fs/open.c

   1 // SPDX-License-Identifier: GPL-2.0-only
   2 /*
   3  *  linux/fs/open.c
   4  *
   5  *  Copyright (C) 1991, 1992  Linus Torvalds
   6  */
   7
   8 #include <linux/string.h>
   9 #include <linux/mm.h>
  10 #include <linux/file.h>
  11 #include <linux/fdtable.h>
  12 #include <linux/fsnotify.h>
  13 #include <linux/module.h>
  14 #include <linux/tty.h>
  15 #include <linux/namei.h>
  16 #include <linux/backing-dev.h>
  17 #include <linux/capability.h>
  18 #include <linux/securebits.h>
  19 #include <linux/security.h>
  20 #include <linux/mount.h>
  21 #include <linux/fcntl.h>
  22 #include <linux/slab.h>
  23 #include <linux/uaccess.h>
  24 #include <linux/fs.h>
  25 #include <linux/personality.h>
  26 #include <linux/pagemap.h>
  27 #include <linux/syscalls.h>
  28 #include <linux/rcupdate.h>
  29 #include <linux/audit.h>
  30 #include <linux/falloc.h>
  31 #include <linux/fs_struct.h>
  32 #include <linux/ima.h>
  33 #include <linux/dnotify.h>
  34 #include <linux/compat.h>
  35
  36 #include "internal.h"
  37
  38 #define CREATE_TRACE_POINTS
  39 #include <trace/events/fs.h>
  40
  41 int do_truncate(struct dentry *dentry, loff_t length, unsigned int time_attrs,
  42         struct file *filp)
  43 {
  44         int ret;
  45         struct iattr newattrs;
  46
  47         /* Not pretty: "inode->i_size" shouldn't really be signed. But it is. */
  48         if (length < 0)
  49                 return -EINVAL;
  50
  51         newattrs.ia_size = length;
  52         newattrs.ia_valid = ATTR_SIZE | time_attrs;
  53         if (filp) {
  54                 newattrs.ia_file = filp;
  55                 newattrs.ia_valid |= ATTR_FILE;
  56         }
  57
  58         /* Remove suid, sgid, and file capabilities on truncate too */
  59         ret = dentry_needs_remove_privs(dentry);
  60         if (ret < 0)
  61                 return ret;
  62         if (ret)
  63                 newattrs.ia_valid |= ret | ATTR_FORCE;
  64
  65         inode_lock(dentry->d_inode);
  66         /* Note any delegations or leases have already been broken: */
  67         ret = notify_change(dentry, &newattrs, NULL);
  68         inode_unlock(dentry->d_inode);
  69         return ret;
  70 }
  71 EXPORT_SYMBOL_GPL(do_truncate);
  72
  73 long vfs_truncate(const struct path *path, loff_t length)
  74 {
  75         struct inode *inode;
  76         long error;
  77
  78         inode = path->dentry->d_inode;
  79
  80         /* For directories it's -EISDIR, for other non-regulars - -EINVAL */
  81         if (S_ISDIR(inode->i_mode))
  82                 return -EISDIR;
  83         if (!S_ISREG(inode->i_mode))
  84                 return -EINVAL;
  85
  86         error = mnt_want_write(path->mnt);
  87         if (error)
  88                 goto out;
  89
  90         error = inode_permission(inode, MAY_WRITE);
  91         if (error)
  92                 goto mnt_drop_write_and_out;
  93
  94         error = -EPERM;
  95         if (IS_APPEND(inode))
  96                 goto mnt_drop_write_and_out;
  97
  98         error = get_write_access(inode);
  99         if (error)
 100                 goto mnt_drop_write_and_out;
 101
 102         /*
 103          * Make sure that there are no leases.  get_write_access() protects
 104          * against the truncate racing with a lease-granting setlease().
 105          */
 106         error = break_lease(inode, O_WRONLY);
 107         if (error)
 108                 goto put_write_and_out;
 109
 110         error = locks_verify_truncate(inode, NULL, length);
 111         if (!error)
 112                 error = security_path_truncate(path);
 113         if (!error)
 114                 error = do_truncate(path->dentry, length, 0, NULL);
 115
 116 put_write_and_out:
 117         put_write_access(inode);
 118 mnt_drop_write_and_out:
 119         mnt_drop_write(path->mnt);
 120 out:
 121         return error;
 122 }
 123 EXPORT_SYMBOL_GPL(vfs_truncate);
 124
 125 long do_sys_truncate(const char __user *pathname, loff_t length)
 126 {
 127         unsigned int lookup_flags = LOOKUP_FOLLOW;
 128         struct path path;
 129         int error;
 130
 131         if (length < 0) /* sorry, but loff_t says... */
 132                 return -EINVAL;
 133
 134 retry:
 135         error = user_path_at(AT_FDCWD, pathname, lookup_flags, &path);
 136         if (!error) {
 137                 error = vfs_truncate(&path, length);
 138                 path_put(&path);
 139         }
 140         if (retry_estale(error, lookup_flags)) {
 141                 lookup_flags |= LOOKUP_REVAL;
 142                 goto retry;
 143         }
 144         return error;
 145 }
 146
 147 SYSCALL_DEFINE2(truncate, const char __user *, path, long, length)
 148 {
 149         return do_sys_truncate(path, length);
 150 }
 151
 152 #ifdef CONFIG_COMPAT
 153 COMPAT_SYSCALL_DEFINE2(truncate, const char __user *, path, compat_off_t, length)
 154 {
 155         return do_sys_truncate(path, length);
 156 }
 157 #endif
 158
 159 long do_sys_ftruncate(unsigned int fd, loff_t length, int small)
 160 {
 161         struct inode *inode;
 162         struct dentry *dentry;
 163         struct fd f;
 164         int error;
 165
 166         error = -EINVAL;
