Commit | Line | Data |
---|---|---|
b4d0d230 | 1 | // SPDX-License-Identifier: GPL-2.0-or-later |
24dcb3d9 DH |
2 | /* Filesystem access-by-fd. |
3 | * | |
4 | * Copyright (C) 2017 Red Hat, Inc. All Rights Reserved. | |
5 | * Written by David Howells (dhowells@redhat.com) | |
24dcb3d9 DH |
6 | */ |
7 | ||
8 | #include <linux/fs_context.h> | |
ecdab150 | 9 | #include <linux/fs_parser.h> |
24dcb3d9 DH |
10 | #include <linux/slab.h> |
11 | #include <linux/uaccess.h> | |
12 | #include <linux/syscalls.h> | |
13 | #include <linux/security.h> | |
14 | #include <linux/anon_inodes.h> | |
15 | #include <linux/namei.h> | |
16 | #include <linux/file.h> | |
17 | #include <uapi/linux/mount.h> | |
ecdab150 | 18 | #include "internal.h" |
24dcb3d9 DH |
19 | #include "mount.h" |
20 | ||
007ec26c DH |
21 | /* |
22 | * Allow the user to read back any error, warning or informational messages. | |
23 | */ | |
24 | static ssize_t fscontext_read(struct file *file, | |
25 | char __user *_buf, size_t len, loff_t *pos) | |
26 | { | |
27 | struct fs_context *fc = file->private_data; | |
cc3c0b53 | 28 | struct fc_log *log = fc->log.log; |
007ec26c DH |
29 | unsigned int logsize = ARRAY_SIZE(log->buffer); |
30 | ssize_t ret; | |
31 | char *p; | |
32 | bool need_free; | |
33 | int index, n; | |
34 | ||
35 | ret = mutex_lock_interruptible(&fc->uapi_mutex); | |
36 | if (ret < 0) | |
37 | return ret; | |
38 | ||
39 | if (log->head == log->tail) { | |
40 | mutex_unlock(&fc->uapi_mutex); | |
41 | return -ENODATA; | |
42 | } | |
43 | ||
44 | index = log->tail & (logsize - 1); | |
45 | p = log->buffer[index]; | |
46 | need_free = log->need_free & (1 << index); | |
47 | log->buffer[index] = NULL; | |
48 | log->need_free &= ~(1 << index); | |
49 | log->tail++; | |
50 | mutex_unlock(&fc->uapi_mutex); | |
51 | ||
52 | ret = -EMSGSIZE; | |
53 | n = strlen(p); | |
54 | if (n > len) | |
55 | goto err_free; | |
56 | ret = -EFAULT; | |
57 | if (copy_to_user(_buf, p, n) != 0) | |
58 | goto err_free; | |
59 | ret = n; | |
60 | ||
61 | err_free: | |
62 | if (need_free) | |
63 | kfree(p); | |
64 | return ret; | |
65 | } | |
66 | ||
24dcb3d9 DH |
67 | static int fscontext_release(struct inode *inode, struct file *file) |
68 | { | |
69 | struct fs_context *fc = file->private_data; | |
70 | ||
71 | if (fc) { | |
72 | file->private_data = NULL; | |
73 | put_fs_context(fc); | |
74 | } | |
75 | return 0; | |
76 | } | |
77 | ||
78 | const struct file_operations fscontext_fops = { | |
007ec26c | 79 | .read = fscontext_read, |
24dcb3d9 DH |
80 | .release = fscontext_release, |
81 | .llseek = no_llseek, | |
82 | }; | |
83 | ||
84 | /* | |
85 | * Attach a filesystem context to a file and an fd. | |
86 | */ | |
87 | static int fscontext_create_fd(struct fs_context *fc, unsigned int o_flags) | |
88 | { | |
89 | int fd; | |
90 | ||
1cdc415f | 91 | fd = anon_inode_getfd("[fscontext]", &fscontext_fops, fc, |
24dcb3d9 DH |
92 | O_RDWR | o_flags); |
93 | if (fd < 0) | |
94 | put_fs_context(fc); | |
95 | return fd; | |
96 | } | |
97 | ||
007ec26c DH |
98 | static int fscontext_alloc_log(struct fs_context *fc) |
99 | { | |
cc3c0b53 AV |
100 | fc->log.log = kzalloc(sizeof(*fc->log.log), GFP_KERNEL); |
101 | if (!fc->log.log) | |
007ec26c | 102 | return -ENOMEM; |
