1 // SPDX-License-Identifier: GPL-2.0 2 #include <linux/sched/signal.h> 3 #include <linux/errno.h> 4 #include <linux/dcache.h> 5 #include <linux/path.h> 6 #include <linux/fdtable.h> 7 #include <linux/namei.h> 8 #include <linux/pid.h> 9 #include <linux/ptrace.h> 10 #include <linux/bitmap.h> 11 #include <linux/security.h> 12 #include <linux/file.h> 13 #include <linux/seq_file.h> 14 #include <linux/fs.h> 15 #include <linux/filelock.h> 16 17 #include <linux/proc_fs.h> 18 19 #include "../mount.h" 20 #include "internal.h" 21 #include "fd.h" 22 23 static int seq_show(struct seq_file *m, void *v) 24 { 25 struct files_struct *files = NULL; 26 int f_flags = 0, ret = -ENOENT; 27 struct file *file = NULL; 28 struct task_struct *task; 29 30 task = get_proc_task(m->private); 31 if (!task) 32 return -ENOENT; 33 34 task_lock(task); 35 files = task->files; 36 if (files) { 37 unsigned int fd = proc_fd(m->private); 38 39 spin_lock(&files->file_lock); 40 file = files_lookup_fd_locked(files, fd); 41 if (file) { 42 f_flags = file->f_flags; 43 if (close_on_exec(fd, files)) 44 f_flags |= O_CLOEXEC; 45 46 get_file(file); 47 ret = 0; 48 } 49 spin_unlock(&files->file_lock); 50 } 51 task_unlock(task); 52 put_task_struct(task); 53 54 if (ret) 55 return ret; 56 57 seq_printf(m, "pos:\t%lli\nflags:\t0%o\nmnt_id:\t%i\nino:\t%lu\n", 58 (long long)file->f_pos, f_flags, 59 real_mount(file->f_path.mnt)->mnt_id, 60 file_inode(file)->i_ino); 61 62 /* show_fd_locks() never dereferences files, so a stale value is safe */ 63 show_fd_locks(m, file, files); 64 if (seq_has_overflowed(m)) 65 goto out; 66 67 if (file->f_op->show_fdinfo) 68 file->f_op->show_fdinfo(m, file); 69 70 out: 71 fput(file); 72 return 0; 73 } 74 75 static int seq_fdinfo_open(struct inode *inode, struct file *file) 76 { 77 return single_open(file, seq_show, inode); 78 } 79 80 /* 81 * Shared /proc/pid/fdinfo and /proc/pid/fdinfo/fd permission helper to ensure 82 * that the current task has PTRACE_MODE_READ in addition to the normal 83 * POSIX-like checks. 84 */ 85 static int proc_fdinfo_permission(struct mnt_idmap *idmap, struct inode *inode, 86 int mask) 87 { 88 bool allowed = false; 89 struct task_struct *task = get_proc_task(inode); 90 91 if (!task) 92 return -ESRCH; 93 94 allowed = ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS); 95 put_task_struct(task); 96 97 if (!allowed) 98 return -EACCES; 99 100 return generic_permission(idmap, inode, mask); 101 } 102 103 static const struct inode_operations proc_fdinfo_file_inode_operations = { 104 .permission = proc_fdinfo_permission, 105 .setattr = proc_setattr, 106 }; 107 108 static const struct file_operations proc_fdinfo_file_operations = { 109 .open = seq_fdinfo_open, 110 .read = seq_read, 111 .llseek = seq_lseek, 112 .release = single_release, 113 }; 114 115 static bool tid_fd_mode(struct task_struct *task, unsigned fd, fmode_t *mode) 116 { 117 struct file *file; 118 119 file = fget_task(task, fd); 120 if (file) { 121 *mode = file->f_mode; 122 fput(file); 123 } 124 return !!file; 125 } 126 127 static void tid_fd_update_inode(struct task_struct *task, struct inode *inode, 128 fmode_t f_mode) 129 { 130 task_dump_owner(task, 0, &inode->i_uid, &inode->i_gid); 131 132 if (S_ISLNK(inode->i_mode)) { 133 unsigned i_mode = S_IFLNK; 134 if (f_mode & FMODE_READ) 135 i_mode |= S_IRUSR | S_IXUSR; 136 if (f_mode & FMODE_WRITE) 137 i_mode |= S_IWUSR | S_IXUSR; 138 inode->i_mode = i_mode; 139 } 140 