1 // SPDX-License-Identifier: GPL-2.0 2 #include <linux/fanotify.h> 3 #include <linux/fcntl.h> 4 #include <linux/file.h> 5 #include <linux/fs.h> 6 #include <linux/anon_inodes.h> 7 #include <linux/fsnotify_backend.h> 8 #include <linux/init.h> 9 #include <linux/mount.h> 10 #include <linux/namei.h> 11 #include <linux/poll.h> 12 #include <linux/security.h> 13 #include <linux/syscalls.h> 14 #include <linux/slab.h> 15 #include <linux/types.h> 16 #include <linux/uaccess.h> 17 #include <linux/compat.h> 18 #include <linux/sched/signal.h> 19 #include <linux/memcontrol.h> 20 #include <linux/statfs.h> 21 #include <linux/exportfs.h> 22 23 #include <asm/ioctls.h> 24 25 #include "../fsnotify.h" 26 #include "../fdinfo.h" 27 #include "fanotify.h" 28 29 #define FANOTIFY_DEFAULT_MAX_EVENTS 16384 30 #define FANOTIFY_OLD_DEFAULT_MAX_MARKS 8192 31 #define FANOTIFY_DEFAULT_MAX_GROUPS 128 32 #define FANOTIFY_DEFAULT_FEE_POOL_SIZE 32 33 34 /* 35 * Legacy fanotify marks limits (8192) is per group and we introduced a tunable 36 * limit of marks per user, similar to inotify. Effectively, the legacy limit 37 * of fanotify marks per user is <max marks per group> * <max groups per user>. 38 * This default limit (1M) also happens to match the increased limit of inotify 39 * max_user_watches since v5.10. 40 */ 41 #define FANOTIFY_DEFAULT_MAX_USER_MARKS \ 42 (FANOTIFY_OLD_DEFAULT_MAX_MARKS * FANOTIFY_DEFAULT_MAX_GROUPS) 43 44 /* 45 * Most of the memory cost of adding an inode mark is pinning the marked inode. 46 * The size of the filesystem inode struct is not uniform across filesystems, 47 * so double the size of a VFS inode is used as a conservative approximation. 48 */ 49 #define INODE_MARK_COST (2 * sizeof(struct inode)) 50 51 /* configurable via /proc/sys/fs/fanotify/ */ 52 static int fanotify_max_queued_events __read_mostly; 53 static int perm_group_timeout __read_mostly; 54 55 #ifdef CONFIG_SYSCTL 56 57 #include <linux/sysctl.h> 58 59 static long ft_zero = 0; 60 static long ft_int_max = INT_MAX; 61 62 static const struct ctl_table fanotify_table[] = { 63 { 64 .procname = "max_user_groups", 65 .data = &init_user_ns.ucount_max[UCOUNT_FANOTIFY_GROUPS], 66 .maxlen = sizeof(long), 67 .mode = 0644, 68 .proc_handler = proc_doulongvec_minmax, 69 .extra1 = &ft_zero, 70 .extra2 = &ft_int_max, 71 }, 72 { 73 .procname = "max_user_marks", 74 .data = &init_user_ns.ucount_max[UCOUNT_FANOTIFY_MARKS], 75 .maxlen = sizeof(long), 76 .mode = 0644, 77 .proc_handler = proc_doulongvec_minmax, 78 .extra1 = &ft_zero, 79 .extra2 = &ft_int_max, 80 }, 81 { 82 .procname = "max_queued_events", 83 .data = &fanotify_max_queued_events, 84 .maxlen = sizeof(int), 85 .mode = 0644, 86 .proc_handler = proc_dointvec_minmax, 87 .extra1 = SYSCTL_ZERO 88 }, 89 { 90 .procname = "watchdog_timeout", 91 .data = &perm_group_timeout, 92 .maxlen = sizeof(int), 93 .mode = 0644, 94 .proc_handler = proc_dointvec_minmax, 95 .extra1 = SYSCTL_ZERO, 96 }, 97 }; 98 99 static void __init fanotify_sysctls_init(void) 100 { 101 register_sysctl("fs/fanotify", fanotify_table); 102 } 103 #else 104 #define fanotify_sysctls_init() do { } while (0) 105 #endif /* CONFIG_SYSCTL */ 106 107 static LIST_HEAD(perm_group_list); 108 static DEFINE_SPINLOCK(perm_group_lock); 109 static void perm_group_watchdog(struct work_struct *work); 110 static DECLARE_DELAYED_WORK(perm_group_work, perm_group_watchdog); 111 112 static void perm_group_watchdog_schedule(void) 113 { 114 schedule_delayed_work(&perm_group_work, secs_to_jiffies(perm_group_timeout)); 115 } 116 117 static void perm_group_watchdog(struct work_struct *work) 118 { 119 struct fsnotify_group *group; 120 struct fanotify_perm_event *event; 121 struct task_struct *task; 122 pid_t failed_pid = 0; 123 124 guard(spinlock)(&perm_group_lock); 125 if (list_empty(&perm_group_list)) 126 return; 127 128 list_for_each_entry(group, &perm_group_list, 129 fanotify_data.perm_grp_list) { 130 /* 131 * Ok to test without lock, racing with an addition is 132 * fine, will deal with it next round 133 */ 134 if (list_empty(&group->fanotify_data.access_list)) 135 continue; 136 137 spin_lock(&group->notification_lock); 138 list_for_each_entry(event, &group->fanotify_data.access_list, 139 fae.fse.list) { 140 if (likely(event->watchdog_cnt == 0)) { 141 event->watchdog_cnt = 1; 142 } else if (event->watchdog_cnt == 1) { 143 /* Report on event only once */ 144 event->watchdog_cnt = 2; 145 146 /* Do not report same pid repeatedly */ 147 if (event->recv_pid == failed_pid) 148 continue; 149 150 failed_pid = event->recv_pid; 151 rcu_read_lock(); 152 task = find_task_by_pid_ns(event->recv_pid, 153 &init_pid_ns); 154 pr_warn_ratelimited( 155 "PID %u (%s) failed to respond to fanotify queue for more than %d seconds\n", 156 event->recv_pid, 157 task ? task->comm : NULL, 158 perm_group_timeout); 159 rcu_read_unlock(); 160 } 161 } 162 spin_unlock(&group->notification_lock); 163 } 164 perm_group_watchdog_schedule(); 165 } 166 167 static void fanotify_perm_watchdog_group_remove(struct fsnotify_group *group) 168 { 169 if (!list_empty(&group->fanotify_data.perm_grp_list)) { 170 /* Perm event watchdog can no longer scan this group. */ 171 spin_lock(&perm_group_lock); 172 list_del_init(&group->fanotify_data.perm_grp_list); 173 spin_unlock(&perm_group_lock); 174 } 175 } 176 177 static void fanotify_perm_watchdog_group_add(struct fsnotify_group *group) 178 { 179 if (!perm_group_timeout) 180 return; 181 182 spin_lock(&perm_group_lock); 183 if (list_empty(&group->fanotify_data.perm_grp_list)) { 184 /* Add to perm_group_list for monitoring by watchdog. */ 185 if (list_empty(&perm_group_list)) 186 perm_group_watchdog_schedule(); 187 list_add_tail(&group->fanotify_data.perm_grp_list, &perm_group_list); 188 } 189 spin_unlock(&perm_group_lock); 190 } 191 192 /* 193 * All flags that may be specified in parameter event_f_flags of fanotify_init. 194 * 195 * Internal and external open flags are stored together in field f_flags of 196 * struct file. Only external open flags shall be allowed in event_f_flags. 197 * Internal flags like FMODE_EXEC shall be excluded. 198 */ 199 #define FANOTIFY_INIT_ALL_EVENT_F_BITS ( \ 200 O_ACCMODE | O_APPEND | O_NONBLOCK | \ 201 __O_SYNC | O_DSYNC | O_CLOEXEC | \ 202 O_LARGEFILE | O_NOATIME ) 203 204 extern const struct fsnotify_ops fanotify_fsnotify_ops; 205 206 struct kmem_cache *fanotify_mark_cache __ro_after_init; 207 struct kmem_cache *fanotify_fid_event_cachep __ro_after_init; 208 struct kmem_cache *fanotify_path_event_cachep __ro_after_init; 209 struct kmem_cache *fanotify_perm_event_cachep __ro_after_init; 210 struct kmem_cache *fanotify_mnt_event_cachep __ro_after_init; 211 212 #define FANOTIFY_EVENT_ALIGN 4 213 #define FANOTIFY_FID_INFO_HDR_LEN \ 214 (sizeof(struct fanotify_event_info_fid) + sizeof(struct file_handle)) 215 #define FANOTIFY_PIDFD_INFO_LEN \ 216 sizeof(struct fanotify_event_info_pidfd) 217 #define FANOTIFY_ERROR_INFO_LEN \ 218 (sizeof(struct fanotify_event_info_error)) 219 #define FANOTIFY_RANGE_INFO_LEN \ 220 (sizeof(struct fanotify_event_info_range)) 221 #define FANOTIFY_MNT_INFO_LEN \ 222 (sizeof(struct fanotify_event_info_mnt)) 223 224 static int fanotify_fid_info_len(int fh_len, int name_len) 225 { 226 int info_len = fh_len; 227 228 if (name_len) 229 info_len += name_len + 1; 230 231 return roundup(FANOTIFY_FID_INFO_HDR_LEN + info_len, 232 FANOTIFY_EVENT_ALIGN); 233 } 234 235 /* FAN_RENAME may have one or two dir+name info records */ 236 static int fanotify_dir_name_info_len(struct fanotify_event *event) 237 { 238 struct fanotify_info *info = fanotify_event_info(event); 239 int dir_fh_len = fanotify_event_dir_fh_len(event); 240 int dir2_fh_len = fanotify_event_dir2_fh_len(event); 241 int info_len = 0; 242 243 if (dir_fh_len) 244 info_len += fanotify_fid_info_len(dir_fh_len, 245 info->name_len); 246 if (dir2_fh_len) 247 info_len += fanotify_fid_info_len(dir2_fh_len, 248 info->name2_len); 249 250 return info_len; 251 } 252 253 static size_t fanotify_event_len(unsigned int info_mode, 254 struct fanotify_event *event) 255 { 256 size_t event_len = FAN_EVENT_METADATA_LEN; 257 int fh_len; 258 int dot_len = 0; 259 260 if (fanotify_is_error_event(event->mask)) 261 event_len += FANOTIFY_ERROR_INFO_LEN; 262 263 if (fanotify_event_has_any_dir_fh(event)) { 264 event_len += fanotify_dir_name_info_len(event); 265 } else if ((info_mode & FAN_REPORT_NAME) && 266 (event->mask & FAN_ONDIR)) { 267 /* 268 * With group flag FAN_REPORT_NAME, if name was not recorded in 269 * event on a directory, we will report the name ".". 