 167         if (length < 0)
 168                 goto out;
 169         error = -EBADF;
 170         f = fdget(fd);
 171         if (!f.file)
 172                 goto out;
 173
 174         /* explicitly opened as large or we are on 64-bit box */
 175         if (f.file->f_flags & O_LARGEFILE)
 176                 small = 0;
 177
 178         dentry = f.file->f_path.dentry;
 179         inode = dentry->d_inode;
 180         error = -EINVAL;
 181         if (!S_ISREG(inode->i_mode) || !(f.file->f_mode & FMODE_WRITE))
 182                 goto out_putf;
 183
 184         error = -EINVAL;
 185         /* Cannot ftruncate over 2^31 bytes without large file support */
 186         if (small && length > MAX_NON_LFS)
 187                 goto out_putf;
 188
 189         error = -EPERM;
 190         /* Check IS_APPEND on real upper inode */
 191         if (IS_APPEND(file_inode(f.file)))
 192                 goto out_putf;
 193
 194         sb_start_write(inode->i_sb);
 195         error = locks_verify_truncate(inode, f.file, length);
 196         if (!error)
 197                 error = security_path_truncate(&f.file->f_path);
 198         if (!error)
 199                 error = do_truncate(dentry, length, ATTR_MTIME|ATTR_CTIME, f.file);
 200         sb_end_write(inode->i_sb);
 201 out_putf:
 202         fdput(f);
 203 out:
 204         return error;
 205 }
 206
 207 SYSCALL_DEFINE2(ftruncate, unsigned int, fd, unsigned long, length)
 208 {
 209         return do_sys_ftruncate(fd, length, 1);
 210 }
 211
 212 #ifdef CONFIG_COMPAT
 213 COMPAT_SYSCALL_DEFINE2(ftruncate, unsigned int, fd, compat_ulong_t, length)
 214 {
 215         return do_sys_ftruncate(fd, length, 1);
 216 }
 217 #endif
 218
 219 /* LFS versions of truncate are only needed on 32 bit machines */
 220 #if BITS_PER_LONG == 32
 221 SYSCALL_DEFINE2(truncate64, const char __user *, path, loff_t, length)
 222 {
 223         return do_sys_truncate(path, length);
 224 }
 225
 226 SYSCALL_DEFINE2(ftruncate64, unsigned int, fd, loff_t, length)
 227 {
 228         return do_sys_ftruncate(fd, length, 0);
 229 }
 230 #endif /* BITS_PER_LONG == 32 */
 231
 232
 233 int vfs_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
 234 {
 235         struct inode *inode = file_inode(file);
 236         long ret;
 237
 238         if (offset < 0 || len <= 0)
 239                 return -EINVAL;
 240
 241         /* Return error if mode is not supported */
 242         if (mode & ~FALLOC_FL_SUPPORTED_MASK)
 243                 return -EOPNOTSUPP;
 244
 245         /* Punch hole and zero range are mutually exclusive */
 246         if ((mode & (FALLOC_FL_PUNCH_HOLE | FALLOC_FL_ZERO_RANGE)) ==
 247             (FALLOC_FL_PUNCH_HOLE | FALLOC_FL_ZERO_RANGE))
 248                 return -EOPNOTSUPP;
 249
 250         /* Punch hole must have keep size set */
 251         if ((mode & FALLOC_FL_PUNCH_HOLE) &&
 252             !(mode & FALLOC_FL_KEEP_SIZE))
 253                 return -EOPNOTSUPP;
 254
 255         /* Collapse range should only be used exclusively. */
 256         if ((mode & FALLOC_FL_COLLAPSE_RANGE) &&
 257             (mode & ~FALLOC_FL_COLLAPSE_RANGE))
 258                 return -EINVAL;
 259
 260         /* Insert range should only be used exclusively. */
 261         if ((mode & FALLOC_FL_INSERT_RANGE) &&
 262             (mode & ~FALLOC_FL_INSERT_RANGE))
 263                 return -EINVAL;
 264
 265         /* Unshare range should only be used with allocate mode. */
 266         if ((mode & FALLOC_FL_UNSHARE_RANGE) &&
 267             (mode & ~(FALLOC_FL_UNSHARE_RANGE | FALLOC_FL_KEEP_SIZE)))
 268                 return -EINVAL;
 269
 270         if (!(file->f_mode & FMODE_WRITE))
 271                 return -EBADF;
 272
 273         /*
 274          * We can only allow pure fallocate on append only files
 275          */
 276         if ((mode & ~FALLOC_FL_KEEP_SIZE) && IS_APPEND(inode))
 277                 return -EPERM;
 278
 279         if (IS_IMMUTABLE(inode))
 280                 return -EPERM;
 281
 282         /*
 283          * We cannot allow any fallocate operation on an active swapfile
 284          */
 285         if (IS_SWAPFILE(inode))
 286                 return -ETXTBSY;
 287
 288         /*
 289          * Revalidate the write permissions, in case security policy has
 290          * changed since the files were opened.
 291          */
 292         ret = security_file_permission(file, MAY_WRITE);
 293         if (ret)
 294                 return ret;
 295
 296         if (S_ISFIFO(inode->i_mode))
 297                 return -ESPIPE;
 298
 299         if (S_ISDIR(inode->i_mode))
 300                 return -EISDIR;
 301
 302         if (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode))
 303                 return -ENODEV;
 304
 305         /* Check for wrap through zero too */
 306         if (((offset + len) > inode->i_sb->s_maxbytes) || ((offset + len) < 0))
 307                 return -EFBIG;
 308
 309         if (!file->f_op->fallocate)
 310                 return -EOPNOTSUPP;
 311
 312         file_start_write(file);
 313         ret = file->f_op->fallocate(file, mode, offset, len);
 314
 315         /*
 316          * Create inotify and fanotify events.
