Something went wrong. Try again.
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
Something went wrong. Try again.
12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586// SPDX-License-Identifier: GPL-2.0-only/* * linux/fs/open.c * * Copyright (C) 1991, 1992 Linus Torvalds */
#include <linux/string.h>#include <linux/mm.h>#include <linux/file.h>#include <linux/fdtable.h>#include <linux/fsnotify.h>#include <linux/module.h>#include <linux/tty.h>#include <linux/namei.h>#include <linux/backing-dev.h>#include <linux/capability.h>#include <linux/securebits.h>#include <linux/security.h>#include <linux/mount.h>#include <linux/fcntl.h>#include <linux/slab.h>#include <linux/uaccess.h>#include <linux/fs.h>#include <linux/personality.h>#include <linux/pagemap.h>#include <linux/syscalls.h>#include <linux/rcupdate.h>#include <linux/audit.h>#include <linux/falloc.h>#include <linux/fs_struct.h>#include <linux/dnotify.h>#include <linux/compat.h>#include <linux/mnt_idmapping.h>#include <linux/filelock.h>
#include "internal.h"
int do_truncate(struct mnt_idmap *idmap, struct dentry *dentry, loff_t length, unsigned int time_attrs, struct file *filp){ int ret; struct iattr newattrs;
/* Not pretty: "inode->i_size" shouldn't really be signed. But it is. */ if (length < 0) return -EINVAL;
newattrs.ia_size = length; newattrs.ia_valid = ATTR_SIZE | time_attrs; if (filp) { newattrs.ia_file = filp; newattrs.ia_valid |= ATTR_FILE; }
/* Remove suid, sgid, and file capabilities on truncate too */ ret = dentry_needs_remove_privs(idmap, dentry); if (ret < 0) return ret; if (ret) newattrs.ia_valid |= ret | ATTR_FORCE;
ret = inode_lock_killable(dentry->d_inode); if (ret) return ret;
/* Note any delegations or leases have already been broken: */ ret = notify_change(idmap, dentry, &newattrs, NULL); inode_unlock(dentry->d_inode); return ret;}
int vfs_truncate(const struct path *path, loff_t length){ struct mnt_idmap *idmap; struct inode *inode; int error;
inode = path->dentry->d_inode;
/* For directories it's -EISDIR, for other non-regulars - -EINVAL */ if (S_ISDIR(inode->i_mode)) return -EISDIR; if (!S_ISREG(inode->i_mode)) return -EINVAL;
idmap = mnt_idmap(path->mnt); error = inode_permission(idmap, inode, MAY_WRITE); if (error) return error;
error = fsnotify_truncate_perm(path, length); if (error) return error;
error = mnt_want_write(path->mnt); if (error) return error;
error = -EPERM; if (IS_APPEND(inode)) goto mnt_drop_write_and_out;
error = get_write_access(inode); if (error) goto mnt_drop_write_and_out;
/* * Make sure that there are no leases. get_write_access() protects * against the truncate racing with a lease-granting setlease(). */ error = break_lease(inode, O_WRONLY); if (error) goto put_write_and_out;
error = security_path_truncate(path); if (!error) error = do_truncate(idmap, path->dentry, length, 0, NULL);
put_write_and_out: put_write_access(inode);mnt_drop_write_and_out: mnt_drop_write(path->mnt);
return error;}EXPORT_SYMBOL_GPL(vfs_truncate);
int ksys_truncate(const char __user *pathname, loff_t length){ unsigned int lookup_flags = LOOKUP_FOLLOW; struct path path; int error;
if (length < 0) /* sorry, but loff_t says... */ return -EINVAL;
CLASS(filename, name)(pathname);retry: error = filename_lookup(AT_FDCWD, name, lookup_flags, &path, NULL); if (!error) { error = vfs_truncate(&path, length); path_put(&path); if (retry_estale(error, lookup_flags)) { lookup_flags |= LOOKUP_REVAL; goto retry; } } return error;}
SYSCALL_DEFINE2(truncate, const char __user *, path, long, length){ return ksys_truncate(path, length);}
#ifdef CONFIG_COMPATCOMPAT_SYSCALL_DEFINE2(truncate, const char __user *, path, compat_off_t, length){ return ksys_truncate(path, length);}#endif
int do_ftruncate(struct file *file, loff_t length, unsigned int flags){ struct dentry *dentry = file->f_path.dentry; struct inode *inode = dentry->d_inode; int error;
if (!S_ISREG(inode->i_mode) || !(file->f_mode & FMODE_WRITE)) return -EINVAL;
/* * Cannot ftruncate over 2^31 bytes without large file support, either * through opening with O_LARGEFILE or by using ftruncate64(). */ if (length > MAX_NON_LFS && !(file->f_flags & O_LARGEFILE) && !(flags & FTRUNCATE_LFS)) return -EINVAL;
/* Check IS_APPEND on real upper inode */ if (IS_APPEND(file_inode(file))) return -EPERM;
error = security_file_truncate(file); if (error) return error;
error = fsnotify_truncate_perm(&file->f_path, length); if (error) return error;
scoped_guard(super_write, inode->i_sb) return do_truncate(file_mnt_idmap(file), dentry, length, ATTR_MTIME | ATTR_CTIME, file);}
int ksys_ftruncate(unsigned int fd, loff_t length, unsigned int flags){ if (length < 0) return -EINVAL; CLASS(fd, f)(fd); if (fd_empty(f)) return -EBADF;
return do_ftruncate(fd_file(f), length, flags);}
