fs/fhandle.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 #include <linux/syscalls.h>
   3 #include <linux/slab.h>
   4 #include <linux/fs.h>
   5 #include <linux/file.h>
   6 #include <linux/mount.h>
   7 #include <linux/namei.h>
   8 #include <linux/exportfs.h>
   9 #include <linux/fs_struct.h>
  10 #include <linux/fsnotify.h>
  11 #include <linux/personality.h>
  12 #include <linux/uaccess.h>
  13 #include <linux/compat.h>
  14 #include "internal.h"
  15 #include "mount.h"
  16
  17 static long do_sys_name_to_handle(const struct path *path,
  18                                   struct file_handle __user *ufh,
  19                                   void __user *mnt_id, bool unique_mntid,
  20                                   int fh_flags)
  21 {
  22         long retval;
  23         struct file_handle f_handle;
  24         int handle_dwords, handle_bytes;
  25         struct file_handle *handle = NULL;
  26
  27         /*
  28          * We need to make sure whether the file system support decoding of
  29          * the file handle if decodeable file handle was requested.
  30          */
  31         if (!exportfs_can_encode_fh(path->dentry->d_sb->s_export_op, fh_flags))
  32                 return -EOPNOTSUPP;
  33
  34         /*
  35          * A request to encode a connectable handle for a disconnected dentry
  36          * is unexpected since AT_EMPTY_PATH is not allowed.
  37          */
  38         if (fh_flags & EXPORT_FH_CONNECTABLE &&
  39             WARN_ON(path->dentry->d_flags & DCACHE_DISCONNECTED))
  40                 return -EINVAL;
  41
  42         if (copy_from_user(&f_handle, ufh, sizeof(struct file_handle)))
  43                 return -EFAULT;
  44
  45         if (f_handle.handle_bytes > MAX_HANDLE_SZ)
  46                 return -EINVAL;
  47
  48         handle = kzalloc(struct_size(handle, f_handle, f_handle.handle_bytes),
  49                          GFP_KERNEL);
  50         if (!handle)
  51                 return -ENOMEM;
  52
  53         /* convert handle size to multiple of sizeof(u32) */
  54         handle_dwords = f_handle.handle_bytes >> 2;
  55
  56         /* Encode a possibly decodeable/connectable file handle */
  57         retval = exportfs_encode_fh(path->dentry,
  58                                     (struct fid *)handle->f_handle,
  59                                     &handle_dwords, fh_flags);
  60         handle->handle_type = retval;
  61         /* convert handle size to bytes */
  62         handle_bytes = handle_dwords * sizeof(u32);
  63         handle->handle_bytes = handle_bytes;
  64         if ((handle->handle_bytes > f_handle.handle_bytes) ||
  65             (retval == FILEID_INVALID) || (retval < 0)) {
  66                 /* As per old exportfs_encode_fh documentation
  67                  * we could return ENOSPC to indicate overflow
  68                  * But file system returned 255 always. So handle
  69                  * both the values
  70                  */
  71                 if (retval == FILEID_INVALID || retval == -ENOSPC)
  72                         retval = -EOVERFLOW;
  73                 /*
  74                  * set the handle size to zero so we copy only
  75                  * non variable part of the file_handle
  76                  */
  77                 handle_bytes = 0;
  78         } else {
  79                 /*
  80                  * When asked to encode a connectable file handle, encode this
  81                  * property in the file handle itself, so that we later know
  82                  * how to decode it.
  83                  * For sanity, also encode in the file handle if the encoded
  84                  * object is a directory and verify this during decode, because
  85                  * decoding directory file handles is quite different than
  86                  * decoding connectable non-directory file handles.
  87                  */
  88                 if (fh_flags & EXPORT_FH_CONNECTABLE) {
  89                         handle->handle_type |= FILEID_IS_CONNECTABLE;
  90                         if (d_is_dir(path->dentry))
  91                                 fh_flags |= FILEID_IS_DIR;
  92                 }
  93                 retval = 0;
  94         }
  95         /* copy the mount id */
  96         if (unique_mntid) {
  97                 if (put_user(real_mount(path->mnt)->mnt_id_unique,
  98                              (u64 __user *) mnt_id))
  99                         retval = -EFAULT;
 100         } else {
 101                 if (put_user(real_mount(path->mnt)->mnt_id,
 102                              (int __user *) mnt_id))
 103                         retval = -EFAULT;
 104         }
 105         /* copy the handle */
 106         if (retval != -EFAULT &&
 107                 copy_to_user(ufh, handle,
 108                              struct_size(handle, f_handle, handle_bytes)))
 109                 retval = -EFAULT;
 110         kfree(handle);
 111         return retval;
 112 }
 113
 114 /**
 115  * sys_name_to_handle_at: convert name to handle
 116  * @dfd: directory relative to which name is interpreted if not absolute
 117  * @name: name that should be converted to handle.
