]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/blob - fs/attr.c
xattr: handle idmapped mounts
[mirror_ubuntu-jammy-kernel.git] / fs / attr.c
1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * linux/fs/attr.c
4 *
5 * Copyright (C) 1991, 1992 Linus Torvalds
6 * changes by Thomas Schoebel-Theuer
7 */
8
9 #include <linux/export.h>
10 #include <linux/time.h>
11 #include <linux/mm.h>
12 #include <linux/string.h>
13 #include <linux/sched/signal.h>
14 #include <linux/capability.h>
15 #include <linux/fsnotify.h>
16 #include <linux/fcntl.h>
17 #include <linux/security.h>
18 #include <linux/evm.h>
19 #include <linux/ima.h>
20
21 /**
22 * chown_ok - verify permissions to chown inode
23 * @mnt_userns: user namespace of the mount @inode was found from
24 * @inode: inode to check permissions on
25 * @uid: uid to chown @inode to
26 *
27 * If the inode has been found through an idmapped mount the user namespace of
28 * the vfsmount must be passed through @mnt_userns. This function will then
29 * take care to map the inode according to @mnt_userns before checking
30 * permissions. On non-idmapped mounts or if permission checking is to be
31 * performed on the raw inode simply passs init_user_ns.
32 */
33 static bool chown_ok(struct user_namespace *mnt_userns,
34 const struct inode *inode,
35 kuid_t uid)
36 {
37 kuid_t kuid = i_uid_into_mnt(mnt_userns, inode);
38 if (uid_eq(current_fsuid(), kuid) && uid_eq(uid, kuid))
39 return true;
40 if (capable_wrt_inode_uidgid(mnt_userns, inode, CAP_CHOWN))
41 return true;
42 if (uid_eq(kuid, INVALID_UID) &&
43 ns_capable(inode->i_sb->s_user_ns, CAP_CHOWN))
44 return true;
45 return false;
46 }
47
48 /**
49 * chgrp_ok - verify permissions to chgrp inode
50 * @mnt_userns: user namespace of the mount @inode was found from
51 * @inode: inode to check permissions on
52 * @gid: gid to chown @inode to
53 *
54 * If the inode has been found through an idmapped mount the user namespace of
55 * the vfsmount must be passed through @mnt_userns. This function will then
56 * take care to map the inode according to @mnt_userns before checking
57 * permissions. On non-idmapped mounts or if permission checking is to be
58 * performed on the raw inode simply passs init_user_ns.
59 */
60 static bool chgrp_ok(struct user_namespace *mnt_userns,
61 const struct inode *inode, kgid_t gid)
62 {
63 kgid_t kgid = i_gid_into_mnt(mnt_userns, inode);
64 if (uid_eq(current_fsuid(), i_uid_into_mnt(mnt_userns, inode)) &&
65 (in_group_p(gid) || gid_eq(gid, kgid)))
66 return true;
67 if (capable_wrt_inode_uidgid(mnt_userns, inode, CAP_CHOWN))
68 return true;
69 if (gid_eq(kgid, INVALID_GID) &&
70 ns_capable(inode->i_sb->s_user_ns, CAP_CHOWN))
71 return true;
72 return false;
73 }
74
75 /**
76 * setattr_prepare - check if attribute changes to a dentry are allowed
77 * @mnt_userns: user namespace of the mount the inode was found from
78 * @dentry: dentry to check
79 * @attr: attributes to change
80 *
81 * Check if we are allowed to change the attributes contained in @attr
82 * in the given dentry. This includes the normal unix access permission
83 * checks, as well as checks for rlimits and others. The function also clears
84 * SGID bit from mode if user is not allowed to set it. Also file capabilities
85 * and IMA extended attributes are cleared if ATTR_KILL_PRIV is set.
86 *
87 * If the inode has been found through an idmapped mount the user namespace of
88 * the vfsmount must be passed through @mnt_userns. This function will then
89 * take care to map the inode according to @mnt_userns before checking
90 * permissions. On non-idmapped mounts or if permission checking is to be
91 * performed on the raw inode simply passs init_user_ns.