 317          *
 318          * To keep the logic simple always create events if fallocate succeeds.
 319          * This implies that events are even created if the file size remains
 320          * unchanged, e.g. when using flag FALLOC_FL_KEEP_SIZE.
 321          */
 322         if (ret == 0)
 323                 fsnotify_modify(file);
 324
 325         file_end_write(file);
 326         return ret;
 327 }
 328 EXPORT_SYMBOL_GPL(vfs_fallocate);
 329
 330 int ksys_fallocate(int fd, int mode, loff_t offset, loff_t len)
 331 {
 332         struct fd f = fdget(fd);
 333         int error = -EBADF;
 334
 335         if (f.file) {
 336                 error = vfs_fallocate(f.file, mode, offset, len);
 337                 fdput(f);
 338         }
 339         return error;
 340 }
 341
 342 SYSCALL_DEFINE4(fallocate, int, fd, int, mode, loff_t, offset, loff_t, len)
 343 {
 344         return ksys_fallocate(fd, mode, offset, len);
 345 }
 346
 347 /*
 348  * access() needs to use the real uid/gid, not the effective uid/gid.
 349  * We do this by temporarily clearing all FS-related capabilities and
 350  * switching the fsuid/fsgid around to the real ones.
 351  */
 352 long do_faccessat(int dfd, const char __user *filename, int mode)
 353 {
 354         const struct cred *old_cred;
 355         struct cred *override_cred;
 356         struct path path;
 357         struct inode *inode;
 358         int res;
 359         unsigned int lookup_flags = LOOKUP_FOLLOW;
 360
 361         if (mode & ~S_IRWXO)    /* where's F_OK, X_OK, W_OK, R_OK? */
 362                 return -EINVAL;
 363
 364         override_cred = prepare_creds();
 365         if (!override_cred)
 366                 return -ENOMEM;
 367
 368         override_cred->fsuid = override_cred->uid;
 369         override_cred->fsgid = override_cred->gid;
 370
 371         if (!issecure(SECURE_NO_SETUID_FIXUP)) {
 372                 /* Clear the capabilities if we switch to a non-root user */
 373                 kuid_t root_uid = make_kuid(override_cred->user_ns, 0);
 374                 if (!uid_eq(override_cred->uid, root_uid))
 375                         cap_clear(override_cred->cap_effective);
 376                 else
 377                         override_cred->cap_effective =
 378                                 override_cred->cap_permitted;
 379         }
 380
 381         /*
 382          * The new set of credentials can *only* be used in
 383          * task-synchronous circumstances, and does not need
 384          * RCU freeing, unless somebody then takes a separate
 385          * reference to it.
 386          *
 387          * NOTE! This is _only_ true because this credential
 388          * is used purely for override_creds() that installs
 389          * it as the subjective cred. Other threads will be
 390          * accessing ->real_cred, not the subjective cred.
 391          *
 392          * If somebody _does_ make a copy of this (using the
 393          * 'get_current_cred()' function), that will clear the
 394          * non_rcu field, because now that other user may be
 395          * expecting RCU freeing. But normal thread-synchronous
 396          * cred accesses will keep things non-RCY.
 397          */
 398         override_cred->non_rcu = 1;
 399
 400         old_cred = override_creds(override_cred);
 401 retry:
 402         res = user_path_at(dfd, filename, lookup_flags, &path);
 403         if (res)
 404                 goto out;
 405
 406         inode = d_backing_inode(path.dentry);
 407
 408         if ((mode & MAY_EXEC) && S_ISREG(inode->i_mode)) {
 409                 /*
 410                  * MAY_EXEC on regular files is denied if the fs is mounted
 411                  * with the "noexec" flag.
 412                  */
 413                 res = -EACCES;
 414                 if (path_noexec(&path))
 415                         goto out_path_release;
 416         }
 417
 418         res = inode_permission(inode, mode | MAY_ACCESS);
 419         /* SuS v2 requires we report a read only fs too */
 420         if (res || !(mode & S_IWOTH) || special_file(inode->i_mode))
 421                 goto out_path_release;
 422         /*
 423          * This is a rare case where using __mnt_is_readonly()
 424          * is OK without a mnt_want/drop_write() pair.  Since
 425          * no actual write to the fs is performed here, we do
 426          * not need to telegraph to that to anyone.
 427          *
 428          * By doing this, we accept that this access is
 429          * inherently racy and know that the fs may change
 430          * state before we even see this result.
