xfs: hide private inodes from bulkstat and handle functions

We're about to start adding functionality that uses internal inodes that
are private to XFS.  What this means is that userspace should never be
able to access any information about these files, and should not be able
to open these files by handle.

To prevent users from ever finding the file or mis-interactions with the
security apparatus, set S_PRIVATE on the inode.  Don't allow bulkstat,
open-by-handle, or linking of S_PRIVATE files into the directory tree.
This should keep private inodes actually private.

Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>

diff --git a/fs/xfs/xfs_export.c b/fs/xfs/xfs_export.c
index 7cd09c3a82cb5013ced681bc389266d21da90a60..4b03221351c0f1a7cc8822ae40652d1bf71e4913 100644 (file)
--- a/fs/xfs/xfs_export.c
+++ b/fs/xfs/xfs_export.c
@@ -160,7 +160,7 @@ xfs_nfs_get_inode(
                }
        }
 
-       if (VFS_I(ip)->i_generation != generation) {
+       if (VFS_I(ip)->i_generation != generation || IS_PRIVATE(VFS_I(ip))) {
                xfs_irele(ip);
                return ERR_PTR(-ESTALE);
        }

diff --git a/fs/xfs/xfs_iops.c b/fs/xfs/xfs_iops.c
index 55ed2d1023d6758fd58fece4bc62869580dd8b43..7f0c840f0fd2fb36818d21307d33372e94fae455 100644 (file)
--- a/fs/xfs/xfs_iops.c
+++ b/fs/xfs/xfs_iops.c
@@ -365,6 +365,9 @@ xfs_vn_link(
        if (unlikely(error))
                return error;
 
+       if (IS_PRIVATE(inode))
+               return -EPERM;
+
        error = xfs_link(XFS_I(dir), XFS_I(inode), &name);
        if (unlikely(error))
                return error;

diff --git a/fs/xfs/xfs_itable.c b/fs/xfs/xfs_itable.c
index 95fc31b9f87d6236967569201ada8e3e25415927..c0757ab994957ba2d14d43df9c4faebaf31e0aad 100644 (file)
--- a/fs/xfs/xfs_itable.c
+++ b/fs/xfs/xfs_itable.c
@@ -97,6 +97,14 @@ xfs_bulkstat_one_int(
        vfsuid = i_uid_into_vfsuid(idmap, inode);
        vfsgid = i_gid_into_vfsgid(idmap, inode);
 
+       /* If this is a private inode, don't leak its details to userspace. */
+       if (IS_PRIVATE(inode)) {
+               xfs_iunlock(ip, XFS_ILOCK_SHARED);
+               xfs_irele(ip);
+               error = -EINVAL;
+               goto out_advance;
+       }
+
        /* xfs_iget returns the following without needing
         * further change.
         */