270 */ 271 dot_len = 1; 272 } 273 274 if (fanotify_event_has_object_fh(event)) { 275 fh_len = fanotify_event_object_fh_len(event); 276 event_len += fanotify_fid_info_len(fh_len, dot_len); 277 } 278 if (fanotify_is_mnt_event(event->mask)) 279 event_len += FANOTIFY_MNT_INFO_LEN; 280 281 if (info_mode & FAN_REPORT_PIDFD) 282 event_len += FANOTIFY_PIDFD_INFO_LEN; 283 284 if (fanotify_event_has_access_range(event)) 285 event_len += FANOTIFY_RANGE_INFO_LEN; 286 287 return event_len; 288 } 289 290 /* 291 * Remove an hashed event from merge hash table. 292 */ 293 static void fanotify_unhash_event(struct fsnotify_group *group, 294 struct fanotify_event *event) 295 { 296 assert_spin_locked(&group->notification_lock); 297 298 pr_debug("%s: group=%p event=%p bucket=%u\n", __func__, 299 group, event, fanotify_event_hash_bucket(group, event)); 300 301 if (WARN_ON_ONCE(hlist_unhashed(&event->merge_list))) 302 return; 303 304 hlist_del_init(&event->merge_list); 305 } 306 307 /* 308 * Get an fanotify notification event if one exists and is small 309 * enough to fit in "count". Return an error pointer if the count 310 * is not large enough. When permission event is dequeued, its state is 311 * updated accordingly. 312 */ 313 static struct fanotify_event *get_one_event(struct fsnotify_group *group, 314 size_t count) 315 { 316 size_t event_size; 317 struct fanotify_event *event = NULL; 318 struct fsnotify_event *fsn_event; 319 unsigned int info_mode = FAN_GROUP_FLAG(group, FANOTIFY_INFO_MODES); 320 321 pr_debug("%s: group=%p count=%zd\n", __func__, group, count); 322 323 spin_lock(&group->notification_lock); 324 fsn_event = fsnotify_peek_first_event(group); 325 if (!fsn_event) 326 goto out; 327 328 event = FANOTIFY_E(fsn_event); 329 event_size = fanotify_event_len(info_mode, event); 330 331 if (event_size > count) { 332 event = ERR_PTR(-EINVAL); 333 goto out; 334 } 335 336 /* 337 * Held the notification_lock the whole time, so this is the 338 * same event we peeked above. 339 */ 340 fsnotify_remove_first_event(group); 341 if (fanotify_is_perm_event(event->mask)) 342 FANOTIFY_PERM(event)->state = FAN_EVENT_REPORTED; 343 if (fanotify_is_hashed_event(event->mask)) 344 fanotify_unhash_event(group, event); 345 out: 346 spin_unlock(&group->notification_lock); 347 return event; 348 } 349 350 static int create_fd(struct fsnotify_group *group, const struct path *path, 351 struct file **file) 352 { 353 int client_fd; 354 struct file *new_file; 355 356 client_fd = get_unused_fd_flags(group->fanotify_data.f_flags); 357 if (client_fd < 0) 358 return client_fd; 359 360 /* 361 * We provide an fd for the userspace program, so it could access the 362 * file without generating fanotify events itself. 363 */ 364 new_file = dentry_open_nonotify(path, group->fanotify_data.f_flags, 365 current_cred()); 366 if (IS_ERR(new_file)) { 367 put_unused_fd(client_fd); 368 client_fd = PTR_ERR(new_file); 369 } else { 370 *file = new_file; 371 } 372 373 return client_fd; 374 } 375 376 static int process_access_response_info(const char __user *info, 377 size_t info_len, 378 struct fanotify_response_info_audit_rule *friar) 379 { 380 if (info_len != sizeof(*friar)) 381 return -EINVAL; 382 383 if (copy_from_user(friar, info, sizeof(*friar))) 384 return -EFAULT; 385 386 if (friar->hdr.type != FAN_RESPONSE_INFO_AUDIT_RULE) 387 return -EINVAL; 388 if (friar->hdr.pad != 0) 389 return -EINVAL; 390 if (friar->hdr.len != sizeof(*friar)) 391 return -EINVAL; 392 393 return info_len; 394 } 395 396 /* 397 * Finish processing of permission event by setting it to ANSWERED state and 398 * drop group->notification_lock. 399 */ 400 static void finish_permission_event(struct fsnotify_group *group, 401 struct fanotify_perm_event *event, u32 response, 402 struct fanotify_response_info_audit_rule *friar) 403 __releases(&group->notification_lock) 404 { 405 bool destroy = false; 406 407 assert_spin_locked(&group->notification_lock); 408 event->response = response & ~FAN_INFO; 409 if (response & FAN_INFO) 410 memcpy(&event->audit_rule, friar, sizeof(*friar)); 411 412 if (event->state == FAN_EVENT_CANCELED) 413 destroy = true; 414 else 415 event->state = FAN_EVENT_ANSWERED; 416 spin_unlock(&group->notification_lock); 417 if (destroy) 418 fsnotify_destroy_event(group, &event->fae.fse); 419 } 420 421 static int process_access_response(struct fsnotify_group *group, 422 struct fanotify_response *response_struct, 423 const char __user *info, 424 size_t info_len) 425 { 426 struct fanotify_perm_event *event; 427 int fd = response_struct->fd; 428 u32 response = response_struct->response; 429 int errno = fanotify_get_response_errno(response); 430 int ret = info_len; 431 struct fanotify_response_info_audit_rule friar; 432 433 pr_debug("%s: group=%p fd=%d response=%x errno=%d buf=%p size=%zu\n", 434 __func__, group, fd, response, errno, info, info_len); 435 /* 436 * make sure the response is valid, if invalid we do nothing and either 437 * userspace can send a valid response or we will clean it up after the 438 * timeout 439 */ 440 if (response & ~FANOTIFY_RESPONSE_VALID_MASK) 441 return -EINVAL; 442 443 switch (response & FANOTIFY_RESPONSE_ACCESS) { 444 case FAN_ALLOW: 445 if (errno) 446 return -EINVAL; 447 break; 448 case FAN_DENY: 449 /* Custom errno is supported only for pre-content groups */ 450 if (errno && group->priority != FSNOTIFY_PRIO_PRE_CONTENT) 451 return -EINVAL; 452 453 /* 454 * Limit errno to values expected on open(2)/read(2)/write(2) 455 * of regular files. 456 */ 457 switch (errno) { 458 case 0: 459 case EIO: 460 case EPERM: 461 case EBUSY: 462 case ETXTBSY: 463 case EAGAIN: 464 case ENOSPC: 465 case EDQUOT: 466 break; 467 default: 468 return -EINVAL; 469 } 470 break; 471 default: 472 return -EINVAL; 473 } 474 475 if ((response & FAN_AUDIT) && !FAN_GROUP_FLAG(group, FAN_ENABLE_AUDIT)) 476 return -EINVAL; 477 478 if (response & FAN_INFO) { 479 ret = process_access_response_info(info, info_len, &friar); 480 if (ret < 0) 481 return ret; 482 if (fd == FAN_NOFD) 483 return ret; 484 } else { 485 ret = 0; 486 } 487 488 if (fd < 0) 489 return -EINVAL; 490 491 spin_lock(&group->notification_lock); 492 list_for_each_entry(event, &group->fanotify_data.access_list, 493 fae.fse.list) { 494 if (event->fd != fd) 495 continue; 496 497 list_del_init(&event->fae.fse.list); 498 finish_permission_event(group, event, response, &friar); 499 wake_up(&group->fanotify_data.access_waitq); 500 return ret; 501 } 502 spin_unlock(&group->notification_lock); 503 504 return -ENOENT; 505 } 506 507 static size_t copy_mnt_info_to_user(struct fanotify_event *event, 508 char __user *buf, int count) 509 { 510 struct fanotify_event_info_mnt info = { }; 511 512 info.hdr.info_type = FAN_EVENT_INFO_TYPE_MNT; 513 info.hdr.len = FANOTIFY_MNT_INFO_LEN; 514 515 if (WARN_ON(count < info.hdr.len)) 516 return -EFAULT; 517 518 info.mnt_id = FANOTIFY_ME(event)->mnt_id; 519 520 if (copy_to_user(buf, &info, sizeof(info))) 521 return -EFAULT; 522 523 return info.hdr.len; 524 } 525 526 static size_t copy_error_info_to_user(struct fanotify_event *event, 527 char __user *buf, int count) 528 { 529 struct fanotify_event_info_error info = { }; 530 struct fanotify_error_event *fee = FANOTIFY_EE(event); 531 532 info.hdr.info_type = FAN_EVENT_INFO_TYPE_ERROR; 533 info.hdr.len = FANOTIFY_ERROR_INFO_LEN; 534 535 if (WARN_ON(count < info.hdr.len)) 536 return -EFAULT; 537 538 info.error = fee->error; 539 info.error_count = fee->err_count; 540 541 if (copy_to_user(buf, &info, sizeof(info))) 542 return -EFAULT; 543 544 return info.hdr.len; 545 } 546 547 static int copy_fid_info_to_user(__kernel_fsid_t *fsid, struct fanotify_fh *fh, 548 int info_type, const char *name, 549 size_t name_len, 550 char __user *buf, size_t count) 551 { 552 struct fanotify_event_info_fid info = { }; 553 struct file_handle handle = { }; 554 unsigned char bounce[FANOTIFY_INLINE_FH_LEN], *fh_buf; 555 size_t fh_len = fh ? fh->len : 0; 556 size_t info_len = fanotify_fid_info_len(fh_len, name_len); 557 size_t len = info_len; 558 559 pr_debug("%s: fh_len=%zu name_len=%zu, info_len=%zu, count=%zu\n", 560 __func__, fh_len, name_len, info_len, count); 561 562 if (WARN_ON_ONCE(len < sizeof(info) || len > count)) 563 return -EFAULT; 564 565 /* 566 * Copy event info fid header followed by variable sized file handle 567 * and optionally followed by variable sized filename. 