cc3c0b53 AV |
103 | refcount_set(&fc->log.log->usage, 1); |
104 | fc->log.log->owner = fc->fs_type->owner; | |
007ec26c DH |
105 | return 0; |
106 | } | |
107 | ||
24dcb3d9 DH |
108 | /* |
109 | * Open a filesystem by name so that it can be configured for mounting. | |
110 | * | |
111 | * We are allowed to specify a container in which the filesystem will be | |
112 | * opened, thereby indicating which namespaces will be used (notably, which | |
113 | * network namespace will be used for network filesystems). | |
114 | */ | |
115 | SYSCALL_DEFINE2(fsopen, const char __user *, _fs_name, unsigned int, flags) | |
116 | { | |
117 | struct file_system_type *fs_type; | |
118 | struct fs_context *fc; | |
119 | const char *fs_name; | |
007ec26c | 120 | int ret; |
24dcb3d9 | 121 | |
a5f85d78 | 122 | if (!may_mount()) |
24dcb3d9 DH |
123 | return -EPERM; |
124 | ||
125 | if (flags & ~FSOPEN_CLOEXEC) | |
126 | return -EINVAL; | |
127 | ||
128 | fs_name = strndup_user(_fs_name, PAGE_SIZE); | |
129 | if (IS_ERR(fs_name)) | |
130 | return PTR_ERR(fs_name); | |
131 | ||
132 | fs_type = get_fs_type(fs_name); | |
133 | kfree(fs_name); | |
134 | if (!fs_type) | |
135 | return -ENODEV; | |
136 | ||
137 | fc = fs_context_for_mount(fs_type, 0); | |
138 | put_filesystem(fs_type); | |
139 | if (IS_ERR(fc)) | |
140 | return PTR_ERR(fc); | |
141 | ||
142 | fc->phase = FS_CONTEXT_CREATE_PARAMS; | |
007ec26c DH |
143 | |
144 | ret = fscontext_alloc_log(fc); | |
145 | if (ret < 0) | |
146 | goto err_fc; | |
147 | ||
24dcb3d9 | 148 | return fscontext_create_fd(fc, flags & FSOPEN_CLOEXEC ? O_CLOEXEC : 0); |
007ec26c DH |
149 | |
150 | err_fc: | |
151 | put_fs_context(fc); | |
152 | return ret; | |
24dcb3d9 | 153 | } |
ecdab150 | 154 | |
cf3cba4a DH |
155 | /* |
156 | * Pick a superblock into a context for reconfiguration. | |
157 | */ | |
158 | SYSCALL_DEFINE3(fspick, int, dfd, const char __user *, path, unsigned int, flags) | |
159 | { | |
160 | struct fs_context *fc; | |
161 | struct path target; | |
162 | unsigned int lookup_flags; | |
163 | int ret; | |
164 | ||
a5f85d78 | 165 | if (!may_mount()) |
cf3cba4a DH |
166 | return -EPERM; |
167 | ||
168 | if ((flags & ~(FSPICK_CLOEXEC | | |
169 | FSPICK_SYMLINK_NOFOLLOW | | |
170 | FSPICK_NO_AUTOMOUNT | | |
171 | FSPICK_EMPTY_PATH)) != 0) | |
172 | return -EINVAL; | |
173 | ||
174 | lookup_flags = LOOKUP_FOLLOW | LOOKUP_AUTOMOUNT; | |
175 | if (flags & FSPICK_SYMLINK_NOFOLLOW) | |
176 | lookup_flags &= ~LOOKUP_FOLLOW; | |
177 | if (flags & FSPICK_NO_AUTOMOUNT) | |
178 | lookup_flags &= ~LOOKUP_AUTOMOUNT; | |
179 | if (flags & FSPICK_EMPTY_PATH) | |
180 | lookup_flags |= LOOKUP_EMPTY; | |
181 | ret = user_path_at(dfd, path, lookup_flags, &target); | |
182 | if (ret < 0) | |
183 | goto err; | |
184 | ||
185 | ret = -EINVAL; | |
186 | if (target.mnt->mnt_root != target.dentry) | |
187 | goto err_path; | |
188 | ||
189 | fc = fs_context_for_reconfigure(target.dentry, 0, 0); | |
190 | if (IS_ERR(fc)) { | |
191 | ret = PTR_ERR(fc); | |
192 | goto err_path; | |
193 | } | |
194 | ||
195 | fc->phase = FS_CONTEXT_RECONF_PARAMS; | |
196 | ||
197 | ret = fscontext_alloc_log(fc); | |
198 | if (ret < 0) | |
199 | goto err_fc; | |
200 | ||
201 | path_put(&target); | |
