xref: /linux/fs/attr.c (revision b27c82e1296572cfa3997e58db3118a33915f85c)
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3  *  linux/fs/attr.c
4  *
5  *  Copyright (C) 1991, 1992  Linus Torvalds
6  *  changes by Thomas Schoebel-Theuer
7  */
8 
9 #include <linux/export.h>
10 #include <linux/time.h>
11 #include <linux/mm.h>
12 #include <linux/string.h>
13 #include <linux/sched/signal.h>
14 #include <linux/capability.h>
15 #include <linux/fsnotify.h>
16 #include <linux/fcntl.h>
17 #include <linux/security.h>
18 #include <linux/evm.h>
19 #include <linux/ima.h>
20 
21 /**
22  * chown_ok - verify permissions to chown inode
23  * @mnt_userns:	user namespace of the mount @inode was found from
24  * @inode:	inode to check permissions on
25  * @uid:	uid to chown @inode to
26  *
27  * If the inode has been found through an idmapped mount the user namespace of
28  * the vfsmount must be passed through @mnt_userns. This function will then
29  * take care to map the inode according to @mnt_userns before checking
30  * permissions. On non-idmapped mounts or if permission checking is to be
31  * performed on the raw inode simply passs init_user_ns.
32  */
33 static bool chown_ok(struct user_namespace *mnt_userns,
34 		     const struct inode *inode, vfsuid_t ia_vfsuid)
35 {
36 	vfsuid_t vfsuid = i_uid_into_vfsuid(mnt_userns, inode);
37 	if (vfsuid_eq_kuid(vfsuid, current_fsuid()) &&
38 	    vfsuid_eq(ia_vfsuid, vfsuid))
39 		return true;
40 	if (capable_wrt_inode_uidgid(mnt_userns, inode, CAP_CHOWN))
41 		return true;
42 	if (!vfsuid_valid(vfsuid) &&
43 	    ns_capable(inode->i_sb->s_user_ns, CAP_CHOWN))
44 		return true;
45 	return false;
46 }
47 
48 /**
49  * chgrp_ok - verify permissions to chgrp inode
50  * @mnt_userns:	user namespace of the mount @inode was found from
51  * @inode:	inode to check permissions on
52  * @gid:	gid to chown @inode to
53  *
54  * If the inode has been found through an idmapped mount the user namespace of
55  * the vfsmount must be passed through @mnt_userns. This function will then
56  * take care to map the inode according to @mnt_userns before checking
57  * permissions. On non-idmapped mounts or if permission checking is to be
58  * performed on the raw inode simply passs init_user_ns.
59  */
60 static bool chgrp_ok(struct user_namespace *mnt_userns,
61 		     const struct inode *inode, vfsgid_t ia_vfsgid)
62 {
63 	vfsgid_t vfsgid = i_gid_into_vfsgid(mnt_userns, inode);
64 	vfsuid_t vfsuid = i_uid_into_vfsuid(mnt_userns, inode);
65 	if (vfsuid_eq_kuid(vfsuid, current_fsuid())) {
66 		if (vfsgid_eq(ia_vfsgid, vfsgid))
67 			return true;
68 		if (vfsgid_in_group_p(ia_vfsgid))
69 			return true;
70 	}
71 	if (capable_wrt_inode_uidgid(mnt_userns, inode, CAP_CHOWN))
72 		return true;
73 	if (!vfsgid_valid(vfsgid) &&
74 	    ns_capable(inode->i_sb->s_user_ns, CAP_CHOWN))
75 		return true;
76 	return false;
77 }
78 
79 /**
80  * setattr_prepare - check if attribute changes to a dentry are allowed
81  * @mnt_userns:	user namespace of the mount the inode was found from
82  * @dentry:	dentry to check
83  * @attr:	attributes to change
84  *
85  * Check if we are allowed to change the attributes contained in @attr
86  * in the given dentry.  This includes the normal unix access permission
87  * checks, as well as checks for rlimits and others. The function also clears
88  * SGID bit from mode if user is not allowed to set it. Also file capabilities
89  * and IMA extended attributes are cleared if ATTR_KILL_PRIV is set.
90  *
91  * If the inode has been found through an idmapped mount the user namespace of
92  * the vfsmount must be passed through @mnt_userns. This function will then
93  * take care to map the inode according to @mnt_userns before checking
94  * permissions. On non-idmapped mounts or if permission checking is to be
95  * performed on the raw inode simply passs init_user_ns.
96  *
97  * Should be called as the first thing in ->setattr implementations,
98  * possibly after taking additional locks.
