1 // SPDX-License-Identifier: GPL-2.0 2 #include <linux/fanotify.h> 3 #include <linux/fcntl.h> 4 #include <linux/file.h> 5 #include <linux/fs.h> 6 #include <linux/anon_inodes.h> 7 #include <linux/fsnotify_backend.h> 8 #include <linux/init.h> 9 #include <linux/mount.h> 10 #include <linux/namei.h> 11 #include <linux/poll.h> 12 #include <linux/security.h> 13 #include <linux/syscalls.h> 14 #include <linux/slab.h> 15 #include <linux/types.h> 16 #include <linux/uaccess.h> 17 #include <linux/compat.h> 18 #include <linux/sched/signal.h> 19 #include <linux/memcontrol.h> 20 #include <linux/statfs.h> 21 #include <linux/exportfs.h> 22 #include <linux/pidfd.h> 23 24 #include <asm/ioctls.h> 25 26 #include "../fsnotify.h" 27 #include "../fdinfo.h" 28 #include "fanotify.h" 29 30 #define FANOTIFY_DEFAULT_MAX_EVENTS 16384 31 #define FANOTIFY_OLD_DEFAULT_MAX_MARKS 8192 32 #define FANOTIFY_DEFAULT_MAX_GROUPS 128 33 #define FANOTIFY_DEFAULT_FEE_POOL_SIZE 32 34 35 /* 36 * Legacy fanotify marks limits (8192) is per group and we introduced a tunable 37 * limit of marks per user, similar to inotify. Effectively, the legacy limit 38 * of fanotify marks per user is <max marks per group> * <max groups per user>. 39 * This default limit (1M) also happens to match the increased limit of inotify 40 * max_user_watches since v5.10. 41 */ 42 #define FANOTIFY_DEFAULT_MAX_USER_MARKS \ 43 (FANOTIFY_OLD_DEFAULT_MAX_MARKS * FANOTIFY_DEFAULT_MAX_GROUPS) 44 45 /* 46 * Most of the memory cost of adding an inode mark is pinning the marked inode. 47 * The size of the filesystem inode struct is not uniform across filesystems, 48 * so double the size of a VFS inode is used as a conservative approximation. 49 */ 50 #define INODE_MARK_COST (2 * sizeof(struct inode)) 51 52 /* configurable via /proc/sys/fs/fanotify/ */ 53 static int fanotify_max_queued_events __read_mostly; 54 static int perm_group_timeout __read_mostly; 55 56 #ifdef CONFIG_SYSCTL 57 58 #include <linux/sysctl.h> 59 60 static long ft_zero = 0; 61 static long ft_int_max = INT_MAX; 62 63 static const struct ctl_table fanotify_table[] = { 64 { 65 .procname = "max_user_groups", 66 .data = &init_user_ns.ucount_max[UCOUNT_FANOTIFY_GROUPS], 67 .maxlen = sizeof(long), 68 .mode = 0644, 69 .proc_handler = proc_doulongvec_minmax, 70 .extra1 = &ft_zero, 71 .extra2 = &ft_int_max, 72 }, 73 { 74 .procname = "max_user_marks", 75 .data = &init_user_ns.ucount_max[UCOUNT_FANOTIFY_MARKS], 76 .maxlen = sizeof(long), 77 .mode = 0644, 78 .proc_handler = proc_doulongvec_minmax, 79 .extra1 = &ft_zero, 80 .extra2 = &ft_int_max, 81 }, 82 { 83 .procname = "max_queued_events", 84 .data = &fanotify_max_queued_events, 85 .maxlen = sizeof(int), 86 .mode = 0644, 87 .proc_handler = proc_dointvec_minmax, 88 .extra1 = SYSCTL_ZERO 89 }, 90 { 91 .procname = "watchdog_timeout", 92 .data = &perm_group_timeout, 93 .maxlen = sizeof(int), 94 .mode = 0644, 95 .proc_handler = proc_dointvec_minmax, 96 .extra1 = SYSCTL_ZERO, 97 }, 98 }; 99 100 static void __init fanotify_sysctls_init(void) 101 { 102 register_sysctl("fs/fanotify", fanotify_table); 103 } 104 #else 105 #define fanotify_sysctls_init() do { } while (0) 106 #endif /* CONFIG_SYSCTL */ 107 108 static LIST_HEAD(perm_group_list); 109 static DEFINE_SPINLOCK(perm_group_lock); 110 static void perm_group_watchdog(struct work_struct *work); 111 static DECLARE_DELAYED_WORK(perm_group_work, perm_group_watchdog); 112 113 static void perm_group_watchdog_schedule(void) 114 { 115 int timeout = READ_ONCE(perm_group_timeout); 116 117 if (!timeout) 118 return; 119 120 schedule_delayed_work(&perm_group_work, secs_to_jiffies(timeout)); 121 } 122 123 static void perm_group_watchdog(struct work_struct *work) 124 { 125 struct fsnotify_group *group; 126 struct fanotify_perm_event *event; 127 struct task_struct *task; 128 pid_t failed_pid = 0; 129 130 guard(spinlock)(&perm_group_lock); 131 if (list_empty(&perm_group_list)) 132 return; 133 134 list_for_each_entry(group, &perm_group_list, 135 fanotify_data.perm_grp_list) { 136 /* 137 * Ok to test without lock, racing with an addition is 138 * fine, will deal with it next round 139 */ 140 if (list_empty(&group->fanotify_data.access_list)) 141 continue; 142 143 spin_lock(&group->notification_lock); 144 list_for_each_entry(event, &group->fanotify_data.access_list, 145 fae.fse.list) { 146 if (likely(event->watchdog_cnt == 0)) { 147 event->watchdog_cnt = 1; 148 } else if (event->watchdog_cnt == 1) { 149 /* Report on event only once */ 150 event->watchdog_cnt = 2; 151 152 /* Do not report same pid repeatedly */ 153 if (event->recv_pid == failed_pid) 154 continue; 155 156 failed_pid = event->recv_pid; 157 rcu_read_lock(); 158 task = find_task_by_pid_ns(event->recv_pid, 159 &init_pid_ns); 160 pr_warn_ratelimited( 161 "PID %u (%s) failed to respond to fanotify queue for more than %d seconds\n", 162 event->recv_pid, 163 task ? task->comm : NULL, 164 perm_group_timeout); 165 rcu_read_unlock(); 166 } 167 } 168 spin_unlock(&group->notification_lock); 169 } 170 perm_group_watchdog_schedule(); 171 } 172 173 static void fanotify_perm_watchdog_group_remove(struct fsnotify_group *group) 174 { 175 if (!list_empty(&group->fanotify_data.perm_grp_list)) { 176 /* Perm event watchdog can no longer scan this group. */ 177 spin_lock(&perm_group_lock); 178 list_del_init(&group->fanotify_data.perm_grp_list); 179 spin_unlock(&perm_group_lock); 180 } 181 } 182 183 static void fanotify_perm_watchdog_group_add(struct fsnotify_group *group) 184 { 185 if (!perm_group_timeout) 186 return; 187 188 spin_lock(&perm_group_lock); 189 if (list_empty(&group->fanotify_data.perm_grp_list)) { 190 /* Add to perm_group_list for monitoring by watchdog. */ 191 if (list_empty(&perm_group_list)) 192 perm_group_watchdog_schedule(); 193 list_add_tail(&group->fanotify_data.perm_grp_list, &perm_group_list); 194 } 195 spin_unlock(&perm_group_lock); 196 } 197 198 /* 199 * All flags that may be specified in parameter event_f_flags of fanotify_init. 200 * 201 * Internal and external open flags are stored together in field f_flags of 202 * struct file. Only external open flags shall be allowed in event_f_flags. 203 * Internal flags like FMODE_EXEC shall be excluded. 204 */ 205 #define FANOTIFY_INIT_ALL_EVENT_F_BITS ( \ 206 O_ACCMODE | O_APPEND | O_NONBLOCK | \ 207 __O_SYNC | O_DSYNC | O_CLOEXEC | \ 208 O_LARGEFILE | O_NOATIME ) 209 210 extern const struct fsnotify_ops fanotify_fsnotify_ops; 211 212 struct kmem_cache *fanotify_mark_cache __ro_after_init; 213 struct kmem_cache *fanotify_fid_event_cachep __ro_after_init; 214 struct kmem_cache *fanotify_path_event_cachep __ro_after_init; 215 struct kmem_cache *fanotify_perm_event_cachep __ro_after_init; 216 struct kmem_cache *fanotify_mnt_event_cachep __ro_after_init; 217 218 #define FANOTIFY_EVENT_ALIGN 4 219 #define FANOTIFY_FID_INFO_HDR_LEN \ 220 (sizeof(struct fanotify_event_info_fid) + sizeof(struct file_handle)) 221 #define FANOTIFY_PIDFD_INFO_LEN \ 222 sizeof(struct fanotify_event_info_pidfd) 223 #define FANOTIFY_ERROR_INFO_LEN \ 224 (sizeof(struct fanotify_event_info_error)) 225 #define FANOTIFY_RANGE_INFO_LEN \ 226 (sizeof(struct fanotify_event_info_range)) 227 #define FANOTIFY_MNT_INFO_LEN \ 228 (sizeof(struct fanotify_event_info_mnt)) 229 230 static int fanotify_fid_info_len(int fh_len, int name_len) 231 { 232 int info_len = fh_len; 233 234 if (name_len) 235 info_len += name_len + 1; 236 237 return roundup(FANOTIFY_FID_INFO_HDR_LEN + info_len, 238 FANOTIFY_EVENT_ALIGN); 239 } 240 241 /* FAN_RENAME may have one or two dir+name info records */ 242 static int fanotify_dir_name_info_len(struct fanotify_event *event) 243 { 244 struct fanotify_info *info = fanotify_event_info(event); 245 int dir_fh_len = fanotify_event_dir_fh_len(event); 246 int dir2_fh_len = fanotify_event_dir2_fh_len(event); 247 int info_len = 0; 248 249 if (dir_fh_len) 250 info_len += fanotify_fid_info_len(dir_fh_len, 251 info->name_len); 252 if (dir2_fh_len) 253 info_len += fanotify_fid_info_len(dir2_fh_len, 254 info->name2_len); 255 256 return info_len; 257 } 258 259 static size_t fanotify_event_len(unsigned int info_mode, 260 struct fanotify_event *event) 261 { 262 size_t event_len = FAN_EVENT_METADATA_LEN; 263 int fh_len; 264 int dot_len = 0; 265 266 if (fanotify_is_error_event(event->mask)) 267 event_len += FANOTIFY_ERROR_INFO_LEN; 268 269 if (fanotify_event_has_any_dir_fh(event)) { 270 event_len += fanotify_dir_name_info_len(event); 271 } else if ((info_mode & FAN_REPORT_NAME) && 272 (event->mask & FAN_ONDIR)) { 273 /* 274 * With group flag FAN_REPORT_NAME, if name was not recorded in 275 * event on a directory, we will report the name ".". 