1 // SPDX-License-Identifier: GPL-2.0 2 #include <linux/fanotify.h> 3 #include <linux/fcntl.h> 4 #include <linux/fdtable.h> 5 #include <linux/file.h> 6 #include <linux/fs.h> 7 #include <linux/anon_inodes.h> 8 #include <linux/fsnotify_backend.h> 9 #include <linux/init.h> 10 #include <linux/mount.h> 11 #include <linux/namei.h> 12 #include <linux/poll.h> 13 #include <linux/security.h> 14 #include <linux/syscalls.h> 15 #include <linux/slab.h> 16 #include <linux/types.h> 17 #include <linux/uaccess.h> 18 #include <linux/compat.h> 19 #include <linux/sched/signal.h> 20 #include <linux/memcontrol.h> 21 #include <linux/statfs.h> 22 #include <linux/exportfs.h> 23 24 #include <asm/ioctls.h> 25 26 #include "../../mount.h" 27 #include "../fdinfo.h" 28 #include "fanotify.h" 29 30 #define FANOTIFY_DEFAULT_MAX_EVENTS 16384 31 #define FANOTIFY_OLD_DEFAULT_MAX_MARKS 8192 32 #define FANOTIFY_DEFAULT_MAX_GROUPS 128 33 #define FANOTIFY_DEFAULT_FEE_POOL_SIZE 32 34 35 /* 36 * Legacy fanotify marks limits (8192) is per group and we introduced a tunable 37 * limit of marks per user, similar to inotify. Effectively, the legacy limit 38 * of fanotify marks per user is <max marks per group> * <max groups per user>. 39 * This default limit (1M) also happens to match the increased limit of inotify 40 * max_user_watches since v5.10. 41 */ 42 #define FANOTIFY_DEFAULT_MAX_USER_MARKS \ 43 (FANOTIFY_OLD_DEFAULT_MAX_MARKS * FANOTIFY_DEFAULT_MAX_GROUPS) 44 45 /* 46 * Most of the memory cost of adding an inode mark is pinning the marked inode. 47 * The size of the filesystem inode struct is not uniform across filesystems, 48 * so double the size of a VFS inode is used as a conservative approximation. 49 */ 50 #define INODE_MARK_COST (2 * sizeof(struct inode)) 51 52 /* configurable via /proc/sys/fs/fanotify/ */ 53 static int fanotify_max_queued_events __read_mostly; 54 55 #ifdef CONFIG_SYSCTL 56 57 #include <linux/sysctl.h> 58 59 static long ft_zero = 0; 60 static long ft_int_max = INT_MAX; 61 62 static struct ctl_table fanotify_table[] = { 63 { 64 .procname = "max_user_groups", 65 .data = &init_user_ns.ucount_max[UCOUNT_FANOTIFY_GROUPS], 66 .maxlen = sizeof(long), 67 .mode = 0644, 68 .proc_handler = proc_doulongvec_minmax, 69 .extra1 = &ft_zero, 70 .extra2 = &ft_int_max, 71 }, 72 { 73 .procname = "max_user_marks", 74 .data = &init_user_ns.ucount_max[UCOUNT_FANOTIFY_MARKS], 75 .maxlen = sizeof(long), 76 .mode = 0644, 77 .proc_handler = proc_doulongvec_minmax, 78 .extra1 = &ft_zero, 79 .extra2 = &ft_int_max, 80 }, 81 { 82 .procname = "max_queued_events", 83 .data = &fanotify_max_queued_events, 84 .maxlen = sizeof(int), 85 .mode = 0644, 86 .proc_handler = proc_dointvec_minmax, 87 .extra1 = SYSCTL_ZERO 88 }, 89 { } 90 }; 91 92 static void __init fanotify_sysctls_init(void) 93 { 94 register_sysctl("fs/fanotify", fanotify_table); 95 } 96 #else 97 #define fanotify_sysctls_init() do { } while (0) 98 #endif /* CONFIG_SYSCTL */ 99 100 /* 101 * All flags that may be specified in parameter event_f_flags of fanotify_init. 102 * 103 * Internal and external open flags are stored together in field f_flags of 104 * struct file. Only external open flags shall be allowed in event_f_flags. 105 * Internal flags like FMODE_NONOTIFY, FMODE_EXEC, FMODE_NOCMTIME shall be 106 * excluded. 107 */ 108 #define FANOTIFY_INIT_ALL_EVENT_F_BITS ( \ 109 O_ACCMODE | O_APPEND | O_NONBLOCK | \ 110 __O_SYNC | O_DSYNC | O_CLOEXEC | \ 111 O_LARGEFILE | O_NOATIME ) 112 113 extern const struct fsnotify_ops fanotify_fsnotify_ops; 114 115 struct kmem_cache *fanotify_mark_cache __read_mostly; 116 struct kmem_cache *fanotify_fid_event_cachep __read_mostly; 117 struct kmem_cache *fanotify_path_event_cachep __read_mostly; 118 struct kmem_cache *fanotify_perm_event_cachep __read_mostly; 119 120 #define FANOTIFY_EVENT_ALIGN 4 121 #define FANOTIFY_FID_INFO_HDR_LEN \ 122 (sizeof(struct fanotify_event_info_fid) + sizeof(struct file_handle)) 123 #define FANOTIFY_PIDFD_INFO_HDR_LEN \ 124 sizeof(struct fanotify_event_info_pidfd) 125 #define FANOTIFY_ERROR_INFO_LEN \ 126 (sizeof(struct fanotify_event_info_error)) 127 128 static int fanotify_fid_info_len(int fh_len, int name_len) 129 { 130 int info_len = fh_len; 131 132 if (name_len) 133 info_len += name_len + 1; 134 135 return roundup(FANOTIFY_FID_INFO_HDR_LEN + info_len, 136 FANOTIFY_EVENT_ALIGN); 137 } 138 139 /* FAN_RENAME may have one or two dir+name info records */ 140 static int fanotify_dir_name_info_len(struct fanotify_event *event) 141 { 142 struct fanotify_info *info = fanotify_event_info(event); 143 int dir_fh_len = fanotify_event_dir_fh_len(event); 144 int dir2_fh_len = fanotify_event_dir2_fh_len(event); 145 int info_len = 0; 146 147 if (dir_fh_len) 148 info_len += fanotify_fid_info_len(dir_fh_len, 149 info->name_len); 150 if (dir2_fh_len) 151 info_len += fanotify_fid_info_len(dir2_fh_len, 152 info->name2_len); 153 154 return info_len; 155 } 156 157 static size_t fanotify_event_len(unsigned int info_mode, 158 struct fanotify_event *event) 159 { 160 size_t event_len = FAN_EVENT_METADATA_LEN; 161 int fh_len; 162 int dot_len = 0; 163 164 if (!info_mode) 165 return event_len; 166 167 if (fanotify_is_error_event(event->mask)) 168 event_len += FANOTIFY_ERROR_INFO_LEN; 169 170 if (fanotify_event_has_any_dir_fh(event)) { 171 event_len += fanotify_dir_name_info_len(event); 172 } else if ((info_mode & FAN_REPORT_NAME) && 173 (event->mask & FAN_ONDIR)) { 174 /* 175 * With group flag FAN_REPORT_NAME, if name was not recorded in 176 * event on a directory, we will report the name ".". 177 */ 178 dot_len = 1; 179 } 180 181 if (info_mode & FAN_REPORT_PIDFD) 182 event_len += FANOTIFY_PIDFD_INFO_HDR_LEN; 183 184 if (fanotify_event_has_object_fh(event)) { 185 fh_len = fanotify_event_object_fh_len(event); 186 event_len += fanotify_fid_info_len(fh_len, dot_len); 187 } 188 189 return event_len; 190 } 191 192 /* 193 * Remove an hashed event from merge hash table. 194 */ 195 static void fanotify_unhash_event(struct fsnotify_group *group, 196 struct fanotify_event *event) 197 { 198 assert_spin_locked(&group->notification_lock); 199 200 pr_debug("%s: group=%p event=%p bucket=%u\n", __func__, 201 group, event, fanotify_event_hash_bucket(group, event)); 202 203 if (WARN_ON_ONCE(hlist_unhashed(&event->merge_list))) 204 return; 205 206 hlist_del_init(&event->merge_list); 207 } 208 209 /* 210 * Get an fanotify notification event if one exists and is small 211 * enough to fit in "count". Return an error pointer if the count 212 * is not large enough. When permission event is dequeued, its state is 213 * updated accordingly. 214 */ 215 static struct fanotify_event *get_one_event(struct fsnotify_group *group, 216 size_t count) 217 { 218 size_t event_size; 219 struct fanotify_event *event = NULL; 220 struct fsnotify_event *fsn_event; 221 unsigned int info_mode = FAN_GROUP_FLAG(group, FANOTIFY_INFO_MODES); 222 223 pr_debug("%s: group=%p count=%zd\n", __func__, group, count); 224 225 spin_lock(&group->notification_lock); 226 fsn_event = fsnotify_peek_first_event(group); 227 if (!fsn_event) 228 goto out; 229 230 event = FANOTIFY_E(fsn_event); 231 event_size = fanotify_event_len(info_mode, event); 232 233 if (event_size > count) { 234 event = ERR_PTR(-EINVAL); 235 goto out; 236 } 237 238 /* 239 * Held the notification_lock the whole time, so this is the 240 * same event we peeked above. 