92 *
93 * Should be called as the first thing in ->setattr implementations,
94 * possibly after taking additional locks.
95 */
96 int setattr_prepare(struct user_namespace *mnt_userns, struct dentry *dentry,
97 struct iattr *attr)
98 {
99 struct inode *inode = d_inode(dentry);
100 unsigned int ia_valid = attr->ia_valid;
101
102 /*
103 * First check size constraints. These can't be overriden using
104 * ATTR_FORCE.
105 */
106 if (ia_valid & ATTR_SIZE) {
107 int error = inode_newsize_ok(inode, attr->ia_size);
108 if (error)
109 return error;
110 }
111
112 /* If force is set do it anyway. */
113 if (ia_valid & ATTR_FORCE)
114 goto kill_priv;
115
116 /* Make sure a caller can chown. */
117 if ((ia_valid & ATTR_UID) && !chown_ok(mnt_userns, inode, attr->ia_uid))
118 return -EPERM;
119
120 /* Make sure caller can chgrp. */
121 if ((ia_valid & ATTR_GID) && !chgrp_ok(mnt_userns, inode, attr->ia_gid))
122 return -EPERM;
123
124 /* Make sure a caller can chmod. */
125 if (ia_valid & ATTR_MODE) {
126 if (!inode_owner_or_capable(mnt_userns, inode))
127 return -EPERM;
128 /* Also check the setgid bit! */
129 if (!in_group_p((ia_valid & ATTR_GID) ? attr->ia_gid :
130 i_gid_into_mnt(mnt_userns, inode)) &&
131 !capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FSETID))
132 attr->ia_mode &= ~S_ISGID;
133 }
134
135 /* Check for setting the inode time. */
136 if (ia_valid & (ATTR_MTIME_SET | ATTR_ATIME_SET | ATTR_TIMES_SET)) {
137 if (!inode_owner_or_capable(mnt_userns, inode))
138 return -EPERM;
139 }
140
141 kill_priv:
142 /* User has permission for the change */
143 if (ia_valid & ATTR_KILL_PRIV) {
144 int error;
145
146 error = security_inode_killpriv(dentry);
147 if (error)
148 return error;
149 }
150
151 return 0;
152 }
153 EXPORT_SYMBOL(setattr_prepare);
154
155 /**
156 * inode_newsize_ok - may this inode be truncated to a given size
157 * @inode: the inode to be truncated
158 * @offset: the new size to assign to the inode
159 *
160 * inode_newsize_ok must be called with i_mutex held.
161 *
162 * inode_newsize_ok will check filesystem limits and ulimits to check that the
163 * new inode size is within limits. inode_newsize_ok will also send SIGXFSZ
164 * when necessary. Caller must not proceed with inode size change if failure is
165 * returned. @inode must be a file (not directory), with appropriate
166 * permissions to allow truncate (inode_newsize_ok does NOT check these
167 * conditions).
168 *
169 * Return: 0 on success, -ve errno on failure
170 */
171 int inode_newsize_ok(const struct inode *inode, loff_t offset)
172 {
173 if (inode->i_size < offset) {
174 unsigned long limit;
175
176 limit = rlimit(RLIMIT_FSIZE);
177 if (limit != RLIM_INFINITY && offset > limit)
178 goto out_sig;
179 if (offset > inode->i_sb->s_maxbytes)
180 goto out_big;
181 } else {
182 /*
183 * truncation of in-use swapfiles is disallowed - it would
184 * cause subsequent swapout to scribble on the now-freed
185 * blocks.
186 */
187 if (IS_SWAPFILE(inode))
188 return -ETXTBSY;
189 }
190
191 return 0;
192 out_sig:
193 send_sig(SIGXFSZ, current, 0);
194 out_big:
195 return -EFBIG;
196 }
197 EXPORT_SYMBOL(inode_newsize_ok);
198
199 /**
200 * setattr_copy - copy simple metadata updates into the generic inode
201 * @mnt_userns: user namespace of the mount the inode was found from
202 * @inode: the inode to be updated
203 * @attr: the new attributes
204 *
205 * setattr_copy must be called with i_mutex held.