SYSCALL_DEFINE2(ftruncate, unsigned int, fd, off_t, length){ return ksys_ftruncate(fd, length, 0);}
#ifdef CONFIG_COMPATCOMPAT_SYSCALL_DEFINE2(ftruncate, unsigned int, fd, compat_off_t, length){ return ksys_ftruncate(fd, length, 0);}#endif
/* LFS versions of truncate are only needed on 32 bit machines */#if BITS_PER_LONG == 32SYSCALL_DEFINE2(truncate64, const char __user *, path, loff_t, length){ return ksys_truncate(path, length);}
SYSCALL_DEFINE2(ftruncate64, unsigned int, fd, loff_t, length){ return ksys_ftruncate(fd, length, FTRUNCATE_LFS);}#endif /* BITS_PER_LONG == 32 */
#if defined(CONFIG_COMPAT) && defined(__ARCH_WANT_COMPAT_TRUNCATE64)COMPAT_SYSCALL_DEFINE3(truncate64, const char __user *, pathname, compat_arg_u64_dual(length)){ return ksys_truncate(pathname, compat_arg_u64_glue(length));}#endif
#if defined(CONFIG_COMPAT) && defined(__ARCH_WANT_COMPAT_FTRUNCATE64)COMPAT_SYSCALL_DEFINE3(ftruncate64, unsigned int, fd, compat_arg_u64_dual(length)){ return ksys_ftruncate(fd, compat_arg_u64_glue(length), FTRUNCATE_LFS);}#endif
int vfs_fallocate(struct file *file, int mode, loff_t offset, loff_t len){ struct inode *inode = file_inode(file); int ret; loff_t sum;
if (offset < 0 || len <= 0) return -EINVAL;
if (mode & ~(FALLOC_FL_MODE_MASK | FALLOC_FL_KEEP_SIZE)) return -EOPNOTSUPP;
/* * Modes are exclusive, even if that is not obvious from the encoding * as bit masks and the mix with the flag in the same namespace. * * To make things even more complicated, FALLOC_FL_ALLOCATE_RANGE is * encoded as no bit set. */ switch (mode & FALLOC_FL_MODE_MASK) { case FALLOC_FL_ALLOCATE_RANGE: case FALLOC_FL_UNSHARE_RANGE: case FALLOC_FL_ZERO_RANGE: break; case FALLOC_FL_PUNCH_HOLE: if (!(mode & FALLOC_FL_KEEP_SIZE)) return -EOPNOTSUPP; break; case FALLOC_FL_COLLAPSE_RANGE: case FALLOC_FL_INSERT_RANGE: case FALLOC_FL_WRITE_ZEROES: if (mode & FALLOC_FL_KEEP_SIZE) return -EOPNOTSUPP; break; default: return -EOPNOTSUPP; }
if (!(file->f_mode & FMODE_WRITE)) return -EBADF;
/* * On append-only files only space preallocation is supported. */ if ((mode & ~FALLOC_FL_KEEP_SIZE) && IS_APPEND(inode)) return -EPERM;
if (IS_IMMUTABLE(inode)) return -EPERM;
/* * We cannot allow any fallocate operation on an active swapfile */ if (IS_SWAPFILE(inode)) return -ETXTBSY;
/* * Revalidate the write permissions, in case security policy has * changed since the files were opened. */ ret = security_file_permission(file, MAY_WRITE); if (ret) return ret;
ret = fsnotify_file_area_perm(file, MAY_WRITE, &offset, len); if (ret) return ret;
if (S_ISFIFO(inode->i_mode)) return -ESPIPE;
if (S_ISDIR(inode->i_mode)) return -EISDIR;
if (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode)) return -ENODEV;
/* Check for wraparound */ if (check_add_overflow(offset, len, &sum)) return -EFBIG;
if (sum > inode->i_sb->s_maxbytes) return -EFBIG;
if (!file->f_op->fallocate) return -EOPNOTSUPP;
file_start_write(file); ret = file->f_op->fallocate(file, mode, offset, len);
/* * Create inotify and fanotify events. * * To keep the logic simple always create events if fallocate succeeds. * This implies that events are even created if the file size remains * unchanged, e.g. when using flag FALLOC_FL_KEEP_SIZE. */ if (ret == 0) fsnotify_modify(file);
file_end_write(file); return ret;}EXPORT_SYMBOL_GPL(vfs_fallocate);
int ksys_fallocate(int fd, int mode, loff_t offset, loff_t len){ CLASS(fd, f)(fd);
if (fd_empty(f)) return -EBADF;
return vfs_fallocate(fd_file(f), mode, offset, len);}
SYSCALL_DEFINE4(fallocate, int, fd, int, mode, loff_t, offset, loff_t, len){ return ksys_fallocate(fd, mode, offset, len);}
#if defined(CONFIG_COMPAT) && defined(__ARCH_WANT_COMPAT_FALLOCATE)COMPAT_SYSCALL_DEFINE6(fallocate, int, fd, int, mode, compat_arg_u64_dual(offset), compat_arg_u64_dual(len)){ return ksys_fallocate(fd, mode, compat_arg_u64_glue(offset), compat_arg_u64_glue(len));}#endif
/* * access() needs to use the real uid/gid, not the effective uid/gid. * We do this by temporarily clearing all FS-related capabilities and * switching the fsuid/fsgid around to the real ones. * * Creating new credentials is expensive, so we try to skip doing it, * which we can if the result would match what we already got. */static bool access_need_override_creds(int flags){ const struct cred *cred;
if (flags & AT_EACCESS) return false;
cred = current_cred(); if (!uid_eq(cred->fsuid, cred->uid) || !gid_eq(cred->fsgid, cred->gid)) return true;
if (!issecure(SECURE_NO_SETUID_FIXUP)) { kuid_t root_uid = make_kuid(cred->user_ns, 0); if (!uid_eq(cred->uid, root_uid)) { if (!cap_isclear(cred->cap_effective)) return true; } else { if (!cap_isidentical(cred->cap_effective, cred->cap_permitted)) return true; } }
return false;}
static const struct cred *access_override_creds(void){ struct cred *override_cred;