202 | return fscontext_create_fd(fc, flags & FSPICK_CLOEXEC ? O_CLOEXEC : 0); | |
203 | ||
204 | err_fc: | |
205 | put_fs_context(fc); | |
206 | err_path: | |
207 | path_put(&target); | |
208 | err: | |
209 | return ret; | |
210 | } | |
211 | ||
dae8b08d CB |
212 | static int vfs_cmd_create(struct fs_context *fc) |
213 | { | |
214 | struct super_block *sb; | |
215 | int ret; | |
216 | ||
217 | if (fc->phase != FS_CONTEXT_CREATE_PARAMS) | |
218 | return -EBUSY; | |
219 | ||
220 | if (!mount_capable(fc)) | |
221 | return -EPERM; | |
222 | ||
223 | fc->phase = FS_CONTEXT_CREATING; | |
224 | ||
225 | ret = vfs_get_tree(fc); | |
226 | if (ret) { | |
227 | fc->phase = FS_CONTEXT_FAILED; | |
228 | return ret; | |
229 | } | |
230 | ||
231 | sb = fc->root->d_sb; | |
232 | ret = security_sb_kern_mount(sb); | |
233 | if (unlikely(ret)) { | |
234 | fc_drop_locked(fc); | |
235 | fc->phase = FS_CONTEXT_FAILED; | |
236 | return ret; | |
237 | } | |
238 | ||
239 | /* vfs_get_tree() callchains will have grabbed @s_umount */ | |
240 | up_write(&sb->s_umount); | |
241 | fc->phase = FS_CONTEXT_AWAITING_MOUNT; | |
242 | return 0; | |
243 | } | |
244 | ||
11a51d8c CB |
245 | static int vfs_cmd_reconfigure(struct fs_context *fc) |
246 | { | |
247 | struct super_block *sb; | |
248 | int ret; | |
249 | ||
250 | if (fc->phase != FS_CONTEXT_RECONF_PARAMS) | |
251 | return -EBUSY; | |
252 | ||
253 | fc->phase = FS_CONTEXT_RECONFIGURING; | |
254 | ||
255 | sb = fc->root->d_sb; | |
256 | if (!ns_capable(sb->s_user_ns, CAP_SYS_ADMIN)) { | |
257 | fc->phase = FS_CONTEXT_FAILED; | |
258 | return -EPERM; | |
259 | } | |
260 | ||
261 | down_write(&sb->s_umount); | |
262 | ret = reconfigure_super(fc); | |
263 | up_write(&sb->s_umount); | |
264 | if (ret) { | |
265 | fc->phase = FS_CONTEXT_FAILED; | |
266 | return ret; | |
267 | } | |
268 | ||
269 | vfs_clean_context(fc); | |
270 | return 0; | |
271 | } | |
272 | ||
ecdab150 DH |
273 | /* |
274 | * Check the state and apply the configuration. Note that this function is | |
275 | * allowed to 'steal' the value by setting param->xxx to NULL before returning. | |
276 | */ | |
277 | static int vfs_fsconfig_locked(struct fs_context *fc, int cmd, | |
278 | struct fs_parameter *param) | |
279 | { | |
ecdab150 DH |
280 | int ret; |
281 | ||
282 | ret = finish_clean_context(fc); | |
283 | if (ret) | |
284 | return ret; | |
285 | switch (cmd) { | |
286 | case FSCONFIG_CMD_CREATE: | |
dae8b08d | 287 | return vfs_cmd_create(fc); |
ecdab150 | 288 | case FSCONFIG_CMD_RECONFIGURE: |
11a51d8c | 289 | return vfs_cmd_reconfigure(fc); |
ecdab150 DH |
290 | default: |
291 | if (fc->phase != FS_CONTEXT_CREATE_PARAMS && | |
292 | fc->phase != FS_CONTEXT_RECONF_PARAMS) | |
293 | return -EBUSY; | |
294 | ||
295 | return vfs_parse_fs_param(fc, param); | |
296 | } | |
ecdab150 DH |
297 | } |
298 | ||
299 | /** | |
300 | * sys_fsconfig - Set parameters and trigger actions on a context | |
301 | * @fd: The filesystem context to act upon | |
302 | * @cmd: The action to take | |
303 | * @_key: Where appropriate, the parameter key to set | |
304 | * @_value: Where appropriate, the parameter value to set | |
305 | * @aux: Additional information for the value | |
306 | * | |
307 | * This system call is used to set parameters on a context, including | |