241 */ 242 fsnotify_remove_first_event(group); 243 if (fanotify_is_perm_event(event->mask)) 244 FANOTIFY_PERM(event)->state = FAN_EVENT_REPORTED; 245 if (fanotify_is_hashed_event(event->mask)) 246 fanotify_unhash_event(group, event); 247 out: 248 spin_unlock(&group->notification_lock); 249 return event; 250 } 251 252 static int create_fd(struct fsnotify_group *group, const struct path *path, 253 struct file **file) 254 { 255 int client_fd; 256 struct file *new_file; 257 258 client_fd = get_unused_fd_flags(group->fanotify_data.f_flags); 259 if (client_fd < 0) 260 return client_fd; 261 262 /* 263 * we need a new file handle for the userspace program so it can read even if it was 264 * originally opened O_WRONLY. 265 */ 266 new_file = dentry_open(path, 267 group->fanotify_data.f_flags | __FMODE_NONOTIFY, 268 current_cred()); 269 if (IS_ERR(new_file)) { 270 /* 271 * we still send an event even if we can't open the file. this 272 * can happen when say tasks are gone and we try to open their 273 * /proc files or we try to open a WRONLY file like in sysfs 274 * we just send the errno to userspace since there isn't much 275 * else we can do. 276 */ 277 put_unused_fd(client_fd); 278 client_fd = PTR_ERR(new_file); 279 } else { 280 *file = new_file; 281 } 282 283 return client_fd; 284 } 285 286 static int process_access_response_info(const char __user *info, 287 size_t info_len, 288 struct fanotify_response_info_audit_rule *friar) 289 { 290 if (info_len != sizeof(*friar)) 291 return -EINVAL; 292 293 if (copy_from_user(friar, info, sizeof(*friar))) 294 return -EFAULT; 295 296 if (friar->hdr.type != FAN_RESPONSE_INFO_AUDIT_RULE) 297 return -EINVAL; 298 if (friar->hdr.pad != 0) 299 return -EINVAL; 300 if (friar->hdr.len != sizeof(*friar)) 301 return -EINVAL; 302 303 return info_len; 304 } 305 306 /* 307 * Finish processing of permission event by setting it to ANSWERED state and 308 * drop group->notification_lock. 309 */ 310 static void finish_permission_event(struct fsnotify_group *group, 311 struct fanotify_perm_event *event, u32 response, 312 struct fanotify_response_info_audit_rule *friar) 313 __releases(&group->notification_lock) 314 { 315 bool destroy = false; 316 317 assert_spin_locked(&group->notification_lock); 318 event->response = response & ~FAN_INFO; 319 if (response & FAN_INFO) 320 memcpy(&event->audit_rule, friar, sizeof(*friar)); 321 322 if (event->state == FAN_EVENT_CANCELED) 323 destroy = true; 324 else 325 event->state = FAN_EVENT_ANSWERED; 326 spin_unlock(&group->notification_lock); 327 if (destroy) 328 fsnotify_destroy_event(group, &event->fae.fse); 329 } 330 331 static int process_access_response(struct fsnotify_group *group, 332 struct fanotify_response *response_struct, 333 const char __user *info, 334 size_t info_len) 335 { 336 struct fanotify_perm_event *event; 337 int fd = response_struct->fd; 338 u32 response = response_struct->response; 339 int ret = info_len; 340 struct fanotify_response_info_audit_rule friar; 341 342 pr_debug("%s: group=%p fd=%d response=%u buf=%p size=%zu\n", __func__, 343 group, fd, response, info, info_len); 344 /* 345 * make sure the response is valid, if invalid we do nothing and either 346 * userspace can send a valid response or we will clean it up after the 347 * timeout 348 */ 349 if (response & ~FANOTIFY_RESPONSE_VALID_MASK) 350 return -EINVAL; 351 352 switch (response & FANOTIFY_RESPONSE_ACCESS) { 353 case FAN_ALLOW: 354 case FAN_DENY: 355 break; 356 default: 357 return -EINVAL; 358 } 359 360 if ((response & FAN_AUDIT) && !FAN_GROUP_FLAG(group, FAN_ENABLE_AUDIT)) 361 return -EINVAL; 362 363 if (response & FAN_INFO) { 364 ret = process_access_response_info(info, info_len, &friar); 365 if (ret < 0) 366 return ret; 367 if (fd == FAN_NOFD) 368 return ret; 369 } else { 370 ret = 0; 371 } 372 373 if (fd < 0) 374 return -EINVAL; 375 376 spin_lock(&group->notification_lock); 377 list_for_each_entry(event, &group->fanotify_data.access_list, 378 fae.fse.list) { 379 if (event->fd != fd) 380 continue; 381 382 list_del_init(&event->fae.fse.list); 383 finish_permission_event(group, event, response, &friar); 384 wake_up(&group->fanotify_data.access_waitq); 385 return ret; 386 } 387 spin_unlock(&group->notification_lock); 388 389 return -ENOENT; 390 } 391 392 static size_t copy_error_info_to_user(struct fanotify_event *event, 393 char __user *buf, int count) 394 { 395 struct fanotify_event_info_error info = { }; 396 struct fanotify_error_event *fee = FANOTIFY_EE(event); 397 398 info.hdr.info_type = FAN_EVENT_INFO_TYPE_ERROR; 399 info.hdr.len = FANOTIFY_ERROR_INFO_LEN; 400 401 if (WARN_ON(count < info.hdr.len)) 402 return -EFAULT; 403 404 info.error = fee->error; 405 info.error_count = fee->err_count; 406 407 if (copy_to_user(buf, &info, sizeof(info))) 408 return -EFAULT; 409 410 return info.hdr.len; 411 } 412 413 static int copy_fid_info_to_user(__kernel_fsid_t *fsid, struct fanotify_fh *fh, 414 int info_type, const char *name, 415 size_t name_len, 416 char __user *buf, size_t count) 417 { 418 struct fanotify_event_info_fid info = { }; 419 struct file_handle handle = { }; 420 unsigned char bounce[FANOTIFY_INLINE_FH_LEN], *fh_buf; 421 size_t fh_len = fh ? fh->len : 0; 422 size_t info_len = fanotify_fid_info_len(fh_len, name_len); 423 size_t len = info_len; 424 425 pr_debug("%s: fh_len=%zu name_len=%zu, info_len=%zu, count=%zu\n", 426 __func__, fh_len, name_len, info_len, count); 427 428 if (WARN_ON_ONCE(len < sizeof(info) || len > count)) 429 return -EFAULT; 430 431 /* 432 * Copy event info fid header followed by variable sized file handle 433 * and optionally followed by variable sized filename. 434 */ 435 switch (info_type) { 436 case FAN_EVENT_INFO_TYPE_FID: 437 case FAN_EVENT_INFO_TYPE_DFID: 438 if (WARN_ON_ONCE(name_len)) 439 return -EFAULT; 440 break; 441 case FAN_EVENT_INFO_TYPE_DFID_NAME: 442 case FAN_EVENT_INFO_TYPE_OLD_DFID_NAME: 443 case FAN_EVENT_INFO_TYPE_NEW_DFID_NAME: 444 if (WARN_ON_ONCE(!name || !name_len)) 445 return -EFAULT; 446 break; 447 default: 448 return -EFAULT; 449 } 450 451 info.hdr.info_type = info_type; 452 info.hdr.len = len; 453 info.fsid = *fsid; 454 if (copy_to_user(buf, &info, sizeof(info))) 455 return -EFAULT; 456 457 buf += sizeof(info); 458 len -= sizeof(info); 459 if (WARN_ON_ONCE(len < sizeof(handle))) 460 return -EFAULT; 461 462 handle.handle_type = fh->type; 463 handle.handle_bytes = fh_len; 464 465 /* Mangle handle_type for bad file_handle */ 466 if (!fh_len) 467 handle.handle_type = FILEID_INVALID; 468 469 if (copy_to_user(buf, &handle, sizeof(handle))) 470 return -EFAULT; 471 472 buf += sizeof(handle); 473 len -= sizeof(handle); 474 if (WARN_ON_ONCE(len < fh_len)) 475 return -EFAULT; 476 477 /* 478 * For an inline fh and inline file name, copy through stack to exclude 479 * the copy from usercopy hardening protections. 