1 // SPDX-License-Identifier: GPL-2.0
2 #include <linux/syscalls.h>
3 #include <linux/slab.h>
4 #include <linux/fs.h>
5 #include <linux/file.h>
6 #include <linux/mount.h>
7 #include <linux/namei.h>
8 #include <linux/exportfs.h>
9 #include <linux/fs_struct.h>
10 #include <linux/fsnotify.h>
11 #include <linux/personality.h>
12 #include <linux/uaccess.h>
13 #include <linux/compat.h>
14 #include "internal.h"
15 #include "mount.h"
16
do_sys_name_to_handle(const struct path * path,struct file_handle __user * ufh,void __user * mnt_id,bool unique_mntid,int fh_flags)17 static long do_sys_name_to_handle(const struct path *path,
18 struct file_handle __user *ufh,
19 void __user *mnt_id, bool unique_mntid,
20 int fh_flags)
21 {
22 long retval;
23 struct file_handle f_handle;
24 int handle_dwords, handle_bytes;
25 struct file_handle *handle = NULL;
26
27 /*
28 * We need to make sure whether the file system support decoding of
29 * the file handle if decodeable file handle was requested.
30 */
31 if (!exportfs_can_encode_fh(path->dentry->d_sb->s_export_op, fh_flags))
32 return -EOPNOTSUPP;
33
34 if (copy_from_user(&f_handle, ufh, sizeof(struct file_handle)))
35 return -EFAULT;
36
37 if (f_handle.handle_bytes > MAX_HANDLE_SZ)
38 return -EINVAL;
39
40 handle = kzalloc(struct_size(handle, f_handle, f_handle.handle_bytes),
41 GFP_KERNEL);
42 if (!handle)
43 return -ENOMEM;
44
45 /* convert handle size to multiple of sizeof(u32) */
46 handle_dwords = f_handle.handle_bytes >> 2;
47
48 /* we ask for a non connectable maybe decodeable file handle */
49 retval = exportfs_encode_fh(path->dentry,
50 (struct fid *)handle->f_handle,
51 &handle_dwords, fh_flags);
52 handle->handle_type = retval;
53 /* convert handle size to bytes */
54 handle_bytes = handle_dwords * sizeof(u32);
55 handle->handle_bytes = handle_bytes;
56 if ((handle->handle_bytes > f_handle.handle_bytes) ||
57 (retval == FILEID_INVALID) || (retval < 0)) {
58 /* As per old exportfs_encode_fh documentation
59 * we could return ENOSPC to indicate overflow
60 * But file system returned 255 always. So handle
61 * both the values
62 */
63 if (retval == FILEID_INVALID || retval == -ENOSPC)
64 retval = -EOVERFLOW;
65 /*
66 * set the handle size to zero so we copy only
67 * non variable part of the file_handle
68 */
69 handle_bytes = 0;
70 } else
71 retval = 0;
72 /* copy the mount id */
73 if (unique_mntid) {
74 if (put_user(real_mount(path->mnt)->mnt_id_unique,
75 (u64 __user *) mnt_id))
76 retval = -EFAULT;
77 } else {
78 if (put_user(real_mount(path->mnt)->mnt_id,
79 (int __user *) mnt_id))
80 retval = -EFAULT;
81 }
82 /* copy the handle */
83 if (retval != -EFAULT &&
84 copy_to_user(ufh, handle,
85 struct_size(handle, f_handle, handle_bytes)))
86 retval = -EFAULT;
87 kfree(handle);
88 return retval;
89 }
90
91 /**
92 * sys_name_to_handle_at: convert name to handle
93 * @dfd: directory relative to which name is interpreted if not absolute
94 * @name: name that should be converted to handle.
95 * @handle: resulting file handle
96 * @mnt_id: mount id of the file system containing the file
97 * (u64 if AT_HANDLE_MNT_ID_UNIQUE, otherwise int)
98 * @flag: flag value to indicate whether to follow symlink or not
99 * and whether a decodable file handle is required.
