1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * linux/fs/attr.c
4 *
5 * Copyright (C) 1991, 1992 Linus Torvalds
6 * changes by Thomas Schoebel-Theuer
7 */
8
9 #include <linux/export.h>
10 #include <linux/time.h>
11 #include <linux/mm.h>
12 #include <linux/string.h>
13 #include <linux/sched/signal.h>
14 #include <linux/capability.h>
15 #include <linux/fsnotify.h>
16 #include <linux/fcntl.h>
17 #include <linux/security.h>
18 #include <linux/evm.h>
19 #include <linux/ima.h>
20
21 /**
22 * chown_ok - verify permissions to chown inode
23 * @mnt_userns: user namespace of the mount @inode was found from
24 * @inode: inode to check permissions on
25 * @uid: uid to chown @inode to
26 *
27 * If the inode has been found through an idmapped mount the user namespace of
28 * the vfsmount must be passed through @mnt_userns. This function will then
29 * take care to map the inode according to @mnt_userns before checking
30 * permissions. On non-idmapped mounts or if permission checking is to be
31 * performed on the raw inode simply passs init_user_ns.
32 */
chown_ok(struct user_namespace * mnt_userns,const struct inode * inode,kuid_t uid)33 static bool chown_ok(struct user_namespace *mnt_userns,
34 const struct inode *inode,
35 kuid_t uid)
36 {
37 kuid_t kuid = i_uid_into_mnt(mnt_userns, inode);
38 if (uid_eq(current_fsuid(), kuid) && uid_eq(uid, kuid))
39 return true;
40 if (capable_wrt_inode_uidgid(mnt_userns, inode, CAP_CHOWN))
41 return true;
42 if (uid_eq(kuid, INVALID_UID) &&
43 ns_capable(inode->i_sb->s_user_ns, CAP_CHOWN))
44 return true;
45 return false;
46 }
47
48 /**
49 * chgrp_ok - verify permissions to chgrp inode
50 * @mnt_userns: user namespace of the mount @inode was found from
51 * @inode: inode to check permissions on
52 * @gid: gid to chown @inode to
53 *
54 * If the inode has been found through an idmapped mount the user namespace of
55 * the vfsmount must be passed through @mnt_userns. This function will then
56 * take care to map the inode according to @mnt_userns before checking
57 * permissions. On non-idmapped mounts or if permission checking is to be
58 * performed on the raw inode simply passs init_user_ns.
59 */
chgrp_ok(struct user_namespace * mnt_userns,const struct inode * inode,kgid_t gid)60 static bool chgrp_ok(struct user_namespace *mnt_userns,
61 const struct inode *inode, kgid_t gid)
62 {
63 kgid_t kgid = i_gid_into_mnt(mnt_userns, inode);
64 if (uid_eq(current_fsuid(), i_uid_into_mnt(mnt_userns, inode)) &&
65 (in_group_p(gid) || gid_eq(gid, kgid)))
66 return true;
67 if (capable_wrt_inode_uidgid(mnt_userns, inode, CAP_CHOWN))
68 return true;
69 if (gid_eq(kgid, INVALID_GID) &&
70 ns_capable(inode->i_sb->s_user_ns, CAP_CHOWN))
71 return true;
72 return false;
73 }
74
75 /**
76 * setattr_prepare - check if attribute changes to a dentry are allowed
77 * @mnt_userns: user namespace of the mount the inode was found from
78 * @dentry: dentry to check
79 * @attr: attributes to change
80 *
81 * Check if we are allowed to change the attributes contained in @attr
82 * in the given dentry. This includes the normal unix access permission
83 * checks, as well as checks for rlimits and others. The function also clears
84 * SGID bit from mode if user is not allowed to set it. Also file capabilities
85 * and IMA extended attributes are cleared if ATTR_KILL_PRIV is set.
86 *
87 * If the inode has been found through an idmapped mount the user namespace of
88 * the vfsmount must be passed through @mnt_userns. This function will then
89 * take care to map the inode according to @mnt_userns before checking
90 * permissions. On non-idmapped mounts or if permission checking is to be
91 * performed on the raw inode simply passs init_user_ns.
92 *
93 * Should be called as the first thing in ->setattr implementations,
94 * possibly after taking additional locks.
