1 // SPDX-License-Identifier: GPL-2.0 2 #include <linux/syscalls.h> 3 #include <linux/slab.h> 4 #include <linux/fs.h> 5 #include <linux/file.h> 6 #include <linux/mount.h> 7 #include <linux/namei.h> 8 #include <linux/exportfs.h> 9 #include <linux/fs_struct.h> 10 #include <linux/fsnotify.h> 11 #include <linux/personality.h> 12 #include <linux/uaccess.h> 13 #include <linux/compat.h> 14 #include "internal.h" 15 #include "mount.h" 16 17 static long do_sys_name_to_handle(const struct path *path, 18 struct file_handle __user *ufh, 19 int __user *mnt_id, int fh_flags) 20 { 21 long retval; 22 struct file_handle f_handle; 23 int handle_dwords, handle_bytes; 24 struct file_handle *handle = NULL; 25 26 /* 27 * We need to make sure whether the file system support decoding of 28 * the file handle if decodeable file handle was requested. 29 */ 30 if (!exportfs_can_encode_fh(path->dentry->d_sb->s_export_op, fh_flags)) 31 return -EOPNOTSUPP; 32 33 if (copy_from_user(&f_handle, ufh, sizeof(struct file_handle))) 34 return -EFAULT; 35 36 if (f_handle.handle_bytes > MAX_HANDLE_SZ) 37 return -EINVAL; 38 39 handle = kzalloc(struct_size(handle, f_handle, f_handle.handle_bytes), 40 GFP_KERNEL); 41 if (!handle) 42 return -ENOMEM; 43 44 /* convert handle size to multiple of sizeof(u32) */ 45 handle_dwords = f_handle.handle_bytes >> 2; 46 47 /* we ask for a non connectable maybe decodeable file handle */ 48 retval = exportfs_encode_fh(path->dentry, 49 (struct fid *)handle->f_handle, 50 &handle_dwords, fh_flags); 51 handle->handle_type = retval; 52 /* convert handle size to bytes */ 53 handle_bytes = handle_dwords * sizeof(u32); 54 handle->handle_bytes = handle_bytes; 55 if ((handle->handle_bytes > f_handle.handle_bytes) || 56 (retval == FILEID_INVALID) || (retval < 0)) { 57 /* As per old exportfs_encode_fh documentation 58 * we could return ENOSPC to indicate overflow 59 * But file system returned 255 always. So handle 60 * both the values 61 */ 62 if (retval == FILEID_INVALID || retval == -ENOSPC) 63 retval = -EOVERFLOW; 64 /* 65 * set the handle size to zero so we copy only 66 * non variable part of the file_handle 67 */ 68 handle_bytes = 0; 69 } else 70 retval = 0; 71 /* copy the mount id */ 72 if (put_user(real_mount(path->mnt)->mnt_id, mnt_id) || 73 copy_to_user(ufh, handle, 74 struct_size(handle, f_handle, handle_bytes))) 75 retval = -EFAULT; 76 kfree(handle); 77 return retval; 78 } 79 80 /** 81 * sys_name_to_handle_at: convert name to handle 82 * @dfd: directory relative to which name is interpreted if not absolute 83 * @name: name that should be converted to handle. 84 * @handle: resulting file handle 85 * @mnt_id: mount id of the file system containing the file 86 * @flag: flag value to indicate whether to follow symlink or not 87 * and whether a decodable file handle is required. 88 * 89 * @handle->handle_size indicate the space available to store the 90 * variable part of the file handle in bytes. If there is not 91 * enough space, the field is updated to return the minimum 92 * value required. 93 */ 94 SYSCALL_DEFINE5(name_to_handle_at, int, dfd, const char __user *, name, 95 struct file_handle __user *, handle, int __user *, mnt_id, 96 int, flag) 97 { 98 struct path path; 99 int lookup_flags; 100 int fh_flags; 101 int err; 102 103 if (flag & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH | AT_HANDLE_FID)) 104 return -EINVAL; 105 106 lookup_flags = (flag & AT_SYMLINK_FOLLOW) ? LOOKUP_FOLLOW : 0; 107 fh_flags = (flag & AT_HANDLE_FID) ? EXPORT_FH_FID : 0; 108 if (flag & AT_EMPTY_PATH) 109 lookup_flags |= LOOKUP_EMPTY; 110 err = user_path_at(dfd, name, lookup_flags, &path); 111 if (!err) { 112 err = do_sys_name_to_handle(&path, handle, mnt_id, fh_flags); 