480 */ 481 fh_buf = fanotify_fh_buf(fh); 482 if (fh_len <= FANOTIFY_INLINE_FH_LEN) { 483 memcpy(bounce, fh_buf, fh_len); 484 fh_buf = bounce; 485 } 486 if (copy_to_user(buf, fh_buf, fh_len)) 487 return -EFAULT; 488 489 buf += fh_len; 490 len -= fh_len; 491 492 if (name_len) { 493 /* Copy the filename with terminating null */ 494 name_len++; 495 if (WARN_ON_ONCE(len < name_len)) 496 return -EFAULT; 497 498 if (copy_to_user(buf, name, name_len)) 499 return -EFAULT; 500 501 buf += name_len; 502 len -= name_len; 503 } 504 505 /* Pad with 0's */ 506 WARN_ON_ONCE(len < 0 || len >= FANOTIFY_EVENT_ALIGN); 507 if (len > 0 && clear_user(buf, len)) 508 return -EFAULT; 509 510 return info_len; 511 } 512 513 static int copy_pidfd_info_to_user(int pidfd, 514 char __user *buf, 515 size_t count) 516 { 517 struct fanotify_event_info_pidfd info = { }; 518 size_t info_len = FANOTIFY_PIDFD_INFO_HDR_LEN; 519 520 if (WARN_ON_ONCE(info_len > count)) 521 return -EFAULT; 522 523 info.hdr.info_type = FAN_EVENT_INFO_TYPE_PIDFD; 524 info.hdr.len = info_len; 525 info.pidfd = pidfd; 526 527 if (copy_to_user(buf, &info, info_len)) 528 return -EFAULT; 529 530 return info_len; 531 } 532 533 static int copy_info_records_to_user(struct fanotify_event *event, 534 struct fanotify_info *info, 535 unsigned int info_mode, int pidfd, 536 char __user *buf, size_t count) 537 { 538 int ret, total_bytes = 0, info_type = 0; 539 unsigned int fid_mode = info_mode & FANOTIFY_FID_BITS; 540 unsigned int pidfd_mode = info_mode & FAN_REPORT_PIDFD; 541 542 /* 543 * Event info records order is as follows: 544 * 1. dir fid + name 545 * 2. (optional) new dir fid + new name 546 * 3. (optional) child fid 547 */ 548 if (fanotify_event_has_dir_fh(event)) { 549 info_type = info->name_len ? FAN_EVENT_INFO_TYPE_DFID_NAME : 550 FAN_EVENT_INFO_TYPE_DFID; 551 552 /* FAN_RENAME uses special info types */ 553 if (event->mask & FAN_RENAME) 554 info_type = FAN_EVENT_INFO_TYPE_OLD_DFID_NAME; 555 556 ret = copy_fid_info_to_user(fanotify_event_fsid(event), 557 fanotify_info_dir_fh(info), 558 info_type, 559 fanotify_info_name(info), 560 info->name_len, buf, count); 561 if (ret < 0) 562 return ret; 563 564 buf += ret; 565 count -= ret; 566 total_bytes += ret; 567 } 568 569 /* New dir fid+name may be reported in addition to old dir fid+name */ 570 if (fanotify_event_has_dir2_fh(event)) { 571 info_type = FAN_EVENT_INFO_TYPE_NEW_DFID_NAME; 572 ret = copy_fid_info_to_user(fanotify_event_fsid(event), 573 fanotify_info_dir2_fh(info), 574 info_type, 575 fanotify_info_name2(info), 576 info->name2_len, buf, count); 577 if (ret < 0) 578 return ret; 579 580 buf += ret; 581 count -= ret; 582 total_bytes += ret; 583 } 584 585 if (fanotify_event_has_object_fh(event)) { 586 const char *dot = NULL; 587 int dot_len = 0; 588 589 if (fid_mode == FAN_REPORT_FID || info_type) { 590 /* 591 * With only group flag FAN_REPORT_FID only type FID is 592 * reported. Second info record type is always FID. 593 */ 594 info_type = FAN_EVENT_INFO_TYPE_FID; 595 } else if ((fid_mode & FAN_REPORT_NAME) && 596 (event->mask & FAN_ONDIR)) { 597 /* 598 * With group flag FAN_REPORT_NAME, if name was not 599 * recorded in an event on a directory, report the name 600 * "." with info type DFID_NAME. 601 */ 602 info_type = FAN_EVENT_INFO_TYPE_DFID_NAME; 603 dot = "."; 604 dot_len = 1; 605 } else if ((event->mask & ALL_FSNOTIFY_DIRENT_EVENTS) || 606 (event->mask & FAN_ONDIR)) { 607 /* 608 * With group flag FAN_REPORT_DIR_FID, a single info 609 * record has type DFID for directory entry modification 610 * event and for event on a directory. 611 */ 612 info_type = FAN_EVENT_INFO_TYPE_DFID; 613 } else { 614 /* 615 * With group flags FAN_REPORT_DIR_FID|FAN_REPORT_FID, 616 * a single info record has type FID for event on a 617 * non-directory, when there is no directory to report. 618 * For example, on FAN_DELETE_SELF event. 619 */ 620 info_type = FAN_EVENT_INFO_TYPE_FID; 621 } 622 623 ret = copy_fid_info_to_user(fanotify_event_fsid(event), 624 fanotify_event_object_fh(event), 625 info_type, dot, dot_len, 626 buf, count); 627 if (ret < 0) 628 return ret; 629 630 buf += ret; 631 count -= ret; 632 total_bytes += ret; 633 } 634 635 if (pidfd_mode) { 636 ret = copy_pidfd_info_to_user(pidfd, buf, count); 637 if (ret < 0) 638 return ret; 639 640 buf += ret; 641 count -= ret; 642 total_bytes += ret; 643 } 644 645 if (fanotify_is_error_event(event->mask)) { 646 ret = copy_error_info_to_user(event, buf, count); 647 if (ret < 0) 648 return ret; 649 buf += ret; 650 count -= ret; 651 total_bytes += ret; 652 } 653 654 return total_bytes; 655 } 656 657 static ssize_t copy_event_to_user(struct fsnotify_group *group, 658 struct fanotify_event *event, 659 char __user *buf, size_t count) 660 { 661 struct fanotify_event_metadata metadata; 662 const struct path *path = fanotify_event_path(event); 663 struct fanotify_info *info = fanotify_event_info(event); 664 unsigned int info_mode = FAN_GROUP_FLAG(group, FANOTIFY_INFO_MODES); 665 unsigned int pidfd_mode = info_mode & FAN_REPORT_PIDFD; 666 struct file *f = NULL, *pidfd_file = NULL; 667 int ret, pidfd = FAN_NOPIDFD, fd = FAN_NOFD; 668 669 pr_debug("%s: group=%p event=%p\n", __func__, group, event); 670 671 metadata.event_len = fanotify_event_len(info_mode, event); 672 metadata.metadata_len = FAN_EVENT_METADATA_LEN; 673 metadata.vers = FANOTIFY_METADATA_VERSION; 674 metadata.reserved = 0; 675 metadata.mask = event->mask & FANOTIFY_OUTGOING_EVENTS; 676 metadata.pid = pid_vnr(event->pid); 677 /* 678 * For an unprivileged listener, event->pid can be used to identify the 679 * events generated by the listener process itself, without disclosing 680 * the pids of other processes. 681 */ 682 if (FAN_GROUP_FLAG(group, FANOTIFY_UNPRIV) && 683 task_tgid(current) != event->pid) 684 metadata.pid = 0; 685 686 /* 687 * For now, fid mode is required for an unprivileged listener and 688 * fid mode does not report fd in events. Keep this check anyway 689 * for safety in case fid mode requirement is relaxed in the future 690 * to allow unprivileged listener to get events with no fd and no fid. 691 */ 692 if (!FAN_GROUP_FLAG(group, FANOTIFY_UNPRIV) && 693 path && path->mnt && path->dentry) { 694 fd = create_fd(group, path, &f); 695 if (fd < 0) 696 return fd; 697 } 698 metadata.fd = fd; 699 700 if (pidfd_mode) { 701 /* 702 * Complain if the FAN_REPORT_PIDFD and FAN_REPORT_TID mutual 703 * exclusion is ever lifted. At the time of incoporating pidfd 704 * support within fanotify, the pidfd API only supported the 705 * creation of pidfds for thread-group leaders. 706 */ 707 WARN_ON_ONCE(FAN_GROUP_FLAG(group, FAN_REPORT_TID)); 708 709 /* 710 * The PIDTYPE_TGID check for an event->pid is performed 711 * preemptively in an attempt to catch out cases where the event 712 * listener reads events after the event generating process has 713 * already terminated. Report FAN_NOPIDFD to the event listener 714 * in those cases, with all other pidfd creation errors being 715 * reported as FAN_EPIDFD. 