308 | * superblock settings, data source and security labelling. | |
309 | * | |
310 | * Actions include triggering the creation of a superblock and the | |
311 | * reconfiguration of the superblock attached to the specified context. | |
312 | * | |
313 | * When setting a parameter, @cmd indicates the type of value being proposed | |
314 | * and @_key indicates the parameter to be altered. | |
315 | * | |
316 | * @_value and @aux are used to specify the value, should a value be required: | |
317 | * | |
318 | * (*) fsconfig_set_flag: No value is specified. The parameter must be boolean | |
319 | * in nature. The key may be prefixed with "no" to invert the | |
320 | * setting. @_value must be NULL and @aux must be 0. | |
321 | * | |
322 | * (*) fsconfig_set_string: A string value is specified. The parameter can be | |
323 | * expecting boolean, integer, string or take a path. A conversion to an | |
324 | * appropriate type will be attempted (which may include looking up as a | |
325 | * path). @_value points to a NUL-terminated string and @aux must be 0. | |
326 | * | |
327 | * (*) fsconfig_set_binary: A binary blob is specified. @_value points to the | |
328 | * blob and @aux indicates its size. The parameter must be expecting a | |
329 | * blob. | |
330 | * | |
331 | * (*) fsconfig_set_path: A non-empty path is specified. The parameter must be | |
332 | * expecting a path object. @_value points to a NUL-terminated string that | |
333 | * is the path and @aux is a file descriptor at which to start a relative | |
334 | * lookup or AT_FDCWD. | |
335 | * | |
336 | * (*) fsconfig_set_path_empty: As fsconfig_set_path, but with AT_EMPTY_PATH | |
337 | * implied. | |
338 | * | |
339 | * (*) fsconfig_set_fd: An open file descriptor is specified. @_value must be | |
340 | * NULL and @aux indicates the file descriptor. | |
341 | */ | |
342 | SYSCALL_DEFINE5(fsconfig, | |
343 | int, fd, | |
344 | unsigned int, cmd, | |
345 | const char __user *, _key, | |
346 | const void __user *, _value, | |
347 | int, aux) | |
348 | { | |
349 | struct fs_context *fc; | |
350 | struct fd f; | |
351 | int ret; | |
aa1918f9 | 352 | int lookup_flags = 0; |
ecdab150 DH |
353 | |
354 | struct fs_parameter param = { | |
355 | .type = fs_value_is_undefined, | |
356 | }; | |
357 | ||
358 | if (fd < 0) | |
359 | return -EINVAL; | |
360 | ||
361 | switch (cmd) { | |
362 | case FSCONFIG_SET_FLAG: | |
363 | if (!_key || _value || aux) | |
364 | return -EINVAL; | |
365 | break; | |
366 | case FSCONFIG_SET_STRING: | |
367 | if (!_key || !_value || aux) | |
368 | return -EINVAL; | |
369 | break; | |
370 | case FSCONFIG_SET_BINARY: | |
371 | if (!_key || !_value || aux <= 0 || aux > 1024 * 1024) | |
372 | return -EINVAL; | |
373 | break; | |
374 | case FSCONFIG_SET_PATH: | |
375 | case FSCONFIG_SET_PATH_EMPTY: | |
376 | if (!_key || !_value || (aux != AT_FDCWD && aux < 0)) | |
377 | return -EINVAL; | |
378 | break; | |
379 | case FSCONFIG_SET_FD: | |
380 | if (!_key || _value || aux < 0) | |
381 | return -EINVAL; | |
382 | break; | |
383 | case FSCONFIG_CMD_CREATE: | |
384 | case FSCONFIG_CMD_RECONFIGURE: | |
385 | if (_key || _value || aux) | |
386 | return -EINVAL; | |
387 | break; | |
