1 // SPDX-License-Identifier: GPL-2.0
2 #include <linux/syscalls.h>
3 #include <linux/slab.h>
4 #include <linux/fs.h>
5 #include <linux/file.h>
6 #include <linux/mount.h>
7 #include <linux/namei.h>
8 #include <linux/exportfs.h>
9 #include <linux/fs_struct.h>
10 #include <linux/fsnotify.h>
11 #include <linux/personality.h>
12 #include <linux/uaccess.h>
13 #include <linux/compat.h>
14 #include "internal.h"
15 #include "mount.h"
16
do_sys_name_to_handle(const struct path * path,struct file_handle __user * ufh,void __user * mnt_id,bool unique_mntid,int fh_flags)17 static long do_sys_name_to_handle(const struct path *path,
18 struct file_handle __user *ufh,
19 void __user *mnt_id, bool unique_mntid,
20 int fh_flags)
21 {
22 long retval;
23 struct file_handle f_handle;
24 int handle_dwords, handle_bytes;
25 struct file_handle *handle = NULL;
26
27 /*
28 * We need to make sure whether the file system support decoding of
29 * the file handle if decodeable file handle was requested.
30 */
31 if (!exportfs_can_encode_fh(path->dentry->d_sb->s_export_op, fh_flags))
32 return -EOPNOTSUPP;
33
34 /*
35 * A request to encode a connectable handle for a disconnected dentry
36 * is unexpected since AT_EMPTY_PATH is not allowed.
37 */
38 if (fh_flags & EXPORT_FH_CONNECTABLE &&
39 WARN_ON(path->dentry->d_flags & DCACHE_DISCONNECTED))
40 return -EINVAL;
41
42 if (copy_from_user(&f_handle, ufh, sizeof(struct file_handle)))
43 return -EFAULT;
44
45 if (f_handle.handle_bytes > MAX_HANDLE_SZ)
46 return -EINVAL;
47
48 handle = kzalloc(struct_size(handle, f_handle, f_handle.handle_bytes),
49 GFP_KERNEL);
50 if (!handle)
51 return -ENOMEM;
52
53 /* convert handle size to multiple of sizeof(u32) */
54 handle_dwords = f_handle.handle_bytes >> 2;
55
56 /* Encode a possibly decodeable/connectable file handle */
57 retval = exportfs_encode_fh(path->dentry,
58 (struct fid *)handle->f_handle,
59 &handle_dwords, fh_flags);
60 handle->handle_type = retval;
61 /* convert handle size to bytes */
62 handle_bytes = handle_dwords * sizeof(u32);
63 handle->handle_bytes = handle_bytes;
64 if ((handle->handle_bytes > f_handle.handle_bytes) ||
65 (retval == FILEID_INVALID) || (retval < 0)) {
66 /* As per old exportfs_encode_fh documentation
67 * we could return ENOSPC to indicate overflow
68 * But file system returned 255 always. So handle
69 * both the values
70 */
71 if (retval == FILEID_INVALID || retval == -ENOSPC)
72 retval = -EOVERFLOW;
73 /*
74 * set the handle size to zero so we copy only
75 * non variable part of the file_handle
76 */
77 handle_bytes = 0;
78 } else {
79 /*
80 * When asked to encode a connectable file handle, encode this
81 * property in the file handle itself, so that we later know
82 * how to decode it.
83 * For sanity, also encode in the file handle if the encoded
84 * object is a directory and verify this during decode, because
85 * decoding directory file handles is quite different than
86 * decoding connectable non-directory file handles.
87 */
88 if (fh_flags & EXPORT_FH_CONNECTABLE) {
89 handle->handle_type |= FILEID_IS_CONNECTABLE;
90 if (d_is_dir(path->dentry))
91 fh_flags |= FILEID_IS_DIR;
92 }
93 retval = 0;
94 }
95 /* copy the mount id */
96 if (unique_mntid) {
97 if (put_user(real_mount(path->mnt)->mnt_id_unique,
98 (u64 __user *) mnt_id))
99 retval = -EFAULT;
100 } else {
101 if (put_user(real_mount(path->mnt)->mnt_id,
102 (int __user *) mnt_id))
103 retval = -EFAULT;
104 }
105 /* copy the handle */
106 if (retval != -EFAULT &&
107 copy_to_user(ufh, handle,
108 struct_size(handle, f_handle, handle_bytes)))
109 retval = -EFAULT;
110 kfree(handle);
111 return retval;
112 }
113
114 /**
115 * sys_name_to_handle_at: convert name to handle
116 * @dfd: directory relative to which name is interpreted if not absolute
117 * @name: name that should be converted to handle.