716 */ 717 if (metadata.pid == 0 || 718 !pid_has_task(event->pid, PIDTYPE_TGID)) { 719 pidfd = FAN_NOPIDFD; 720 } else { 721 pidfd = pidfd_prepare(event->pid, 0, &pidfd_file); 722 if (pidfd < 0) 723 pidfd = FAN_EPIDFD; 724 } 725 } 726 727 ret = -EFAULT; 728 /* 729 * Sanity check copy size in case get_one_event() and 730 * event_len sizes ever get out of sync. 731 */ 732 if (WARN_ON_ONCE(metadata.event_len > count)) 733 goto out_close_fd; 734 735 if (copy_to_user(buf, &metadata, FAN_EVENT_METADATA_LEN)) 736 goto out_close_fd; 737 738 buf += FAN_EVENT_METADATA_LEN; 739 count -= FAN_EVENT_METADATA_LEN; 740 741 if (fanotify_is_perm_event(event->mask)) 742 FANOTIFY_PERM(event)->fd = fd; 743 744 if (info_mode) { 745 ret = copy_info_records_to_user(event, info, info_mode, pidfd, 746 buf, count); 747 if (ret < 0) 748 goto out_close_fd; 749 } 750 751 if (f) 752 fd_install(fd, f); 753 754 if (pidfd_file) 755 fd_install(pidfd, pidfd_file); 756 757 return metadata.event_len; 758 759 out_close_fd: 760 if (fd != FAN_NOFD) { 761 put_unused_fd(fd); 762 fput(f); 763 } 764 765 if (pidfd >= 0) { 766 put_unused_fd(pidfd); 767 fput(pidfd_file); 768 } 769 770 return ret; 771 } 772 773 /* intofiy userspace file descriptor functions */ 774 static __poll_t fanotify_poll(struct file *file, poll_table *wait) 775 { 776 struct fsnotify_group *group = file->private_data; 777 __poll_t ret = 0; 778 779 poll_wait(file, &group->notification_waitq, wait); 780 spin_lock(&group->notification_lock); 781 if (!fsnotify_notify_queue_is_empty(group)) 782 ret = EPOLLIN | EPOLLRDNORM; 783 spin_unlock(&group->notification_lock); 784 785 return ret; 786 } 787 788 static ssize_t fanotify_read(struct file *file, char __user *buf, 789 size_t count, loff_t *pos) 790 { 791 struct fsnotify_group *group; 792 struct fanotify_event *event; 793 char __user *start; 794 int ret; 795 DEFINE_WAIT_FUNC(wait, woken_wake_function); 796 797 start = buf; 798 group = file->private_data; 799 800 pr_debug("%s: group=%p\n", __func__, group); 801 802 add_wait_queue(&group->notification_waitq, &wait); 803 while (1) { 804 /* 805 * User can supply arbitrarily large buffer. Avoid softlockups 806 * in case there are lots of available events. 807 */ 808 cond_resched(); 809 event = get_one_event(group, count); 810 if (IS_ERR(event)) { 811 ret = PTR_ERR(event); 812 break; 813 } 814 815 if (!event) { 816 ret = -EAGAIN; 817 if (file->f_flags & O_NONBLOCK) 818 break; 819 820 ret = -ERESTARTSYS; 821 if (signal_pending(current)) 822 break; 823 824 if (start != buf) 825 break; 826 827 wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT); 828 continue; 829 } 830 831 ret = copy_event_to_user(group, event, buf, count); 832 if (unlikely(ret == -EOPENSTALE)) { 833 /* 834 * We cannot report events with stale fd so drop it. 835 * Setting ret to 0 will continue the event loop and 836 * do the right thing if there are no more events to 837 * read (i.e. return bytes read, -EAGAIN or wait). 838 */ 839 ret = 0; 840 } 841 842 /* 843 * Permission events get queued to wait for response. Other 844 * events can be destroyed now. 845 */ 846 if (!fanotify_is_perm_event(event->mask)) { 847 fsnotify_destroy_event(group, &event->fse); 848 } else { 849 if (ret <= 0) { 850 spin_lock(&group->notification_lock); 851 finish_permission_event(group, 852 FANOTIFY_PERM(event), FAN_DENY, NULL); 853 wake_up(&group->fanotify_data.access_waitq); 854 } else { 855 spin_lock(&group->notification_lock); 856 list_add_tail(&event->fse.list, 857 &group->fanotify_data.access_list); 858 spin_unlock(&group->notification_lock); 859 } 860 } 861 if (ret < 0) 862 break; 863 buf += ret; 864 count -= ret; 865 } 866 remove_wait_queue(&group->notification_waitq, &wait); 867 868 if (start != buf && ret != -EFAULT) 869 ret = buf - start; 870 return ret; 871 } 872 873 static ssize_t fanotify_write(struct file *file, const char __user *buf, size_t count, loff_t *pos) 874 { 875 struct fanotify_response response; 876 struct fsnotify_group *group; 877 int ret; 878 const char __user *info_buf = buf + sizeof(struct fanotify_response); 879 size_t info_len; 880 881 if (!IS_ENABLED(CONFIG_FANOTIFY_ACCESS_PERMISSIONS)) 882 return -EINVAL; 883 884 group = file->private_data; 885 886 pr_debug("%s: group=%p count=%zu\n", __func__, group, count); 887 888 if (count < sizeof(response)) 889 return -EINVAL; 890 891 if (copy_from_user(&response, buf, sizeof(response))) 892 return -EFAULT; 893 894 info_len = count - sizeof(response); 895 896 ret = process_access_response(group, &response, info_buf, info_len); 897 if (ret < 0) 898 count = ret; 899 else 900 count = sizeof(response) + ret; 901 902 return count; 903 } 904 905 static int fanotify_release(struct inode *ignored, struct file *file) 906 { 907 struct fsnotify_group *group = file->private_data; 908 struct fsnotify_event *fsn_event; 909 910 /* 911 * Stop new events from arriving in the notification queue. since 912 * userspace cannot use fanotify fd anymore, no event can enter or 913 * leave access_list by now either. 914 */ 915 fsnotify_group_stop_queueing(group); 916 917 /* 918 * Process all permission events on access_list and notification queue 919 * and simulate reply from userspace. 920 */ 921 spin_lock(&group->notification_lock); 922 while (!list_empty(&group->fanotify_data.access_list)) { 923 struct fanotify_perm_event *event; 924 925 event = list_first_entry(&group->fanotify_data.access_list, 926 struct fanotify_perm_event, fae.fse.list); 927 list_del_init(&event->fae.fse.list); 928 finish_permission_event(group, event, FAN_ALLOW, NULL); 929 spin_lock(&group->notification_lock); 930 } 931 932 /* 933 * Destroy all non-permission events. For permission events just 934 * dequeue them and set the response. They will be freed once the 935 * response is consumed and fanotify_get_response() returns. 936 */ 937 while ((fsn_event = fsnotify_remove_first_event(group))) { 938 struct fanotify_event *event = FANOTIFY_E(fsn_event); 939 940 if (!(event->mask & FANOTIFY_PERM_EVENTS)) { 941 spin_unlock(&group->notification_lock); 942 fsnotify_destroy_event(group, fsn_event); 943 } else { 944 finish_permission_event(group, FANOTIFY_PERM(event), 945 FAN_ALLOW, NULL); 946 } 947 spin_lock(&group->notification_lock); 948 } 949 spin_unlock(&group->notification_lock); 950 951 /* Response for all permission events it set, wakeup waiters */ 952 wake_up(&group->fanotify_data.access_waitq); 953 954 /* matches the fanotify_init->fsnotify_alloc_group */ 955 fsnotify_destroy_group(group); 956 957 return 0; 958 } 959 960 static long fanotify_ioctl(struct file *file, unsigned int cmd, unsigned long arg) 961 { 962 struct fsnotify_group *group; 963 struct fsnotify_event *fsn_event; 964 void __user *p; 965 int ret = -ENOTTY; 966 size_t send_len = 0; 967 968 group = file->private_data; 969 970 p = (void __user *) arg; 971 972 switch (cmd) { 973 case FIONREAD: 974 spin_lock(&group->notification_lock); 975 list_for_each_entry(fsn_event, &group->notification_list, list) 976 send_len += FAN_EVENT_METADATA_LEN; 977 spin_unlock(&group->notification_lock); 978 ret = put_user(send_len, (int __user *) p); 979 break; 980 } 981 982 return ret; 983 } 984 985 static const struct file_operations fanotify_fops = { 986 .show_fdinfo = fanotify_show_fdinfo, 987 .poll = fanotify_poll, 988 .read = fanotify_read, 989 .write = fanotify_write, 990 .fasync = NULL, 991 .release = fanotify_release, 992 .unlocked_ioctl = fanotify_ioctl, 993 .compat_ioctl = compat_ptr_ioctl, 994 .llseek = noop_llseek, 995 }; 996 997 static int fanotify_find_path(int dfd, const char __user *filename, 998 struct path *path, unsigned int flags, __u64 mask, 999 unsigned int obj_type) 1000 { 1001 int ret; 1002 1003 pr_debug("%s: dfd=%d filename=%p flags=%x\n", __func__, 1004 dfd, filename, flags); 1005 1006 if (filename == NULL) { 1007 struct fd f = fdget(dfd); 1008 1009 ret = -EBADF; 1010 if (!f.file) 1011 goto out; 1012 1013 ret = -ENOTDIR; 1014 if ((flags & FAN_MARK_ONLYDIR) && 1015 !