 431          */
 432         if (__mnt_is_readonly(path.mnt))
 433                 res = -EROFS;
 434
 435 out_path_release:
 436         path_put(&path);
 437         if (retry_estale(res, lookup_flags)) {
 438                 lookup_flags |= LOOKUP_REVAL;
 439                 goto retry;
 440         }
 441 out:
 442         revert_creds(old_cred);
 443         put_cred(override_cred);
 444         return res;
 445 }
 446
 447 SYSCALL_DEFINE3(faccessat, int, dfd, const char __user *, filename, int, mode)
 448 {
 449         return do_faccessat(dfd, filename, mode);
 450 }
 451
 452 SYSCALL_DEFINE2(access, const char __user *, filename, int, mode)
 453 {
 454         return do_faccessat(AT_FDCWD, filename, mode);
 455 }
 456
 457 int ksys_chdir(const char __user *filename)
 458 {
 459         struct path path;
 460         int error;
 461         unsigned int lookup_flags = LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
 462 retry:
 463         error = user_path_at(AT_FDCWD, filename, lookup_flags, &path);
 464         if (error)
 465                 goto out;
 466
 467         error = inode_permission(path.dentry->d_inode, MAY_EXEC | MAY_CHDIR);
 468         if (error)
 469                 goto dput_and_out;
 470
 471         set_fs_pwd(current->fs, &path);
 472
 473 dput_and_out:
 474         path_put(&path);
 475         if (retry_estale(error, lookup_flags)) {
 476                 lookup_flags |= LOOKUP_REVAL;
 477                 goto retry;
 478         }
 479 out:
 480         return error;
 481 }
 482
 483 SYSCALL_DEFINE1(chdir, const char __user *, filename)
 484 {
 485         return ksys_chdir(filename);
 486 }
 487
 488 SYSCALL_DEFINE1(fchdir, unsigned int, fd)
 489 {
 490         struct fd f = fdget_raw(fd);
 491         int error;
 492
 493         error = -EBADF;
 494         if (!f.file)
 495                 goto out;
 496
 497         error = -ENOTDIR;
 498         if (!d_can_lookup(f.file->f_path.dentry))
 499                 goto out_putf;
 500
 501         error = inode_permission(file_inode(f.file), MAY_EXEC | MAY_CHDIR);
 502         if (!error)
 503                 set_fs_pwd(current->fs, &f.file->f_path);
 504 out_putf:
 505         fdput(f);
 506 out:
 507         return error;
 508 }
 509
 510 int ksys_chroot(const char __user *filename)
 511 {
 512         struct path path;
 513         int error;
 514         unsigned int lookup_flags = LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
 515 retry:
 516         error = user_path_at(AT_FDCWD, filename, lookup_flags, &path);
 517         if (error)
 518                 goto out;
 519
 520         error = inode_permission(path.dentry->d_inode, MAY_EXEC | MAY_CHDIR);
 521         if (error)
 522                 goto dput_and_out;
 523
 524         error = -EPERM;
 525         if (!ns_capable(current_user_ns(), CAP_SYS_CHROOT))
 526                 goto dput_and_out;
 527         error = security_path_chroot(&path);
 528         if (error)
 529                 goto dput_and_out;
 530
 531         set_fs_root(current->fs, &path);
 532         error = 0;
 533 dput_and_out:
 534         path_put(&path);
 535         if (retry_estale(error, lookup_flags)) {
 536                 lookup_flags |= LOOKUP_REVAL;
 537                 goto retry;
 538         }
 539 out:
 540         return error;
 541 }
 542
 543 SYSCALL_DEFINE1(chroot, const char __user *, filename)
 544 {
 545         return ksys_chroot(filename);
 546 }
 547
 548 static int chmod_common(const struct path *path, umode_t mode)
 549 {
 550         struct inode *inode = path->dentry->d_inode;
 551         struct inode *delegated_inode = NULL;
 552         struct iattr newattrs;
 553         int error;
 554
 555         error = mnt_want_write(path->mnt);
 556         if (error)
 557                 return error;
 558 retry_deleg:
 559         inode_lock(inode);
 560         error = security_path_chmod(path, mode);
 561         if (error)
 562                 goto out_unlock;
 563         newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
 564         newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
 565         error = notify_change(path->dentry, &newattrs, &delegated_inode);
 566 out_unlock:
 567         inode_unlock(inode);
 568         if (delegated_inode) {
 569                 error = break_deleg_wait(&delegated_inode);
 570                 if (!error)
 571                         goto retry_deleg;
 572         }
 573         mnt_drop_write(path->mnt);
 574         return error;
 575 }
 576
 577 int ksys_fchmod(unsigned int fd, umode_t mode)
 578 {
 579         struct fd f = fdget(fd);
 580         int err = -EBADF;
 581
 582         if (f.file) {
 583                 audit_file(f.file);
 584                 err = chmod_common(&f.file->f_path, mode);
 585                 fdput(f);
 586         }
 587         return err;
 588 }
 589
 590 SYSCALL_DEFINE2(fchmod, unsigned int, fd, umode_t, mode)
 591 {
 592         return ksys_fchmod(fd, mode);
 593 }
 594
 595 int do_fchmodat(int dfd, const char __user *filename, umode_t mode)
 596 {
 597         struct path path;
 598         int error;
 599         unsigned int lookup_flags = LOOKUP_FOLLOW;
 600 retry:
 601         error = user_path_at(dfd, filename, lookup_flags, &path);
 602         if (!error) {
 603                 error = chmod_common(&path, mode);
 604                 path_put(&path);
 605                 if (retry_estale(error, lookup_flags)) {
 606                         lookup_flags |= LOOKUP_REVAL;
 607                         goto retry;
 608                 }
 609         }
 610         return error;
 611 }
 612
 613 SYSCALL_DEFINE3(fchmodat, int, dfd, const char __user *, filename,
 614                 umode_t, mode)
 615 {
 616         return do_fchmodat(dfd, filename, mode);
 617 }
 618
 619 SYSCALL_DEFINE2(chmod, const char __user *, filename, umode_t, mode)
 620 {
 621         return do_fchmodat(AT_FDCWD, filename, mode);
 622 }
 623
 624 static int chown_common(const struct path *path, uid_t user, gid_t group)
 625 {
 626         struct inode *inode = path->dentry->d_inode;
 627         struct inode *delegated_inode = NULL;
 628         int error;
 629         struct iattr newattrs;
 630         kuid_t uid;
 631         kgid_t gid;
 632
 633         uid = make_kuid(current_user_ns(), user);
 634         gid = make_kgid(current_user_ns(), group);
 635
 636 retry_deleg:
 637         newattrs.ia_valid =  ATTR_CTIME;
 638         if (user != (uid_t) -1) {
 639                 if (!uid_valid(uid))
 640                         return -EINVAL;
 641                 newattrs.ia_valid |= ATTR_UID;
 642                 newattrs.ia_uid = uid;
 643         }
 644         if (group != (gid_t) -1) {
 645                 if (!gid_valid(gid))
 646                         return -EINVAL;
