1 // SPDX-License-Identifier: GPL-2.0
2 #include <linux/syscalls.h>
3 #include <linux/slab.h>
4 #include <linux/fs.h>
5 #include <linux/file.h>
6 #include <linux/mount.h>
7 #include <linux/namei.h>
8 #include <linux/exportfs.h>
9 #include <linux/fs_struct.h>
10 #include <linux/fsnotify.h>
11 #include <linux/personality.h>
12 #include <linux/uaccess.h>
13 #include <linux/compat.h>
14 #include "internal.h"
15 #include "mount.h"
16
17 static long do_sys_name_to_handle(const struct path *path,
18 struct file_handle __user *ufh,
19 int __user *mnt_id, int fh_flags)
20 {
21 long retval;
22 struct file_handle f_handle;
23 int handle_dwords, handle_bytes;
24 struct file_handle *handle = NULL;
25
26 /*
27 * We need to make sure whether the file system support decoding of
28 * the file handle if decodeable file handle was requested.
29 */
30 if (!exportfs_can_encode_fh(path->dentry->d_sb->s_export_op, fh_flags))
31 return -EOPNOTSUPP;
32
33 if (copy_from_user(&f_handle, ufh, sizeof(struct file_handle)))
34 return -EFAULT;
35
36 if (f_handle.handle_bytes > MAX_HANDLE_SZ)
37 return -EINVAL;
38
39 handle = kzalloc(struct_size(handle, f_handle, f_handle.handle_bytes),
40 GFP_KERNEL);
41 if (!handle)
42 return -ENOMEM;
43
44 /* convert handle size to multiple of sizeof(u32) */
45 handle_dwords = f_handle.handle_bytes >> 2;
46
47 /* we ask for a non connectable maybe decodeable file handle */
48 retval = exportfs_encode_fh(path->dentry,
49 (struct fid *)handle->f_handle,
50 &handle_dwords, fh_flags);
51 handle->handle_type = retval;
52 /* convert handle size to bytes */
53 handle_bytes = handle_dwords * sizeof(u32);
54 handle->handle_bytes = handle_bytes;
55 if ((handle->handle_bytes > f_handle.handle_bytes) ||
56 (retval == FILEID_INVALID) || (retval < 0)) {
57 /* As per old exportfs_encode_fh documentation
58 * we could return ENOSPC to indicate overflow
59 * But file system returned 255 always. So handle
60 * both the values
61 */
62 if (retval == FILEID_INVALID || retval == -ENOSPC)
63 retval = -EOVERFLOW;
64 /*
65 * set the handle size to zero so we copy only
66 * non variable part of the file_handle
67 */
68 handle_bytes = 0;
69 } else
70 retval = 0;
71 /* copy the mount id */
72 if (put_user(real_mount(path->mnt)->mnt_id, mnt_id) ||
73 copy_to_user(ufh, handle,
74 struct_size(handle, f_handle, handle_bytes)))
75 retval = -EFAULT;
76 kfree(handle);
77 return retval;
78 }
79
80 /**
81 * sys_name_to_handle_at: convert name to handle
82 * @dfd: directory relative to which name is interpreted if not absolute
83 * @name: name that should be converted to handle.
84 * @handle: resulting file handle
85 * @mnt_id: mount id of the file system containing the file
86 * @flag: flag value to indicate whether to follow symlink or not
87 * and whether a decodable file handle is required.
88 *
89 * @handle->handle_size indicate the space available to store the
90 * variable part of the file handle in bytes. If there is not
91 * enough space, the field is updated to return the minimum
92 * value required.