(S_ISDIR(file_inode(f.file)->i_mode))) { 1016 fdput(f); 1017 goto out; 1018 } 1019 1020 *path = f.file->f_path; 1021 path_get(path); 1022 fdput(f); 1023 } else { 1024 unsigned int lookup_flags = 0; 1025 1026 if (!(flags & FAN_MARK_DONT_FOLLOW)) 1027 lookup_flags |= LOOKUP_FOLLOW; 1028 if (flags & FAN_MARK_ONLYDIR) 1029 lookup_flags |= LOOKUP_DIRECTORY; 1030 1031 ret = user_path_at(dfd, filename, lookup_flags, path); 1032 if (ret) 1033 goto out; 1034 } 1035 1036 /* you can only watch an inode if you have read permissions on it */ 1037 ret = path_permission(path, MAY_READ); 1038 if (ret) { 1039 path_put(path); 1040 goto out; 1041 } 1042 1043 ret = security_path_notify(path, mask, obj_type); 1044 if (ret) 1045 path_put(path); 1046 1047 out: 1048 return ret; 1049 } 1050 1051 static __u32 fanotify_mark_remove_from_mask(struct fsnotify_mark *fsn_mark, 1052 __u32 mask, unsigned int flags, 1053 __u32 umask, int *destroy) 1054 { 1055 __u32 oldmask, newmask; 1056 1057 /* umask bits cannot be removed by user */ 1058 mask &= ~umask; 1059 spin_lock(&fsn_mark->lock); 1060 oldmask = fsnotify_calc_mask(fsn_mark); 1061 if (!(flags & FANOTIFY_MARK_IGNORE_BITS)) { 1062 fsn_mark->mask &= ~mask; 1063 } else { 1064 fsn_mark->ignore_mask &= ~mask; 1065 } 1066 newmask = fsnotify_calc_mask(fsn_mark); 1067 /* 1068 * We need to keep the mark around even if remaining mask cannot 1069 * result in any events (e.g. mask == FAN_ONDIR) to support incremenal 1070 * changes to the mask. 1071 * Destroy mark when only umask bits remain. 1072 */ 1073 *destroy = !((fsn_mark->mask | fsn_mark->ignore_mask) & ~umask); 1074 spin_unlock(&fsn_mark->lock); 1075 1076 return oldmask & ~newmask; 1077 } 1078 1079 static int fanotify_remove_mark(struct fsnotify_group *group, 1080 fsnotify_connp_t *connp, __u32 mask, 1081 unsigned int flags, __u32 umask) 1082 { 1083 struct fsnotify_mark *fsn_mark = NULL; 1084 __u32 removed; 1085 int destroy_mark; 1086 1087 fsnotify_group_lock(group); 1088 fsn_mark = fsnotify_find_mark(connp, group); 1089 if (!fsn_mark) { 1090 fsnotify_group_unlock(group); 1091 return -ENOENT; 1092 } 1093 1094 removed = fanotify_mark_remove_from_mask(fsn_mark, mask, flags, 1095 umask, &destroy_mark); 1096 if (removed & fsnotify_conn_mask(fsn_mark->connector)) 1097 fsnotify_recalc_mask(fsn_mark->connector); 1098 if (destroy_mark) 1099 fsnotify_detach_mark(fsn_mark); 1100 fsnotify_group_unlock(group); 1101 if (destroy_mark) 1102 fsnotify_free_mark(fsn_mark); 1103 1104 /* matches the fsnotify_find_mark() */ 1105 fsnotify_put_mark(fsn_mark); 1106 return 0; 1107 } 1108 1109 static int fanotify_remove_vfsmount_mark(struct fsnotify_group *group, 1110 struct vfsmount *mnt, __u32 mask, 1111 unsigned int flags, __u32 umask) 1112 { 1113 return fanotify_remove_mark(group, &real_mount(mnt)->mnt_fsnotify_marks, 1114 mask, flags, umask); 1115 } 1116 1117 static int fanotify_remove_sb_mark(struct fsnotify_group *group, 1118 struct super_block *sb, __u32 mask, 1119 unsigned int flags, __u32 umask) 1120 { 1121 return fanotify_remove_mark(group, &sb->s_fsnotify_marks, mask, 1122 flags, umask); 1123 } 1124 1125 static int fanotify_remove_inode_mark(struct fsnotify_group *group, 1126 struct inode *inode, __u32 mask, 1127 unsigned int flags, __u32 umask) 1128 { 1129 return fanotify_remove_mark(group, &inode->i_fsnotify_marks, mask, 1130 flags, umask); 1131 } 1132 1133 static bool fanotify_mark_update_flags(struct fsnotify_mark *fsn_mark, 1134 unsigned int fan_flags) 1135 { 1136 bool want_iref = !(fan_flags & FAN_MARK_EVICTABLE); 1137 unsigned int ignore = fan_flags & FANOTIFY_MARK_IGNORE_BITS; 1138 bool recalc = false; 1139 1140 /* 1141 * When using FAN_MARK_IGNORE for the first time, mark starts using 1142 * independent event flags in ignore mask. After that, trying to 1143 * update the ignore mask with the old FAN_MARK_IGNORED_MASK API 1144 * will result in EEXIST error. 1145 */ 1146 if (ignore == FAN_MARK_IGNORE) 1147 fsn_mark->flags |= FSNOTIFY_MARK_FLAG_HAS_IGNORE_FLAGS; 1148 1149 /* 1150 * Setting FAN_MARK_IGNORED_SURV_MODIFY for the first time may lead to 1151 * the removal of the FS_MODIFY bit in calculated mask if it was set 1152 * because of an ignore mask that is now going to survive FS_MODIFY. 1153 */ 1154 if (ignore && (fan_flags & FAN_MARK_IGNORED_SURV_MODIFY) && 1155 !(fsn_mark->flags & FSNOTIFY_MARK_FLAG_IGNORED_SURV_MODIFY)) { 1156 fsn_mark->flags |= FSNOTIFY_MARK_FLAG_IGNORED_SURV_MODIFY; 1157 if (!(fsn_mark->mask & FS_MODIFY)) 1158 recalc = true; 1159 } 1160 1161 if (fsn_mark->connector->type != FSNOTIFY_OBJ_TYPE_INODE || 1162 want_iref == !(fsn_mark->flags & FSNOTIFY_MARK_FLAG_NO_IREF)) 1163 return recalc; 1164 1165 /* 1166 * NO_IREF may be removed from a mark, but not added. 1167 * When removed, fsnotify_recalc_mask() will take the inode ref. 1168 */ 1169 WARN_ON_ONCE(!want_iref); 1170 fsn_mark->flags &= ~FSNOTIFY_MARK_FLAG_NO_IREF; 1171 1172 return true; 1173 } 1174 1175 static bool fanotify_mark_add_to_mask(struct fsnotify_mark *fsn_mark, 1176 __u32 mask, unsigned int fan_flags) 1177 { 1178 bool recalc; 1179 1180 spin_lock(&fsn_mark->lock); 1181 if (!(fan_flags & FANOTIFY_MARK_IGNORE_BITS)) 1182 fsn_mark->mask |= mask; 1183 else 1184 fsn_mark->ignore_mask |= mask; 1185 1186 recalc = fsnotify_calc_mask(fsn_mark) & 1187 ~fsnotify_conn_mask(fsn_mark->connector); 1188 1189 recalc |= fanotify_mark_update_flags(fsn_mark, fan_flags); 1190 spin_unlock(&fsn_mark->lock); 1191 1192 return recalc; 1193 } 1194 1195 static struct fsnotify_mark *fanotify_add_new_mark(struct fsnotify_group *group, 1196 fsnotify_connp_t *connp, 1197 unsigned int obj_type, 1198 unsigned int fan_flags, 1199 __kernel_fsid_t *fsid) 1200 { 1201 struct ucounts *ucounts = group->fanotify_data.ucounts; 1202 struct fsnotify_mark *mark; 1203 int ret; 1204 1205 /* 1206 * Enforce per user marks limits per user in all containing user ns. 1207 * A group with FAN_UNLIMITED_MARKS does not contribute to mark count 1208 * in the limited groups account. 1209 */ 1210 if (!FAN_GROUP_FLAG(group, FAN_UNLIMITED_MARKS) && 1211 !inc_ucount(ucounts->ns, ucounts->uid, UCOUNT_FANOTIFY_MARKS)) 1212 return ERR_PTR(-ENOSPC); 1213 1214 mark = kmem_cache_alloc(fanotify_mark_cache, GFP_KERNEL); 1215 if (!mark) { 1216 ret = -ENOMEM; 1217 goto out_dec_ucounts; 1218 } 1219 1220 fsnotify_init_mark(mark, group); 1221 if (fan_flags & FAN_MARK_EVICTABLE) 1222 mark->flags |= FSNOTIFY_MARK_FLAG_NO_IREF; 1223 1224 ret = fsnotify_add_mark_locked(mark, connp, obj_type, 0, fsid); 1225 if (ret) { 1226 fsnotify_put_mark(mark); 1227 goto out_dec_ucounts; 1228 } 1229 1230 return mark; 1231 1232 out_dec_ucounts: 1233 if (!FAN_GROUP_FLAG(group, FAN_UNLIMITED_MARKS)) 1234 dec_ucount(ucounts, UCOUNT_FANOTIFY_MARKS); 1235 return ERR_PTR(ret); 1236 } 1237 1238 static int fanotify_group_init_error_pool(struct fsnotify_group *group) 1239 { 1240 if (mempool_initialized(&group->fanotify_data.error_events_pool)) 1241 return 0; 1242 1243 return mempool_init_kmalloc_pool(&group->fanotify_data.error_events_pool, 1244 FANOTIFY_DEFAULT_FEE_POOL_SIZE, 1245 sizeof(struct fanotify_error_event)); 1246 } 1247 1248 static int fanotify_may_update_existing_mark(struct fsnotify_mark *fsn_mark, 1249 unsigned int fan_flags) 1250 { 1251 /* 1252 * Non evictable mark cannot be downgraded to evictable mark. 1253 */ 1254 if (fan_flags & FAN_MARK_EVICTABLE && 1255 !