1 // SPDX-License-Identifier: GPL-2.0
2 /* Copyright (c) 2022 Christian Brauner <brauner@kernel.org> */
3
4 #include <linux/cred.h>
5 #include <linux/fs.h>
6 #include <linux/mnt_idmapping.h>
7 #include <linux/slab.h>
8 #include <linux/user_namespace.h>
9
10 #include "internal.h"
11
12 /*
13 * Outside of this file vfs{g,u}id_t are always created from k{g,u}id_t,
14 * never from raw values. These are just internal helpers.
15 */
16 #define VFSUIDT_INIT_RAW(val) (vfsuid_t){ val }
17 #define VFSGIDT_INIT_RAW(val) (vfsgid_t){ val }
18
19 struct mnt_idmap {
20 struct uid_gid_map uid_map;
21 struct uid_gid_map gid_map;
22 refcount_t count;
23 };
24
25 /*
26 * Carries the initial idmapping of 0:0:4294967295 which is an identity
27 * mapping. This means that {g,u}id 0 is mapped to {g,u}id 0, {g,u}id 1 is
28 * mapped to {g,u}id 1, [...], {g,u}id 1000 to {g,u}id 1000, [...].
29 */
30 struct mnt_idmap nop_mnt_idmap = {
31 .count = REFCOUNT_INIT(1),
32 };
33 EXPORT_SYMBOL_GPL(nop_mnt_idmap);
34
35 /**
36 * initial_idmapping - check whether this is the initial mapping
37 * @ns: idmapping to check
38 *
39 * Check whether this is the initial mapping, mapping 0 to 0, 1 to 1,
40 * [...], 1000 to 1000 [...].
41 *
42 * Return: true if this is the initial mapping, false if not.
43 */
initial_idmapping(const struct user_namespace * ns)44 static inline bool initial_idmapping(const struct user_namespace *ns)
45 {
46 return ns == &init_user_ns;
47 }
48
49 /**
50 * make_vfsuid - map a filesystem kuid according to an idmapping
51 * @idmap: the mount's idmapping
52 * @fs_userns: the filesystem's idmapping
53 * @kuid : kuid to be mapped
54 *
55 * Take a @kuid and remap it from @fs_userns into @idmap. Use this
56 * function when preparing a @kuid to be reported to userspace.
57 *
58 * If initial_idmapping() determines that this is not an idmapped mount
59 * we can simply return @kuid unchanged.
60 * If initial_idmapping() tells us that the filesystem is not mounted with an
61 * idmapping we know the value of @kuid won't change when calling
62 * from_kuid() so we can simply retrieve the value via __kuid_val()
63 * directly.
64 *
65 * Return: @kuid mapped according to @idmap.
66 * If @kuid has no mapping in either @idmap or @fs_userns INVALID_UID is
67 * returned.
68 */
69
make_vfsuid(struct mnt_idmap * idmap,struct user_namespace * fs_userns,kuid_t kuid)70 vfsuid_t make_vfsuid(struct mnt_idmap *idmap,
71 struct user_namespace *fs_userns,
72 kuid_t kuid)
73 {
74 uid_t uid;
75
76 if (idmap == &nop_mnt_idmap)
77 return VFSUIDT_INIT(kuid);
78 if (initial_idmapping(fs_userns))
79 uid = __kuid_val(kuid);
80 else
81 uid = from_kuid(fs_userns, kuid);
82 if (uid == (uid_t)-1)
83 return INVALID_VFSUID;
84 return VFSUIDT_INIT_RAW(map_id_down(&idmap->uid_map, uid));
85 }
86 EXPORT_SYMBOL_GPL(make_vfsuid);
87
88 /**
89 * make_vfsgid - map a filesystem kgid according to an idmapping
90 * @idmap: the mount's idmapping
91 * @fs_userns: the filesystem's idmapping
92 * @kgid : kgid to be mapped
93 *
94 * Take a @kgid and remap it from @fs_userns into @idmap. Use this
95 * function when preparing a @kgid to be reported to userspace.
96 *
97 * If initial_idmapping() determines that this is not an idmapped mount
98 * we can simply return @kgid unchanged.
99 * If initial_idmapping() tells us that the filesystem is not mounted with an
100 * idmapping we know the value of @kgid won't change when calling
101 * from_kgid() so we can simply retrieve the value via __kgid_val()
102 * directly.
103 *
104 * Return: @kgid mapped according to @idmap.
105 * If @kgid has no mapping in either @idmap or @fs_userns INVALID_GID is
106 * returned.