276 */ 277 dot_len = 1; 278 } 279 280 if (fanotify_event_has_object_fh(event)) { 281 fh_len = fanotify_event_object_fh_len(event); 282 event_len += fanotify_fid_info_len(fh_len, dot_len); 283 } 284 if (fanotify_is_mnt_event(event->mask)) 285 event_len += FANOTIFY_MNT_INFO_LEN; 286 287 if (info_mode & FAN_REPORT_PIDFD) 288 event_len += FANOTIFY_PIDFD_INFO_LEN; 289 290 if (fanotify_event_has_access_range(event)) 291 event_len += FANOTIFY_RANGE_INFO_LEN; 292 293 return event_len; 294 } 295 296 /* 297 * Remove an hashed event from merge hash table. 298 */ 299 static void fanotify_unhash_event(struct fsnotify_group *group, 300 struct fanotify_event *event) 301 { 302 assert_spin_locked(&group->notification_lock); 303 304 pr_debug("%s: group=%p event=%p bucket=%u\n", __func__, 305 group, event, fanotify_event_hash_bucket(group, event)); 306 307 if (WARN_ON_ONCE(hlist_unhashed(&event->merge_list))) 308 return; 309 310 hlist_del_init(&event->merge_list); 311 } 312 313 /* 314 * Get an fanotify notification event if one exists and is small 315 * enough to fit in "count". Return an error pointer if the count 316 * is not large enough. When permission event is dequeued, its state is 317 * updated accordingly. 318 */ 319 static struct fanotify_event *get_one_event(struct fsnotify_group *group, 320 size_t count) 321 { 322 size_t event_size; 323 struct fanotify_event *event = NULL; 324 struct fsnotify_event *fsn_event; 325 unsigned int info_mode = FAN_GROUP_FLAG(group, FANOTIFY_INFO_MODES); 326 327 pr_debug("%s: group=%p count=%zd\n", __func__, group, count); 328 329 spin_lock(&group->notification_lock); 330 fsn_event = fsnotify_peek_first_event(group); 331 if (!fsn_event) 332 goto out; 333 334 event = FANOTIFY_E(fsn_event); 335 event_size = fanotify_event_len(info_mode, event); 336 337 if (event_size > count) { 338 event = ERR_PTR(-EINVAL); 339 goto out; 340 } 341 342 /* 343 * Held the notification_lock the whole time, so this is the 344 * same event we peeked above. 345 */ 346 fsnotify_remove_first_event(group); 347 if (fanotify_is_perm_event(event->mask)) 348 FANOTIFY_PERM(event)->state = FAN_EVENT_REPORTED; 349 if (fanotify_is_hashed_event(event->mask)) 350 fanotify_unhash_event(group, event); 351 out: 352 spin_unlock(&group->notification_lock); 353 return event; 354 } 355 356 static int create_fd(struct fsnotify_group *group, const struct path *path, 357 struct file **file) 358 { 359 int client_fd; 360 struct file *new_file; 361 362 client_fd = get_unused_fd_flags(group->fanotify_data.f_flags); 363 if (client_fd < 0) 364 return client_fd; 365 366 /* 367 * We provide an fd for the userspace program, so it could access the 368 * file without generating fanotify events itself. 369 */ 370 new_file = dentry_open_nonotify(path, group->fanotify_data.f_flags, 371 current_cred()); 372 if (IS_ERR(new_file)) { 373 put_unused_fd(client_fd); 374 client_fd = PTR_ERR(new_file); 375 } else { 376 *file = new_file; 377 } 378 379 return client_fd; 380 } 381 382 static int process_access_response_info(const char __user *info, 383 size_t info_len, 384 struct fanotify_response_info_audit_rule *friar) 385 { 386 if (info_len != sizeof(*friar)) 387 return -EINVAL; 388 389 if (copy_from_user(friar, info, sizeof(*friar))) 390 return -EFAULT; 391 392 if (friar->hdr.type != FAN_RESPONSE_INFO_AUDIT_RULE) 393 return -EINVAL; 394 if (friar->hdr.pad != 0) 395 return -EINVAL; 396 if (friar->hdr.len != sizeof(*friar)) 397 return -EINVAL; 398 399 return info_len; 400 } 401 402 /* 403 * Finish processing of permission event by setting it to ANSWERED state and 404 * drop group->notification_lock. 405 */ 406 static void finish_permission_event(struct fsnotify_group *group, 407 struct fanotify_perm_event *event, u32 response, 408 struct fanotify_response_info_audit_rule *friar) 409 __releases(&group->notification_lock) 410 { 411 bool destroy = false; 412 413 assert_spin_locked(&group->notification_lock); 414 event->response = response & ~FAN_INFO; 415 if (response & FAN_INFO) 416 memcpy(&event->audit_rule, friar, sizeof(*friar)); 417 418 if (event->state == FAN_EVENT_CANCELED) 419 destroy = true; 420 else 421 event->state = FAN_EVENT_ANSWERED; 422 spin_unlock(&group->notification_lock); 423 if (destroy) 424 fsnotify_destroy_event(group, &event->fae.fse); 425 } 426 427 static int process_access_response(struct fsnotify_group *group, 428 struct fanotify_response *response_struct, 429 const char __user *info, 430 size_t info_len) 431 { 432 struct fanotify_perm_event *event; 433 int fd = response_struct->fd; 434 u32 response = response_struct->response; 435 int errno = fanotify_get_response_errno(response); 436 int ret = info_len; 437 struct fanotify_response_info_audit_rule friar; 438 439 pr_debug("%s: group=%p fd=%d response=%x errno=%d buf=%p size=%zu\n", 440 __func__, group, fd, response, errno, info, info_len); 441 /* 442 * make sure the response is valid, if invalid we do nothing and either 443 * userspace can send a valid response or we will clean it up after the 444 * timeout 445 */ 446 if (response & ~FANOTIFY_RESPONSE_VALID_MASK) 447 return -EINVAL; 448 449 switch (response & FANOTIFY_RESPONSE_ACCESS) { 450 case FAN_ALLOW: 451 if (errno) 452 return -EINVAL; 453 break; 454 case FAN_DENY: 455 /* Custom errno is supported only for pre-content groups */ 456 if (errno && group->priority != FSNOTIFY_PRIO_PRE_CONTENT) 457 return -EINVAL; 458 459 /* 460 * Limit errno to values expected on open(2)/read(2)/write(2) 461 * of regular files. 462 */ 463 switch (errno) { 464 case 0: 465 case EIO: 466 case EPERM: 467 case EBUSY: 468 case ETXTBSY: 469 case EAGAIN: 470 case ENOSPC: 471 case EDQUOT: 472 break; 473 default: 474 return -EINVAL; 475 } 476 break; 477 default: 478 return -EINVAL; 479 } 480 481 if ((response & FAN_AUDIT) && !FAN_GROUP_FLAG(group, FAN_ENABLE_AUDIT)) 482 return -EINVAL; 483 484 if (response & FAN_INFO) { 485 ret = process_access_response_info(info, info_len, &friar); 486 if (ret < 0) 487 return ret; 488 if (fd == FAN_NOFD) 489 return ret; 490 } else { 491 ret = 0; 492 } 493 494 if (fd < 0) 495 return -EINVAL; 496 497 spin_lock(&group->notification_lock); 498 list_for_each_entry(event, &group->fanotify_data.access_list, 499 fae.fse.list) { 500 if (event->fd != fd) 501 continue; 502 503 list_del_init(&event->fae.fse.list); 504 finish_permission_event(group, event, response, &friar); 505 wake_up(&group->fanotify_data.access_waitq); 506 return ret; 507 } 508 spin_unlock(&group->notification_lock); 509 510 return -ENOENT; 511 } 512 513 static size_t copy_mnt_info_to_user(struct fanotify_event *event, 514 char __user *buf, int count) 515 { 516 struct fanotify_event_info_mnt info = { }; 517 518 info.hdr.info_type = FAN_EVENT_INFO_TYPE_MNT; 519 info.hdr.len = FANOTIFY_MNT_INFO_LEN; 520 521 if (WARN_ON(count < info.hdr.len)) 522 return -EFAULT; 523 524 info.mnt_id = FANOTIFY_ME(event)->mnt_id; 525 526 if (copy_to_user(buf, &info, sizeof(info))) 527 return -EFAULT; 528 529 return info.hdr.len; 530 } 531 532 static size_t copy_error_info_to_user(struct fanotify_event *event, 533 char __user *buf, int count) 534 { 535 struct fanotify_event_info_error info = { }; 536 struct fanotify_error_event *fee = FANOTIFY_EE(event); 537 538 info.hdr.info_type = FAN_EVENT_INFO_TYPE_ERROR; 539 info.hdr.len = FANOTIFY_ERROR_INFO_LEN; 540 541 if (WARN_ON(count < info.hdr.len)) 542 return -EFAULT; 543 544 info.error = fee->error; 545 info.error_count = fee->err_count; 546 547 if (copy_to_user(buf, &info, sizeof(info))) 548 return -EFAULT; 549 550 return info.hdr.len; 551 } 552 553 static int copy_fid_info_to_user(__kernel_fsid_t *fsid, struct fanotify_fh *fh, 554 int info_type, const char *name, 555 size_t name_len, 556 char __user *buf, size_t count) 557 { 558 struct fanotify_event_info_fid info = { }; 559 struct file_handle handle = { }; 560 unsigned char bounce[FANOTIFY_INLINE_FH_LEN], *fh_buf; 561 size_t fh_len = fh ? fh->len : 0; 562 size_t info_len = fanotify_fid_info_len(fh_len, name_len); 563 size_t len = info_len; 564 565 pr_debug("%s: fh_len=%zu name_len=%zu, info_len=%zu, count=%zu\n", 566 __func__, fh_len, name_len, info_len, count); 567 568 if (WARN_ON_ONCE(len < sizeof(info) || len > count)) 569 return -EFAULT; 570 571 /* 572 * Copy event info fid header followed by variable sized file handle 573 * and optionally followed by variable sized filename. 