override_cred = prepare_creds(); if (!override_cred) return NULL;
/* * XXX access_need_override_creds performs checks in hopes of skipping * this work. Make sure it stays in sync if making any changes in this * routine. */
override_cred->fsuid = override_cred->uid; override_cred->fsgid = override_cred->gid;
if (!issecure(SECURE_NO_SETUID_FIXUP)) { /* Clear the capabilities if we switch to a non-root user */ kuid_t root_uid = make_kuid(override_cred->user_ns, 0); if (!uid_eq(override_cred->uid, root_uid)) cap_clear(override_cred->cap_effective); else override_cred->cap_effective = override_cred->cap_permitted; }
/* * The new set of credentials can *only* be used in * task-synchronous circumstances, and does not need * RCU freeing, unless somebody then takes a separate * reference to it. * * NOTE! This is _only_ true because this credential * is used purely for override_creds() that installs * it as the subjective cred. Other threads will be * accessing ->real_cred, not the subjective cred. * * If somebody _does_ make a copy of this (using the * 'get_current_cred()' function), that will clear the * non_rcu field, because now that other user may be * expecting RCU freeing. But normal thread-synchronous * cred accesses will keep things non-racy to avoid RCU * freeing. */ override_cred->non_rcu = 1; return override_creds(override_cred);}
static int do_faccessat(int dfd, const char __user *filename, int mode, int flags){ struct path path; struct inode *inode; int res; unsigned int lookup_flags = LOOKUP_FOLLOW; const struct cred *old_cred = NULL;
if (mode & ~S_IRWXO) /* where's F_OK, X_OK, W_OK, R_OK? */ return -EINVAL;
if (flags & ~(AT_EACCESS | AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH)) return -EINVAL;
if (flags & AT_SYMLINK_NOFOLLOW) lookup_flags &= ~LOOKUP_FOLLOW;
if (access_need_override_creds(flags)) { old_cred = access_override_creds(); if (!old_cred) return -ENOMEM; }
CLASS(filename_uflags, name)(filename, flags);retry: res = filename_lookup(dfd, name, lookup_flags, &path, NULL); if (res) goto out;
inode = d_backing_inode(path.dentry);
if ((mode & MAY_EXEC) && S_ISREG(inode->i_mode)) { /* * MAY_EXEC on regular files is denied if the fs is mounted * with the "noexec" flag. */ res = -EACCES; if (path_noexec(&path)) goto out_path_release; }
res = inode_permission(mnt_idmap(path.mnt), inode, mode | MAY_ACCESS); /* SuS v2 requires we report a read only fs too */ if (res || !(mode & S_IWOTH) || special_file(inode->i_mode)) goto out_path_release; /* * This is a rare case where using __mnt_is_readonly() * is OK without a mnt_want/drop_write() pair. Since * no actual write to the fs is performed here, we do * not need to telegraph to that to anyone. * * By doing this, we accept that this access is * inherently racy and know that the fs may change * state before we even see this result. */ if (__mnt_is_readonly(path.mnt)) res = -EROFS;
out_path_release: path_put(&path); if (retry_estale(res, lookup_flags)) { lookup_flags |= LOOKUP_REVAL; goto retry; }out: if (old_cred) put_cred(revert_creds(old_cred));
return res;}
SYSCALL_DEFINE3(faccessat, int, dfd, const char __user *, filename, int, mode){ return do_faccessat(dfd, filename, mode, 0);}
SYSCALL_DEFINE4(faccessat2, int, dfd, const char __user *, filename, int, mode, int, flags){ return do_faccessat(dfd, filename, mode, flags);}
SYSCALL_DEFINE2(access, const char __user *, filename, int, mode){ return do_faccessat(AT_FDCWD, filename, mode, 0);}
SYSCALL_DEFINE1(chdir, const char __user *, filename){ struct path path; int error; unsigned int lookup_flags = LOOKUP_FOLLOW | LOOKUP_DIRECTORY; CLASS(filename, name)(filename);retry: error = filename_lookup(AT_FDCWD, name, lookup_flags, &path, NULL); if (!error) { error = path_permission(&path, MAY_EXEC | MAY_CHDIR); if (!error) set_fs_pwd(current->fs, &path); path_put(&path); if (retry_estale(error, lookup_flags)) { lookup_flags |= LOOKUP_REVAL; goto retry; } } return error;}
SYSCALL_DEFINE1(fchdir, unsigned int, fd){ CLASS(fd_raw, f)(fd); int error;
if (fd_empty(f)) return -EBADF;
if (!d_can_lookup(fd_file(f)->f_path.dentry)) return -ENOTDIR;
error = file_permission(fd_file(f), MAY_EXEC | MAY_CHDIR); if (!error) set_fs_pwd(current->fs, &fd_file(f)->f_path); return error;}
SYSCALL_DEFINE1(chroot, const char __user *, filename){ struct path path; int error; unsigned int lookup_flags = LOOKUP_FOLLOW | LOOKUP_DIRECTORY; CLASS(filename, name)(filename);retry: error = filename_lookup(AT_FDCWD, name, lookup_flags, &path, NULL); if (error) return error;
error = path_permission(&path, MAY_EXEC | MAY_CHDIR); if (error) goto dput_and_out;
error = -EPERM; if (!ns_capable(current_user_ns(), CAP_SYS_CHROOT)) goto dput_and_out; error = security_path_chroot(&path); if (!error) set_fs_root(current->fs, &path);dput_and_out: path_put(&path); if (retry_estale(error, lookup_flags)) { lookup_flags |= LOOKUP_REVAL; goto retry; } return error;}