95 */
setattr_prepare(struct user_namespace * mnt_userns,struct dentry * dentry,struct iattr * attr)96 int setattr_prepare(struct user_namespace *mnt_userns, struct dentry *dentry,
97 struct iattr *attr)
98 {
99 struct inode *inode = d_inode(dentry);
100 unsigned int ia_valid = attr->ia_valid;
101
102 /*
103 * First check size constraints. These can't be overriden using
104 * ATTR_FORCE.
105 */
106 if (ia_valid & ATTR_SIZE) {
107 int error = inode_newsize_ok(inode, attr->ia_size);
108 if (error)
109 return error;
110 }
111
112 /* If force is set do it anyway. */
113 if (ia_valid & ATTR_FORCE)
114 goto kill_priv;
115
116 /* Make sure a caller can chown. */
117 if ((ia_valid & ATTR_UID) && !chown_ok(mnt_userns, inode, attr->ia_uid))
118 return -EPERM;
119
120 /* Make sure caller can chgrp. */
121 if ((ia_valid & ATTR_GID) && !chgrp_ok(mnt_userns, inode, attr->ia_gid))
122 return -EPERM;
123
124 /* Make sure a caller can chmod. */
125 if (ia_valid & ATTR_MODE) {
126 if (!inode_owner_or_capable(mnt_userns, inode))
127 return -EPERM;
128 /* Also check the setgid bit! */
129 if (!in_group_p((ia_valid & ATTR_GID) ? attr->ia_gid :
130 i_gid_into_mnt(mnt_userns, inode)) &&
131 !capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FSETID))
132 attr->ia_mode &= ~S_ISGID;
133 }
134
135 /* Check for setting the inode time. */
136 if (ia_valid & (ATTR_MTIME_SET | ATTR_ATIME_SET | ATTR_TIMES_SET)) {
137 if (!inode_owner_or_capable(mnt_userns, inode))
138 return -EPERM;
139 }
140
141 kill_priv:
142 /* User has permission for the change */
143 if (ia_valid & ATTR_KILL_PRIV) {
144 int error;
145
146 error = security_inode_killpriv(mnt_userns, dentry);
147 if (error)
148 return error;
149 }
150
151 return 0;
152 }
153 EXPORT_SYMBOL(setattr_prepare);
154
155 /**
156 * inode_newsize_ok - may this inode be truncated to a given size
157 * @inode: the inode to be truncated
158 * @offset: the new size to assign to the inode
159 *
160 * inode_newsize_ok must be called with i_mutex held.
161 *
162 * inode_newsize_ok will check filesystem limits and ulimits to check that the
163 * new inode size is within limits. inode_newsize_ok will also send SIGXFSZ
164 * when necessary. Caller must not proceed with inode size change if failure is
165 * returned. @inode must be a file (not directory), with appropriate
166 * permissions to allow truncate (inode_newsize_ok does NOT check these
167 * conditions).
168 *
169 * Return: 0 on success, -ve errno on failure
170 */
inode_newsize_ok(const struct inode * inode,loff_t offset)171 int inode_newsize_ok(const struct inode *inode, loff_t offset)
172 {
173 if (inode->i_size < offset) {
174 unsigned long limit;
175
176 limit = rlimit(RLIMIT_FSIZE);
177 if (limit != RLIM_INFINITY && offset > limit)
178 goto out_sig;
179 if (offset > inode->i_sb->s_maxbytes)
180 goto out_big;
181 } else {
182 /*
183 * truncation of in-use swapfiles is disallowed - it would
184 * cause subsequent swapout to scribble on the now-freed
185 * blocks.
186 */
187 if (IS_SWAPFILE(inode))
188 return -ETXTBSY;
189 }
190
191 return 0;
192 out_sig:
193 send_sig(SIGXFSZ, current, 0);
194 out_big:
195 return -EFBIG;
196 }
197 EXPORT_SYMBOL(inode_newsize_ok);
198
199 /**
200 * setattr_copy - copy simple metadata updates into the generic inode
201 * @mnt_userns: user namespace of the mount the inode was found from
202 * @inode: the inode to be updated
203 * @attr: the new attributes
204 *
205 * setattr_copy must be called with i_mutex held.
206 *
207 * setattr_copy updates the inode's metadata with that specified
208 * in attr on idmapped mounts. If file ownership is changed setattr_copy
209 * doesn't map ia_uid and ia_gid. It will asssume the caller has already
210 * provided the intended values. Necessary permission checks to determine
211 * whether or not the S_ISGID property needs to be removed are performed with
212 * the correct idmapped mount permission helpers.