568 */ 569 switch (info_type) { 570 case FAN_EVENT_INFO_TYPE_FID: 571 case FAN_EVENT_INFO_TYPE_DFID: 572 if (WARN_ON_ONCE(name_len)) 573 return -EFAULT; 574 break; 575 case FAN_EVENT_INFO_TYPE_DFID_NAME: 576 case FAN_EVENT_INFO_TYPE_OLD_DFID_NAME: 577 case FAN_EVENT_INFO_TYPE_NEW_DFID_NAME: 578 if (WARN_ON_ONCE(!name || !name_len)) 579 return -EFAULT; 580 break; 581 default: 582 return -EFAULT; 583 } 584 585 info.hdr.info_type = info_type; 586 info.hdr.len = len; 587 info.fsid = *fsid; 588 if (copy_to_user(buf, &info, sizeof(info))) 589 return -EFAULT; 590 591 buf += sizeof(info); 592 len -= sizeof(info); 593 if (WARN_ON_ONCE(len < sizeof(handle))) 594 return -EFAULT; 595 596 handle.handle_type = fh->type; 597 handle.handle_bytes = fh_len; 598 599 /* Mangle handle_type for bad file_handle */ 600 if (!fh_len) 601 handle.handle_type = FILEID_INVALID; 602 603 if (copy_to_user(buf, &handle, sizeof(handle))) 604 return -EFAULT; 605 606 buf += sizeof(handle); 607 len -= sizeof(handle); 608 if (WARN_ON_ONCE(len < fh_len)) 609 return -EFAULT; 610 611 /* 612 * For an inline fh and inline file name, copy through stack to exclude 613 * the copy from usercopy hardening protections. 614 */ 615 fh_buf = fanotify_fh_buf(fh); 616 if (fh_len <= FANOTIFY_INLINE_FH_LEN) { 617 memcpy(bounce, fh_buf, fh_len); 618 fh_buf = bounce; 619 } 620 if (copy_to_user(buf, fh_buf, fh_len)) 621 return -EFAULT; 622 623 buf += fh_len; 624 len -= fh_len; 625 626 if (name_len) { 627 /* Copy the filename with terminating null */ 628 name_len++; 629 if (WARN_ON_ONCE(len < name_len)) 630 return -EFAULT; 631 632 if (copy_to_user(buf, name, name_len)) 633 return -EFAULT; 634 635 buf += name_len; 636 len -= name_len; 637 } 638 639 /* Pad with 0's */ 640 WARN_ON_ONCE(len < 0 || len >= FANOTIFY_EVENT_ALIGN); 641 if (len > 0 && clear_user(buf, len)) 642 return -EFAULT; 643 644 return info_len; 645 } 646 647 static int copy_pidfd_info_to_user(int pidfd, 648 char __user *buf, 649 size_t count) 650 { 651 struct fanotify_event_info_pidfd info = { }; 652 size_t info_len = FANOTIFY_PIDFD_INFO_LEN; 653 654 if (WARN_ON_ONCE(info_len > count)) 655 return -EFAULT; 656 657 info.hdr.info_type = FAN_EVENT_INFO_TYPE_PIDFD; 658 info.hdr.len = info_len; 659 info.pidfd = pidfd; 660 661 if (copy_to_user(buf, &info, info_len)) 662 return -EFAULT; 663 664 return info_len; 665 } 666 667 static size_t copy_range_info_to_user(struct fanotify_event *event, 668 char __user *buf, int count) 669 { 670 struct fanotify_perm_event *pevent = FANOTIFY_PERM(event); 671 struct fanotify_event_info_range info = { }; 672 size_t info_len = FANOTIFY_RANGE_INFO_LEN; 673 674 if (WARN_ON_ONCE(info_len > count)) 675 return -EFAULT; 676 677 if (WARN_ON_ONCE(!pevent->ppos)) 678 return -EINVAL; 679 680 info.hdr.info_type = FAN_EVENT_INFO_TYPE_RANGE; 681 info.hdr.len = info_len; 682 info.offset = *(pevent->ppos); 683 info.count = pevent->count; 684 685 if (copy_to_user(buf, &info, info_len)) 686 return -EFAULT; 687 688 return info_len; 689 } 690 691 static int copy_info_records_to_user(struct fanotify_event *event, 692 struct fanotify_info *info, 693 unsigned int info_mode, int pidfd, 694 char __user *buf, size_t count) 695 { 696 int ret, total_bytes = 0, info_type = 0; 697 unsigned int fid_mode = info_mode & FANOTIFY_FID_BITS; 698 unsigned int pidfd_mode = info_mode & FAN_REPORT_PIDFD; 699 700 /* 701 * Event info records order is as follows: 702 * 1. dir fid + name 703 * 2. (optional) new dir fid + new name 704 * 3. (optional) child fid 705 */ 706 if (fanotify_event_has_dir_fh(event)) { 707 info_type = info->name_len ? FAN_EVENT_INFO_TYPE_DFID_NAME : 708 FAN_EVENT_INFO_TYPE_DFID; 709 710 /* FAN_RENAME uses special info types */ 711 if (event->mask & FAN_RENAME) 712 info_type = FAN_EVENT_INFO_TYPE_OLD_DFID_NAME; 713 714 ret = copy_fid_info_to_user(fanotify_event_fsid(event), 715 fanotify_info_dir_fh(info), 716 info_type, 717 fanotify_info_name(info), 718 info->name_len, buf, count); 719 if (ret < 0) 720 return ret; 721 722 buf += ret; 723 count -= ret; 724 total_bytes += ret; 725 } 726 727 /* New dir fid+name may be reported in addition to old dir fid+name */ 728 if (fanotify_event_has_dir2_fh(event)) { 729 info_type = FAN_EVENT_INFO_TYPE_NEW_DFID_NAME; 730 ret = copy_fid_info_to_user(fanotify_event_fsid(event), 731 fanotify_info_dir2_fh(info), 732 info_type, 733 fanotify_info_name2(info), 734 info->name2_len, buf, count); 735 if (ret < 0) 736 return ret; 737 738 buf += ret; 739 count -= ret; 740 total_bytes += ret; 741 } 742 743 if (fanotify_event_has_object_fh(event)) { 744 const char *dot = NULL; 745 int dot_len = 0; 746 747 if (fid_mode == FAN_REPORT_FID || info_type) { 748 /* 749 * With only group flag FAN_REPORT_FID only type FID is 750 * reported. Second info record type is always FID. 751 */ 752 info_type = FAN_EVENT_INFO_TYPE_FID; 753 } else if ((fid_mode & FAN_REPORT_NAME) && 754 (event->mask & FAN_ONDIR)) { 755 /* 756 * With group flag FAN_REPORT_NAME, if name was not 757 * recorded in an event on a directory, report the name 758 * "." with info type DFID_NAME. 759 */ 760 info_type = FAN_EVENT_INFO_TYPE_DFID_NAME; 761 dot = "."; 762 dot_len = 1; 763 } else if ((event->mask & ALL_FSNOTIFY_DIRENT_EVENTS) || 764 (event->mask & FAN_ONDIR)) { 765 /* 766 * With group flag FAN_REPORT_DIR_FID, a single info 767 * record has type DFID for directory entry modification 768 * event and for event on a directory. 769 */ 770 info_type = FAN_EVENT_INFO_TYPE_DFID; 771 } else { 772 /* 773 * With group flags FAN_REPORT_DIR_FID|FAN_REPORT_FID, 774 * a single info record has type FID for event on a 775 * non-directory, when there is no directory to report. 776 * For example, on FAN_DELETE_SELF event. 777 */ 778 info_type = FAN_EVENT_INFO_TYPE_FID; 779 } 780 781 ret = copy_fid_info_to_user(fanotify_event_fsid(event), 782 fanotify_event_object_fh(event), 783 info_type, dot, dot_len, 784 buf, count); 785 if (ret < 0) 786 return ret; 787 788 buf += ret; 789 count -= ret; 790 total_bytes += ret; 791 } 792 793 if (pidfd_mode) { 794 ret = copy_pidfd_info_to_user(pidfd, buf, count); 795 if (ret < 0) 796 return ret; 797 798 buf += ret; 799 count -= ret; 800 total_bytes += ret; 801 } 802 803 if (fanotify_is_error_event(event->mask)) { 804 ret = copy_error_info_to_user(event, buf, count); 805 if (ret < 0) 806 return ret; 807 buf += ret; 808 count -= ret; 809 total_bytes += ret; 810 } 811 812 if (fanotify_event_has_access_range(event)) { 813 ret = copy_range_info_to_user(event, buf, count); 814 if (ret < 0) 815 return ret; 816 buf += ret; 817 count -= ret; 818 total_bytes += ret; 819 } 820 821 if (fanotify_is_mnt_event(event->mask)) { 822 ret = copy_mnt_info_to_user(event, buf, count); 823 if (ret < 0) 824 return ret; 825 buf += ret; 826 count -= ret; 827 total_bytes += ret; 828 } 829 830 return total_bytes; 831 } 832 833 static ssize_t copy_event_to_user(struct fsnotify_group *group, 834 struct fanotify_event *event, 835 char __user *buf, size_t count) 836 { 837 struct fanotify_event_metadata metadata; 838 const struct path *path = fanotify_event_path(event); 839 struct fanotify_info *info = fanotify_event_info(event); 840 unsigned int info_mode = FAN_GROUP_FLAG(group, FANOTIFY_INFO_MODES); 841 unsigned int pidfd_mode = info_mode & FAN_REPORT_PIDFD; 842 struct file *f = NULL, *pidfd_file = NULL; 843 int ret, pidfd = -ESRCH, fd = -EBADF; 844 845 pr_debug("%s: group=%p event=%p\n", __func__, group, event); 846 847 metadata.event_len = fanotify_event_len(info_mode, event); 848 metadata.metadata_len = FAN_EVENT_METADATA_LEN; 849 metadata.vers = FANOTIFY_METADATA_VERSION; 850 metadata.reserved = 0; 851 metadata.mask = event->mask & FANOTIFY_OUTGOING_EVENTS; 852 metadata.pid = pid_vnr(event->pid); 853 /* 854 * For an unprivileged listener, event->pid can be used to identify the 855 * events generated by the listener process itself, without disclosing 856 * the pids of other processes. 857 */ 858 if (FAN_GROUP_FLAG(group, FANOTIFY_UNPRIV) && 859 task_tgid(current) != event->pid) 860 metadata.pid = 0; 861 862 /* 863 * For now, fid mode is required for an unprivileged listener and 864 * fid mode does not report fd in events. Keep this check anyway 865 * for safety in case fid mode requirement is relaxed in the future 866 * to allow unprivileged listener to get events with no fd and no fid. 867 */ 868 if (!FAN_GROUP_FLAG(group, FANOTIFY_UNPRIV) && 869 path && path->mnt && path->dentry) { 870 fd = create_fd(group, path, &f); 871 /* 872 * Opening an fd from dentry can fail for several reasons. 