1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * linux/fs/open.c 4 * 5 * Copyright (C) 1991, 1992 Linus Torvalds 6 */ 7 8 #include <linux/string.h> 9 #include <linux/mm.h> 10 #include <linux/file.h> 11 #include <linux/fdtable.h> 12 #include <linux/fsnotify.h> 13 #include <linux/module.h> 14 #include <linux/tty.h> 15 #include <linux/namei.h> 16 #include <linux/backing-dev.h> 17 #include <linux/capability.h> 18 #include <linux/securebits.h> 19 #include <linux/security.h> 20 #include <linux/mount.h> 21 #include <linux/fcntl.h> 22 #include <linux/slab.h> 23 #include <linux/uaccess.h> 24 #include <linux/fs.h> 25 #include <linux/personality.h> 26 #include <linux/pagemap.h> 27 #include <linux/syscalls.h> 28 #include <linux/rcupdate.h> 29 #include <linux/audit.h> 30 #include <linux/falloc.h> 31 #include <linux/fs_struct.h> 32 #include <linux/dnotify.h> 33 #include <linux/compat.h> 34 #include <linux/mnt_idmapping.h> 35 #include <linux/filelock.h> 36 37 #include "internal.h" 38 39 int do_truncate(struct mnt_idmap *idmap, struct dentry *dentry, 40 loff_t length, unsigned int time_attrs, struct file *filp) 41 { 42 int ret; 43 struct iattr newattrs; 44 45 /* Not pretty: "inode->i_size" shouldn't really be signed. But it is. */ 46 if (length < 0) 47 return -EINVAL; 48 49 newattrs.ia_size = length; 50 newattrs.ia_valid = ATTR_SIZE | time_attrs; 51 if (filp) { 52 newattrs.ia_file = filp; 53 newattrs.ia_valid |= ATTR_FILE; 54 } 55 56 /* Remove suid, sgid, and file capabilities on truncate too */ 57 ret = dentry_needs_remove_privs(idmap, dentry); 58 if (ret < 0) 59 return ret; 60 if (ret) 61 newattrs.ia_valid |= ret | ATTR_FORCE; 62 63 ret = inode_lock_killable(dentry->d_inode); 64 if (ret) 65 return ret; 66 67 /* Note any delegations or leases have already been broken: */ 68 ret = notify_change(idmap, dentry, &newattrs, NULL); 69 inode_unlock(dentry->d_inode); 70 return ret; 71 } 72 73 int vfs_truncate(const struct path *path, loff_t length) 74 { 75 struct mnt_idmap *idmap; 76 struct inode *inode; 77 int error; 78 79 inode = path->dentry->d_inode; 80 81 /* For directories it's -EISDIR, for other non-regulars - -EINVAL */ 82 if (S_ISDIR(inode->i_mode)) 83 return -EISDIR; 84 if (!S_ISREG(inode->i_mode)) 85 return -EINVAL; 86 87 idmap = mnt_idmap(path->mnt); 88 error = inode_permission(idmap, inode, MAY_WRITE); 89 if (error) 90 return error; 91 92 error = fsnotify_truncate_perm(path, length); 93 if (error) 94 return error; 95 96 error = mnt_want_write(path->mnt); 97 if (error) 98 return error; 99 100 error = -EPERM; 101 if (IS_APPEND(inode)) 102 goto mnt_drop_write_and_out; 103 104 error = get_write_access(inode); 105 if (error) 106 goto mnt_drop_write_and_out; 107 108 /* 109 * Make sure that there are no leases. get_write_access() protects 110 * against the truncate racing with a lease-granting setlease(). 111 */ 112 error = break_lease(inode, O_WRONLY); 113 if (error) 114 goto put_write_and_out; 115 116 error = security_path_truncate(path); 117 if (!error) 118 error = do_truncate(idmap, path->dentry, length, 0, NULL); 119 120 put_write_and_out: 121 put_write_access(inode); 122 mnt_drop_write_and_out: 123 mnt_drop_write(path->mnt); 124 125 return error; 126 } 127 EXPORT_SYMBOL_GPL(vfs_truncate); 128 129 int do_sys_truncate(const char __user *pathname, loff_t length) 130 { 131 unsigned int lookup_flags = LOOKUP_FOLLOW; 132 struct path path; 133 int error; 134 135 if (length < 0) /* sorry, but loff_t says... */ 136 return -EINVAL; 137 138 retry: 139 error = user_path_at(AT_FDCWD, pathname, lookup_flags, &path); 140 if (!error) { 141 error = vfs_truncate(&path, length); 142 path_put(&path); 143 } 144 if (retry_estale(error, lookup_flags)) { 145 lookup_flags |= LOOKUP_REVAL; 146 goto retry; 147 } 148 return error; 149 } 150 151 SYSCALL_DEFINE2(truncate, const char __user *, path, long, length) 152 { 153 return do_sys_truncate(path, length); 154 } 155 156 #ifdef CONFIG_COMPAT 157 COMPAT_SYSCALL_DEFINE2(truncate, const char __user *, path, compat_off_t, length) 158 { 159 return do_sys_truncate(path, length); 160 } 161 #endif 162 163 int do_ftruncate(struct file *file, loff_t length, int small) 164 { 165 struct inode *inode; 166 struct dentry *dentry; 167 int error; 168 169 /* explicitly opened as large or we are on 64-bit box */ 170 if (file->f_flags & O_LARGEFILE) 171 small = 0; 172 173 dentry = file->f_path.dentry; 174 inode = dentry->d_inode; 175 if (!S_ISREG(inode->i_mode) || !(file->f_mode & FMODE_WRITE)) 176 return -EINVAL; 177 178 /* Cannot ftruncate over 2^31 bytes without large file support */ 179 if (small && length > MAX_NON_LFS) 180 return -EINVAL; 181 182 /* Check IS_APPEND on real upper inode */ 183 if (IS_APPEND(file_inode(file))) 184 return -EPERM; 185 186 error = security_file_truncate(file); 187 if (error) 188 return error; 189 190 error = fsnotify_truncate_perm(&file->f_path, length); 191 if (error) 192 return error; 193 194 scoped_guard(super_write, inode->i_sb) 195 return do_truncate(file_mnt_idmap(file), dentry, length, 196 ATTR_MTIME | ATTR_CTIME, file); 197 } 198 199 int do_sys_ftruncate(unsigned int fd, loff_t length, int small) 200 { 201 if (length < 0) 202 return -EINVAL; 203 CLASS(fd, f)(fd); 204 if (fd_empty(f)) 205 return -EBADF; 206 207 return do_ftruncate(fd_file(f), length, small); 208 } 209 210 SYSCALL_DEFINE2(ftruncate, unsigned int, fd, off_t, length) 211 { 212 return do_sys_ftruncate(fd, length, 1); 213 } 214 215 #ifdef CONFIG_COMPAT 216 COMPAT_SYSCALL_DEFINE2(ftruncate, unsigned int, fd, compat_off_t, length) 217 { 218 return do_sys_ftruncate(fd, length, 1); 219 } 220 #endif 221 222 /* LFS versions of truncate are only needed on 32 bit machines */ 223 #if BITS_PER_LONG == 32 224 SYSCALL_DEFINE2(truncate64, const char __user *, path, loff_t, length) 