1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * linux/fs/open.c 4 * 5 * Copyright (C) 1991, 1992 Linus Torvalds 6 */ 7 8 #include <linux/string.h> 9 #include <linux/mm.h> 10 #include <linux/file.h> 11 #include <linux/fdtable.h> 12 #include <linux/fsnotify.h> 13 #include <linux/module.h> 14 #include <linux/tty.h> 15 #include <linux/namei.h> 16 #include <linux/backing-dev.h> 17 #include <linux/capability.h> 18 #include <linux/securebits.h> 19 #include <linux/security.h> 20 #include <linux/mount.h> 21 #include <linux/fcntl.h> 22 #include <linux/slab.h> 23 #include <linux/uaccess.h> 24 #include <linux/fs.h> 25 #include <linux/personality.h> 26 #include <linux/pagemap.h> 27 #include <linux/syscalls.h> 28 #include <linux/rcupdate.h> 29 #include <linux/audit.h> 30 #include <linux/falloc.h> 31 #include <linux/fs_struct.h> 32 #include <linux/dnotify.h> 33 #include <linux/compat.h> 34 #include <linux/mnt_idmapping.h> 35 #include <linux/filelock.h> 36 37 #include "internal.h" 38 39 int do_truncate(struct mnt_idmap *idmap, struct dentry *dentry, 40 loff_t length, unsigned int time_attrs, struct file *filp) 41 { 42 int ret; 43 struct iattr newattrs; 44 45 /* Not pretty: "inode->i_size" shouldn't really be signed. But it is. */ 46 if (length < 0) 47 return -EINVAL; 48 49 newattrs.ia_size = length; 50 newattrs.ia_valid = ATTR_SIZE | time_attrs; 51 if (filp) { 52 newattrs.ia_file = filp; 53 newattrs.ia_valid |= ATTR_FILE; 54 } 55 56 /* Remove suid, sgid, and file capabilities on truncate too */ 57 ret = dentry_needs_remove_privs(idmap, dentry); 58 if (ret < 0) 59 return ret; 60 if (ret) 61 newattrs.ia_valid |= ret | ATTR_FORCE; 62 63 ret = inode_lock_killable(dentry->d_inode); 64 if (ret) 65 return ret; 66 67 /* Note any delegations or leases have already been broken: */ 68 ret = notify_change(idmap, dentry, &newattrs, NULL); 69 inode_unlock(dentry->d_inode); 70 return ret; 71 } 72 73 int vfs_truncate(const struct path *path, loff_t length) 74 { 75 struct mnt_idmap *idmap; 76 struct inode *inode; 77 int error; 78 79 inode = path->dentry->d_inode; 80 81 /* For directories it's -EISDIR, for other non-regulars - -EINVAL */ 82 if (S_ISDIR(inode->i_mode)) 83 return -EISDIR; 84 if (!S_ISREG(inode->i_mode)) 85 return -EINVAL; 86 87 idmap = mnt_idmap(path->mnt); 88 error = inode_permission(idmap, inode, MAY_WRITE); 89 if (error) 90 return error; 91 92 error = fsnotify_truncate_perm(path, length); 93 if (error) 94 return error; 95 96 error = mnt_want_write(path->mnt); 97 if (error) 98 return error; 99 100 error = -EPERM; 101 if (IS_APPEND(inode)) 102 goto mnt_drop_write_and_out; 103 104 error = get_write_access(inode); 105 if (error) 106 goto mnt_drop_write_and_out; 107 108 /* 109 * Make sure that there are no leases. get_write_access() protects 110 * against the truncate racing with a lease-granting setlease(). 111 */ 112 error = break_lease(inode, O_WRONLY); 113 if (error) 114 goto put_write_and_out; 115 116 error = security_path_truncate(path); 117 if (!error) 118 error = do_truncate(idmap, path->dentry, length, 0, NULL); 119 120 put_write_and_out: 121 put_write_access(inode); 122 mnt_drop_write_and_out: 123 mnt_drop_write(path->mnt); 124 125 return error; 126 } 127 EXPORT_SYMBOL_GPL(vfs_truncate); 128 129 int ksys_truncate(const char __user *pathname, loff_t length) 130 { 131 unsigned int lookup_flags = LOOKUP_FOLLOW; 132 struct path path; 133 int error; 134 135 if (length < 0) /* sorry, but loff_t says... */ 136 return -EINVAL; 137 138 CLASS(filename, name)(pathname); 139 retry: 140 error = filename_lookup(AT_FDCWD, name, lookup_flags, &path, NULL); 141 if (!error) { 142 error = vfs_truncate(&path, length); 143 path_put(&path); 144 if (retry_estale(error, lookup_flags)) { 145 lookup_flags |= LOOKUP_REVAL; 146 goto retry; 147 } 148 } 149 return error; 150 } 151 152 SYSCALL_DEFINE2(truncate, const char __user *, path, long, length) 153 { 154 return ksys_truncate(path, length); 155 } 156 157 #ifdef CONFIG_COMPAT 158 COMPAT_SYSCALL_DEFINE2(truncate, const char __user *, path, compat_off_t, length) 159 { 160 return ksys_truncate(path, length); 161 } 162 #endif 163 164 int do_ftruncate(struct file *file, loff_t length, unsigned int flags) 165 { 166 struct dentry *dentry = file->f_path.dentry; 167 struct inode *inode = dentry->d_inode; 168 int error; 169 170 if (!S_ISREG(inode->i_mode) || !(file->f_mode & FMODE_WRITE)) 171 return -EINVAL; 172 173 /* 174 * Cannot ftruncate over 2^31 bytes without large file support, either 175 * through opening with O_LARGEFILE or by using ftruncate64(). 176 */ 177 if (length > MAX_NON_LFS && 178 !(file->f_flags & O_LARGEFILE) && !(flags & FTRUNCATE_LFS)) 179 return -EINVAL; 180 181 /* Check IS_APPEND on real upper inode */ 182 if (IS_APPEND(file_inode(file))) 183 return -EPERM; 184 185 error = security_file_truncate(file); 186 if (error) 187 return error; 188 189 error = fsnotify_truncate_perm(&file->f_path, length); 190 if (error) 191 return error; 192 193 scoped_guard(super_write, inode->i_sb) 194 return do_truncate(file_mnt_idmap(file), dentry, length, 195 ATTR_MTIME | ATTR_CTIME, file); 196 } 197 198 int ksys_ftruncate(unsigned int fd, loff_t length, unsigned int flags) 199 { 200 if (length < 0) 201 return -EINVAL; 202 CLASS(fd, f)(fd); 203 if (fd_empty(f)) 204 return -EBADF; 205 206 return do_ftruncate(fd_file(f), length, flags); 207 } 208 209 SYSCALL_DEFINE2(ftruncate, unsigned int, fd, off_t, length) 210 { 211 return ksys_ftruncate(fd, length, 0); 212 } 213 214 #ifdef CONFIG_COMPAT 215 COMPAT_SYSCALL_DEFINE2(ftruncate, unsigned int, fd, compat_off_t, length) 216 { 217 return ksys_ftruncate(fd, length, 0); 218 } 219 #endif 220 221 /* LFS versions of truncate are only needed on 32 bit machines */ 222 #if BITS_PER_LONG == 32 223 SYSCALL_DEFINE2(truncate64, const char __user *, path, loff_t, length) 224 { 225 return ksys_truncate(path, length); 226 } 227 228 SYSCALL_DEFINE2(ftruncate64, unsigned int, fd, loff_t, length) 229 { 230 return ksys_ftruncate(fd, length, FTRUNCATE_LFS); 231 } 232 #endif /* BITS_PER_LONG == 32 */ 233 234 #if defined(CONFIG_COMPAT) && defined(__ARCH_WANT_COMPAT_TRUNCATE64) 235 COMPAT_SYSCALL_DEFINE3(truncate64, const char __user *, pathname, 236 compat_arg_u64_dual(length)) 237 { 238 return ksys_truncate(pathname, compat_arg_u64_glue(length)); 239 } 240 #endif 241 242 #if defined(CONFIG_COMPAT) && defined(__ARCH_WANT_COMPAT_FTRUNCATE64) 243 COMPAT_SYSCALL_DEFINE3(ftruncate64, unsigned int, fd, 244 compat_arg_u64_dual(length)) 245 { 246 return ksys_ftruncate(fd, compat_arg_u64_glue(length), FTRUNCATE_LFS); 247 } 248 #endif 249 250 int vfs_fallocate(struct file *file, int mode, loff_t offset, loff_t len) 251 { 252 struct inode *inode = file_inode(file); 253 int ret; 254 loff_t sum; 255 256 if (offset < 0 || len <= 0) 257 return -EINVAL; 258 259 if (mode & ~(FALLOC_FL_MODE_MASK | FALLOC_FL_KEEP_SIZE)) 260 return -EOPNOTSUPP; 261 262 /* 263 * Modes are exclusive, even if that is not obvious from the encoding 264 * as bit masks and the mix with the flag in the same namespace. 265 * 266 * To make things even more complicated, FALLOC_FL_ALLOCATE_RANGE is 267 * encoded as no bit set. 268 */ 269 switch (mode & FALLOC_FL_MODE_MASK) { 270 case FALLOC_FL_ALLOCATE_RANGE: 271 case FALLOC_FL_UNSHARE_RANGE: 272 case FALLOC_FL_ZERO_RANGE: 273 break; 274 case FALLOC_FL_PUNCH_HOLE: 275 if (!(mode & FALLOC_FL_KEEP_SIZE)) 276 return -EOPNOTSUPP; 277 break; 278 case FALLOC_FL_COLLAPSE_RANGE: 279 case FALLOC_FL_INSERT_RANGE: 280 case FALLOC_FL_WRITE_ZEROES: 281 if (mode & FALLOC_FL_KEEP_SIZE) 282 return -EOPNOTSUPP; 283 break; 284 default: 285 return -EOPNOTSUPP; 286 } 287 288 if (!(file->f_mode & FMODE_WRITE)) 289 return -EBADF; 290 291 /* 292 * On append-only files only space preallocation is supported. 293 */ 294 if ((mode & ~FALLOC_FL_KEEP_SIZE) && IS_APPEND(inode)) 295 return -EPERM; 296 297 if (IS_IMMUTABLE(inode)) 298 return -EPERM; 299 300 /* 301 * We cannot allow any fallocate operation on an active swapfile 302 */ 303 if (IS_SWAPFILE(inode)) 304 return -ETXTBSY; 305 306 /* 307 * Revalidate the write permissions, in case security policy has 308 * changed since the files were opened. 309 */ 310 ret = security_file_permission(file, MAY_WRITE); 311 if (ret) 312 return ret; 313 314 ret = fsnotify_file_area_perm(file, MAY_WRITE, &offset, len); 315 if (ret) 316 return ret; 317 318 if (S_ISFIFO(inode->i_mode)) 319 return -ESPIPE; 320 321 if (S_ISDIR(inode->i_mode)) 322 return -EISDIR; 323 324 if (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode)) 325 return -ENODEV; 326 327 /* Check for wraparound */ 328 if (check_add_overflow(offset, len, &sum)) 329 return -EFBIG; 330 331 if (sum > inode->i_sb->s_maxbytes) 332 return -EFBIG; 333 334 if (!file->f_op->fallocate) 335 return -EOPNOTSUPP; 336 337 file_start_write(file); 338 ret = file->f_op->fallocate(file, mode, offset, len); 339 340 /* 341 * Create inotify and fanotify events. 342 * 343 * To keep the logic simple always create events if fallocate succeeds. 344 * This implies that events are even created if the file size remains 345 * unchanged, e.g. when using flag FALLOC_FL_KEEP_SIZE. 346 */ 347 if (ret == 0) 348 fsnotify_modify(file); 349 350 file_end_write(file); 351 return ret; 352 } 353 EXPORT_SYMBOL_GPL(vfs_fallocate); 354 355 int ksys_fallocate(int fd, int mode, loff_t offset, loff_t len) 356 { 357 CLASS(fd, f)(fd); 358 359 if (fd_empty(f)) 360 return -EBADF; 361 362 return vfs_fallocate(fd_file(f), mode, offset, len); 363 } 364 365 SYSCALL_DEFINE4(fallocate, int, fd, int, mode, loff_t, offset, loff_t, len) 366 { 367 return ksys_fallocate(fd, mode, offset, len); 368 } 369 370 #if defined(CONFIG_COMPAT) && defined(__ARCH_WANT_COMPAT_FALLOCATE) 371 COMPAT_SYSCALL_DEFINE6(fallocate, int, fd, int, mode, compat_arg_u64_dual(offset), 372 compat_arg_u64_dual(len)) 373 { 374 return ksys_fallocate(fd, mode, compat_arg_u64_glue(offset), 375 compat_arg_u64_glue(len)); 376 } 377 #endif 378 379 /* 380 * access() needs to use the real uid/gid, not the effective uid/gid. 381 * We do this by temporarily clearing all FS-related capabilities and 382 * switching the fsuid/fsgid around to the real ones. 383 * 384 * Creating new credentials is expensive, so we try to skip doing it, 385 * which we can if the result would match what we already got. 386 */ 387 static bool access_need_override_creds(int flags) 388 { 389 const struct cred *cred; 390 391 if (flags & AT_EACCESS) 392 return false; 393 394 cred = current_cred(); 395 if (!uid_eq(cred->fsuid, cred->uid) || 396 !gid_eq(cred->fsgid, cred->gid)) 397 return true; 398 399 if (!issecure(SECURE_NO_SETUID_FIXUP)) { 400 kuid_t root_uid = make_kuid(cred->user_ns, 0); 401 if (!uid_eq(cred->uid, root_uid)) { 402 if (!cap_isclear(cred->cap_effective)) 403 return true; 404 } else { 405 if (!cap_isidentical(cred->cap_effective, 406 cred->cap_permitted)) 407 return true; 408 } 409 } 410 411 return false; 412 } 413 414 static const struct cred *access_override_creds(void) 415 { 416 struct cred *override_cred; 417 418 override_cred = prepare_creds(); 419 if (!override_cred) 420 return NULL; 421 422 /* 423 * XXX access_need_override_creds performs checks in hopes of skipping 424 * this work. Make sure it stays in sync if making any changes in this 425 * routine. 