873 * For example, when tasks are gone and we try to open their 874 * /proc files or we try to open a WRONLY file like in sysfs 875 * or when trying to open a file that was deleted on the 876 * remote network server. 877 * 878 * For a group with FAN_REPORT_FD_ERROR, we will send the 879 * event with the error instead of the open fd, otherwise 880 * Userspace may not get the error at all. 881 * In any case, userspace will not know which file failed to 882 * open, so add a debug print for further investigation. 883 */ 884 if (fd < 0) { 885 pr_debug("fanotify: create_fd(%pd2) failed err=%d\n", 886 path->dentry, fd); 887 if (!FAN_GROUP_FLAG(group, FAN_REPORT_FD_ERROR)) { 888 /* 889 * Historically, we've handled EOPENSTALE in a 890 * special way and silently dropped such 891 * events. Now we have to keep it to maintain 892 * backward compatibility... 893 */ 894 if (fd == -EOPENSTALE) 895 fd = 0; 896 return fd; 897 } 898 } 899 } 900 if (FAN_GROUP_FLAG(group, FAN_REPORT_FD_ERROR)) 901 metadata.fd = fd; 902 else 903 metadata.fd = fd >= 0 ? fd : FAN_NOFD; 904 905 if (pidfd_mode) { 906 /* 907 * Complain if the FAN_REPORT_PIDFD and FAN_REPORT_TID mutual 908 * exclusion is ever lifted. At the time of incoporating pidfd 909 * support within fanotify, the pidfd API only supported the 910 * creation of pidfds for thread-group leaders. 911 */ 912 WARN_ON_ONCE(FAN_GROUP_FLAG(group, FAN_REPORT_TID)); 913 914 /* 915 * The PIDTYPE_TGID check for an event->pid is performed 916 * preemptively in an attempt to catch out cases where the event 917 * listener reads events after the event generating process has 918 * already terminated. Depending on flag FAN_REPORT_FD_ERROR, 919 * report either -ESRCH or FAN_NOPIDFD to the event listener in 920 * those cases with all other pidfd creation errors reported as 921 * the error code itself or as FAN_EPIDFD. 922 */ 923 if (metadata.pid && pid_has_task(event->pid, PIDTYPE_TGID)) 924 pidfd = pidfd_prepare(event->pid, 0, &pidfd_file); 925 926 if (!FAN_GROUP_FLAG(group, FAN_REPORT_FD_ERROR) && pidfd < 0) 927 pidfd = pidfd == -ESRCH ? FAN_NOPIDFD : FAN_EPIDFD; 928 } 929 930 ret = -EFAULT; 931 /* 932 * Sanity check copy size in case get_one_event() and 933 * event_len sizes ever get out of sync. 934 */ 935 if (WARN_ON_ONCE(metadata.event_len > count)) 936 goto out_close_fd; 937 938 if (copy_to_user(buf, &metadata, FAN_EVENT_METADATA_LEN)) 939 goto out_close_fd; 940 941 buf += FAN_EVENT_METADATA_LEN; 942 count -= FAN_EVENT_METADATA_LEN; 943 944 ret = copy_info_records_to_user(event, info, info_mode, pidfd, 945 buf, count); 946 if (ret < 0) 947 goto out_close_fd; 948 949 if (f) 950 fd_install(fd, f); 951 952 if (pidfd_file) 953 fd_install(pidfd, pidfd_file); 954 955 if (fanotify_is_perm_event(event->mask)) 956 FANOTIFY_PERM(event)->fd = fd; 957 958 return metadata.event_len; 959 960 out_close_fd: 961 if (f) { 962 put_unused_fd(fd); 963 fput(f); 964 } 965 966 if (pidfd_file) { 967 put_unused_fd(pidfd); 968 fput(pidfd_file); 969 } 970 971 return ret; 972 } 973 974 /* intofiy userspace file descriptor functions */ 975 static __poll_t fanotify_poll(struct file *file, poll_table *wait) 976 { 977 struct fsnotify_group *group = file->private_data; 978 __poll_t ret = 0; 979 980 poll_wait(file, &group->notification_waitq, wait); 981 spin_lock(&group->notification_lock); 982 if (!fsnotify_notify_queue_is_empty(group)) 983 ret = EPOLLIN | EPOLLRDNORM; 984 spin_unlock(&group->notification_lock); 985 986 return ret; 987 } 988 989 static ssize_t fanotify_read(struct file *file, char __user *buf, 990 size_t count, loff_t *pos) 991 { 992 struct fsnotify_group *group; 993 struct fanotify_event *event; 994 char __user *start; 995 int ret; 996 DEFINE_WAIT_FUNC(wait, woken_wake_function); 997 998 start = buf; 999 group = file->private_data; 1000 1001 pr_debug("%s: group=%p\n", __func__, group); 1002 1003 add_wait_queue(&group->notification_waitq, &wait); 1004 while (1) { 1005 /* 1006 * User can supply arbitrarily large buffer. Avoid softlockups 1007 * in case there are lots of available events. 1008 */ 1009 cond_resched(); 1010 event = get_one_event(group, count); 1011 if (IS_ERR(event)) { 1012 ret = PTR_ERR(event); 1013 break; 1014 } 1015 1016 if (!event) { 1017 ret = -EAGAIN; 1018 if (file->f_flags & O_NONBLOCK) 1019 break; 1020 1021 ret = -ERESTARTSYS; 1022 if (signal_pending(current)) 1023 break; 1024 1025 if (start != buf) 1026 break; 1027 1028 wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT); 1029 continue; 1030 } 1031 1032 ret = copy_event_to_user(group, event, buf, count); 1033 1034 /* 1035 * Permission events get queued to wait for response. Other 1036 * events can be destroyed now. 1037 */ 1038 if (!fanotify_is_perm_event(event->mask)) { 1039 fsnotify_destroy_event(group, &event->fse); 1040 } else { 1041 if (ret <= 0 || FANOTIFY_PERM(event)->fd < 0) { 1042 spin_lock(&group->notification_lock); 1043 finish_permission_event(group, 1044 FANOTIFY_PERM(event), FAN_DENY, NULL); 1045 wake_up(&group->fanotify_data.access_waitq); 1046 } else { 1047 spin_lock(&group->notification_lock); 1048 list_add_tail(&event->fse.list, 1049 &group->fanotify_data.access_list); 1050 FANOTIFY_PERM(event)->recv_pid = current->pid; 1051 spin_unlock(&group->notification_lock); 1052 } 1053 } 1054 if (ret < 0) 1055 break; 1056 buf += ret; 1057 count -= ret; 1058 } 1059 remove_wait_queue(&group->notification_waitq, &wait); 1060 1061 if (start != buf && ret != -EFAULT) 1062 ret = buf - start; 1063 return ret; 1064 } 1065 1066 static ssize_t fanotify_write(struct file *file, const char __user *buf, size_t count, loff_t *pos) 1067 { 1068 struct fanotify_response response; 1069 struct fsnotify_group *group; 1070 int ret; 1071 const char __user *info_buf = buf + sizeof(struct fanotify_response); 1072 size_t info_len; 1073 1074 if (!IS_ENABLED(CONFIG_FANOTIFY_ACCESS_PERMISSIONS)) 1075 return -EINVAL; 1076 1077 group = file->private_data; 1078 1079 pr_debug("%s: group=%p count=%zu\n", __func__, group, count); 1080 1081 if (count < sizeof(response)) 1082 return -EINVAL; 1083 1084 if (copy_from_user(&response, buf, sizeof(response))) 1085 return -EFAULT; 1086 1087 info_len = count - sizeof(response); 1088 1089 ret = process_access_response(group, &response, info_buf, info_len); 1090 if (ret < 0) 1091 count = ret; 1092 else 1093 count = sizeof(response) + ret; 1094 1095 return count; 1096 } 1097 1098 static int fanotify_release(struct inode *ignored, struct file *file) 1099 { 1100 struct fsnotify_group *group = file->private_data; 1101 struct fsnotify_event *fsn_event; 1102 1103 /* 1104 * Stop new events from arriving in the notification queue. since 1105 * userspace cannot use fanotify fd anymore, no event can enter or 1106 * leave access_list by now either. 1107 */ 1108 fsnotify_group_stop_queueing(group); 1109 1110 fanotify_perm_watchdog_group_remove(group); 1111 1112 /* 1113 * Process all permission events on access_list and notification queue 1114 * and simulate reply from userspace. 1115 */ 1116 spin_lock(&group->notification_lock); 1117 while (!list_empty(&group->fanotify_data.access_list)) { 1118 struct fanotify_perm_event *event; 1119 1120 event = list_first_entry(&group->fanotify_data.access_list, 1121 struct fanotify_perm_event, fae.fse.list); 1122 list_del_init(&event->fae.fse.list); 1123 finish_permission_event(group, event, FAN_ALLOW, NULL); 1124 spin_lock(&group->notification_lock); 1125 } 1126 1127 /* 1128 * Destroy all non-permission events. For permission events just 1129 * dequeue them and set the response. They will be freed once the 1130 * response is consumed and fanotify_get_response() returns. 1131 */ 1132 while ((fsn_event = fsnotify_remove_first_event(group))) { 1133 struct fanotify_event *event = FANOTIFY_E(fsn_event); 1134 1135 if (!