 647                 newattrs.ia_valid |= ATTR_GID;
 648                 newattrs.ia_gid = gid;
 649         }
 650         if (!S_ISDIR(inode->i_mode))
 651                 newattrs.ia_valid |=
 652                         ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_KILL_PRIV;
 653         inode_lock(inode);
 654         error = security_path_chown(path, uid, gid);
 655         if (!error)
 656                 error = notify_change(path->dentry, &newattrs, &delegated_inode);
 657         inode_unlock(inode);
 658         if (delegated_inode) {
 659                 error = break_deleg_wait(&delegated_inode);
 660                 if (!error)
 661                         goto retry_deleg;
 662         }
 663         return error;
 664 }
 665
 666 int do_fchownat(int dfd, const char __user *filename, uid_t user, gid_t group,
 667                 int flag)
 668 {
 669         struct path path;
 670         int error = -EINVAL;
 671         int lookup_flags;
 672
 673         if ((flag & ~(AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH)) != 0)
 674                 goto out;
 675
 676         lookup_flags = (flag & AT_SYMLINK_NOFOLLOW) ? 0 : LOOKUP_FOLLOW;
 677         if (flag & AT_EMPTY_PATH)
 678                 lookup_flags |= LOOKUP_EMPTY;
 679 retry:
 680         error = user_path_at(dfd, filename, lookup_flags, &path);
 681         if (error)
 682                 goto out;
 683         error = mnt_want_write(path.mnt);
 684         if (error)
 685                 goto out_release;
 686         error = chown_common(&path, user, group);
 687         mnt_drop_write(path.mnt);
 688 out_release:
 689         path_put(&path);
 690         if (retry_estale(error, lookup_flags)) {
 691                 lookup_flags |= LOOKUP_REVAL;
 692                 goto retry;
 693         }
 694 out:
 695         return error;
 696 }
 697
 698 SYSCALL_DEFINE5(fchownat, int, dfd, const char __user *, filename, uid_t, user,
 699                 gid_t, group, int, flag)
 700 {
 701         return do_fchownat(dfd, filename, user, group, flag);
 702 }
 703
 704 SYSCALL_DEFINE3(chown, const char __user *, filename, uid_t, user, gid_t, group)
 705 {
 706         return do_fchownat(AT_FDCWD, filename, user, group, 0);
 707 }
 708
 709 SYSCALL_DEFINE3(lchown, const char __user *, filename, uid_t, user, gid_t, group)
 710 {
 711         return do_fchownat(AT_FDCWD, filename, user, group,
 712                            AT_SYMLINK_NOFOLLOW);
 713 }
 714
 715 int ksys_fchown(unsigned int fd, uid_t user, gid_t group)
 716 {
 717         struct fd f = fdget(fd);
 718         int error = -EBADF;
 719
 720         if (!f.file)
 721                 goto out;
 722
 723         error = mnt_want_write_file(f.file);
 724         if (error)
 725                 goto out_fput;
 726         audit_file(f.file);
 727         error = chown_common(&f.file->f_path, user, group);
 728         mnt_drop_write_file(f.file);
 729 out_fput:
 730         fdput(f);
 731 out:
 732         return error;
 733 }
 734
 735 SYSCALL_DEFINE3(fchown, unsigned int, fd, uid_t, user, gid_t, group)
 736 {
 737         return ksys_fchown(fd, user, group);
 738 }
 739
 740 static int do_dentry_open(struct file *f,
 741                           struct inode *inode,
 742                           int (*open)(struct inode *, struct file *))
 743 {
 744         static const struct file_operations empty_fops = {};
 745         int error;
 746
 747         path_get(&f->f_path);
 748         f->f_inode = inode;
 749         f->f_mapping = inode->i_mapping;
 750
 751         /* Ensure that we skip any errors that predate opening of the file */
 752         f->f_wb_err = filemap_sample_wb_err(f->f_mapping);
 753
 754         if (unlikely(f->f_flags & O_PATH)) {
 755                 f->f_mode = FMODE_PATH | FMODE_OPENED;
 756                 f->f_op = &empty_fops;
 757                 return 0;
 758         }
 759
 760         /* Any file opened for execve()/uselib() has to be a regular file. */
 761         if (unlikely(f->f_flags & FMODE_EXEC && !S_ISREG(inode->i_mode))) {
 762                 error = -EACCES;
 763                 goto cleanup_file;
 764         }
 765
 766         if (f->f_mode & FMODE_WRITE && !special_file(inode->i_mode)) {
 767                 error = get_write_access(inode);
 768                 if (unlikely(error))
 769                         goto cleanup_file;
 770                 error = __mnt_want_write(f->f_path.mnt);
 771                 if (unlikely(error)) {
 772                         put_write_access(inode);
 773                         goto cleanup_file;
 774                 }
 775                 f->f_mode |= FMODE_WRITER;
 776         }
 777
 778         /* POSIX.1-2008/SUSv4 Section XSI 2.9.7 */
 779         if (S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode))
 780                 f->f_mode |= FMODE_ATOMIC_POS;
 781
 782         f->f_op = fops_get(inode->i_fop);
 783         if (WARN_ON(!f->f_op)) {
 784                 error = -ENODEV;
 785                 goto cleanup_all;
 786         }
 787
 788         error = security_file_open(f);
 789         if (error)
 790                 goto cleanup_all;
 791
 792         error = break_lease(locks_inode(f), f->f_flags);
 793         if (error)
 794                 goto cleanup_all;
 795
 796         /* normally all 3 are set; ->open() can clear them if needed */
 797         f->f_mode |= FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE;
 798         if (!open)
 799                 open = f->f_op->open;
 800         if (open) {
 801                 error = open(inode, f);
 802                 if (error)
 803                         goto cleanup_all;
 804         }
 805         f->f_mode |= FMODE_OPENED;
 806         if ((f->f_mode & (FMODE_READ | FMODE_WRITE)) == FMODE_READ)
 807                 i_readcount_inc(inode);
 808         if ((f->f_mode & FMODE_READ) &&
 809              likely(f->f_op->read || f->f_op->read_iter))
 810                 f->f_mode |= FMODE_CAN_READ;
 811         if ((f->f_mode & FMODE_WRITE) &&
 812              likely(f->f_op->write || f->f_op->write_iter))
 813                 f->f_mode |= FMODE_CAN_WRITE;
 814
 815         f->f_write_hint = WRITE_LIFE_NOT_SET;
 816         f->f_flags &= ~(O_CREAT | O_EXCL | O_NOCTTY | O_TRUNC);
 817
 818         file_ra_state_init(&f->f_ra, f->f_mapping->host->i_mapping);
 819
 820         /* NB: we're sure to have correct a_ops only after f_op->open */
 821         if (f->f_flags & O_DIRECT) {
 822                 if (!f->f_mapping->a_ops || !f->f_mapping->a_ops->direct_IO)
 823                         return -EINVAL;
 824         }
 825
 826         /*
 827          * XXX: Huge page cache doesn't support writing yet. Drop all page
 828          * cache for this file before processing writes.