118 * @handle: resulting file handle
119 * @mnt_id: mount id of the file system containing the file
120 * (u64 if AT_HANDLE_MNT_ID_UNIQUE, otherwise int)
121 * @flag: flag value to indicate whether to follow symlink or not
122 * and whether a decodable file handle is required.
123 *
124 * @handle->handle_size indicate the space available to store the
125 * variable part of the file handle in bytes. If there is not
126 * enough space, the field is updated to return the minimum
127 * value required.
128 */
SYSCALL_DEFINE5(name_to_handle_at,int,dfd,const char __user *,name,struct file_handle __user *,handle,void __user *,mnt_id,int,flag)129 SYSCALL_DEFINE5(name_to_handle_at, int, dfd, const char __user *, name,
130 struct file_handle __user *, handle, void __user *, mnt_id,
131 int, flag)
132 {
133 struct path path;
134 int lookup_flags;
135 int fh_flags = 0;
136 int err;
137
138 if (flag & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH | AT_HANDLE_FID |
139 AT_HANDLE_MNT_ID_UNIQUE | AT_HANDLE_CONNECTABLE))
140 return -EINVAL;
141
142 /*
143 * AT_HANDLE_FID means there is no intention to decode file handle
144 * AT_HANDLE_CONNECTABLE means there is an intention to decode a
145 * connected fd (with known path), so these flags are conflicting.
146 * AT_EMPTY_PATH could be used along with a dfd that refers to a
147 * disconnected non-directory, which cannot be used to encode a
148 * connectable file handle, because its parent is unknown.
149 */
150 if (flag & AT_HANDLE_CONNECTABLE &&
151 flag & (AT_HANDLE_FID | AT_EMPTY_PATH))
152 return -EINVAL;
153 else if (flag & AT_HANDLE_FID)
154 fh_flags |= EXPORT_FH_FID;
155 else if (flag & AT_HANDLE_CONNECTABLE)
156 fh_flags |= EXPORT_FH_CONNECTABLE;
157
158 lookup_flags = (flag & AT_SYMLINK_FOLLOW) ? LOOKUP_FOLLOW : 0;
159 if (flag & AT_EMPTY_PATH)
160 lookup_flags |= LOOKUP_EMPTY;
161 err = user_path_at(dfd, name, lookup_flags, &path);
162 if (!err) {
163 err = do_sys_name_to_handle(&path, handle, mnt_id,
164 flag & AT_HANDLE_MNT_ID_UNIQUE,
165 fh_flags);
166 path_put(&path);
167 }
168 return err;
169 }
170
get_path_from_fd(int fd,struct path * root)171 static int get_path_from_fd(int fd, struct path *root)
172 {
173 if (fd == AT_FDCWD) {
174 struct fs_struct *fs = current->fs;
175 spin_lock(&fs->lock);
176 *root = fs->pwd;
177 path_get(root);
178 spin_unlock(&fs->lock);
179 } else {
180 CLASS(fd, f)(fd);
181 if (fd_empty(f))
182 return -EBADF;
183 *root = fd_file(f)->f_path;
184 path_get(root);
185 }
186
187 return 0;
188 }
189
vfs_dentry_acceptable(void * context,struct dentry * dentry)190 static int vfs_dentry_acceptable(void *context, struct dentry *dentry)
191 {
192 struct handle_to_path_ctx *ctx = context;
193 struct user_namespace *user_ns = current_user_ns();
194 struct dentry *d, *root = ctx->root.dentry;
195 struct mnt_idmap *idmap = mnt_idmap(ctx->root.mnt);
196 int retval = 0;
197
198 if (!root)
199 return 1;
200
201 /* Old permission model with global CAP_DAC_READ_SEARCH. */
202 if (!ctx->flags)
203 return 1;
204
205 /*
206 * It's racy as we're not taking rename_lock but we're able to ignore
207 * permissions and we just need an approximation whether we were able
208 * to follow a path to the file.
209 *
210 * It's also potentially expensive on some filesystems especially if
211 * there is a deep path.
212 */
213 d = dget(dentry);
214 while (d != root && !IS_ROOT(d)) {
215 struct dentry *parent = dget_parent(d);
216
217 /*
218 * We know that we have the ability to override DAC permissions
219 * as we've verified this earlier via CAP_DAC_READ_SEARCH. But
220 * we also need to make sure that there aren't any unmapped
221 * inodes in the path that would prevent us from reaching the
222 * file.