(fsn_mark->flags & FSNOTIFY_MARK_FLAG_NO_IREF)) 1256 return -EEXIST; 1257 1258 /* 1259 * New ignore mask semantics cannot be downgraded to old semantics. 1260 */ 1261 if (fan_flags & FAN_MARK_IGNORED_MASK && 1262 fsn_mark->flags & FSNOTIFY_MARK_FLAG_HAS_IGNORE_FLAGS) 1263 return -EEXIST; 1264 1265 /* 1266 * An ignore mask that survives modify could never be downgraded to not 1267 * survive modify. With new FAN_MARK_IGNORE semantics we make that rule 1268 * explicit and return an error when trying to update the ignore mask 1269 * without the original FAN_MARK_IGNORED_SURV_MODIFY value. 1270 */ 1271 if (fan_flags & FAN_MARK_IGNORE && 1272 !(fan_flags & FAN_MARK_IGNORED_SURV_MODIFY) && 1273 fsn_mark->flags & FSNOTIFY_MARK_FLAG_IGNORED_SURV_MODIFY) 1274 return -EEXIST; 1275 1276 return 0; 1277 } 1278 1279 static int fanotify_add_mark(struct fsnotify_group *group, 1280 fsnotify_connp_t *connp, unsigned int obj_type, 1281 __u32 mask, unsigned int fan_flags, 1282 __kernel_fsid_t *fsid) 1283 { 1284 struct fsnotify_mark *fsn_mark; 1285 bool recalc; 1286 int ret = 0; 1287 1288 fsnotify_group_lock(group); 1289 fsn_mark = fsnotify_find_mark(connp, group); 1290 if (!fsn_mark) { 1291 fsn_mark = fanotify_add_new_mark(group, connp, obj_type, 1292 fan_flags, fsid); 1293 if (IS_ERR(fsn_mark)) { 1294 fsnotify_group_unlock(group); 1295 return PTR_ERR(fsn_mark); 1296 } 1297 } 1298 1299 /* 1300 * Check if requested mark flags conflict with an existing mark flags. 1301 */ 1302 ret = fanotify_may_update_existing_mark(fsn_mark, fan_flags); 1303 if (ret) 1304 goto out; 1305 1306 /* 1307 * Error events are pre-allocated per group, only if strictly 1308 * needed (i.e. FAN_FS_ERROR was requested). 1309 */ 1310 if (!(fan_flags & FANOTIFY_MARK_IGNORE_BITS) && 1311 (mask & FAN_FS_ERROR)) { 1312 ret = fanotify_group_init_error_pool(group); 1313 if (ret) 1314 goto out; 1315 } 1316 1317 recalc = fanotify_mark_add_to_mask(fsn_mark, mask, fan_flags); 1318 if (recalc) 1319 fsnotify_recalc_mask(fsn_mark->connector); 1320 1321 out: 1322 fsnotify_group_unlock(group); 1323 1324 fsnotify_put_mark(fsn_mark); 1325 return ret; 1326 } 1327 1328 static int fanotify_add_vfsmount_mark(struct fsnotify_group *group, 1329 struct vfsmount *mnt, __u32 mask, 1330 unsigned int flags, __kernel_fsid_t *fsid) 1331 { 1332 return fanotify_add_mark(group, &real_mount(mnt)->mnt_fsnotify_marks, 1333 FSNOTIFY_OBJ_TYPE_VFSMOUNT, mask, flags, fsid); 1334 } 1335 1336 static int fanotify_add_sb_mark(struct fsnotify_group *group, 1337 struct super_block *sb, __u32 mask, 1338 unsigned int flags, __kernel_fsid_t *fsid) 1339 { 1340 return fanotify_add_mark(group, &sb->s_fsnotify_marks, 1341 FSNOTIFY_OBJ_TYPE_SB, mask, flags, fsid); 1342 } 1343 1344 static int fanotify_add_inode_mark(struct fsnotify_group *group, 1345 struct inode *inode, __u32 mask, 1346 unsigned int flags, __kernel_fsid_t *fsid) 1347 { 1348 pr_debug("%s: group=%p inode=%p\n", __func__, group, inode); 1349 1350 /* 1351 * If some other task has this inode open for write we should not add 1352 * an ignore mask, unless that ignore mask is supposed to survive 1353 * modification changes anyway. 1354 */ 1355 if ((flags & FANOTIFY_MARK_IGNORE_BITS) && 1356 !(flags & FAN_MARK_IGNORED_SURV_MODIFY) && 1357 inode_is_open_for_write(inode)) 1358 return 0; 1359 1360 return fanotify_add_mark(group, &inode->i_fsnotify_marks, 1361 FSNOTIFY_OBJ_TYPE_INODE, mask, flags, fsid); 1362 } 1363 1364 static struct fsnotify_event *fanotify_alloc_overflow_event(void) 1365 { 1366 struct fanotify_event *oevent; 1367 1368 oevent = kmalloc(sizeof(*oevent), GFP_KERNEL_ACCOUNT); 1369 if (!oevent) 1370 return NULL; 1371 1372 fanotify_init_event(oevent, 0, FS_Q_OVERFLOW); 1373 oevent->type = FANOTIFY_EVENT_TYPE_OVERFLOW; 1374 1375 return &oevent->fse; 1376 } 1377 1378 static struct hlist_head *fanotify_alloc_merge_hash(void) 1379 { 1380 struct hlist_head *hash; 1381 1382 hash = kmalloc(sizeof(struct hlist_head) << FANOTIFY_HTABLE_BITS, 1383 GFP_KERNEL_ACCOUNT); 1384 if (!hash) 1385 return NULL; 1386 1387 __hash_init(hash, FANOTIFY_HTABLE_SIZE); 1388 1389 return hash; 1390 } 1391 1392 /* fanotify syscalls */ 1393 SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags) 1394 { 1395 struct fsnotify_group *group; 1396 int f_flags, fd; 1397 unsigned int fid_mode = flags & FANOTIFY_FID_BITS; 1398 unsigned int class = flags & FANOTIFY_CLASS_BITS; 1399 unsigned int internal_flags = 0; 1400 1401 pr_debug("%s: flags=%x event_f_flags=%x\n", 1402 __func__, flags, event_f_flags); 1403 1404 if (!capable(CAP_SYS_ADMIN)) { 1405 /* 1406 * An unprivileged user can setup an fanotify group with 1407 * limited functionality - an unprivileged group is limited to 1408 * notification events with file handles and it cannot use 1409 * unlimited queue/marks. 1410 */ 1411 if ((flags & FANOTIFY_ADMIN_INIT_FLAGS) || !fid_mode) 1412 return -EPERM; 1413 1414 /* 1415 * Setting the internal flag FANOTIFY_UNPRIV on the group 1416 * prevents setting mount/filesystem marks on this group and 1417 * prevents reporting pid and open fd in events. 1418 */ 1419 internal_flags |= FANOTIFY_UNPRIV; 1420 } 1421 1422 #ifdef CONFIG_AUDITSYSCALL 1423 if (flags & ~(FANOTIFY_INIT_FLAGS | FAN_ENABLE_AUDIT)) 1424 #else 1425 if (flags & ~FANOTIFY_INIT_FLAGS) 1426 #endif 1427 return -EINVAL; 1428 1429 /* 1430 * A pidfd can only be returned for a thread-group leader; thus 1431 * FAN_REPORT_PIDFD and FAN_REPORT_TID need to remain mutually 1432 * exclusive. 1433 */ 1434 if ((flags & FAN_REPORT_PIDFD) && (flags & FAN_REPORT_TID)) 1435 return -EINVAL; 1436 1437 if (event_f_flags & ~FANOTIFY_INIT_ALL_EVENT_F_BITS) 1438 return -EINVAL; 1439 1440 switch (event_f_flags & O_ACCMODE) { 1441 case O_RDONLY: 1442 case O_RDWR: 1443 case O_WRONLY: 1444 break; 1445 default: 1446 return -EINVAL; 1447 } 1448 1449 if (fid_mode && class != FAN_CLASS_NOTIF) 1450 return -EINVAL; 1451 1452 /* 1453 * Child name is reported with parent fid so requires dir fid. 1454 * We can report both child fid and dir fid with or without name. 1455 */ 1456 if ((fid_mode & FAN_REPORT_NAME) && !(fid_mode & FAN_REPORT_DIR_FID)) 1457 return -EINVAL; 1458 1459 /* 1460 * FAN_REPORT_TARGET_FID requires FAN_REPORT_NAME and FAN_REPORT_FID 1461 * and is used as an indication to report both dir and child fid on all 1462 * dirent events. 1463 */ 1464 if ((fid_mode & FAN_REPORT_TARGET_FID) && 1465 (!(fid_mode & FAN_REPORT_NAME) || !