206 *
207 * setattr_copy updates the inode's metadata with that specified
208 * in attr on idmapped mounts. If file ownership is changed setattr_copy
209 * doesn't map ia_uid and ia_gid. It will asssume the caller has already
210 * provided the intended values. Necessary permission checks to determine
211 * whether or not the S_ISGID property needs to be removed are performed with
212 * the correct idmapped mount permission helpers.
213 * Noticeably missing is inode size update, which is more complex
214 * as it requires pagecache updates.
215 *
216 * If the inode has been found through an idmapped mount the user namespace of
217 * the vfsmount must be passed through @mnt_userns. This function will then
218 * take care to map the inode according to @mnt_userns before checking
219 * permissions. On non-idmapped mounts or if permission checking is to be
220 * performed on the raw inode simply passs init_user_ns.
221 *
222 * The inode is not marked as dirty after this operation. The rationale is
223 * that for "simple" filesystems, the struct inode is the inode storage.
224 * The caller is free to mark the inode dirty afterwards if needed.
225 */
226 void setattr_copy(struct user_namespace *mnt_userns, struct inode *inode,
227 const struct iattr *attr)
228 {
229 unsigned int ia_valid = attr->ia_valid;
230
231 if (ia_valid & ATTR_UID)
232 inode->i_uid = attr->ia_uid;
233 if (ia_valid & ATTR_GID)
234 inode->i_gid = attr->ia_gid;
235 if (ia_valid & ATTR_ATIME)
236 inode->i_atime = attr->ia_atime;
237 if (ia_valid & ATTR_MTIME)
238 inode->i_mtime = attr->ia_mtime;
239 if (ia_valid & ATTR_CTIME)
240 inode->i_ctime = attr->ia_ctime;
241 if (ia_valid & ATTR_MODE) {
242 umode_t mode = attr->ia_mode;
243 kgid_t kgid = i_gid_into_mnt(mnt_userns, inode);
244 if (!in_group_p(kgid) &&
245 !capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FSETID))
246 mode &= ~S_ISGID;
247 inode->i_mode = mode;
248 }
249 }
250 EXPORT_SYMBOL(setattr_copy);
251
252 /**
253 * notify_change - modify attributes of a filesytem object
254 * @mnt_userns: user namespace of the mount the inode was found from
255 * @dentry: object affected
256 * @attr: new attributes
257 * @delegated_inode: returns inode, if the inode is delegated
258 *
259 * The caller must hold the i_mutex on the affected object.
260 *
261 * If notify_change discovers a delegation in need of breaking,
262 * it will return -EWOULDBLOCK and return a reference to the inode in
263 * delegated_inode. The caller should then break the delegation and
264 * retry. Because breaking a delegation may take a long time, the
265 * caller should drop the i_mutex before doing so.
266 *
267 * If file ownership is changed notify_change() doesn't map ia_uid and
268 * ia_gid. It will asssume the caller has already provided the intended values.
269 *
270 * Alternatively, a caller may pass NULL for delegated_inode. This may
271 * be appropriate for callers that expect the underlying filesystem not
272 * to be NFS exported. Also, passing NULL is fine for callers holding
273 * the file open for write, as there can be no conflicting delegation in
274 * that case.
275 *
276 * If the inode has been found through an idmapped mount the user namespace of
277 * the vfsmount must be passed through @mnt_userns. This function will then
278 * take care to map the inode according to @mnt_userns before checking
279 * permissions. On non-idmapped mounts or if permission checking is to be
280 * performed on the raw inode simply passs init_user_ns.