225 { 226 return do_sys_truncate(path, length); 227 } 228 229 SYSCALL_DEFINE2(ftruncate64, unsigned int, fd, loff_t, length) 230 { 231 return do_sys_ftruncate(fd, length, 0); 232 } 233 #endif /* BITS_PER_LONG == 32 */ 234 235 #if defined(CONFIG_COMPAT) && defined(__ARCH_WANT_COMPAT_TRUNCATE64) 236 COMPAT_SYSCALL_DEFINE3(truncate64, const char __user *, pathname, 237 compat_arg_u64_dual(length)) 238 { 239 return ksys_truncate(pathname, compat_arg_u64_glue(length)); 240 } 241 #endif 242 243 #if defined(CONFIG_COMPAT) && defined(__ARCH_WANT_COMPAT_FTRUNCATE64) 244 COMPAT_SYSCALL_DEFINE3(ftruncate64, unsigned int, fd, 245 compat_arg_u64_dual(length)) 246 { 247 return ksys_ftruncate(fd, compat_arg_u64_glue(length)); 248 } 249 #endif 250 251 int vfs_fallocate(struct file *file, int mode, loff_t offset, loff_t len) 252 { 253 struct inode *inode = file_inode(file); 254 int ret; 255 loff_t sum; 256 257 if (offset < 0 || len <= 0) 258 return -EINVAL; 259 260 if (mode & ~(FALLOC_FL_MODE_MASK | FALLOC_FL_KEEP_SIZE)) 261 return -EOPNOTSUPP; 262 263 /* 264 * Modes are exclusive, even if that is not obvious from the encoding 265 * as bit masks and the mix with the flag in the same namespace. 266 * 267 * To make things even more complicated, FALLOC_FL_ALLOCATE_RANGE is 268 * encoded as no bit set. 269 */ 270 switch (mode & FALLOC_FL_MODE_MASK) { 271 case FALLOC_FL_ALLOCATE_RANGE: 272 case FALLOC_FL_UNSHARE_RANGE: 273 case FALLOC_FL_ZERO_RANGE: 274 break; 275 case FALLOC_FL_PUNCH_HOLE: 276 if (!(mode & FALLOC_FL_KEEP_SIZE)) 277 return -EOPNOTSUPP; 278 break; 279 case FALLOC_FL_COLLAPSE_RANGE: 280 case FALLOC_FL_INSERT_RANGE: 281 case FALLOC_FL_WRITE_ZEROES: 282 if (mode & FALLOC_FL_KEEP_SIZE) 283 return -EOPNOTSUPP; 284 break; 285 default: 286 return -EOPNOTSUPP; 287 } 288 289 if (!(file->f_mode & FMODE_WRITE)) 290 return -EBADF; 291 292 /* 293 * On append-only files only space preallocation is supported. 294 */ 295 if ((mode & ~FALLOC_FL_KEEP_SIZE) && IS_APPEND(inode)) 296 return -EPERM; 297 298 if (IS_IMMUTABLE(inode)) 299 return -EPERM; 300 301 /* 302 * We cannot allow any fallocate operation on an active swapfile 303 */ 304 if (IS_SWAPFILE(inode)) 305 return -ETXTBSY; 306 307 /* 308 * Revalidate the write permissions, in case security policy has 309 * changed since the files were opened. 310 */ 311 ret = security_file_permission(file, MAY_WRITE); 312 if (ret) 313 return ret; 314 315 ret = fsnotify_file_area_perm(file, MAY_WRITE, &offset, len); 316 if (ret) 317 return ret; 318 319 if (S_ISFIFO(inode->i_mode)) 320 return -ESPIPE; 321 322 if (S_ISDIR(inode->i_mode)) 323 return -EISDIR; 324 325 if (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode)) 326 return -ENODEV; 327 328 /* Check for wraparound */ 329 if (check_add_overflow(offset, len, &sum)) 330 return -EFBIG; 331 332 if (sum > inode->i_sb->s_maxbytes) 333 return -EFBIG; 334 335 if (!file->f_op->fallocate) 336 return -EOPNOTSUPP; 337 338 file_start_write(file); 339 ret = file->f_op->fallocate(file, mode, offset, len); 340 341 /* 342 * Create inotify and fanotify events. 343 * 344 * To keep the logic simple always create events if fallocate succeeds. 345 * This implies that events are even created if the file size remains 346 * unchanged, e.g. when using flag FALLOC_FL_KEEP_SIZE. 347 */ 348 if (ret == 0) 349 fsnotify_modify(file); 350 351 file_end_write(file); 352 return ret; 353 } 354 EXPORT_SYMBOL_GPL(vfs_fallocate); 355 356 int ksys_fallocate(int fd, int mode, loff_t offset, loff_t len) 357 { 358 CLASS(fd, f)(fd); 359 360 if (fd_empty(f)) 361 return -EBADF; 362 363 return vfs_fallocate(fd_file(f), mode, offset, len); 364 } 365 366 SYSCALL_DEFINE4(fallocate, int, fd, int, mode, loff_t, offset, loff_t, len) 367 { 368 return ksys_fallocate(fd, mode, offset, len); 369 } 370 371 #if defined(CONFIG_COMPAT) && defined(__ARCH_WANT_COMPAT_FALLOCATE) 372 COMPAT_SYSCALL_DEFINE6(fallocate, int, fd, int, mode, compat_arg_u64_dual(offset), 373 compat_arg_u64_dual(len)) 374 { 375 return ksys_fallocate(fd, mode, compat_arg_u64_glue(offset), 376 compat_arg_u64_glue(len)); 377 } 378 #endif 379 380 /* 381 * access() needs to use the real uid/gid, not the effective uid/gid. 382 * We do this by temporarily clearing all FS-related capabilities and 383 * switching the fsuid/fsgid around to the real ones. 384 * 385 * Creating new credentials is expensive, so we try to skip doing it, 386 * which we can if the result would match what we already got. 387 */ 388 static bool access_need_override_creds(int flags) 389 { 390 const struct cred *cred; 391 392 if (flags & AT_EACCESS) 393 return false; 394 395 cred = current_cred(); 396 if (!uid_eq(cred->fsuid, cred->uid) || 397 !gid_eq(cred->fsgid, cred->gid)) 398 return true; 399 400 if (!issecure(SECURE_NO_SETUID_FIXUP)) { 401 kuid_t root_uid = make_kuid(cred->user_ns, 0); 402 if (!uid_eq(cred->uid, root_uid)) { 403 if (!cap_isclear(cred->cap_effective)) 404 return true; 405 } else { 406 if (!cap_isidentical(cred->cap_effective, 407 cred->cap_permitted)) 408 return true; 409 } 410 } 411 412 return false; 413 } 414 415 static const struct cred *access_override_creds(void) 416 { 417 struct cred *override_cred; 418 419 override_cred = prepare_creds(); 420 if (!override_cred) 421 return NULL; 422 423 /* 424 * XXX access_need_override_creds performs checks in hopes of skipping 425 * this work. Make sure it stays in sync if making any changes in this 426 * routine. 