574 */ 575 switch (info_type) { 576 case FAN_EVENT_INFO_TYPE_FID: 577 case FAN_EVENT_INFO_TYPE_DFID: 578 if (WARN_ON_ONCE(name_len)) 579 return -EFAULT; 580 break; 581 case FAN_EVENT_INFO_TYPE_DFID_NAME: 582 case FAN_EVENT_INFO_TYPE_OLD_DFID_NAME: 583 case FAN_EVENT_INFO_TYPE_NEW_DFID_NAME: 584 if (WARN_ON_ONCE(!name || !name_len)) 585 return -EFAULT; 586 break; 587 default: 588 return -EFAULT; 589 } 590 591 info.hdr.info_type = info_type; 592 info.hdr.len = len; 593 info.fsid = *fsid; 594 if (copy_to_user(buf, &info, sizeof(info))) 595 return -EFAULT; 596 597 buf += sizeof(info); 598 len -= sizeof(info); 599 if (WARN_ON_ONCE(len < sizeof(handle))) 600 return -EFAULT; 601 602 handle.handle_type = fh->type; 603 handle.handle_bytes = fh_len; 604 605 /* Mangle handle_type for bad file_handle */ 606 if (!fh_len) 607 handle.handle_type = FILEID_INVALID; 608 609 if (copy_to_user(buf, &handle, sizeof(handle))) 610 return -EFAULT; 611 612 buf += sizeof(handle); 613 len -= sizeof(handle); 614 if (WARN_ON_ONCE(len < fh_len)) 615 return -EFAULT; 616 617 /* 618 * For an inline fh and inline file name, copy through stack to exclude 619 * the copy from usercopy hardening protections. 620 */ 621 fh_buf = fanotify_fh_buf(fh); 622 if (fh_len <= FANOTIFY_INLINE_FH_LEN) { 623 memcpy(bounce, fh_buf, fh_len); 624 fh_buf = bounce; 625 } 626 if (copy_to_user(buf, fh_buf, fh_len)) 627 return -EFAULT; 628 629 buf += fh_len; 630 len -= fh_len; 631 632 if (name_len) { 633 /* Copy the filename with terminating null */ 634 name_len++; 635 if (WARN_ON_ONCE(len < name_len)) 636 return -EFAULT; 637 638 if (copy_to_user(buf, name, name_len)) 639 return -EFAULT; 640 641 buf += name_len; 642 len -= name_len; 643 } 644 645 /* Pad with 0's */ 646 WARN_ON_ONCE(len < 0 || len >= FANOTIFY_EVENT_ALIGN); 647 if (len > 0 && clear_user(buf, len)) 648 return -EFAULT; 649 650 return info_len; 651 } 652 653 static int copy_pidfd_info_to_user(int pidfd, 654 char __user *buf, 655 size_t count) 656 { 657 struct fanotify_event_info_pidfd info = { }; 658 size_t info_len = FANOTIFY_PIDFD_INFO_LEN; 659 660 if (WARN_ON_ONCE(info_len > count)) 661 return -EFAULT; 662 663 info.hdr.info_type = FAN_EVENT_INFO_TYPE_PIDFD; 664 info.hdr.len = info_len; 665 info.pidfd = pidfd; 666 667 if (copy_to_user(buf, &info, info_len)) 668 return -EFAULT; 669 670 return info_len; 671 } 672 673 static size_t copy_range_info_to_user(struct fanotify_event *event, 674 char __user *buf, int count) 675 { 676 struct fanotify_perm_event *pevent = FANOTIFY_PERM(event); 677 struct fanotify_event_info_range info = { }; 678 size_t info_len = FANOTIFY_RANGE_INFO_LEN; 679 680 if (WARN_ON_ONCE(info_len > count)) 681 return -EFAULT; 682 683 info.hdr.info_type = FAN_EVENT_INFO_TYPE_RANGE; 684 info.hdr.len = info_len; 685 info.offset = pevent->pos; 686 info.count = pevent->count; 687 688 if (copy_to_user(buf, &info, info_len)) 689 return -EFAULT; 690 691 return info_len; 692 } 693 694 static int copy_info_records_to_user(struct fanotify_event *event, 695 struct fanotify_info *info, 696 unsigned int info_mode, int pidfd, 697 char __user *buf, size_t count) 698 { 699 int ret, total_bytes = 0, info_type = 0; 700 unsigned int fid_mode = info_mode & FANOTIFY_FID_BITS; 701 unsigned int pidfd_mode = info_mode & FAN_REPORT_PIDFD; 702 703 /* 704 * Event info records order is as follows: 705 * 1. dir fid + name 706 * 2. (optional) new dir fid + new name 707 * 3. (optional) child fid 708 */ 709 if (fanotify_event_has_dir_fh(event)) { 710 info_type = info->name_len ? FAN_EVENT_INFO_TYPE_DFID_NAME : 711 FAN_EVENT_INFO_TYPE_DFID; 712 713 /* FAN_RENAME uses special info types */ 714 if (event->mask & FAN_RENAME) 715 info_type = FAN_EVENT_INFO_TYPE_OLD_DFID_NAME; 716 717 ret = copy_fid_info_to_user(fanotify_event_fsid(event), 718 fanotify_info_dir_fh(info), 719 info_type, 720 fanotify_info_name(info), 721 info->name_len, buf, count); 722 if (ret < 0) 723 return ret; 724 725 buf += ret; 726 count -= ret; 727 total_bytes += ret; 728 } 729 730 /* New dir fid+name may be reported in addition to old dir fid+name */ 731 if (fanotify_event_has_dir2_fh(event)) { 732 info_type = FAN_EVENT_INFO_TYPE_NEW_DFID_NAME; 733 ret = copy_fid_info_to_user(fanotify_event_fsid(event), 734 fanotify_info_dir2_fh(info), 735 info_type, 736 fanotify_info_name2(info), 737 info->name2_len, buf, count); 738 if (ret < 0) 739 return ret; 740 741 buf += ret; 742 count -= ret; 743 total_bytes += ret; 744 } 745 746 if (fanotify_event_has_object_fh(event)) { 747 const char *dot = NULL; 748 int dot_len = 0; 749 750 if (fid_mode == FAN_REPORT_FID || info_type) { 751 /* 752 * With only group flag FAN_REPORT_FID only type FID is 753 * reported. Second info record type is always FID. 754 */ 755 info_type = FAN_EVENT_INFO_TYPE_FID; 756 } else if ((fid_mode & FAN_REPORT_NAME) && 757 (event->mask & FAN_ONDIR)) { 758 /* 759 * With group flag FAN_REPORT_NAME, if name was not 760 * recorded in an event on a directory, report the name 761 * "." with info type DFID_NAME. 762 */ 763 info_type = FAN_EVENT_INFO_TYPE_DFID_NAME; 764 dot = "."; 765 dot_len = 1; 766 } else if ((event->mask & ALL_FSNOTIFY_DIRENT_EVENTS) || 767 (event->mask & FAN_ONDIR)) { 768 /* 769 * With group flag FAN_REPORT_DIR_FID, a single info 770 * record has type DFID for directory entry modification 771 * event and for event on a directory. 772 */ 773 info_type = FAN_EVENT_INFO_TYPE_DFID; 774 } else { 775 /* 776 * With group flags FAN_REPORT_DIR_FID|FAN_REPORT_FID, 777 * a single info record has type FID for event on a 778 * non-directory, when there is no directory to report. 779 * For example, on FAN_DELETE_SELF event. 780 */ 781 info_type = FAN_EVENT_INFO_TYPE_FID; 782 } 783 784 ret = copy_fid_info_to_user(fanotify_event_fsid(event), 785 fanotify_event_object_fh(event), 786 info_type, dot, dot_len, 787 buf, count); 788 if (ret < 0) 789 return ret; 790 791 buf += ret; 792 count -= ret; 793 total_bytes += ret; 794 } 795 796 if (pidfd_mode) { 797 ret = copy_pidfd_info_to_user(pidfd, buf, count); 798 if (ret < 0) 799 return ret; 800 801 buf += ret; 802 count -= ret; 803 total_bytes += ret; 804 } 805 806 if (fanotify_is_error_event(event->mask)) { 807 ret = copy_error_info_to_user(event, buf, count); 808 if (ret < 0) 809 return ret; 810 buf += ret; 811 count -= ret; 812 total_bytes += ret; 813 } 814 815 if (fanotify_event_has_access_range(event)) { 816 ret = copy_range_info_to_user(event, buf, count); 817 if (ret < 0) 818 return ret; 819 buf += ret; 820 count -= ret; 821 total_bytes += ret; 822 } 823 824 if (fanotify_is_mnt_event(event->mask)) { 825 ret = copy_mnt_info_to_user(event, buf, count); 826 if (ret < 0) 827 return ret; 828 buf += ret; 829 count -= ret; 830 total_bytes += ret; 831 } 832 833 return total_bytes; 834 } 835 836 static ssize_t copy_event_to_user(struct fsnotify_group *group, 837 struct fanotify_event *event, 838 char __user *buf, size_t count) 839 { 840 struct fanotify_event_metadata metadata; 841 const struct path *path = fanotify_event_path(event); 842 struct fanotify_info *info = fanotify_event_info(event); 843 unsigned int info_mode = FAN_GROUP_FLAG(group, FANOTIFY_INFO_MODES); 844 unsigned int pidfd_mode = info_mode & FAN_REPORT_PIDFD; 845 struct file *f = NULL, *pidfd_file = NULL; 846 int ret, pidfd = -ESRCH, fd = -EBADF; 847 848 pr_debug("%s: group=%p event=%p\n", __func__, group, event); 849 850 metadata.event_len = fanotify_event_len(info_mode, event); 851 metadata.metadata_len = FAN_EVENT_METADATA_LEN; 852 metadata.vers = FANOTIFY_METADATA_VERSION; 853 metadata.reserved = 0; 854 metadata.mask = event->mask & FANOTIFY_OUTGOING_EVENTS; 855 metadata.pid = pid_vnr(event->pid); 856 /* 857 * For an unprivileged listener, event->pid can be used to identify the 858 * events generated by the listener process itself, without disclosing 859 * the pids of other processes. 