99  */
100 int setattr_prepare(struct user_namespace *mnt_userns, struct dentry *dentry,
101 		    struct iattr *attr)
102 {
103 	struct inode *inode = d_inode(dentry);
104 	unsigned int ia_valid = attr->ia_valid;
105 
106 	/*
107 	 * First check size constraints.  These can't be overriden using
108 	 * ATTR_FORCE.
109 	 */
110 	if (ia_valid & ATTR_SIZE) {
111 		int error = inode_newsize_ok(inode, attr->ia_size);
112 		if (error)
113 			return error;
114 	}
115 
116 	/* If force is set do it anyway. */
117 	if (ia_valid & ATTR_FORCE)
118 		goto kill_priv;
119 
120 	/* Make sure a caller can chown. */
121 	if ((ia_valid & ATTR_UID) &&
122 	    !chown_ok(mnt_userns, inode, attr->ia_vfsuid))
123 		return -EPERM;
124 
125 	/* Make sure caller can chgrp. */
126 	if ((ia_valid & ATTR_GID) &&
127 	    !chgrp_ok(mnt_userns, inode, attr->ia_vfsgid))
128 		return -EPERM;
129 
130 	/* Make sure a caller can chmod. */
131 	if (ia_valid & ATTR_MODE) {
132 		vfsgid_t vfsgid;
133 
134 		if (!inode_owner_or_capable(mnt_userns, inode))
135 			return -EPERM;
136 
137 		if (ia_valid & ATTR_GID)
138 			vfsgid = attr->ia_vfsgid;
139 		else
140 			vfsgid = i_gid_into_vfsgid(mnt_userns, inode);
141 
142 		/* Also check the setgid bit! */
143 		if (!vfsgid_in_group_p(vfsgid) &&
144 		    !capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FSETID))
145 			attr->ia_mode &= ~S_ISGID;
146 	}
147 
148 	/* Check for setting the inode time. */
149 	if (ia_valid & (ATTR_MTIME_SET | ATTR_ATIME_SET | ATTR_TIMES_SET)) {
150 		if (!inode_owner_or_capable(mnt_userns, inode))
151 			return -EPERM;
152 	}
153 
154 kill_priv:
155 	/* User has permission for the change */
156 	if (ia_valid & ATTR_KILL_PRIV) {
157 		int error;
158 
159 		error = security_inode_killpriv(mnt_userns, dentry);
160 		if (error)
161 			return error;
162 	}
163 
164 	return 0;
165 }
166 EXPORT_SYMBOL(setattr_prepare);
167 
168 /**
169  * inode_newsize_ok - may this inode be truncated to a given size
170  * @inode:	the inode to be truncated
171  * @offset:	the new size to assign to the inode
172  *
173  * inode_newsize_ok must be called with i_mutex held.
174  *
175  * inode_newsize_ok will check filesystem limits and ulimits to check that the
176  * new inode size is within limits. inode_newsize_ok will also send SIGXFSZ
177  * when necessary. Caller must not proceed with inode size change if failure is
178  * returned. @inode must be a file (not directory), with appropriate
179  * permissions to allow truncate (inode_newsize_ok does NOT check these
180  * conditions).
181  *
182  * Return: 0 on success, -ve errno on failure
183  */
184 int inode_newsize_ok(const struct inode *inode, loff_t offset)
185 {
186 	if (inode->i_size < offset) {
187 		unsigned long limit;
188 
189 		limit = rlimit(RLIMIT_FSIZE);
190 		if (limit != RLIM_INFINITY && offset > limit)
191 			goto out_sig;
192 		if (offset > inode->i_sb->s_maxbytes)
193 			goto out_big;
194 	} else {
195 		/*
196 		 * truncation of in-use swapfiles is disallowed - it would
197 		 * cause subsequent swapout to scribble on the now-freed
198 		 * blocks.
199 		 */
200 		if (IS_SWAPFILE(inode))
201 			return -ETXTBSY;
202 	}
203 
204 	return 0;
205 out_sig:
206 	send_sig(SIGXFSZ, current, 0);
207 out_big:
208 	return -EFBIG;
209 }
210 EXPORT_SYMBOL(inode_newsize_ok);
211 
212 /**
213  * setattr_copy - copy simple metadata updates into the generic inode
214  * @mnt_userns:	user namespace of the mount the inode was found from
215  * @inode:	the inode to be updated
216  * @attr:	the new attributes
217  *
218  * setattr_copy must be called with i_mutex held.