113 path_put(&path); 114 } 115 return err; 116 } 117 118 static int get_path_from_fd(int fd, struct path *root) 119 { 120 if (fd == AT_FDCWD) { 121 struct fs_struct *fs = current->fs; 122 spin_lock(&fs->lock); 123 *root = fs->pwd; 124 path_get(root); 125 spin_unlock(&fs->lock); 126 } else { 127 struct fd f = fdget(fd); 128 if (!f.file) 129 return -EBADF; 130 *root = f.file->f_path; 131 path_get(root); 132 fdput(f); 133 } 134 135 return 0; 136 } 137 138 enum handle_to_path_flags { 139 HANDLE_CHECK_PERMS = (1 << 0), 140 HANDLE_CHECK_SUBTREE = (1 << 1), 141 }; 142 143 struct handle_to_path_ctx { 144 struct path root; 145 enum handle_to_path_flags flags; 146 unsigned int fh_flags; 147 }; 148 149 static int vfs_dentry_acceptable(void *context, struct dentry *dentry) 150 { 151 struct handle_to_path_ctx *ctx = context; 152 struct user_namespace *user_ns = current_user_ns(); 153 struct dentry *d, *root = ctx->root.dentry; 154 struct mnt_idmap *idmap = mnt_idmap(ctx->root.mnt); 155 int retval = 0; 156 157 if (!root) 158 return 1; 159 160 /* Old permission model with global CAP_DAC_READ_SEARCH. */ 161 if (!ctx->flags) 162 return 1; 163 164 /* 165 * It's racy as we're not taking rename_lock but we're able to ignore 166 * permissions and we just need an approximation whether we were able 167 * to follow a path to the file. 168 * 169 * It's also potentially expensive on some filesystems especially if 170 * there is a deep path. 171 */ 172 d = dget(dentry); 173 while (d != root && !IS_ROOT(d)) { 174 struct dentry *parent = dget_parent(d); 175 176 /* 177 * We know that we have the ability to override DAC permissions 178 * as we've verified this earlier via CAP_DAC_READ_SEARCH. But 179 * we also need to make sure that there aren't any unmapped 180 * inodes in the path that would prevent us from reaching the 181 * file. 182 */ 183 if (!privileged_wrt_inode_uidgid(user_ns, idmap, 184 d_inode(parent))) { 185 dput(d); 186 dput(parent); 187 return retval; 188 } 189 190 dput(d); 191 d = parent; 192 } 193 194 if (!(ctx->flags & HANDLE_CHECK_SUBTREE) || d == root) 195 retval = 1; 196 WARN_ON_ONCE(d != root && d != root->d_sb->s_root); 197 dput(d); 198 return retval; 199 } 200 201 static int do_handle_to_path(struct file_handle *handle, struct path *path, 202 struct handle_to_path_ctx *ctx) 203 { 204 int handle_dwords; 205 struct vfsmount *mnt = ctx->root.mnt; 206 207 /* change the handle size to multiple of sizeof(u32) */ 208 handle_dwords = handle->handle_bytes >> 2; 209 path->dentry = exportfs_decode_fh_raw(mnt, 210 (struct fid *)handle->f_handle, 211 handle_dwords, handle->handle_type, 212 ctx->fh_flags, 213 vfs_dentry_acceptable, ctx); 214 if (IS_ERR_OR_NULL(path->dentry)) { 215 if (path->dentry == ERR_PTR(-ENOMEM)) 216 return -ENOMEM; 217 return -ESTALE; 218 } 219 path->mnt = mntget(mnt); 220 return 0; 221 } 222 223 /* 224 * Allow relaxed permissions of file handles if the caller has the 225 * ability to mount the filesystem or create a bind-mount of the 226 * provided @mountdirfd. 227 * 228 * In both cases the caller may be able to get an unobstructed way to 229 * the encoded file handle. If the caller is only able to create a 230 * bind-mount we need to verify that there are no locked mounts on top 231 * of it that could prevent us from getting to the encoded file. 232 * 233 * In principle, locked mounts can prevent the caller from mounting the 234 * filesystem but that only applies to procfs and sysfs neither of which 235 * support decoding file handles. 236 */ 237 static inline bool may_decode_fh(struct handle_to_path_ctx *ctx, 238 unsigned int o_flags) 239 { 240 struct path *root = &ctx->root; 241 242 /* 243 * Restrict to O_DIRECTORY to provide a deterministic API that avoids a 244 * confusing api in the face of disconnected non-dir dentries. 