Line data Source code
1 : // SPDX-License-Identifier: GPL-2.0
2 : /*
3 : * linux/fs/attr.c
4 : *
5 : * Copyright (C) 1991, 1992 Linus Torvalds
6 : * changes by Thomas Schoebel-Theuer
7 : */
8 :
9 : #include <linux/export.h>
10 : #include <linux/time.h>
11 : #include <linux/mm.h>
12 : #include <linux/string.h>
13 : #include <linux/sched/signal.h>
14 : #include <linux/capability.h>
15 : #include <linux/fsnotify.h>
16 : #include <linux/fcntl.h>
17 : #include <linux/filelock.h>
18 : #include <linux/security.h>
19 : #include <linux/evm.h>
20 : #include <linux/ima.h>
21 :
22 : #include "internal.h"
23 :
24 : /**
25 : * setattr_should_drop_sgid - determine whether the setgid bit needs to be
26 : * removed
27 : * @idmap: idmap of the mount @inode was found from
28 : * @inode: inode to check
29 : *
30 : * This function determines whether the setgid bit needs to be removed.
31 : * We retain backwards compatibility and require setgid bit to be removed
32 : * unconditionally if S_IXGRP is set. Otherwise we have the exact same
33 : * requirements as setattr_prepare() and setattr_copy().
34 : *
35 : * Return: ATTR_KILL_SGID if setgid bit needs to be removed, 0 otherwise.
36 : */
37 40884060 : int setattr_should_drop_sgid(struct mnt_idmap *idmap,
38 : const struct inode *inode)
39 : {
40 40884060 : umode_t mode = inode->i_mode;
41 :
42 40884060 : if (!(mode & S_ISGID))
43 : return 0;
44 1027 : if (mode & S_IXGRP)
45 : return ATTR_KILL_SGID;
46 411 : if (!in_group_or_capable(idmap, inode, i_gid_into_vfsgid(idmap, inode)))
47 140 : return ATTR_KILL_SGID;
48 : return 0;
49 : }
50 : EXPORT_SYMBOL(setattr_should_drop_sgid);
51 :
52 : /**
53 : * setattr_should_drop_suidgid - determine whether the set{g,u}id bit needs to
54 : * be dropped
55 : * @idmap: idmap of the mount @inode was found from
56 : * @inode: inode to check
57 : *
58 : * This function determines whether the set{g,u}id bits need to be removed.
59 : * If the setuid bit needs to be removed ATTR_KILL_SUID is returned. If the
60 : * setgid bit needs to be removed ATTR_KILL_SGID is returned. If both
61 : * set{g,u}id bits need to be removed the corresponding mask of both flags is
62 : * returned.
63 : *
64 : * Return: A mask of ATTR_KILL_S{G,U}ID indicating which - if any - setid bits
65 : * to remove, 0 otherwise.
66 : */
67 23718907 : int setattr_should_drop_suidgid(struct mnt_idmap *idmap,
68 : struct inode *inode)
69 : {
70 23718907 : umode_t mode = inode->i_mode;
71 23718907 : int kill = 0;
72 :
73 : /* suid always must be killed */
74 23718907 : if (unlikely(mode & S_ISUID))
75 664 : kill = ATTR_KILL_SUID;
76 :
77 23718907 : kill |= setattr_should_drop_sgid(idmap, inode);
78 :
79 23705604 : if (unlikely(kill && !capable(CAP_FSETID) && S_ISREG(mode)))
80 564 : return kill;
81 :
82 : return 0;
83 : }
84 : EXPORT_SYMBOL(setattr_should_drop_suidgid);
85 :
86 : /**
87 : * chown_ok - verify permissions to chown inode
88 : * @idmap: idmap of the mount @inode was found from
89 : * @inode: inode to check permissions on
90 : * @ia_vfsuid: uid to chown @inode to
91 : *
92 : * If the inode has been found through an idmapped mount the idmap of
93 : * the vfsmount must be passed through @idmap. This function will then
94 : * take care to map the inode according to @idmap before checking
95 : * permissions. On non-idmapped mounts or if permission checking is to be
96 : * performed on the raw inode simply pass @nop_mnt_idmap.