219  *
220  * setattr_copy updates the inode's metadata with that specified
221  * in attr on idmapped mounts. Necessary permission checks to determine
222  * whether or not the S_ISGID property needs to be removed are performed with
223  * the correct idmapped mount permission helpers.
224  * Noticeably missing is inode size update, which is more complex
225  * as it requires pagecache updates.
226  *
227  * If the inode has been found through an idmapped mount the user namespace of
228  * the vfsmount must be passed through @mnt_userns. This function will then
229  * take care to map the inode according to @mnt_userns before checking
230  * permissions. On non-idmapped mounts or if permission checking is to be
231  * performed on the raw inode simply passs init_user_ns.
232  *
233  * The inode is not marked as dirty after this operation. The rationale is
234  * that for "simple" filesystems, the struct inode is the inode storage.
235  * The caller is free to mark the inode dirty afterwards if needed.
236  */
237 void setattr_copy(struct user_namespace *mnt_userns, struct inode *inode,
238 		  const struct iattr *attr)
239 {
240 	unsigned int ia_valid = attr->ia_valid;
241 
242 	i_uid_update(mnt_userns, attr, inode);
243 	i_gid_update(mnt_userns, attr, inode);
244 	if (ia_valid & ATTR_ATIME)
245 		inode->i_atime = attr->ia_atime;
246 	if (ia_valid & ATTR_MTIME)
247 		inode->i_mtime = attr->ia_mtime;
248 	if (ia_valid & ATTR_CTIME)
249 		inode->i_ctime = attr->ia_ctime;
250 	if (ia_valid & ATTR_MODE) {
251 		umode_t mode = attr->ia_mode;
252 		vfsgid_t vfsgid = i_gid_into_vfsgid(mnt_userns, inode);
253 		if (!vfsgid_in_group_p(vfsgid) &&
254 		    !capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FSETID))
255 			mode &= ~S_ISGID;
256 		inode->i_mode = mode;
257 	}
258 }
259 EXPORT_SYMBOL(setattr_copy);
260 
261 int may_setattr(struct user_namespace *mnt_userns, struct inode *inode,
262 		unsigned int ia_valid)
263 {
264 	int error;
265 
266 	if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID | ATTR_TIMES_SET)) {
267 		if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
268 			return -EPERM;
269 	}
270 
271 	/*
272 	 * If utimes(2) and friends are called with times == NULL (or both
273 	 * times are UTIME_NOW), then we need to check for write permission
274 	 */
275 	if (ia_valid & ATTR_TOUCH) {
276 		if (IS_IMMUTABLE(inode))
277 			return -EPERM;
278 
279 		if (!inode_owner_or_capable(mnt_userns, inode)) {
280 			error = inode_permission(mnt_userns, inode, MAY_WRITE);
281 			if (error)
282 				return error;
283 		}
284 	}
285 	return 0;
286 }
287 EXPORT_SYMBOL(may_setattr);
288 
289 /**
290  * notify_change - modify attributes of a filesytem object
291  * @mnt_userns:	user namespace of the mount the inode was found from
292  * @dentry:	object affected
293  * @attr:	new attributes
294  * @delegated_inode: returns inode, if the inode is delegated
295  *
296  * The caller must hold the i_mutex on the affected object.
297  *
298  * If notify_change discovers a delegation in need of breaking,
299  * it will return -EWOULDBLOCK and return a reference to the inode in
300  * delegated_inode.  The caller should then break the delegation and
301  * retry.  Because breaking a delegation may take a long time, the
302  * caller should drop the i_mutex before doing so.
303  *
304  * Alternatively, a caller may pass NULL for delegated_inode.  This may
305  * be appropriate for callers that expect the underlying filesystem not
306  * to be NFS exported.  Also, passing NULL is fine for callers holding
307  * the file open for write, as there can be no conflicting delegation in
308  * that case.
309  *
310  * If the inode has been found through an idmapped mount the user namespace of
311  * the vfsmount must be passed through @mnt_userns. This function will then
312  * take care to map the inode according to @mnt_userns before checking
313  * permissions. On non-idmapped mounts or if permission checking is to be
314  * performed on the raw inode simply passs init_user_ns.