427 */ 428 429 override_cred->fsuid = override_cred->uid; 430 override_cred->fsgid = override_cred->gid; 431 432 if (!issecure(SECURE_NO_SETUID_FIXUP)) { 433 /* Clear the capabilities if we switch to a non-root user */ 434 kuid_t root_uid = make_kuid(override_cred->user_ns, 0); 435 if (!uid_eq(override_cred->uid, root_uid)) 436 cap_clear(override_cred->cap_effective); 437 else 438 override_cred->cap_effective = 439 override_cred->cap_permitted; 440 } 441 442 /* 443 * The new set of credentials can *only* be used in 444 * task-synchronous circumstances, and does not need 445 * RCU freeing, unless somebody then takes a separate 446 * reference to it. 447 * 448 * NOTE! This is _only_ true because this credential 449 * is used purely for override_creds() that installs 450 * it as the subjective cred. Other threads will be 451 * accessing ->real_cred, not the subjective cred. 452 * 453 * If somebody _does_ make a copy of this (using the 454 * 'get_current_cred()' function), that will clear the 455 * non_rcu field, because now that other user may be 456 * expecting RCU freeing. But normal thread-synchronous 457 * cred accesses will keep things non-racy to avoid RCU 458 * freeing. 459 */ 460 override_cred->non_rcu = 1; 461 return override_creds(override_cred); 462 } 463 464 static int do_faccessat(int dfd, const char __user *filename, int mode, int flags) 465 { 466 struct path path; 467 struct inode *inode; 468 int res; 469 unsigned int lookup_flags = LOOKUP_FOLLOW; 470 const struct cred *old_cred = NULL; 471 472 if (mode & ~S_IRWXO) /* where's F_OK, X_OK, W_OK, R_OK? */ 473 return -EINVAL; 474 475 if (flags & ~(AT_EACCESS | AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH)) 476 return -EINVAL; 477 478 if (flags & AT_SYMLINK_NOFOLLOW) 479 lookup_flags &= ~LOOKUP_FOLLOW; 480 if (flags & AT_EMPTY_PATH) 481 lookup_flags |= LOOKUP_EMPTY; 482 483 if (access_need_override_creds(flags)) { 484 old_cred = access_override_creds(); 485 if (!old_cred) 486 return -ENOMEM; 487 } 488 489 retry: 490 res = user_path_at(dfd, filename, lookup_flags, &path); 491 if (res) 492 goto out; 493 494 inode = d_backing_inode(path.dentry); 495 496 if ((mode & MAY_EXEC) && S_ISREG(inode->i_mode)) { 497 /* 498 * MAY_EXEC on regular files is denied if the fs is mounted 499 * with the "noexec" flag. 500 */ 501 res = -EACCES; 502 if (path_noexec(&path)) 503 goto out_path_release; 504 } 505 506 res = inode_permission(mnt_idmap(path.mnt), inode, mode | MAY_ACCESS); 507 /* SuS v2 requires we report a read only fs too */ 508 if (res || !(mode & S_IWOTH) || special_file(inode->i_mode)) 509 goto out_path_release; 510 /* 511 * This is a rare case where using __mnt_is_readonly() 512 * is OK without a mnt_want/drop_write() pair. Since 513 * no actual write to the fs is performed here, we do 514 * not need to telegraph to that to anyone. 515 * 516 * By doing this, we accept that this access is 517 * inherently racy and know that the fs may change 518 * state before we even see this result. 519 */ 520 if (__mnt_is_readonly(path.mnt)) 521 res = -EROFS; 522 523 out_path_release: 524 path_put(&path); 525 if (retry_estale(res, lookup_flags)) { 526 lookup_flags |= LOOKUP_REVAL; 527 goto retry; 528 } 529 out: 530 if (old_cred) 531 put_cred(revert_creds(old_cred)); 532 533 return res; 534 } 535 536 SYSCALL_DEFINE3(faccessat, int, dfd, const char __user *, filename, int, mode) 537 { 538 return do_faccessat(dfd, filename, mode, 0); 539 } 540 541 SYSCALL_DEFINE4(faccessat2, int, dfd, const char __user *, filename, int, mode, 542 int, flags) 543 { 544 return do_faccessat(dfd, filename, mode, flags); 545 } 546 547 SYSCALL_DEFINE2(access, const char __user *, filename, int, mode) 548 { 549 return do_faccessat(AT_FDCWD, filename, mode, 0); 550 } 551 552 SYSCALL_DEFINE1(chdir, const char __user *, filename) 553 { 554 struct path path; 555 int error; 556 unsigned int lookup_flags = LOOKUP_FOLLOW | LOOKUP_DIRECTORY; 557 retry: 558 error = user_path_at(AT_FDCWD, filename, lookup_flags, &path); 559 if (error) 560 goto out; 561 562 error = path_permission(&path, MAY_EXEC | MAY_CHDIR); 563 if (error) 564 goto dput_and_out; 565 566 set_fs_pwd(current->fs, &path); 567 568 dput_and_out: 569 path_put(&path); 570 if (retry_estale(error, lookup_flags)) { 571 lookup_flags |= LOOKUP_REVAL; 572 goto retry; 573 } 574 out: 575 return error; 576 } 577 578 SYSCALL_DEFINE1(fchdir, unsigned int, fd) 579 { 580 CLASS(fd_raw, f)(fd); 581 int error; 582 583 if (fd_empty(f)) 584 return -EBADF; 585 586 if (!d_can_lookup(fd_file(f)->f_path.dentry)) 587 return -ENOTDIR; 588 589 error = file_permission(fd_file(f), MAY_EXEC | MAY_CHDIR); 590 if (!error) 591 set_fs_pwd(current->fs, &fd_file(f)->f_path); 592 return error; 593 } 594 595 SYSCALL_DEFINE1(chroot, const char __user *, filename) 596 { 597 struct path path; 598 int error; 599 unsigned int lookup_flags = LOOKUP_FOLLOW | LOOKUP_DIRECTORY; 600 retry: 601 error = user_path_at(AT_FDCWD, filename, lookup_flags, &path); 602 if (error) 603 goto out; 604 605 error = path_permission(&path, MAY_EXEC | MAY_CHDIR); 606 if (error) 607 goto dput_and_out; 608 609 error = -EPERM; 610 if (!ns_capable(current_user_ns(), CAP_SYS_CHROOT)) 611 goto dput_and_out; 612 error = security_path_chroot(&path); 613 if (error) 614 goto dput_and_out; 615 616 set_fs_root(current->fs, &path); 617 error = 0; 618 dput_and_out: 619 path_put(&path); 620 if (retry_estale(error, lookup_flags)) { 621 lookup_flags |= LOOKUP_REVAL; 622 goto retry; 623 } 624 out: 625 return error; 626 } 627 628 int chmod_common(const struct path *path, umode_t mode) 629 { 630 struct inode *inode = path->dentry->d_inode; 631 struct delegated_inode delegated_inode = { }; 632 struct iattr newattrs; 633 int error; 634 635 error = mnt_want_write(path->mnt); 636 if (error) 637 return error; 638 retry_deleg: 639 error = inode_lock_killable(inode); 640 if (error) 641 goto out_mnt_unlock; 642 error = security_path_chmod(path, mode); 643 if (error) 644 goto out_unlock; 645 newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO); 646 newattrs.ia_valid = ATTR_MODE | ATTR_CTIME; 647 error = notify_change(mnt_idmap(path->mnt), path->dentry, 648 &newattrs, &delegated_inode); 649 out_unlock: 650 inode_unlock(inode); 651 if (is_delegated(&delegated_inode)) { 652 error = break_deleg_wait(&delegated_inode); 653 if (!error) 654 goto retry_deleg; 655 } 656 out_mnt_unlock: 657 mnt_drop_write(path->mnt); 658 return error; 659 } 660 661 int vfs_fchmod(struct file *file, umode_t mode) 662 { 663 audit_file(file); 664 return chmod_common(&file->f_path, mode); 665 } 666 667 SYSCALL_DEFINE2(fchmod, unsigned int, fd, umode_t, mode) 668 { 669 CLASS(fd, f)(fd); 670 671 if (fd_empty(f)) 672 return -EBADF; 673 674 return vfs_fchmod(fd_file(f), mode); 675 } 676 677 static int do_fchmodat(int dfd, const char __user *filename, umode_t mode, 678 unsigned int flags) 679 { 680 struct path path; 681 int error; 682 unsigned int lookup_flags; 683 684 if (unlikely(flags & ~(AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH))) 685 return -EINVAL; 686 687 lookup_flags = (flags & AT_SYMLINK_NOFOLLOW) ? 0 : LOOKUP_FOLLOW; 688 if (flags & AT_EMPTY_PATH) 689 lookup_flags |= LOOKUP_EMPTY; 690 691 retry: 692 error = user_path_at(dfd, filename, lookup_flags, &path); 693 if (!error) { 694 error = chmod_common(&path, mode); 695 path_put(&path); 696 if (retry_estale(error, lookup_flags)) { 697 lookup_flags |= LOOKUP_REVAL; 698 goto retry; 699 } 700 } 701 return error; 702 } 703 704 SYSCALL_DEFINE4(fchmodat2, int, dfd, const char __user *, filename, 705 umode_t, mode, unsigned int, flags) 706 { 707 return do_fchmodat(dfd, filename, mode, flags); 708 } 709 710 SYSCALL_DEFINE3(fchmodat, int, dfd, const char __user *, filename, 711 umode_t, mode) 712 { 713 return do_fchmodat(dfd, filename, mode, 0); 714 } 715 716 SYSCALL_DEFINE2(chmod, const char __user *, filename, umode_t, mode) 717 { 718 return do_fchmodat(AT_FDCWD, filename, mode, 0); 719 } 720 721 /* 722 * Check whether @kuid is valid and if so generate and set vfsuid_t in 723 * ia_vfsuid. 724 * 725 * Return: true if @kuid is valid, false if not. 726 */ 727 static inline bool setattr_vfsuid(struct iattr *attr, kuid_t kuid) 728 { 729 if (!uid_valid(kuid)) 730 return false; 731 attr->ia_valid |= ATTR_UID; 732 attr->ia_vfsuid = VFSUIDT_INIT(kuid); 733 return true; 734 } 735 736 /* 737 * Check whether @kgid is valid and if so generate and set vfsgid_t in 738 * ia_vfsgid. 739 * 740 * Return: true if @kgid is valid, false if not. 741 */ 742 static inline bool setattr_vfsgid(struct iattr *attr, kgid_t kgid) 743 { 744 if (!gid_valid(kgid)) 745 return false; 746 attr->ia_valid |= ATTR_GID; 747 attr->ia_vfsgid = VFSGIDT_INIT(kgid); 748 return true; 749 } 750 751 int chown_common(const struct path *path, uid_t user, gid_t group) 752 { 753 struct mnt_idmap *idmap; 754 struct user_namespace *fs_userns; 755 struct inode *inode = path->dentry->d_inode; 756 struct delegated_inode delegated_inode = { }; 757 int error; 758 struct iattr newattrs; 759 kuid_t uid; 760 kgid_t gid; 761 762 uid = make_kuid(current_user_ns(), user); 763 gid = make_kgid(current_user_ns(), group); 764 765 idmap = mnt_idmap(path->mnt); 766 fs_userns = i_user_ns(inode); 767 768 retry_deleg: 769 newattrs.ia_vfsuid = INVALID_VFSUID; 770 newattrs.ia_vfsgid = INVALID_VFSGID; 771 newattrs.ia_valid = ATTR_CTIME; 772 if ((user != (uid_t)-1) && !setattr_vfsuid(&newattrs, uid)) 773 return -EINVAL; 774 if ((group != (gid_t)-1) && !setattr_vfsgid(&newattrs, gid)) 775 return -EINVAL; 776 error = inode_lock_killable(inode); 777 if (error) 778 return error; 779 if (!S_ISDIR(inode->i_mode)) 780 newattrs.ia_valid |= ATTR_KILL_SUID | ATTR_KILL_PRIV | 781 setattr_should_drop_sgid(idmap, inode); 782 /* Continue to send actual fs values, not the mount values. */ 783 error = security_path_chown( 784 path, 785 from_vfsuid(idmap, fs_userns, newattrs.ia_vfsuid), 786 from_vfsgid(idmap, fs_userns, newattrs.ia_vfsgid)); 787 if (!error) 788 error = notify_change(idmap, path->dentry, &newattrs, 789 &delegated_inode); 790 inode_unlock(inode); 791 if (is_delegated(&delegated_inode)) { 792 error = break_deleg_wait(&delegated_inode); 793 if (!error) 794 goto retry_deleg; 795 } 796 return error; 797 } 798 799 int do_fchownat(int dfd, const char __user *filename, uid_t user, gid_t group, 800 int flag) 801 { 802 struct path path; 803 int error = -EINVAL; 804 int lookup_flags; 805 806 if ((flag & ~(AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH)) != 0) 807 goto out; 808 809 lookup_flags = (flag & AT_SYMLINK_NOFOLLOW) ? 0 : LOOKUP_FOLLOW; 810 if (flag & AT_EMPTY_PATH) 811 lookup_flags |= LOOKUP_EMPTY; 812 retry: 813 error = user_path_at(dfd, filename, lookup_flags, &path); 814 if (error) 815 goto out; 816 error = mnt_want_write(path.mnt); 817 if (error) 818 goto out_release; 819 error = chown_common(&path, user, group); 820 mnt_drop_write(path.mnt); 821 out_release: 822 path_put(&path); 823 if (retry_estale(error, lookup_flags)) { 824 lookup_flags |= LOOKUP_REVAL; 825 goto retry; 826 } 827 out: 828 return error; 829 } 830 831 SYSCALL_DEFINE5(fchownat, int, dfd, const char __user *, filename, uid_t, user, 832 gid_t, group, int, flag) 833 { 834 return do_fchownat(dfd, filename, user, group, flag); 835 } 836 837 SYSCALL_DEFINE3(chown, const char __user *, filename, uid_t, user, gid_t, group) 838 { 839 return do_fchownat(AT_FDCWD, filename, user, group, 0); 840 } 841 842 SYSCALL_DEFINE3(lchown, const char __user *, filename, uid_t, user, gid_t, group) 843 { 844 return do_fchownat(AT_FDCWD, filename, user, group, 845 AT_SYMLINK_NOFOLLOW); 846 } 847 848 int vfs_fchown(struct file *file, uid_t user, gid_t group) 849 { 850 int error; 851 852 error = mnt_want_write_file(file); 853 if (error) 854 return error; 855 audit_file(file); 856 error = chown_common(&file->f_path, user, group); 857 mnt_drop_write_file(file); 858 return