 118  * @handle: resulting file handle
 119  * @mnt_id: mount id of the file system containing the file
 120  *          (u64 if AT_HANDLE_MNT_ID_UNIQUE, otherwise int)
 121  * @flag: flag value to indicate whether to follow symlink or not
 122  *        and whether a decodable file handle is required.
 123  *
 124  * @handle->handle_size indicate the space available to store the
 125  * variable part of the file handle in bytes. If there is not
 126  * enough space, the field is updated to return the minimum
 127  * value required.
 128  */
 129 SYSCALL_DEFINE5(name_to_handle_at, int, dfd, const char __user *, name,
 130                 struct file_handle __user *, handle, void __user *, mnt_id,
 131                 int, flag)
 132 {
 133         struct path path;
 134         int lookup_flags;
 135         int fh_flags = 0;
 136         int err;
 137
 138         if (flag & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH | AT_HANDLE_FID |
 139                      AT_HANDLE_MNT_ID_UNIQUE | AT_HANDLE_CONNECTABLE))
 140                 return -EINVAL;
 141
 142         /*
 143          * AT_HANDLE_FID means there is no intention to decode file handle
 144          * AT_HANDLE_CONNECTABLE means there is an intention to decode a
 145          * connected fd (with known path), so these flags are conflicting.
 146          * AT_EMPTY_PATH could be used along with a dfd that refers to a
 147          * disconnected non-directory, which cannot be used to encode a
 148          * connectable file handle, because its parent is unknown.
 149          */
 150         if (flag & AT_HANDLE_CONNECTABLE &&
 151             flag & (AT_HANDLE_FID | AT_EMPTY_PATH))
 152                 return -EINVAL;
 153         else if (flag & AT_HANDLE_FID)
 154                 fh_flags |= EXPORT_FH_FID;
 155         else if (flag & AT_HANDLE_CONNECTABLE)
 156                 fh_flags |= EXPORT_FH_CONNECTABLE;
 157
 158         lookup_flags = (flag & AT_SYMLINK_FOLLOW) ? LOOKUP_FOLLOW : 0;
 159         if (flag & AT_EMPTY_PATH)
 160                 lookup_flags |= LOOKUP_EMPTY;
 161         err = user_path_at(dfd, name, lookup_flags, &path);
 162         if (!err) {
 163                 err = do_sys_name_to_handle(&path, handle, mnt_id,
 164                                             flag & AT_HANDLE_MNT_ID_UNIQUE,
 165                                             fh_flags);
 166                 path_put(&path);
 167         }
 168         return err;
 169 }
 170
 171 static int get_path_from_fd(int fd, struct path *root)
 172 {
 173         if (fd == AT_FDCWD) {
 174                 struct fs_struct *fs = current->fs;
 175                 spin_lock(&fs->lock);
 176                 *root = fs->pwd;
 177                 path_get(root);
 178                 spin_unlock(&fs->lock);
 179         } else {
 180                 CLASS(fd, f)(fd);
 181                 if (fd_empty(f))
 182                         return -EBADF;
 183                 *root = fd_file(f)->f_path;
 184                 path_get(root);
 185         }
 186
 187         return 0;
 188 }
 189
 190 static int vfs_dentry_acceptable(void *context, struct dentry *dentry)
 191 {
 192         struct handle_to_path_ctx *ctx = context;
 193         struct user_namespace *user_ns = current_user_ns();
 194         struct dentry *d, *root = ctx->root.dentry;
 195         struct mnt_idmap *idmap = mnt_idmap(ctx->root.mnt);
 196         int retval = 0;
 197
 198         if (!root)
 199                 return 1;
 200
 201         /* Old permission model with global CAP_DAC_READ_SEARCH. */
 202         if (!ctx->flags)
 203                 return 1;
 204
 205         /*
 206          * It's racy as we're not taking rename_lock but we're able to ignore
 207          * permissions and we just need an approximation whether we were able
 208          * to follow a path to the file.
 209          *
 210          * It's also potentially expensive on some filesystems especially if
 211          * there is a deep path.
 212          */
 213         d = dget(dentry);
 214         while (d != root && !IS_ROOT(d)) {
 215                 struct dentry *parent = dget_parent(d);
 216
 217                 /*
 218                  * We know that we have the ability to override DAC permissions
 219                  * as we've verified this earlier via CAP_DAC_READ_SEARCH. But
 220                  * we also need to make sure that there aren't any unmapped
 221                  * inodes in the path that would prevent us from reaching the
 222                  * file.