(event->mask & FANOTIFY_PERM_EVENTS)) { 1136 spin_unlock(&group->notification_lock); 1137 fsnotify_destroy_event(group, fsn_event); 1138 } else { 1139 finish_permission_event(group, FANOTIFY_PERM(event), 1140 FAN_ALLOW, NULL); 1141 } 1142 spin_lock(&group->notification_lock); 1143 } 1144 spin_unlock(&group->notification_lock); 1145 1146 /* Response for all permission events it set, wakeup waiters */ 1147 wake_up(&group->fanotify_data.access_waitq); 1148 1149 /* matches the fanotify_init->fsnotify_alloc_group */ 1150 fsnotify_destroy_group(group); 1151 1152 return 0; 1153 } 1154 1155 static long fanotify_ioctl(struct file *file, unsigned int cmd, unsigned long arg) 1156 { 1157 struct fsnotify_group *group; 1158 struct fsnotify_event *fsn_event; 1159 void __user *p; 1160 int ret = -ENOTTY; 1161 size_t send_len = 0; 1162 1163 group = file->private_data; 1164 1165 p = (void __user *) arg; 1166 1167 switch (cmd) { 1168 case FIONREAD: 1169 spin_lock(&group->notification_lock); 1170 list_for_each_entry(fsn_event, &group->notification_list, list) 1171 send_len += FAN_EVENT_METADATA_LEN; 1172 spin_unlock(&group->notification_lock); 1173 ret = put_user(send_len, (int __user *) p); 1174 break; 1175 } 1176 1177 return ret; 1178 } 1179 1180 static const struct file_operations fanotify_fops = { 1181 .show_fdinfo = fanotify_show_fdinfo, 1182 .poll = fanotify_poll, 1183 .read = fanotify_read, 1184 .write = fanotify_write, 1185 .fasync = NULL, 1186 .release = fanotify_release, 1187 .unlocked_ioctl = fanotify_ioctl, 1188 .compat_ioctl = compat_ptr_ioctl, 1189 .llseek = noop_llseek, 1190 }; 1191 1192 static int fanotify_find_path(int dfd, const char __user *filename, 1193 struct path *path, unsigned int flags, __u64 mask, 1194 unsigned int obj_type) 1195 { 1196 int ret; 1197 1198 pr_debug("%s: dfd=%d filename=%p flags=%x\n", __func__, 1199 dfd, filename, flags); 1200 1201 if (filename == NULL) { 1202 CLASS(fd, f)(dfd); 1203 1204 if (fd_empty(f)) 1205 return -EBADF; 1206 1207 if ((flags & FAN_MARK_ONLYDIR) && 1208 !(S_ISDIR(file_inode(fd_file(f))->i_mode))) 1209 return -ENOTDIR; 1210 1211 *path = fd_file(f)->f_path; 1212 path_get(path); 1213 } else { 1214 unsigned int lookup_flags = 0; 1215 1216 if (!(flags & FAN_MARK_DONT_FOLLOW)) 1217 lookup_flags |= LOOKUP_FOLLOW; 1218 if (flags & FAN_MARK_ONLYDIR) 1219 lookup_flags |= LOOKUP_DIRECTORY; 1220 1221 ret = user_path_at(dfd, filename, lookup_flags, path); 1222 if (ret) 1223 goto out; 1224 } 1225 1226 /* you can only watch an inode if you have read permissions on it */ 1227 ret = path_permission(path, MAY_READ); 1228 if (ret) { 1229 path_put(path); 1230 goto out; 1231 } 1232 1233 ret = security_path_notify(path, mask, obj_type); 1234 if (ret) 1235 path_put(path); 1236 1237 out: 1238 return ret; 1239 } 1240 1241 static __u32 fanotify_mark_remove_from_mask(struct fsnotify_mark *fsn_mark, 1242 __u32 mask, unsigned int flags, 1243 __u32 umask, int *destroy) 1244 { 1245 __u32 oldmask, newmask; 1246 1247 /* umask bits cannot be removed by user */ 1248 mask &= ~umask; 1249 spin_lock(&fsn_mark->lock); 1250 oldmask = fsnotify_calc_mask(fsn_mark); 1251 if (!(flags & FANOTIFY_MARK_IGNORE_BITS)) { 1252 fsn_mark->mask &= ~mask; 1253 } else { 1254 fsn_mark->ignore_mask &= ~mask; 1255 } 1256 newmask = fsnotify_calc_mask(fsn_mark); 1257 /* 1258 * We need to keep the mark around even if remaining mask cannot 1259 * result in any events (e.g. mask == FAN_ONDIR) to support incremenal 1260 * changes to the mask. 1261 * Destroy mark when only umask bits remain. 1262 */ 1263 *destroy = !((fsn_mark->mask | fsn_mark->ignore_mask) & ~umask); 1264 spin_unlock(&fsn_mark->lock); 1265 1266 return oldmask & ~newmask; 1267 } 1268 1269 static int fanotify_remove_mark(struct fsnotify_group *group, 1270 void *obj, unsigned int obj_type, __u32 mask, 1271 unsigned int flags, __u32 umask) 1272 { 1273 struct fsnotify_mark *fsn_mark = NULL; 1274 __u32 removed; 1275 int destroy_mark; 1276 1277 fsnotify_group_lock(group); 1278 fsn_mark = fsnotify_find_mark(obj, obj_type, group); 1279 if (!fsn_mark) { 1280 fsnotify_group_unlock(group); 1281 return -ENOENT; 1282 } 1283 1284 removed = fanotify_mark_remove_from_mask(fsn_mark, mask, flags, 1285 umask, &destroy_mark); 1286 if (removed & fsnotify_conn_mask(fsn_mark->connector)) 1287 fsnotify_recalc_mask(fsn_mark->connector); 1288 if (destroy_mark) 1289 fsnotify_detach_mark(fsn_mark); 1290 fsnotify_group_unlock(group); 1291 if (destroy_mark) 1292 fsnotify_free_mark(fsn_mark); 1293 1294 /* matches the fsnotify_find_mark() */ 1295 fsnotify_put_mark(fsn_mark); 1296 return 0; 1297 } 1298 1299 static bool fanotify_mark_update_flags(struct fsnotify_mark *fsn_mark, 1300 unsigned int fan_flags) 1301 { 1302 bool want_iref = !(fan_flags & FAN_MARK_EVICTABLE); 1303 unsigned int ignore = fan_flags & FANOTIFY_MARK_IGNORE_BITS; 1304 bool recalc = false; 1305 1306 /* 1307 * When using FAN_MARK_IGNORE for the first time, mark starts using 1308 * independent event flags in ignore mask. After that, trying to 1309 * update the ignore mask with the old FAN_MARK_IGNORED_MASK API 1310 * will result in EEXIST error. 1311 */ 1312 if (ignore == FAN_MARK_IGNORE) 1313 fsn_mark->flags |= FSNOTIFY_MARK_FLAG_HAS_IGNORE_FLAGS; 1314 1315 /* 1316 * Setting FAN_MARK_IGNORED_SURV_MODIFY for the first time may lead to 1317 * the removal of the FS_MODIFY bit in calculated mask if it was set 1318 * because of an ignore mask that is now going to survive FS_MODIFY. 1319 */ 1320 if (ignore && (fan_flags & FAN_MARK_IGNORED_SURV_MODIFY) && 1321 !(fsn_mark->flags & FSNOTIFY_MARK_FLAG_IGNORED_SURV_MODIFY)) { 1322 fsn_mark->flags |= FSNOTIFY_MARK_FLAG_IGNORED_SURV_MODIFY; 1323 if (!(fsn_mark->mask & FS_MODIFY)) 1324 recalc = true; 1325 } 1326 1327 if (fsn_mark->connector->type != FSNOTIFY_OBJ_TYPE_INODE || 1328 want_iref == !(fsn_mark->flags & FSNOTIFY_MARK_FLAG_NO_IREF)) 1329 return recalc; 1330 1331 /* 1332 * NO_IREF may be removed from a mark, but not added. 1333 * When removed, fsnotify_recalc_mask() will take the inode ref. 1334 */ 1335 WARN_ON_ONCE(!want_iref); 1336 fsn_mark->flags &= ~FSNOTIFY_MARK_FLAG_NO_IREF; 1337 1338 return true; 1339 } 1340 1341 static bool fanotify_mark_add_to_mask(struct fsnotify_mark *fsn_mark, 1342 __u32 mask, unsigned int fan_flags) 1343 { 1344 bool recalc; 1345 1346 spin_lock(&fsn_mark->lock); 1347 if (!(fan_flags & FANOTIFY_MARK_IGNORE_BITS)) 1348 fsn_mark->mask |= mask; 1349 else 1350 fsn_mark->ignore_mask |= mask; 1351 1352 recalc = fsnotify_calc_mask(fsn_mark) & 1353 ~fsnotify_conn_mask(fsn_mark->connector); 1354 1355 recalc |= fanotify_mark_update_flags(fsn_mark, fan_flags); 1356 spin_unlock(&fsn_mark->lock); 1357 1358 return recalc; 1359 } 1360 1361 struct fan_fsid { 1362 struct super_block *sb; 1363 __kernel_fsid_t id; 1364 bool weak; 1365 }; 1366 1367 static int fanotify_set_mark_fsid(struct fsnotify_group *group, 1368 struct fsnotify_mark *mark, 1369 struct fan_fsid *fsid) 1370 { 1371 struct fsnotify_mark_connector *conn; 1372 struct fsnotify_mark *old; 1373 struct super_block *old_sb = NULL; 1374 1375 FANOTIFY_MARK(mark)->fsid = fsid->id; 1376 mark->flags |= FSNOTIFY_MARK_FLAG_HAS_FSID; 1377 if (fsid->weak) 1378 mark->flags |= FSNOTIFY_MARK_FLAG_WEAK_FSID; 1379 1380 /* First mark added will determine if group is single or multi fsid */ 1381 if (list_empty(&group->marks_list)) 1382 return 0; 1383 1384 /* Find sb of an existing mark */ 1385 list_for_each_entry(old, &group->marks_list, g_list) { 1386 conn = READ_ONCE(old->connector); 1387 if (!conn) 1388 continue; 1389 old_sb = fsnotify_connector_sb(conn); 1390 if (old_sb) 1391 break; 1392 } 1393 1394 /* Only detached marks left? */ 1395 if (!old_sb) 1396 return 0; 1397 1398 /* Do not allow mixing of marks with weak and strong fsid */ 1399 if ((mark->flags ^ old->flags) & FSNOTIFY_MARK_FLAG_WEAK_FSID) 1400 return -EXDEV; 1401 1402 /* Allow mixing of marks with strong fsid from different fs */ 1403 if (!fsid->weak) 1404 return 0; 1405 1406 /* Do not allow mixing marks with weak fsid from different fs */ 1407 if (old_sb != fsid->sb) 1408 return -EXDEV; 1409 1410 /* Do not allow mixing marks from different btrfs sub-volumes */ 1411 if (!fanotify_fsid_equal(&FANOTIFY_MARK(old)->fsid, 1412 &FANOTIFY_MARK(mark)->fsid)) 1413 return -EXDEV; 1414 1415 return 0; 1416 } 1417 1418 static struct fsnotify_mark *fanotify_add_new_mark(struct fsnotify_group *group, 1419 void *obj, 1420 unsigned int obj_type, 1421 unsigned int fan_flags, 1422 struct fan_fsid *fsid) 1423 { 1424 struct ucounts *ucounts = group->fanotify_data.ucounts; 1425 struct fanotify_mark *fan_mark; 1426 struct fsnotify_mark *mark; 1427 int ret; 1428 1429 /* 1430 * Enforce per user marks limits per user in all containing user ns. 1431 * A group with FAN_UNLIMITED_MARKS does not contribute to mark count 1432 * in the limited groups account. 