213 * Noticeably missing is inode size update, which is more complex
214 * as it requires pagecache updates.
215 *
216 * If the inode has been found through an idmapped mount the user namespace of
217 * the vfsmount must be passed through @mnt_userns. This function will then
218 * take care to map the inode according to @mnt_userns before checking
219 * permissions. On non-idmapped mounts or if permission checking is to be
220 * performed on the raw inode simply passs init_user_ns.
221 *
222 * The inode is not marked as dirty after this operation. The rationale is
223 * that for "simple" filesystems, the struct inode is the inode storage.
224 * The caller is free to mark the inode dirty afterwards if needed.
225 */
setattr_copy(struct user_namespace * mnt_userns,struct inode * inode,const struct iattr * attr)226 void setattr_copy(struct user_namespace *mnt_userns, struct inode *inode,
227 const struct iattr *attr)
228 {
229 unsigned int ia_valid = attr->ia_valid;
230
231 if (ia_valid & ATTR_UID)
232 inode->i_uid = attr->ia_uid;
233 if (ia_valid & ATTR_GID)
234 inode->i_gid = attr->ia_gid;
235 if (ia_valid & ATTR_ATIME)
236 inode->i_atime = attr->ia_atime;
237 if (ia_valid & ATTR_MTIME)
238 inode->i_mtime = attr->ia_mtime;
239 if (ia_valid & ATTR_CTIME)
240 inode->i_ctime = attr->ia_ctime;
241 if (ia_valid & ATTR_MODE) {
242 umode_t mode = attr->ia_mode;
243 kgid_t kgid = i_gid_into_mnt(mnt_userns, inode);
244 if (!in_group_p(kgid) &&
245 !capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FSETID))
246 mode &= ~S_ISGID;
247 inode->i_mode = mode;
248 }
249 }
250 EXPORT_SYMBOL(setattr_copy);
251
may_setattr(struct user_namespace * mnt_userns,struct inode * inode,unsigned int ia_valid)252 int may_setattr(struct user_namespace *mnt_userns, struct inode *inode,
253 unsigned int ia_valid)
254 {
255 int error;
256
257 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID | ATTR_TIMES_SET)) {
258 if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
259 return -EPERM;
260 }
261
262 /*
263 * If utimes(2) and friends are called with times == NULL (or both
264 * times are UTIME_NOW), then we need to check for write permission
265 */
266 if (ia_valid & ATTR_TOUCH) {
267 if (IS_IMMUTABLE(inode))
268 return -EPERM;
269
270 if (!inode_owner_or_capable(mnt_userns, inode)) {
271 error = inode_permission(mnt_userns, inode, MAY_WRITE);
272 if (error)
273 return error;
274 }
275 }
276 return 0;
277 }
278 EXPORT_SYMBOL(may_setattr);
279
280 /**
281 * notify_change - modify attributes of a filesytem object
282 * @mnt_userns: user namespace of the mount the inode was found from
283 * @dentry: object affected
284 * @attr: new attributes
285 * @delegated_inode: returns inode, if the inode is delegated
286 *
287 * The caller must hold the i_mutex on the affected object.
288 *
289 * If notify_change discovers a delegation in need of breaking,
290 * it will return -EWOULDBLOCK and return a reference to the inode in
291 * delegated_inode. The caller should then break the delegation and
292 * retry. Because breaking a delegation may take a long time, the
293 * caller should drop the i_mutex before doing so.
294 *
295 * If file ownership is changed notify_change() doesn't map ia_uid and
296 * ia_gid. It will asssume the caller has already provided the intended values.
297 *
298 * Alternatively, a caller may pass NULL for delegated_inode. This may
299 * be appropriate for callers that expect the underlying filesystem not
300 * to be NFS exported. Also, passing NULL is fine for callers holding
301 * the file open for write, as there can be no conflicting delegation in
302 * that case.
303 *
304 * If the inode has been found through an idmapped mount the user namespace of
305 * the vfsmount must be passed through @mnt_userns. This function will then
306 * take care to map the inode according to @mnt_userns before checking
307 * permissions. On non-idmapped mounts or if permission checking is to be
308 * performed on the raw inode simply passs init_user_ns.