860 */ 861 if (FAN_GROUP_FLAG(group, FANOTIFY_UNPRIV) && 862 task_tgid(current) != event->pid) 863 metadata.pid = 0; 864 865 /* 866 * For now, fid mode is required for an unprivileged listener and 867 * fid mode does not report fd in events. Keep this check anyway 868 * for safety in case fid mode requirement is relaxed in the future 869 * to allow unprivileged listener to get events with no fd and no fid. 870 */ 871 if (!FAN_GROUP_FLAG(group, FANOTIFY_UNPRIV) && 872 path && path->mnt && path->dentry) { 873 fd = create_fd(group, path, &f); 874 /* 875 * Opening an fd from dentry can fail for several reasons. 876 * For example, when tasks are gone and we try to open their 877 * /proc files or we try to open a WRONLY file like in sysfs 878 * or when trying to open a file that was deleted on the 879 * remote network server. 880 * 881 * For a group with FAN_REPORT_FD_ERROR, we will send the 882 * event with the error instead of the open fd, otherwise 883 * Userspace may not get the error at all. 884 * In any case, userspace will not know which file failed to 885 * open, so add a debug print for further investigation. 886 */ 887 if (fd < 0) { 888 pr_debug("fanotify: create_fd(%pd2) failed err=%d\n", 889 path->dentry, fd); 890 if (!FAN_GROUP_FLAG(group, FAN_REPORT_FD_ERROR)) { 891 /* 892 * Historically, we've handled EOPENSTALE in a 893 * special way and silently dropped such 894 * events. Now we have to keep it to maintain 895 * backward compatibility... 896 */ 897 if (fd == -EOPENSTALE) 898 fd = 0; 899 return fd; 900 } 901 } 902 } 903 if (FAN_GROUP_FLAG(group, FAN_REPORT_FD_ERROR)) 904 metadata.fd = fd; 905 else 906 metadata.fd = fd >= 0 ? fd : FAN_NOFD; 907 908 if (pidfd_mode) { 909 unsigned int pidfd_flags = PIDFD_STALE; 910 911 if (FAN_GROUP_FLAG(group, FAN_REPORT_TID)) 912 pidfd_flags |= PIDFD_THREAD; 913 914 if (metadata.pid) 915 pidfd = pidfd_prepare(event->pid, pidfd_flags, &pidfd_file); 916 917 if (!FAN_GROUP_FLAG(group, FAN_REPORT_FD_ERROR) && pidfd < 0) 918 pidfd = pidfd == -ESRCH ? FAN_NOPIDFD : FAN_EPIDFD; 919 } 920 921 ret = -EFAULT; 922 /* 923 * Sanity check copy size in case get_one_event() and 924 * event_len sizes ever get out of sync. 925 */ 926 if (WARN_ON_ONCE(metadata.event_len > count)) 927 goto out_close_fd; 928 929 if (copy_to_user(buf, &metadata, FAN_EVENT_METADATA_LEN)) 930 goto out_close_fd; 931 932 buf += FAN_EVENT_METADATA_LEN; 933 count -= FAN_EVENT_METADATA_LEN; 934 935 ret = copy_info_records_to_user(event, info, info_mode, pidfd, 936 buf, count); 937 if (ret < 0) 938 goto out_close_fd; 939 940 if (f) 941 fd_install(fd, f); 942 943 if (pidfd_file) 944 fd_install(pidfd, pidfd_file); 945 946 if (fanotify_is_perm_event(event->mask)) 947 FANOTIFY_PERM(event)->fd = fd; 948 949 return metadata.event_len; 950 951 out_close_fd: 952 if (f) { 953 put_unused_fd(fd); 954 fput(f); 955 } 956 957 if (pidfd_file) { 958 put_unused_fd(pidfd); 959 fput(pidfd_file); 960 } 961 962 return ret; 963 } 964 965 /* intofiy userspace file descriptor functions */ 966 static __poll_t fanotify_poll(struct file *file, poll_table *wait) 967 { 968 struct fsnotify_group *group = file->private_data; 969 __poll_t ret = 0; 970 971 poll_wait(file, &group->notification_waitq, wait); 972 spin_lock(&group->notification_lock); 973 if (!fsnotify_notify_queue_is_empty(group)) 974 ret = EPOLLIN | EPOLLRDNORM; 975 spin_unlock(&group->notification_lock); 976 977 return ret; 978 } 979 980 static ssize_t fanotify_read(struct file *file, char __user *buf, 981 size_t count, loff_t *pos) 982 { 983 struct fsnotify_group *group; 984 struct fanotify_event *event; 985 char __user *start; 986 int ret; 987 DEFINE_WAIT_FUNC(wait, woken_wake_function); 988 989 start = buf; 990 group = file->private_data; 991 992 pr_debug("%s: group=%p\n", __func__, group); 993 994 add_wait_queue(&group->notification_waitq, &wait); 995 while (1) { 996 /* 997 * User can supply arbitrarily large buffer. Avoid softlockups 998 * in case there are lots of available events. 999 */ 1000 cond_resched(); 1001 event = get_one_event(group, count); 1002 if (IS_ERR(event)) { 1003 ret = PTR_ERR(event); 1004 break; 1005 } 1006 1007 if (!event) { 1008 ret = -EAGAIN; 1009 if (file->f_flags & O_NONBLOCK) 1010 break; 1011 1012 ret = -ERESTARTSYS; 1013 if (signal_pending(current)) 1014 break; 1015 1016 if (start != buf) 1017 break; 1018 1019 wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT); 1020 continue; 1021 } 1022 1023 ret = copy_event_to_user(group, event, buf, count); 1024 1025 /* 1026 * Permission events get queued to wait for response. Other 1027 * events can be destroyed now. 1028 */ 1029 if (!fanotify_is_perm_event(event->mask)) { 1030 fsnotify_destroy_event(group, &event->fse); 1031 } else { 1032 if (ret <= 0 || FANOTIFY_PERM(event)->fd < 0) { 1033 spin_lock(&group->notification_lock); 1034 finish_permission_event(group, 1035 FANOTIFY_PERM(event), FAN_DENY, NULL); 1036 wake_up(&group->fanotify_data.access_waitq); 1037 } else { 1038 spin_lock(&group->notification_lock); 1039 list_add_tail(&event->fse.list, 1040 &group->fanotify_data.access_list); 1041 FANOTIFY_PERM(event)->recv_pid = current->pid; 1042 spin_unlock(&group->notification_lock); 1043 } 1044 } 1045 if (ret < 0) 1046 break; 1047 buf += ret; 1048 count -= ret; 1049 } 1050 remove_wait_queue(&group->notification_waitq, &wait); 1051 1052 if (start != buf && ret != -EFAULT) 1053 ret = buf - start; 1054 return ret; 1055 } 1056 1057 static ssize_t fanotify_write(struct file *file, const char __user *buf, size_t count, loff_t *pos) 1058 { 1059 struct fanotify_response response; 1060 struct fsnotify_group *group; 1061 int ret; 1062 const char __user *info_buf = buf + sizeof(struct fanotify_response); 1063 size_t info_len; 1064 1065 if (!IS_ENABLED(CONFIG_FANOTIFY_ACCESS_PERMISSIONS)) 1066 return -EINVAL; 1067 1068 group = file->private_data; 1069 1070 pr_debug("%s: group=%p count=%zu\n", __func__, group, count); 1071 1072 if (count < sizeof(response)) 1073 return -EINVAL; 1074 1075 if (copy_from_user(&response, buf, sizeof(response))) 1076 return -EFAULT; 1077 1078 info_len = count - sizeof(response); 1079 1080 ret = process_access_response(group, &response, info_buf, info_len); 1081 if (ret < 0) 1082 count = ret; 1083 else 1084 count = sizeof(response) + ret; 1085 1086 return count; 1087 } 1088 1089 static int fanotify_release(struct inode *ignored, struct file *file) 1090 { 1091 struct fsnotify_group *group = file->private_data; 1092 struct fsnotify_event *fsn_event; 1093 1094 /* 1095 * Stop new events from arriving in the notification queue. since 1096 * userspace cannot use fanotify fd anymore, no event can enter or 1097 * leave access_list by now either. 1098 */ 1099 fsnotify_group_stop_queueing(group); 1100 1101 fanotify_perm_watchdog_group_remove(group); 1102 1103 /* 1104 * Process all permission events on access_list and notification queue 1105 * and simulate reply from userspace. 1106 */ 1107 spin_lock(&group->notification_lock); 1108 while (!list_empty(&group->fanotify_data.access_list)) { 1109 struct fanotify_perm_event *event; 1110 1111 event = list_first_entry(&group->fanotify_data.access_list, 1112 struct fanotify_perm_event, fae.fse.list); 1113 list_del_init(&event->fae.fse.list); 1114 finish_permission_event(group, event, FAN_ALLOW, NULL); 1115 spin_lock(&group->notification_lock); 1116 } 1117 1118 /* 1119 * Destroy all non-permission events. For permission events just 1120 * dequeue them and set the response. They will be freed once the 1121 * response is consumed and fanotify_get_response() returns. 1122 */ 1123 while ((fsn_event = fsnotify_remove_first_event(group))) { 1124 struct fanotify_event *event = FANOTIFY_E(fsn_event); 1125 1126 if (!