int chmod_common(const struct path *path, umode_t mode){ struct inode *inode = path->dentry->d_inode; struct delegated_inode delegated_inode = { }; struct iattr newattrs; int error;
error = mnt_want_write(path->mnt); if (error) return error;retry_deleg: error = inode_lock_killable(inode); if (error) goto out_mnt_unlock; error = security_path_chmod(path, mode); if (error) goto out_unlock; newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO); newattrs.ia_valid = ATTR_MODE | ATTR_CTIME; error = notify_change(mnt_idmap(path->mnt), path->dentry, &newattrs, &delegated_inode);out_unlock: inode_unlock(inode); if (is_delegated(&delegated_inode)) { error = break_deleg_wait(&delegated_inode); if (!error) goto retry_deleg; }out_mnt_unlock: mnt_drop_write(path->mnt); return error;}
int vfs_fchmod(struct file *file, umode_t mode){ audit_file(file); return chmod_common(&file->f_path, mode);}
SYSCALL_DEFINE2(fchmod, unsigned int, fd, umode_t, mode){ CLASS(fd, f)(fd);
if (fd_empty(f)) return -EBADF;
return vfs_fchmod(fd_file(f), mode);}
static int do_fchmodat(int dfd, const char __user *filename, umode_t mode, unsigned int flags){ struct path path; int error; unsigned int lookup_flags;
if (unlikely(flags & ~(AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH))) return -EINVAL;
lookup_flags = (flags & AT_SYMLINK_NOFOLLOW) ? 0 : LOOKUP_FOLLOW; CLASS(filename_uflags, name)(filename, flags);retry: error = filename_lookup(dfd, name, lookup_flags, &path, NULL); if (!error) { error = chmod_common(&path, mode); path_put(&path); if (retry_estale(error, lookup_flags)) { lookup_flags |= LOOKUP_REVAL; goto retry; } } return error;}
SYSCALL_DEFINE4(fchmodat2, int, dfd, const char __user *, filename, umode_t, mode, unsigned int, flags){ return do_fchmodat(dfd, filename, mode, flags);}
SYSCALL_DEFINE3(fchmodat, int, dfd, const char __user *, filename, umode_t, mode){ return do_fchmodat(dfd, filename, mode, 0);}
SYSCALL_DEFINE2(chmod, const char __user *, filename, umode_t, mode){ return do_fchmodat(AT_FDCWD, filename, mode, 0);}
/* * Check whether @kuid is valid and if so generate and set vfsuid_t in * ia_vfsuid. * * Return: true if @kuid is valid, false if not. */static inline bool setattr_vfsuid(struct iattr *attr, kuid_t kuid){ if (!uid_valid(kuid)) return false; attr->ia_valid |= ATTR_UID; attr->ia_vfsuid = VFSUIDT_INIT(kuid); return true;}
/* * Check whether @kgid is valid and if so generate and set vfsgid_t in * ia_vfsgid. * * Return: true if @kgid is valid, false if not. */static inline bool setattr_vfsgid(struct iattr *attr, kgid_t kgid){ if (!gid_valid(kgid)) return false; attr->ia_valid |= ATTR_GID; attr->ia_vfsgid = VFSGIDT_INIT(kgid); return true;}
int chown_common(const struct path *path, uid_t user, gid_t group){ struct mnt_idmap *idmap; struct user_namespace *fs_userns; struct inode *inode = path->dentry->d_inode; struct delegated_inode delegated_inode = { }; int error; struct iattr newattrs; kuid_t uid; kgid_t gid;
uid = make_kuid(current_user_ns(), user); gid = make_kgid(current_user_ns(), group);
idmap = mnt_idmap(path->mnt); fs_userns = i_user_ns(inode);
retry_deleg: newattrs.ia_vfsuid = INVALID_VFSUID; newattrs.ia_vfsgid = INVALID_VFSGID; newattrs.ia_valid = ATTR_CTIME; if ((user != (uid_t)-1) && !setattr_vfsuid(&newattrs, uid)) return -EINVAL; if ((group != (gid_t)-1) && !setattr_vfsgid(&newattrs, gid)) return -EINVAL; error = inode_lock_killable(inode); if (error) return error; if (!S_ISDIR(inode->i_mode)) newattrs.ia_valid |= ATTR_KILL_SUID | ATTR_KILL_PRIV | setattr_should_drop_sgid(idmap, inode); /* Continue to send actual fs values, not the mount values. */ error = security_path_chown( path, from_vfsuid(idmap, fs_userns, newattrs.ia_vfsuid), from_vfsgid(idmap, fs_userns, newattrs.ia_vfsgid)); if (!error) error = notify_change(idmap, path->dentry, &newattrs, &delegated_inode); inode_unlock(inode); if (is_delegated(&delegated_inode)) { error = break_deleg_wait(&delegated_inode); if (!error) goto retry_deleg; } return error;}
int do_fchownat(int dfd, const char __user *filename, uid_t user, gid_t group, int flag){ struct path path; int error; int lookup_flags;
if ((flag & ~(AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH)) != 0) return -EINVAL;
lookup_flags = (flag & AT_SYMLINK_NOFOLLOW) ? 0 : LOOKUP_FOLLOW; CLASS(filename_uflags, name)(filename, flag);retry: error = filename_lookup(dfd, name, lookup_flags, &path, NULL); if (!error) { error = mnt_want_write(path.mnt); if (!error) { error = chown_common(&path, user, group); mnt_drop_write(path.mnt); } path_put(&path); if (retry_estale(error, lookup_flags)) { lookup_flags |= LOOKUP_REVAL; goto retry; } } return error;}
