1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * linux/fs/open.c 4 * 5 * Copyright (C) 1991, 1992 Linus Torvalds 6 */ 7 8 #include <linux/string.h> 9 #include <linux/mm.h> 10 #include <linux/file.h> 11 #include <linux/fdtable.h> 12 #include <linux/fsnotify.h> 13 #include <linux/module.h> 14 #include <linux/tty.h> 15 #include <linux/namei.h> 16 #include <linux/backing-dev.h> 17 #include <linux/capability.h> 18 #include <linux/securebits.h> 19 #include <linux/security.h> 20 #include <linux/mount.h> 21 #include <linux/fcntl.h> 22 #include <linux/slab.h> 23 #include <linux/uaccess.h> 24 #include <linux/fs.h> 25 #include <linux/personality.h> 26 #include <linux/pagemap.h> 27 #include <linux/syscalls.h> 28 #include <linux/rcupdate.h> 29 #include <linux/audit.h> 30 #include <linux/falloc.h> 31 #include <linux/fs_struct.h> 32 #include <linux/dnotify.h> 33 #include <linux/compat.h> 34 #include <linux/mnt_idmapping.h> 35 #include <linux/filelock.h> 36 37 #include "internal.h" 38 39 int do_truncate(struct mnt_idmap *idmap, struct dentry *dentry, 40 loff_t length, unsigned int time_attrs, struct file *filp) 41 { 42 int ret; 43 struct iattr newattrs; 44 45 /* Not pretty: "inode->i_size" shouldn't really be signed. But it is. */ 46 if (length < 0) 47 return -EINVAL; 48 49 newattrs.ia_size = length; 50 newattrs.ia_valid = ATTR_SIZE | time_attrs; 51 if (filp) { 52 newattrs.ia_file = filp; 53 newattrs.ia_valid |= ATTR_FILE; 54 } 55 56 /* Remove suid, sgid, and file capabilities on truncate too */ 57 ret = dentry_needs_remove_privs(idmap, dentry); 58 if (ret < 0) 59 return ret; 60 if (ret) 61 newattrs.ia_valid |= ret | ATTR_FORCE; 62 63 inode_lock(dentry->d_inode); 64 /* Note any delegations or leases have already been broken: */ 65 ret = notify_change(idmap, dentry, &newattrs, NULL); 66 inode_unlock(dentry->d_inode); 67 return ret; 68 } 69 70 long vfs_truncate(const struct path *path, loff_t length) 71 { 72 struct mnt_idmap *idmap; 73 struct inode *inode; 74 long error; 75 76 inode = path->dentry->d_inode; 77 78 /* For directories it's -EISDIR, for other non-regulars - -EINVAL */ 79 if (S_ISDIR(inode->i_mode)) 80 return -EISDIR; 81 if (!S_ISREG(inode->i_mode)) 82 return -EINVAL; 83 84 idmap = mnt_idmap(path->mnt); 85 error = inode_permission(idmap, inode, MAY_WRITE); 86 if (error) 87 return error; 88 89 error = fsnotify_truncate_perm(path, length); 90 if (error) 91 return error; 92 93 error = mnt_want_write(path->mnt); 94 if (error) 95 return error; 96 97 error = -EPERM; 98 if (IS_APPEND(inode)) 99 goto mnt_drop_write_and_out; 100 101 error = get_write_access(inode); 102 if (error) 103 goto mnt_drop_write_and_out; 104 105 /* 106 * Make sure that there are no leases. get_write_access() protects 107 * against the truncate racing with a lease-granting setlease(). 108 */ 109 error = break_lease(inode, O_WRONLY); 110 if (error) 111 goto put_write_and_out; 112 113 error = security_path_truncate(path); 114 if (!error) 115 error = do_truncate(idmap, path->dentry, length, 0, NULL); 116 117 put_write_and_out: 118 put_write_access(inode); 119 mnt_drop_write_and_out: 120 mnt_drop_write(path->mnt); 121 122 return error; 123 } 124 EXPORT_SYMBOL_GPL(vfs_truncate); 125 126 long do_sys_truncate(const char __user *pathname, loff_t length) 127 { 128 unsigned int lookup_flags = LOOKUP_FOLLOW; 129 struct path path; 130 int error; 131 132 if (length < 0) /* sorry, but loff_t says... */ 133 return -EINVAL; 134 135 retry: 136 error = user_path_at(AT_FDCWD, pathname, lookup_flags, &path); 137 if (!error) { 138 error = vfs_truncate(&path, length); 139 path_put(&path); 140 } 141 if (retry_estale(error, lookup_flags)) { 142 lookup_flags |= LOOKUP_REVAL; 143 goto retry; 144 } 145 return error; 146 } 147 148 SYSCALL_DEFINE2(truncate, const char __user *, path, long, length) 149 { 150 return do_sys_truncate(path, length); 151 } 152 153 #ifdef CONFIG_COMPAT 154 COMPAT_SYSCALL_DEFINE2(truncate, const char __user *, path, compat_off_t, length) 155 { 156 return do_sys_truncate(path, length); 157 } 158 #endif 159 160 long do_ftruncate(struct file *file, loff_t length, int small) 161 { 162 struct inode *inode; 163 struct dentry *dentry; 164 int error; 165 166 /* explicitly opened as large or we are on 64-bit box */ 167 if (file->f_flags & O_LARGEFILE) 168 small = 0; 169 170 dentry = file->f_path.dentry; 171 inode = dentry->d_inode; 172 if (!S_ISREG(inode->i_mode) || !(file->f_mode & FMODE_WRITE)) 173 return -EINVAL; 174 175 /* Cannot ftruncate over 2^31 bytes without large file support */ 176 if (small && length > MAX_NON_LFS) 177 return -EINVAL; 178 179 /* Check IS_APPEND on real upper inode */ 180 if (IS_APPEND(file_inode(file))) 181 return -EPERM; 182 183 error = security_file_truncate(file); 184 if (error) 185 return error; 186 187 error = fsnotify_truncate_perm(&file->f_path, length); 188 if (error) 189 return error; 190 191 sb_start_write(inode->i_sb); 192 error = do_truncate(file_mnt_idmap(file), dentry, length, 193 ATTR_MTIME | ATTR_CTIME, file); 194 sb_end_write(inode->i_sb); 195 196 return error; 197 } 198 199 long do_sys_ftruncate(unsigned int fd, loff_t length, int small) 200 { 201 if (length < 0) 202 return -EINVAL; 203 CLASS(fd, f)(fd); 204 if (fd_empty(f)) 205 return -EBADF; 206 207 return do_ftruncate(fd_file(f), length, small); 208 } 209 210 SYSCALL_DEFINE2(ftruncate, unsigned int, fd, off_t, length) 211 { 212 return do_sys_ftruncate(fd, length, 1); 213 } 214 215 #ifdef CONFIG_COMPAT 216 COMPAT_SYSCALL_DEFINE2(ftruncate, unsigned int, fd, compat_off_t, length) 217 { 218 return do_sys_ftruncate(fd, length, 1); 219 } 220 #endif 221 222 /* LFS versions of truncate are only needed on 32 bit machines */ 223 #if BITS_PER_LONG == 32 224 SYSCALL_DEFINE2(truncate64, const char __user *, path, loff_t, length) 225 { 226 return do_sys_truncate(path, length); 227 } 228 229 SYSCALL_DEFINE2(ftruncate64, unsigned int, fd, loff_t, length) 230 { 231 return do_sys_ftruncate(fd, length, 0); 232 } 233 #endif /* BITS_PER_LONG == 32 */ 234 235 #if defined(CONFIG_COMPAT) && defined(__ARCH_WANT_COMPAT_TRUNCATE64) 236 COMPAT_SYSCALL_DEFINE3(truncate64, const char __user *, pathname, 237 compat_arg_u64_dual(length)) 238 { 239 return ksys_truncate(pathname, compat_arg_u64_glue(length)); 240 } 241 #endif 242 243 #if defined(CONFIG_COMPAT) && defined(__ARCH_WANT_COMPAT_FTRUNCATE64) 244 COMPAT_SYSCALL_DEFINE3(ftruncate64, unsigned int, fd, 245 compat_arg_u64_dual(length)) 246 { 247 return ksys_ftruncate(fd, compat_arg_u64_glue(length)); 248 } 249 #endif 250 251 int vfs_fallocate(struct file *file, int mode, loff_t offset, loff_t len) 252 { 253 struct inode *inode = file_inode(file); 254 long ret; 255 loff_t sum; 256 257 if (offset < 0 || len <= 0) 258 return -EINVAL; 259 260 if (mode & ~(FALLOC_FL_MODE_MASK | FALLOC_FL_KEEP_SIZE)) 261 return -EOPNOTSUPP; 262 263 /* 264 * Modes are exclusive, even if that is not obvious from the encoding 265 * as bit masks and the mix with the flag in the same namespace. 266 * 267 * To make things even more complicated, FALLOC_FL_ALLOCATE_RANGE is 268 * encoded as no bit set. 269 */ 270 switch (mode & FALLOC_FL_MODE_MASK) { 271 case FALLOC_FL_ALLOCATE_RANGE: 272 case FALLOC_FL_UNSHARE_RANGE: 273 case FALLOC_FL_ZERO_RANGE: 274 break; 275 case FALLOC_FL_PUNCH_HOLE: 276 if (!(mode & FALLOC_FL_KEEP_SIZE)) 277 return -EOPNOTSUPP; 278 break; 279 case FALLOC_FL_COLLAPSE_RANGE: 280 case FALLOC_FL_INSERT_RANGE: 281 if (mode & FALLOC_FL_KEEP_SIZE) 282 return -EOPNOTSUPP; 283 break; 284 default: 285 return -EOPNOTSUPP; 286 } 287 288 if (!(file->f_mode & FMODE_WRITE)) 289 return -EBADF; 290 291 /* 292 * On append-only files only space preallocation is supported. 293 */ 294 if ((mode & ~FALLOC_FL_KEEP_SIZE) && IS_APPEND(inode)) 295 return -EPERM; 296 297 if (IS_IMMUTABLE(inode)) 298 return -EPERM; 299 300 /* 301 * We cannot allow any fallocate operation on an active swapfile 302 */ 303 if (IS_SWAPFILE(inode)) 304 return -ETXTBSY; 305 306 /* 307 * Revalidate the write permissions, in case security policy has 308 * changed since the files were opened. 309 */ 310 ret = security_file_permission(file, MAY_WRITE); 311 if (ret) 312 return ret; 313 314 ret = fsnotify_file_area_perm(file, MAY_WRITE, &offset, len); 315 if (ret) 316 return ret; 317 318 if (S_ISFIFO(inode->i_mode)) 319 return -ESPIPE; 320 321 if (S_ISDIR(inode->i_mode)) 322 return -EISDIR; 323 324 if (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode)) 325 return -ENODEV; 326 327 /* Check for wraparound */ 328 if (check_add_overflow(offset, len, &sum)) 329 return -EFBIG; 330 331 if (sum > inode->i_sb->s_maxbytes) 332 return -EFBIG; 333 334 if (!file->f_op->fallocate) 335 return -EOPNOTSUPP; 336 337 file_start_write(file); 338 ret = file->f_op->fallocate(file, mode, offset, len); 339 340 /* 341 * Create inotify and fanotify events. 342 * 343 * To keep the logic simple always create events if fallocate succeeds. 344 * This implies that events are even created if the file size remains 345 * unchanged, e.g. when using flag FALLOC_FL_KEEP_SIZE. 346 */ 347 if (ret == 0) 348 fsnotify_modify(file); 349 350 file_end_write(file); 351 return ret; 352 } 353 EXPORT_SYMBOL_GPL(vfs_fallocate); 354 355 int ksys_fallocate(int fd, int mode, loff_t offset, loff_t len) 356 { 357 CLASS(fd, f)(fd); 358 359 if (fd_empty(f)) 360 return -EBADF; 361 362 return vfs_fallocate(fd_file(f), mode, offset, len); 363 } 364 365 SYSCALL_DEFINE4(fallocate, int, fd, int, mode, loff_t, offset, loff_t, len) 366 { 367 return ksys_fallocate(fd, mode, offset, len); 368 } 369 370 #if defined(CONFIG_COMPAT) && defined(__ARCH_WANT_COMPAT_FALLOCATE) 371 COMPAT_SYSCALL_DEFINE6(fallocate, int, fd, int, mode, compat_arg_u64_dual(offset), 372 compat_arg_u64_dual(len)) 373 { 374 return ksys_fallocate(fd, mode, compat_arg_u64_glue(offset), 375 compat_arg_u64_glue(len)); 376 } 377 #endif 378 379 /* 380 * access() needs to use the real uid/gid, not the effective uid/gid. 381 * We do this by temporarily clearing all FS-related capabilities and 382 * switching the fsuid/fsgid around to the real ones. 383 * 384 * Creating new credentials is expensive, so we try to skip doing it, 385 * which we can if the result would match what we already got. 386 */ 387 static bool access_need_override_creds(int flags) 388 { 389 const struct cred *cred; 390 391 if (flags & AT_EACCESS) 392 return false; 393 394 cred = current_cred(); 395 if (!uid_eq(cred->fsuid, cred->uid) || 396 !gid_eq(cred->fsgid, cred->gid)) 397 return true; 398 399 if (!issecure(SECURE_NO_SETUID_FIXUP)) { 400 kuid_t root_uid = make_kuid(cred->user_ns, 0); 401 if (!uid_eq(cred->uid, root_uid)) { 402 if (!cap_isclear(cred->cap_effective)) 403 return true; 404 } else { 405 if (!cap_isidentical(cred->cap_effective, 406 cred->cap_permitted)) 407 return true; 408 } 409 } 410 411 return false; 412 } 413 414 static const struct cred *access_override_creds(void) 415 { 416 struct cred *override_cred; 417 418 override_cred = prepare_creds(); 419 if (!override_cred) 420 return NULL; 421 422 /* 423 * XXX access_need_override_creds performs checks in hopes of skipping 424 * this work. Make sure it stays in sync if making any changes in this 425 * routine. 