(event->mask & FANOTIFY_PERM_EVENTS)) { 1127 spin_unlock(&group->notification_lock); 1128 fsnotify_destroy_event(group, fsn_event); 1129 } else { 1130 finish_permission_event(group, FANOTIFY_PERM(event), 1131 FAN_ALLOW, NULL); 1132 } 1133 spin_lock(&group->notification_lock); 1134 } 1135 spin_unlock(&group->notification_lock); 1136 1137 /* Response for all permission events it set, wakeup waiters */ 1138 wake_up(&group->fanotify_data.access_waitq); 1139 1140 /* matches the fanotify_init->fsnotify_alloc_group */ 1141 fsnotify_destroy_group(group); 1142 1143 return 0; 1144 } 1145 1146 static long fanotify_ioctl(struct file *file, unsigned int cmd, unsigned long arg) 1147 { 1148 struct fsnotify_group *group; 1149 struct fsnotify_event *fsn_event; 1150 unsigned int info_mode; 1151 void __user *p; 1152 int ret = -ENOTTY; 1153 size_t send_len = 0; 1154 1155 group = file->private_data; 1156 info_mode = FAN_GROUP_FLAG(group, FANOTIFY_INFO_MODES); 1157 1158 p = (void __user *) arg; 1159 1160 switch (cmd) { 1161 case FIONREAD: 1162 spin_lock(&group->notification_lock); 1163 list_for_each_entry(fsn_event, &group->notification_list, list) 1164 send_len += fanotify_event_len(info_mode, 1165 FANOTIFY_E(fsn_event)); 1166 spin_unlock(&group->notification_lock); 1167 ret = put_user(send_len, (int __user *) p); 1168 break; 1169 } 1170 1171 return ret; 1172 } 1173 1174 static const struct file_operations fanotify_fops = { 1175 .show_fdinfo = fanotify_show_fdinfo, 1176 .poll = fanotify_poll, 1177 .read = fanotify_read, 1178 .write = fanotify_write, 1179 .fasync = NULL, 1180 .release = fanotify_release, 1181 .unlocked_ioctl = fanotify_ioctl, 1182 .compat_ioctl = compat_ptr_ioctl, 1183 .llseek = noop_llseek, 1184 }; 1185 1186 static int fanotify_find_path(int dfd, const char __user *filename, 1187 struct path *path, unsigned int flags, __u64 mask, 1188 unsigned int obj_type) 1189 { 1190 int ret; 1191 1192 pr_debug("%s: dfd=%d filename=%p flags=%x\n", __func__, 1193 dfd, filename, flags); 1194 1195 if (filename == NULL) { 1196 CLASS(fd, f)(dfd); 1197 1198 if (fd_empty(f)) 1199 return -EBADF; 1200 1201 if ((flags & FAN_MARK_ONLYDIR) && 1202 !(S_ISDIR(file_inode(fd_file(f))->i_mode))) 1203 return -ENOTDIR; 1204 1205 *path = fd_file(f)->f_path; 1206 path_get(path); 1207 ret = 0; 1208 } else { 1209 unsigned int lookup_flags = 0; 1210 1211 if (!(flags & FAN_MARK_DONT_FOLLOW)) 1212 lookup_flags |= LOOKUP_FOLLOW; 1213 if (flags & FAN_MARK_ONLYDIR) 1214 lookup_flags |= LOOKUP_DIRECTORY; 1215 1216 ret = user_path_at(dfd, filename, lookup_flags, path); 1217 } 1218 return ret; 1219 } 1220 1221 static __u32 fanotify_mark_remove_from_mask(struct fsnotify_mark *fsn_mark, 1222 __u32 mask, unsigned int flags, 1223 __u32 umask, int *destroy) 1224 { 1225 __u32 oldmask, newmask; 1226 1227 /* umask bits cannot be removed by user */ 1228 mask &= ~umask; 1229 spin_lock(&fsn_mark->lock); 1230 oldmask = fsnotify_calc_mask(fsn_mark); 1231 if (!(flags & FANOTIFY_MARK_IGNORE_BITS)) { 1232 fsn_mark->mask &= ~mask; 1233 } else { 1234 fsn_mark->ignore_mask &= ~mask; 1235 } 1236 newmask = fsnotify_calc_mask(fsn_mark); 1237 /* 1238 * We need to keep the mark around even if remaining mask cannot 1239 * result in any events (e.g. mask == FAN_ONDIR) to support incremenal 1240 * changes to the mask. 1241 * Destroy mark when only umask bits remain. 1242 */ 1243 *destroy = !((fsn_mark->mask | fsn_mark->ignore_mask) & ~umask); 1244 spin_unlock(&fsn_mark->lock); 1245 1246 return oldmask & ~newmask; 1247 } 1248 1249 static int fanotify_remove_mark(struct fsnotify_group *group, 1250 void *obj, unsigned int obj_type, __u32 mask, 1251 unsigned int flags, __u32 umask) 1252 { 1253 struct fsnotify_mark *fsn_mark = NULL; 1254 __u32 removed; 1255 int destroy_mark; 1256 1257 fsnotify_group_lock(group); 1258 fsn_mark = fsnotify_find_mark(obj, obj_type, group); 1259 if (!fsn_mark) { 1260 fsnotify_group_unlock(group); 1261 return -ENOENT; 1262 } 1263 1264 removed = fanotify_mark_remove_from_mask(fsn_mark, mask, flags, 1265 umask, &destroy_mark); 1266 if (removed & fsnotify_conn_mask(fsn_mark->connector)) 1267 fsnotify_recalc_mask(fsn_mark->connector); 1268 if (destroy_mark) 1269 fsnotify_detach_mark(fsn_mark); 1270 fsnotify_group_unlock(group); 1271 if (destroy_mark) 1272 fsnotify_free_mark(fsn_mark); 1273 1274 /* matches the fsnotify_find_mark() */ 1275 fsnotify_put_mark(fsn_mark); 1276 return 0; 1277 } 1278 1279 static bool fanotify_mark_update_flags(struct fsnotify_mark *fsn_mark, 1280 unsigned int fan_flags) 1281 { 1282 bool want_iref = !(fan_flags & FAN_MARK_EVICTABLE); 1283 unsigned int ignore = fan_flags & FANOTIFY_MARK_IGNORE_BITS; 1284 bool recalc = false; 1285 1286 /* 1287 * When using FAN_MARK_IGNORE for the first time, mark starts using 1288 * independent event flags in ignore mask. After that, trying to 1289 * update the ignore mask with the old FAN_MARK_IGNORED_MASK API 1290 * will result in EEXIST error. 1291 */ 1292 if (ignore == FAN_MARK_IGNORE) 1293 fsn_mark->flags |= FSNOTIFY_MARK_FLAG_HAS_IGNORE_FLAGS; 1294 1295 /* 1296 * Setting FAN_MARK_IGNORED_SURV_MODIFY for the first time may lead to 1297 * the removal of the FS_MODIFY bit in calculated mask if it was set 1298 * because of an ignore mask that is now going to survive FS_MODIFY. 1299 */ 1300 if (ignore && (fan_flags & FAN_MARK_IGNORED_SURV_MODIFY) && 1301 !(fsn_mark->flags & FSNOTIFY_MARK_FLAG_IGNORED_SURV_MODIFY)) { 1302 fsn_mark->flags |= FSNOTIFY_MARK_FLAG_IGNORED_SURV_MODIFY; 1303 if (!(fsn_mark->mask & FS_MODIFY)) 1304 recalc = true; 1305 } 1306 1307 if (fsn_mark->connector->type != FSNOTIFY_OBJ_TYPE_INODE || 1308 want_iref == !(fsn_mark->flags & FSNOTIFY_MARK_FLAG_NO_IREF)) 1309 return recalc; 1310 1311 /* 1312 * NO_IREF may be removed from a mark, but not added. 1313 * When removed, fsnotify_recalc_mask() will take the inode ref. 1314 */ 1315 WARN_ON_ONCE(!want_iref); 1316 fsn_mark->flags &= ~FSNOTIFY_MARK_FLAG_NO_IREF; 1317 1318 return true; 1319 } 1320 1321 static bool fanotify_mark_add_to_mask(struct fsnotify_mark *fsn_mark, 1322 __u32 mask, unsigned int fan_flags) 1323 { 1324 __u32 old_mask; 1325 bool recalc; 1326 1327 spin_lock(&fsn_mark->lock); 1328 if (!(fan_flags & FANOTIFY_MARK_IGNORE_BITS)) { 1329 old_mask = fsn_mark->mask; 1330 fsn_mark->mask |= mask; 1331 recalc = old_mask != fsn_mark->mask; 1332 } else { 1333 fsn_mark->ignore_mask |= mask; 1334 recalc = true; 1335 } 1336 1337 recalc |= fanotify_mark_update_flags(fsn_mark, fan_flags); 1338 spin_unlock(&fsn_mark->lock); 1339 1340 return recalc; 1341 } 1342 1343 struct fan_fsid { 1344 struct super_block *sb; 1345 __kernel_fsid_t id; 1346 bool weak; 1347 }; 1348 1349 static int fanotify_set_mark_fsid(struct fsnotify_group *group, 1350 struct fsnotify_mark *mark, 1351 struct fan_fsid *fsid) 1352 { 1353 struct fsnotify_mark_connector *conn; 1354 struct fsnotify_mark *old; 1355 struct super_block *old_sb = NULL; 1356 1357 FANOTIFY_MARK(mark)->fsid = fsid->id; 1358 mark->flags |= FSNOTIFY_MARK_FLAG_HAS_FSID; 1359 if (fsid->weak) 1360 mark->flags |= FSNOTIFY_MARK_FLAG_WEAK_FSID; 1361 1362 /* First mark added will determine if group is single or multi fsid */ 1363 if (list_empty(&group->marks_list)) 1364 return 0; 1365 1366 /* Find sb of an existing mark */ 1367 list_for_each_entry(old, &group->marks_list, g_list) { 1368 conn = READ_ONCE(old->connector); 1369 if (!conn) 1370 continue; 1371 old_sb = fsnotify_connector_sb(conn); 1372 if (old_sb) 1373 break; 1374 } 1375 1376 /* Only detached marks left? */ 1377 if (!old_sb) 1378 return 0; 1379 1380 /* Do not allow mixing of marks with weak and strong fsid */ 1381 if ((mark->flags ^ old->flags) & FSNOTIFY_MARK_FLAG_WEAK_FSID) 1382 return -EXDEV; 1383 1384 /* Allow mixing of marks with strong fsid from different fs */ 1385 if (!fsid->weak) 1386 return 0; 1387 1388 /* Do not allow mixing marks with weak fsid from different fs */ 1389 if (old_sb != fsid->sb) 1390 return -EXDEV; 1391 1392 /* Do not allow mixing marks from different btrfs sub-volumes */ 1393 if (!fanotify_fsid_equal(&FANOTIFY_MARK(old)->fsid, 1394 &FANOTIFY_MARK(mark)->fsid)) 1395 return -EXDEV; 1396 1397 return 0; 1398 } 1399 1400 static struct fsnotify_mark *fanotify_add_new_mark(struct fsnotify_group *group, 1401 void *obj, 1402 unsigned int obj_type, 1403 unsigned int fan_flags, 1404 struct fan_fsid *fsid) 1405 { 1406 struct ucounts *ucounts = group->fanotify_data.ucounts; 1407 struct fanotify_mark *fan_mark; 1408 struct fsnotify_mark *mark; 1409 int ret; 1410 1411 /* 1412 * Enforce per user marks limits per user in all containing user ns. 1413 * A group with FAN_UNLIMITED_MARKS does not contribute to mark count 1414 * in the limited groups account. 1415 */ 1416 BUILD_BUG_ON(!