426 */ 427 428 override_cred->fsuid = override_cred->uid; 429 override_cred->fsgid = override_cred->gid; 430 431 if (!issecure(SECURE_NO_SETUID_FIXUP)) { 432 /* Clear the capabilities if we switch to a non-root user */ 433 kuid_t root_uid = make_kuid(override_cred->user_ns, 0); 434 if (!uid_eq(override_cred->uid, root_uid)) 435 cap_clear(override_cred->cap_effective); 436 else 437 override_cred->cap_effective = 438 override_cred->cap_permitted; 439 } 440 441 /* 442 * The new set of credentials can *only* be used in 443 * task-synchronous circumstances, and does not need 444 * RCU freeing, unless somebody then takes a separate 445 * reference to it. 446 * 447 * NOTE! This is _only_ true because this credential 448 * is used purely for override_creds() that installs 449 * it as the subjective cred. Other threads will be 450 * accessing ->real_cred, not the subjective cred. 451 * 452 * If somebody _does_ make a copy of this (using the 453 * 'get_current_cred()' function), that will clear the 454 * non_rcu field, because now that other user may be 455 * expecting RCU freeing. But normal thread-synchronous 456 * cred accesses will keep things non-racy to avoid RCU 457 * freeing. 458 */ 459 override_cred->non_rcu = 1; 460 return override_creds(override_cred); 461 } 462 463 static int do_faccessat(int dfd, const char __user *filename, int mode, int flags) 464 { 465 struct path path; 466 struct inode *inode; 467 int res; 468 unsigned int lookup_flags = LOOKUP_FOLLOW; 469 const struct cred *old_cred = NULL; 470 471 if (mode & ~S_IRWXO) /* where's F_OK, X_OK, W_OK, R_OK? */ 472 return -EINVAL; 473 474 if (flags & ~(AT_EACCESS | AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH)) 475 return -EINVAL; 476 477 if (flags & AT_SYMLINK_NOFOLLOW) 478 lookup_flags &= ~LOOKUP_FOLLOW; 479 480 if (access_need_override_creds(flags)) { 481 old_cred = access_override_creds(); 482 if (!old_cred) 483 return -ENOMEM; 484 } 485 486 CLASS(filename_uflags, name)(filename, flags); 487 retry: 488 res = filename_lookup(dfd, name, lookup_flags, &path, NULL); 489 if (res) 490 goto out; 491 492 inode = d_backing_inode(path.dentry); 493 494 if ((mode & MAY_EXEC) && S_ISREG(inode->i_mode)) { 495 /* 496 * MAY_EXEC on regular files is denied if the fs is mounted 497 * with the "noexec" flag. 498 */ 499 res = -EACCES; 500 if (path_noexec(&path)) 501 goto out_path_release; 502 } 503 504 res = inode_permission(mnt_idmap(path.mnt), inode, mode | MAY_ACCESS); 505 /* SuS v2 requires we report a read only fs too */ 506 if (res || !(mode & S_IWOTH) || special_file(inode->i_mode)) 507 goto out_path_release; 508 /* 509 * This is a rare case where using __mnt_is_readonly() 510 * is OK without a mnt_want/drop_write() pair. Since 511 * no actual write to the fs is performed here, we do 512 * not need to telegraph to that to anyone. 513 * 514 * By doing this, we accept that this access is 515 * inherently racy and know that the fs may change 516 * state before we even see this result. 517 */ 518 if (__mnt_is_readonly(path.mnt)) 519 res = -EROFS; 520 521 out_path_release: 522 path_put(&path); 523 if (retry_estale(res, lookup_flags)) { 524 lookup_flags |= LOOKUP_REVAL; 525 goto retry; 526 } 527 out: 528 if (old_cred) 529 put_cred(revert_creds(old_cred)); 530 531 return res; 532 } 533 534 SYSCALL_DEFINE3(faccessat, int, dfd, const char __user *, filename, int, mode) 535 { 536 return do_faccessat(dfd, filename, mode, 0); 537 } 538 539 SYSCALL_DEFINE4(faccessat2, int, dfd, const char __user *, filename, int, mode, 540 int, flags) 541 { 542 return do_faccessat(dfd, filename, mode, flags); 543 } 544 545 SYSCALL_DEFINE2(access, const char __user *, filename, int, mode) 546 { 547 return do_faccessat(AT_FDCWD, filename, mode, 0); 548 } 549 550 SYSCALL_DEFINE1(chdir, const char __user *, filename) 551 { 552 struct path path; 553 int error; 554 unsigned int lookup_flags = LOOKUP_FOLLOW | LOOKUP_DIRECTORY; 555 CLASS(filename, name)(filename); 556 retry: 557 error = filename_lookup(AT_FDCWD, name, lookup_flags, &path, NULL); 558 if (!error) { 559 error = path_permission(&path, MAY_EXEC | MAY_CHDIR); 560 if (!error) 561 set_fs_pwd(current->fs, &path); 562 path_put(&path); 563 if (retry_estale(error, lookup_flags)) { 564 lookup_flags |= LOOKUP_REVAL; 565 goto retry; 566 } 567 } 568 return error; 569 } 570 571 SYSCALL_DEFINE1(fchdir, unsigned int, fd) 572 { 573 int error; 574 575 if ((int)fd == FD_FAILFS_ROOT) 576 return failfs_current_chdir(); 577 578 CLASS(fd_raw, f)(fd); 579 if (fd_empty(f)) 580 return -EBADF; 581 582 if (!d_can_lookup(fd_file(f)->f_path.dentry)) 583 return -ENOTDIR; 584 585 error = file_permission(fd_file(f), MAY_EXEC | MAY_CHDIR); 586 if (!error) 587 set_fs_pwd(current->fs, &fd_file(f)->f_path); 588 return error; 589 } 590 591 SYSCALL_DEFINE1(chroot, const char __user *, filename) 592 { 593 struct path path; 594 int error; 595 unsigned int lookup_flags = LOOKUP_FOLLOW | LOOKUP_DIRECTORY; 596 CLASS(filename, name)(filename); 597 retry: 598 error = filename_lookup(AT_FDCWD, name, lookup_flags, &path, NULL); 599 if (error) 600 return error; 601 602 error = path_permission(&path, MAY_EXEC | MAY_CHDIR); 603 if (error) 604 goto dput_and_out; 605 606 error = -EPERM; 607 if (!ns_capable(current_user_ns(), CAP_SYS_CHROOT)) 608 goto dput_and_out; 609 error = security_path_chroot(&path); 610 if (!error) 611 set_fs_root(current->fs, &path); 612 dput_and_out: 613 path_put(&path); 614 if (retry_estale(error, lookup_flags)) { 615 lookup_flags |= LOOKUP_REVAL; 616 goto retry; 617 } 618 return error; 619 } 620 621 SYSCALL_DEFINE2(fchroot, int, fd, unsigned int, flags) 622 { 623 struct path path; 624 int error; 625 626 if (flags) 627 return -EINVAL; 628 629 if (fd == FD_FAILFS_ROOT) { 630 if (!ns_capable(current_user_ns(), CAP_SYS_CHROOT)) { 631 if (!task_no_new_privs(current)) 632 return -EPERM; 633 /* A shared fs_struct lets a sibling exec setuid past the check above. */ 634 if (current->fs->users != 1) 635 return -EINVAL; 636 /* Moving the root to failfs lifts the old root's ".." barrier. */ 637 if (current_chrooted()) 638 return -EPERM; 639 } 640 failfs_get_root(&path); 641 } else { 642 CLASS(fd_raw, f)(fd); 643 if (fd_empty(f)) 644 return -EBADF; 645 646 if (!d_can_lookup(fd_file(f)->f_path.dentry)) 647 return -ENOTDIR; 648 649 error = file_permission(fd_file(f), MAY_EXEC | MAY_CHDIR); 650 if (error) 651 return error; 652 653 if (!ns_capable(current_user_ns(), CAP_SYS_CHROOT)) 654 return -EPERM; 655 656 path = fd_file(f)->f_path; 657 path_get(&path); 658 } 659 660 error = security_path_chroot(&path); 661 if (!error) 662 set_fs_root(current->fs, &path); 663 path_put(&path); 664 return error; 665 } 666 667 int chmod_common(const struct path *path, umode_t mode) 668 { 669 struct inode *inode = path->dentry->d_inode; 670 struct delegated_inode delegated_inode = { }; 671 struct iattr newattrs; 672 int error; 673 674 error = mnt_want_write(path->mnt); 675 if (error) 676 return error; 677 retry_deleg: 678 error = inode_lock_killable(inode); 679 if (error) 680 goto out_mnt_unlock; 681 error = security_path_chmod(path, mode); 682 if (error) 683 goto out_unlock; 684 newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO); 685 newattrs.ia_valid = ATTR_MODE | ATTR_CTIME; 686 error = notify_change(mnt_idmap(path->mnt), path->dentry, 687 &newattrs, &delegated_inode); 688 out_unlock: 689 inode_unlock(inode); 690 if (is_delegated(&delegated_inode)) { 691 error = break_deleg_wait(&delegated_inode); 692 if (!error) 693 goto retry_deleg; 694 } 695 out_mnt_unlock: 696 mnt_drop_write(path->mnt); 697 return error; 698 } 699 700 int vfs_fchmod(struct file *file, umode_t mode) 701 { 702 audit_file(file); 703 return chmod_common(&file->f_path, mode); 704 } 705 706 SYSCALL_DEFINE2(fchmod, unsigned int, fd, umode_t, mode) 707 { 708 CLASS(fd, f)(fd); 709 710 if (fd_empty(f)) 711 return -EBADF; 712 713 return vfs_fchmod(fd_file(f), mode); 714 } 715 716 static int do_fchmodat(int dfd, const char __user *filename, umode_t mode, 717 unsigned int flags) 718 { 719 struct path path; 720 int error; 721 unsigned int lookup_flags; 722 723 if (unlikely(flags & ~(AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH))) 724 return -EINVAL; 725 726 lookup_flags = (flags & AT_SYMLINK_NOFOLLOW) ? 0 : LOOKUP_FOLLOW; 727 CLASS(filename_uflags, name)(filename, flags); 728 retry: 729 error = filename_lookup(dfd, name, lookup_flags, &path, NULL); 730 if (!error) { 731 error = chmod_common(&path, mode); 732 path_put(&path); 733 if (retry_estale(error, lookup_flags)) { 734 lookup_flags |= LOOKUP_REVAL; 735 goto retry; 736 } 737 } 738 return error; 739 } 740 741 SYSCALL_DEFINE4(fchmodat2, int, dfd, const char __user *, filename, 742 umode_t, mode, unsigned int, flags) 743 { 744 return do_fchmodat(dfd, filename, mode, flags); 745 } 746 747 SYSCALL_DEFINE3(fchmodat, int, dfd, const char __user *, filename, 748 umode_t, mode) 749 { 750 return do_fchmodat(dfd, filename, mode, 0); 751 } 752 753 SYSCALL_DEFINE2(chmod, const char __user *, filename, umode_t, mode) 754 { 755 return do_fchmodat(AT_FDCWD, filename, mode, 0); 756 } 757 758 /* 759 * Check whether @kuid is valid and if so generate and set vfsuid_t in 760 * ia_vfsuid. 761 * 762 * Return: true if @kuid is valid, false if not. 763 */ 764 static inline bool setattr_vfsuid(struct iattr *attr, kuid_t kuid) 765 { 766 if (!uid_valid(kuid)) 767 return false; 768 attr->ia_valid |= ATTR_UID; 769 attr->ia_vfsuid = VFSUIDT_INIT(kuid); 770 return true; 771 } 772 773 /* 774 * Check whether @kgid is valid and if so generate and set vfsgid_t in 775 * ia_vfsgid. 776 * 777 * Return: true if @kgid is valid, false if not. 778 */ 779 static inline bool setattr_vfsgid(struct iattr *attr, kgid_t kgid) 780 { 781 if (!gid_valid(kgid)) 782 return false; 783 attr->ia_valid |= ATTR_GID; 784 attr->ia_vfsgid = VFSGIDT_INIT(kgid); 785 return true; 786 } 787 788 int chown_common(const struct path *path, uid_t user, gid_t group) 789 { 790 struct mnt_idmap *idmap; 791 struct user_namespace *fs_userns; 792 struct inode *inode = path->dentry->d_inode; 793 struct delegated_inode delegated_inode = { }; 794 int error; 795 struct iattr newattrs; 796 kuid_t uid; 797 kgid_t gid; 798 799 uid = make_kuid(current_user_ns(), user); 800 gid = make_kgid(current_user_ns(), group); 801 802 idmap = mnt_idmap(path->mnt); 803 fs_userns = i_user_ns(inode); 804 805 retry_deleg: 806 newattrs.ia_vfsuid = INVALID_VFSUID; 807 newattrs.ia_vfsgid = INVALID_VFSGID; 808 newattrs.ia_valid = ATTR_CTIME; 809 if ((user != (uid_t)-1) && !setattr_vfsuid(&newattrs, uid)) 810 return -EINVAL; 811 if ((group != (gid_t)-1) && !setattr_vfsgid(&newattrs, gid)) 812 return -EINVAL; 813 error = inode_lock_killable(inode); 814 if (error) 815 return error; 816 if (!S_ISDIR(inode->i_mode)) 817 newattrs.ia_valid |= ATTR_KILL_SUID | ATTR_KILL_PRIV | 818 setattr_should_drop_sgid(idmap, inode); 819 /* Continue to send actual fs values, not the mount values. */ 820 error = security_path_chown( 821 path, 822 from_vfsuid(idmap, fs_userns, newattrs.ia_vfsuid), 823 from_vfsgid(idmap, fs_userns, newattrs.ia_vfsgid)); 824 if (!error) 825 error = notify_change(idmap, path->dentry, &newattrs, 826 &delegated_inode); 827 inode_unlock(inode); 828 if (is_delegated(&delegated_inode)) { 829 error = break_deleg_wait(&delegated_inode); 830 if (!error) 831 goto retry_deleg; 832 } 833 return error; 834 } 835 836 int do_fchownat(int dfd, const char __user *filename, uid_t user, gid_t group, 837 int flag) 838 { 839 struct path path; 840 int error; 841 int lookup_flags; 842 843 if ((flag & ~(AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH)) != 0) 844 return -EINVAL; 845 846 lookup_flags = (flag & AT_SYMLINK_NOFOLLOW) ? 