SYSCALL_DEFINE5(fchownat, int, dfd, const char __user *, filename, uid_t, user, gid_t, group, int, flag){ return do_fchownat(dfd, filename, user, group, flag);}
SYSCALL_DEFINE3(chown, const char __user *, filename, uid_t, user, gid_t, group){ return do_fchownat(AT_FDCWD, filename, user, group, 0);}
SYSCALL_DEFINE3(lchown, const char __user *, filename, uid_t, user, gid_t, group){ return do_fchownat(AT_FDCWD, filename, user, group, AT_SYMLINK_NOFOLLOW);}
int vfs_fchown(struct file *file, uid_t user, gid_t group){ int error;
error = mnt_want_write_file(file); if (error) return error; audit_file(file); error = chown_common(&file->f_path, user, group); mnt_drop_write_file(file); return error;}
int ksys_fchown(unsigned int fd, uid_t user, gid_t group){ CLASS(fd, f)(fd);
if (fd_empty(f)) return -EBADF;
return vfs_fchown(fd_file(f), user, group);}
SYSCALL_DEFINE3(fchown, unsigned int, fd, uid_t, user, gid_t, group){ return ksys_fchown(fd, user, group);}
static inline int file_get_write_access(struct file *f){ int error;
error = get_write_access(f->f_inode); if (unlikely(error)) return error; error = mnt_get_write_access(f->f_path.mnt); if (unlikely(error)) goto cleanup_inode; if (unlikely(f->f_mode & FMODE_BACKING)) { error = mnt_get_write_access(backing_file_user_path(f)->mnt); if (unlikely(error)) goto cleanup_mnt; } return 0;
cleanup_mnt: mnt_put_write_access(f->f_path.mnt);cleanup_inode: put_write_access(f->f_inode); return error;}
static int do_dentry_open(struct file *f, int (*open)(struct inode *, struct file *)){ static const struct file_operations empty_fops = {}; struct inode *inode = f->f_path.dentry->d_inode; int error;
path_get(&f->f_path); f->f_inode = inode; f->f_mapping = inode->i_mapping; f->f_wb_err = filemap_sample_wb_err(f->f_mapping); f->f_sb_err = file_sample_sb_err(f);
if (unlikely(f->f_flags & O_PATH)) { f->f_mode = FMODE_PATH | FMODE_OPENED; file_set_fsnotify_mode(f, FMODE_NONOTIFY); f->f_op = &empty_fops; return 0; }
if ((f->f_mode & (FMODE_READ | FMODE_WRITE)) == FMODE_READ) { i_readcount_inc(inode); } else if (f->f_mode & FMODE_WRITE && !special_file(inode->i_mode)) { error = file_get_write_access(f); if (unlikely(error)) goto cleanup_file; f->f_mode |= FMODE_WRITER; }
/* POSIX.1-2008/SUSv4 Section XSI 2.9.7 */ if (S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode)) f->f_mode |= FMODE_ATOMIC_POS;
f->f_op = fops_get(inode->i_fop); if (WARN_ON(!f->f_op)) { error = -ENODEV; goto cleanup_all; }
error = security_file_open(f); if (unlikely(error)) goto cleanup_all;
/* * Call fsnotify open permission hook and set FMODE_NONOTIFY_* bits * according to existing permission watches. * If FMODE_NONOTIFY mode was already set for an fanotify fd or for a * pseudo file, this call will not change the mode. */ error = fsnotify_open_perm_and_set_mode(f); if (unlikely(error)) goto cleanup_all;
error = break_lease(file_inode(f), f->f_flags); if (unlikely(error)) goto cleanup_all;
/* normally all 3 are set; ->open() can clear them if needed */ f->f_mode |= FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE; if (!open) open = f->f_op->open; if (open) { error = open(inode, f); if (error) goto cleanup_all; } f->f_mode |= FMODE_OPENED; if ((f->f_mode & FMODE_READ) && likely(f->f_op->read || f->f_op->read_iter)) f->f_mode |= FMODE_CAN_READ; if ((f->f_mode & FMODE_WRITE) && likely(f->f_op->write || f->f_op->write_iter)) f->f_mode |= FMODE_CAN_WRITE; if ((f->f_mode & FMODE_LSEEK) && !f->f_op->llseek) f->f_mode &= ~FMODE_LSEEK; if (f->f_mapping->a_ops && f->f_mapping->a_ops->direct_IO) f->f_mode |= FMODE_CAN_ODIRECT;
f->f_flags &= ~(O_CREAT | O_EXCL | O_NOCTTY | O_TRUNC | __O_REGULAR); f->f_iocb_flags = iocb_flags(f);
file_ra_state_init(&f->f_ra, f->f_mapping->host->i_mapping);
if ((f->f_flags & O_DIRECT) && !(f->f_mode & FMODE_CAN_ODIRECT)) return -EINVAL;
return 0;
cleanup_all: if (WARN_ON_ONCE(error > 0)) error = -EINVAL; fops_put(f->f_op); put_file_access(f);cleanup_file: path_put(&f->f_path); f->__f_path.mnt = NULL; f->__f_path.dentry = NULL; f->f_inode = NULL; return error;}
/** * finish_open - finish opening a file * @file: file pointer * @dentry: pointer to dentry * @open: open callback * * This can be used to finish opening a file passed to i_op->atomic_open(). * * If the open callback is set to NULL, then the standard f_op->open() * filesystem callback is substituted. * * NB: the dentry reference is _not_ consumed. If, for example, the dentry is * the return value of d_splice_alias(), then the caller needs to perform dput() * on it after finish_open(). * * Returns zero on success or -errno if the open failed. */int finish_open(struct file *file, struct dentry *dentry, int (*open)(struct inode *, struct file *)){ BUG_ON(file->f_mode & FMODE_OPENED); /* once it's opened, it's opened */