(FANOTIFY_ADMIN_INIT_FLAGS & FAN_UNLIMITED_MARKS)); 1417 if (!FAN_GROUP_FLAG(group, FAN_UNLIMITED_MARKS) && 1418 !inc_ucount(ucounts->ns, ucounts->uid, UCOUNT_FANOTIFY_MARKS)) 1419 return ERR_PTR(-ENOSPC); 1420 1421 fan_mark = kmem_cache_alloc(fanotify_mark_cache, GFP_KERNEL); 1422 if (!fan_mark) { 1423 ret = -ENOMEM; 1424 goto out_dec_ucounts; 1425 } 1426 1427 mark = &fan_mark->fsn_mark; 1428 fsnotify_init_mark(mark, group); 1429 if (fan_flags & FAN_MARK_EVICTABLE) 1430 mark->flags |= FSNOTIFY_MARK_FLAG_NO_IREF; 1431 1432 /* Cache fsid of filesystem containing the marked object */ 1433 if (fsid) { 1434 ret = fanotify_set_mark_fsid(group, mark, fsid); 1435 if (ret) 1436 goto out_put_mark; 1437 } else { 1438 fan_mark->fsid.val[0] = fan_mark->fsid.val[1] = 0; 1439 } 1440 1441 ret = fsnotify_add_mark_locked(mark, obj, obj_type, 0); 1442 if (ret) 1443 goto out_put_mark; 1444 1445 return mark; 1446 1447 out_put_mark: 1448 fsnotify_put_mark(mark); 1449 out_dec_ucounts: 1450 if (!FAN_GROUP_FLAG(group, FAN_UNLIMITED_MARKS)) 1451 dec_ucount(ucounts, UCOUNT_FANOTIFY_MARKS); 1452 return ERR_PTR(ret); 1453 } 1454 1455 static int fanotify_group_init_error_pool(struct fsnotify_group *group) 1456 { 1457 if (mempool_initialized(&group->fanotify_data.error_events_pool)) 1458 return 0; 1459 1460 return mempool_init_kmalloc_pool(&group->fanotify_data.error_events_pool, 1461 FANOTIFY_DEFAULT_FEE_POOL_SIZE, 1462 sizeof(struct fanotify_error_event)); 1463 } 1464 1465 static int fanotify_may_update_existing_mark(struct fsnotify_mark *fsn_mark, 1466 __u32 mask, unsigned int fan_flags) 1467 { 1468 /* 1469 * Non evictable mark cannot be downgraded to evictable mark. 1470 */ 1471 if (fan_flags & FAN_MARK_EVICTABLE && 1472 !(fsn_mark->flags & FSNOTIFY_MARK_FLAG_NO_IREF)) 1473 return -EEXIST; 1474 1475 /* 1476 * New ignore mask semantics cannot be downgraded to old semantics. 1477 */ 1478 if (fan_flags & FAN_MARK_IGNORED_MASK && 1479 fsn_mark->flags & FSNOTIFY_MARK_FLAG_HAS_IGNORE_FLAGS) 1480 return -EEXIST; 1481 1482 /* 1483 * An ignore mask that survives modify could never be downgraded to not 1484 * survive modify. With new FAN_MARK_IGNORE semantics we make that rule 1485 * explicit and return an error when trying to update the ignore mask 1486 * without the original FAN_MARK_IGNORED_SURV_MODIFY value. 1487 */ 1488 if (fan_flags & FAN_MARK_IGNORE && 1489 !(fan_flags & FAN_MARK_IGNORED_SURV_MODIFY) && 1490 fsn_mark->flags & FSNOTIFY_MARK_FLAG_IGNORED_SURV_MODIFY) 1491 return -EEXIST; 1492 1493 /* For now pre-content events are not generated for directories */ 1494 mask |= fsn_mark->mask; 1495 if (mask & FANOTIFY_PRE_CONTENT_EVENTS && mask & FAN_ONDIR) 1496 return -EEXIST; 1497 1498 return 0; 1499 } 1500 1501 static int fanotify_add_mark(struct fsnotify_group *group, 1502 void *obj, unsigned int obj_type, 1503 __u32 mask, unsigned int fan_flags, 1504 struct fan_fsid *fsid) 1505 { 1506 struct fsnotify_mark *fsn_mark; 1507 bool recalc; 1508 int ret = 0; 1509 1510 fsnotify_group_lock(group); 1511 fsn_mark = fsnotify_find_mark(obj, obj_type, group); 1512 if (!fsn_mark) { 1513 fsn_mark = fanotify_add_new_mark(group, obj, obj_type, 1514 fan_flags, fsid); 1515 if (IS_ERR(fsn_mark)) { 1516 fsnotify_group_unlock(group); 1517 return PTR_ERR(fsn_mark); 1518 } 1519 } 1520 1521 /* 1522 * Check if requested mark flags conflict with an existing mark flags. 1523 */ 1524 ret = fanotify_may_update_existing_mark(fsn_mark, mask, fan_flags); 1525 if (ret) 1526 goto out; 1527 1528 /* 1529 * Error events are pre-allocated per group, only if strictly 1530 * needed (i.e. FAN_FS_ERROR was requested). 1531 */ 1532 if (!(fan_flags & FANOTIFY_MARK_IGNORE_BITS) && 1533 (mask & FAN_FS_ERROR)) { 1534 ret = fanotify_group_init_error_pool(group); 1535 if (ret) 1536 goto out; 1537 } 1538 1539 recalc = fanotify_mark_add_to_mask(fsn_mark, mask, fan_flags); 1540 if (recalc) 1541 fsnotify_recalc_mask(fsn_mark->connector); 1542 1543 out: 1544 fsnotify_group_unlock(group); 1545 1546 fsnotify_put_mark(fsn_mark); 1547 1548 if (!ret && (mask & FANOTIFY_PERM_EVENTS)) 1549 fanotify_perm_watchdog_group_add(group); 1550 1551 return ret; 1552 } 1553 1554 static struct fsnotify_event *fanotify_alloc_overflow_event(void) 1555 { 1556 struct fanotify_event *oevent; 1557 1558 oevent = kmalloc_obj(*oevent, GFP_KERNEL_ACCOUNT); 1559 if (!oevent) 1560 return NULL; 1561 1562 fanotify_init_event(oevent, 0, FS_Q_OVERFLOW); 1563 oevent->type = FANOTIFY_EVENT_TYPE_OVERFLOW; 1564 1565 return &oevent->fse; 1566 } 1567 1568 static struct hlist_head *fanotify_alloc_merge_hash(void) 1569 { 1570 struct hlist_head *hash; 1571 1572 hash = kmalloc(sizeof(struct hlist_head) << FANOTIFY_HTABLE_BITS, 1573 GFP_KERNEL_ACCOUNT); 1574 if (!hash) 1575 return NULL; 1576 1577 __hash_init(hash, FANOTIFY_HTABLE_SIZE); 1578 1579 return hash; 1580 } 1581 1582 DEFINE_CLASS(fsnotify_group, 1583 struct fsnotify_group *, 1584 if (!IS_ERR_OR_NULL(_T)) fsnotify_destroy_group(_T), 1585 fsnotify_alloc_group(ops, flags), 1586 const struct fsnotify_ops *ops, int flags) 1587 1588 /* fanotify syscalls */ 1589 SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags) 1590 { 1591 struct user_namespace *user_ns = current_user_ns(); 1592 int f_flags, fd; 1593 unsigned int fid_mode = flags & FANOTIFY_FID_BITS; 1594 unsigned int class = flags & FANOTIFY_CLASS_BITS; 1595 unsigned int internal_flags = 0; 1596 1597 pr_debug("%s: flags=%x event_f_flags=%x\n", 1598 __func__, flags, event_f_flags); 1599 1600 /* 1601 * An unprivileged user can setup an fanotify group with limited 1602 * functionality - an unprivileged group is limited to notification 1603 * events with file handles or mount ids and it cannot use unlimited 1604 * queue/marks. 1605 */ 1606 if (((flags & FANOTIFY_ADMIN_INIT_FLAGS) || 1607 !(flags & (FANOTIFY_FID_BITS | FAN_REPORT_MNT))) && 1608 !capable(CAP_SYS_ADMIN)) 1609 return -EPERM; 1610 1611 if (!ns_capable_noaudit(&init_user_ns, CAP_SYS_ADMIN)) { 1612 /* 1613 * Setting the internal flag FANOTIFY_UNPRIV on the group 1614 * prevents setting mount/filesystem marks on this group and 1615 * prevents reporting pid and open fd in events. 1616 */ 1617 internal_flags |= FANOTIFY_UNPRIV; 1618 } 1619 1620 #ifdef CONFIG_AUDITSYSCALL 1621 if (flags & ~(FANOTIFY_INIT_FLAGS | FAN_ENABLE_AUDIT)) 1622 #else 1623 if (flags & ~FANOTIFY_INIT_FLAGS) 1624 #endif 1625 return -EINVAL; 1626 1627 /* Don't allow mixing mnt events with inode events for now */ 1628 if (flags & FAN_REPORT_MNT) { 1629 if (class != FAN_CLASS_NOTIF) 1630 return -EINVAL; 1631 if (flags & (FANOTIFY_FID_BITS | FAN_REPORT_FD_ERROR)) 1632 return -EINVAL; 1633 } 1634 1635 if (event_f_flags & ~FANOTIFY_INIT_ALL_EVENT_F_BITS) 1636 return -EINVAL; 1637 1638 switch (event_f_flags & O_ACCMODE) { 1639 case O_RDONLY: 1640 case O_RDWR: 1641 case O_WRONLY: 1642 break; 1643 default: 1644 return -EINVAL; 1645 } 1646 1647 if (fid_mode && class != FAN_CLASS_NOTIF) 1648 return -EINVAL; 1649 1650 /* 1651 * Child name is reported with parent fid so requires dir fid. 1652 * We can report both child fid and dir fid with or without name. 1653 */ 1654 if ((fid_mode & FAN_REPORT_NAME) && !(fid_mode & FAN_REPORT_DIR_FID)) 1655 return -EINVAL; 1656 1657 /* 1658 * FAN_REPORT_TARGET_FID requires FAN_REPORT_NAME and FAN_REPORT_FID 1659 * and is used as an indication to report both dir and child fid on all 1660 * dirent events. 1661 */ 1662 if ((fid_mode & FAN_REPORT_TARGET_FID) && 1663 (!(fid_mode & FAN_REPORT_NAME) || !