0 : LOOKUP_FOLLOW; 847 CLASS(filename_uflags, name)(filename, flag); 848 retry: 849 error = filename_lookup(dfd, name, lookup_flags, &path, NULL); 850 if (!error) { 851 error = mnt_want_write(path.mnt); 852 if (!error) { 853 error = chown_common(&path, user, group); 854 mnt_drop_write(path.mnt); 855 } 856 path_put(&path); 857 if (retry_estale(error, lookup_flags)) { 858 lookup_flags |= LOOKUP_REVAL; 859 goto retry; 860 } 861 } 862 return error; 863 } 864 865 SYSCALL_DEFINE5(fchownat, int, dfd, const char __user *, filename, uid_t, user, 866 gid_t, group, int, flag) 867 { 868 return do_fchownat(dfd, filename, user, group, flag); 869 } 870 871 SYSCALL_DEFINE3(chown, const char __user *, filename, uid_t, user, gid_t, group) 872 { 873 return do_fchownat(AT_FDCWD, filename, user, group, 0); 874 } 875 876 SYSCALL_DEFINE3(lchown, const char __user *, filename, uid_t, user, gid_t, group) 877 { 878 return do_fchownat(AT_FDCWD, filename, user, group, 879 AT_SYMLINK_NOFOLLOW); 880 } 881 882 int vfs_fchown(struct file *file, uid_t user, gid_t group) 883 { 884 int error; 885 886 error = mnt_want_write_file(file); 887 if (error) 888 return error; 889 audit_file(file); 890 error = chown_common(&file->f_path, user, group); 891 mnt_drop_write_file(file); 892 return error; 893 } 894 895 int ksys_fchown(unsigned int fd, uid_t user, gid_t group) 896 { 897 CLASS(fd, f)(fd); 898 899 if (fd_empty(f)) 900 return -EBADF; 901 902 return vfs_fchown(fd_file(f), user, group); 903 } 904 905 SYSCALL_DEFINE3(fchown, unsigned int, fd, uid_t, user, gid_t, group) 906 { 907 return ksys_fchown(fd, user, group); 908 } 909 910 static inline int file_get_write_access(struct file *f) 911 { 912 int error; 913 914 error = get_write_access(f->f_inode); 915 if (unlikely(error)) 916 return error; 917 error = mnt_get_write_access(f->f_path.mnt); 918 if (unlikely(error)) 919 goto cleanup_inode; 920 if (unlikely(f->f_mode & FMODE_BACKING)) { 921 error = mnt_get_write_access(backing_file_user_path(f)->mnt); 922 if (unlikely(error)) 923 goto cleanup_mnt; 924 } 925 return 0; 926 927 cleanup_mnt: 928 mnt_put_write_access(f->f_path.mnt); 929 cleanup_inode: 930 put_write_access(f->f_inode); 931 return error; 932 } 933 934 static int do_dentry_open(struct file *f, 935 int (*open)(struct inode *, struct file *)) 936 { 937 static const struct file_operations empty_fops = {}; 938 struct inode *inode = f->f_path.dentry->d_inode; 939 int error; 940 941 path_get(&f->f_path); 942 f->f_inode = inode; 943 f->f_mapping = inode->i_mapping; 944 f->f_wb_err = filemap_sample_wb_err(f->f_mapping); 945 f->f_sb_err = file_sample_sb_err(f); 946 947 if (unlikely(f->f_flags & O_PATH)) { 948 f->f_mode = FMODE_PATH | FMODE_OPENED; 949 file_set_fsnotify_mode(f, FMODE_NONOTIFY); 950 f->f_op = &empty_fops; 951 return 0; 952 } 953 954 if ((f->f_mode & (FMODE_READ | FMODE_WRITE)) == FMODE_READ) { 955 i_readcount_inc(inode); 956 } else if (f->f_mode & FMODE_WRITE && !special_file(inode->i_mode)) { 957 error = file_get_write_access(f); 958 if (unlikely(error)) 959 goto cleanup_file; 960 f->f_mode |= FMODE_WRITER; 961 } 962 963 /* POSIX.1-2008/SUSv4 Section XSI 2.9.7 */ 964 if (S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode)) 965 f->f_mode |= FMODE_ATOMIC_POS; 966 967 f->f_op = fops_get(inode->i_fop); 968 if (WARN_ON(!f->f_op)) { 969 error = -ENODEV; 970 goto cleanup_all; 971 } 972 973 error = security_file_open(f); 974 if (unlikely(error)) 975 goto cleanup_all; 976 977 /* 978 * Call fsnotify open permission hook and set FMODE_NONOTIFY_* bits 979 * according to existing permission watches. 980 * If FMODE_NONOTIFY mode was already set for an fanotify fd or for a 981 * pseudo file, this call will not change the mode. 982 */ 983 error = fsnotify_open_perm_and_set_mode(f); 984 if (unlikely(error)) 985 goto cleanup_all; 986 987 error = break_lease(file_inode(f), f->f_flags); 988 if (unlikely(error)) 989 goto cleanup_all; 990 991 /* normally all 3 are set; ->open() can clear them if needed */ 992 f->f_mode |= FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE; 993 if (!open) 994 open = f->f_op->open; 995 if (open) { 996 error = open(inode, f); 997 if (error) 998 goto cleanup_all; 999 } 1000 f->f_mode |= FMODE_OPENED; 1001 if ((f->f_mode & FMODE_READ) && 1002 likely(f->f_op->read || f->f_op->read_iter)) 1003 f->f_mode |= FMODE_CAN_READ; 1004 if ((f->f_mode & FMODE_WRITE) && 1005 likely(f->f_op->write || f->f_op->write_iter)) 1006 f->f_mode |= FMODE_CAN_WRITE; 1007 if ((f->f_mode & FMODE_LSEEK) && !f->f_op->llseek) 1008 f->f_mode &= ~FMODE_LSEEK; 1009 if (f->f_mapping->a_ops && f->f_mapping->a_ops->direct_IO) 1010 f->f_mode |= FMODE_CAN_ODIRECT; 1011 1012 f->f_flags &= ~(O_CREAT | O_EXCL | O_NOCTTY | O_TRUNC | __O_REGULAR); 1013 f->f_iocb_flags = iocb_flags(f); 1014 1015 file_ra_state_init(&f->f_ra, f->f_mapping->host->i_mapping); 1016 1017 if ((f->f_flags & O_DIRECT) && !(f->f_mode & FMODE_CAN_ODIRECT)) 1018 return -EINVAL; 1019 1020 return 0; 1021 1022 cleanup_all: 1023 if (WARN_ON_ONCE(error > 0)) 1024 error = -EINVAL; 1025 fops_put(f->f_op); 1026 put_file_access(f); 1027 cleanup_file: 1028 path_put(&f->f_path); 1029 f->__f_path.mnt = NULL; 1030 f->__f_path.dentry = NULL; 1031 f->f_inode = NULL; 1032 return error; 1033 } 1034 1035 /** 1036 * finish_open - finish opening a file 1037 * @file: file pointer 1038 * @dentry: pointer to dentry 1039 * @open: open callback 1040 * 1041 * This can be used to finish opening a file passed to i_op->atomic_open(). 1042 * 1043 * If the open callback is set to NULL, then the standard f_op->open() 1044 * filesystem callback is substituted. 1045 * 1046 * NB: the dentry reference is _not_ consumed. If, for example, the dentry is 1047 * the return value of d_splice_alias(), then the caller needs to perform dput() 1048 * on it after finish_open(). 1049 * 1050 * Returns zero on success or -errno if the open failed. 