1433 */ 1434 BUILD_BUG_ON(!(FANOTIFY_ADMIN_INIT_FLAGS & FAN_UNLIMITED_MARKS)); 1435 if (!FAN_GROUP_FLAG(group, FAN_UNLIMITED_MARKS) && 1436 !inc_ucount(ucounts->ns, ucounts->uid, UCOUNT_FANOTIFY_MARKS)) 1437 return ERR_PTR(-ENOSPC); 1438 1439 fan_mark = kmem_cache_alloc(fanotify_mark_cache, GFP_KERNEL); 1440 if (!fan_mark) { 1441 ret = -ENOMEM; 1442 goto out_dec_ucounts; 1443 } 1444 1445 mark = &fan_mark->fsn_mark; 1446 fsnotify_init_mark(mark, group); 1447 if (fan_flags & FAN_MARK_EVICTABLE) 1448 mark->flags |= FSNOTIFY_MARK_FLAG_NO_IREF; 1449 1450 /* Cache fsid of filesystem containing the marked object */ 1451 if (fsid) { 1452 ret = fanotify_set_mark_fsid(group, mark, fsid); 1453 if (ret) 1454 goto out_put_mark; 1455 } else { 1456 fan_mark->fsid.val[0] = fan_mark->fsid.val[1] = 0; 1457 } 1458 1459 ret = fsnotify_add_mark_locked(mark, obj, obj_type, 0); 1460 if (ret) 1461 goto out_put_mark; 1462 1463 return mark; 1464 1465 out_put_mark: 1466 fsnotify_put_mark(mark); 1467 out_dec_ucounts: 1468 if (!FAN_GROUP_FLAG(group, FAN_UNLIMITED_MARKS)) 1469 dec_ucount(ucounts, UCOUNT_FANOTIFY_MARKS); 1470 return ERR_PTR(ret); 1471 } 1472 1473 static int fanotify_group_init_error_pool(struct fsnotify_group *group) 1474 { 1475 if (mempool_initialized(&group->fanotify_data.error_events_pool)) 1476 return 0; 1477 1478 return mempool_init_kmalloc_pool(&group->fanotify_data.error_events_pool, 1479 FANOTIFY_DEFAULT_FEE_POOL_SIZE, 1480 sizeof(struct fanotify_error_event)); 1481 } 1482 1483 static int fanotify_may_update_existing_mark(struct fsnotify_mark *fsn_mark, 1484 __u32 mask, unsigned int fan_flags) 1485 { 1486 /* 1487 * Non evictable mark cannot be downgraded to evictable mark. 1488 */ 1489 if (fan_flags & FAN_MARK_EVICTABLE && 1490 !(fsn_mark->flags & FSNOTIFY_MARK_FLAG_NO_IREF)) 1491 return -EEXIST; 1492 1493 /* 1494 * New ignore mask semantics cannot be downgraded to old semantics. 1495 */ 1496 if (fan_flags & FAN_MARK_IGNORED_MASK && 1497 fsn_mark->flags & FSNOTIFY_MARK_FLAG_HAS_IGNORE_FLAGS) 1498 return -EEXIST; 1499 1500 /* 1501 * An ignore mask that survives modify could never be downgraded to not 1502 * survive modify. With new FAN_MARK_IGNORE semantics we make that rule 1503 * explicit and return an error when trying to update the ignore mask 1504 * without the original FAN_MARK_IGNORED_SURV_MODIFY value. 1505 */ 1506 if (fan_flags & FAN_MARK_IGNORE && 1507 !(fan_flags & FAN_MARK_IGNORED_SURV_MODIFY) && 1508 fsn_mark->flags & FSNOTIFY_MARK_FLAG_IGNORED_SURV_MODIFY) 1509 return -EEXIST; 1510 1511 /* For now pre-content events are not generated for directories */ 1512 mask |= fsn_mark->mask; 1513 if (mask & FANOTIFY_PRE_CONTENT_EVENTS && mask & FAN_ONDIR) 1514 return -EEXIST; 1515 1516 return 0; 1517 } 1518 1519 static int fanotify_add_mark(struct fsnotify_group *group, 1520 void *obj, unsigned int obj_type, 1521 __u32 mask, unsigned int fan_flags, 1522 struct fan_fsid *fsid) 1523 { 1524 struct fsnotify_mark *fsn_mark; 1525 bool recalc; 1526 int ret = 0; 1527 1528 fsnotify_group_lock(group); 1529 fsn_mark = fsnotify_find_mark(obj, obj_type, group); 1530 if (!fsn_mark) { 1531 fsn_mark = fanotify_add_new_mark(group, obj, obj_type, 1532 fan_flags, fsid); 1533 if (IS_ERR(fsn_mark)) { 1534 fsnotify_group_unlock(group); 1535 return PTR_ERR(fsn_mark); 1536 } 1537 } 1538 1539 /* 1540 * Check if requested mark flags conflict with an existing mark flags. 1541 */ 1542 ret = fanotify_may_update_existing_mark(fsn_mark, mask, fan_flags); 1543 if (ret) 1544 goto out; 1545 1546 /* 1547 * Error events are pre-allocated per group, only if strictly 1548 * needed (i.e. FAN_FS_ERROR was requested). 1549 */ 1550 if (!(fan_flags & FANOTIFY_MARK_IGNORE_BITS) && 1551 (mask & FAN_FS_ERROR)) { 1552 ret = fanotify_group_init_error_pool(group); 1553 if (ret) 1554 goto out; 1555 } 1556 1557 recalc = fanotify_mark_add_to_mask(fsn_mark, mask, fan_flags); 1558 if (recalc) 1559 fsnotify_recalc_mask(fsn_mark->connector); 1560 1561 out: 1562 fsnotify_group_unlock(group); 1563 1564 fsnotify_put_mark(fsn_mark); 1565 1566 if (!ret && (mask & FANOTIFY_PERM_EVENTS)) 1567 fanotify_perm_watchdog_group_add(group); 1568 1569 return ret; 1570 } 1571 1572 static struct fsnotify_event *fanotify_alloc_overflow_event(void) 1573 { 1574 struct fanotify_event *oevent; 1575 1576 oevent = kmalloc(sizeof(*oevent), GFP_KERNEL_ACCOUNT); 1577 if (!oevent) 1578 return NULL; 1579 1580 fanotify_init_event(oevent, 0, FS_Q_OVERFLOW); 1581 oevent->type = FANOTIFY_EVENT_TYPE_OVERFLOW; 1582 1583 return &oevent->fse; 1584 } 1585 1586 static struct hlist_head *fanotify_alloc_merge_hash(void) 1587 { 1588 struct hlist_head *hash; 1589 1590 hash = kmalloc(sizeof(struct hlist_head) << FANOTIFY_HTABLE_BITS, 1591 GFP_KERNEL_ACCOUNT); 1592 if (!hash) 1593 return NULL; 1594 1595 __hash_init(hash, FANOTIFY_HTABLE_SIZE); 1596 1597 return hash; 1598 } 1599 1600 /* fanotify syscalls */ 1601 SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags) 1602 { 1603 struct user_namespace *user_ns = current_user_ns(); 1604 struct fsnotify_group *group; 1605 int f_flags, fd; 1606 unsigned int fid_mode = flags & FANOTIFY_FID_BITS; 1607 unsigned int class = flags & FANOTIFY_CLASS_BITS; 1608 unsigned int internal_flags = 0; 1609 struct file *file; 1610 1611 pr_debug("%s: flags=%x event_f_flags=%x\n", 1612 __func__, flags, event_f_flags); 1613 1614 if (!capable(CAP_SYS_ADMIN)) { 1615 /* 1616 * An unprivileged user can setup an fanotify group with 1617 * limited functionality - an unprivileged group is limited to 1618 * notification events with file handles or mount ids and it 1619 * cannot use unlimited queue/marks. 1620 */ 1621 if ((flags & FANOTIFY_ADMIN_INIT_FLAGS) || 1622 !(flags & (FANOTIFY_FID_BITS | FAN_REPORT_MNT))) 1623 return -EPERM; 1624 1625 /* 1626 * Setting the internal flag FANOTIFY_UNPRIV on the group 1627 * prevents setting mount/filesystem marks on this group and 1628 * prevents reporting pid and open fd in events. 1629 */ 1630 internal_flags |= FANOTIFY_UNPRIV; 1631 } 1632 1633 #ifdef CONFIG_AUDITSYSCALL 1634 if (flags & ~(FANOTIFY_INIT_FLAGS | FAN_ENABLE_AUDIT)) 1635 #else 1636 if (flags & ~FANOTIFY_INIT_FLAGS) 1637 #endif 1638 return -EINVAL; 1639 1640 /* 1641 * A pidfd can only be returned for a thread-group leader; thus 1642 * FAN_REPORT_PIDFD and FAN_REPORT_TID need to remain mutually 1643 * exclusive. 1644 */ 1645 if ((flags & FAN_REPORT_PIDFD) && (flags & FAN_REPORT_TID)) 1646 return -EINVAL; 1647 1648 /* Don't allow mixing mnt events with inode events for now */ 1649 if (flags & FAN_REPORT_MNT) { 1650 if (class != FAN_CLASS_NOTIF) 1651 return -EINVAL; 1652 if (flags & (FANOTIFY_FID_BITS | FAN_REPORT_FD_ERROR)) 1653 return -EINVAL; 1654 } 1655 1656 if (event_f_flags & ~FANOTIFY_INIT_ALL_EVENT_F_BITS) 1657 return -EINVAL; 1658 1659 switch (event_f_flags & O_ACCMODE) { 1660 case O_RDONLY: 1661 case O_RDWR: 1662 case O_WRONLY: 1663 break; 1664 default: 1665 return -EINVAL; 1666 } 1667 1668 if (fid_mode && class != FAN_CLASS_NOTIF) 1669 return -EINVAL; 1670 1671 /* 1672 * Child name is reported with parent fid so requires dir fid. 1673 * We can report both child fid and dir fid with or without name. 1674 */ 1675 if ((fid_mode & FAN_REPORT_NAME) && !(fid_mode & FAN_REPORT_DIR_FID)) 1676 return -EINVAL; 1677 1678 /* 1679 * FAN_REPORT_TARGET_FID requires FAN_REPORT_NAME and FAN_REPORT_FID 1680 * and is used as an indication to report both dir and child fid on all 1681 * dirent events. 1682 */ 1683 if ((fid_mode & FAN_REPORT_TARGET_FID) && 1684 (!(fid_mode & FAN_REPORT_NAME) || !