file->__f_path.dentry = dentry; return do_dentry_open(file, open);}EXPORT_SYMBOL(finish_open);
/** * finish_no_open - finish ->atomic_open() without opening the file * * @file: file pointer * @dentry: dentry, ERR_PTR(-E...) or NULL (as returned from ->lookup()) * * This can be used to set the result of a lookup in ->atomic_open(). * * NB: unlike finish_open() this function does consume the dentry reference and * the caller need not dput() it. * * Returns 0 or -E..., which must be the return value of ->atomic_open() after * having called this function. */int finish_no_open(struct file *file, struct dentry *dentry){ if (IS_ERR(dentry)) return PTR_ERR(dentry); file->__f_path.dentry = dentry; return 0;}EXPORT_SYMBOL(finish_no_open);
char *file_path(struct file *filp, char *buf, int buflen){ return d_path(&filp->f_path, buf, buflen);}EXPORT_SYMBOL(file_path);
/** * vfs_open - open the file at the given path * @path: path to open * @file: newly allocated file with f_flag initialized */int vfs_open(const struct path *path, struct file *file){ int ret;
file->__f_path = *path; ret = do_dentry_open(file, NULL); if (!ret) { /* * Once we return a file with FMODE_OPENED, __fput() will call * fsnotify_close(), so we need fsnotify_open() here for * symmetry. */ fsnotify_open(file); } return ret;}
struct file *dentry_open(const struct path *path, int flags, const struct cred *cred){ int error; struct file *f;
/* We must always pass in a valid mount pointer. */ BUG_ON(!path->mnt);
f = alloc_empty_file(flags, cred); if (!IS_ERR(f)) { error = vfs_open(path, f); if (error) { fput(f); f = ERR_PTR(error); } } return f;}EXPORT_SYMBOL(dentry_open);
struct file *dentry_open_nonotify(const struct path *path, int flags, const struct cred *cred){ struct file *f = alloc_empty_file(flags, cred); if (!IS_ERR(f)) { int error;
file_set_fsnotify_mode(f, FMODE_NONOTIFY); error = vfs_open(path, f); if (error) { fput(f); f = ERR_PTR(error); } } return f;}
/** * kernel_file_open - open a file for kernel internal use * @path: path of the file to open * @flags: open flags * @cred: credentials for open * * Open a file for use by in-kernel consumers. The file is not accounted * against nr_files and must not be installed into the file descriptor * table. * * Return: Opened file on success, an error pointer on failure. */struct file *kernel_file_open(const struct path *path, int flags, const struct cred *cred){ struct file *f; int error;
f = alloc_empty_file_noaccount(flags, cred); if (IS_ERR(f)) return f;
error = vfs_open(path, f); if (error) { fput(f); return ERR_PTR(error); } return f;}EXPORT_SYMBOL_GPL(kernel_file_open);
#define WILL_CREATE(flags) (flags & (O_CREAT | __O_TMPFILE))#define O_PATH_FLAGS (O_DIRECTORY | O_NOFOLLOW | O_PATH | O_CLOEXEC | O_EMPTYPATH)
inline struct open_how build_open_how(int flags, umode_t mode){ struct open_how how = { .flags = flags & VALID_OPEN_FLAGS, .mode = mode & S_IALLUGO, };
/* O_PATH beats everything else. */ if (how.flags & O_PATH) how.flags &= O_PATH_FLAGS; /* Modes should only be set for create-like flags. */ if (!WILL_CREATE(how.flags)) how.mode = 0; return how;}
inline int build_open_flags(const struct open_how *how, struct open_flags *op){ u64 flags = how->flags; u64 strip = O_CLOEXEC; int lookup_flags = 0; int acc_mode = ACC_MODE(flags);
BUILD_BUG_ON_MSG(upper_32_bits(VALID_OPEN_FLAGS), "VALID_OPEN_FLAGS must fit in 32 bits"); /* The whole point: OPENAT2_REGULAR must be unrepresentable in int. */ BUILD_BUG_ON_MSG(!upper_32_bits(OPENAT2_REGULAR), "OPENAT2_REGULAR must live in the upper 32 bits of open_how::flags"); /* Prevent a future bit collision between UAPI and internal carrier. */ BUILD_BUG_ON_MSG(OPENAT2_REGULAR & VALID_OPEN_FLAGS, "OPENAT2_REGULAR must not alias any open()/openat() flag"); BUILD_BUG_ON_MSG(__O_REGULAR & VALID_OPENAT2_FLAGS, "__O_REGULAR must not alias any user-visible flag");
/* * Strip flags that aren't relevant in determining struct open_flags. */ flags &= ~strip;
/* * Older syscalls implicitly clear all of the invalid flags or argument * values before calling build_open_flags(), but openat2(2) checks all * of its arguments. */ if (flags & ~VALID_OPENAT2_FLAGS) return -EINVAL; if (how->resolve & ~VALID_RESOLVE_FLAGS) return -EINVAL;
/* Scoping flags are mutually exclusive. */ if ((how->resolve & RESOLVE_BENEATH) && (how->resolve & RESOLVE_IN_ROOT)) return -EINVAL;
/* Deal with the mode. */ if (WILL_CREATE(flags)) { if (how->mode & ~S_IALLUGO) return -EINVAL; op->mode = how->mode | S_IFREG; } else { if (how->mode != 0) return -EINVAL; op->mode = 0; }
/* * Block bugs where O_DIRECTORY | O_CREAT created regular files. * Note, that blocking O_DIRECTORY | O_CREAT here also protects * O_TMPFILE below which requires O_DIRECTORY being raised. */ if ((flags & (O_DIRECTORY | O_CREAT)) == (O_DIRECTORY | O_CREAT)) return -EINVAL;