security_task_to_inode(task, inode); 141 } 142 143 static int tid_fd_revalidate(struct dentry *dentry, unsigned int flags) 144 { 145 struct task_struct *task; 146 struct inode *inode; 147 unsigned int fd; 148 149 if (flags & LOOKUP_RCU) 150 return -ECHILD; 151 152 inode = d_inode(dentry); 153 task = get_proc_task(inode); 154 fd = proc_fd(inode); 155 156 if (task) { 157 fmode_t f_mode; 158 if (tid_fd_mode(task, fd, &f_mode)) { 159 tid_fd_update_inode(task, inode, f_mode); 160 put_task_struct(task); 161 return 1; 162 } 163 put_task_struct(task); 164 } 165 return 0; 166 } 167 168 static const struct dentry_operations tid_fd_dentry_operations = { 169 .d_revalidate = tid_fd_revalidate, 170 .d_delete = pid_delete_dentry, 171 }; 172 173 static int proc_fd_link(struct dentry *dentry, struct path *path) 174 { 175 struct task_struct *task; 176 int ret = -ENOENT; 177 178 task = get_proc_task(d_inode(dentry)); 179 if (task) { 180 unsigned int fd = proc_fd(d_inode(dentry)); 181 struct file *fd_file; 182 183 fd_file = fget_task(task, fd); 184 if (fd_file) { 185 *path = fd_file->f_path; 186 path_get(&fd_file->f_path); 187 ret = 0; 188 fput(fd_file); 189 } 190 put_task_struct(task); 191 } 192 193 return ret; 194 } 195 196 struct fd_data { 197 fmode_t mode; 198 unsigned fd; 199 }; 200 201 static struct dentry *proc_fd_instantiate(struct dentry *dentry, 202 struct task_struct *task, const void *ptr) 203 { 204 const struct fd_data *data = ptr; 205 struct proc_inode *ei; 206 struct inode *inode; 207 208 inode = proc_pid_make_inode(dentry->d_sb, task, S_IFLNK); 209 if (!inode) 210 return ERR_PTR(-ENOENT); 211 212 ei = PROC_I(inode); 213 ei->fd = data->fd; 214 215 inode->i_op = &proc_pid_link_inode_operations; 216 inode->i_size = 64; 217 218 ei->op.proc_get_link = proc_fd_link; 219 tid_fd_update_inode(task, inode, data->mode); 220 221 return proc_splice_unmountable(inode, dentry, 222 &tid_fd_dentry_operations); 223 } 224 225 static struct dentry *proc_lookupfd_common(struct inode *dir, 226 struct dentry *dentry, 227 instantiate_t instantiate) 228 { 229 struct task_struct *task = get_proc_task(dir); 230 struct fd_data data = {.fd = name_to_int(&dentry->d_name)}; 231 struct dentry *result = ERR_PTR(-ENOENT); 232 233 if (!task) 234 goto out_no_task; 235 if (data.fd == ~0U) 236 goto out; 237 if (!tid_fd_mode(task, data.fd, &data.mode)) 238 goto out; 239 240 result = instantiate(dentry, task, &data); 241 out: 242 put_task_struct(task); 243 out_no_task: 244 return result; 245 } 246 247 static int proc_readfd_common(struct file *file, struct dir_context *ctx, 248 instantiate_t instantiate) 249 { 250 struct task_struct *p = get_proc_task(file_inode(file)); 251 unsigned int fd; 252 253 if (!p) 254 return -ENOENT; 255 256 if (!dir_emit_dots(file, ctx)) 257 goto out; 258 259 for (fd = ctx->pos - 2;; fd++) { 260 struct file *f; 261 struct fd_data data; 262 char name[10 + 1]; 263 unsigned int len; 264 265 f = fget_task_next(p, &fd); 266 ctx->pos = fd + 2LL; 267 if (!f) 268 break; 269 data.mode = f->f_mode; 270 fput(f); 271 data.fd = fd; 272 273 len = snprintf(name, sizeof(name), "%u", fd); 274 if (!proc_fill_cache(file, ctx, 275 name, len, instantiate, p, 276 &data)) 277 break; 278 cond_resched(); 279 } 280 out: 281 put_task_struct(p); 282 return 0; 283 } 284 285 static int proc_readfd_count(struct inode *inode, loff_t *count) 286 { 287 struct task_struct *p = get_proc_task(inode); 288 struct fdtable *fdt; 289 290 if (!p) 