error; 859 } 860 861 int ksys_fchown(unsigned int fd, uid_t user, gid_t group) 862 { 863 CLASS(fd, f)(fd); 864 865 if (fd_empty(f)) 866 return -EBADF; 867 868 return vfs_fchown(fd_file(f), user, group); 869 } 870 871 SYSCALL_DEFINE3(fchown, unsigned int, fd, uid_t, user, gid_t, group) 872 { 873 return ksys_fchown(fd, user, group); 874 } 875 876 static inline int file_get_write_access(struct file *f) 877 { 878 int error; 879 880 error = get_write_access(f->f_inode); 881 if (unlikely(error)) 882 return error; 883 error = mnt_get_write_access(f->f_path.mnt); 884 if (unlikely(error)) 885 goto cleanup_inode; 886 if (unlikely(f->f_mode & FMODE_BACKING)) { 887 error = mnt_get_write_access(backing_file_user_path(f)->mnt); 888 if (unlikely(error)) 889 goto cleanup_mnt; 890 } 891 return 0; 892 893 cleanup_mnt: 894 mnt_put_write_access(f->f_path.mnt); 895 cleanup_inode: 896 put_write_access(f->f_inode); 897 return error; 898 } 899 900 static int do_dentry_open(struct file *f, 901 int (*open)(struct inode *, struct file *)) 902 { 903 static const struct file_operations empty_fops = {}; 904 struct inode *inode = f->f_path.dentry->d_inode; 905 int error; 906 907 path_get(&f->f_path); 908 f->f_inode = inode; 909 f->f_mapping = inode->i_mapping; 910 f->f_wb_err = filemap_sample_wb_err(f->f_mapping); 911 f->f_sb_err = file_sample_sb_err(f); 912 913 if (unlikely(f->f_flags & O_PATH)) { 914 f->f_mode = FMODE_PATH | FMODE_OPENED; 915 file_set_fsnotify_mode(f, FMODE_NONOTIFY); 916 f->f_op = &empty_fops; 917 return 0; 918 } 919 920 if ((f->f_mode & (FMODE_READ | FMODE_WRITE)) == FMODE_READ) { 921 i_readcount_inc(inode); 922 } else if (f->f_mode & FMODE_WRITE && !special_file(inode->i_mode)) { 923 error = file_get_write_access(f); 924 if (unlikely(error)) 925 goto cleanup_file; 926 f->f_mode |= FMODE_WRITER; 927 } 928 929 /* POSIX.1-2008/SUSv4 Section XSI 2.9.7 */ 930 if (S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode)) 931 f->f_mode |= FMODE_ATOMIC_POS; 932 933 f->f_op = fops_get(inode->i_fop); 934 if (WARN_ON(!f->f_op)) { 935 error = -ENODEV; 936 goto cleanup_all; 937 } 938 939 error = security_file_open(f); 940 if (unlikely(error)) 941 goto cleanup_all; 942 943 /* 944 * Call fsnotify open permission hook and set FMODE_NONOTIFY_* bits 945 * according to existing permission watches. 946 * If FMODE_NONOTIFY mode was already set for an fanotify fd or for a 947 * pseudo file, this call will not change the mode. 948 */ 949 error = fsnotify_open_perm_and_set_mode(f); 950 if (unlikely(error)) 951 goto cleanup_all; 952 953 error = break_lease(file_inode(f), f->f_flags); 954 if (unlikely(error)) 955 goto cleanup_all; 956 957 /* normally all 3 are set; ->open() can clear them if needed */ 958 f->f_mode |= FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE; 959 if (!open) 960 open = f->f_op->open; 961 if (open) { 962 error = open(inode, f); 963 if (error) 964 goto cleanup_all; 965 } 966 f->f_mode |= FMODE_OPENED; 967 if ((f->f_mode & FMODE_READ) && 968 likely(f->f_op->read || f->f_op->read_iter)) 969 f->f_mode |= FMODE_CAN_READ; 970 if ((f->f_mode & FMODE_WRITE) && 971 likely(f->f_op->write || f->f_op->write_iter)) 972 f->f_mode |= FMODE_CAN_WRITE; 973 if ((f->f_mode & FMODE_LSEEK) && !f->f_op->llseek) 974 f->f_mode &= ~FMODE_LSEEK; 975 if (f->f_mapping->a_ops && f->f_mapping->a_ops->direct_IO) 976 f->f_mode |= FMODE_CAN_ODIRECT; 977 978 f->f_flags &= ~(O_CREAT | O_EXCL | O_NOCTTY | O_TRUNC); 979 f->f_iocb_flags = iocb_flags(f); 980 981 file_ra_state_init(&f->f_ra, f->f_mapping->host->i_mapping); 982 983 if ((f->f_flags & O_DIRECT) && !(f->f_mode & FMODE_CAN_ODIRECT)) 984 return -EINVAL; 985 986 /* 987 * XXX: Huge page cache doesn't support writing yet. Drop all page 988 * cache for this file before processing writes. 989 */ 990 if (f->f_mode & FMODE_WRITE) { 991 /* 992 * Depends on full fence from get_write_access() to synchronize 993 * against collapse_file() regarding i_writecount and nr_thps 994 * updates. Ensures subsequent insertion of THPs into the page 995 * cache will fail. 996 */ 997 if (filemap_nr_thps(inode->i_mapping)) { 998 struct address_space *mapping = inode->i_mapping; 999 1000 filemap_invalidate_lock(inode->i_mapping); 1001 /* 1002 * unmap_mapping_range just need to be called once 1003 * here, because the private pages is not need to be 1004 * unmapped mapping (e.g. data segment of dynamic 1005 * shared libraries here). 1006 */ 1007 unmap_mapping_range(mapping, 0, 0, 0); 1008 truncate_inode_pages(mapping, 0); 1009 filemap_invalidate_unlock(inode->i_mapping); 1010 } 1011 } 1012 1013 return 0; 1014 1015 cleanup_all: 1016 if (WARN_ON_ONCE(error > 0)) 1017 error = -EINVAL; 1018 fops_put(f->f_op); 1019 put_file_access(f); 1020 cleanup_file: 1021 path_put(&f->f_path); 1022 f->__f_path.mnt = NULL; 1023 f->__f_path.dentry = NULL; 1024 f->f_inode = NULL; 1025 return error; 1026 } 1027 1028 /** 1029 * finish_open - finish opening a file 1030 * @file: file pointer 1031 * @dentry: pointer to dentry 1032 * @open: open callback 1033 * 1034 * This can be used to finish opening a file passed to i_op->atomic_open(). 1035 * 1036 * If the open callback is set to NULL, then the standard f_op->open() 1037 * filesystem callback is substituted. 1038 * 1039 * NB: the dentry reference is _not_ consumed. If, for example, the dentry is 1040 * the return value of d_splice_alias(), then the caller needs to perform dput() 1041 * on it after finish_open(). 1042 * 1043 * Returns zero on success or -errno if the open failed. 