100 *
101 * @handle->handle_size indicate the space available to store the
102 * variable part of the file handle in bytes. If there is not
103 * enough space, the field is updated to return the minimum
104 * value required.
105 */
SYSCALL_DEFINE5(name_to_handle_at,int,dfd,const char __user *,name,struct file_handle __user *,handle,void __user *,mnt_id,int,flag)106 SYSCALL_DEFINE5(name_to_handle_at, int, dfd, const char __user *, name,
107 struct file_handle __user *, handle, void __user *, mnt_id,
108 int, flag)
109 {
110 struct path path;
111 int lookup_flags;
112 int fh_flags;
113 int err;
114
115 if (flag & ~(AT_SYMLINK_FOLLOW | AT_EMPTY_PATH | AT_HANDLE_FID |
116 AT_HANDLE_MNT_ID_UNIQUE))
117 return -EINVAL;
118
119 lookup_flags = (flag & AT_SYMLINK_FOLLOW) ? LOOKUP_FOLLOW : 0;
120 fh_flags = (flag & AT_HANDLE_FID) ? EXPORT_FH_FID : 0;
121 if (flag & AT_EMPTY_PATH)
122 lookup_flags |= LOOKUP_EMPTY;
123 err = user_path_at(dfd, name, lookup_flags, &path);
124 if (!err) {
125 err = do_sys_name_to_handle(&path, handle, mnt_id,
126 flag & AT_HANDLE_MNT_ID_UNIQUE,
127 fh_flags);
128 path_put(&path);
129 }
130 return err;
131 }
132
get_path_from_fd(int fd,struct path * root)133 static int get_path_from_fd(int fd, struct path *root)
134 {
135 if (fd == AT_FDCWD) {
136 struct fs_struct *fs = current->fs;
137 spin_lock(&fs->lock);
138 *root = fs->pwd;
139 path_get(root);
140 spin_unlock(&fs->lock);
141 } else {
142 struct fd f = fdget(fd);
143 if (!fd_file(f))
144 return -EBADF;
145 *root = fd_file(f)->f_path;
146 path_get(root);
147 fdput(f);
148 }
149
150 return 0;
151 }
152
153 enum handle_to_path_flags {
154 HANDLE_CHECK_PERMS = (1 << 0),
155 HANDLE_CHECK_SUBTREE = (1 << 1),
156 };
157
158 struct handle_to_path_ctx {
159 struct path root;
160 enum handle_to_path_flags flags;
161 unsigned int fh_flags;
162 };
163
vfs_dentry_acceptable(void * context,struct dentry * dentry)164 static int vfs_dentry_acceptable(void *context, struct dentry *dentry)
165 {
166 struct handle_to_path_ctx *ctx = context;
167 struct user_namespace *user_ns = current_user_ns();
168 struct dentry *d, *root = ctx->root.dentry;
169 struct mnt_idmap *idmap = mnt_idmap(ctx->root.mnt);
170 int retval = 0;
171
172 if (!root)
173 return 1;
174
175 /* Old permission model with global CAP_DAC_READ_SEARCH. */
176 if (!ctx->flags)
177 return 1;
178
179 /*
180 * Verify that the decoded dentry itself has a valid id mapping.
181 * In case the decoded dentry is the mountfd root itself, this
182 * verifies that the mountfd inode itself has a valid id mapping.
183 */
184 if (!privileged_wrt_inode_uidgid(user_ns, idmap, d_inode(dentry)))
185 return 0;
186
187 /*
188 * It's racy as we're not taking rename_lock but we're able to ignore
189 * permissions and we just need an approximation whether we were able
190 * to follow a path to the file.
191 *
192 * It's also potentially expensive on some filesystems especially if
193 * there is a deep path.