426 */ 427 428 override_cred->fsuid = override_cred->uid; 429 override_cred->fsgid = override_cred->gid; 430 431 if (!issecure(SECURE_NO_SETUID_FIXUP)) { 432 /* Clear the capabilities if we switch to a non-root user */ 433 kuid_t root_uid = make_kuid(override_cred->user_ns, 0); 434 if (!uid_eq(override_cred->uid, root_uid)) 435 cap_clear(override_cred->cap_effective); 436 else 437 override_cred->cap_effective = 438 override_cred->cap_permitted; 439 } 440 441 /* 442 * The new set of credentials can *only* be used in 443 * task-synchronous circumstances, and does not need 444 * RCU freeing, unless somebody then takes a separate 445 * reference to it. 446 * 447 * NOTE! This is _only_ true because this credential 448 * is used purely for override_creds() that installs 449 * it as the subjective cred. Other threads will be 450 * accessing ->real_cred, not the subjective cred. 451 * 452 * If somebody _does_ make a copy of this (using the 453 * 'get_current_cred()' function), that will clear the 454 * non_rcu field, because now that other user may be 455 * expecting RCU freeing. But normal thread-synchronous 456 * cred accesses will keep things non-racy to avoid RCU 457 * freeing. 458 */ 459 override_cred->non_rcu = 1; 460 return override_creds(override_cred); 461 } 462 463 static long do_faccessat(int dfd, const char __user *filename, int mode, int flags) 464 { 465 struct path path; 466 struct inode *inode; 467 int res; 468 unsigned int lookup_flags = LOOKUP_FOLLOW; 469 const struct cred *old_cred = NULL; 470 471 if (mode & ~S_IRWXO) /* where's F_OK, X_OK, W_OK, R_OK? */ 472 return -EINVAL; 473 474 if (flags & ~(AT_EACCESS | AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH)) 475 return -EINVAL; 476 477 if (flags & AT_SYMLINK_NOFOLLOW) 478 lookup_flags &= ~LOOKUP_FOLLOW; 479 if (flags & AT_EMPTY_PATH) 480 lookup_flags |= LOOKUP_EMPTY; 481 482 if (access_need_override_creds(flags)) { 483 old_cred = access_override_creds(); 484 if (!old_cred) 485 return -ENOMEM; 486 } 487 488 retry: 489 res = user_path_at(dfd, filename, lookup_flags, &path); 490 if (res) 491 goto out; 492 493 inode = d_backing_inode(path.dentry); 494 495 if ((mode & MAY_EXEC) && S_ISREG(inode->i_mode)) { 496 /* 497 * MAY_EXEC on regular files is denied if the fs is mounted 498 * with the "noexec" flag. 499 */ 500 res = -EACCES; 501 if (path_noexec(&path)) 502 goto out_path_release; 503 } 504 505 res = inode_permission(mnt_idmap(path.mnt), inode, mode | MAY_ACCESS); 506 /* SuS v2 requires we report a read only fs too */ 507 if (res || !(mode & S_IWOTH) || special_file(inode->i_mode)) 508 goto out_path_release; 509 /* 510 * This is a rare case where using __mnt_is_readonly() 511 * is OK without a mnt_want/drop_write() pair. Since 512 * no actual write to the fs is performed here, we do 513 * not need to telegraph to that to anyone. 514 * 515 * By doing this, we accept that this access is 516 * inherently racy and know that the fs may change 517 * state before we even see this result. 518 */ 519 if (__mnt_is_readonly(path.mnt)) 520 res = -EROFS; 521 522 out_path_release: 523 path_put(&path); 524 if (retry_estale(res, lookup_flags)) { 525 lookup_flags |= LOOKUP_REVAL; 526 goto retry; 527 } 528 out: 529 if (old_cred) 530 put_cred(revert_creds(old_cred)); 531 532 return res; 533 } 534 535 SYSCALL_DEFINE3(faccessat, int, dfd, const char __user *, filename, int, mode) 536 { 537 return do_faccessat(dfd, filename, mode, 0); 538 } 539 540 SYSCALL_DEFINE4(faccessat2, int, dfd, const char __user *, filename, int, mode, 541 int, flags) 542 { 543 return do_faccessat(dfd, filename, mode, flags); 544 } 545 546 SYSCALL_DEFINE2(access, const char __user *, filename, int, mode) 547 { 548 return do_faccessat(AT_FDCWD, filename, mode, 0); 549 } 550 551 SYSCALL_DEFINE1(chdir, const char __user *, filename) 552 { 553 struct path path; 554 int error; 555 unsigned int lookup_flags = LOOKUP_FOLLOW | LOOKUP_DIRECTORY; 556 retry: 557 error = user_path_at(AT_FDCWD, filename, lookup_flags, &path); 558 if (error) 559 goto out; 560 561 error = path_permission(&path, MAY_EXEC | MAY_CHDIR); 562 if (error) 563 goto dput_and_out; 564 565 set_fs_pwd(current->fs, &path); 566 567 dput_and_out: 568 path_put(&path); 569 if (retry_estale(error, lookup_flags)) { 570 lookup_flags |= LOOKUP_REVAL; 571 goto retry; 572 } 573 out: 574 return error; 575 } 576 577 SYSCALL_DEFINE1(fchdir, unsigned int, fd) 578 { 579 CLASS(fd_raw, f)(fd); 580 int error; 581 582 if (fd_empty(f)) 583 return -EBADF; 584 585 if (!d_can_lookup(fd_file(f)->f_path.dentry)) 586 return -ENOTDIR; 587 588 error = file_permission(fd_file(f), MAY_EXEC | MAY_CHDIR); 589 if (!error) 590 set_fs_pwd(current->fs, &fd_file(f)->f_path); 591 return error; 592 } 593 594 SYSCALL_DEFINE1(chroot, const char __user *, filename) 595 { 596 struct path path; 597 int error; 598 unsigned int lookup_flags = LOOKUP_FOLLOW | LOOKUP_DIRECTORY; 599 retry: 600 error = user_path_at(AT_FDCWD, filename, lookup_flags, &path); 601 if (error) 602 goto out; 603 604 error = path_permission(&path, MAY_EXEC | MAY_CHDIR); 605 if (error) 606 goto dput_and_out; 607 608 error = -EPERM; 609 if (!ns_capable(current_user_ns(), CAP_SYS_CHROOT)) 610 goto dput_and_out; 611 error = security_path_chroot(&path); 612 if (error) 613 goto dput_and_out; 614 615 set_fs_root(current->fs, &path); 616 error = 0; 617 dput_and_out: 618 path_put(&path); 619 if (retry_estale(error, lookup_flags)) { 620 lookup_flags |= LOOKUP_REVAL; 621 goto retry; 622 } 623 out: 624 return error; 625 } 626 627 int chmod_common(const struct path *path, umode_t mode) 628 { 629 struct inode *inode = path->dentry->d_inode; 630 struct inode *delegated_inode = NULL; 631 struct iattr newattrs; 632 int error; 633 634 error = mnt_want_write(path->mnt); 635 if (error) 636 return error; 637 retry_deleg: 638 inode_lock(inode); 639 error = security_path_chmod(path, mode); 640 if (error) 641 goto out_unlock; 642 newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO); 643 newattrs.ia_valid = ATTR_MODE | ATTR_CTIME; 644 error = notify_change(mnt_idmap(path->mnt), path->dentry, 