1051 */ 1052 int finish_open(struct file *file, struct dentry *dentry, 1053 int (*open)(struct inode *, struct file *)) 1054 { 1055 BUG_ON(file->f_mode & FMODE_OPENED); /* once it's opened, it's opened */ 1056 1057 file->__f_path.dentry = dentry; 1058 return do_dentry_open(file, open); 1059 } 1060 EXPORT_SYMBOL(finish_open); 1061 1062 /** 1063 * finish_no_open - finish ->atomic_open() without opening the file 1064 * 1065 * @file: file pointer 1066 * @dentry: dentry, ERR_PTR(-E...) or NULL (as returned from ->lookup()) 1067 * 1068 * This can be used to set the result of a lookup in ->atomic_open(). 1069 * 1070 * NB: unlike finish_open() this function does consume the dentry reference and 1071 * the caller need not dput() it. 1072 * 1073 * Returns 0 or -E..., which must be the return value of ->atomic_open() after 1074 * having called this function. 1075 */ 1076 int finish_no_open(struct file *file, struct dentry *dentry) 1077 { 1078 if (IS_ERR(dentry)) 1079 return PTR_ERR(dentry); 1080 file->__f_path.dentry = dentry; 1081 return 0; 1082 } 1083 EXPORT_SYMBOL(finish_no_open); 1084 1085 char *file_path(struct file *filp, char *buf, int buflen) 1086 { 1087 return d_path(&filp->f_path, buf, buflen); 1088 } 1089 EXPORT_SYMBOL(file_path); 1090 1091 /** 1092 * vfs_open - open the file at the given path 1093 * @path: path to open 1094 * @file: newly allocated file with f_flag initialized 1095 */ 1096 int vfs_open(const struct path *path, struct file *file) 1097 { 1098 int ret; 1099 1100 file->__f_path = *path; 1101 ret = do_dentry_open(file, NULL); 1102 if (!ret) { 1103 /* 1104 * Once we return a file with FMODE_OPENED, __fput() will call 1105 * fsnotify_close(), so we need fsnotify_open() here for 1106 * symmetry. 1107 */ 1108 fsnotify_open(file); 1109 } 1110 return ret; 1111 } 1112 1113 struct file *dentry_open(const struct path *path, int flags, 1114 const struct cred *cred) 1115 { 1116 int error; 1117 struct file *f; 1118 1119 /* We must always pass in a valid mount pointer. */ 1120 BUG_ON(!path->mnt); 1121 1122 f = alloc_empty_file(flags, cred); 1123 if (!IS_ERR(f)) { 1124 error = vfs_open(path, f); 1125 if (error) { 1126 fput(f); 1127 f = ERR_PTR(error); 1128 } 1129 } 1130 return f; 1131 } 1132 EXPORT_SYMBOL(dentry_open); 1133 1134 struct file *dentry_open_nonotify(const struct path *path, int flags, 1135 const struct cred *cred) 1136 { 1137 struct file *f = alloc_empty_file(flags, cred); 1138 if (!IS_ERR(f)) { 1139 int error; 1140 1141 file_set_fsnotify_mode(f, FMODE_NONOTIFY); 1142 error = vfs_open(path, f); 1143 if (error) { 1144 fput(f); 1145 f = ERR_PTR(error); 1146 } 1147 } 1148 return f; 1149 } 1150 1151 /** 1152 * kernel_file_open - open a file for kernel internal use 1153 * @path: path of the file to open 1154 * @flags: open flags 1155 * @cred: credentials for open 1156 * 1157 * Open a file for use by in-kernel consumers. The file is not accounted 1158 * against nr_files and must not be installed into the file descriptor 1159 * table. 1160 * 1161 * Return: Opened file on success, an error pointer on failure. 1162 */ 1163 struct file *kernel_file_open(const struct path *path, int flags, 1164 const struct cred *cred) 1165 { 1166 struct file *f; 1167 int error; 1168 1169 f = alloc_empty_file_noaccount(flags, cred); 1170 if (IS_ERR(f)) 1171 return f; 1172 1173 error = vfs_open(path, f); 1174 if (error) { 1175 fput(f); 1176 return ERR_PTR(error); 1177 } 1178 return f; 1179 } 1180 EXPORT_SYMBOL_GPL(kernel_file_open); 1181 1182 #define WILL_CREATE(flags) (flags & (O_CREAT | __O_TMPFILE)) 1183 #define O_PATH_FLAGS (O_DIRECTORY | O_NOFOLLOW | O_PATH | O_CLOEXEC | O_EMPTYPATH) 1184 1185 inline struct open_how build_open_how(int flags, umode_t mode) 1186 { 1187 struct open_how how = { 1188 .flags = flags & VALID_OPEN_FLAGS, 1189 .mode = mode & S_IALLUGO, 1190 }; 1191 1192 /* O_PATH beats everything else. */ 1193 if (how.flags & O_PATH) 1194 how.flags &= O_PATH_FLAGS; 1195 /* Modes should only be set for create-like flags. */ 1196 if (!WILL_CREATE(how.flags)) 1197 how.mode = 0; 1198 return how; 1199 } 1200 1201 inline int build_open_flags(const struct open_how *how, struct open_flags *op) 1202 { 1203 u64 flags = how->flags; 1204 u64 strip = O_CLOEXEC; 1205 int lookup_flags = 0; 1206 int acc_mode = ACC_MODE(flags); 1207 1208 BUILD_BUG_ON_MSG(upper_32_bits(VALID_OPEN_FLAGS), 1209 "VALID_OPEN_FLAGS must fit in 32 bits"); 1210 /* The whole point: OPENAT2_REGULAR must be unrepresentable in int. */ 1211 BUILD_BUG_ON_MSG(!upper_32_bits(OPENAT2_REGULAR), 1212 "OPENAT2_REGULAR must live in the upper 32 bits of open_how::flags"); 1213 /* Prevent a future bit collision between UAPI and internal carrier. */ 1214 BUILD_BUG_ON_MSG(OPENAT2_REGULAR & VALID_OPEN_FLAGS, 1215 "OPENAT2_REGULAR must not alias any open()/openat() flag"); 1216 BUILD_BUG_ON_MSG(__O_REGULAR & VALID_OPENAT2_FLAGS, 1217 "__O_REGULAR must not alias any user-visible flag"); 1218 1219 /* 1220 * Strip flags that aren't relevant in determining struct open_flags. 1221 */ 1222 flags &= ~strip; 1223 1224 /* 1225 * Older syscalls implicitly clear all of the invalid flags or argument 1226 * values before calling build_open_flags(), but openat2(2) checks all 1227 * of its arguments. 1228 */ 1229 if (flags & ~VALID_OPENAT2_FLAGS) 1230 return -EINVAL; 1231 if (how->resolve & ~VALID_RESOLVE_FLAGS) 1232 return -EINVAL; 1233 1234 /* Scoping flags are mutually exclusive. */ 1235 if ((how->resolve & RESOLVE_BENEATH) && (how->resolve & RESOLVE_IN_ROOT)) 1236 return -EINVAL; 1237 1238 /* Deal with the mode. */ 1239 if (WILL_CREATE(flags)) { 1240 if (how->mode & ~S_IALLUGO) 1241 return -EINVAL; 1242 op->mode = how->mode | S_IFREG; 1243 } else { 1244 if (how->mode != 0) 1245 return -EINVAL; 1246 op->mode = 0; 1247 } 1248 1249 /* 1250 * Block bugs where O_DIRECTORY | O_CREAT created regular files. 1251 * Note, that blocking O_DIRECTORY | O_CREAT here also protects 1252 * O_TMPFILE below which requires O_DIRECTORY being raised. 