1044 */ 1045 int finish_open(struct file *file, struct dentry *dentry, 1046 int (*open)(struct inode *, struct file *)) 1047 { 1048 BUG_ON(file->f_mode & FMODE_OPENED); /* once it's opened, it's opened */ 1049 1050 file->__f_path.dentry = dentry; 1051 return do_dentry_open(file, open); 1052 } 1053 EXPORT_SYMBOL(finish_open); 1054 1055 /** 1056 * finish_no_open - finish ->atomic_open() without opening the file 1057 * 1058 * @file: file pointer 1059 * @dentry: dentry, ERR_PTR(-E...) or NULL (as returned from ->lookup()) 1060 * 1061 * This can be used to set the result of a lookup in ->atomic_open(). 1062 * 1063 * NB: unlike finish_open() this function does consume the dentry reference and 1064 * the caller need not dput() it. 1065 * 1066 * Returns 0 or -E..., which must be the return value of ->atomic_open() after 1067 * having called this function. 1068 */ 1069 int finish_no_open(struct file *file, struct dentry *dentry) 1070 { 1071 if (IS_ERR(dentry)) 1072 return PTR_ERR(dentry); 1073 file->__f_path.dentry = dentry; 1074 return 0; 1075 } 1076 EXPORT_SYMBOL(finish_no_open); 1077 1078 char *file_path(struct file *filp, char *buf, int buflen) 1079 { 1080 return d_path(&filp->f_path, buf, buflen); 1081 } 1082 EXPORT_SYMBOL(file_path); 1083 1084 /** 1085 * vfs_open - open the file at the given path 1086 * @path: path to open 1087 * @file: newly allocated file with f_flag initialized 1088 */ 1089 int vfs_open(const struct path *path, struct file *file) 1090 { 1091 int ret; 1092 1093 file->__f_path = *path; 1094 ret = do_dentry_open(file, NULL); 1095 if (!ret) { 1096 /* 1097 * Once we return a file with FMODE_OPENED, __fput() will call 1098 * fsnotify_close(), so we need fsnotify_open() here for 1099 * symmetry. 1100 */ 1101 fsnotify_open(file); 1102 } 1103 return ret; 1104 } 1105 1106 struct file *dentry_open(const struct path *path, int flags, 1107 const struct cred *cred) 1108 { 1109 int error; 1110 struct file *f; 1111 1112 /* We must always pass in a valid mount pointer. */ 1113 BUG_ON(!path->mnt); 1114 1115 f = alloc_empty_file(flags, cred); 1116 if (!IS_ERR(f)) { 1117 error = vfs_open(path, f); 1118 if (error) { 1119 fput(f); 1120 f = ERR_PTR(error); 1121 } 1122 } 1123 return f; 1124 } 1125 EXPORT_SYMBOL(dentry_open); 1126 1127 struct file *dentry_open_nonotify(const struct path *path, int flags, 1128 const struct cred *cred) 1129 { 1130 struct file *f = alloc_empty_file(flags, cred); 1131 if (!IS_ERR(f)) { 1132 int error; 1133 1134 file_set_fsnotify_mode(f, FMODE_NONOTIFY); 1135 error = vfs_open(path, f); 1136 if (error) { 1137 fput(f); 1138 f = ERR_PTR(error); 1139 } 1140 } 1141 return f; 1142 } 1143 1144 /** 1145 * dentry_create - Create and open a file 1146 * @path: path to create 1147 * @flags: O_ flags 1148 * @mode: mode bits for new file 1149 * @cred: credentials to use 1150 * 1151 * Caller must hold the parent directory's lock, and have prepared 1152 * a negative dentry, placed in @path->dentry, for the new file. 1153 * 1154 * Caller sets @path->mnt to the vfsmount of the filesystem where 1155 * the new file is to be created. The parent directory and the 1156 * negative dentry must reside on the same filesystem instance. 1157 * 1158 * On success, returns a "struct file *". Otherwise a ERR_PTR 1159 * is returned. 1160 */ 1161 struct file *dentry_create(const struct path *path, int flags, umode_t mode, 1162 const struct cred *cred) 1163 { 1164 struct file *f; 1165 int error; 1166 1167 f = alloc_empty_file(flags, cred); 1168 if (IS_ERR(f)) 1169 return f; 1170 1171 error = vfs_create(mnt_idmap(path->mnt), path->dentry, mode, NULL); 1172 if (!error) 1173 error = vfs_open(path, f); 1174 1175 if (unlikely(error)) { 1176 fput(f); 1177 return ERR_PTR(error); 1178 } 1179 return f; 1180 } 1181 EXPORT_SYMBOL(dentry_create); 1182 1183 /** 1184 * kernel_file_open - open a file for kernel internal use 1185 * @path: path of the file to open 1186 * @flags: open flags 1187 * @cred: credentials for open 1188 * 1189 * Open a file for use by in-kernel consumers. The file is not accounted 1190 * against nr_files and must not be installed into the file descriptor 1191 * table. 1192 * 1193 * Return: Opened file on success, an error pointer on failure. 1194 */ 1195 struct file *kernel_file_open(const struct path *path, int flags, 1196 const struct cred *cred) 1197 { 1198 struct file *f; 1199 int error; 1200 1201 f = alloc_empty_file_noaccount(flags, cred); 1202 if (IS_ERR(f)) 1203 return f; 1204 1205 error = vfs_open(path, f); 1206 if (error) { 1207 fput(f); 1208 return ERR_PTR(error); 1209 } 1210 return f; 1211 } 1212 EXPORT_SYMBOL_GPL(kernel_file_open); 1213 1214 #define WILL_CREATE(flags) (flags & (O_CREAT | __O_TMPFILE)) 1215 #define O_PATH_FLAGS (O_DIRECTORY | O_NOFOLLOW | O_PATH | O_CLOEXEC) 1216 1217 inline struct open_how build_open_how(int flags, umode_t mode) 1218 { 1219 struct open_how how = { 1220 .flags = flags & VALID_OPEN_FLAGS, 1221 .mode = mode & S_IALLUGO, 1222 }; 1223 1224 /* O_PATH beats everything else. */ 1225 if (how.flags & O_PATH) 1226 how.flags &= O_PATH_FLAGS; 1227 /* Modes should only be set for create-like flags. */ 1228 if (!WILL_CREATE(how.flags)) 1229 how.mode = 0; 1230 return how; 1231 } 1232 1233 inline int build_open_flags(const struct open_how *how, struct open_flags *op) 1234 { 1235 u64 flags = how->flags; 1236 u64 strip = O_CLOEXEC; 1237 int lookup_flags = 0; 1238 int acc_mode = ACC_MODE(flags); 1239 1240 BUILD_BUG_ON_MSG(upper_32_bits(VALID_OPEN_FLAGS), 1241 "struct open_flags doesn't yet handle flags > 32 bits"); 1242 1243 /* 1244 * Strip flags that aren't relevant in determining struct open_flags. 1245 */ 1246 flags &= ~strip; 1247 1248 /* 1249 * Older syscalls implicitly clear all of the invalid flags or argument 1250 * values before calling build_open_flags(), but openat2(2) checks all 1251 * of its arguments. 