/* Now handle the creative implementation of O_TMPFILE. */ if (flags & __O_TMPFILE) { /* * In order to ensure programs get explicit errors when trying * to use O_TMPFILE on old kernels we enforce that O_DIRECTORY * is raised alongside __O_TMPFILE. */ if (!(flags & O_DIRECTORY)) return -EINVAL; if (!(acc_mode & MAY_WRITE)) return -EINVAL; } /* * Asking to open a directory and a regular file at the same time is * contradictory. */ if ((flags & (O_DIRECTORY | OPENAT2_REGULAR)) == (O_DIRECTORY | OPENAT2_REGULAR)) return -EINVAL;
if (flags & O_PATH) { /* O_PATH only permits certain other flags to be set. */ if (flags & ~O_PATH_FLAGS) return -EINVAL; acc_mode = 0; }
/* * O_SYNC is implemented as __O_SYNC|O_DSYNC. As many places only * check for O_DSYNC if the need any syncing at all we enforce it's * always set instead of having to deal with possibly weird behaviour * for malicious applications setting only __O_SYNC. */ if (flags & __O_SYNC) flags |= O_DSYNC;
/* * Translate the upper-32-bit UAPI bit OPENAT2_REGULAR into the * kernel-internal lower-32-bit __O_REGULAR carrier so the bit * survives the assignment to op->open_flag (an int) below and the * subsequent flow through f->f_flags (unsigned int) and the * i_op->atomic_open() callback (unsigned). do_dentry_open() strips * __O_REGULAR before the file becomes visible to userspace. */ if (flags & OPENAT2_REGULAR) { flags &= ~OPENAT2_REGULAR; flags |= __O_REGULAR; }
op->open_flag = flags;
/* O_TRUNC implies we need access checks for write permissions */ if (flags & O_TRUNC) acc_mode |= MAY_WRITE;
/* Allow the LSM permission hook to distinguish append access from general write access. */ if (flags & O_APPEND) acc_mode |= MAY_APPEND;
op->acc_mode = acc_mode;
op->intent = flags & O_PATH ? 0 : LOOKUP_OPEN;
if (flags & O_CREAT) { op->intent |= LOOKUP_CREATE; if (flags & O_EXCL) { op->intent |= LOOKUP_EXCL; flags |= O_NOFOLLOW; } }
if (flags & O_DIRECTORY) lookup_flags |= LOOKUP_DIRECTORY; if (!(flags & O_NOFOLLOW)) lookup_flags |= LOOKUP_FOLLOW; if (flags & O_EMPTYPATH) lookup_flags |= LOOKUP_EMPTY;
if (how->resolve & RESOLVE_NO_XDEV) lookup_flags |= LOOKUP_NO_XDEV; if (how->resolve & RESOLVE_NO_MAGICLINKS) lookup_flags |= LOOKUP_NO_MAGICLINKS; if (how->resolve & RESOLVE_NO_SYMLINKS) lookup_flags |= LOOKUP_NO_SYMLINKS; if (how->resolve & RESOLVE_BENEATH) lookup_flags |= LOOKUP_BENEATH; if (how->resolve & RESOLVE_IN_ROOT) lookup_flags |= LOOKUP_IN_ROOT; if (how->resolve & RESOLVE_CACHED) { /* Don't bother even trying for create/truncate/tmpfile open */ if (flags & (O_TRUNC | O_CREAT | __O_TMPFILE)) return -EAGAIN; lookup_flags |= LOOKUP_CACHED; }
op->lookup_flags = lookup_flags; return 0;}
/** * file_open_name - open file and return file pointer * * @name: struct filename containing path to open * @flags: open flags as per the open(2) second argument * @mode: mode for the new file if O_CREAT is set, else ignored * * This is the helper to open a file from kernelspace if you really * have to. But in generally you should not do this, so please move * along, nothing to see here.. */struct file *file_open_name(struct filename *name, int flags, umode_t mode){ struct open_flags op; struct open_how how = build_open_how(flags, mode); int err = build_open_flags(&how, &op); if (err) return ERR_PTR(err); return do_file_open(AT_FDCWD, name, &op);}
/** * filp_open - open file and return file pointer * * @filename: path to open * @flags: open flags as per the open(2) second argument * @mode: mode for the new file if O_CREAT is set, else ignored * * This is the helper to open a file from kernelspace if you really * have to. But in generally you should not do this, so please move * along, nothing to see here.. */struct file *filp_open(const char *filename, int flags, umode_t mode){ CLASS(filename_kernel, name)(filename); return file_open_name(name, flags, mode);}EXPORT_SYMBOL(filp_open);
struct file *file_open_root(const struct path *root, const char *filename, int flags, umode_t mode){ struct open_flags op; struct open_how how = build_open_how(flags, mode); int err = build_open_flags(&how, &op); if (err) return ERR_PTR(err); return do_file_open_root(root, filename, &op);}EXPORT_SYMBOL(file_open_root);
static int do_sys_openat2(int dfd, const char __user *filename, struct open_how *how){ struct open_flags op; int err = build_open_flags(how, &op); if (unlikely(err)) return err;
CLASS(filename_flags, name)(filename, op.lookup_flags); return FD_ADD(how->flags, do_file_open(dfd, name, &op));}
int do_sys_open(int dfd, const char __user *filename, int flags, umode_t mode){ struct open_how how = build_open_how(flags, mode); return do_sys_openat2(dfd, filename, &how);}
SYSCALL_DEFINE3(open, const char __user *, filename, int, flags, umode_t, mode){ if (force_o_largefile()) flags |= O_LARGEFILE; return do_sys_open(AT_FDCWD, filename, flags, mode);}