388 | default: | |
389 | return -EOPNOTSUPP; | |
390 | } | |
391 | ||
392 | f = fdget(fd); | |
393 | if (!f.file) | |
394 | return -EBADF; | |
395 | ret = -EINVAL; | |
396 | if (f.file->f_op != &fscontext_fops) | |
397 | goto out_f; | |
398 | ||
399 | fc = f.file->private_data; | |
400 | if (fc->ops == &legacy_fs_context_ops) { | |
401 | switch (cmd) { | |
402 | case FSCONFIG_SET_BINARY: | |
403 | case FSCONFIG_SET_PATH: | |
404 | case FSCONFIG_SET_PATH_EMPTY: | |
405 | case FSCONFIG_SET_FD: | |
406 | ret = -EOPNOTSUPP; | |
407 | goto out_f; | |
408 | } | |
409 | } | |
410 | ||
411 | if (_key) { | |
412 | param.key = strndup_user(_key, 256); | |
413 | if (IS_ERR(param.key)) { | |
414 | ret = PTR_ERR(param.key); | |
415 | goto out_f; | |
416 | } | |
417 | } | |
418 | ||
419 | switch (cmd) { | |
420 | case FSCONFIG_SET_FLAG: | |
421 | param.type = fs_value_is_flag; | |
422 | break; | |
423 | case FSCONFIG_SET_STRING: | |
424 | param.type = fs_value_is_string; | |
425 | param.string = strndup_user(_value, 256); | |
426 | if (IS_ERR(param.string)) { | |
427 | ret = PTR_ERR(param.string); | |
428 | goto out_key; | |
429 | } | |
430 | param.size = strlen(param.string); | |
431 | break; | |
432 | case FSCONFIG_SET_BINARY: | |
433 | param.type = fs_value_is_blob; | |
434 | param.size = aux; | |
435 | param.blob = memdup_user_nul(_value, aux); | |
436 | if (IS_ERR(param.blob)) { | |
437 | ret = PTR_ERR(param.blob); | |
438 | goto out_key; | |
439 | } | |
440 | break; | |
aa1918f9 AV |
441 | case FSCONFIG_SET_PATH_EMPTY: |
442 | lookup_flags = LOOKUP_EMPTY; | |
df561f66 | 443 | fallthrough; |
ecdab150 DH |
444 | case FSCONFIG_SET_PATH: |
445 | param.type = fs_value_is_filename; | |
aa1918f9 | 446 | param.name = getname_flags(_value, lookup_flags, NULL); |
ecdab150 DH |
447 | if (IS_ERR(param.name)) { |
448 | ret = PTR_ERR(param.name); | |
449 | goto out_key; | |
450 | } | |
451 | param.dirfd = aux; | |
452 | param.size = strlen(param.name->name); | |
453 | break; | |
454 | case FSCONFIG_SET_FD: | |
455 | param.type = fs_value_is_file; | |
456 | ret = -EBADF; | |
457 | param.file = fget(aux); | |
458 | if (!param.file) | |
459 | goto out_key; | |
460 | break; | |
461 | default: | |
462 | break; | |
463 | } | |
464 | ||
465 | ret = mutex_lock_interruptible(&fc->uapi_mutex); | |
466 | if (ret == 0) { | |
467 | ret = vfs_fsconfig_locked(fc, cmd, ¶m); | |
468 | mutex_unlock(&fc->uapi_mutex); | |
469 | } | |
470 | ||
471 | /* Clean up the our record of any value that we obtained from | |
472 | * userspace. Note that the value may have been stolen by the LSM or | |
473 | * filesystem, in which case the value pointer will have been cleared. | |
474 | */ | |
475 | switch (cmd) { | |
476 | case FSCONFIG_SET_STRING: | |
477 | case FSCONFIG_SET_BINARY: | |
478 | kfree(param.string); | |
479 | break; | |
480 | case FSCONFIG_SET_PATH: | |
481 | case FSCONFIG_SET_PATH_EMPTY: | |
482 | if (param.name) | |
483 | putname(param.name); | |
484 | break; | |
485 | case FSCONFIG_SET_FD: | |
486 | if (param.file) | |
487 | fput(param.file); | |
488 | break; | |
489 | default: | |
490 | break; | |
491 | } | |
492 | out_key: | |
493 | kfree(param.key); | |
494 | out_f: | |
495 | fdput(f); | |
496 | return ret; | |
497 | } |