315  */
316 int notify_change(struct user_namespace *mnt_userns, struct dentry *dentry,
317 		  struct iattr *attr, struct inode **delegated_inode)
318 {
319 	struct inode *inode = dentry->d_inode;
320 	umode_t mode = inode->i_mode;
321 	int error;
322 	struct timespec64 now;
323 	unsigned int ia_valid = attr->ia_valid;
324 
325 	WARN_ON_ONCE(!inode_is_locked(inode));
326 
327 	error = may_setattr(mnt_userns, inode, ia_valid);
328 	if (error)
329 		return error;
330 
331 	if ((ia_valid & ATTR_MODE)) {
332 		umode_t amode = attr->ia_mode;
333 		/* Flag setting protected by i_mutex */
334 		if (is_sxid(amode))
335 			inode->i_flags &= ~S_NOSEC;
336 	}
337 
338 	now = current_time(inode);
339 
340 	attr->ia_ctime = now;
341 	if (!(ia_valid & ATTR_ATIME_SET))
342 		attr->ia_atime = now;
343 	else
344 		attr->ia_atime = timestamp_truncate(attr->ia_atime, inode);
345 	if (!(ia_valid & ATTR_MTIME_SET))
346 		attr->ia_mtime = now;
347 	else
348 		attr->ia_mtime = timestamp_truncate(attr->ia_mtime, inode);
349 
350 	if (ia_valid & ATTR_KILL_PRIV) {
351 		error = security_inode_need_killpriv(dentry);
352 		if (error < 0)
353 			return error;
354 		if (error == 0)
355 			ia_valid = attr->ia_valid &= ~ATTR_KILL_PRIV;
356 	}
357 
358 	/*
359 	 * We now pass ATTR_KILL_S*ID to the lower level setattr function so
360 	 * that the function has the ability to reinterpret a mode change
361 	 * that's due to these bits. This adds an implicit restriction that
362 	 * no function will ever call notify_change with both ATTR_MODE and
363 	 * ATTR_KILL_S*ID set.
364 	 */
365 	if ((ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) &&
366 	    (ia_valid & ATTR_MODE))
367 		BUG();
368 
369 	if (ia_valid & ATTR_KILL_SUID) {
370 		if (mode & S_ISUID) {
371 			ia_valid = attr->ia_valid |= ATTR_MODE;
372 			attr->ia_mode = (inode->i_mode & ~S_ISUID);
373 		}
374 	}
375 	if (ia_valid & ATTR_KILL_SGID) {
376 		if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
377 			if (!(ia_valid & ATTR_MODE)) {
378 				ia_valid = attr->ia_valid |= ATTR_MODE;
379 				attr->ia_mode = inode->i_mode;
380 			}
381 			attr->ia_mode &= ~S_ISGID;
382 		}
383 	}
384 	if (!(attr->ia_valid & ~(ATTR_KILL_SUID | ATTR_KILL_SGID)))
385 		return 0;
386 
387 	/*
388 	 * Verify that uid/gid changes are valid in the target
389 	 * namespace of the superblock.
390 	 */
391 	if (ia_valid & ATTR_UID &&
392 	    !vfsuid_has_fsmapping(mnt_userns, inode->i_sb->s_user_ns,
393 				  attr->ia_vfsuid))
394 		return -EOVERFLOW;
395 	if (ia_valid & ATTR_GID &&
396 	    !vfsgid_has_fsmapping(mnt_userns, inode->i_sb->s_user_ns,
397 				  attr->ia_vfsgid))
398 		return -EOVERFLOW;
399 
400 	/* Don't allow modifications of files with invalid uids or
401 	 * gids unless those uids & gids are being made valid.
402 	 */
403 	if (!(ia_valid & ATTR_UID) &&
404 	    !vfsuid_valid(i_uid_into_vfsuid(mnt_userns, inode)))
405 		return -EOVERFLOW;
406 	if (!(ia_valid & ATTR_GID) &&
407 	    !vfsgid_valid(i_gid_into_vfsgid(mnt_userns, inode)))
408 		return -EOVERFLOW;
409 
410 	error = security_inode_setattr(mnt_userns, dentry, attr);
411 	if (error)
412 		return error;
413 	error = try_break_deleg(inode, delegated_inode);
414 	if (error)
415 		return error;
416 
417 	if (inode->i_op->setattr)
418 		error = inode->i_op->setattr(mnt_userns, dentry, attr);
419 	else
420 		error = simple_setattr(mnt_userns, dentry, attr);
421 
422 	if (!error) {
423 		fsnotify_change(dentry, ia_valid);
424 		ima_inode_post_setattr(mnt_userns, dentry);
425 		evm_inode_post_setattr(dentry, ia_valid);
426 	}
427 
428 	return error;
429 }
430 EXPORT_SYMBOL(notify_change);
431