645 &newattrs, &delegated_inode); 646 out_unlock: 647 inode_unlock(inode); 648 if (delegated_inode) { 649 error = break_deleg_wait(&delegated_inode); 650 if (!error) 651 goto retry_deleg; 652 } 653 mnt_drop_write(path->mnt); 654 return error; 655 } 656 657 int vfs_fchmod(struct file *file, umode_t mode) 658 { 659 audit_file(file); 660 return chmod_common(&file->f_path, mode); 661 } 662 663 SYSCALL_DEFINE2(fchmod, unsigned int, fd, umode_t, mode) 664 { 665 CLASS(fd, f)(fd); 666 667 if (fd_empty(f)) 668 return -EBADF; 669 670 return vfs_fchmod(fd_file(f), mode); 671 } 672 673 static int do_fchmodat(int dfd, const char __user *filename, umode_t mode, 674 unsigned int flags) 675 { 676 struct path path; 677 int error; 678 unsigned int lookup_flags; 679 680 if (unlikely(flags & ~(AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH))) 681 return -EINVAL; 682 683 lookup_flags = (flags & AT_SYMLINK_NOFOLLOW) ? 0 : LOOKUP_FOLLOW; 684 if (flags & AT_EMPTY_PATH) 685 lookup_flags |= LOOKUP_EMPTY; 686 687 retry: 688 error = user_path_at(dfd, filename, lookup_flags, &path); 689 if (!error) { 690 error = chmod_common(&path, mode); 691 path_put(&path); 692 if (retry_estale(error, lookup_flags)) { 693 lookup_flags |= LOOKUP_REVAL; 694 goto retry; 695 } 696 } 697 return error; 698 } 699 700 SYSCALL_DEFINE4(fchmodat2, int, dfd, const char __user *, filename, 701 umode_t, mode, unsigned int, flags) 702 { 703 return do_fchmodat(dfd, filename, mode, flags); 704 } 705 706 SYSCALL_DEFINE3(fchmodat, int, dfd, const char __user *, filename, 707 umode_t, mode) 708 { 709 return do_fchmodat(dfd, filename, mode, 0); 710 } 711 712 SYSCALL_DEFINE2(chmod, const char __user *, filename, umode_t, mode) 713 { 714 return do_fchmodat(AT_FDCWD, filename, mode, 0); 715 } 716 717 /* 718 * Check whether @kuid is valid and if so generate and set vfsuid_t in 719 * ia_vfsuid. 720 * 721 * Return: true if @kuid is valid, false if not. 722 */ 723 static inline bool setattr_vfsuid(struct iattr *attr, kuid_t kuid) 724 { 725 if (!uid_valid(kuid)) 726 return false; 727 attr->ia_valid |= ATTR_UID; 728 attr->ia_vfsuid = VFSUIDT_INIT(kuid); 729 return true; 730 } 731 732 /* 733 * Check whether @kgid is valid and if so generate and set vfsgid_t in 734 * ia_vfsgid. 735 * 736 * Return: true if @kgid is valid, false if not. 737 */ 738 static inline bool setattr_vfsgid(struct iattr *attr, kgid_t kgid) 739 { 740 if (!gid_valid(kgid)) 741 return false; 742 attr->ia_valid |= ATTR_GID; 743 attr->ia_vfsgid = VFSGIDT_INIT(kgid); 744 return true; 745 } 746 747 int chown_common(const struct path *path, uid_t user, gid_t group) 748 { 749 struct mnt_idmap *idmap; 750 struct user_namespace *fs_userns; 751 struct inode *inode = path->dentry->d_inode; 752 struct inode *delegated_inode = NULL; 753 int error; 754 struct iattr newattrs; 755 kuid_t uid; 756 kgid_t gid; 757 758 uid = make_kuid(current_user_ns(), user); 759 gid = make_kgid(current_user_ns(), group); 760 761 idmap = mnt_idmap(path->mnt); 762 fs_userns = i_user_ns(inode); 763 764 retry_deleg: 765 newattrs.ia_vfsuid = INVALID_VFSUID; 766 newattrs.ia_vfsgid = INVALID_VFSGID; 767 newattrs.ia_valid = ATTR_CTIME; 768 if ((user != (uid_t)-1) && !setattr_vfsuid(&newattrs, uid)) 769 return -EINVAL; 770 if ((group != (gid_t)-1) && !setattr_vfsgid(&newattrs, gid)) 771 return -EINVAL; 772 inode_lock(inode); 773 if (!S_ISDIR(inode->i_mode)) 774 newattrs.ia_valid |= ATTR_KILL_SUID | ATTR_KILL_PRIV | 775 setattr_should_drop_sgid(idmap, inode); 776 /* Continue to send actual fs values, not the mount values. */ 777 error = security_path_chown( 778 path, 779 from_vfsuid(idmap, fs_userns, newattrs.ia_vfsuid), 780 from_vfsgid(idmap, fs_userns, newattrs.ia_vfsgid)); 781 if (!error) 782 error = notify_change(idmap, path->dentry, &newattrs, 783 &delegated_inode); 784 inode_unlock(inode); 785 if (delegated_inode) { 786 error = break_deleg_wait(&delegated_inode); 787 if (!error) 788 goto retry_deleg; 789 } 790 return error; 791 } 792 793 int do_fchownat(int dfd, const char __user *filename, uid_t user, gid_t group, 794 int flag) 795 { 796 struct path path; 797 int error = -EINVAL; 798 int lookup_flags; 799 800 if ((flag & ~(AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH)) != 0) 801 goto out; 802 803 lookup_flags = (flag & AT_SYMLINK_NOFOLLOW) ? 0 : LOOKUP_FOLLOW; 804 if (flag & AT_EMPTY_PATH) 805 lookup_flags |= LOOKUP_EMPTY; 806 retry: 807 error = user_path_at(dfd, filename, lookup_flags, &path); 808 if (error) 809 goto out; 810 error = mnt_want_write(path.mnt); 811 if (error) 812 goto out_release; 813 error = chown_common(&path, user, group); 814 mnt_drop_write(path.mnt); 815 out_release: 816 path_put(&path); 817 if (retry_estale(error, lookup_flags)) { 818 lookup_flags |= LOOKUP_REVAL; 819 goto retry; 820 } 821 out: 822 return error; 823 } 824 825 SYSCALL_DEFINE5(fchownat, int, dfd, const char __user *, filename, uid_t, user, 826 gid_t, group, int, flag) 827 { 828 return do_fchownat(dfd, filename, user, group, flag); 829 } 830 831 SYSCALL_DEFINE3(chown, const char __user *, filename, uid_t, user, gid_t, group) 832 { 833 return do_fchownat(AT_FDCWD, filename, user, group, 0); 834 } 835 836 SYSCALL_DEFINE3(lchown, const char __user *, filename, uid_t, user, gid_t, group) 837 { 838 return do_fchownat(AT_FDCWD, filename, user, group, 839 AT_SYMLINK_NOFOLLOW); 840 } 841 842 int vfs_fchown(struct file *file, uid_t user, gid_t group) 843 { 844 int error; 845 846 error = mnt_want_write_file(file); 847 if (error) 848 return error; 849 audit_file(file); 850 error = chown_common(&file->f_path, user, group); 851 mnt_drop_write_file(file); 852 return error; 853 } 854 855 int ksys_fchown(unsigned int fd, uid_t user, gid_t group) 856 { 857 CLASS(fd, f)(fd); 