1252 */ 1253 if (flags & ~VALID_OPEN_FLAGS) 1254 return -EINVAL; 1255 if (how->resolve & ~VALID_RESOLVE_FLAGS) 1256 return -EINVAL; 1257 1258 /* Scoping flags are mutually exclusive. */ 1259 if ((how->resolve & RESOLVE_BENEATH) && (how->resolve & RESOLVE_IN_ROOT)) 1260 return -EINVAL; 1261 1262 /* Deal with the mode. */ 1263 if (WILL_CREATE(flags)) { 1264 if (how->mode & ~S_IALLUGO) 1265 return -EINVAL; 1266 op->mode = how->mode | S_IFREG; 1267 } else { 1268 if (how->mode != 0) 1269 return -EINVAL; 1270 op->mode = 0; 1271 } 1272 1273 /* 1274 * Block bugs where O_DIRECTORY | O_CREAT created regular files. 1275 * Note, that blocking O_DIRECTORY | O_CREAT here also protects 1276 * O_TMPFILE below which requires O_DIRECTORY being raised. 1277 */ 1278 if ((flags & (O_DIRECTORY | O_CREAT)) == (O_DIRECTORY | O_CREAT)) 1279 return -EINVAL; 1280 1281 /* Now handle the creative implementation of O_TMPFILE. */ 1282 if (flags & __O_TMPFILE) { 1283 /* 1284 * In order to ensure programs get explicit errors when trying 1285 * to use O_TMPFILE on old kernels we enforce that O_DIRECTORY 1286 * is raised alongside __O_TMPFILE. 1287 */ 1288 if (!(flags & O_DIRECTORY)) 1289 return -EINVAL; 1290 if (!(acc_mode & MAY_WRITE)) 1291 return -EINVAL; 1292 } 1293 if (flags & O_PATH) { 1294 /* O_PATH only permits certain other flags to be set. */ 1295 if (flags & ~O_PATH_FLAGS) 1296 return -EINVAL; 1297 acc_mode = 0; 1298 } 1299 1300 /* 1301 * O_SYNC is implemented as __O_SYNC|O_DSYNC. As many places only 1302 * check for O_DSYNC if the need any syncing at all we enforce it's 1303 * always set instead of having to deal with possibly weird behaviour 1304 * for malicious applications setting only __O_SYNC. 1305 */ 1306 if (flags & __O_SYNC) 1307 flags |= O_DSYNC; 1308 1309 op->open_flag = flags; 1310 1311 /* O_TRUNC implies we need access checks for write permissions */ 1312 if (flags & O_TRUNC) 1313 acc_mode |= MAY_WRITE; 1314 1315 /* Allow the LSM permission hook to distinguish append 1316 access from general write access. */ 1317 if (flags & O_APPEND) 1318 acc_mode |= MAY_APPEND; 1319 1320 op->acc_mode = acc_mode; 1321 1322 op->intent = flags & O_PATH ? 0 : LOOKUP_OPEN; 1323 1324 if (flags & O_CREAT) { 1325 op->intent |= LOOKUP_CREATE; 1326 if (flags & O_EXCL) { 1327 op->intent |= LOOKUP_EXCL; 1328 flags |= O_NOFOLLOW; 1329 } 1330 } 1331 1332 if (flags & O_DIRECTORY) 1333 lookup_flags |= LOOKUP_DIRECTORY; 1334 if (!(flags & O_NOFOLLOW)) 1335 lookup_flags |= LOOKUP_FOLLOW; 1336 1337 if (how->resolve & RESOLVE_NO_XDEV) 1338 lookup_flags |= LOOKUP_NO_XDEV; 1339 if (how->resolve & RESOLVE_NO_MAGICLINKS) 1340 lookup_flags |= LOOKUP_NO_MAGICLINKS; 1341 if (how->resolve & RESOLVE_NO_SYMLINKS) 1342 lookup_flags |= LOOKUP_NO_SYMLINKS; 1343 if (how->resolve & RESOLVE_BENEATH) 1344 lookup_flags |= LOOKUP_BENEATH; 1345 if (how->resolve & RESOLVE_IN_ROOT) 1346 lookup_flags |= LOOKUP_IN_ROOT; 1347 if (how->resolve & RESOLVE_CACHED) { 1348 /* Don't bother even trying for create/truncate/tmpfile open */ 1349 if (flags & (O_TRUNC | O_CREAT | __O_TMPFILE)) 1350 return -EAGAIN; 1351 lookup_flags |= LOOKUP_CACHED; 1352 } 1353 1354 op->lookup_flags = lookup_flags; 1355 return 0; 1356 } 1357 1358 /** 1359 * file_open_name - open file and return file pointer 1360 * 1361 * @name: struct filename containing path to open 1362 * @flags: open flags as per the open(2) second argument 1363 * @mode: mode for the new file if O_CREAT is set, else ignored 1364 * 1365 * This is the helper to open a file from kernelspace if you really 1366 * have to. But in generally you should not do this, so please move 1367 * along, nothing to see here.. 1368 */ 1369 struct file *file_open_name(struct filename *name, int flags, umode_t mode) 1370 { 1371 struct open_flags op; 1372 struct open_how how = build_open_how(flags, mode); 1373 int err = build_open_flags(&how, &op); 1374 if (err) 1375 return ERR_PTR(err); 1376 return do_filp_open(AT_FDCWD, name, &op); 1377 } 1378 1379 /** 1380 * filp_open - open file and return file pointer 1381 * 1382 * @filename: path to open 1383 * @flags: open flags as per the open(2) second argument 1384 * @mode: mode for the new file if O_CREAT is set, else ignored 1385 * 1386 * This is the helper to open a file from kernelspace if you really 1387 * have to. But in generally you should not do this, so please move 1388 * along, nothing to see here.. 1389 */ 1390 struct file *filp_open(const char *filename, int flags, umode_t mode) 1391 { 1392 struct filename *name = getname_kernel(filename); 1393 struct file *file = ERR_CAST(name); 1394 1395 if (!IS_ERR(name)) { 1396 file = file_open_name(name, flags, mode); 1397 putname(name); 1398 } 1399 return file; 1400 } 1401 EXPORT_SYMBOL(filp_open); 1402 1403 struct file *file_open_root(const struct path *root, 1404 const char *filename, int flags, umode_t mode) 1405 { 1406 struct open_flags op; 1407 struct open_how how = build_open_how(flags, mode); 1408 int err = build_open_flags(&how, &op); 1409 if (err) 1410 return ERR_PTR(err); 1411 return do_file_open_root(root, filename, &op); 1412 } 1413 EXPORT_SYMBOL(file_open_root); 1414 1415 static int do_sys_openat2(int dfd, const char __user *filename, 1416 struct open_how *how) 1417 { 1418 struct open_flags op; 1419 struct filename *tmp __free(putname) = NULL; 1420 int err; 1421 1422 err = build_open_flags(how, &op); 1423 if (unlikely(err)) 1424 return err; 1425 1426 tmp = getname(filename); 1427 if (IS_ERR(tmp)) 1428 return PTR_ERR(tmp); 1429 1430 return FD_ADD(how->flags, do_filp_open(dfd, tmp, &op)); 1431 } 1432 1433 int do_sys_open(int dfd, const char __user *filename, int flags, umode_t mode) 1434 { 1435 struct open_how how = build_open_how(flags, mode); 1436 return do_sys_openat2(dfd, filename, &how); 1437 } 1438 1439 1440 SYSCALL_DEFINE3(open, const char __user *, filename, int, flags, umode_t, mode) 1441 { 1442 if (force_o_largefile()) 1443 flags |= O_LARGEFILE; 1444 return do_sys_open(AT_FDCWD, filename, flags, mode); 