(fid_mode & FAN_REPORT_FID))) 1664 return -EINVAL; 1665 1666 f_flags = O_RDWR; 1667 if (flags & FAN_CLOEXEC) 1668 f_flags |= O_CLOEXEC; 1669 if (flags & FAN_NONBLOCK) 1670 f_flags |= O_NONBLOCK; 1671 1672 CLASS(fsnotify_group, group)(&fanotify_fsnotify_ops, 1673 FSNOTIFY_GROUP_USER); 1674 /* fsnotify_alloc_group takes a ref. Dropped in fanotify_release */ 1675 if (IS_ERR(group)) 1676 return PTR_ERR(group); 1677 1678 /* Enforce groups limits per user in all containing user ns */ 1679 group->fanotify_data.ucounts = inc_ucount(user_ns, current_euid(), 1680 UCOUNT_FANOTIFY_GROUPS); 1681 if (!group->fanotify_data.ucounts) 1682 return -EMFILE; 1683 1684 group->fanotify_data.flags = flags | internal_flags; 1685 group->memcg = get_mem_cgroup_from_mm(current->mm); 1686 group->user_ns = get_user_ns(user_ns); 1687 1688 group->fanotify_data.merge_hash = fanotify_alloc_merge_hash(); 1689 if (!group->fanotify_data.merge_hash) 1690 return -ENOMEM; 1691 1692 group->overflow_event = fanotify_alloc_overflow_event(); 1693 if (unlikely(!group->overflow_event)) 1694 return -ENOMEM; 1695 1696 if (force_o_largefile()) 1697 event_f_flags |= O_LARGEFILE; 1698 group->fanotify_data.f_flags = event_f_flags; 1699 init_waitqueue_head(&group->fanotify_data.access_waitq); 1700 INIT_LIST_HEAD(&group->fanotify_data.access_list); 1701 INIT_LIST_HEAD(&group->fanotify_data.perm_grp_list); 1702 switch (class) { 1703 case FAN_CLASS_NOTIF: 1704 group->priority = FSNOTIFY_PRIO_NORMAL; 1705 break; 1706 case FAN_CLASS_CONTENT: 1707 group->priority = FSNOTIFY_PRIO_CONTENT; 1708 break; 1709 case FAN_CLASS_PRE_CONTENT: 1710 group->priority = FSNOTIFY_PRIO_PRE_CONTENT; 1711 break; 1712 default: 1713 return -EINVAL; 1714 } 1715 1716 BUILD_BUG_ON(!(FANOTIFY_ADMIN_INIT_FLAGS & FAN_UNLIMITED_QUEUE)); 1717 if (flags & FAN_UNLIMITED_QUEUE) { 1718 group->max_events = UINT_MAX; 1719 } else { 1720 group->max_events = fanotify_max_queued_events; 1721 } 1722 1723 if (flags & FAN_ENABLE_AUDIT) { 1724 if (!capable(CAP_AUDIT_WRITE)) 1725 return -EPERM; 1726 } 1727 1728 fd = FD_ADD(f_flags, 1729 anon_inode_getfile_fmode("[fanotify]", &fanotify_fops, 1730 group, f_flags, FMODE_NONOTIFY)); 1731 if (fd >= 0) 1732 retain_and_null_ptr(group); 1733 return fd; 1734 } 1735 1736 static int fanotify_test_fsid(struct dentry *dentry, unsigned int flags, 1737 struct fan_fsid *fsid) 1738 { 1739 unsigned int mark_type = flags & FANOTIFY_MARK_TYPE_BITS; 1740 __kernel_fsid_t root_fsid; 1741 int err; 1742 1743 /* 1744 * Make sure dentry is not of a filesystem with zero fsid (e.g. fuse). 1745 */ 1746 err = vfs_get_fsid(dentry, &fsid->id); 1747 if (err) 1748 return err; 1749 1750 fsid->sb = dentry->d_sb; 1751 if (!fsid->id.val[0] && !fsid->id.val[1]) { 1752 err = -ENODEV; 1753 goto weak; 1754 } 1755 1756 /* 1757 * Make sure dentry is not of a filesystem subvolume (e.g. btrfs) 1758 * which uses a different fsid than sb root. 1759 */ 1760 err = vfs_get_fsid(dentry->d_sb->s_root, &root_fsid); 1761 if (err) 1762 return err; 1763 1764 if (!fanotify_fsid_equal(&root_fsid, &fsid->id)) { 1765 err = -EXDEV; 1766 goto weak; 1767 } 1768 1769 fsid->weak = false; 1770 return 0; 1771 1772 weak: 1773 /* Allow weak fsid when marking inodes */ 1774 fsid->weak = true; 1775 return (mark_type == FAN_MARK_INODE) ? 0 : err; 1776 } 1777 1778 /* Check if filesystem can encode a unique fid */ 1779 static int fanotify_test_fid(struct dentry *dentry, unsigned int flags) 1780 { 1781 unsigned int mark_type = flags & FANOTIFY_MARK_TYPE_BITS; 1782 const struct export_operations *nop = dentry->d_sb->s_export_op; 1783 1784 /* 1785 * We need to make sure that the filesystem supports encoding of 1786 * file handles so user can use name_to_handle_at() to compare fids 1787 * reported with events to the file handle of watched objects. 1788 */ 1789 if (!exportfs_can_encode_fid(nop)) 1790 return -EOPNOTSUPP; 1791 1792 /* 1793 * For sb/mount mark, we also need to make sure that the filesystem 1794 * supports decoding file handles, so user has a way to map back the 1795 * reported fids to filesystem objects. 1796 */ 1797 if (mark_type != FAN_MARK_INODE && !exportfs_can_decode_fh(nop)) 1798 return -EOPNOTSUPP; 1799 1800 return 0; 1801 } 1802 1803 static int fanotify_events_supported(struct fsnotify_group *group, 1804 const struct path *path, __u64 mask, 1805 unsigned int flags) 1806 { 1807 unsigned int mark_type = flags & FANOTIFY_MARK_TYPE_BITS; 1808 bool is_dir = d_is_dir(path->dentry); 1809 /* Strict validation of events in non-dir inode mask with v5.17+ APIs */ 1810 bool strict_dir_events = FAN_GROUP_FLAG(group, FAN_REPORT_TARGET_FID) || 1811 (mask & FAN_RENAME) || 1812 (flags & FAN_MARK_IGNORE); 1813 1814 /* 1815 * Filesystems need to opt-into pre-content evnets (a.k.a HSM) 1816 * and they are only supported on regular files and directories. 1817 */ 1818 if (mask & FANOTIFY_PRE_CONTENT_EVENTS) { 1819 if (!(path->mnt->mnt_sb->s_iflags & SB_I_ALLOW_HSM)) 1820 return -EOPNOTSUPP; 1821 if (!is_dir && !d_is_reg(path->dentry)) 1822 return -EINVAL; 1823 } 1824 1825 /* 1826 * Some filesystems such as 'proc' acquire unusual locks when opening 1827 * files. For them fanotify permission events have high chances of 1828 * deadlocking the system - open done when reporting fanotify event 1829 * blocks on this "unusual" lock while another process holding the lock 1830 * waits for fanotify permission event to be answered. Just disallow 1831 * permission events for such filesystems. 1832 */ 1833 if (mask & FANOTIFY_PERM_EVENTS && 1834 path->mnt->mnt_sb->s_type->fs_flags & FS_DISALLOW_NOTIFY_PERM) 1835 return -EINVAL; 1836 1837 /* 1838 * mount and sb marks are not allowed on kernel internal pseudo fs, 1839 * like pipe_mnt, because that would subscribe to events on all the 1840 * anonymous pipes in the system. 1841 * 1842 * SB_NOUSER covers all of the internal pseudo fs whose objects are not 1843 * exposed to user's mount namespace, but there are other SB_KERNMOUNT 1844 * fs, like nsfs, debugfs, for which the value of allowing sb and mount 1845 * mark is questionable. For now we leave them alone. 1846 */ 1847 if (mark_type != FAN_MARK_INODE && 1848 path->mnt->mnt_sb->s_flags & SB_NOUSER) 1849 return -EINVAL; 1850 1851 /* 1852 * We shouldn't have allowed setting dirent events and the directory 1853 * flags FAN_ONDIR and FAN_EVENT_ON_CHILD in mask of non-dir inode, 1854 * but because we always allowed it, error only when using new APIs. 1855 */ 1856 if (strict_dir_events && mark_type == FAN_MARK_INODE && 1857 !is_dir && (mask & FANOTIFY_DIRONLY_EVENT_BITS)) 1858 return -ENOTDIR; 1859 1860 return 0; 1861 } 1862 1863 static int do_fanotify_mark(int fanotify_fd, unsigned int flags, __u64 mask, 1864 int dfd, const char __user *pathname) 1865 { 1866 struct inode *inode = NULL; 1867 struct fsnotify_group *group; 1868 struct path path; 1869 struct fan_fsid __fsid, *fsid = NULL; 1870 struct user_namespace *user_ns = NULL; 1871 struct mnt_namespace *mntns; 1872 u32 valid_mask = FANOTIFY_EVENTS | FANOTIFY_EVENT_FLAGS; 1873 unsigned int mark_type = flags & FANOTIFY_MARK_TYPE_BITS; 1874 unsigned int mark_cmd = flags & FANOTIFY_MARK_CMD_BITS; 1875 unsigned int ignore = flags & FANOTIFY_MARK_IGNORE_BITS; 1876 unsigned int obj_type, fid_mode; 1877 void *obj = NULL; 1878 u32 umask = 0; 1879 int ret; 1880 1881 pr_debug("%s: fanotify_fd=%d flags=%x dfd=%d pathname=%p mask=%llx\n", 1882 __func__, fanotify_fd, flags, dfd, pathname, mask); 1883 1884 /* we only use the lower 32 bits as of right now. */ 1885 if (upper_32_bits(mask)) 1886 return -EINVAL; 1887 1888 if (flags & ~FANOTIFY_MARK_FLAGS) 1889 return -EINVAL; 1890 1891 switch (mark_type) { 1892 case FAN_MARK_INODE: 1893 obj_type = FSNOTIFY_OBJ_TYPE_INODE; 1894 break; 1895 case FAN_MARK_MOUNT: 1896 obj_type = FSNOTIFY_OBJ_TYPE_VFSMOUNT; 1897 break; 1898 case FAN_MARK_FILESYSTEM: 1899 obj_type = FSNOTIFY_OBJ_TYPE_SB; 1900 break; 1901 case FAN_MARK_MNTNS: 1902 obj_type = FSNOTIFY_OBJ_TYPE_MNTNS; 1903 break; 1904 default: 1905 return -EINVAL; 1906 } 1907 1908 switch (mark_cmd) { 1909 case FAN_MARK_ADD: 1910 case FAN_MARK_REMOVE: 1911 if (!mask) 1912 return -EINVAL; 1913 break; 1914 case FAN_MARK_FLUSH: 1915 if (flags & ~(FANOTIFY_MARK_TYPE_BITS | FAN_MARK_FLUSH)) 1916 return -EINVAL; 1917 break; 1918 default: 1919 return -EINVAL; 1920 } 1921 1922 if (IS_ENABLED(CONFIG_FANOTIFY_ACCESS_PERMISSIONS)) 1923 valid_mask |= FANOTIFY_PERM_EVENTS; 1924 1925 if (mask & ~valid_mask) 1926 return -EINVAL; 1927 1928 1929 /* We don't allow FAN_MARK_IGNORE & FAN_MARK_IGNORED_MASK together */ 1930 if (ignore == (FAN_MARK_IGNORE | FAN_MARK_IGNORED_MASK)) 1931 return -EINVAL; 1932 1933 /* 1934 * Event flags (FAN_ONDIR, FAN_EVENT_ON_CHILD) have no effect with 1935 * FAN_MARK_IGNORED_MASK. 1936 */ 1937 if (ignore == FAN_MARK_IGNORED_MASK) { 1938 mask &= ~FANOTIFY_EVENT_FLAGS; 1939 umask = FANOTIFY_EVENT_FLAGS; 1940 } 1941 1942 CLASS(fd, f)(fanotify_fd); 1943 if (fd_empty(f)) 1944 return -EBADF; 1945 1946 /* verify that this is indeed an fanotify instance */ 1947 if (unlikely(fd_file(f)->f_op != &fanotify_fops)) 1948 return -EINVAL; 1949 group = fd_file(f)->private_data; 1950 1951 /* Only report mount events on mnt namespace */ 1952 if (FAN_GROUP_FLAG(group, FAN_REPORT_MNT)) { 1953 if (mask & ~FANOTIFY_MOUNT_EVENTS) 1954 return -EINVAL; 1955 if (mark_type != FAN_MARK_MNTNS) 1956 return -EINVAL; 1957 } else { 1958 if (mask & FANOTIFY_MOUNT_EVENTS) 1959 return -EINVAL; 1960 if (mark_type == FAN_MARK_MNTNS) 1961 return -EINVAL; 1962 } 1963 1964 /* 1965 * A user is allowed to setup sb/mount/mntns marks only if it is 1966 * capable in the user ns where the group was created. 