194 */
195 d = dget(dentry);
196 while (d != root && !IS_ROOT(d)) {
197 struct dentry *parent = dget_parent(d);
198
199 /*
200 * We know that we have the ability to override DAC permissions
201 * as we've verified this earlier via CAP_DAC_READ_SEARCH. But
202 * we also need to make sure that there aren't any unmapped
203 * inodes in the path that would prevent us from reaching the
204 * file.
205 */
206 if (!privileged_wrt_inode_uidgid(user_ns, idmap,
207 d_inode(parent))) {
208 dput(d);
209 dput(parent);
210 return retval;
211 }
212
213 dput(d);
214 d = parent;
215 }
216
217 if (!(ctx->flags & HANDLE_CHECK_SUBTREE) || d == root)
218 retval = 1;
219 WARN_ON_ONCE(d != root && d != root->d_sb->s_root);
220 dput(d);
221 return retval;
222 }
223
do_handle_to_path(struct file_handle * handle,struct path * path,struct handle_to_path_ctx * ctx)224 static int do_handle_to_path(struct file_handle *handle, struct path *path,
225 struct handle_to_path_ctx *ctx)
226 {
227 int handle_dwords;
228 struct vfsmount *mnt = ctx->root.mnt;
229
230 /* change the handle size to multiple of sizeof(u32) */
231 handle_dwords = handle->handle_bytes >> 2;
232 path->dentry = exportfs_decode_fh_raw(mnt,
233 (struct fid *)handle->f_handle,
234 handle_dwords, handle->handle_type,
235 ctx->fh_flags,
236 vfs_dentry_acceptable, ctx);
237 if (IS_ERR_OR_NULL(path->dentry)) {
238 if (path->dentry == ERR_PTR(-ENOMEM))
239 return -ENOMEM;
240 return -ESTALE;
241 }
242 path->mnt = mntget(mnt);
243 return 0;
244 }
245
246 /*
247 * Allow relaxed permissions of file handles if the caller has the
248 * ability to mount the filesystem or create a bind-mount of the
249 * provided @mountdirfd.
250 *
251 * In both cases the caller may be able to get an unobstructed way to
252 * the encoded file handle. If the caller is only able to create a
253 * bind-mount we need to verify that there are no locked mounts on top
254 * of it that could prevent us from getting to the encoded file.
255 *
256 * In principle, locked mounts can prevent the caller from mounting the
257 * filesystem but that only applies to procfs and sysfs neither of which
258 * support decoding file handles.
259 */
may_decode_fh(struct handle_to_path_ctx * ctx,unsigned int o_flags)260 static inline bool may_decode_fh(struct handle_to_path_ctx *ctx,
261 unsigned int o_flags)
262 {
263 struct path *root = &ctx->root;
264
265 /*
266 * Restrict to O_DIRECTORY to provide a deterministic API that avoids a
267 * confusing api in the face of disconnected non-dir dentries.
268 *
269 * There's only one dentry for each directory inode (VFS rule)...