97 : */
98 18329981 : static bool chown_ok(struct mnt_idmap *idmap,
99 : const struct inode *inode, vfsuid_t ia_vfsuid)
100 : {
101 18329981 : vfsuid_t vfsuid = i_uid_into_vfsuid(idmap, inode);
102 52809479 : if (vfsuid_eq_kuid(vfsuid, current_fsuid()) &&
103 : vfsuid_eq(ia_vfsuid, vfsuid))
104 : return true;
105 17456227 : if (capable_wrt_inode_uidgid(idmap, inode, CAP_CHOWN))
106 : return true;
107 312 : if (!vfsuid_valid(vfsuid) &&
108 13 : ns_capable(inode->i_sb->s_user_ns, CAP_CHOWN))
109 0 : return true;
110 : return false;
111 : }
112 :
113 : /**
114 : * chgrp_ok - verify permissions to chgrp inode
115 : * @idmap: idmap of the mount @inode was found from
116 : * @inode: inode to check permissions on
117 : * @ia_vfsgid: gid to chown @inode to
118 : *
119 : * If the inode has been found through an idmapped mount the idmap of
120 : * the vfsmount must be passed through @idmap. This function will then
121 : * take care to map the inode according to @idmap before checking
122 : * permissions. On non-idmapped mounts or if permission checking is to be
123 : * performed on the raw inode simply pass @nop_mnt_idmap.
124 : */
125 18197062 : static bool chgrp_ok(struct mnt_idmap *idmap,
126 : const struct inode *inode, vfsgid_t ia_vfsgid)
127 : {
128 18197062 : vfsgid_t vfsgid = i_gid_into_vfsgid(idmap, inode);
129 18206152 : vfsuid_t vfsuid = i_uid_into_vfsuid(idmap, inode);
130 36447412 : if (vfsuid_eq_kuid(vfsuid, current_fsuid())) {
131 32188280 : if (vfsgid_eq(ia_vfsgid, vfsgid))
132 : return true;
133 15242346 : if (vfsgid_in_group_p(ia_vfsgid))
134 : return true;
135 : }
136 17352693 : if (capable_wrt_inode_uidgid(idmap, inode, CAP_CHOWN))
137 : return true;
138 69 : if (!vfsgid_valid(vfsgid) &&
139 0 : ns_capable(inode->i_sb->s_user_ns, CAP_CHOWN))
140 0 : return true;
141 : return false;
142 : }
143 :
144 : /**
145 : * setattr_prepare - check if attribute changes to a dentry are allowed
146 : * @idmap: idmap of the mount the inode was found from
147 : * @dentry: dentry to check
148 : * @attr: attributes to change
149 : *
150 : * Check if we are allowed to change the attributes contained in @attr
151 : * in the given dentry. This includes the normal unix access permission
152 : * checks, as well as checks for rlimits and others. The function also clears
153 : * SGID bit from mode if user is not allowed to set it. Also file capabilities
154 : * and IMA extended attributes are cleared if ATTR_KILL_PRIV is set.
155 : *
156 : * If the inode has been found through an idmapped mount the idmap of
157 : * the vfsmount must be passed through @idmap. This function will then
158 : * take care to map the inode according to @idmap before checking
159 : * permissions. On non-idmapped mounts or if permission checking is to be
160 : * performed on the raw inode simply passs @nop_mnt_idmap.
161 : *
162 : * Should be called as the first thing in ->setattr implementations,
163 : * possibly after taking additional locks.
164 : */
165 54345904 : int setattr_prepare(struct mnt_idmap *idmap, struct dentry *dentry,
166 : struct iattr *attr)
167 : {
168 54345904 : struct inode *inode = d_inode(dentry);
169 54345904 : unsigned int ia_valid = attr->ia_valid;
170 :
171 : /*
172 : * First check size constraints. These can't be overriden using
173 : * ATTR_FORCE.