223 */
224 if (!privileged_wrt_inode_uidgid(user_ns, idmap,
225 d_inode(parent))) {
226 dput(d);
227 dput(parent);
228 return retval;
229 }
230
231 dput(d);
232 d = parent;
233 }
234
235 if (!(ctx->flags & HANDLE_CHECK_SUBTREE) || d == root)
236 retval = 1;
237 /*
238 * exportfs_decode_fh_raw() does not call acceptable() callback with
239 * a disconnected directory dentry, so we should have reached either
240 * mount fd directory or sb root.
241 */
242 if (ctx->fh_flags & EXPORT_FH_DIR_ONLY)
243 WARN_ON_ONCE(d != root && d != root->d_sb->s_root);
244 dput(d);
245 return retval;
246 }
247
do_handle_to_path(struct file_handle * handle,struct path * path,struct handle_to_path_ctx * ctx)248 static int do_handle_to_path(struct file_handle *handle, struct path *path,
249 struct handle_to_path_ctx *ctx)
250 {
251 int handle_dwords;
252 struct vfsmount *mnt = ctx->root.mnt;
253 struct dentry *dentry;
254
255 /* change the handle size to multiple of sizeof(u32) */
256 handle_dwords = handle->handle_bytes >> 2;
257 dentry = exportfs_decode_fh_raw(mnt, (struct fid *)handle->f_handle,
258 handle_dwords, handle->handle_type,
259 ctx->fh_flags, vfs_dentry_acceptable,
260 ctx);
261 if (IS_ERR_OR_NULL(dentry)) {
262 if (dentry == ERR_PTR(-ENOMEM))
263 return -ENOMEM;
264 return -ESTALE;
265 }
266 path->dentry = dentry;
267 path->mnt = mntget(mnt);
268 return 0;
269 }
270
may_decode_fh(struct handle_to_path_ctx * ctx,unsigned int o_flags)271 static inline int may_decode_fh(struct handle_to_path_ctx *ctx,
272 unsigned int o_flags)
273 {
274 struct path *root = &ctx->root;
275
276 if (capable(CAP_DAC_READ_SEARCH))
277 return 0;
278
279 /*
280 * Allow relaxed permissions of file handles if the caller has
281 * the ability to mount the filesystem or create a bind-mount of
282 * the provided @mountdirfd.
283 *
284 * In both cases the caller may be able to get an unobstructed
285 * way to the encoded file handle. If the caller is only able to
286 * create a bind-mount we need to verify that there are no
287 * locked mounts on top of it that could prevent us from getting
288 * to the encoded file.
289 *
290 * In principle, locked mounts can prevent the caller from
291 * mounting the filesystem but that only applies to procfs and
292 * sysfs neither of which support decoding file handles.
293 *
294 * Restrict to O_DIRECTORY to provide a deterministic API that
295 * avoids a confusing api in the face of disconnected non-dir
296 * dentries.
297 *
298 * There's only one dentry for each directory inode (VFS rule)...
299 */
300 if (!(o_flags & O_DIRECTORY))
301 return -EPERM;
302
303 if (ns_capable(root->mnt->mnt_sb->s_user_ns, CAP_SYS_ADMIN))
304 ctx->flags = HANDLE_CHECK_PERMS;
305 else if (is_mounted(root->mnt) &&
306 ns_capable(real_mount(root->mnt)->mnt_ns->user_ns,
307 CAP_SYS_ADMIN) &&
308 !has_locked_children(real_mount(root->mnt), root->dentry))
309 ctx->flags = HANDLE_CHECK_PERMS | HANDLE_CHECK_SUBTREE;
310 else
311 return -EPERM;
312
313 /* Are we able to override DAC permissions? */
314 if (!ns_capable(current_user_ns(), CAP_DAC_READ_SEARCH))
315 return -EPERM;
316
317 ctx->fh_flags = EXPORT_FH_DIR_ONLY;
318 return 0;
319 }
320
handle_to_path(int mountdirfd,struct file_handle __user * ufh,struct path * path,unsigned int o_flags)321 static int handle_to_path(int mountdirfd, struct file_handle __user *ufh,
322 struct path *path, unsigned int o_flags)
323 {
324 int retval = 0;
325 struct file_handle f_handle;
326 struct file_handle *handle = NULL;
327 struct handle_to_path_ctx ctx = {};
328 const struct export_operations *eops;
329
330 retval = get_path_from_fd(mountdirfd, &ctx.root);
331 if (retval)
332 goto out_err;