SYSCALL_DEFINE4(openat, int, dfd, const char __user *, filename, int, flags, umode_t, mode){ if (force_o_largefile()) flags |= O_LARGEFILE; return do_sys_open(dfd, filename, flags, mode);}
SYSCALL_DEFINE4(openat2, int, dfd, const char __user *, filename, struct open_how __user *, how, size_t, usize){ int err; struct open_how tmp;
BUILD_BUG_ON(sizeof(struct open_how) < OPEN_HOW_SIZE_VER0); BUILD_BUG_ON(sizeof(struct open_how) != OPEN_HOW_SIZE_LATEST);
if (unlikely(usize < OPEN_HOW_SIZE_VER0)) return -EINVAL; if (unlikely(usize > PAGE_SIZE)) return -E2BIG;
err = copy_struct_from_user(&tmp, sizeof(tmp), how, usize); if (err) return err;
audit_openat2_how(&tmp);
/* O_LARGEFILE is only allowed for non-O_PATH. */ if (!(tmp.flags & O_PATH) && force_o_largefile()) tmp.flags |= O_LARGEFILE;
return do_sys_openat2(dfd, filename, &tmp);}
#ifdef CONFIG_COMPAT/* * Exactly like sys_open(), except that it doesn't set the * O_LARGEFILE flag. */COMPAT_SYSCALL_DEFINE3(open, const char __user *, filename, int, flags, umode_t, mode){ return do_sys_open(AT_FDCWD, filename, flags, mode);}
/* * Exactly like sys_openat(), except that it doesn't set the * O_LARGEFILE flag. */COMPAT_SYSCALL_DEFINE4(openat, int, dfd, const char __user *, filename, int, flags, umode_t, mode){ return do_sys_open(dfd, filename, flags, mode);}#endif
#ifndef __alpha__
/* * For backward compatibility? Maybe this should be moved * into arch/i386 instead? */SYSCALL_DEFINE2(creat, const char __user *, pathname, umode_t, mode){ int flags = O_CREAT | O_WRONLY | O_TRUNC;
if (force_o_largefile()) flags |= O_LARGEFILE; return do_sys_open(AT_FDCWD, pathname, flags, mode);}#endif
/* * "id" is the POSIX thread ID. We use the * files pointer for this.. */static int filp_flush(struct file *filp, fl_owner_t id){ int retval = 0;
if (CHECK_DATA_CORRUPTION(file_count(filp) == 0, filp, "VFS: Close: file count is 0 (f_op=%ps)", filp->f_op)) { return 0; }
if (filp->f_op->flush) retval = filp->f_op->flush(filp, id);
if (likely(!(filp->f_mode & FMODE_PATH))) { dnotify_flush(filp, id); locks_remove_posix(filp, id); } return retval;}
int filp_close(struct file *filp, fl_owner_t id){ int retval;
retval = filp_flush(filp, id); fput_close(filp);
return retval;}EXPORT_SYMBOL(filp_close);
/* * Careful here! We test whether the file pointer is NULL before * releasing the fd. This ensures that one clone task can't release * an fd while another clone is opening it. */SYSCALL_DEFINE1(close, unsigned int, fd){ int retval; struct file *file;
file = file_close_fd(fd); if (!file) return -EBADF;
retval = filp_flush(file, current->files);
/* * We're returning to user space. Don't bother * with any delayed fput() cases. */ fput_close_sync(file);
if (likely(retval == 0)) return 0;
/* can't restart close syscall because file table entry was cleared */ if (retval == -ERESTARTSYS || retval == -ERESTARTNOINTR || retval == -ERESTARTNOHAND || retval == -ERESTART_RESTARTBLOCK) retval = -EINTR;
return retval;}
/* * This routine simulates a hangup on the tty, to arrange that users * are given clean terminals at login time. */SYSCALL_DEFINE0(vhangup){ if (capable(CAP_SYS_TTY_CONFIG)) { tty_vhangup_self(); return 0; } return -EPERM;}
/* * Called when an inode is about to be open. * We use this to disallow opening large files on 32bit systems if * the caller didn't specify O_LARGEFILE. On 64bit systems we force * on this flag in sys_open. */int generic_file_open(struct inode * inode, struct file * filp){ if (!(filp->f_flags & O_LARGEFILE) && i_size_read(inode) > MAX_NON_LFS) return -EOVERFLOW; return 0;}
EXPORT_SYMBOL(generic_file_open);
/* * This is used by subsystems that don't want seekable * file descriptors. The function is not supposed to ever fail, the only * reason it returns an 'int' and not 'void' is so that it can be plugged * directly into file_operations structure. */int nonseekable_open(struct inode *inode, struct file *filp){ filp->f_mode &= ~(FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE); return 0;}
EXPORT_SYMBOL(nonseekable_open);
/* * stream_open is used by subsystems that want stream-like file descriptors. * Such file descriptors are not seekable and don't have notion of position * (file.f_pos is always 0 and ppos passed to .read()/.write() is always NULL). * Contrary to file descriptors of other regular files, .read() and .write() * can run simultaneously. * * stream_open never fails and is marked to return int so that it could be * directly used as file_operations.open . */int stream_open(struct inode *inode, struct file *filp){ filp->f_mode &= ~(FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE | FMODE_ATOMIC_POS); filp->f_mode |= FMODE_STREAM; return 0;}
EXPORT_SYMBOL(stream_open);