107 */
make_vfsgid(struct mnt_idmap * idmap,struct user_namespace * fs_userns,kgid_t kgid)108 vfsgid_t make_vfsgid(struct mnt_idmap *idmap,
109 struct user_namespace *fs_userns, kgid_t kgid)
110 {
111 gid_t gid;
112
113 if (idmap == &nop_mnt_idmap)
114 return VFSGIDT_INIT(kgid);
115 if (initial_idmapping(fs_userns))
116 gid = __kgid_val(kgid);
117 else
118 gid = from_kgid(fs_userns, kgid);
119 if (gid == (gid_t)-1)
120 return INVALID_VFSGID;
121 return VFSGIDT_INIT_RAW(map_id_down(&idmap->gid_map, gid));
122 }
123 EXPORT_SYMBOL_GPL(make_vfsgid);
124
125 /**
126 * from_vfsuid - map a vfsuid into the filesystem idmapping
127 * @idmap: the mount's idmapping
128 * @fs_userns: the filesystem's idmapping
129 * @vfsuid : vfsuid to be mapped
130 *
131 * Map @vfsuid into the filesystem idmapping. This function has to be used in
132 * order to e.g. write @vfsuid to inode->i_uid.
133 *
134 * Return: @vfsuid mapped into the filesystem idmapping
135 */
from_vfsuid(struct mnt_idmap * idmap,struct user_namespace * fs_userns,vfsuid_t vfsuid)136 kuid_t from_vfsuid(struct mnt_idmap *idmap,
137 struct user_namespace *fs_userns, vfsuid_t vfsuid)
138 {
139 uid_t uid;
140
141 if (idmap == &nop_mnt_idmap)
142 return AS_KUIDT(vfsuid);
143 uid = map_id_up(&idmap->uid_map, __vfsuid_val(vfsuid));
144 if (uid == (uid_t)-1)
145 return INVALID_UID;
146 if (initial_idmapping(fs_userns))
147 return KUIDT_INIT(uid);
148 return make_kuid(fs_userns, uid);
149 }
150 EXPORT_SYMBOL_GPL(from_vfsuid);
151
152 /**
153 * from_vfsgid - map a vfsgid into the filesystem idmapping
154 * @idmap: the mount's idmapping
155 * @fs_userns: the filesystem's idmapping
156 * @vfsgid : vfsgid to be mapped
157 *
158 * Map @vfsgid into the filesystem idmapping. This function has to be used in
159 * order to e.g. write @vfsgid to inode->i_gid.
160 *
161 * Return: @vfsgid mapped into the filesystem idmapping
162 */
from_vfsgid(struct mnt_idmap * idmap,struct user_namespace * fs_userns,vfsgid_t vfsgid)163 kgid_t from_vfsgid(struct mnt_idmap *idmap,
164 struct user_namespace *fs_userns, vfsgid_t vfsgid)
165 {
166 gid_t gid;
167
168 if (idmap == &nop_mnt_idmap)
169 return AS_KGIDT(vfsgid);
170 gid = map_id_up(&idmap->gid_map, __vfsgid_val(vfsgid));
171 if (gid == (gid_t)-1)
172 return INVALID_GID;
173 if (initial_idmapping(fs_userns))
174 return KGIDT_INIT(gid);
175 return make_kgid(fs_userns, gid);
176 }
177 EXPORT_SYMBOL_GPL(from_vfsgid);
178
179 #ifdef CONFIG_MULTIUSER
180 /**
181 * vfsgid_in_group_p() - check whether a vfsuid matches the caller's groups
182 * @vfsgid: the mnt gid to match
183 *
184 * This function can be used to determine whether @vfsuid matches any of the
185 * caller's groups.
186 *
187 * Return: 1 if vfsuid matches caller's groups, 0 if not.
188 */
vfsgid_in_group_p(vfsgid_t vfsgid)189 int vfsgid_in_group_p(vfsgid_t vfsgid)
190 {
191 return in_group_p(AS_KGIDT(vfsgid));
192 }
193 #else
vfsgid_in_group_p(vfsgid_t vfsgid)194 int vfsgid_in_group_p(vfsgid_t vfsgid)
195 {
196 return 1;
197 }
198 #endif
199 EXPORT_SYMBOL_GPL(vfsgid_in_group_p);
200
copy_mnt_idmap(struct uid_gid_map * map_from,struct uid_gid_map * map_to)201 static int copy_mnt_idmap(struct uid_gid_map *map_from,
202 struct uid_gid_map *map_to)
203 {
204 struct uid_gid_extent *forward, *reverse;
205 u32 nr_extents = READ_ONCE(map_from->nr_extents);
206 /* Pairs with smp_wmb() when writing the idmapping. */
207 smp_rmb();
208
209 /*
210 * Don't blindly copy @map_to into @map_from if nr_extents is
211 * smaller or equal to UID_GID_MAP_MAX_BASE_EXTENTS. Since we
212 * read @nr_extents someone could have written an idmapping and
213 * then we might end up with inconsistent data. So just don't do
214 * anything at all.