291 return -ENOENT; 292 293 task_lock(p); 294 if (p->files) { 295 rcu_read_lock(); 296 297 fdt = files_fdtable(p->files); 298 *count = bitmap_weight(fdt->open_fds, fdt->max_fds); 299 300 rcu_read_unlock(); 301 } 302 task_unlock(p); 303 304 put_task_struct(p); 305 306 return 0; 307 } 308 309 static int proc_fd_iterate(struct file *file, struct dir_context *ctx) 310 { 311 return proc_readfd_common(file, ctx, proc_fd_instantiate); 312 } 313 314 const struct file_operations proc_fd_operations = { 315 .read = generic_read_dir, 316 .iterate_shared = proc_fd_iterate, 317 .llseek = generic_file_llseek, 318 }; 319 320 static struct dentry *proc_lookupfd(struct inode *dir, struct dentry *dentry, 321 unsigned int flags) 322 { 323 return proc_lookupfd_common(dir, dentry, proc_fd_instantiate); 324 } 325 326 /* 327 * /proc/pid/fd needs a special permission handler so that a process can still 328 * access /proc/self/fd after it has executed a setuid(). 329 */ 330 int proc_fd_permission(struct mnt_idmap *idmap, 331 struct inode *inode, int mask) 332 { 333 struct task_struct *p; 334 int rv; 335 336 rv = generic_permission(&nop_mnt_idmap, inode, mask); 337 if (rv == 0) 338 return rv; 339 340 rcu_read_lock(); 341 p = pid_task(proc_pid(inode), PIDTYPE_PID); 342 if (p && same_thread_group(p, current)) 343 rv = 0; 344 rcu_read_unlock(); 345 346 return rv; 347 } 348 349 static int proc_fd_getattr(struct mnt_idmap *idmap, 350 const struct path *path, struct kstat *stat, 351 u32 request_mask, unsigned int query_flags) 352 { 353 struct inode *inode = d_inode(path->dentry); 354 int rv = 0; 355 356 generic_fillattr(&nop_mnt_idmap, request_mask, inode, stat); 357 358 /* If it's a directory, put the number of open fds there */ 359 if (S_ISDIR(inode->i_mode)) { 360 rv = proc_readfd_count(inode, &stat->size); 361 if (rv < 0) 362 return rv; 363 } 364 365 return rv; 366 } 367 368 const struct inode_operations proc_fd_inode_operations = { 369 .lookup = proc_lookupfd, 370 .permission = proc_fd_permission, 371 .getattr = proc_fd_getattr, 372 .setattr = proc_setattr, 373 }; 374 375 static struct dentry *proc_fdinfo_instantiate(struct dentry *dentry, 376 struct task_struct *task, const void *ptr) 377 { 378 const struct fd_data *data = ptr; 379 struct proc_inode *ei; 380 struct inode *inode; 381 382 inode = proc_pid_make_inode(dentry->d_sb, task, S_IFREG | S_IRUGO); 383 if (!inode) 384 return ERR_PTR(-ENOENT); 385 386 ei = PROC_I(inode); 387 ei->fd = data->fd; 388 389 inode->i_op = &proc_fdinfo_file_inode_operations; 390 391 inode->i_fop = &proc_fdinfo_file_operations; 392 tid_fd_update_inode(task, inode, 0); 393 394 return proc_splice_unmountable(inode, dentry, 395 &tid_fd_dentry_operations); 396 } 397 398 static struct dentry * 399 proc_lookupfdinfo(struct inode *dir, struct dentry *dentry, unsigned int flags) 400 { 401 return proc_lookupfd_common(dir, dentry, proc_fdinfo_instantiate); 402 } 403 404 static int proc_fdinfo_iterate(struct file *file, struct dir_context *ctx) 405 { 406 return proc_readfd_common(file, ctx, 407 proc_fdinfo_instantiate); 408 } 409 410 const struct inode_operations proc_fdinfo_inode_operations = { 411 .lookup = proc_lookupfdinfo, 412 .permission = proc_fdinfo_permission, 413 .setattr = proc_setattr, 414 }; 415 416 const struct file_operations proc_fdinfo_operations = { 417 .read = generic_read_dir, 418 .iterate_shared = proc_fdinfo_iterate, 419 .llseek = generic_file_llseek, 420 }; 421