1253 */ 1254 if ((flags & (O_DIRECTORY | O_CREAT)) == (O_DIRECTORY | O_CREAT)) 1255 return -EINVAL; 1256 1257 /* Now handle the creative implementation of O_TMPFILE. */ 1258 if (flags & __O_TMPFILE) { 1259 /* 1260 * In order to ensure programs get explicit errors when trying 1261 * to use O_TMPFILE on old kernels we enforce that O_DIRECTORY 1262 * is raised alongside __O_TMPFILE. 1263 */ 1264 if (!(flags & O_DIRECTORY)) 1265 return -EINVAL; 1266 if (!(acc_mode & MAY_WRITE)) 1267 return -EINVAL; 1268 } 1269 /* 1270 * Asking to open a directory and a regular file at the same time is 1271 * contradictory. 1272 */ 1273 if ((flags & (O_DIRECTORY | OPENAT2_REGULAR)) == 1274 (O_DIRECTORY | OPENAT2_REGULAR)) 1275 return -EINVAL; 1276 1277 if (flags & O_PATH) { 1278 /* O_PATH only permits certain other flags to be set. */ 1279 if (flags & ~O_PATH_FLAGS) 1280 return -EINVAL; 1281 acc_mode = 0; 1282 } 1283 1284 /* 1285 * O_SYNC is implemented as __O_SYNC|O_DSYNC. As many places only 1286 * check for O_DSYNC if the need any syncing at all we enforce it's 1287 * always set instead of having to deal with possibly weird behaviour 1288 * for malicious applications setting only __O_SYNC. 1289 */ 1290 if (flags & __O_SYNC) 1291 flags |= O_DSYNC; 1292 1293 /* 1294 * Translate the upper-32-bit UAPI bit OPENAT2_REGULAR into the 1295 * kernel-internal lower-32-bit __O_REGULAR carrier so the bit 1296 * survives the assignment to op->open_flag (an int) below and the 1297 * subsequent flow through f->f_flags (unsigned int) and the 1298 * i_op->atomic_open() callback (unsigned). do_dentry_open() strips 1299 * __O_REGULAR before the file becomes visible to userspace. 1300 */ 1301 if (flags & OPENAT2_REGULAR) { 1302 flags &= ~OPENAT2_REGULAR; 1303 flags |= __O_REGULAR; 1304 } 1305 1306 op->open_flag = flags; 1307 1308 /* O_TRUNC implies we need access checks for write permissions */ 1309 if (flags & O_TRUNC) 1310 acc_mode |= MAY_WRITE; 1311 1312 /* Allow the LSM permission hook to distinguish append 1313 access from general write access. */ 1314 if (flags & O_APPEND) 1315 acc_mode |= MAY_APPEND; 1316 1317 op->acc_mode = acc_mode; 1318 1319 op->intent = flags & O_PATH ? 0 : LOOKUP_OPEN; 1320 1321 if (flags & O_CREAT) { 1322 op->intent |= LOOKUP_CREATE; 1323 if (flags & O_EXCL) { 1324 op->intent |= LOOKUP_EXCL; 1325 flags |= O_NOFOLLOW; 1326 } 1327 } 1328 1329 if (flags & O_DIRECTORY) 1330 lookup_flags |= LOOKUP_DIRECTORY; 1331 if (!(flags & O_NOFOLLOW)) 1332 lookup_flags |= LOOKUP_FOLLOW; 1333 if (flags & O_EMPTYPATH) 1334 lookup_flags |= LOOKUP_EMPTY; 1335 1336 if (how->resolve & RESOLVE_NO_XDEV) 1337 lookup_flags |= LOOKUP_NO_XDEV; 1338 if (how->resolve & RESOLVE_NO_MAGICLINKS) 1339 lookup_flags |= LOOKUP_NO_MAGICLINKS; 1340 if (how->resolve & RESOLVE_NO_SYMLINKS) 1341 lookup_flags |= LOOKUP_NO_SYMLINKS; 1342 if (how->resolve & RESOLVE_BENEATH) 1343 lookup_flags |= LOOKUP_BENEATH; 1344 if (how->resolve & RESOLVE_IN_ROOT) 1345 lookup_flags |= LOOKUP_IN_ROOT; 1346 if (how->resolve & RESOLVE_CACHED) { 1347 /* Don't bother even trying for create/truncate/tmpfile open */ 1348 if (flags & (O_TRUNC | O_CREAT | __O_TMPFILE)) 1349 return -EAGAIN; 1350 lookup_flags |= LOOKUP_CACHED; 1351 } 1352 1353 op->lookup_flags = lookup_flags; 1354 return 0; 1355 } 1356 1357 /** 1358 * file_open_name - open file and return file pointer 1359 * 1360 * @name: struct filename containing path to open 1361 * @flags: open flags as per the open(2) second argument 1362 * @mode: mode for the new file if O_CREAT is set, else ignored 1363 * 1364 * This is the helper to open a file from kernelspace if you really 1365 * have to. But in generally you should not do this, so please move 1366 * along, nothing to see here.. 1367 */ 1368 struct file *file_open_name(struct filename *name, int flags, umode_t mode) 1369 { 1370 struct open_flags op; 1371 struct open_how how = build_open_how(flags, mode); 1372 int err = build_open_flags(&how, &op); 1373 if (err) 1374 return ERR_PTR(err); 1375 return do_file_open(AT_FDCWD, name, &op); 1376 } 1377 1378 /** 1379 * filp_open - open file and return file pointer 1380 * 1381 * @filename: path to open 1382 * @flags: open flags as per the open(2) second argument 1383 * @mode: mode for the new file if O_CREAT is set, else ignored 1384 * 1385 * This is the helper to open a file from kernelspace if you really 1386 * have to. But in generally you should not do this, so please move 1387 * along, nothing to see here.. 1388 */ 1389 struct file *filp_open(const char *filename, int flags, umode_t mode) 1390 { 1391 CLASS(filename_kernel, name)(filename); 1392 return file_open_name(name, flags, mode); 1393 } 1394 EXPORT_SYMBOL(filp_open); 1395 1396 struct file *file_open_root(const struct path *root, 1397 const char *filename, int flags, umode_t mode) 1398 { 1399 struct open_flags op; 1400 struct open_how how = build_open_how(flags, mode); 1401 int err = build_open_flags(&how, &op); 1402 if (err) 1403 return ERR_PTR(err); 1404 return do_file_open_root(root, filename, &op); 1405 } 1406 EXPORT_SYMBOL(file_open_root); 1407 1408 static int do_sys_openat2(int dfd, const char __user *filename, 1409 struct open_how *how) 1410 { 1411 struct open_flags op; 1412 int err = build_open_flags(how, &op); 1413 if (unlikely(err)) 1414 return err; 1415 1416 CLASS(filename_flags, name)(filename, op.lookup_flags); 1417 return FD_ADD(how->flags, do_file_open(dfd, name, &op)); 1418 } 1419 1420 int do_sys_open(int dfd, const char __user *filename, int flags, umode_t mode) 1421 { 1422 struct open_how how = build_open_how(flags, mode); 1423 return do_sys_openat2(dfd, filename, &how); 1424 } 1425 1426 1427 SYSCALL_DEFINE3(open, const char __user *, filename, int, flags, umode_t, mode) 1428 { 1429 if (force_o_largefile()) 1430 flags |= O_LARGEFILE; 1431 return