 829          */
 830         if ((f->f_mode & FMODE_WRITE) && filemap_nr_thps(inode->i_mapping))
 831                 truncate_pagecache(inode, 0);
 832
 833         return 0;
 834
 835 cleanup_all:
 836         if (WARN_ON_ONCE(error > 0))
 837                 error = -EINVAL;
 838         fops_put(f->f_op);
 839         if (f->f_mode & FMODE_WRITER) {
 840                 put_write_access(inode);
 841                 __mnt_drop_write(f->f_path.mnt);
 842         }
 843 cleanup_file:
 844         path_put(&f->f_path);
 845         f->f_path.mnt = NULL;
 846         f->f_path.dentry = NULL;
 847         f->f_inode = NULL;
 848         return error;
 849 }
 850
 851 /**
 852  * finish_open - finish opening a file
 853  * @file: file pointer
 854  * @dentry: pointer to dentry
 855  * @open: open callback
 856  * @opened: state of open
 857  *
 858  * This can be used to finish opening a file passed to i_op->atomic_open().
 859  *
 860  * If the open callback is set to NULL, then the standard f_op->open()
 861  * filesystem callback is substituted.
 862  *
 863  * NB: the dentry reference is _not_ consumed.  If, for example, the dentry is
 864  * the return value of d_splice_alias(), then the caller needs to perform dput()
 865  * on it after finish_open().
 866  *
 867  * Returns zero on success or -errno if the open failed.
 868  */
 869 int finish_open(struct file *file, struct dentry *dentry,
 870                 int (*open)(struct inode *, struct file *))
 871 {
 872         BUG_ON(file->f_mode & FMODE_OPENED); /* once it's opened, it's opened */
 873
 874         file->f_path.dentry = dentry;
 875         return do_dentry_open(file, d_backing_inode(dentry), open);
 876 }
 877 EXPORT_SYMBOL(finish_open);
 878
 879 /**
 880  * finish_no_open - finish ->atomic_open() without opening the file
 881  *
 882  * @file: file pointer
 883  * @dentry: dentry or NULL (as returned from ->lookup())
 884  *
 885  * This can be used to set the result of a successful lookup in ->atomic_open().
 886  *
 887  * NB: unlike finish_open() this function does consume the dentry reference and
 888  * the caller need not dput() it.
 889  *
 890  * Returns "0" which must be the return value of ->atomic_open() after having
 891  * called this function.
 892  */
 893 int finish_no_open(struct file *file, struct dentry *dentry)
 894 {
 895         file->f_path.dentry = dentry;
 896         return 0;
 897 }
 898 EXPORT_SYMBOL(finish_no_open);
 899
 900 char *file_path(struct file *filp, char *buf, int buflen)
 901 {
 902         return d_path(&filp->f_path, buf, buflen);
 903 }
 904 EXPORT_SYMBOL(file_path);
 905
 906 /**
 907  * vfs_open - open the file at the given path
 908  * @path: path to open
 909  * @file: newly allocated file with f_flag initialized
 910  * @cred: credentials to use
 911  */
 912 int vfs_open(const struct path *path, struct file *file)
 913 {
 914         file->f_path = *path;
 915         return do_dentry_open(file, d_backing_inode(path->dentry), NULL);
 916 }
 917
 918 struct file *dentry_open(const struct path *path, int flags,
 919                          const struct cred *cred)
 920 {
 921         int error;
 922         struct file *f;
 923
 924         validate_creds(cred);
 925
 926         /* We must always pass in a valid mount pointer. */
 927         BUG_ON(!path->mnt);
 928
 929         f = alloc_empty_file(flags, cred);
 930         if (!IS_ERR(f)) {
 931                 error = vfs_open(path, f);
 932                 if (error) {
 933                         fput(f);
 934                         f = ERR_PTR(error);
 935                 }
 936         }
 937         return f;
 938 }
 939 EXPORT_SYMBOL(dentry_open);
 940
 941 struct file *open_with_fake_path(const struct path *path, int flags,
 942                                 struct inode *inode, const struct cred *cred)
 943 {
 944         struct file *f = alloc_empty_file_noaccount(flags, cred);
 945         if (!IS_ERR(f)) {
 946                 int error;
 947
 948                 f->f_path = *path;
 949                 error = do_dentry_open(f, inode, NULL);
 950                 if (error) {
 951                         fput(f);
 952                         f = ERR_PTR(error);
 953                 }
 954         }
 955         return f;
 956 }
 957 EXPORT_SYMBOL(open_with_fake_path);
 958
 959 static inline int build_open_flags(int flags, umode_t mode, struct open_flags *op)
 960 {
 961         int lookup_flags = 0;
 962         int acc_mode = ACC_MODE(flags);
 963
 964         /*
 965          * Clear out all open flags we don't know about so that we don't report
 966          * them in fcntl(F_GETFD) or similar interfaces.