1445 } 1446 1447 SYSCALL_DEFINE4(openat, int, dfd, const char __user *, filename, int, flags, 1448 umode_t, mode) 1449 { 1450 if (force_o_largefile()) 1451 flags |= O_LARGEFILE; 1452 return do_sys_open(dfd, filename, flags, mode); 1453 } 1454 1455 SYSCALL_DEFINE4(openat2, int, dfd, const char __user *, filename, 1456 struct open_how __user *, how, size_t, usize) 1457 { 1458 int err; 1459 struct open_how tmp; 1460 1461 BUILD_BUG_ON(sizeof(struct open_how) < OPEN_HOW_SIZE_VER0); 1462 BUILD_BUG_ON(sizeof(struct open_how) != OPEN_HOW_SIZE_LATEST); 1463 1464 if (unlikely(usize < OPEN_HOW_SIZE_VER0)) 1465 return -EINVAL; 1466 if (unlikely(usize > PAGE_SIZE)) 1467 return -E2BIG; 1468 1469 err = copy_struct_from_user(&tmp, sizeof(tmp), how, usize); 1470 if (err) 1471 return err; 1472 1473 audit_openat2_how(&tmp); 1474 1475 /* O_LARGEFILE is only allowed for non-O_PATH. */ 1476 if (!(tmp.flags & O_PATH) && force_o_largefile()) 1477 tmp.flags |= O_LARGEFILE; 1478 1479 return do_sys_openat2(dfd, filename, &tmp); 1480 } 1481 1482 #ifdef CONFIG_COMPAT 1483 /* 1484 * Exactly like sys_open(), except that it doesn't set the 1485 * O_LARGEFILE flag. 1486 */ 1487 COMPAT_SYSCALL_DEFINE3(open, const char __user *, filename, int, flags, umode_t, mode) 1488 { 1489 return do_sys_open(AT_FDCWD, filename, flags, mode); 1490 } 1491 1492 /* 1493 * Exactly like sys_openat(), except that it doesn't set the 1494 * O_LARGEFILE flag. 1495 */ 1496 COMPAT_SYSCALL_DEFINE4(openat, int, dfd, const char __user *, filename, int, flags, umode_t, mode) 1497 { 1498 return do_sys_open(dfd, filename, flags, mode); 1499 } 1500 #endif 1501 1502 #ifndef __alpha__ 1503 1504 /* 1505 * For backward compatibility? Maybe this should be moved 1506 * into arch/i386 instead? 1507 */ 1508 SYSCALL_DEFINE2(creat, const char __user *, pathname, umode_t, mode) 1509 { 1510 int flags = O_CREAT | O_WRONLY | O_TRUNC; 1511 1512 if (force_o_largefile()) 1513 flags |= O_LARGEFILE; 1514 return do_sys_open(AT_FDCWD, pathname, flags, mode); 1515 } 1516 #endif 1517 1518 /* 1519 * "id" is the POSIX thread ID. We use the 1520 * files pointer for this.. 1521 */ 1522 static int filp_flush(struct file *filp, fl_owner_t id) 1523 { 1524 int retval = 0; 1525 1526 if (CHECK_DATA_CORRUPTION(file_count(filp) == 0, filp, 1527 "VFS: Close: file count is 0 (f_op=%ps)", 1528 filp->f_op)) { 1529 return 0; 1530 } 1531 1532 if (filp->f_op->flush) 1533 retval = filp->f_op->flush(filp, id); 1534 1535 if (likely(!(filp->f_mode & FMODE_PATH))) { 1536 dnotify_flush(filp, id); 1537 locks_remove_posix(filp, id); 1538 } 1539 return retval; 1540 } 1541 1542 int filp_close(struct file *filp, fl_owner_t id) 1543 { 1544 int retval; 1545 1546 retval = filp_flush(filp, id); 1547 fput_close(filp); 1548 1549 return retval; 1550 } 1551 EXPORT_SYMBOL(filp_close); 1552 1553 /* 1554 * Careful here! We test whether the file pointer is NULL before 1555 * releasing the fd. This ensures that one clone task can't release 1556 * an fd while another clone is opening it. 1557 */ 1558 SYSCALL_DEFINE1(close, unsigned int, fd) 1559 { 1560 int retval; 1561 struct file *file; 1562 1563 file = file_close_fd(fd); 1564 if (!file) 1565 return -EBADF; 1566 1567 retval = filp_flush(file, current->files); 1568 1569 /* 1570 * We're returning to user space. Don't bother 1571 * with any delayed fput() cases. 1572 */ 1573 fput_close_sync(file); 1574 1575 if (likely(retval == 0)) 1576 return 0; 1577 1578 /* can't restart close syscall because file table entry was cleared */ 1579 if (retval == -ERESTARTSYS || 1580 retval == -ERESTARTNOINTR || 1581 retval == -ERESTARTNOHAND || 1582 retval == -ERESTART_RESTARTBLOCK) 1583 retval = -EINTR; 1584 1585 return retval; 1586 } 1587 1588 /* 1589 * This routine simulates a hangup on the tty, to arrange that users 1590 * are given clean terminals at login time. 1591 */ 1592 SYSCALL_DEFINE0(vhangup) 1593 { 1594 if (capable(CAP_SYS_TTY_CONFIG)) { 1595 tty_vhangup_self(); 1596 return 0; 1597 } 1598 return -EPERM; 1599 } 1600 1601 /* 1602 * Called when an inode is about to be open. 1603 * We use this to disallow opening large files on 32bit systems if 1604 * the caller didn't specify O_LARGEFILE. On 64bit systems we force 1605 * on this flag in sys_open. 1606 */ 1607 int generic_file_open(struct inode * inode, struct file * filp) 1608 { 1609 if (!(filp->f_flags & O_LARGEFILE) && i_size_read(inode) > MAX_NON_LFS) 1610 return -EOVERFLOW; 1611 return 0; 1612 } 1613 1614 EXPORT_SYMBOL(generic_file_open); 1615 1616 /* 1617 * This is used by subsystems that don't want seekable 1618 * file descriptors. The function is not supposed to ever fail, the only 1619 * reason it returns an 'int' and not 'void' is so that it can be plugged 1620 * directly into file_operations structure. 1621 */ 1622 int nonseekable_open(struct inode *inode, struct file *filp) 1623 { 1624 filp->f_mode &= ~(FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE); 1625 return 0; 1626 } 1627 1628 EXPORT_SYMBOL(nonseekable_open); 1629 1630 /* 1631 * stream_open is used by subsystems that want stream-like file descriptors. 1632 * Such file descriptors are not seekable and don't have notion of position 1633 * (file.f_pos is always 0 and ppos passed to .read()/.write() is always NULL). 1634 * Contrary to file descriptors of other regular files, .read() and .write() 1635 * can run simultaneously. 1636 * 1637 * stream_open never fails and is marked to return int so that it could be 1638 * directly used as file_operations.open . 1639 */ 1640 int stream_open(struct inode *inode, struct file *filp) 1641 { 1642 filp->f_mode &= ~(FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE | FMODE_ATOMIC_POS); 1643 filp->f_mode |= FMODE_STREAM; 1644 return 0; 1645 } 1646 1647 EXPORT_SYMBOL(stream_open); 1648