333
334 eops = ctx.root.mnt->mnt_sb->s_export_op;
335 if (eops && eops->permission)
336 retval = eops->permission(&ctx, o_flags);
337 else
338 retval = may_decode_fh(&ctx, o_flags);
339 if (retval)
340 goto out_path;
341
342 if (copy_from_user(&f_handle, ufh, sizeof(struct file_handle))) {
343 retval = -EFAULT;
344 goto out_path;
345 }
346 if ((f_handle.handle_bytes > MAX_HANDLE_SZ) ||
347 (f_handle.handle_bytes == 0)) {
348 retval = -EINVAL;
349 goto out_path;
350 }
351 if (f_handle.handle_type < 0 ||
352 FILEID_USER_FLAGS(f_handle.handle_type) & ~FILEID_VALID_USER_FLAGS) {
353 retval = -EINVAL;
354 goto out_path;
355 }
356
357 handle = kmalloc(struct_size(handle, f_handle, f_handle.handle_bytes),
358 GFP_KERNEL);
359 if (!handle) {
360 retval = -ENOMEM;
361 goto out_path;
362 }
363 /* copy the full handle */
364 *handle = f_handle;
365 if (copy_from_user(&handle->f_handle,
366 &ufh->f_handle,
367 f_handle.handle_bytes)) {
368 retval = -EFAULT;
369 goto out_handle;
370 }
371
372 /*
373 * If handle was encoded with AT_HANDLE_CONNECTABLE, verify that we
374 * are decoding an fd with connected path, which is accessible from
375 * the mount fd path.
376 */
377 if (f_handle.handle_type & FILEID_IS_CONNECTABLE) {
378 ctx.fh_flags |= EXPORT_FH_CONNECTABLE;
379 ctx.flags |= HANDLE_CHECK_SUBTREE;
380 }
381 if (f_handle.handle_type & FILEID_IS_DIR)
382 ctx.fh_flags |= EXPORT_FH_DIR_ONLY;
383 /* Filesystem code should not be exposed to user flags */
384 handle->handle_type &= ~FILEID_USER_FLAGS_MASK;
385 retval = do_handle_to_path(handle, path, &ctx);
386
387 out_handle:
388 kfree(handle);
389 out_path:
390 path_put(&ctx.root);
391 out_err:
392 return retval;
393 }
394
do_handle_open(int mountdirfd,struct file_handle __user * ufh,int open_flag)395 static long do_handle_open(int mountdirfd, struct file_handle __user *ufh,
396 int open_flag)
397 {
398 long retval = 0;
399 struct path path __free(path_put) = {};
400 struct file *file;
401 const struct export_operations *eops;
402
403 retval = handle_to_path(mountdirfd, ufh, &path, open_flag);
404 if (retval)
405 return retval;
406
407 CLASS(get_unused_fd, fd)(O_CLOEXEC);
408 if (fd < 0)
409 return fd;
410
411 eops = path.mnt->mnt_sb->s_export_op;
412 if (eops->open)
413 file = eops->open(&path, open_flag);
414 else
415 file = file_open_root(&path, "", open_flag, 0);
416 if (IS_ERR(file))
417 return PTR_ERR(file);
418
419 fd_install(fd, file);
420 return take_fd(fd);
421 }
422
423 /**
424 * sys_open_by_handle_at: Open the file handle
425 * @mountdirfd: directory file descriptor
426 * @handle: file handle to be opened
427 * @flags: open flags.
428 *
429 * @mountdirfd indicate the directory file descriptor
430 * of the mount point. file handle is decoded relative
431 * to the vfsmount pointed by the @mountdirfd. @flags
432 * value is same as the open(2) flags.
433 */
SYSCALL_DEFINE3(open_by_handle_at,int,mountdirfd,struct file_handle __user *,handle,int,flags)434 SYSCALL_DEFINE3(open_by_handle_at, int, mountdirfd,
435 struct file_handle __user *, handle,
436 int, flags)
437 {
438 long ret;
439
440 if (force_o_largefile())
441 flags |= O_LARGEFILE;
442
443 ret = do_handle_open(mountdirfd, handle, flags);
444 return ret;
445 }
446
447 #ifdef CONFIG_COMPAT
448 /*
449 * Exactly like fs/open.c:sys_open_by_handle_at(), except that it
450 * doesn't set the O_LARGEFILE flag.
451 */
COMPAT_SYSCALL_DEFINE3(open_by_handle_at,int,mountdirfd,struct file_handle __user *,handle,int,flags)452 COMPAT_SYSCALL_DEFINE3(open_by_handle_at, int, mountdirfd,
453 struct file_handle __user *, handle, int, flags)
454 {
455 return do_handle_open(mountdirfd, handle, flags);
456 }
457 #endif
458