 967          */
 968         flags &= VALID_OPEN_FLAGS;
 969
 970         if (flags & (O_CREAT | __O_TMPFILE))
 971                 op->mode = (mode & S_IALLUGO) | S_IFREG;
 972         else
 973                 op->mode = 0;
 974
 975         /* Must never be set by userspace */
 976         flags &= ~FMODE_NONOTIFY & ~O_CLOEXEC;
 977
 978         /*
 979          * O_SYNC is implemented as __O_SYNC|O_DSYNC.  As many places only
 980          * check for O_DSYNC if the need any syncing at all we enforce it's
 981          * always set instead of having to deal with possibly weird behaviour
 982          * for malicious applications setting only __O_SYNC.
 983          */
 984         if (flags & __O_SYNC)
 985                 flags |= O_DSYNC;
 986
 987         if (flags & __O_TMPFILE) {
 988                 if ((flags & O_TMPFILE_MASK) != O_TMPFILE)
 989                         return -EINVAL;
 990                 if (!(acc_mode & MAY_WRITE))
 991                         return -EINVAL;
 992         } else if (flags & O_PATH) {
 993                 /*
 994                  * If we have O_PATH in the open flag. Then we
 995                  * cannot have anything other than the below set of flags
 996                  */
 997                 flags &= O_DIRECTORY | O_NOFOLLOW | O_PATH;
 998                 acc_mode = 0;
 999         }
1000
1001         op->open_flag = flags;
1002
1003         /* O_TRUNC implies we need access checks for write permissions */
1004         if (flags & O_TRUNC)
1005                 acc_mode |= MAY_WRITE;
1006
1007         /* Allow the LSM permission hook to distinguish append
1008            access from general write access. */
1009         if (flags & O_APPEND)
1010                 acc_mode |= MAY_APPEND;
1011
1012         op->acc_mode = acc_mode;
1013
1014         op->intent = flags & O_PATH ? 0 : LOOKUP_OPEN;
1015
1016         if (flags & O_CREAT) {
1017                 op->intent |= LOOKUP_CREATE;
1018                 if (flags & O_EXCL)
1019                         op->intent |= LOOKUP_EXCL;
1020         }
1021
1022         if (flags & O_DIRECTORY)
1023                 lookup_flags |= LOOKUP_DIRECTORY;
1024         if (!(flags & O_NOFOLLOW))
1025                 lookup_flags |= LOOKUP_FOLLOW;
1026         op->lookup_flags = lookup_flags;
1027         return 0;
1028 }
1029
1030 /**
1031  * file_open_name - open file and return file pointer
1032  *
1033  * @name:       struct filename containing path to open
1034  * @flags:      open flags as per the open(2) second argument
1035  * @mode:       mode for the new file if O_CREAT is set, else ignored
1036  *
1037  * This is the helper to open a file from kernelspace if you really
1038  * have to.  But in generally you should not do this, so please move
1039  * along, nothing to see here..
1040  */
1041 struct file *file_open_name(struct filename *name, int flags, umode_t mode)
1042 {
1043         struct open_flags op;
1044         int err = build_open_flags(flags, mode, &op);
1045         return err ? ERR_PTR(err) : do_filp_open(AT_FDCWD, name, &op);
1046 }
1047
1048 /**
1049  * filp_open - open file and return file pointer
1050  *
1051  * @filename:   path to open
1052  * @flags:      open flags as per the open(2) second argument
1053  * @mode:       mode for the new file if O_CREAT is set, else ignored
1054  *
1055  * This is the helper to open a file from kernelspace if you really
1056  * have to.  But in generally you should not do this, so please move
1057  * along, nothing to see here..
1058  */
1059 struct file *filp_open(const char *filename, int flags, umode_t mode)
1060 {
1061         struct filename *name = getname_kernel(filename);
1062         struct file *file = ERR_CAST(name);
1063
1064         if (!IS_ERR(name)) {
1065                 file = file_open_name(name, flags, mode);
1066                 putname(name);
1067         }
1068         return file;
1069 }
1070 EXPORT_SYMBOL(filp_open);
1071
1072 struct file *file_open_root(struct dentry *dentry, struct vfsmount *mnt,
1073                             const char *filename, int flags, umode_t mode)
1074 {
1075         struct open_flags op;
1076         int err = build_open_flags(flags, mode, &op);
1077         if (err)
1078                 return ERR_PTR(err);
1079         return do_file_open_root(dentry, mnt, filename, &op);
1080 }
1081 EXPORT_SYMBOL(file_open_root);
1082
1083 long do_sys_open(int dfd, const char __user *filename, int flags, umode_t mode)
1084 {
1085         struct open_flags op;
1086         int fd = build_open_flags(flags, mode, &op);
1087         struct filename *tmp;
1088
1089         if (fd)
1090                 return fd;
1091
1092         tmp = getname(filename);
1093         if (IS_ERR(tmp))
1094                 return PTR_ERR(tmp);
1095
1096         fd = get_unused_fd_flags(flags);
1097         if (fd >= 0) {
1098                 struct file *f = do_filp_open(dfd, tmp, &op);
1099                 if (IS_ERR(f)) {
1100                         put_unused_fd(fd);
1101                         fd = PTR_ERR(f);
1102                 } else {
1103                         fsnotify_open(f);
1104                         fd_install(fd, f);
1105                         trace_do_sys_open(tmp->name, flags, mode);
1106                 }
1107         }
1108         putname(tmp);
1109         return fd;
1110 }
1111
1112 SYSCALL_DEFINE3(open, const char __user *, filename, int, flags, umode_t, mode)
1113 {
1114         if (force_o_largefile())
1115                 flags |= O_LARGEFILE;
1116
1117         return do_sys_open(AT_FDCWD, filename, flags, mode);
1118 }
1119
1120 SYSCALL_DEFINE4(openat, int, dfd, const char __user *, filename, int, flags,
1121                 umode_t, mode)
1122 {
1123         if (force_o_largefile())
1124                 flags |= O_LARGEFILE;
1125
1126         return do_sys_open(dfd, filename, flags, mode);
1127 }
1128
1129 #ifdef CONFIG_COMPAT
1130 /*
1131  * Exactly like sys_open(), except that it doesn't set the
1132  * O_LARGEFILE flag.