(fid_mode & FAN_REPORT_FID))) 1685 return -EINVAL; 1686 1687 f_flags = O_RDWR; 1688 if (flags & FAN_CLOEXEC) 1689 f_flags |= O_CLOEXEC; 1690 if (flags & FAN_NONBLOCK) 1691 f_flags |= O_NONBLOCK; 1692 1693 /* fsnotify_alloc_group takes a ref. Dropped in fanotify_release */ 1694 group = fsnotify_alloc_group(&fanotify_fsnotify_ops, 1695 FSNOTIFY_GROUP_USER); 1696 if (IS_ERR(group)) { 1697 return PTR_ERR(group); 1698 } 1699 1700 /* Enforce groups limits per user in all containing user ns */ 1701 group->fanotify_data.ucounts = inc_ucount(user_ns, current_euid(), 1702 UCOUNT_FANOTIFY_GROUPS); 1703 if (!group->fanotify_data.ucounts) { 1704 fd = -EMFILE; 1705 goto out_destroy_group; 1706 } 1707 1708 group->fanotify_data.flags = flags | internal_flags; 1709 group->memcg = get_mem_cgroup_from_mm(current->mm); 1710 group->user_ns = get_user_ns(user_ns); 1711 1712 group->fanotify_data.merge_hash = fanotify_alloc_merge_hash(); 1713 if (!group->fanotify_data.merge_hash) { 1714 fd = -ENOMEM; 1715 goto out_destroy_group; 1716 } 1717 1718 group->overflow_event = fanotify_alloc_overflow_event(); 1719 if (unlikely(!group->overflow_event)) { 1720 fd = -ENOMEM; 1721 goto out_destroy_group; 1722 } 1723 1724 if (force_o_largefile()) 1725 event_f_flags |= O_LARGEFILE; 1726 group->fanotify_data.f_flags = event_f_flags; 1727 init_waitqueue_head(&group->fanotify_data.access_waitq); 1728 INIT_LIST_HEAD(&group->fanotify_data.access_list); 1729 INIT_LIST_HEAD(&group->fanotify_data.perm_grp_list); 1730 switch (class) { 1731 case FAN_CLASS_NOTIF: 1732 group->priority = FSNOTIFY_PRIO_NORMAL; 1733 break; 1734 case FAN_CLASS_CONTENT: 1735 group->priority = FSNOTIFY_PRIO_CONTENT; 1736 break; 1737 case FAN_CLASS_PRE_CONTENT: 1738 group->priority = FSNOTIFY_PRIO_PRE_CONTENT; 1739 break; 1740 default: 1741 fd = -EINVAL; 1742 goto out_destroy_group; 1743 } 1744 1745 BUILD_BUG_ON(!(FANOTIFY_ADMIN_INIT_FLAGS & FAN_UNLIMITED_QUEUE)); 1746 if (flags & FAN_UNLIMITED_QUEUE) { 1747 group->max_events = UINT_MAX; 1748 } else { 1749 group->max_events = fanotify_max_queued_events; 1750 } 1751 1752 if (flags & FAN_ENABLE_AUDIT) { 1753 fd = -EPERM; 1754 if (!capable(CAP_AUDIT_WRITE)) 1755 goto out_destroy_group; 1756 } 1757 1758 fd = get_unused_fd_flags(f_flags); 1759 if (fd < 0) 1760 goto out_destroy_group; 1761 1762 file = anon_inode_getfile_fmode("[fanotify]", &fanotify_fops, group, 1763 f_flags, FMODE_NONOTIFY); 1764 if (IS_ERR(file)) { 1765 put_unused_fd(fd); 1766 fd = PTR_ERR(file); 1767 goto out_destroy_group; 1768 } 1769 fd_install(fd, file); 1770 return fd; 1771 1772 out_destroy_group: 1773 fsnotify_destroy_group(group); 1774 return fd; 1775 } 1776 1777 static int fanotify_test_fsid(struct dentry *dentry, unsigned int flags, 1778 struct fan_fsid *fsid) 1779 { 1780 unsigned int mark_type = flags & FANOTIFY_MARK_TYPE_BITS; 1781 __kernel_fsid_t root_fsid; 1782 int err; 1783 1784 /* 1785 * Make sure dentry is not of a filesystem with zero fsid (e.g. fuse). 1786 */ 1787 err = vfs_get_fsid(dentry, &fsid->id); 1788 if (err) 1789 return err; 1790 1791 fsid->sb = dentry->d_sb; 1792 if (!fsid->id.val[0] && !fsid->id.val[1]) { 1793 err = -ENODEV; 1794 goto weak; 1795 } 1796 1797 /* 1798 * Make sure dentry is not of a filesystem subvolume (e.g. btrfs) 1799 * which uses a different fsid than sb root. 1800 */ 1801 err = vfs_get_fsid(dentry->d_sb->s_root, &root_fsid); 1802 if (err) 1803 return err; 1804 1805 if (!fanotify_fsid_equal(&root_fsid, &fsid->id)) { 1806 err = -EXDEV; 1807 goto weak; 1808 } 1809 1810 fsid->weak = false; 1811 return 0; 1812 1813 weak: 1814 /* Allow weak fsid when marking inodes */ 1815 fsid->weak = true; 1816 return (mark_type == FAN_MARK_INODE) ? 0 : err; 1817 } 1818 1819 /* Check if filesystem can encode a unique fid */ 1820 static int fanotify_test_fid(struct dentry *dentry, unsigned int flags) 1821 { 1822 unsigned int mark_type = flags & FANOTIFY_MARK_TYPE_BITS; 1823 const struct export_operations *nop = dentry->d_sb->s_export_op; 1824 1825 /* 1826 * We need to make sure that the filesystem supports encoding of 1827 * file handles so user can use name_to_handle_at() to compare fids 1828 * reported with events to the file handle of watched objects. 1829 */ 1830 if (!exportfs_can_encode_fid(nop)) 1831 return -EOPNOTSUPP; 1832 1833 /* 1834 * For sb/mount mark, we also need to make sure that the filesystem 1835 * supports decoding file handles, so user has a way to map back the 1836 * reported fids to filesystem objects. 1837 */ 1838 if (mark_type != FAN_MARK_INODE && !exportfs_can_decode_fh(nop)) 1839 return -EOPNOTSUPP; 1840 1841 return 0; 1842 } 1843 1844 static int fanotify_events_supported(struct fsnotify_group *group, 1845 const struct path *path, __u64 mask, 1846 unsigned int flags) 1847 { 1848 unsigned int mark_type = flags & FANOTIFY_MARK_TYPE_BITS; 1849 bool is_dir = d_is_dir(path->dentry); 1850 /* Strict validation of events in non-dir inode mask with v5.17+ APIs */ 1851 bool strict_dir_events = FAN_GROUP_FLAG(group, FAN_REPORT_TARGET_FID) || 1852 (mask & FAN_RENAME) || 1853 (flags & FAN_MARK_IGNORE); 1854 1855 /* 1856 * Filesystems need to opt-into pre-content evnets (a.k.a HSM) 1857 * and they are only supported on regular files and directories. 1858 */ 1859 if (mask & FANOTIFY_PRE_CONTENT_EVENTS) { 1860 if (!(path->mnt->mnt_sb->s_iflags & SB_I_ALLOW_HSM)) 1861 return -EOPNOTSUPP; 1862 if (!is_dir && !d_is_reg(path->dentry)) 1863 return -EINVAL; 1864 } 1865 1866 /* 1867 * Some filesystems such as 'proc' acquire unusual locks when opening 1868 * files. For them fanotify permission events have high chances of 1869 * deadlocking the system - open done when reporting fanotify event 1870 * blocks on this "unusual" lock while another process holding the lock 1871 * waits for fanotify permission event to be answered. Just disallow 1872 * permission events for such filesystems. 1873 */ 1874 if (mask & FANOTIFY_PERM_EVENTS && 1875 path->mnt->mnt_sb->s_type->fs_flags & FS_DISALLOW_NOTIFY_PERM) 1876 return -EINVAL; 1877 1878 /* 1879 * mount and sb marks are not allowed on kernel internal pseudo fs, 1880 * like pipe_mnt, because that would subscribe to events on all the 1881 * anonynous pipes in the system. 1882 * 1883 * SB_NOUSER covers all of the internal pseudo fs whose objects are not 1884 * exposed to user's mount namespace, but there are other SB_KERNMOUNT 1885 * fs, like nsfs, debugfs, for which the value of allowing sb and mount 1886 * mark is questionable. For now we leave them alone. 1887 */ 1888 if (mark_type != FAN_MARK_INODE && 1889 path->mnt->mnt_sb->s_flags & SB_NOUSER) 1890 return -EINVAL; 1891 1892 /* 1893 * We shouldn't have allowed setting dirent events and the directory 1894 * flags FAN_ONDIR and FAN_EVENT_ON_CHILD in mask of non-dir inode, 1895 * but because we always allowed it, error only when using new APIs. 1896 */ 1897 if (strict_dir_events && mark_type == FAN_MARK_INODE && 1898 !is_dir && (mask & FANOTIFY_DIRONLY_EVENT_BITS)) 1899 return -ENOTDIR; 1900 1901 return 0; 1902 } 1903 1904 static int do_fanotify_mark(int fanotify_fd, unsigned int flags, __u64 mask, 1905 int dfd, const char __user *pathname) 1906 { 1907 struct inode *inode = NULL; 1908 struct fsnotify_group *group; 1909 struct path path; 1910 struct fan_fsid __fsid, *fsid = NULL; 1911 struct user_namespace *user_ns = NULL; 1912 struct mnt_namespace *mntns; 1913 u32 valid_mask = FANOTIFY_EVENTS | FANOTIFY_EVENT_FLAGS; 1914 unsigned int mark_type = flags & FANOTIFY_MARK_TYPE_BITS; 1915 unsigned int mark_cmd = flags & FANOTIFY_MARK_CMD_BITS; 1916 unsigned int ignore = flags & FANOTIFY_MARK_IGNORE_BITS; 1917 unsigned int obj_type, fid_mode; 1918 void *obj = NULL; 1919 u32 umask = 0; 1920 int ret; 1921 1922 pr_debug("%s: fanotify_fd=%d flags=%x dfd=%d pathname=%p mask=%llx\n", 1923 __func__, fanotify_fd, flags, dfd, pathname, mask); 1924 1925 /* we only use the lower 32 bits as of right now. */ 1926 if (upper_32_bits(mask)) 1927 return -EINVAL; 1928 1929 if (flags & ~FANOTIFY_MARK_FLAGS) 1930 return -EINVAL; 1931 1932 switch (mark_type) { 1933 case FAN_MARK_INODE: 1934 obj_type = FSNOTIFY_OBJ_TYPE_INODE; 1935 break; 1936 case FAN_MARK_MOUNT: 1937 obj_type = FSNOTIFY_OBJ_TYPE_VFSMOUNT; 1938 break; 1939 case FAN_MARK_FILESYSTEM: 1940 obj_type = FSNOTIFY_OBJ_TYPE_SB; 1941 break; 1942 case FAN_MARK_MNTNS: 1943 obj_type = FSNOTIFY_OBJ_TYPE_MNTNS; 1944 break; 1945 default: 1946 return -EINVAL; 1947 } 1948 1949 switch (mark_cmd) { 1950 case FAN_MARK_ADD: 1951 case FAN_MARK_REMOVE: 1952 if (!mask) 1953 return -EINVAL; 1954 break; 1955 case FAN_MARK_FLUSH: 1956 if (flags & ~(FANOTIFY_MARK_TYPE_BITS | FAN_MARK_FLUSH)) 1957 return -EINVAL; 1958 break; 1959 default: 1960 return -EINVAL; 1961 } 1962 1963 if (IS_ENABLED(CONFIG_FANOTIFY_ACCESS_PERMISSIONS)) 1964 valid_mask |= FANOTIFY_PERM_EVENTS; 1965 1966 if (mask & ~valid_mask) 1967 return -EINVAL; 1968 1969 1970 /* We don't allow FAN_MARK_IGNORE & FAN_MARK_IGNORED_MASK together */ 1971 if (ignore == (FAN_MARK_IGNORE | FAN_MARK_IGNORED_MASK)) 1972 return -EINVAL; 1973 1974 /* 1975 * Event flags (FAN_ONDIR, FAN_EVENT_ON_CHILD) have no effect with 1976 * FAN_MARK_IGNORED_MASK. 1977 */ 1978 if (ignore == FAN_MARK_IGNORED_MASK) { 1979 mask &= ~FANOTIFY_EVENT_FLAGS; 1980 umask = FANOTIFY_EVENT_FLAGS; 1981 } 1982 1983 CLASS(fd, f)(fanotify_fd); 1984 if (fd_empty(f)) 1985 return -EBADF; 1986 1987 /* verify that this is indeed an fanotify instance */ 1988 if (unlikely(fd_file(f)->f_op != &fanotify_fops)) 1989 return -EINVAL; 1990 group = fd_file(f)->private_data; 1991 1992 /* Only report mount events on mnt namespace */ 1993 if (FAN_GROUP_FLAG(group, FAN_REPORT_MNT)) { 1994 if (mask & ~FANOTIFY_MOUNT_EVENTS) 1995 return -EINVAL; 1996 if (mark_type != FAN_MARK_MNTNS) 1997 return -EINVAL; 1998 } else { 1999 if (mask & FANOTIFY_MOUNT_EVENTS) 2000 return -EINVAL; 2001 if (mark_type == FAN_MARK_MNTNS) 2002 return -EINVAL; 2003 } 2004 2005 /* 2006 * A user is allowed to setup sb/mount/mntns marks only if it is 2007 * capable in the user ns where the group was created. 