245 * 246 * There's only one dentry for each directory inode (VFS rule)... 247 */ 248 if (!(o_flags & O_DIRECTORY)) 249 return false; 250 251 if (ns_capable(root->mnt->mnt_sb->s_user_ns, CAP_SYS_ADMIN)) 252 ctx->flags = HANDLE_CHECK_PERMS; 253 else if (is_mounted(root->mnt) && 254 ns_capable(real_mount(root->mnt)->mnt_ns->user_ns, 255 CAP_SYS_ADMIN) && 256 !has_locked_children(real_mount(root->mnt), root->dentry)) 257 ctx->flags = HANDLE_CHECK_PERMS | HANDLE_CHECK_SUBTREE; 258 else 259 return false; 260 261 /* Are we able to override DAC permissions? */ 262 if (!ns_capable(current_user_ns(), CAP_DAC_READ_SEARCH)) 263 return false; 264 265 ctx->fh_flags = EXPORT_FH_DIR_ONLY; 266 return true; 267 } 268 269 static int handle_to_path(int mountdirfd, struct file_handle __user *ufh, 270 struct path *path, unsigned int o_flags) 271 { 272 int retval = 0; 273 struct file_handle f_handle; 274 struct file_handle *handle = NULL; 275 struct handle_to_path_ctx ctx = {}; 276 277 retval = get_path_from_fd(mountdirfd, &ctx.root); 278 if (retval) 279 goto out_err; 280 281 if (!capable(CAP_DAC_READ_SEARCH) && !may_decode_fh(&ctx, o_flags)) { 282 retval = -EPERM; 283 goto out_path; 284 } 285 286 if (copy_from_user(&f_handle, ufh, sizeof(struct file_handle))) { 287 retval = -EFAULT; 288 goto out_path; 289 } 290 if ((f_handle.handle_bytes > MAX_HANDLE_SZ) || 291 (f_handle.handle_bytes == 0)) { 292 retval = -EINVAL; 293 goto out_path; 294 } 295 handle = kmalloc(struct_size(handle, f_handle, f_handle.handle_bytes), 296 GFP_KERNEL); 297 if (!handle) { 298 retval = -ENOMEM; 299 goto out_path; 300 } 301 /* copy the full handle */ 302 *handle = f_handle; 303 if (copy_from_user(&handle->f_handle, 304 &ufh->f_handle, 305 f_handle.handle_bytes)) { 306 retval = -EFAULT; 307 goto out_handle; 308 } 309 310 retval = do_handle_to_path(handle, path, &ctx); 311 312 out_handle: 313 kfree(handle); 314 out_path: 315 path_put(&ctx.root); 316 out_err: 317 return retval; 318 } 319 320 static long do_handle_open(int mountdirfd, struct file_handle __user *ufh, 321 int open_flag) 322 { 323 long retval = 0; 324 struct path path; 325 struct file *file; 326 int fd; 327 328 retval = handle_to_path(mountdirfd, ufh, &path, open_flag); 329 if (retval) 330 return retval; 331 332 fd = get_unused_fd_flags(open_flag); 333 if (fd < 0) { 334 path_put(&path); 335 return fd; 336 } 337 file = file_open_root(&path, "", open_flag, 0); 338 if (IS_ERR(file)) { 339 put_unused_fd(fd); 340 retval = PTR_ERR(file); 341 } else { 342 retval = fd; 343 fd_install(fd, file); 344 } 345 path_put(&path); 346 return retval; 347 } 348 349 /** 350 * sys_open_by_handle_at: Open the file handle 351 * @mountdirfd: directory file descriptor 352 * @handle: file handle to be opened 353 * @flags: open flags. 354 * 355 * @mountdirfd indicate the directory file descriptor 356 * of the mount point. file handle is decoded relative 357 * to the vfsmount pointed by the @mountdirfd. @flags 358 * value is same as the open(2) flags. 359 */ 360 SYSCALL_DEFINE3(open_by_handle_at, int, mountdirfd, 361 struct file_handle __user *, handle, 362 int, flags) 363 { 364 long ret; 365 366 if (force_o_largefile()) 367 flags |= O_LARGEFILE; 368 369 ret = do_handle_open(mountdirfd, handle, flags); 370 return ret; 371 } 372 373 #ifdef CONFIG_COMPAT 374 /* 375 * Exactly like fs/open.c:sys_open_by_handle_at(), except that it 376 * doesn't set the O_LARGEFILE flag. 377 */ 378 COMPAT_SYSCALL_DEFINE3(open_by_handle_at, int, mountdirfd, 379 struct file_handle __user *, handle, int, flags) 380 { 381 return do_handle_open(mountdirfd, handle, flags); 382 } 383 #endif 384