @delegated_inode: returns inode, if the inode is delegated
208 *
209 * The caller must hold the i_mutex on the affected object.
210 *
211 * If notify_change discovers a delegation in need of breaking,
212 * it will return -EWOULDBLOCK and return a reference to the inode in
213 * delegated_inode. The caller should then break the delegation and
214 * retry. Because breaking a delegation may take a long time, the
215 * caller should drop the i_mutex before doing so.
216 *
255 * @dentry: object affected
256 * @attr: new attributes
257 * @delegated_inode: returns inode, if the inode is delegated
258 *
259 * The caller must hold the i_mutex on the affected object.
260 *
261 * If notify_change discovers a delegation in need of breaking,
262 * it will return -EWOULDBLOCK and return a reference to the inode in
263 * delegated_inode. The caller should then break the delegation and
264 * retry. Because breaking a delegation may take a long time, the
265 * caller should drop the i_mutex before doing so.
266 *
267 * If file ownership is changed notify_change() doesn't map ia_uid and
268 * ia_gid. It will asssume the caller has already provided the intended values.
269 *
217 * Alternatively, a caller may pass NULL for delegated_inode. This may
218 * be appropriate for callers that expect the underlying filesystem not
219 * to be NFS exported. Also, passing NULL is fine for callers holding
220 * the file open for write, as there can be no conflicting delegation in
221 * that case.
270 * Alternatively, a caller may pass NULL for delegated_inode. This may
271 * be appropriate for callers that expect the underlying filesystem not
272 * to be NFS exported. Also, passing NULL is fine for callers holding
273 * the file open for write, as there can be no conflicting delegation in
274 * that case.
275 *
276 * If the inode has been found through an idmapped mount the user namespace of
277 * the vfsmount must be passed through @mnt_userns. This function will then
278 * take care to map the inode according to @mnt_userns before checking
279 * permissions. On non-idmapped mounts or if permission checking is to be
280 * performed on the raw inode simply passs init_user_ns.
222 */
281 */
223int notify_change(struct dentry * dentry, struct iattr * attr, struct inode **delegated_inode)
282int notify_change(struct user_namespace *mnt_userns, struct dentry *dentry,
283 struct iattr *attr, struct inode **delegated_inode)
224{
225 struct inode *inode = dentry->d_inode;
226 umode_t mode = inode->i_mode;
227 int error;
228 struct timespec64 now;
229 unsigned int ia_valid = attr->ia_valid;
230
231 WARN_ON_ONCE(!inode_is_locked(inode));

--- 6 unchanged lines hidden (view full) ---

238 /*
239 * If utimes(2) and friends are called with times == NULL (or both
240 * times are UTIME_NOW), then we need to check for write permission
241 */
242 if (ia_valid & ATTR_TOUCH) {
243 if (IS_IMMUTABLE(inode))
244 return -EPERM;
245
284{
285 struct inode *inode = dentry->d_inode;
286 umode_t mode = inode->i_mode;
287 int error;
288 struct timespec64 now;
289 unsigned int ia_valid = attr->ia_valid;
290
291 WARN_ON_ONCE(!inode_is_locked(inode));

--- 6 unchanged lines hidden (view full) ---

298 /*
299 * If utimes(2) and friends are called with times == NULL (or both
300 * times are UTIME_NOW), then we need to check for write permission
301 */
302 if (ia_valid & ATTR_TOUCH) {
303 if (IS_IMMUTABLE(inode))
304 return -EPERM;
305
246 if (!inode_owner_or_capable(&init_user_ns, inode)) {
247 error = inode_permission(&init_user_ns, inode,
248 MAY_WRITE);
306 if (!inode_owner_or_capable(mnt_userns, inode)) {
307 error = inode_permission(mnt_userns, inode, MAY_WRITE);
249 if (error)
250 return error;
251 }
252 }
253
254 if ((ia_valid & ATTR_MODE)) {
255 umode_t amode = attr->ia_mode;
256 /* Flag setting protected by i_mutex */

--- 59 unchanged lines hidden (view full) ---

316 return -EOVERFLOW;
317 if (ia_valid & ATTR_GID &&
318 !kgid_has_mapping(inode->i_sb->s_user_ns, attr->ia_gid))
319 return -EOVERFLOW;
320
321 /* Don't allow modifications of files with invalid uids or
322 * gids unless those uids & gids are being made valid.
323 */
308 if (error)
309 return error;
310 }
311 }
312
313 if ((ia_valid & ATTR_MODE)) {
314 umode_t amode = attr->ia_mode;
315 /* Flag setting protected by i_mutex */

--- 59 unchanged lines hidden (view full) ---

375 return -EOVERFLOW;
376 if (ia_valid & ATTR_GID &&
377 !kgid_has_mapping(inode->i_sb->s_user_ns, attr->ia_gid))
378 return -EOVERFLOW;
379
380 /* Don't allow modifications of files with invalid uids or
381 * gids unless those uids & gids are being made valid.
382 */
324 if (!(ia_valid & ATTR_UID) && !uid_valid(inode->i_uid))
383 if (!(ia_valid & ATTR_UID) &&
384 !uid_valid(i_uid_into_mnt(mnt_userns, inode)))
325 return -EOVERFLOW;
385 return -EOVERFLOW;
326 if (!(ia_valid & ATTR_GID) && !gid_valid(inode->i_gid))
386 if (!(ia_valid & ATTR_GID) &&
387 !gid_valid(i_gid_into_mnt(mnt_userns, inode)))
327 return -EOVERFLOW;
328
329 error = security_inode_setattr(dentry, attr);
330 if (error)
331 return error;
332 error = try_break_deleg(inode, delegated_inode);
333 if (error)
334 return error;

--- 15 unchanged lines hidden --- 		388 return -EOVERFLOW;
389
390 error = security_inode_setattr(dentry, attr);
391 if (error)
392 return error;
393 error = try_break_deleg(inode, delegated_inode);
394 if (error)
395 return error;

--- 15 unchanged lines hidden ---