1967 */ 1968 if (mark_type != FAN_MARK_INODE && 1969 !ns_capable(group->user_ns, CAP_SYS_ADMIN)) 1970 return -EPERM; 1971 1972 /* 1973 * Permission events are not allowed for FAN_CLASS_NOTIF. 1974 * Pre-content permission events are not allowed for FAN_CLASS_CONTENT. 1975 */ 1976 if (mask & FANOTIFY_PERM_EVENTS && 1977 group->priority == FSNOTIFY_PRIO_NORMAL) 1978 return -EINVAL; 1979 else if (mask & FANOTIFY_PRE_CONTENT_EVENTS && 1980 group->priority == FSNOTIFY_PRIO_CONTENT) 1981 return -EINVAL; 1982 1983 if (mask & FAN_FS_ERROR && 1984 mark_type != FAN_MARK_FILESYSTEM) 1985 return -EINVAL; 1986 1987 /* 1988 * Evictable is only relevant for inode marks, because only inode object 1989 * can be evicted on memory pressure. 1990 */ 1991 if (flags & FAN_MARK_EVICTABLE && 1992 mark_type != FAN_MARK_INODE) 1993 return -EINVAL; 1994 1995 /* 1996 * Events that do not carry enough information to report 1997 * event->fd require a group that supports reporting fid. Those 1998 * events are not supported on a mount mark, because they do not 1999 * carry enough information (i.e. path) to be filtered by mount 2000 * point. 2001 */ 2002 fid_mode = FAN_GROUP_FLAG(group, FANOTIFY_FID_BITS); 2003 if (mask & ~(FANOTIFY_FD_EVENTS|FANOTIFY_MOUNT_EVENTS|FANOTIFY_EVENT_FLAGS) && 2004 (!fid_mode || mark_type == FAN_MARK_MOUNT)) 2005 return -EINVAL; 2006 2007 /* 2008 * FAN_RENAME uses special info type records to report the old and 2009 * new parent+name. Reporting only old and new parent id is less 2010 * useful and was not implemented. 2011 */ 2012 if (mask & FAN_RENAME && !(fid_mode & FAN_REPORT_NAME)) 2013 return -EINVAL; 2014 2015 /* Pre-content events are not currently generated for directories. */ 2016 if (mask & FANOTIFY_PRE_CONTENT_EVENTS && mask & FAN_ONDIR) 2017 return -EINVAL; 2018 2019 if (mark_cmd == FAN_MARK_FLUSH) { 2020 fsnotify_clear_marks_by_group(group, obj_type); 2021 return 0; 2022 } 2023 2024 ret = fanotify_find_path(dfd, pathname, &path, flags, 2025 (mask & ALL_FSNOTIFY_EVENTS), obj_type); 2026 if (ret) 2027 return ret; 2028 2029 if (mark_cmd == FAN_MARK_ADD) { 2030 ret = fanotify_events_supported(group, &path, mask, flags); 2031 if (ret) 2032 goto path_put_and_out; 2033 } 2034 2035 /* you can only watch an inode if you have read permissions on it */ 2036 ret = path_permission(&path, MAY_READ); 2037 if (ret) 2038 goto path_put_and_out; 2039 2040 ret = security_path_notify(&path, mask, obj_type); 2041 if (ret) 2042 goto path_put_and_out; 2043 2044 if (fid_mode) { 2045 ret = fanotify_test_fsid(path.dentry, flags, &__fsid); 2046 if (ret) 2047 goto path_put_and_out; 2048 2049 ret = fanotify_test_fid(path.dentry, flags); 2050 if (ret) 2051 goto path_put_and_out; 2052 2053 fsid = &__fsid; 2054 } 2055 2056 /* 2057 * In addition to being capable in the user ns where group was created, 2058 * the user also needs to be capable in the user ns associated with 2059 * the filesystem or in the user ns associated with the mntns 2060 * (when marking mntns). 2061 */ 2062 if (obj_type == FSNOTIFY_OBJ_TYPE_INODE) { 2063 inode = path.dentry->d_inode; 2064 obj = inode; 2065 } else if (obj_type == FSNOTIFY_OBJ_TYPE_VFSMOUNT) { 2066 user_ns = path.mnt->mnt_sb->s_user_ns; 2067 obj = path.mnt; 2068 } else if (obj_type == FSNOTIFY_OBJ_TYPE_SB) { 2069 user_ns = path.mnt->mnt_sb->s_user_ns; 2070 obj = path.mnt->mnt_sb; 2071 } else if (obj_type == FSNOTIFY_OBJ_TYPE_MNTNS) { 2072 ret = -EINVAL; 2073 mntns = mnt_ns_from_dentry(path.dentry); 2074 if (!mntns) 2075 goto path_put_and_out; 2076 user_ns = mntns->user_ns; 2077 obj = mntns; 2078 } 2079 2080 ret = -EPERM; 2081 if (user_ns && !ns_capable(user_ns, CAP_SYS_ADMIN)) 2082 goto path_put_and_out; 2083 2084 ret = -EINVAL; 2085 if (!obj) 2086 goto path_put_and_out; 2087 2088 /* 2089 * If some other task has this inode open for write we should not add 2090 * an ignore mask, unless that ignore mask is supposed to survive 2091 * modification changes anyway. 2092 */ 2093 if (mark_cmd == FAN_MARK_ADD && (flags & FANOTIFY_MARK_IGNORE_BITS) && 2094 !(flags & FAN_MARK_IGNORED_SURV_MODIFY)) { 2095 ret = !inode ? -EINVAL : -EISDIR; 2096 /* FAN_MARK_IGNORE requires SURV_MODIFY for sb/mount/dir marks */ 2097 if (ignore == FAN_MARK_IGNORE && 2098 (!inode || S_ISDIR(inode->i_mode))) 2099 goto path_put_and_out; 2100 2101 ret = 0; 2102 if (inode && inode_is_open_for_write(inode)) 2103 goto path_put_and_out; 2104 } 2105 2106 /* Mask out FAN_EVENT_ON_CHILD flag for sb/mount/non-dir marks */ 2107 if (!inode || !S_ISDIR(inode->i_mode)) { 2108 mask &= ~FAN_EVENT_ON_CHILD; 2109 umask = FAN_EVENT_ON_CHILD; 2110 /* 2111 * If group needs to report parent fid, register for getting 2112 * events with parent/name info for non-directory. 2113 */ 2114 if ((fid_mode & FAN_REPORT_DIR_FID) && 2115 (flags & FAN_MARK_ADD) && !ignore) 2116 mask |= FAN_EVENT_ON_CHILD; 2117 } 2118 2119 /* create/update an inode mark */ 2120 switch (mark_cmd) { 2121 case FAN_MARK_ADD: 2122 ret = fanotify_add_mark(group, obj, obj_type, mask, flags, 2123 fsid); 2124 break; 2125 case FAN_MARK_REMOVE: 2126 ret = fanotify_remove_mark(group, obj, obj_type, mask, flags, 2127 umask); 2128 break; 2129 default: 2130 ret = -EINVAL; 2131 } 2132 2133 path_put_and_out: 2134 path_put(&path); 2135 return ret; 2136 } 2137 2138 #ifndef CONFIG_ARCH_SPLIT_ARG64 2139 SYSCALL_DEFINE5(fanotify_mark, int, fanotify_fd, unsigned int, flags, 2140 __u64, mask, int, dfd, 2141 const char __user *, pathname) 2142 { 2143 return do_fanotify_mark(fanotify_fd, flags, mask, dfd, pathname); 2144 } 2145 #endif 2146 2147 #if defined(CONFIG_ARCH_SPLIT_ARG64) || defined(CONFIG_COMPAT) 2148 SYSCALL32_DEFINE6(fanotify_mark, 2149 int, fanotify_fd, unsigned int, flags, 2150 SC_ARG64(mask), int, dfd, 2151 const char __user *, pathname) 2152 { 2153 return do_fanotify_mark(fanotify_fd, flags, SC_VAL64(__u64, mask), 2154 dfd, pathname); 2155 } 2156 #endif 2157 2158 /* 2159 * fanotify_user_setup - Our initialization function. Note that we cannot return 2160 * error because we have compiled-in VFS hooks. So an (unlikely) failure here 2161 * must result in panic(). 2162 */ 2163 static int __init fanotify_user_setup(void) 2164 { 2165 struct sysinfo si; 2166 int max_marks; 2167 2168 si_meminfo(&si); 2169 /* 2170 * Allow up to 1% of addressable memory to be accounted for per user 2171 * marks limited to the range [8192, 1048576]. mount and sb marks are 2172 * a lot cheaper than inode marks, but there is no reason for a user 2173 * to have many of those, so calculate by the cost of inode marks. 2174 */ 2175 max_marks = (((si.totalram - si.totalhigh) / 100) << PAGE_SHIFT) / 2176 INODE_MARK_COST; 2177 max_marks = clamp(max_marks, FANOTIFY_OLD_DEFAULT_MAX_MARKS, 2178 FANOTIFY_DEFAULT_MAX_USER_MARKS); 2179 2180 BUILD_BUG_ON(FANOTIFY_INIT_FLAGS & FANOTIFY_INTERNAL_GROUP_FLAGS); 2181 BUILD_BUG_ON(HWEIGHT32(FANOTIFY_INIT_FLAGS) != 14); 2182 BUILD_BUG_ON(HWEIGHT32(FANOTIFY_MARK_FLAGS) != 11); 2183 2184 fanotify_mark_cache = KMEM_CACHE(fanotify_mark, 2185 SLAB_PANIC|SLAB_ACCOUNT); 2186 fanotify_fid_event_cachep = KMEM_CACHE(fanotify_fid_event, 2187 SLAB_PANIC); 2188 fanotify_path_event_cachep = KMEM_CACHE(fanotify_path_event, 2189 SLAB_PANIC); 2190 if (IS_ENABLED(CONFIG_FANOTIFY_ACCESS_PERMISSIONS)) { 2191 fanotify_perm_event_cachep = 2192 KMEM_CACHE(fanotify_perm_event, SLAB_PANIC); 2193 } 2194 fanotify_mnt_event_cachep = KMEM_CACHE(fanotify_mnt_event, SLAB_PANIC); 2195 2196 fanotify_max_queued_events = FANOTIFY_DEFAULT_MAX_EVENTS; 2197 init_user_ns.ucount_max[UCOUNT_FANOTIFY_GROUPS] = 2198 FANOTIFY_DEFAULT_MAX_GROUPS; 2199 init_user_ns.ucount_max[UCOUNT_FANOTIFY_MARKS] = max_marks; 2200 fanotify_sysctls_init(); 2201 2202 return 0; 2203 } 2204 device_initcall(fanotify_user_setup); 2205