1133  */
1134 COMPAT_SYSCALL_DEFINE3(open, const char __user *, filename, int, flags, umode_t, mode)
1135 {
1136         return do_sys_open(AT_FDCWD, filename, flags, mode);
1137 }
1138
1139 /*
1140  * Exactly like sys_openat(), except that it doesn't set the
1141  * O_LARGEFILE flag.
1142  */
1143 COMPAT_SYSCALL_DEFINE4(openat, int, dfd, const char __user *, filename, int, flags, umode_t, mode)
1144 {
1145         return do_sys_open(dfd, filename, flags, mode);
1146 }
1147 #endif
1148
1149 #ifndef __alpha__
1150
1151 /*
1152  * For backward compatibility?  Maybe this should be moved
1153  * into arch/i386 instead?
1154  */
1155 SYSCALL_DEFINE2(creat, const char __user *, pathname, umode_t, mode)
1156 {
1157         return ksys_open(pathname, O_CREAT | O_WRONLY | O_TRUNC, mode);
1158 }
1159
1160 #endif
1161
1162 /*
1163  * "id" is the POSIX thread ID. We use the
1164  * files pointer for this..
1165  */
1166 int filp_close(struct file *filp, fl_owner_t id)
1167 {
1168         int retval = 0;
1169
1170         if (!file_count(filp)) {
1171                 printk(KERN_ERR "VFS: Close: file count is 0\n");
1172                 return 0;
1173         }
1174
1175         if (filp->f_op->flush)
1176                 retval = filp->f_op->flush(filp, id);
1177
1178         if (likely(!(filp->f_mode & FMODE_PATH))) {
1179                 dnotify_flush(filp, id);
1180                 locks_remove_posix(filp, id);
1181         }
1182         fput(filp);
1183         return retval;
1184 }
1185
1186 EXPORT_SYMBOL(filp_close);
1187
1188 /*
1189  * Careful here! We test whether the file pointer is NULL before
1190  * releasing the fd. This ensures that one clone task can't release
1191  * an fd while another clone is opening it.
1192  */
1193 SYSCALL_DEFINE1(close, unsigned int, fd)
1194 {
1195         int retval = __close_fd(current->files, fd);
1196
1197         /* can't restart close syscall because file table entry was cleared */
1198         if (unlikely(retval == -ERESTARTSYS ||
1199                      retval == -ERESTARTNOINTR ||
1200                      retval == -ERESTARTNOHAND ||
1201                      retval == -ERESTART_RESTARTBLOCK))
1202                 retval = -EINTR;
1203
1204         return retval;
1205 }
1206
1207 /*
1208  * This routine simulates a hangup on the tty, to arrange that users
1209  * are given clean terminals at login time.
1210  */
1211 SYSCALL_DEFINE0(vhangup)
1212 {
1213         if (capable(CAP_SYS_TTY_CONFIG)) {
1214                 tty_vhangup_self();
1215                 return 0;
1216         }
1217         return -EPERM;
1218 }
1219
1220 /*
1221  * Called when an inode is about to be open.
1222  * We use this to disallow opening large files on 32bit systems if
1223  * the caller didn't specify O_LARGEFILE.  On 64bit systems we force
1224  * on this flag in sys_open.
1225  */
1226 int generic_file_open(struct inode * inode, struct file * filp)
1227 {
1228         if (!(filp->f_flags & O_LARGEFILE) && i_size_read(inode) > MAX_NON_LFS)
1229                 return -EOVERFLOW;
1230         return 0;
1231 }
1232
1233 EXPORT_SYMBOL(generic_file_open);
1234
1235 /*
1236  * This is used by subsystems that don't want seekable
1237  * file descriptors. The function is not supposed to ever fail, the only
1238  * reason it returns an 'int' and not 'void' is so that it can be plugged
1239  * directly into file_operations structure.
1240  */
1241 int nonseekable_open(struct inode *inode, struct file *filp)
1242 {
1243         filp->f_mode &= ~(FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE);
1244         return 0;
1245 }
1246
1247 EXPORT_SYMBOL(nonseekable_open);
1248
1249 /*
1250  * stream_open is used by subsystems that want stream-like file descriptors.
1251  * Such file descriptors are not seekable and don't have notion of position
1252  * (file.f_pos is always 0 and ppos passed to .read()/.write() is always NULL).
1253  * Contrary to file descriptors of other regular files, .read() and .write()
1254  * can run simultaneously.
1255  *
1256  * stream_open never fails and is marked to return int so that it could be
1257  * directly used as file_operations.open .
1258  */
1259 int stream_open(struct inode *inode, struct file *filp)
1260 {
1261         filp->f_mode &= ~(FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE | FMODE_ATOMIC_POS);
1262         filp->f_mode |= FMODE_STREAM;
1263         return 0;
1264 }
1265
1266 EXPORT_SYMBOL(stream_open);