93 */
94 SYSCALL_DEFINE5(name_to_handle_at, int, dfd, const char __user *, name,
95 struct file_handle __user *, handle, int __user *, mnt_id,
96 int, flag)
97 {
98 struct path path;
99 int lookup_flags;
100 int fh_flags;
101 int err;
102
103 if (flag & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH | AT_HANDLE_FID))
104 return -EINVAL;
105
106 lookup_flags = (flag & AT_SYMLINK_FOLLOW) ? LOOKUP_FOLLOW : 0;
107 fh_flags = (flag & AT_HANDLE_FID) ? EXPORT_FH_FID : 0;
108 if (flag & AT_EMPTY_PATH)
109 lookup_flags |= LOOKUP_EMPTY;
110 err = user_path_at(dfd, name, lookup_flags, &path);
111 if (!err) {
112 err = do_sys_name_to_handle(&path, handle, mnt_id, fh_flags);
113 path_put(&path);
114 }
115 return err;
116 }
117
118 static int get_path_from_fd(int fd, struct path *root)
119 {
120 if (fd == AT_FDCWD) {
121 struct fs_struct *fs = current->fs;
122 spin_lock(&fs->lock);
123 *root = fs->pwd;
124 path_get(root);
125 spin_unlock(&fs->lock);
126 } else {
127 struct fd f = fdget(fd);
128 if (!f.file)
129 return -EBADF;
130 *root = f.file->f_path;
131 path_get(root);
132 fdput(f);
133 }
134
135 return 0;
136 }
137
138 enum handle_to_path_flags {
139 HANDLE_CHECK_PERMS = (1 << 0),
140 HANDLE_CHECK_SUBTREE = (1 << 1),
141 };
142
143 struct handle_to_path_ctx {
144 struct path root;
145 enum handle_to_path_flags flags;
146 unsigned int fh_flags;
147 };
148
149 static int vfs_dentry_acceptable(void *context, struct dentry *dentry)
150 {
151 struct handle_to_path_ctx *ctx = context;
152 struct user_namespace *user_ns = current_user_ns();
153 struct dentry *d, *root = ctx->root.dentry;
154 struct mnt_idmap *idmap = mnt_idmap(ctx->root.mnt);
155 int retval = 0;
156
157 if (!root)
158 return 1;
159
160 /* Old permission model with global CAP_DAC_READ_SEARCH. */
161 if (!ctx->flags)
162 return 1;
163
164 /*
165 * It's racy as we're not taking rename_lock but we're able to ignore
166 * permissions and we just need an approximation whether we were able
167 * to follow a path to the file.
168 *
169 * It's also potentially expensive on some filesystems especially if
170 * there is a deep path.
171 */
172 d = dget(dentry);
173 while (d != root && !IS_ROOT(d)) {
174 struct dentry *parent = dget_parent(d);
175
176 /*
177 * We know that we have the ability to override DAC permissions
178 * as we've verified this earlier via CAP_DAC_READ_SEARCH. But
179 * we also need to make sure that there aren't any unmapped
180 * inodes in the path that would prevent us from reaching the
181 * file.
182 */
183 if (!privileged_wrt_inode_uidgid(user_ns, idmap,
184 d_inode(parent))) {
185 dput(d);
186 dput(parent);
187 return retval;
188 }
189
190 dput(d);
191 d = parent;
192 }
193
194 if (!(ctx->flags & HANDLE_CHECK_SUBTREE) || d == root)
195 retval = 1;
196 WARN_ON_ONCE(d != root && d != root->d_sb->s_root);
197 dput(d);
198 return retval;
199 }
200
201 static int do_handle_to_path(struct file_handle *handle, struct path *path,
202 struct handle_to_path_ctx *ctx)
203 {
204 int handle_dwords;
205 struct vfsmount *mnt = ctx->root.mnt;
206
207 /* change the handle size to multiple of sizeof(u32) */
208 handle_dwords = handle->handle_bytes >> 2;
209 path->dentry = exportfs_decode_fh_raw(mnt,
210 (struct fid *)handle->f_handle,
211 handle_dwords, handle->handle_type,
212 ctx->fh_flags,
213 vfs_dentry_acceptable, ctx);
214 if (IS_ERR_OR_NULL(path->dentry)) {
215 if (path->dentry == ERR_PTR(-ENOMEM))
216 return -ENOMEM;
217 return -ESTALE;
218 }
219 path->mnt = mntget(mnt);
220 return 0;
221 }
222
223 /*
224 * Allow relaxed permissions of file handles if the caller has the
225 * ability to mount the filesystem or create a bind-mount of the
226 * provided @mountdirfd.
227 *
228 * In both cases the caller may be able to get an unobstructed way to
229 * the encoded file handle. If the caller is only able to create a
230 * bind-mount we need to verify that there are no locked mounts on top
231 * of it that could prevent us from getting to the encoded file.
232 *
233 * In principle, locked mounts can prevent the caller from mounting the
234 * filesystem but that only applies to procfs and sysfs neither of which
235 * support decoding file handles.
236 */
237 static inline bool may_decode_fh(struct handle_to_path_ctx *ctx,
238 unsigned int o_flags)
239 {
240 struct path *root = &ctx->root;
241
242 /*
243 * Restrict to O_DIRECTORY to provide a deterministic API that avoids a
244 * confusing api in the face of disconnected non-dir dentries.
245 *
246 * There's only one dentry for each directory inode (VFS rule)...