(fid_mode & FAN_REPORT_FID))) 1466 return -EINVAL; 1467 1468 f_flags = O_RDWR | __FMODE_NONOTIFY; 1469 if (flags & FAN_CLOEXEC) 1470 f_flags |= O_CLOEXEC; 1471 if (flags & FAN_NONBLOCK) 1472 f_flags |= O_NONBLOCK; 1473 1474 /* fsnotify_alloc_group takes a ref. Dropped in fanotify_release */ 1475 group = fsnotify_alloc_group(&fanotify_fsnotify_ops, 1476 FSNOTIFY_GROUP_USER | FSNOTIFY_GROUP_NOFS); 1477 if (IS_ERR(group)) { 1478 return PTR_ERR(group); 1479 } 1480 1481 /* Enforce groups limits per user in all containing user ns */ 1482 group->fanotify_data.ucounts = inc_ucount(current_user_ns(), 1483 current_euid(), 1484 UCOUNT_FANOTIFY_GROUPS); 1485 if (!group->fanotify_data.ucounts) { 1486 fd = -EMFILE; 1487 goto out_destroy_group; 1488 } 1489 1490 group->fanotify_data.flags = flags | internal_flags; 1491 group->memcg = get_mem_cgroup_from_mm(current->mm); 1492 1493 group->fanotify_data.merge_hash = fanotify_alloc_merge_hash(); 1494 if (!group->fanotify_data.merge_hash) { 1495 fd = -ENOMEM; 1496 goto out_destroy_group; 1497 } 1498 1499 group->overflow_event = fanotify_alloc_overflow_event(); 1500 if (unlikely(!group->overflow_event)) { 1501 fd = -ENOMEM; 1502 goto out_destroy_group; 1503 } 1504 1505 if (force_o_largefile()) 1506 event_f_flags |= O_LARGEFILE; 1507 group->fanotify_data.f_flags = event_f_flags; 1508 init_waitqueue_head(&group->fanotify_data.access_waitq); 1509 INIT_LIST_HEAD(&group->fanotify_data.access_list); 1510 switch (class) { 1511 case FAN_CLASS_NOTIF: 1512 group->priority = FS_PRIO_0; 1513 break; 1514 case FAN_CLASS_CONTENT: 1515 group->priority = FS_PRIO_1; 1516 break; 1517 case FAN_CLASS_PRE_CONTENT: 1518 group->priority = FS_PRIO_2; 1519 break; 1520 default: 1521 fd = -EINVAL; 1522 goto out_destroy_group; 1523 } 1524 1525 if (flags & FAN_UNLIMITED_QUEUE) { 1526 fd = -EPERM; 1527 if (!capable(CAP_SYS_ADMIN)) 1528 goto out_destroy_group; 1529 group->max_events = UINT_MAX; 1530 } else { 1531 group->max_events = fanotify_max_queued_events; 1532 } 1533 1534 if (flags & FAN_UNLIMITED_MARKS) { 1535 fd = -EPERM; 1536 if (!capable(CAP_SYS_ADMIN)) 1537 goto out_destroy_group; 1538 } 1539 1540 if (flags & FAN_ENABLE_AUDIT) { 1541 fd = -EPERM; 1542 if (!capable(CAP_AUDIT_WRITE)) 1543 goto out_destroy_group; 1544 } 1545 1546 fd = anon_inode_getfd("[fanotify]", &fanotify_fops, group, f_flags); 1547 if (fd < 0) 1548 goto out_destroy_group; 1549 1550 return fd; 1551 1552 out_destroy_group: 1553 fsnotify_destroy_group(group); 1554 return fd; 1555 } 1556 1557 static int fanotify_test_fsid(struct dentry *dentry, __kernel_fsid_t *fsid) 1558 { 1559 __kernel_fsid_t root_fsid; 1560 int err; 1561 1562 /* 1563 * Make sure dentry is not of a filesystem with zero fsid (e.g. fuse). 1564 */ 1565 err = vfs_get_fsid(dentry, fsid); 1566 if (err) 1567 return err; 1568 1569 if (!fsid->val[0] && !fsid->val[1]) 1570 return -ENODEV; 1571 1572 /* 1573 * Make sure dentry is not of a filesystem subvolume (e.g. btrfs) 1574 * which uses a different fsid than sb root. 1575 */ 1576 err = vfs_get_fsid(dentry->d_sb->s_root, &root_fsid); 1577 if (err) 1578 return err; 1579 1580 if (root_fsid.val[0] != fsid->val[0] || 1581 root_fsid.val[1] != fsid->val[1]) 1582 return -EXDEV; 1583 1584 return 0; 1585 } 1586 1587 /* Check if filesystem can encode a unique fid */ 1588 static int fanotify_test_fid(struct dentry *dentry) 1589 { 1590 /* 1591 * We need to make sure that the file system supports at least 1592 * encoding a file handle so user can use name_to_handle_at() to 1593 * compare fid returned with event to the file handle of watched 1594 * objects. However, even the relaxed AT_HANDLE_FID flag requires 1595 * at least empty export_operations for ecoding unique file ids. 1596 */ 1597 if (!dentry->d_sb->s_export_op) 1598 return -EOPNOTSUPP; 1599 1600 return 0; 1601 } 1602 1603 static int fanotify_events_supported(struct fsnotify_group *group, 1604 const struct path *path, __u64 mask, 1605 unsigned int flags) 1606 { 1607 unsigned int mark_type = flags & FANOTIFY_MARK_TYPE_BITS; 1608 /* Strict validation of events in non-dir inode mask with v5.17+ APIs */ 1609 bool strict_dir_events = FAN_GROUP_FLAG(group, FAN_REPORT_TARGET_FID) || 1610 (mask & FAN_RENAME) || 1611 (flags & FAN_MARK_IGNORE); 1612 1613 /* 1614 * Some filesystems such as 'proc' acquire unusual locks when opening 1615 * files. For them fanotify permission events have high chances of 1616 * deadlocking the system - open done when reporting fanotify event 1617 * blocks on this "unusual" lock while another process holding the lock 1618 * waits for fanotify permission event to be answered. Just disallow 1619 * permission events for such filesystems. 1620 */ 1621 if (mask & FANOTIFY_PERM_EVENTS && 1622 path->mnt->mnt_sb->s_type->fs_flags & FS_DISALLOW_NOTIFY_PERM) 1623 return -EINVAL; 1624 1625 /* 1626 * mount and sb marks are not allowed on kernel internal pseudo fs, 1627 * like pipe_mnt, because that would subscribe to events on all the 1628 * anonynous pipes in the system. 1629 * 1630 * SB_NOUSER covers all of the internal pseudo fs whose objects are not 1631 * exposed to user's mount namespace, but there are other SB_KERNMOUNT 1632 * fs, like nsfs, debugfs, for which the value of allowing sb and mount 1633 * mark is questionable. For now we leave them alone. 1634 */ 1635 if (mark_type != FAN_MARK_INODE && 1636 path->mnt->mnt_sb->s_flags & SB_NOUSER) 1637 return -EINVAL; 1638 1639 /* 1640 * We shouldn't have allowed setting dirent events and the directory 1641 * flags FAN_ONDIR and FAN_EVENT_ON_CHILD in mask of non-dir inode, 1642 * but because we always allowed it, error only when using new APIs. 1643 */ 1644 if (strict_dir_events && mark_type == FAN_MARK_INODE && 1645 !d_is_dir(path->dentry) && (mask & FANOTIFY_DIRONLY_EVENT_BITS)) 1646 return -ENOTDIR; 1647 1648 return 0; 1649 } 1650 1651 static int do_fanotify_mark(int fanotify_fd, unsigned int flags, __u64 mask, 1652 int dfd, const char __user *pathname) 1653 { 1654 struct inode *inode = NULL; 1655 struct vfsmount *mnt = NULL; 1656 struct fsnotify_group *group; 1657 struct fd f; 1658 struct path path; 1659 __kernel_fsid_t __fsid, *fsid = NULL; 1660 u32 valid_mask = FANOTIFY_EVENTS | FANOTIFY_EVENT_FLAGS; 1661 unsigned int mark_type = flags & FANOTIFY_MARK_TYPE_BITS; 1662 unsigned int mark_cmd = flags & FANOTIFY_MARK_CMD_BITS; 1663 unsigned int ignore = flags & FANOTIFY_MARK_IGNORE_BITS; 1664 unsigned int obj_type, fid_mode; 1665 u32 umask = 0; 1666 int ret; 1667 1668 pr_debug("%s: fanotify_fd=%d flags=%x dfd=%d pathname=%p mask=%llx\n", 1669 __func__, fanotify_fd, flags, dfd, pathname, mask); 1670 1671 /* we only use the lower 32 bits as of right now. */ 1672 if (upper_32_bits(mask)) 1673 return -EINVAL; 1674 1675 if (flags & ~FANOTIFY_MARK_FLAGS) 1676 return -EINVAL; 1677 1678 switch (mark_type) { 1679 case FAN_MARK_INODE: 1680 obj_type = FSNOTIFY_OBJ_TYPE_INODE; 1681 break; 1682 case FAN_MARK_MOUNT: 1683 obj_type = FSNOTIFY_OBJ_TYPE_VFSMOUNT; 1684 break; 1685 case FAN_MARK_FILESYSTEM: 1686 obj_type = FSNOTIFY_OBJ_TYPE_SB; 1687 break; 1688 default: 1689 return -EINVAL; 1690 } 1691 1692 switch (mark_cmd) { 1693 case FAN_MARK_ADD: 1694 case FAN_MARK_REMOVE: 1695 if (!mask) 1696 return -EINVAL; 1697 break; 1698 case FAN_MARK_FLUSH: 1699 if (flags & ~(FANOTIFY_MARK_TYPE_BITS | FAN_MARK_FLUSH)) 1700 return -EINVAL; 1701 break; 1702 default: 1703 return -EINVAL; 1704 } 1705 1706 if (IS_ENABLED(CONFIG_FANOTIFY_ACCESS_PERMISSIONS)) 1707 valid_mask |= FANOTIFY_PERM_EVENTS; 1708 1709 if (mask & ~valid_mask) 1710 return -EINVAL; 1711 1712 1713 /* We don't allow FAN_MARK_IGNORE & FAN_MARK_IGNORED_MASK together */ 1714 if (ignore == (FAN_MARK_IGNORE | FAN_MARK_IGNORED_MASK)) 1715 return -EINVAL; 1716 1717 /* 1718 * Event flags (FAN_ONDIR, FAN_EVENT_ON_CHILD) have no effect with 1719 * FAN_MARK_IGNORED_MASK. 1720 */ 1721 if (ignore == FAN_MARK_IGNORED_MASK) { 1722 mask &= ~FANOTIFY_EVENT_FLAGS; 1723 umask = FANOTIFY_EVENT_FLAGS; 1724 } 1725 1726 f = fdget(fanotify_fd); 1727 if (unlikely(!f.file)) 1728 return -EBADF; 1729 1730 /* verify that this is indeed an fanotify instance */ 1731 ret = -EINVAL; 1732 if (unlikely(f.file->f_op != &fanotify_fops)) 1733 goto fput_and_out; 1734 group = f.file->private_data; 1735 1736 /* 1737 * An unprivileged user is not allowed to setup mount nor filesystem 1738 * marks. This also includes setting up such marks by a group that 1739 * was initialized by an unprivileged user. 1740 */ 1741 ret = -EPERM; 1742 if ((!capable(CAP_SYS_ADMIN) || 1743 FAN_GROUP_FLAG(group, FANOTIFY_UNPRIV)) && 1744 mark_type != FAN_MARK_INODE) 1745 goto fput_and_out; 1746 1747 /* 1748 * group->priority == FS_PRIO_0 == FAN_CLASS_NOTIF. These are not 1749 * allowed to set permissions events. 