fs/fhandle.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 #include <linux/syscalls.h>
   3 #include <linux/slab.h>
   4 #include <linux/fs.h>
   5 #include <linux/file.h>
   6 #include <linux/mount.h>
   7 #include <linux/namei.h>
   8 #include <linux/exportfs.h>
   9 #include <linux/fs_struct.h>
  10 #include <linux/fsnotify.h>
  11 #include <linux/personality.h>
  12 #include <linux/uaccess.h>
  13 #include <linux/compat.h>
  14 #include "internal.h"
  15 #include "mount.h"
  16
  17 static long do_sys_name_to_handle(const struct path *path,
  18                                   struct file_handle __user *ufh,
  19                                   void __user *mnt_id, bool unique_mntid,
  20                                   int fh_flags)
  21 {
  22         long retval;
  23         struct file_handle f_handle;
  24         int handle_dwords, handle_bytes;
  25         struct file_handle *handle = NULL;
  26
  27         /*
  28          * We need to make sure whether the file system support decoding of
  29          * the file handle if decodeable file handle was requested.
  30          */
  31         if (!exportfs_can_encode_fh(path->dentry->d_sb->s_export_op, fh_flags))
  32                 return -EOPNOTSUPP;
  33
  34         /*
  35          * A request to encode a connectable handle for a disconnected dentry
  36          * is unexpected since AT_EMPTY_PATH is not allowed.
  37          */
  38         if (fh_flags & EXPORT_FH_CONNECTABLE &&
  39             WARN_ON(path->dentry->d_flags & DCACHE_DISCONNECTED))
  40                 return -EINVAL;
  41
  42         if (copy_from_user(&f_handle, ufh, sizeof(struct file_handle)))
  43                 return -EFAULT;
  44
  45         if (f_handle.handle_bytes > MAX_HANDLE_SZ)
  46                 return -EINVAL;
  47
  48         handle = kzalloc(struct_size(handle, f_handle, f_handle.handle_bytes),
  49                          GFP_KERNEL);
  50         if (!handle)
  51                 return -ENOMEM;
  52
  53         /* convert handle size to multiple of sizeof(u32) */
  54         handle_dwords = f_handle.handle_bytes >> 2;
  55
  56         /* Encode a possibly decodeable/connectable file handle */
  57         retval = exportfs_encode_fh(path->dentry,
  58                                     (struct fid *)handle->f_handle,
  59                                     &handle_dwords, fh_flags);
  60         handle->handle_type = retval;
  61         /* convert handle size to bytes */
  62         handle_bytes = handle_dwords * sizeof(u32);
  63         handle->handle_bytes = handle_bytes;
  64         if ((handle->handle_bytes > f_handle.handle_bytes) ||
  65             (retval == FILEID_INVALID) || (retval < 0)) {
  66                 /* As per old exportfs_encode_fh documentation
  67                  * we could return ENOSPC to indicate overflow
  68                  * But file system returned 255 always. So handle
  69                  * both the values
  70                  */
  71                 if (retval == FILEID_INVALID || retval == -ENOSPC)
  72                         retval = -EOVERFLOW;
  73                 /*
  74                  * set the handle size to zero so we copy only
  75                  * non variable part of the file_handle
  76                  */
  77                 handle_bytes = 0;
  78         } else {
  79                 /*
  80                  * When asked to encode a connectable file handle, encode this
  81                  * property in the file handle itself, so that we later know
  82                  * how to decode it.
  83                  * For sanity, also encode in the file handle if the encoded
  84                  * object is a directory and verify this during decode, because
  85                  * decoding directory file handles is quite different than
  86                  * decoding connectable non-directory file handles.
  87                  */
  88                 if (fh_flags & EXPORT_FH_CONNECTABLE) {
  89                         handle->handle_type |= FILEID_IS_CONNECTABLE;
  90                         if (d_is_dir(path->dentry))
  91                                 fh_flags |= FILEID_IS_DIR;
  92                 }
  93                 retval = 0;
  94         }
  95         /* copy the mount id */
  96         if (unique_mntid) {
  97                 if (put_user(real_mount(path->mnt)->mnt_id_unique,
  98                              (u64 __user *) mnt_id))
  99                         retval = -EFAULT;
 100         } else {
 101                 if (put_user(real_mount(path->mnt)->mnt_id,
 102                              (int __user *) mnt_id))
 103                         retval = -EFAULT;
 104         }
 105         /* copy the handle */
 106         if (retval != -EFAULT &&
 107                 copy_to_user(ufh, handle,
 108                              struct_size(handle, f_handle, handle_bytes)))
 109                 retval = -EFAULT;
 110         kfree(handle);
 111         return retval;
 112 }
 113
 114 /**
 115  * sys_name_to_handle_at: convert name to handle
 116  * @dfd: directory relative to which name is interpreted if not absolute
 117  * @name: name that should be converted to handle.