247 */
248 if (!(o_flags & O_DIRECTORY))
249 return false;
250
251 if (ns_capable(root->mnt->mnt_sb->s_user_ns, CAP_SYS_ADMIN))
252 ctx->flags = HANDLE_CHECK_PERMS;
253 else if (is_mounted(root->mnt) &&
254 ns_capable(real_mount(root->mnt)->mnt_ns->user_ns,
255 CAP_SYS_ADMIN) &&
256 !has_locked_children(real_mount(root->mnt), root->dentry))
257 ctx->flags = HANDLE_CHECK_PERMS | HANDLE_CHECK_SUBTREE;
258 else
259 return false;
260
261 /* Are we able to override DAC permissions? */
262 if (!ns_capable(current_user_ns(), CAP_DAC_READ_SEARCH))
263 return false;
264
265 ctx->fh_flags = EXPORT_FH_DIR_ONLY;
266 return true;
267 }
268
269 static int handle_to_path(int mountdirfd, struct file_handle __user *ufh,
270 struct path *path, unsigned int o_flags)
271 {
272 int retval = 0;
273 struct file_handle f_handle;
274 struct file_handle *handle = NULL;
275 struct handle_to_path_ctx ctx = {};
276
277 retval = get_path_from_fd(mountdirfd, &ctx.root);
278 if (retval)
279 goto out_err;
280
281 if (!capable(CAP_DAC_READ_SEARCH) && !may_decode_fh(&ctx, o_flags)) {
282 retval = -EPERM;
283 goto out_path;
284 }
285
286 if (copy_from_user(&f_handle, ufh, sizeof(struct file_handle))) {
287 retval = -EFAULT;
288 goto out_path;
289 }
290 if ((f_handle.handle_bytes > MAX_HANDLE_SZ) ||
291 (f_handle.handle_bytes == 0)) {
292 retval = -EINVAL;
293 goto out_path;
294 }
295 handle = kmalloc(struct_size(handle, f_handle, f_handle.handle_bytes),
296 GFP_KERNEL);
297 if (!handle) {
298 retval = -ENOMEM;
299 goto out_path;
300 }
301 /* copy the full handle */
302 *handle = f_handle;
303 if (copy_from_user(&handle->f_handle,
304 &ufh->f_handle,
305 f_handle.handle_bytes)) {
306 retval = -EFAULT;
307 goto out_handle;
308 }
309
310 retval = do_handle_to_path(handle, path, &ctx);
311
312 out_handle:
313 kfree(handle);
314 out_path:
315 path_put(&ctx.root);
316 out_err:
317 return retval;
318 }
319
320 static long do_handle_open(int mountdirfd, struct file_handle __user *ufh,
321 int open_flag)
322 {
323 long retval = 0;
324 struct path path;
325 struct file *file;
326 int fd;
327
328 retval = handle_to_path(mountdirfd, ufh, &path, open_flag);
329 if (retval)
330 return retval;
331
332 fd = get_unused_fd_flags(open_flag);
333 if (fd < 0) {
334 path_put(&path);
335 return fd;
336 }
337 file = file_open_root(&path, "", open_flag, 0);
338 if (IS_ERR(file)) {
339 put_unused_fd(fd);
340 retval = PTR_ERR(file);
341 } else {
342 retval = fd;
343 fd_install(fd, file);
344 }
345 path_put(&path);
346 return retval;
347 }
348
349 /**
350 * sys_open_by_handle_at: Open the file handle
351 * @mountdirfd: directory file descriptor
352 * @handle: file handle to be opened
353 * @flags: open flags.
354 *
355 * @mountdirfd indicate the directory file descriptor
356 * of the mount point. file handle is decoded relative
357 * to the vfsmount pointed by the @mountdirfd. @flags
358 * value is same as the open(2) flags.
359 */
360 SYSCALL_DEFINE3(open_by_handle_at, int, mountdirfd,
361 struct file_handle __user *, handle,
362 int, flags)
363 {
364 long ret;
365
366 if (force_o_largefile())
367 flags |= O_LARGEFILE;
368
369 ret = do_handle_open(mountdirfd, handle, flags);
370 return ret;
371 }
372
373 #ifdef CONFIG_COMPAT
374 /*
375 * Exactly like fs/open.c:sys_open_by_handle_at(), except that it
376 * doesn't set the O_LARGEFILE flag.
377 */
378 COMPAT_SYSCALL_DEFINE3(open_by_handle_at, int, mountdirfd,
379 struct file_handle __user *, handle, int, flags)
380 {
381 return do_handle_open(mountdirfd, handle, flags);
382 }
383 #endif
384
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.