858 859 if (fd_empty(f)) 860 return -EBADF; 861 862 return vfs_fchown(fd_file(f), user, group); 863 } 864 865 SYSCALL_DEFINE3(fchown, unsigned int, fd, uid_t, user, gid_t, group) 866 { 867 return ksys_fchown(fd, user, group); 868 } 869 870 static inline int file_get_write_access(struct file *f) 871 { 872 int error; 873 874 error = get_write_access(f->f_inode); 875 if (unlikely(error)) 876 return error; 877 error = mnt_get_write_access(f->f_path.mnt); 878 if (unlikely(error)) 879 goto cleanup_inode; 880 if (unlikely(f->f_mode & FMODE_BACKING)) { 881 error = mnt_get_write_access(backing_file_user_path(f)->mnt); 882 if (unlikely(error)) 883 goto cleanup_mnt; 884 } 885 return 0; 886 887 cleanup_mnt: 888 mnt_put_write_access(f->f_path.mnt); 889 cleanup_inode: 890 put_write_access(f->f_inode); 891 return error; 892 } 893 894 static int do_dentry_open(struct file *f, 895 int (*open)(struct inode *, struct file *)) 896 { 897 static const struct file_operations empty_fops = {}; 898 struct inode *inode = f->f_path.dentry->d_inode; 899 int error; 900 901 path_get(&f->f_path); 902 f->f_inode = inode; 903 f->f_mapping = inode->i_mapping; 904 f->f_wb_err = filemap_sample_wb_err(f->f_mapping); 905 f->f_sb_err = file_sample_sb_err(f); 906 907 if (unlikely(f->f_flags & O_PATH)) { 908 f->f_mode = FMODE_PATH | FMODE_OPENED | FMODE_NONOTIFY; 909 f->f_op = &empty_fops; 910 return 0; 911 } 912 913 if ((f->f_mode & (FMODE_READ | FMODE_WRITE)) == FMODE_READ) { 914 i_readcount_inc(inode); 915 } else if (f->f_mode & FMODE_WRITE && !special_file(inode->i_mode)) { 916 error = file_get_write_access(f); 917 if (unlikely(error)) 918 goto cleanup_file; 919 f->f_mode |= FMODE_WRITER; 920 } 921 922 /* POSIX.1-2008/SUSv4 Section XSI 2.9.7 */ 923 if (S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode)) 924 f->f_mode |= FMODE_ATOMIC_POS; 925 926 f->f_op = fops_get(inode->i_fop); 927 if (WARN_ON(!f->f_op)) { 928 error = -ENODEV; 929 goto cleanup_all; 930 } 931 932 error = security_file_open(f); 933 if (error) 934 goto cleanup_all; 935 936 /* 937 * Set FMODE_NONOTIFY_* bits according to existing permission watches. 938 * If FMODE_NONOTIFY was already set for an fanotify fd, this doesn't 939 * change anything. 940 */ 941 file_set_fsnotify_mode(f); 942 error = fsnotify_open_perm(f); 943 if (error) 944 goto cleanup_all; 945 946 error = break_lease(file_inode(f), f->f_flags); 947 if (error) 948 goto cleanup_all; 949 950 /* normally all 3 are set; ->open() can clear them if needed */ 951 f->f_mode |= FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE; 952 if (!open) 953 open = f->f_op->open; 954 if (open) { 955 error = open(inode, f); 956 if (error) 957 goto cleanup_all; 958 } 959 f->f_mode |= FMODE_OPENED; 960 if ((f->f_mode & FMODE_READ) && 961 likely(f->f_op->read || f->f_op->read_iter)) 962 f->f_mode |= FMODE_CAN_READ; 963 if ((f->f_mode & FMODE_WRITE) && 964 likely(f->f_op->write || f->f_op->write_iter)) 965 f->f_mode |= FMODE_CAN_WRITE; 966 if ((f->f_mode & FMODE_LSEEK) && !f->f_op->llseek) 967 f->f_mode &= ~FMODE_LSEEK; 968 if (f->f_mapping->a_ops && f->f_mapping->a_ops->direct_IO) 969 f->f_mode |= FMODE_CAN_ODIRECT; 970 971 f->f_flags &= ~(O_CREAT | O_EXCL | O_NOCTTY | O_TRUNC); 972 f->f_iocb_flags = iocb_flags(f); 973 974 file_ra_state_init(&f->f_ra, f->f_mapping->host->i_mapping); 975 976 if ((f->f_flags & O_DIRECT) && !(f->f_mode & FMODE_CAN_ODIRECT)) 977 return -EINVAL; 978 979 /* 980 * XXX: Huge page cache doesn't support writing yet. Drop all page 981 * cache for this file before processing writes. 982 */ 983 if (f->f_mode & FMODE_WRITE) { 984 /* 985 * Depends on full fence from get_write_access() to synchronize 986 * against collapse_file() regarding i_writecount and nr_thps 987 * updates. Ensures subsequent insertion of THPs into the page 988 * cache will fail. 989 */ 990 if (filemap_nr_thps(inode->i_mapping)) { 991 struct address_space *mapping = inode->i_mapping; 992 993 filemap_invalidate_lock(inode->i_mapping); 994 /* 995 * unmap_mapping_range just need to be called once 996 * here, because the private pages is not need to be 997 * unmapped mapping (e.g. data segment of dynamic 998 * shared libraries here). 999 */ 1000 unmap_mapping_range(mapping, 0, 0, 0); 1001 truncate_inode_pages(mapping, 0); 1002 filemap_invalidate_unlock(inode->i_mapping); 1003 } 1004 } 1005 1006 return 0; 1007 1008 cleanup_all: 1009 if (WARN_ON_ONCE(error > 0)) 1010 error = -EINVAL; 1011 fops_put(f->f_op); 1012 put_file_access(f); 1013 cleanup_file: 1014 path_put(&f->f_path); 1015 f->f_path.mnt = NULL; 1016 f->f_path.dentry = NULL; 1017 f->f_inode = NULL; 1018 return error; 1019 } 1020 1021 /** 1022 * finish_open - finish opening a file 1023 * @file: file pointer 1024 * @dentry: pointer to dentry 1025 * @open: open callback 1026 * 1027 * This can be used to finish opening a file passed to i_op->atomic_open(). 1028 * 1029 * If the open callback is set to NULL, then the standard f_op->open() 1030 * filesystem callback is substituted. 1031 * 1032 * NB: the dentry reference is _not_ consumed. If, for example, the dentry is 1033 * the return value of d_splice_alias(), then the caller needs to perform dput() 1034 * on it after finish_open(). 1035 * 1036 * Returns zero on success or -errno if the open failed. 1037 */ 1038 int finish_open(struct file *file, struct dentry *dentry, 1039 int (*open)(struct inode *, struct file *)) 1040 { 1041 BUG_ON(file->f_mode & FMODE_OPENED); /* once it's opened, it's opened */ 1042 1043 file->f_path.dentry = dentry; 1044 return do_dentry_open(file, open); 1045 } 1046 EXPORT_SYMBOL(finish_open); 1047 1048 /** 1049 * finish_no_open - finish ->atomic_open() without opening the file 1050 * 1051 * @file: file pointer 1052 * @dentry: dentry or NULL (as returned from ->lookup()) 1053 * 1054 * This can be used to set the result of a successful lookup in ->atomic_open(). 