 118  * @handle: resulting file handle
 119  * @mnt_id: mount id of the file system containing the file
 120  *          (u64 if AT_HANDLE_MNT_ID_UNIQUE, otherwise int)
 121  * @flag: flag value to indicate whether to follow symlink or not
 122  *        and whether a decodable file handle is required.
 123  *
 124  * @handle->handle_size indicate the space available to store the
 125  * variable part of the file handle in bytes. If there is not
 126  * enough space, the field is updated to return the minimum
 127  * value required.
 128  */
 129 SYSCALL_DEFINE5(name_to_handle_at, int, dfd, const char __user *, name,
 130                 struct file_handle __user *, handle, void __user *, mnt_id,
 131                 int, flag)
 132 {
 133         struct path path;
 134         int lookup_flags;
 135         int fh_flags = 0;
 136         int err;
 137
 138         if (flag & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH | AT_HANDLE_FID |
 139                      AT_HANDLE_MNT_ID_UNIQUE | AT_HANDLE_CONNECTABLE))
 140                 return -EINVAL;
 141
 142         /*
 143          * AT_HANDLE_FID means there is no intention to decode file handle
 144          * AT_HANDLE_CONNECTABLE means there is an intention to decode a
 145          * connected fd (with known path), so these flags are conflicting.
 146          * AT_EMPTY_PATH could be used along with a dfd that refers to a
 147          * disconnected non-directory, which cannot be used to encode a
 148          * connectable file handle, because its parent is unknown.
 149          */
 150         if (flag & AT_HANDLE_CONNECTABLE &&
 151             flag & (AT_HANDLE_FID | AT_EMPTY_PATH))
 152                 return -EINVAL;
 153         else if (flag & AT_HANDLE_FID)
 154                 fh_flags |= EXPORT_FH_FID;
 155         else if (flag & AT_HANDLE_CONNECTABLE)
 156                 fh_flags |= EXPORT_FH_CONNECTABLE;
 157
 158         lookup_flags = (flag & AT_SYMLINK_FOLLOW) ? LOOKUP_FOLLOW : 0;
 159         if (flag & AT_EMPTY_PATH)
 160                 lookup_flags |= LOOKUP_EMPTY;
 161         err = user_path_at(dfd, name, lookup_flags, &path);
 162         if (!err) {
 163                 err = do_sys_name_to_handle(&path, handle, mnt_id,
 164                                             flag & AT_HANDLE_MNT_ID_UNIQUE,
 165                                             fh_flags);
 166                 path_put(&path);
 167         }
 168         return err;
 169 }
 170
 171 static int get_path_from_fd(int fd, struct path *root)
 172 {
 173         if (fd == AT_FDCWD) {
 174                 struct fs_struct *fs = current->fs;
 175                 spin_lock(&fs->lock);
 176                 *root = fs->pwd;
 177                 path_get(root);
 178                 spin_unlock(&fs->lock);
 179         } else {
 180                 CLASS(fd, f)(fd);
 181                 if (fd_empty(f))
 182                         return -EBADF;
 183                 *root = fd_file(f)->f_path;
 184                 path_get(root);
 185         }
 186
 187         return 0;
 188 }
 189
 190 enum handle_to_path_flags {
 191         HANDLE_CHECK_PERMS   = (1 << 0),
 192         HANDLE_CHECK_SUBTREE = (1 << 1),
 193 };
 194
 195 struct handle_to_path_ctx {
 196         struct path root;
 197         enum handle_to_path_flags flags;
 198         unsigned int fh_flags;
 199 };
 200
 201 static int vfs_dentry_acceptable(void *context, struct dentry *dentry)
 202 {
 203         struct handle_to_path_ctx *ctx = context;
 204         struct user_namespace *user_ns = current_user_ns();
 205         struct dentry *d, *root = ctx->root.dentry;
 206         struct mnt_idmap *idmap = mnt_idmap(ctx->root.mnt);
 207         int retval = 0;
 208
 209         if (!root)
 210                 return 1;
 211
 212         /* Old permission model with global CAP_DAC_READ_SEARCH. */
 213         if (!ctx->flags)
 214                 return 1;
 215
 216         /*
 217          * It's racy as we're not taking rename_lock but we're able to ignore
 218          * permissions and we just need an approximation whether we were able
 219          * to follow a path to the file.
 220          *
 221          * It's also potentially expensive on some filesystems especially if
 222          * there is a deep path.