 223                  */
 224                 if (!privileged_wrt_inode_uidgid(user_ns, idmap,
 225                                                  d_inode(parent))) {
 226                         dput(d);
 227                         dput(parent);
 228                         return retval;
 229                 }
 230
 231                 dput(d);
 232                 d = parent;
 233         }
 234
 235         if (!(ctx->flags & HANDLE_CHECK_SUBTREE) || d == root)
 236                 retval = 1;
 237         /*
 238          * exportfs_decode_fh_raw() does not call acceptable() callback with
 239          * a disconnected directory dentry, so we should have reached either
 240          * mount fd directory or sb root.
 241          */
 242         if (ctx->fh_flags & EXPORT_FH_DIR_ONLY)
 243                 WARN_ON_ONCE(d != root && d != root->d_sb->s_root);
 244         dput(d);
 245         return retval;
 246 }
 247
 248 static int do_handle_to_path(struct file_handle *handle, struct path *path,
 249                              struct handle_to_path_ctx *ctx)
 250 {
 251         int handle_dwords;
 252         struct vfsmount *mnt = ctx->root.mnt;
 253         struct dentry *dentry;
 254
 255         /* change the handle size to multiple of sizeof(u32) */
 256         handle_dwords = handle->handle_bytes >> 2;
 257         dentry = exportfs_decode_fh_raw(mnt, (struct fid *)handle->f_handle,
 258                                         handle_dwords, handle->handle_type,
 259                                         ctx->fh_flags, vfs_dentry_acceptable,
 260                                         ctx);
 261         if (IS_ERR_OR_NULL(dentry)) {
 262                 if (dentry == ERR_PTR(-ENOMEM))
 263                         return -ENOMEM;
 264                 return -ESTALE;
 265         }
 266         path->dentry = dentry;
 267         path->mnt = mntget(mnt);
 268         return 0;
 269 }
 270
 271 static inline int may_decode_fh(struct handle_to_path_ctx *ctx,
 272                                 unsigned int o_flags)
 273 {
 274         struct path *root = &ctx->root;
 275
 276         if (capable(CAP_DAC_READ_SEARCH))
 277                 return 0;
 278
 279         /*
 280          * Allow relaxed permissions of file handles if the caller has
 281          * the ability to mount the filesystem or create a bind-mount of
 282          * the provided @mountdirfd.
 283          *
 284          * In both cases the caller may be able to get an unobstructed
 285          * way to the encoded file handle. If the caller is only able to
 286          * create a bind-mount we need to verify that there are no
 287          * locked mounts on top of it that could prevent us from getting
 288          * to the encoded file.
 289          *
 290          * In principle, locked mounts can prevent the caller from
 291          * mounting the filesystem but that only applies to procfs and
 292          * sysfs neither of which support decoding file handles.
 293          *
 294          * Restrict to O_DIRECTORY to provide a deterministic API that
 295          * avoids a confusing api in the face of disconnected non-dir
 296          * dentries.
 297          *
 298          * There's only one dentry for each directory inode (VFS rule)...
 299          */
 300         if (!(o_flags & O_DIRECTORY))
 301                 return -EPERM;
 302
 303         if (ns_capable(root->mnt->mnt_sb->s_user_ns, CAP_SYS_ADMIN))
 304                 ctx->flags = HANDLE_CHECK_PERMS;
 305         else if (is_mounted(root->mnt) &&
 306                  ns_capable(real_mount(root->mnt)->mnt_ns->user_ns,
 307                             CAP_SYS_ADMIN) &&
 308                  !has_locked_children(real_mount(root->mnt), root->dentry))
 309                 ctx->flags = HANDLE_CHECK_PERMS | HANDLE_CHECK_SUBTREE;
 310         else
 311                 return -EPERM;
 312
 313         /* Are we able to override DAC permissions? */
 314         if (!ns_capable(current_user_ns(), CAP_DAC_READ_SEARCH))
 315                 return -EPERM;
 316
 317         ctx->fh_flags = EXPORT_FH_DIR_ONLY;
 318         return 0;
 319 }
 320
 321 static int handle_to_path(int mountdirfd, struct file_handle __user *ufh,
 322                    struct path *path, unsigned int o_flags)
 323 {
 324         int retval = 0;
 325         struct file_handle f_handle;
 326         struct file_handle *handle = NULL;
 327         struct handle_to_path_ctx ctx = {};
 328         const struct export_operations *eops;
 329