309 */
notify_change(struct user_namespace * mnt_userns,struct dentry * dentry,struct iattr * attr,struct inode ** delegated_inode)310 int notify_change(struct user_namespace *mnt_userns, struct dentry *dentry,
311 struct iattr *attr, struct inode **delegated_inode)
312 {
313 struct inode *inode = dentry->d_inode;
314 umode_t mode = inode->i_mode;
315 int error;
316 struct timespec64 now;
317 unsigned int ia_valid = attr->ia_valid;
318
319 WARN_ON_ONCE(!inode_is_locked(inode));
320
321 error = may_setattr(mnt_userns, inode, ia_valid);
322 if (error)
323 return error;
324
325 if ((ia_valid & ATTR_MODE)) {
326 umode_t amode = attr->ia_mode;
327 /* Flag setting protected by i_mutex */
328 if (is_sxid(amode))
329 inode->i_flags &= ~S_NOSEC;
330 }
331
332 now = current_time(inode);
333
334 attr->ia_ctime = now;
335 if (!(ia_valid & ATTR_ATIME_SET))
336 attr->ia_atime = now;
337 else
338 attr->ia_atime = timestamp_truncate(attr->ia_atime, inode);
339 if (!(ia_valid & ATTR_MTIME_SET))
340 attr->ia_mtime = now;
341 else
342 attr->ia_mtime = timestamp_truncate(attr->ia_mtime, inode);
343
344 if (ia_valid & ATTR_KILL_PRIV) {
345 error = security_inode_need_killpriv(dentry);
346 if (error < 0)
347 return error;
348 if (error == 0)
349 ia_valid = attr->ia_valid &= ~ATTR_KILL_PRIV;
350 }
351
352 /*
353 * We now pass ATTR_KILL_S*ID to the lower level setattr function so
354 * that the function has the ability to reinterpret a mode change
355 * that's due to these bits. This adds an implicit restriction that
356 * no function will ever call notify_change with both ATTR_MODE and
357 * ATTR_KILL_S*ID set.
358 */
359 if ((ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) &&
360 (ia_valid & ATTR_MODE))
361 BUG();
362
363 if (ia_valid & ATTR_KILL_SUID) {
364 if (mode & S_ISUID) {
365 ia_valid = attr->ia_valid |= ATTR_MODE;
366 attr->ia_mode = (inode->i_mode & ~S_ISUID);
367 }
368 }
369 if (ia_valid & ATTR_KILL_SGID) {
370 if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
371 if (!(ia_valid & ATTR_MODE)) {
372 ia_valid = attr->ia_valid |= ATTR_MODE;
373 attr->ia_mode = inode->i_mode;
374 }
375 attr->ia_mode &= ~S_ISGID;
376 }
377 }
378 if (!(attr->ia_valid & ~(ATTR_KILL_SUID | ATTR_KILL_SGID)))
379 return 0;
380
381 /*
382 * Verify that uid/gid changes are valid in the target
383 * namespace of the superblock.
384 */
385 if (ia_valid & ATTR_UID &&
386 !kuid_has_mapping(inode->i_sb->s_user_ns, attr->ia_uid))
387 return -EOVERFLOW;
388 if (ia_valid & ATTR_GID &&
389 !kgid_has_mapping(inode->i_sb->s_user_ns, attr->ia_gid))
390 return -EOVERFLOW;
391
392 /* Don't allow modifications of files with invalid uids or
393 * gids unless those uids & gids are being made valid.
394 */
395 if (!(ia_valid & ATTR_UID) &&
396 !uid_valid(i_uid_into_mnt(mnt_userns, inode)))
397 return -EOVERFLOW;
398 if (!(ia_valid & ATTR_GID) &&
399 !gid_valid(i_gid_into_mnt(mnt_userns, inode)))
400 return -EOVERFLOW;
401
402 error = security_inode_setattr(dentry, attr);
403 if (error)
404 return error;
405 error = try_break_deleg(inode, delegated_inode);
406 if (error)
407 return error;
408
409 if (inode->i_op->setattr)
410 error = inode->i_op->setattr(mnt_userns, dentry, attr);
411 else
412 error = simple_setattr(mnt_userns, dentry, attr);
413
414 if (!error) {
415 fsnotify_change(dentry, ia_valid);
416 ima_inode_post_setattr(mnt_userns, dentry);
417 evm_inode_post_setattr(dentry, ia_valid);
418 }
419
420 return error;
421 }
422 EXPORT_SYMBOL(notify_change);
423
