1 // SPDX-License-Identifier: GPL-2.0 2 #include <linux/syscalls.h> 3 #include <linux/slab.h> 4 #include <linux/fs.h> 5 #include <linux/file.h> 6 #include <linux/mount.h> 7 #include <linux/namei.h> 8 #include <linux/exportfs.h> 9 #include <linux/fs_struct.h> 10 #include <linux/fsnotify.h> 11 #include <linux/personality.h> 12 #include <linux/uaccess.h> 13 #include <linux/compat.h> 14 #include "internal.h" 15 #include "mount.h" 16 17 static long do_sys_name_to_handle(const struct path *path, 18 struct file_handle __user *ufh, 19 void __user *mnt_id, bool unique_mntid, 20 int fh_flags) 21 { 22 long retval; 23 struct file_handle f_handle; 24 int handle_dwords, handle_bytes; 25 struct file_handle *handle = NULL; 26 27 /* 28 * We need to make sure whether the file system support decoding of 29 * the file handle if decodeable file handle was requested. 30 */ 31 if (!exportfs_can_encode_fh(path->dentry->d_sb->s_export_op, fh_flags)) 32 return -EOPNOTSUPP; 33 34 if (copy_from_user(&f_handle, ufh, sizeof(struct file_handle))) 35 return -EFAULT; 36 37 if (f_handle.handle_bytes > MAX_HANDLE_SZ) 38 return -EINVAL; 39 40 handle = kzalloc(struct_size(handle, f_handle, f_handle.handle_bytes), 41 GFP_KERNEL); 42 if (!handle) 43 return -ENOMEM; 44 45 /* convert handle size to multiple of sizeof(u32) */ 46 handle_dwords = f_handle.handle_bytes >> 2; 47 48 /* we ask for a non connectable maybe decodeable file handle */ 49 retval = exportfs_encode_fh(path->dentry, 50 (struct fid *)handle->f_handle, 51 &handle_dwords, fh_flags); 52 handle->handle_type = retval; 53 /* convert handle size to bytes */ 54 handle_bytes = handle_dwords * sizeof(u32); 55 handle->handle_bytes = handle_bytes; 56 if ((handle->handle_bytes > f_handle.handle_bytes) || 57 (retval == FILEID_INVALID) || (retval < 0)) { 58 /* As per old exportfs_encode_fh documentation 59 * we could return ENOSPC to indicate overflow 60 * But file system returned 255 always. So handle 61 * both the values 62 */ 63 if (retval == FILEID_INVALID || retval == -ENOSPC) 64 retval = -EOVERFLOW; 65 /* 66 * set the handle size to zero so we copy only 67 * non variable part of the file_handle 68 */ 69 handle_bytes = 0; 70 } else 71 retval = 0; 72 /* copy the mount id */ 73 if (unique_mntid) { 74 if (put_user(real_mount(path->mnt)->mnt_id_unique, 75 (u64 __user *) mnt_id)) 76 retval = -EFAULT; 77 } else { 78 if (put_user(real_mount(path->mnt)->mnt_id, 79 (int __user *) mnt_id)) 80 retval = -EFAULT; 81 } 82 /* copy the handle */ 83 if (retval != -EFAULT && 84 copy_to_user(ufh, handle, 85 struct_size(handle, f_handle, handle_bytes))) 86 retval = -EFAULT; 87 kfree(handle); 88 return retval; 89 } 90 91 /** 92 * sys_name_to_handle_at: convert name to handle 93 * @dfd: directory relative to which name is interpreted if not absolute 94 * @name: name that should be converted to handle. 95 * @handle: resulting file handle 96 * @mnt_id: mount id of the file system containing the file 97 * (u64 if AT_HANDLE_MNT_ID_UNIQUE, otherwise int) 98 * @flag: flag value to indicate whether to follow symlink or not 99 * and whether a decodable file handle is required. 100 * 101 * @handle->handle_size indicate the space available to store the 102 * variable part of the file handle in bytes. If there is not 103 * enough space, the field is updated to return the minimum 104 * value required. 