270 */
271 if (!(o_flags & O_DIRECTORY))
272 return false;
273
274 if (ns_capable(root->mnt->mnt_sb->s_user_ns, CAP_SYS_ADMIN))
275 ctx->flags = HANDLE_CHECK_PERMS;
276 else if (is_mounted(root->mnt) &&
277 ns_capable(real_mount(root->mnt)->mnt_ns->user_ns,
278 CAP_SYS_ADMIN) &&
279 !has_locked_children(real_mount(root->mnt), root->dentry))
280 ctx->flags = HANDLE_CHECK_PERMS | HANDLE_CHECK_SUBTREE;
281 else
282 return false;
283
284 /* Are we able to override DAC permissions? */
285 if (!ns_capable(current_user_ns(), CAP_DAC_READ_SEARCH))
286 return false;
287
288 ctx->fh_flags = EXPORT_FH_DIR_ONLY;
289 return true;
290 }
291
handle_to_path(int mountdirfd,struct file_handle __user * ufh,struct path * path,unsigned int o_flags)292 static int handle_to_path(int mountdirfd, struct file_handle __user *ufh,
293 struct path *path, unsigned int o_flags)
294 {
295 int retval = 0;
296 struct file_handle f_handle;
297 struct file_handle *handle = NULL;
298 struct handle_to_path_ctx ctx = {};
299
300 retval = get_path_from_fd(mountdirfd, &ctx.root);
301 if (retval)
302 goto out_err;
303
304 if (!capable(CAP_DAC_READ_SEARCH) && !may_decode_fh(&ctx, o_flags)) {
305 retval = -EPERM;
306 goto out_path;
307 }
308
309 if (copy_from_user(&f_handle, ufh, sizeof(struct file_handle))) {
310 retval = -EFAULT;
311 goto out_path;
312 }
313 if ((f_handle.handle_bytes > MAX_HANDLE_SZ) ||
314 (f_handle.handle_bytes == 0)) {
315 retval = -EINVAL;
316 goto out_path;
317 }
318 handle = kmalloc(struct_size(handle, f_handle, f_handle.handle_bytes),
319 GFP_KERNEL);
320 if (!handle) {
321 retval = -ENOMEM;
322 goto out_path;
323 }
324 /* copy the full handle */
325 *handle = f_handle;
326 if (copy_from_user(&handle->f_handle,
327 &ufh->f_handle,
328 f_handle.handle_bytes)) {
329 retval = -EFAULT;
330 goto out_handle;
331 }
332
333 retval = do_handle_to_path(handle, path, &ctx);
334
335 out_handle:
336 kfree(handle);
337 out_path:
338 path_put(&ctx.root);
339 out_err:
340 return retval;
341 }
342
do_handle_open(int mountdirfd,struct file_handle __user * ufh,int open_flag)343 static long do_handle_open(int mountdirfd, struct file_handle __user *ufh,
344 int open_flag)
345 {
346 long retval = 0;
347 struct path path;
348 struct file *file;
349 int fd;
350
351 retval = handle_to_path(mountdirfd, ufh, &path, open_flag);
352 if (retval)
353 return retval;
354
355 fd = get_unused_fd_flags(open_flag);
356 if (fd < 0) {
357 path_put(&path);
358 return fd;
359 }
360 file = file_open_root(&path, "", open_flag, 0);
361 if (IS_ERR(file)) {
362 put_unused_fd(fd);
363 retval = PTR_ERR(file);
364 } else {
365 retval = fd;
366 fd_install(fd, file);
367 }
368 path_put(&path);
369 return retval;
370 }
371
372 /**
373 * sys_open_by_handle_at: Open the file handle
374 * @mountdirfd: directory file descriptor
375 * @handle: file handle to be opened
376 * @flags: open flags.
377 *
378 * @mountdirfd indicate the directory file descriptor
379 * of the mount point. file handle is decoded relative
380 * to the vfsmount pointed by the @mountdirfd. @flags
381 * value is same as the open(2) flags.
382 */
SYSCALL_DEFINE3(open_by_handle_at,int,mountdirfd,struct file_handle __user *,handle,int,flags)383 SYSCALL_DEFINE3(open_by_handle_at, int, mountdirfd,
384 struct file_handle __user *, handle,
385 int, flags)
386 {
387 long ret;
388
389 if (force_o_largefile())
390 flags |= O_LARGEFILE;
391
392 ret = do_handle_open(mountdirfd, handle, flags);
393 return ret;
394 }
395
396 #ifdef CONFIG_COMPAT
397 /*
398 * Exactly like fs/open.c:sys_open_by_handle_at(), except that it
399 * doesn't set the O_LARGEFILE flag.
400 */
COMPAT_SYSCALL_DEFINE3(open_by_handle_at,int,mountdirfd,struct file_handle __user *,handle,int,flags)401 COMPAT_SYSCALL_DEFINE3(open_by_handle_at, int, mountdirfd,
402 struct file_handle __user *, handle, int, flags)
403 {
404 return do_handle_open(mountdirfd, handle, flags);
405 }
406 #endif
407