2008 */ 2009 if (!ns_capable(group->user_ns, CAP_SYS_ADMIN) && 2010 mark_type != FAN_MARK_INODE) 2011 return -EPERM; 2012 2013 /* 2014 * Permission events are not allowed for FAN_CLASS_NOTIF. 2015 * Pre-content permission events are not allowed for FAN_CLASS_CONTENT. 2016 */ 2017 if (mask & FANOTIFY_PERM_EVENTS && 2018 group->priority == FSNOTIFY_PRIO_NORMAL) 2019 return -EINVAL; 2020 else if (mask & FANOTIFY_PRE_CONTENT_EVENTS && 2021 group->priority == FSNOTIFY_PRIO_CONTENT) 2022 return -EINVAL; 2023 2024 if (mask & FAN_FS_ERROR && 2025 mark_type != FAN_MARK_FILESYSTEM) 2026 return -EINVAL; 2027 2028 /* 2029 * Evictable is only relevant for inode marks, because only inode object 2030 * can be evicted on memory pressure. 2031 */ 2032 if (flags & FAN_MARK_EVICTABLE && 2033 mark_type != FAN_MARK_INODE) 2034 return -EINVAL; 2035 2036 /* 2037 * Events that do not carry enough information to report 2038 * event->fd require a group that supports reporting fid. Those 2039 * events are not supported on a mount mark, because they do not 2040 * carry enough information (i.e. path) to be filtered by mount 2041 * point. 2042 */ 2043 fid_mode = FAN_GROUP_FLAG(group, FANOTIFY_FID_BITS); 2044 if (mask & ~(FANOTIFY_FD_EVENTS|FANOTIFY_MOUNT_EVENTS|FANOTIFY_EVENT_FLAGS) && 2045 (!fid_mode || mark_type == FAN_MARK_MOUNT)) 2046 return -EINVAL; 2047 2048 /* 2049 * FAN_RENAME uses special info type records to report the old and 2050 * new parent+name. Reporting only old and new parent id is less 2051 * useful and was not implemented. 2052 */ 2053 if (mask & FAN_RENAME && !(fid_mode & FAN_REPORT_NAME)) 2054 return -EINVAL; 2055 2056 /* Pre-content events are not currently generated for directories. */ 2057 if (mask & FANOTIFY_PRE_CONTENT_EVENTS && mask & FAN_ONDIR) 2058 return -EINVAL; 2059 2060 if (mark_cmd == FAN_MARK_FLUSH) { 2061 fsnotify_clear_marks_by_group(group, obj_type); 2062 return 0; 2063 } 2064 2065 ret = fanotify_find_path(dfd, pathname, &path, flags, 2066 (mask & ALL_FSNOTIFY_EVENTS), obj_type); 2067 if (ret) 2068 return ret; 2069 2070 if (mark_cmd == FAN_MARK_ADD) { 2071 ret = fanotify_events_supported(group, &path, mask, flags); 2072 if (ret) 2073 goto path_put_and_out; 2074 } 2075 2076 if (fid_mode) { 2077 ret = fanotify_test_fsid(path.dentry, flags, &__fsid); 2078 if (ret) 2079 goto path_put_and_out; 2080 2081 ret = fanotify_test_fid(path.dentry, flags); 2082 if (ret) 2083 goto path_put_and_out; 2084 2085 fsid = &__fsid; 2086 } 2087 2088 /* 2089 * In addition to being capable in the user ns where group was created, 2090 * the user also needs to be capable in the user ns associated with 2091 * the filesystem or in the user ns associated with the mntns 2092 * (when marking mntns). 2093 */ 2094 if (obj_type == FSNOTIFY_OBJ_TYPE_INODE) { 2095 inode = path.dentry->d_inode; 2096 obj = inode; 2097 } else if (obj_type == FSNOTIFY_OBJ_TYPE_VFSMOUNT) { 2098 user_ns = path.mnt->mnt_sb->s_user_ns; 2099 obj = path.mnt; 2100 } else if (obj_type == FSNOTIFY_OBJ_TYPE_SB) { 2101 user_ns = path.mnt->mnt_sb->s_user_ns; 2102 obj = path.mnt->mnt_sb; 2103 } else if (obj_type == FSNOTIFY_OBJ_TYPE_MNTNS) { 2104 ret = -EINVAL; 2105 mntns = mnt_ns_from_dentry(path.dentry); 2106 if (!mntns) 2107 goto path_put_and_out; 2108 user_ns = mntns->user_ns; 2109 obj = mntns; 2110 } 2111 2112 ret = -EPERM; 2113 if (user_ns && !ns_capable(user_ns, CAP_SYS_ADMIN)) 2114 goto path_put_and_out; 2115 2116 ret = -EINVAL; 2117 if (!obj) 2118 goto path_put_and_out; 2119 2120 /* 2121 * If some other task has this inode open for write we should not add 2122 * an ignore mask, unless that ignore mask is supposed to survive 2123 * modification changes anyway. 2124 */ 2125 if (mark_cmd == FAN_MARK_ADD && (flags & FANOTIFY_MARK_IGNORE_BITS) && 2126 !(flags & FAN_MARK_IGNORED_SURV_MODIFY)) { 2127 ret = !inode ? -EINVAL : -EISDIR; 2128 /* FAN_MARK_IGNORE requires SURV_MODIFY for sb/mount/dir marks */ 2129 if (ignore == FAN_MARK_IGNORE && 2130 (!inode || S_ISDIR(inode->i_mode))) 2131 goto path_put_and_out; 2132 2133 ret = 0; 2134 if (inode && inode_is_open_for_write(inode)) 2135 goto path_put_and_out; 2136 } 2137 2138 /* Mask out FAN_EVENT_ON_CHILD flag for sb/mount/non-dir marks */ 2139 if (!inode || !S_ISDIR(inode->i_mode)) { 2140 mask &= ~FAN_EVENT_ON_CHILD; 2141 umask = FAN_EVENT_ON_CHILD; 2142 /* 2143 * If group needs to report parent fid, register for getting 2144 * events with parent/name info for non-directory. 2145 */ 2146 if ((fid_mode & FAN_REPORT_DIR_FID) && 2147 (flags & FAN_MARK_ADD) && !ignore) 2148 mask |= FAN_EVENT_ON_CHILD; 2149 } 2150 2151 /* create/update an inode mark */ 2152 switch (mark_cmd) { 2153 case FAN_MARK_ADD: 2154 ret = fanotify_add_mark(group, obj, obj_type, mask, flags, 2155 fsid); 2156 break; 2157 case FAN_MARK_REMOVE: 2158 ret = fanotify_remove_mark(group, obj, obj_type, mask, flags, 2159 umask); 2160 break; 2161 default: 2162 ret = -EINVAL; 2163 } 2164 2165 path_put_and_out: 2166 path_put(&path); 2167 return ret; 2168 } 2169 2170 #ifndef CONFIG_ARCH_SPLIT_ARG64 2171 SYSCALL_DEFINE5(fanotify_mark, int, fanotify_fd, unsigned int, flags, 2172 __u64, mask, int, dfd, 2173 const char __user *, pathname) 2174 { 2175 return do_fanotify_mark(fanotify_fd, flags, mask, dfd, pathname); 2176 } 2177 #endif 2178 2179 #if defined(CONFIG_ARCH_SPLIT_ARG64) || defined(CONFIG_COMPAT) 2180 SYSCALL32_DEFINE6(fanotify_mark, 2181 int, fanotify_fd, unsigned int, flags, 2182 SC_ARG64(mask), int, dfd, 2183 const char __user *, pathname) 2184 { 2185 return do_fanotify_mark(fanotify_fd, flags, SC_VAL64(__u64, mask), 2186 dfd, pathname); 2187 } 2188 #endif 2189 2190 /* 2191 * fanotify_user_setup - Our initialization function. Note that we cannot return 2192 * error because we have compiled-in VFS hooks. So an (unlikely) failure here 2193 * must result in panic(). 2194 */ 2195 static int __init fanotify_user_setup(void) 2196 { 2197 struct sysinfo si; 2198 int max_marks; 2199 2200 si_meminfo(&si); 2201 /* 2202 * Allow up to 1% of addressable memory to be accounted for per user 2203 * marks limited to the range [8192, 1048576]. mount and sb marks are 2204 * a lot cheaper than inode marks, but there is no reason for a user 2205 * to have many of those, so calculate by the cost of inode marks. 2206 */ 2207 max_marks = (((si.totalram - si.totalhigh) / 100) << PAGE_SHIFT) / 2208 INODE_MARK_COST; 2209 max_marks = clamp(max_marks, FANOTIFY_OLD_DEFAULT_MAX_MARKS, 2210 FANOTIFY_DEFAULT_MAX_USER_MARKS); 2211 2212 BUILD_BUG_ON(FANOTIFY_INIT_FLAGS & FANOTIFY_INTERNAL_GROUP_FLAGS); 2213 BUILD_BUG_ON(HWEIGHT32(FANOTIFY_INIT_FLAGS) != 14); 2214 BUILD_BUG_ON(HWEIGHT32(FANOTIFY_MARK_FLAGS) != 11); 2215 2216 fanotify_mark_cache = KMEM_CACHE(fanotify_mark, 2217 SLAB_PANIC|SLAB_ACCOUNT); 2218 fanotify_fid_event_cachep = KMEM_CACHE(fanotify_fid_event, 2219 SLAB_PANIC); 2220 fanotify_path_event_cachep = KMEM_CACHE(fanotify_path_event, 2221 SLAB_PANIC); 2222 if (IS_ENABLED(CONFIG_FANOTIFY_ACCESS_PERMISSIONS)) { 2223 fanotify_perm_event_cachep = 2224 KMEM_CACHE(fanotify_perm_event, SLAB_PANIC); 2225 } 2226 fanotify_mnt_event_cachep = KMEM_CACHE(fanotify_mnt_event, SLAB_PANIC); 2227 2228 fanotify_max_queued_events = FANOTIFY_DEFAULT_MAX_EVENTS; 2229 init_user_ns.ucount_max[UCOUNT_FANOTIFY_GROUPS] = 2230 FANOTIFY_DEFAULT_MAX_GROUPS; 2231 init_user_ns.ucount_max[UCOUNT_FANOTIFY_MARKS] = max_marks; 2232 fanotify_sysctls_init(); 2233 2234 return 0; 2235 } 2236 device_initcall(fanotify_user_setup); 2237