1750 */ 1751 ret = -EINVAL; 1752 if (mask & FANOTIFY_PERM_EVENTS && 1753 group->priority == FS_PRIO_0) 1754 goto fput_and_out; 1755 1756 if (mask & FAN_FS_ERROR && 1757 mark_type != FAN_MARK_FILESYSTEM) 1758 goto fput_and_out; 1759 1760 /* 1761 * Evictable is only relevant for inode marks, because only inode object 1762 * can be evicted on memory pressure. 1763 */ 1764 if (flags & FAN_MARK_EVICTABLE && 1765 mark_type != FAN_MARK_INODE) 1766 goto fput_and_out; 1767 1768 /* 1769 * Events that do not carry enough information to report 1770 * event->fd require a group that supports reporting fid. Those 1771 * events are not supported on a mount mark, because they do not 1772 * carry enough information (i.e. path) to be filtered by mount 1773 * point. 1774 */ 1775 fid_mode = FAN_GROUP_FLAG(group, FANOTIFY_FID_BITS); 1776 if (mask & ~(FANOTIFY_FD_EVENTS|FANOTIFY_EVENT_FLAGS) && 1777 (!fid_mode || mark_type == FAN_MARK_MOUNT)) 1778 goto fput_and_out; 1779 1780 /* 1781 * FAN_RENAME uses special info type records to report the old and 1782 * new parent+name. Reporting only old and new parent id is less 1783 * useful and was not implemented. 1784 */ 1785 if (mask & FAN_RENAME && !(fid_mode & FAN_REPORT_NAME)) 1786 goto fput_and_out; 1787 1788 if (mark_cmd == FAN_MARK_FLUSH) { 1789 ret = 0; 1790 if (mark_type == FAN_MARK_MOUNT) 1791 fsnotify_clear_vfsmount_marks_by_group(group); 1792 else if (mark_type == FAN_MARK_FILESYSTEM) 1793 fsnotify_clear_sb_marks_by_group(group); 1794 else 1795 fsnotify_clear_inode_marks_by_group(group); 1796 goto fput_and_out; 1797 } 1798 1799 ret = fanotify_find_path(dfd, pathname, &path, flags, 1800 (mask & ALL_FSNOTIFY_EVENTS), obj_type); 1801 if (ret) 1802 goto fput_and_out; 1803 1804 if (mark_cmd == FAN_MARK_ADD) { 1805 ret = fanotify_events_supported(group, &path, mask, flags); 1806 if (ret) 1807 goto path_put_and_out; 1808 } 1809 1810 if (fid_mode) { 1811 ret = fanotify_test_fsid(path.dentry, &__fsid); 1812 if (ret) 1813 goto path_put_and_out; 1814 1815 ret = fanotify_test_fid(path.dentry); 1816 if (ret) 1817 goto path_put_and_out; 1818 1819 fsid = &__fsid; 1820 } 1821 1822 /* inode held in place by reference to path; group by fget on fd */ 1823 if (mark_type == FAN_MARK_INODE) 1824 inode = path.dentry->d_inode; 1825 else 1826 mnt = path.mnt; 1827 1828 ret = mnt ? -EINVAL : -EISDIR; 1829 /* FAN_MARK_IGNORE requires SURV_MODIFY for sb/mount/dir marks */ 1830 if (mark_cmd == FAN_MARK_ADD && ignore == FAN_MARK_IGNORE && 1831 (mnt || S_ISDIR(inode->i_mode)) && 1832 !(flags & FAN_MARK_IGNORED_SURV_MODIFY)) 1833 goto path_put_and_out; 1834 1835 /* Mask out FAN_EVENT_ON_CHILD flag for sb/mount/non-dir marks */ 1836 if (mnt || !S_ISDIR(inode->i_mode)) { 1837 mask &= ~FAN_EVENT_ON_CHILD; 1838 umask = FAN_EVENT_ON_CHILD; 1839 /* 1840 * If group needs to report parent fid, register for getting 1841 * events with parent/name info for non-directory. 1842 */ 1843 if ((fid_mode & FAN_REPORT_DIR_FID) && 1844 (flags & FAN_MARK_ADD) && !ignore) 1845 mask |= FAN_EVENT_ON_CHILD; 1846 } 1847 1848 /* create/update an inode mark */ 1849 switch (mark_cmd) { 1850 case FAN_MARK_ADD: 1851 if (mark_type == FAN_MARK_MOUNT) 1852 ret = fanotify_add_vfsmount_mark(group, mnt, mask, 1853 flags, fsid); 1854 else if (mark_type == FAN_MARK_FILESYSTEM) 1855 ret = fanotify_add_sb_mark(group, mnt->mnt_sb, mask, 1856 flags, fsid); 1857 else 1858 ret = fanotify_add_inode_mark(group, inode, mask, 1859 flags, fsid); 1860 break; 1861 case FAN_MARK_REMOVE: 1862 if (mark_type == FAN_MARK_MOUNT) 1863 ret = fanotify_remove_vfsmount_mark(group, mnt, mask, 1864 flags, umask); 1865 else if (mark_type == FAN_MARK_FILESYSTEM) 1866 ret = fanotify_remove_sb_mark(group, mnt->mnt_sb, mask, 1867 flags, umask); 1868 else 1869 ret = fanotify_remove_inode_mark(group, inode, mask, 1870 flags, umask); 1871 break; 1872 default: 1873 ret = -EINVAL; 1874 } 1875 1876 path_put_and_out: 1877 path_put(&path); 1878 fput_and_out: 1879 fdput(f); 1880 return ret; 1881 } 1882 1883 #ifndef CONFIG_ARCH_SPLIT_ARG64 1884 SYSCALL_DEFINE5(fanotify_mark, int, fanotify_fd, unsigned int, flags, 1885 __u64, mask, int, dfd, 1886 const char __user *, pathname) 1887 { 1888 return do_fanotify_mark(fanotify_fd, flags, mask, dfd, pathname); 1889 } 1890 #endif 1891 1892 #if defined(CONFIG_ARCH_SPLIT_ARG64) || defined(CONFIG_COMPAT) 1893 SYSCALL32_DEFINE6(fanotify_mark, 1894 int, fanotify_fd, unsigned int, flags, 1895 SC_ARG64(mask), int, dfd, 1896 const char __user *, pathname) 1897 { 1898 return do_fanotify_mark(fanotify_fd, flags, SC_VAL64(__u64, mask), 1899 dfd, pathname); 1900 } 1901 #endif 1902 1903 /* 1904 * fanotify_user_setup - Our initialization function. Note that we cannot return 1905 * error because we have compiled-in VFS hooks. So an (unlikely) failure here 1906 * must result in panic(). 1907 */ 1908 static int __init fanotify_user_setup(void) 1909 { 1910 struct sysinfo si; 1911 int max_marks; 1912 1913 si_meminfo(&si); 1914 /* 1915 * Allow up to 1% of addressable memory to be accounted for per user 1916 * marks limited to the range [8192, 1048576]. mount and sb marks are 1917 * a lot cheaper than inode marks, but there is no reason for a user 1918 * to have many of those, so calculate by the cost of inode marks. 1919 */ 1920 max_marks = (((si.totalram - si.totalhigh) / 100) << PAGE_SHIFT) / 1921 INODE_MARK_COST; 1922 max_marks = clamp(max_marks, FANOTIFY_OLD_DEFAULT_MAX_MARKS, 1923 FANOTIFY_DEFAULT_MAX_USER_MARKS); 1924 1925 BUILD_BUG_ON(FANOTIFY_INIT_FLAGS & FANOTIFY_INTERNAL_GROUP_FLAGS); 1926 BUILD_BUG_ON(HWEIGHT32(FANOTIFY_INIT_FLAGS) != 12); 1927 BUILD_BUG_ON(HWEIGHT32(FANOTIFY_MARK_FLAGS) != 11); 1928 1929 fanotify_mark_cache = KMEM_CACHE(fsnotify_mark, 1930 SLAB_PANIC|SLAB_ACCOUNT); 1931 fanotify_fid_event_cachep = KMEM_CACHE(fanotify_fid_event, 1932 SLAB_PANIC); 1933 fanotify_path_event_cachep = KMEM_CACHE(fanotify_path_event, 1934 SLAB_PANIC); 1935 if (IS_ENABLED(CONFIG_FANOTIFY_ACCESS_PERMISSIONS)) { 1936 fanotify_perm_event_cachep = 1937 KMEM_CACHE(fanotify_perm_event, SLAB_PANIC); 1938 } 1939 1940 fanotify_max_queued_events = FANOTIFY_DEFAULT_MAX_EVENTS; 1941 init_user_ns.ucount_max[UCOUNT_FANOTIFY_GROUPS] = 1942 FANOTIFY_DEFAULT_MAX_GROUPS; 1943 init_user_ns.ucount_max[UCOUNT_FANOTIFY_MARKS] = max_marks; 1944 fanotify_sysctls_init(); 1945 1946 return 0; 1947 } 1948 device_initcall(fanotify_user_setup); 1949