105 */ 106 SYSCALL_DEFINE5(name_to_handle_at, int, dfd, const char __user *, name, 107 struct file_handle __user *, handle, void __user *, mnt_id, 108 int, flag) 109 { 110 struct path path; 111 int lookup_flags; 112 int fh_flags; 113 int err; 114 115 if (flag & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH | AT_HANDLE_FID | 116 AT_HANDLE_MNT_ID_UNIQUE)) 117 return -EINVAL; 118 119 lookup_flags = (flag & AT_SYMLINK_FOLLOW) ? LOOKUP_FOLLOW : 0; 120 fh_flags = (flag & AT_HANDLE_FID) ? EXPORT_FH_FID : 0; 121 if (flag & AT_EMPTY_PATH) 122 lookup_flags |= LOOKUP_EMPTY; 123 err = user_path_at(dfd, name, lookup_flags, &path); 124 if (!err) { 125 err = do_sys_name_to_handle(&path, handle, mnt_id, 126 flag & AT_HANDLE_MNT_ID_UNIQUE, 127 fh_flags); 128 path_put(&path); 129 } 130 return err; 131 } 132 133 static int get_path_from_fd(int fd, struct path *root) 134 { 135 if (fd == AT_FDCWD) { 136 struct fs_struct *fs = current->fs; 137 spin_lock(&fs->lock); 138 *root = fs->pwd; 139 path_get(root); 140 spin_unlock(&fs->lock); 141 } else { 142 struct fd f = fdget(fd); 143 if (!fd_file(f)) 144 return -EBADF; 145 *root = fd_file(f)->f_path; 146 path_get(root); 147 fdput(f); 148 } 149 150 return 0; 151 } 152 153 enum handle_to_path_flags { 154 HANDLE_CHECK_PERMS = (1 << 0), 155 HANDLE_CHECK_SUBTREE = (1 << 1), 156 }; 157 158 struct handle_to_path_ctx { 159 struct path root; 160 enum handle_to_path_flags flags; 161 unsigned int fh_flags; 162 }; 163 164 static int vfs_dentry_acceptable(void *context, struct dentry *dentry) 165 { 166 struct handle_to_path_ctx *ctx = context; 167 struct user_namespace *user_ns = current_user_ns(); 168 struct dentry *d, *root = ctx->root.dentry; 169 struct mnt_idmap *idmap = mnt_idmap(ctx->root.mnt); 170 int retval = 0; 171 172 if (!root) 173 return 1; 174 175 /* Old permission model with global CAP_DAC_READ_SEARCH. */ 176 if (!ctx->flags) 177 return 1; 178 179 /* 180 * It's racy as we're not taking rename_lock but we're able to ignore 181 * permissions and we just need an approximation whether we were able 182 * to follow a path to the file. 183 * 184 * It's also potentially expensive on some filesystems especially if 185 * there is a deep path. 186 */ 187 d = dget(dentry); 188 while (d != root && !IS_ROOT(d)) { 189 struct dentry *parent = dget_parent(d); 190 191 /* 192 * We know that we have the ability to override DAC permissions 193 * as we've verified this earlier via CAP_DAC_READ_SEARCH. But 194 * we also need to make sure that there aren't any unmapped 195 * inodes in the path that would prevent us from reaching the 196 * file. 197 */ 198 if (!privileged_wrt_inode_uidgid(user_ns, idmap, 199 d_inode(parent))) { 200 dput(d); 201 dput(parent); 202 return retval; 203 } 204 205 dput(d); 206 d = parent; 207 } 208 209 if (!(ctx->flags & HANDLE_CHECK_SUBTREE) || d == root) 210 retval = 1; 211 WARN_ON_ONCE(d != root && d != root->d_sb->s_root); 212 dput(d); 213 return retval; 214 } 215 216 static int do_handle_to_path(struct file_handle *handle, struct path *path, 217 struct handle_to_path_ctx *ctx) 218 { 219 int handle_dwords; 220 struct vfsmount *mnt = ctx->root.mnt; 221 222 /* change the handle size to multiple of sizeof(u32) */ 223 handle_dwords = handle->handle_bytes >> 2; 224 path->dentry = exportfs_decode_fh_raw(mnt, 225 (struct fid *)handle->f_handle, 226 handle_dwords, handle->handle_type, 227 ctx->fh_flags, 228 vfs_dentry_acceptable, ctx); 229 if (IS_ERR_OR_NULL(path->dentry)) { 230 if (path->dentry == ERR_PTR(-ENOMEM)) 231 return -ENOMEM; 232 return -ESTALE; 233 } 234 path->mnt = mntget(mnt); 235 return 0; 236 } 237 238 /* 239 * Allow relaxed permissions of file handles if the caller has the 240 * ability to mount the filesystem or create a bind-mount of the 241 * provided @mountdirfd. 242 * 243 * In both cases the caller may be able to get an unobstructed way to 244 * the encoded file handle. If the caller is only able to create a 245 * bind-mount we need to verify that there are no locked mounts on top 246 * of it that could prevent us from getting to the encoded file. 247 * 248 * In principle, locked mounts can prevent the caller from mounting the 249 * filesystem but that only applies to procfs and sysfs neither of which 250 * support decoding file handles. 