 223          */
 224         d = dget(dentry);
 225         while (d != root && !IS_ROOT(d)) {
 226                 struct dentry *parent = dget_parent(d);
 227
 228                 /*
 229                  * We know that we have the ability to override DAC permissions
 230                  * as we've verified this earlier via CAP_DAC_READ_SEARCH. But
 231                  * we also need to make sure that there aren't any unmapped
 232                  * inodes in the path that would prevent us from reaching the
 233                  * file.
 234                  */
 235                 if (!privileged_wrt_inode_uidgid(user_ns, idmap,
 236                                                  d_inode(parent))) {
 237                         dput(d);
 238                         dput(parent);
 239                         return retval;
 240                 }
 241
 242                 dput(d);
 243                 d = parent;
 244         }
 245
 246         if (!(ctx->flags & HANDLE_CHECK_SUBTREE) || d == root)
 247                 retval = 1;
 248         /*
 249          * exportfs_decode_fh_raw() does not call acceptable() callback with
 250          * a disconnected directory dentry, so we should have reached either
 251          * mount fd directory or sb root.
 252          */
 253         if (ctx->fh_flags & EXPORT_FH_DIR_ONLY)
 254                 WARN_ON_ONCE(d != root && d != root->d_sb->s_root);
 255         dput(d);
 256         return retval;
 257 }
 258
 259 static int do_handle_to_path(struct file_handle *handle, struct path *path,
 260                              struct handle_to_path_ctx *ctx)
 261 {
 262         int handle_dwords;
 263         struct vfsmount *mnt = ctx->root.mnt;
 264
 265         /* change the handle size to multiple of sizeof(u32) */
 266         handle_dwords = handle->handle_bytes >> 2;
 267         path->dentry = exportfs_decode_fh_raw(mnt,
 268                                           (struct fid *)handle->f_handle,
 269                                           handle_dwords, handle->handle_type,
 270                                           ctx->fh_flags,
 271                                           vfs_dentry_acceptable, ctx);
 272         if (IS_ERR_OR_NULL(path->dentry)) {
 273                 if (path->dentry == ERR_PTR(-ENOMEM))
 274                         return -ENOMEM;
 275                 return -ESTALE;
 276         }
 277         path->mnt = mntget(mnt);
 278         return 0;
 279 }
 280
 281 /*
 282  * Allow relaxed permissions of file handles if the caller has the
 283  * ability to mount the filesystem or create a bind-mount of the
 284  * provided @mountdirfd.
 285  *
 286  * In both cases the caller may be able to get an unobstructed way to
 287  * the encoded file handle. If the caller is only able to create a
 288  * bind-mount we need to verify that there are no locked mounts on top
 289  * of it that could prevent us from getting to the encoded file.
 290  *
 291  * In principle, locked mounts can prevent the caller from mounting the
 292  * filesystem but that only applies to procfs and sysfs neither of which
 293  * support decoding file handles.
 294  */
 295 static inline bool may_decode_fh(struct handle_to_path_ctx *ctx,
 296                                  unsigned int o_flags)
 297 {
 298         struct path *root = &ctx->root;
 299
 300         /*
 301          * Restrict to O_DIRECTORY to provide a deterministic API that avoids a
 302          * confusing api in the face of disconnected non-dir dentries.
 303          *
 304          * There's only one dentry for each directory inode (VFS rule)...