1055 * 1056 * NB: unlike finish_open() this function does consume the dentry reference and 1057 * the caller need not dput() it. 1058 * 1059 * Returns "0" which must be the return value of ->atomic_open() after having 1060 * called this function. 1061 */ 1062 int finish_no_open(struct file *file, struct dentry *dentry) 1063 { 1064 file->f_path.dentry = dentry; 1065 return 0; 1066 } 1067 EXPORT_SYMBOL(finish_no_open); 1068 1069 char *file_path(struct file *filp, char *buf, int buflen) 1070 { 1071 return d_path(&filp->f_path, buf, buflen); 1072 } 1073 EXPORT_SYMBOL(file_path); 1074 1075 /** 1076 * vfs_open - open the file at the given path 1077 * @path: path to open 1078 * @file: newly allocated file with f_flag initialized 1079 */ 1080 int vfs_open(const struct path *path, struct file *file) 1081 { 1082 int ret; 1083 1084 file->f_path = *path; 1085 ret = do_dentry_open(file, NULL); 1086 if (!ret) { 1087 /* 1088 * Once we return a file with FMODE_OPENED, __fput() will call 1089 * fsnotify_close(), so we need fsnotify_open() here for 1090 * symmetry. 1091 */ 1092 fsnotify_open(file); 1093 } 1094 return ret; 1095 } 1096 1097 struct file *dentry_open(const struct path *path, int flags, 1098 const struct cred *cred) 1099 { 1100 int error; 1101 struct file *f; 1102 1103 /* We must always pass in a valid mount pointer. */ 1104 BUG_ON(!path->mnt); 1105 1106 f = alloc_empty_file(flags, cred); 1107 if (!IS_ERR(f)) { 1108 error = vfs_open(path, f); 1109 if (error) { 1110 fput(f); 1111 f = ERR_PTR(error); 1112 } 1113 } 1114 return f; 1115 } 1116 EXPORT_SYMBOL(dentry_open); 1117 1118 struct file *dentry_open_nonotify(const struct path *path, int flags, 1119 const struct cred *cred) 1120 { 1121 struct file *f = alloc_empty_file(flags, cred); 1122 if (!IS_ERR(f)) { 1123 int error; 1124 1125 f->f_mode |= FMODE_NONOTIFY; 1126 error = vfs_open(path, f); 1127 if (error) { 1128 fput(f); 1129 f = ERR_PTR(error); 1130 } 1131 } 1132 return f; 1133 } 1134 1135 /** 1136 * dentry_create - Create and open a file 1137 * @path: path to create 1138 * @flags: O_ flags 1139 * @mode: mode bits for new file 1140 * @cred: credentials to use 1141 * 1142 * Caller must hold the parent directory's lock, and have prepared 1143 * a negative dentry, placed in @path->dentry, for the new file. 1144 * 1145 * Caller sets @path->mnt to the vfsmount of the filesystem where 1146 * the new file is to be created. The parent directory and the 1147 * negative dentry must reside on the same filesystem instance. 1148 * 1149 * On success, returns a "struct file *". Otherwise a ERR_PTR 1150 * is returned. 1151 */ 1152 struct file *dentry_create(const struct path *path, int flags, umode_t mode, 1153 const struct cred *cred) 1154 { 1155 struct file *f; 1156 int error; 1157 1158 f = alloc_empty_file(flags, cred); 1159 if (IS_ERR(f)) 1160 return f; 1161 1162 error = vfs_create(mnt_idmap(path->mnt), 1163 d_inode(path->dentry->d_parent), 1164 path->dentry, mode, true); 1165 if (!error) 1166 error = vfs_open(path, f); 1167 1168 if (unlikely(error)) { 1169 fput(f); 1170 return ERR_PTR(error); 1171 } 1172 return f; 1173 } 1174 EXPORT_SYMBOL(dentry_create); 1175 1176 /** 1177 * kernel_file_open - open a file for kernel internal use 1178 * @path: path of the file to open 1179 * @flags: open flags 1180 * @cred: credentials for open 1181 * 1182 * Open a file for use by in-kernel consumers. The file is not accounted 1183 * against nr_files and must not be installed into the file descriptor 1184 * table. 1185 * 1186 * Return: Opened file on success, an error pointer on failure. 1187 */ 1188 struct file *kernel_file_open(const struct path *path, int flags, 1189 const struct cred *cred) 1190 { 1191 struct file *f; 1192 int error; 1193 1194 f = alloc_empty_file_noaccount(flags, cred); 1195 if (IS_ERR(f)) 1196 return f; 1197 1198 f->f_path = *path; 1199 error = do_dentry_open(f, NULL); 1200 if (error) { 1201 fput(f); 1202 return ERR_PTR(error); 1203 } 1204 1205 fsnotify_open(f); 1206 return f; 1207 } 1208 EXPORT_SYMBOL_GPL(kernel_file_open); 1209 1210 #define WILL_CREATE(flags) (flags & (O_CREAT | __O_TMPFILE)) 1211 #define O_PATH_FLAGS (O_DIRECTORY | O_NOFOLLOW | O_PATH | O_CLOEXEC) 1212 1213 inline struct open_how build_open_how(int flags, umode_t mode) 1214 { 1215 struct open_how how = { 1216 .flags = flags & VALID_OPEN_FLAGS, 1217 .mode = mode & S_IALLUGO, 1218 }; 1219 1220 /* O_PATH beats everything else. */ 1221 if (how.flags & O_PATH) 1222 how.flags &= O_PATH_FLAGS; 1223 /* Modes should only be set for create-like flags. */ 1224 if (!WILL_CREATE(how.flags)) 1225 how.mode = 0; 1226 return how; 1227 } 1228 1229 inline int build_open_flags(const struct open_how *how, struct open_flags *op) 1230 { 1231 u64 flags = how->flags; 1232 u64 strip = O_CLOEXEC; 1233 int lookup_flags = 0; 1234 int acc_mode = ACC_MODE(flags); 1235 1236 BUILD_BUG_ON_MSG(upper_32_bits(VALID_OPEN_FLAGS), 1237 "struct open_flags doesn't yet handle flags > 32 bits"); 1238 1239 /* 1240 * Strip flags that aren't relevant in determining struct open_flags. 1241 */ 1242 flags &= ~strip; 1243 1244 /* 1245 * Older syscalls implicitly clear all of the invalid flags or argument 1246 * values before calling build_open_flags(), but openat2(2) checks all 1247 * of its arguments. 1248 */ 1249 if (flags & ~VALID_OPEN_FLAGS) 1250 return -EINVAL; 1251 if (how->resolve & ~VALID_RESOLVE_FLAGS) 1252 return -EINVAL; 1253 1254 /* Scoping flags are mutually exclusive. */ 1255 if ((how->resolve & RESOLVE_BENEATH) && (how->resolve & RESOLVE_IN_ROOT)) 1256 return -EINVAL; 1257 1258 /* Deal with the mode. */ 1259 if (WILL_CREATE(flags)) { 1260 if (how->mode & ~S_IALLUGO) 1261 return -EINVAL; 1262 op->mode = how->mode | S_IFREG; 1263 } else { 1264 if (how->mode != 0) 1265 return -EINVAL; 1266 op->mode = 0; 1267 } 1268 1269 /* 1270 * Block bugs where O_DIRECTORY | O_CREAT created regular files. 