215 */
216 if (nr_extents == 0)
217 return -EINVAL;
218
219 /*
220 * Here we know that nr_extents is greater than zero which means
221 * a map has been written. Since idmappings can't be changed
222 * once they have been written we know that we can safely copy
223 * from @map_to into @map_from.
224 */
225
226 if (nr_extents <= UID_GID_MAP_MAX_BASE_EXTENTS) {
227 *map_to = *map_from;
228 return 0;
229 }
230
231 forward = kmemdup(map_from->forward,
232 nr_extents * sizeof(struct uid_gid_extent),
233 GFP_KERNEL_ACCOUNT);
234 if (!forward)
235 return -ENOMEM;
236
237 reverse = kmemdup(map_from->reverse,
238 nr_extents * sizeof(struct uid_gid_extent),
239 GFP_KERNEL_ACCOUNT);
240 if (!reverse) {
241 kfree(forward);
242 return -ENOMEM;
243 }
244
245 /*
246 * The idmapping isn't exposed anywhere so we don't need to care
247 * about ordering between extent pointers and @nr_extents
248 * initialization.
249 */
250 map_to->forward = forward;
251 map_to->reverse = reverse;
252 map_to->nr_extents = nr_extents;
253 return 0;
254 }
255
free_mnt_idmap(struct mnt_idmap * idmap)256 static void free_mnt_idmap(struct mnt_idmap *idmap)
257 {
258 if (idmap->uid_map.nr_extents > UID_GID_MAP_MAX_BASE_EXTENTS) {
259 kfree(idmap->uid_map.forward);
260 kfree(idmap->uid_map.reverse);
261 }
262 if (idmap->gid_map.nr_extents > UID_GID_MAP_MAX_BASE_EXTENTS) {
263 kfree(idmap->gid_map.forward);
264 kfree(idmap->gid_map.reverse);
265 }
266 kfree(idmap);
267 }
268
alloc_mnt_idmap(struct user_namespace * mnt_userns)269 struct mnt_idmap *alloc_mnt_idmap(struct user_namespace *mnt_userns)
270 {
271 struct mnt_idmap *idmap;
272 int ret;
273
274 idmap = kzalloc(sizeof(struct mnt_idmap), GFP_KERNEL_ACCOUNT);
275 if (!idmap)
276 return ERR_PTR(-ENOMEM);
277
278 refcount_set(&idmap->count, 1);
279 ret = copy_mnt_idmap(&mnt_userns->uid_map, &idmap->uid_map);
280 if (!ret)
281 ret = copy_mnt_idmap(&mnt_userns->gid_map, &idmap->gid_map);
282 if (ret) {
283 free_mnt_idmap(idmap);
284 idmap = ERR_PTR(ret);
285 }
286 return idmap;
287 }
288
289 /**
290 * mnt_idmap_get - get a reference to an idmapping
291 * @idmap: the idmap to bump the reference on
292 *
293 * If @idmap is not the @nop_mnt_idmap bump the reference count.
294 *
295 * Return: @idmap with reference count bumped if @not_mnt_idmap isn't passed.
296 */
mnt_idmap_get(struct mnt_idmap * idmap)297 struct mnt_idmap *mnt_idmap_get(struct mnt_idmap *idmap)
298 {
299 if (idmap != &nop_mnt_idmap)
300 refcount_inc(&idmap->count);
301
302 return idmap;
303 }
304 EXPORT_SYMBOL_GPL(mnt_idmap_get);
305
306 /**
307 * mnt_idmap_put - put a reference to an idmapping
308 * @idmap: the idmap to put the reference on
309 *
310 * If this is a non-initial idmapping, put the reference count when a mount is
311 * released and free it if we're the last user.
312 */
mnt_idmap_put(struct mnt_idmap * idmap)313 void mnt_idmap_put(struct mnt_idmap *idmap)
314 {
315 if (idmap != &nop_mnt_idmap && refcount_dec_and_test(&idmap->count))
316 free_mnt_idmap(idmap);
317 }
318 EXPORT_SYMBOL_GPL(mnt_idmap_put);
319