 305          */
 306         if (!(o_flags & O_DIRECTORY))
 307                 return false;
 308
 309         if (ns_capable(root->mnt->mnt_sb->s_user_ns, CAP_SYS_ADMIN))
 310                 ctx->flags = HANDLE_CHECK_PERMS;
 311         else if (is_mounted(root->mnt) &&
 312                  ns_capable(real_mount(root->mnt)->mnt_ns->user_ns,
 313                             CAP_SYS_ADMIN) &&
 314                  !has_locked_children(real_mount(root->mnt), root->dentry))
 315                 ctx->flags = HANDLE_CHECK_PERMS | HANDLE_CHECK_SUBTREE;
 316         else
 317                 return false;
 318
 319         /* Are we able to override DAC permissions? */
 320         if (!ns_capable(current_user_ns(), CAP_DAC_READ_SEARCH))
 321                 return false;
 322
 323         ctx->fh_flags = EXPORT_FH_DIR_ONLY;
 324         return true;
 325 }
 326
 327 static int handle_to_path(int mountdirfd, struct file_handle __user *ufh,
 328                    struct path *path, unsigned int o_flags)
 329 {
 330         int retval = 0;
 331         struct file_handle f_handle;
 332         struct file_handle *handle = NULL;
 333         struct handle_to_path_ctx ctx = {};
 334
 335         retval = get_path_from_fd(mountdirfd, &ctx.root);
 336         if (retval)
 337                 goto out_err;
 338
 339         if (!capable(CAP_DAC_READ_SEARCH) && !may_decode_fh(&ctx, o_flags)) {
 340                 retval = -EPERM;
 341                 goto out_path;
 342         }
 343
 344         if (copy_from_user(&f_handle, ufh, sizeof(struct file_handle))) {
 345                 retval = -EFAULT;
 346                 goto out_path;
 347         }
 348         if ((f_handle.handle_bytes > MAX_HANDLE_SZ) ||
 349             (f_handle.handle_bytes == 0)) {
 350                 retval = -EINVAL;
 351                 goto out_path;
 352         }
 353         if (f_handle.handle_type < 0 ||
 354             FILEID_USER_FLAGS(f_handle.handle_type) & ~FILEID_VALID_USER_FLAGS) {
 355                 retval = -EINVAL;
 356                 goto out_path;
 357         }
 358
 359         handle = kmalloc(struct_size(handle, f_handle, f_handle.handle_bytes),
 360                          GFP_KERNEL);
 361         if (!handle) {
 362                 retval = -ENOMEM;
 363                 goto out_path;
 364         }
 365         /* copy the full handle */
 366         *handle = f_handle;
 367         if (copy_from_user(&handle->f_handle,
 368                            &ufh->f_handle,
 369                            f_handle.handle_bytes)) {
 370                 retval = -EFAULT;
 371                 goto out_handle;
 372         }
 373
 374         /*
 375          * If handle was encoded with AT_HANDLE_CONNECTABLE, verify that we
 376          * are decoding an fd with connected path, which is accessible from
 377          * the mount fd path.
 378          */
 379         if (f_handle.handle_type & FILEID_IS_CONNECTABLE) {
 380                 ctx.fh_flags |= EXPORT_FH_CONNECTABLE;
 381                 ctx.flags |= HANDLE_CHECK_SUBTREE;
 382         }
 383         if (f_handle.handle_type & FILEID_IS_DIR)
 384                 ctx.fh_flags |= EXPORT_FH_DIR_ONLY;
 385         /* Filesystem code should not be exposed to user flags */
 386         handle->handle_type &= ~FILEID_USER_FLAGS_MASK;
 387         retval = do_handle_to_path(handle, path, &ctx);
 388
 389 out_handle:
 390         kfree(handle);
 391 out_path:
 392         path_put(&ctx.root);
 393 out_err:
 394         return retval;
 395 }
 396
 397 static long do_handle_open(int mountdirfd, struct file_handle __user *ufh,
 398                            int open_flag)
 399 {
 400         long retval = 0;
 401         struct path path;
 402         struct file *file;
 403         int fd;
 404
 405         retval = handle_to_path(mountdirfd, ufh, &path, open_flag);
 406         if (retval)
 407                 return retval;
 408
 409         fd = get_unused_fd_flags(open_flag);
 410         if (fd < 0) {
 411                 path_put(&path);
 412                 return fd;
 413         }
 414         file = file_open_root(&path, "", open_flag, 0);
 415         if (IS_ERR(file)) {
 416                 put_unused_fd(fd);
 417                 retval =  PTR_ERR(file);
 418         } else {
 419                 retval = fd;
 420                 fd_install(fd, file);
 421         }
 422         path_put(&path);
 423         return retval;
 424 }
 425
 426 /**
 427  * sys_open_by_handle_at: Open the file handle
 428  * @mountdirfd: directory file descriptor
 429  * @handle: file handle to be opened
 430  * @flags: open flags.
 431  *
 432  * @mountdirfd indicate the directory file descriptor
 433  * of the mount point. file handle is decoded relative
 434  * to the vfsmount pointed by the @mountdirfd. @flags
 435  * value is same as the open(2) flags.
 436  */
 437 SYSCALL_DEFINE3(open_by_handle_at, int, mountdirfd,
 438                 struct file_handle __user *, handle,
 439                 int, flags)
 440 {
 441         long ret;
 442
 443         if (force_o_largefile())
 444                 flags |= O_LARGEFILE;
 445
 446         ret = do_handle_open(mountdirfd, handle, flags);
 447         return ret;
 448 }
 449
 450 #ifdef CONFIG_COMPAT
 451 /*
 452  * Exactly like fs/open.c:sys_open_by_handle_at(), except that it
 453  * doesn't set the O_LARGEFILE flag.
 454  */
 455 COMPAT_SYSCALL_DEFINE3(open_by_handle_at, int, mountdirfd,
 456                              struct file_handle __user *, handle, int, flags)
 457 {
 458         return do_handle_open(mountdirfd, handle, flags);
 459 }
 460 #endif