281 */
282 int notify_change(struct user_namespace *mnt_userns, struct dentry *dentry,
283 struct iattr *attr, struct inode **delegated_inode)
284 {
285 struct inode *inode = dentry->d_inode;
286 umode_t mode = inode->i_mode;
287 int error;
288 struct timespec64 now;
289 unsigned int ia_valid = attr->ia_valid;
290
291 WARN_ON_ONCE(!inode_is_locked(inode));
292
293 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID | ATTR_TIMES_SET)) {
294 if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
295 return -EPERM;
296 }
297
298 /*
299 * If utimes(2) and friends are called with times == NULL (or both
300 * times are UTIME_NOW), then we need to check for write permission
301 */
302 if (ia_valid & ATTR_TOUCH) {
303 if (IS_IMMUTABLE(inode))
304 return -EPERM;
305
306 if (!inode_owner_or_capable(mnt_userns, inode)) {
307 error = inode_permission(mnt_userns, inode, MAY_WRITE);
308 if (error)
309 return error;
310 }
311 }
312
313 if ((ia_valid & ATTR_MODE)) {
314 umode_t amode = attr->ia_mode;
315 /* Flag setting protected by i_mutex */
316 if (is_sxid(amode))
317 inode->i_flags &= ~S_NOSEC;
318 }
319
320 now = current_time(inode);
321
322 attr->ia_ctime = now;
323 if (!(ia_valid & ATTR_ATIME_SET))
324 attr->ia_atime = now;
325 else
326 attr->ia_atime = timestamp_truncate(attr->ia_atime, inode);
327 if (!(ia_valid & ATTR_MTIME_SET))
328 attr->ia_mtime = now;
329 else
330 attr->ia_mtime = timestamp_truncate(attr->ia_mtime, inode);
331
332 if (ia_valid & ATTR_KILL_PRIV) {
333 error = security_inode_need_killpriv(dentry);
334 if (error < 0)
335 return error;
336 if (error == 0)
337 ia_valid = attr->ia_valid &= ~ATTR_KILL_PRIV;
338 }
339
340 /*
341 * We now pass ATTR_KILL_S*ID to the lower level setattr function so
342 * that the function has the ability to reinterpret a mode change
343 * that's due to these bits. This adds an implicit restriction that
344 * no function will ever call notify_change with both ATTR_MODE and
345 * ATTR_KILL_S*ID set.
346 */
347 if ((ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) &&
348 (ia_valid & ATTR_MODE))
349 BUG();
350
351 if (ia_valid & ATTR_KILL_SUID) {
352 if (mode & S_ISUID) {
353 ia_valid = attr->ia_valid |= ATTR_MODE;
354 attr->ia_mode = (inode->i_mode & ~S_ISUID);
355 }
356 }
357 if (ia_valid & ATTR_KILL_SGID) {
358 if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
359 if (!(ia_valid & ATTR_MODE)) {
360 ia_valid = attr->ia_valid |= ATTR_MODE;
361 attr->ia_mode = inode->i_mode;
362 }
363 attr->ia_mode &= ~S_ISGID;
364 }
365 }
366 if (!(attr->ia_valid & ~(ATTR_KILL_SUID | ATTR_KILL_SGID)))
367 return 0;
368
369 /*
370 * Verify that uid/gid changes are valid in the target
371 * namespace of the superblock.
372 */
373 if (ia_valid & ATTR_UID &&
374 !kuid_has_mapping(inode->i_sb->s_user_ns, attr->ia_uid))
375 return -EOVERFLOW;
376 if (ia_valid & ATTR_GID &&
377 !kgid_has_mapping(inode->i_sb->s_user_ns, attr->ia_gid))
378 return -EOVERFLOW;
379
380 /* Don't allow modifications of files with invalid uids or
381 * gids unless those uids & gids are being made valid.
382 */
383 if (!(ia_valid & ATTR_UID) &&
384 !uid_valid(i_uid_into_mnt(mnt_userns, inode)))
385 return -EOVERFLOW;
386 if (!(ia_valid & ATTR_GID) &&
387 !gid_valid(i_gid_into_mnt(mnt_userns, inode)))
388 return -EOVERFLOW;
389
390 error = security_inode_setattr(dentry, attr);
391 if (error)
392 return error;
393 error = try_break_deleg(inode, delegated_inode);
394 if (error)
395 return error;
396
397 if (inode->i_op->setattr)
398 error = inode->i_op->setattr(dentry, attr);
399 else
400 error = simple_setattr(dentry, attr);
401
402 if (!error) {
403 fsnotify_change(dentry, ia_valid);
404 ima_inode_post_setattr(dentry);
405 evm_inode_post_setattr(dentry, ia_valid);
406 }
407
408 return error;
409 }
410 EXPORT_SYMBOL(notify_change);