251 */ 252 static inline bool may_decode_fh(struct handle_to_path_ctx *ctx, 253 unsigned int o_flags) 254 { 255 struct path *root = &ctx->root; 256 257 /* 258 * Restrict to O_DIRECTORY to provide a deterministic API that avoids a 259 * confusing api in the face of disconnected non-dir dentries. 260 * 261 * There's only one dentry for each directory inode (VFS rule)... 262 */ 263 if (!(o_flags & O_DIRECTORY)) 264 return false; 265 266 if (ns_capable(root->mnt->mnt_sb->s_user_ns, CAP_SYS_ADMIN)) 267 ctx->flags = HANDLE_CHECK_PERMS; 268 else if (is_mounted(root->mnt) && 269 ns_capable(real_mount(root->mnt)->mnt_ns->user_ns, 270 CAP_SYS_ADMIN) && 271 !has_locked_children(real_mount(root->mnt), root->dentry)) 272 ctx->flags = HANDLE_CHECK_PERMS | HANDLE_CHECK_SUBTREE; 273 else 274 return false; 275 276 /* Are we able to override DAC permissions? */ 277 if (!ns_capable(current_user_ns(), CAP_DAC_READ_SEARCH)) 278 return false; 279 280 ctx->fh_flags = EXPORT_FH_DIR_ONLY; 281 return true; 282 } 283 284 static int handle_to_path(int mountdirfd, struct file_handle __user *ufh, 285 struct path *path, unsigned int o_flags) 286 { 287 int retval = 0; 288 struct file_handle f_handle; 289 struct file_handle *handle = NULL; 290 struct handle_to_path_ctx ctx = {}; 291 292 retval = get_path_from_fd(mountdirfd, &ctx.root); 293 if (retval) 294 goto out_err; 295 296 if (!capable(CAP_DAC_READ_SEARCH) && !may_decode_fh(&ctx, o_flags)) { 297 retval = -EPERM; 298 goto out_path; 299 } 300 301 if (copy_from_user(&f_handle, ufh, sizeof(struct file_handle))) { 302 retval = -EFAULT; 303 goto out_path; 304 } 305 if ((f_handle.handle_bytes > MAX_HANDLE_SZ) || 306 (f_handle.handle_bytes == 0)) { 307 retval = -EINVAL; 308 goto out_path; 309 } 310 handle = kmalloc(struct_size(handle, f_handle, f_handle.handle_bytes), 311 GFP_KERNEL); 312 if (!handle) { 313 retval = -ENOMEM; 314 goto out_path; 315 } 316 /* copy the full handle */ 317 *handle = f_handle; 318 if (copy_from_user(&handle->f_handle, 319 &ufh->f_handle, 320 f_handle.handle_bytes)) { 321 retval = -EFAULT; 322 goto out_handle; 323 } 324 325 retval = do_handle_to_path(handle, path, &ctx); 326 327 out_handle: 328 kfree(handle); 329 out_path: 330 path_put(&ctx.root); 331 out_err: 332 return retval; 333 } 334 335 static long do_handle_open(int mountdirfd, struct file_handle __user *ufh, 336 int open_flag) 337 { 338 long retval = 0; 339 struct path path; 340 struct file *file; 341 int fd; 342 343 retval = handle_to_path(mountdirfd, ufh, &path, open_flag); 344 if (retval) 345 return retval; 346 347 fd = get_unused_fd_flags(open_flag); 348 if (fd < 0) { 349 path_put(&path); 350 return fd; 351 } 352 file = file_open_root(&path, "", open_flag, 0); 353 if (IS_ERR(file)) { 354 put_unused_fd(fd); 355 retval = PTR_ERR(file); 356 } else { 357 retval = fd; 358 fd_install(fd, file); 359 } 360 path_put(&path); 361 return retval; 362 } 363 364 /** 365 * sys_open_by_handle_at: Open the file handle 366 * @mountdirfd: directory file descriptor 367 * @handle: file handle to be opened 368 * @flags: open flags. 369 * 370 * @mountdirfd indicate the directory file descriptor 371 * of the mount point. file handle is decoded relative 372 * to the vfsmount pointed by the @mountdirfd. @flags 373 * value is same as the open(2) flags. 374 */ 375 SYSCALL_DEFINE3(open_by_handle_at, int, mountdirfd, 376 struct file_handle __user *, handle, 377 int, flags) 378 { 379 long ret; 380 381 if (force_o_largefile()) 382 flags |= O_LARGEFILE; 383 384 ret = do_handle_open(mountdirfd, handle, flags); 385 return ret; 386 } 387 388 #ifdef CONFIG_COMPAT 389 /* 390 * Exactly like fs/open.c:sys_open_by_handle_at(), except that it 391 * doesn't set the O_LARGEFILE flag. 392 */ 393 COMPAT_SYSCALL_DEFINE3(open_by_handle_at, int, mountdirfd, 394 struct file_handle __user *, handle, int, flags) 395 { 396 return do_handle_open(mountdirfd, handle, flags); 397 } 398 #endif 399