do_sys_open(AT_FDCWD, filename, flags, mode); 1432 } 1433 1434 SYSCALL_DEFINE4(openat, int, dfd, const char __user *, filename, int, flags, 1435 umode_t, mode) 1436 { 1437 if (force_o_largefile()) 1438 flags |= O_LARGEFILE; 1439 return do_sys_open(dfd, filename, flags, mode); 1440 } 1441 1442 SYSCALL_DEFINE4(openat2, int, dfd, const char __user *, filename, 1443 struct open_how __user *, how, size_t, usize) 1444 { 1445 int err; 1446 struct open_how tmp; 1447 1448 BUILD_BUG_ON(sizeof(struct open_how) < OPEN_HOW_SIZE_VER0); 1449 BUILD_BUG_ON(sizeof(struct open_how) != OPEN_HOW_SIZE_LATEST); 1450 1451 if (unlikely(usize < OPEN_HOW_SIZE_VER0)) 1452 return -EINVAL; 1453 if (unlikely(usize > PAGE_SIZE)) 1454 return -E2BIG; 1455 1456 err = copy_struct_from_user(&tmp, sizeof(tmp), how, usize); 1457 if (err) 1458 return err; 1459 1460 audit_openat2_how(&tmp); 1461 1462 /* O_LARGEFILE is only allowed for non-O_PATH. */ 1463 if (!(tmp.flags & O_PATH) && force_o_largefile()) 1464 tmp.flags |= O_LARGEFILE; 1465 1466 return do_sys_openat2(dfd, filename, &tmp); 1467 } 1468 1469 #ifdef CONFIG_COMPAT 1470 /* 1471 * Exactly like sys_open(), except that it doesn't set the 1472 * O_LARGEFILE flag. 1473 */ 1474 COMPAT_SYSCALL_DEFINE3(open, const char __user *, filename, int, flags, umode_t, mode) 1475 { 1476 return do_sys_open(AT_FDCWD, filename, flags, mode); 1477 } 1478 1479 /* 1480 * Exactly like sys_openat(), except that it doesn't set the 1481 * O_LARGEFILE flag. 1482 */ 1483 COMPAT_SYSCALL_DEFINE4(openat, int, dfd, const char __user *, filename, int, flags, umode_t, mode) 1484 { 1485 return do_sys_open(dfd, filename, flags, mode); 1486 } 1487 #endif 1488 1489 #ifndef __alpha__ 1490 1491 /* 1492 * For backward compatibility? Maybe this should be moved 1493 * into arch/i386 instead? 1494 */ 1495 SYSCALL_DEFINE2(creat, const char __user *, pathname, umode_t, mode) 1496 { 1497 int flags = O_CREAT | O_WRONLY | O_TRUNC; 1498 1499 if (force_o_largefile()) 1500 flags |= O_LARGEFILE; 1501 return do_sys_open(AT_FDCWD, pathname, flags, mode); 1502 } 1503 #endif 1504 1505 /* 1506 * "id" is the POSIX thread ID. We use the 1507 * files pointer for this.. 1508 */ 1509 static int filp_flush(struct file *filp, fl_owner_t id) 1510 { 1511 int retval = 0; 1512 1513 if (CHECK_DATA_CORRUPTION(file_count(filp) == 0, filp, 1514 "VFS: Close: file count is 0 (f_op=%ps)", 1515 filp->f_op)) { 1516 return 0; 1517 } 1518 1519 if (filp->f_op->flush) 1520 retval = filp->f_op->flush(filp, id); 1521 1522 if (likely(!(filp->f_mode & FMODE_PATH))) { 1523 dnotify_flush(filp, id); 1524 locks_remove_posix(filp, id); 1525 } 1526 return retval; 1527 } 1528 1529 int filp_close(struct file *filp, fl_owner_t id) 1530 { 1531 int retval; 1532 1533 retval = filp_flush(filp, id); 1534 fput_close(filp); 1535 1536 return retval; 1537 } 1538 EXPORT_SYMBOL(filp_close); 1539 1540 /* 1541 * Careful here! We test whether the file pointer is NULL before 1542 * releasing the fd. This ensures that one clone task can't release 1543 * an fd while another clone is opening it. 1544 */ 1545 SYSCALL_DEFINE1(close, unsigned int, fd) 1546 { 1547 int retval; 1548 struct file *file; 1549 1550 file = file_close_fd(fd); 1551 if (!file) 1552 return -EBADF; 1553 1554 retval = filp_flush(file, current->files); 1555 1556 /* 1557 * We're returning to user space. Don't bother 1558 * with any delayed fput() cases. 1559 */ 1560 fput_close_sync(file); 1561 1562 if (likely(retval == 0)) 1563 return 0; 1564 1565 /* can't restart close syscall because file table entry was cleared */ 1566 if (retval == -ERESTARTSYS || 1567 retval == -ERESTARTNOINTR || 1568 retval == -ERESTARTNOHAND || 1569 retval == -ERESTART_RESTARTBLOCK) 1570 retval = -EINTR; 1571 1572 return retval; 1573 } 1574 1575 /* 1576 * This routine simulates a hangup on the tty, to arrange that users 1577 * are given clean terminals at login time. 1578 */ 1579 SYSCALL_DEFINE0(vhangup) 1580 { 1581 if (capable(CAP_SYS_TTY_CONFIG)) { 1582 tty_vhangup_self(); 1583 return 0; 1584 } 1585 return -EPERM; 1586 } 1587 1588 /* 1589 * Called when an inode is about to be open. 1590 * We use this to disallow opening large files on 32bit systems if 1591 * the caller didn't specify O_LARGEFILE. On 64bit systems we force 1592 * on this flag in sys_open. 1593 */ 1594 int generic_file_open(struct inode * inode, struct file * filp) 1595 { 1596 if (!(filp->f_flags & O_LARGEFILE) && i_size_read(inode) > MAX_NON_LFS) 1597 return -EOVERFLOW; 1598 return 0; 1599 } 1600 1601 EXPORT_SYMBOL(generic_file_open); 1602 1603 /* 1604 * This is used by subsystems that don't want seekable 1605 * file descriptors. The function is not supposed to ever fail, the only 1606 * reason it returns an 'int' and not 'void' is so that it can be plugged 1607 * directly into file_operations structure. 1608 */ 1609 int nonseekable_open(struct inode *inode, struct file *filp) 1610 { 1611 filp->f_mode &= ~(FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE); 1612 return 0; 1613 } 1614 1615 EXPORT_SYMBOL(nonseekable_open); 1616 1617 /* 1618 * stream_open is used by subsystems that want stream-like file descriptors. 1619 * Such file descriptors are not seekable and don't have notion of position 1620 * (file.f_pos is always 0 and ppos passed to .read()/.write() is always NULL). 1621 * Contrary to file descriptors of other regular files, .read() and .write() 1622 * can run simultaneously. 1623 * 1624 * stream_open never fails and is marked to return int so that it could be 1625 * directly used as file_operations.open . 1626 */ 1627 int stream_open(struct inode *inode, struct file *filp) 1628 { 1629 filp->f_mode &= ~(FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE | FMODE_ATOMIC_POS); 1630 filp->f_mode |= FMODE_STREAM; 1631 return 0; 1632 } 1633 1634 EXPORT_SYMBOL(stream_open); 1635