1271 * Note, that blocking O_DIRECTORY | O_CREAT here also protects 1272 * O_TMPFILE below which requires O_DIRECTORY being raised. 1273 */ 1274 if ((flags & (O_DIRECTORY | O_CREAT)) == (O_DIRECTORY | O_CREAT)) 1275 return -EINVAL; 1276 1277 /* Now handle the creative implementation of O_TMPFILE. */ 1278 if (flags & __O_TMPFILE) { 1279 /* 1280 * In order to ensure programs get explicit errors when trying 1281 * to use O_TMPFILE on old kernels we enforce that O_DIRECTORY 1282 * is raised alongside __O_TMPFILE. 1283 */ 1284 if (!(flags & O_DIRECTORY)) 1285 return -EINVAL; 1286 if (!(acc_mode & MAY_WRITE)) 1287 return -EINVAL; 1288 } 1289 if (flags & O_PATH) { 1290 /* O_PATH only permits certain other flags to be set. */ 1291 if (flags & ~O_PATH_FLAGS) 1292 return -EINVAL; 1293 acc_mode = 0; 1294 } 1295 1296 /* 1297 * O_SYNC is implemented as __O_SYNC|O_DSYNC. As many places only 1298 * check for O_DSYNC if the need any syncing at all we enforce it's 1299 * always set instead of having to deal with possibly weird behaviour 1300 * for malicious applications setting only __O_SYNC. 1301 */ 1302 if (flags & __O_SYNC) 1303 flags |= O_DSYNC; 1304 1305 op->open_flag = flags; 1306 1307 /* O_TRUNC implies we need access checks for write permissions */ 1308 if (flags & O_TRUNC) 1309 acc_mode |= MAY_WRITE; 1310 1311 /* Allow the LSM permission hook to distinguish append 1312 access from general write access. */ 1313 if (flags & O_APPEND) 1314 acc_mode |= MAY_APPEND; 1315 1316 op->acc_mode = acc_mode; 1317 1318 op->intent = flags & O_PATH ? 0 : LOOKUP_OPEN; 1319 1320 if (flags & O_CREAT) { 1321 op->intent |= LOOKUP_CREATE; 1322 if (flags & O_EXCL) { 1323 op->intent |= LOOKUP_EXCL; 1324 flags |= O_NOFOLLOW; 1325 } 1326 } 1327 1328 if (flags & O_DIRECTORY) 1329 lookup_flags |= LOOKUP_DIRECTORY; 1330 if (!(flags & O_NOFOLLOW)) 1331 lookup_flags |= LOOKUP_FOLLOW; 1332 1333 if (how->resolve & RESOLVE_NO_XDEV) 1334 lookup_flags |= LOOKUP_NO_XDEV; 1335 if (how->resolve & RESOLVE_NO_MAGICLINKS) 1336 lookup_flags |= LOOKUP_NO_MAGICLINKS; 1337 if (how->resolve & RESOLVE_NO_SYMLINKS) 1338 lookup_flags |= LOOKUP_NO_SYMLINKS; 1339 if (how->resolve & RESOLVE_BENEATH) 1340 lookup_flags |= LOOKUP_BENEATH; 1341 if (how->resolve & RESOLVE_IN_ROOT) 1342 lookup_flags |= LOOKUP_IN_ROOT; 1343 if (how->resolve & RESOLVE_CACHED) { 1344 /* Don't bother even trying for create/truncate/tmpfile open */ 1345 if (flags & (O_TRUNC | O_CREAT | __O_TMPFILE)) 1346 return -EAGAIN; 1347 lookup_flags |= LOOKUP_CACHED; 1348 } 1349 1350 op->lookup_flags = lookup_flags; 1351 return 0; 1352 } 1353 1354 /** 1355 * file_open_name - open file and return file pointer 1356 * 1357 * @name: struct filename containing path to open 1358 * @flags: open flags as per the open(2) second argument 1359 * @mode: mode for the new file if O_CREAT is set, else ignored 1360 * 1361 * This is the helper to open a file from kernelspace if you really 1362 * have to. But in generally you should not do this, so please move 1363 * along, nothing to see here.. 1364 */ 1365 struct file *file_open_name(struct filename *name, int flags, umode_t mode) 1366 { 1367 struct open_flags op; 1368 struct open_how how = build_open_how(flags, mode); 1369 int err = build_open_flags(&how, &op); 1370 if (err) 1371 return ERR_PTR(err); 1372 return do_filp_open(AT_FDCWD, name, &op); 1373 } 1374 1375 /** 1376 * filp_open - open file and return file pointer 1377 * 1378 * @filename: path to open 1379 * @flags: open flags as per the open(2) second argument 1380 * @mode: mode for the new file if O_CREAT is set, else ignored 1381 * 1382 * This is the helper to open a file from kernelspace if you really 1383 * have to. But in generally you should not do this, so please move 1384 * along, nothing to see here.. 1385 */ 1386 struct file *filp_open(const char *filename, int flags, umode_t mode) 1387 { 1388 struct filename *name = getname_kernel(filename); 1389 struct file *file = ERR_CAST(name); 1390 1391 if (!IS_ERR(name)) { 1392 file = file_open_name(name, flags, mode); 1393 putname(name); 1394 } 1395 return file; 1396 } 1397 EXPORT_SYMBOL(filp_open); 1398 1399 struct file *file_open_root(const struct path *root, 1400 const char *filename, int flags, umode_t mode) 1401 { 1402 struct open_flags op; 1403 struct open_how how = build_open_how(flags, mode); 1404 int err = build_open_flags(&how, &op); 1405 if (err) 1406 return ERR_PTR(err); 1407 return do_file_open_root(root, filename, &op); 1408 } 1409 EXPORT_SYMBOL(file_open_root); 1410 1411 static long do_sys_openat2(int dfd, const char __user *filename, 1412 struct open_how *how) 1413 { 1414 struct open_flags op; 1415 int fd = build_open_flags(how, &op); 1416 struct filename *tmp; 1417 1418 if (fd) 1419 return fd; 1420 1421 tmp = getname(filename); 1422 if (IS_ERR(tmp)) 1423 return PTR_ERR(tmp); 1424 1425 fd = get_unused_fd_flags(how->flags); 1426 if (fd >= 0) { 1427 struct file *f = do_filp_open(dfd, tmp, &op); 1428 if (IS_ERR(f)) { 1429 put_unused_fd(fd); 1430 fd = PTR_ERR(f); 1431 } else { 1432 fd_install(fd, f); 1433 } 1434 } 1435 putname(tmp); 1436 return fd; 1437 } 1438 1439 long do_sys_open(int dfd, const char __user *filename, int flags, umode_t mode) 1440 { 1441 struct open_how how = build_open_how(flags, mode); 1442 return do_sys_openat2(dfd, filename, &how); 1443 } 1444 1445 1446 SYSCALL_DEFINE3(open, const char __user *, filename, int, flags, umode_t, mode) 1447 { 1448 if (force_o_largefile()) 1449 flags |= O_LARGEFILE; 1450 return