 330         retval = get_path_from_fd(mountdirfd, &ctx.root);
 331         if (retval)
 332                 goto out_err;
 333
 334         eops = ctx.root.mnt->mnt_sb->s_export_op;
 335         if (eops && eops->permission)
 336                 retval = eops->permission(&ctx, o_flags);
 337         else
 338                 retval = may_decode_fh(&ctx, o_flags);
 339         if (retval)
 340                 goto out_path;
 341
 342         if (copy_from_user(&f_handle, ufh, sizeof(struct file_handle))) {
 343                 retval = -EFAULT;
 344                 goto out_path;
 345         }
 346         if ((f_handle.handle_bytes > MAX_HANDLE_SZ) ||
 347             (f_handle.handle_bytes == 0)) {
 348                 retval = -EINVAL;
 349                 goto out_path;
 350         }
 351         if (f_handle.handle_type < 0 ||
 352             FILEID_USER_FLAGS(f_handle.handle_type) & ~FILEID_VALID_USER_FLAGS) {
 353                 retval = -EINVAL;
 354                 goto out_path;
 355         }
 356
 357         handle = kmalloc(struct_size(handle, f_handle, f_handle.handle_bytes),
 358                          GFP_KERNEL);
 359         if (!handle) {
 360                 retval = -ENOMEM;
 361                 goto out_path;
 362         }
 363         /* copy the full handle */
 364         *handle = f_handle;
 365         if (copy_from_user(&handle->f_handle,
 366                            &ufh->f_handle,
 367                            f_handle.handle_bytes)) {
 368                 retval = -EFAULT;
 369                 goto out_handle;
 370         }
 371
 372         /*
 373          * If handle was encoded with AT_HANDLE_CONNECTABLE, verify that we
 374          * are decoding an fd with connected path, which is accessible from
 375          * the mount fd path.
 376          */
 377         if (f_handle.handle_type & FILEID_IS_CONNECTABLE) {
 378                 ctx.fh_flags |= EXPORT_FH_CONNECTABLE;
 379                 ctx.flags |= HANDLE_CHECK_SUBTREE;
 380         }
 381         if (f_handle.handle_type & FILEID_IS_DIR)
 382                 ctx.fh_flags |= EXPORT_FH_DIR_ONLY;
 383         /* Filesystem code should not be exposed to user flags */
 384         handle->handle_type &= ~FILEID_USER_FLAGS_MASK;
 385         retval = do_handle_to_path(handle, path, &ctx);
 386
 387 out_handle:
 388         kfree(handle);
 389 out_path:
 390         path_put(&ctx.root);
 391 out_err:
 392         return retval;
 393 }
 394
 395 static long do_handle_open(int mountdirfd, struct file_handle __user *ufh,
 396                            int open_flag)
 397 {
 398         long retval = 0;
 399         struct path path __free(path_put) = {};
 400         struct file *file;
 401         const struct export_operations *eops;
 402
 403         retval = handle_to_path(mountdirfd, ufh, &path, open_flag);
 404         if (retval)
 405                 return retval;
 406
 407         CLASS(get_unused_fd, fd)(O_CLOEXEC);
 408         if (fd < 0)
 409                 return fd;
 410
 411         eops = path.mnt->mnt_sb->s_export_op;
 412         if (eops->open)
 413                 file = eops->open(&path, open_flag);
 414         else
 415                 file = file_open_root(&path, "", open_flag, 0);
 416         if (IS_ERR(file))
 417                 return PTR_ERR(file);
 418
 419         fd_install(fd, file);
 420         return take_fd(fd);
 421 }
 422
 423 /**
 424  * sys_open_by_handle_at: Open the file handle
 425  * @mountdirfd: directory file descriptor
 426  * @handle: file handle to be opened
 427  * @flags: open flags.
 428  *
 429  * @mountdirfd indicate the directory file descriptor
 430  * of the mount point. file handle is decoded relative
 431  * to the vfsmount pointed by the @mountdirfd. @flags
 432  * value is same as the open(2) flags.
 433  */
 434 SYSCALL_DEFINE3(open_by_handle_at, int, mountdirfd,
 435                 struct file_handle __user *, handle,
 436                 int, flags)
 437 {
 438         long ret;
 439
 440         if (force_o_largefile())
 441                 flags |= O_LARGEFILE;
 442
 443         ret = do_handle_open(mountdirfd, handle, flags);
 444         return ret;
 445 }
 446
 447 #ifdef CONFIG_COMPAT
 448 /*
 449  * Exactly like fs/open.c:sys_open_by_handle_at(), except that it
 450  * doesn't set the O_LARGEFILE flag.
 451  */
 452 COMPAT_SYSCALL_DEFINE3(open_by_handle_at, int, mountdirfd,
 453                              struct file_handle __user *, handle, int, flags)
 454 {
 455         return do_handle_open(mountdirfd, handle, flags);
 456 }
 457 #endif