do_sys_open(AT_FDCWD, filename, flags, mode); 1451 } 1452 1453 SYSCALL_DEFINE4(openat, int, dfd, const char __user *, filename, int, flags, 1454 umode_t, mode) 1455 { 1456 if (force_o_largefile()) 1457 flags |= O_LARGEFILE; 1458 return do_sys_open(dfd, filename, flags, mode); 1459 } 1460 1461 SYSCALL_DEFINE4(openat2, int, dfd, const char __user *, filename, 1462 struct open_how __user *, how, size_t, usize) 1463 { 1464 int err; 1465 struct open_how tmp; 1466 1467 BUILD_BUG_ON(sizeof(struct open_how) < OPEN_HOW_SIZE_VER0); 1468 BUILD_BUG_ON(sizeof(struct open_how) != OPEN_HOW_SIZE_LATEST); 1469 1470 if (unlikely(usize < OPEN_HOW_SIZE_VER0)) 1471 return -EINVAL; 1472 if (unlikely(usize > PAGE_SIZE)) 1473 return -E2BIG; 1474 1475 err = copy_struct_from_user(&tmp, sizeof(tmp), how, usize); 1476 if (err) 1477 return err; 1478 1479 audit_openat2_how(&tmp); 1480 1481 /* O_LARGEFILE is only allowed for non-O_PATH. */ 1482 if (!(tmp.flags & O_PATH) && force_o_largefile()) 1483 tmp.flags |= O_LARGEFILE; 1484 1485 return do_sys_openat2(dfd, filename, &tmp); 1486 } 1487 1488 #ifdef CONFIG_COMPAT 1489 /* 1490 * Exactly like sys_open(), except that it doesn't set the 1491 * O_LARGEFILE flag. 1492 */ 1493 COMPAT_SYSCALL_DEFINE3(open, const char __user *, filename, int, flags, umode_t, mode) 1494 { 1495 return do_sys_open(AT_FDCWD, filename, flags, mode); 1496 } 1497 1498 /* 1499 * Exactly like sys_openat(), except that it doesn't set the 1500 * O_LARGEFILE flag. 1501 */ 1502 COMPAT_SYSCALL_DEFINE4(openat, int, dfd, const char __user *, filename, int, flags, umode_t, mode) 1503 { 1504 return do_sys_open(dfd, filename, flags, mode); 1505 } 1506 #endif 1507 1508 #ifndef __alpha__ 1509 1510 /* 1511 * For backward compatibility? Maybe this should be moved 1512 * into arch/i386 instead? 1513 */ 1514 SYSCALL_DEFINE2(creat, const char __user *, pathname, umode_t, mode) 1515 { 1516 int flags = O_CREAT | O_WRONLY | O_TRUNC; 1517 1518 if (force_o_largefile()) 1519 flags |= O_LARGEFILE; 1520 return do_sys_open(AT_FDCWD, pathname, flags, mode); 1521 } 1522 #endif 1523 1524 /* 1525 * "id" is the POSIX thread ID. We use the 1526 * files pointer for this.. 1527 */ 1528 static int filp_flush(struct file *filp, fl_owner_t id) 1529 { 1530 int retval = 0; 1531 1532 if (CHECK_DATA_CORRUPTION(file_count(filp) == 0, filp, 1533 "VFS: Close: file count is 0 (f_op=%ps)", 1534 filp->f_op)) { 1535 return 0; 1536 } 1537 1538 if (filp->f_op->flush) 1539 retval = filp->f_op->flush(filp, id); 1540 1541 if (likely(!(filp->f_mode & FMODE_PATH))) { 1542 dnotify_flush(filp, id); 1543 locks_remove_posix(filp, id); 1544 } 1545 return retval; 1546 } 1547 1548 int filp_close(struct file *filp, fl_owner_t id) 1549 { 1550 int retval; 1551 1552 retval = filp_flush(filp, id); 1553 fput(filp); 1554 1555 return retval; 1556 } 1557 EXPORT_SYMBOL(filp_close); 1558 1559 /* 1560 * Careful here! We test whether the file pointer is NULL before 1561 * releasing the fd. This ensures that one clone task can't release 1562 * an fd while another clone is opening it. 1563 */ 1564 SYSCALL_DEFINE1(close, unsigned int, fd) 1565 { 1566 int retval; 1567 struct file *file; 1568 1569 file = file_close_fd(fd); 1570 if (!file) 1571 return -EBADF; 1572 1573 retval = filp_flush(file, current->files); 1574 1575 /* 1576 * We're returning to user space. Don't bother 1577 * with any delayed fput() cases. 1578 */ 1579 __fput_sync(file); 1580 1581 /* can't restart close syscall because file table entry was cleared */ 1582 if (unlikely(retval == -ERESTARTSYS || 1583 retval == -ERESTARTNOINTR || 1584 retval == -ERESTARTNOHAND || 1585 retval == -ERESTART_RESTARTBLOCK)) 1586 retval = -EINTR; 1587 1588 return retval; 1589 } 1590 1591 /* 1592 * This routine simulates a hangup on the tty, to arrange that users 1593 * are given clean terminals at login time. 1594 */ 1595 SYSCALL_DEFINE0(vhangup) 1596 { 1597 if (capable(CAP_SYS_TTY_CONFIG)) { 1598 tty_vhangup_self(); 1599 return 0; 1600 } 1601 return -EPERM; 1602 } 1603 1604 /* 1605 * Called when an inode is about to be open. 1606 * We use this to disallow opening large files on 32bit systems if 1607 * the caller didn't specify O_LARGEFILE. On 64bit systems we force 1608 * on this flag in sys_open. 1609 */ 1610 int generic_file_open(struct inode * inode, struct file * filp) 1611 { 1612 if (!(filp->f_flags & O_LARGEFILE) && i_size_read(inode) > MAX_NON_LFS) 1613 return -EOVERFLOW; 1614 return 0; 1615 } 1616 1617 EXPORT_SYMBOL(generic_file_open); 1618 1619 /* 1620 * This is used by subsystems that don't want seekable 1621 * file descriptors. The function is not supposed to ever fail, the only 1622 * reason it returns an 'int' and not 'void' is so that it can be plugged 1623 * directly into file_operations structure. 1624 */ 1625 int nonseekable_open(struct inode *inode, struct file *filp) 1626 { 1627 filp->f_mode &= ~(FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE); 1628 return 0; 1629 } 1630 1631 EXPORT_SYMBOL(nonseekable_open); 1632 1633 /* 1634 * stream_open is used by subsystems that want stream-like file descriptors. 1635 * Such file descriptors are not seekable and don't have notion of position 1636 * (file.f_pos is always 0 and ppos passed to .read()/.write() is always NULL). 1637 * Contrary to file descriptors of other regular files, .read() and .write() 1638 * can run simultaneously. 1639 * 1640 * stream_open never fails and is marked to return int so that it could be 1641 * directly used as file_operations.open . 1642 */ 1643 int stream_open(struct inode *inode, struct file *filp) 1644 { 1645 filp->f_mode &= ~(FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE | FMODE_ATOMIC_POS); 1646 filp->f_mode |= FMODE_STREAM; 1647 return 0; 1648 } 1649 1650 EXPORT_SYMBOL(stream_open); 1651