174 : */
175 54345904 : if (ia_valid & ATTR_SIZE) {
176 18700938 : int error = inode_newsize_ok(inode, attr->ia_size);
177 18701020 : if (error)
178 : return error;
179 : }
180 :
181 : /* If force is set do it anyway. */
182 54345882 : if (ia_valid & ATTR_FORCE)
183 645 : goto kill_priv;
184 :
185 : /* Make sure a caller can chown. */
186 72529869 : if ((ia_valid & ATTR_UID) &&
187 18342274 : !chown_ok(idmap, inode, attr->ia_vfsuid))
188 : return -EPERM;
189 :
190 : /* Make sure caller can chgrp. */
191 72393667 : if ((ia_valid & ATTR_GID) &&
192 18194009 : !chgrp_ok(idmap, inode, attr->ia_vfsgid))
193 : return -EPERM;
194 :
195 : /* Make sure a caller can chmod. */
196 54199589 : if (ia_valid & ATTR_MODE) {
197 1615503 : vfsgid_t vfsgid;
198 :
199 1615503 : if (!inode_owner_or_capable(idmap, inode))
200 39 : return -EPERM;
201 :
202 1613496 : if (ia_valid & ATTR_GID)
203 5260 : vfsgid = attr->ia_vfsgid;
204 : else
205 1608236 : vfsgid = i_gid_into_vfsgid(idmap, inode);
206 :
207 : /* Also check the setgid bit! */
208 1613938 : if (!in_group_or_capable(idmap, inode, vfsgid))
209 52 : attr->ia_mode &= ~S_ISGID;
210 : }
211 :
212 : /* Check for setting the inode time. */
213 54198412 : if (ia_valid & (ATTR_MTIME_SET | ATTR_ATIME_SET | ATTR_TIMES_SET)) {
214 12078824 : if (!inode_owner_or_capable(idmap, inode))
215 : return -EPERM;
216 : }
217 :
218 54226026 : kill_priv:
219 : /* User has permission for the change */
220 54226671 : if (ia_valid & ATTR_KILL_PRIV) {
221 97 : int error;
222 :
223 97 : error = security_inode_killpriv(idmap, dentry);
224 97 : if (error)
225 0 : return error;
226 : }
227 :
228 : return 0;
229 : }
230 : EXPORT_SYMBOL(setattr_prepare);
231 :
232 : /**
233 : * inode_newsize_ok - may this inode be truncated to a given size
234 : * @inode: the inode to be truncated
235 : * @offset: the new size to assign to the inode
236 : *
237 : * inode_newsize_ok must be called with i_mutex held.
238 : *
239 : * inode_newsize_ok will check filesystem limits and ulimits to check that the
240 : * new inode size is within limits. inode_newsize_ok will also send SIGXFSZ
241 : * when necessary. Caller must not proceed with inode size change if failure is
242 : * returned. @inode must be a file (not directory), with appropriate
243 : * permissions to allow truncate (inode_newsize_ok does NOT check these
244 : * conditions).
245 : *
246 : * Return: 0 on success, -ve errno on failure
247 : */
248 25927973 : int inode_newsize_ok(const struct inode *inode, loff_t offset)
249 : {
250 25927973 : if (offset < 0)
251 : return -EINVAL;
252 25927973 : if (inode->i_size < offset) {
253 15897763 : unsigned long limit;
254 :
255 15897763 : limit = rlimit(RLIMIT_FSIZE);
256 15897763 : if (limit != RLIM_INFINITY && offset > limit)
257 25 : goto out_sig;
258 15897738 : if (offset > inode->i_sb->s_maxbytes)
259 66 : goto out_big;
260 : } else {
261 : /*
262 : * truncation of in-use swapfiles is disallowed - it would
263 : * cause subsequent swapout to scribble on the now-freed
264 : * blocks.
265 : */
266 10030210 : if (IS_SWAPFILE(inode))
267 25 : return -ETXTBSY;
268 : }
269 :
270 : return 0;
271 : out_sig:
272 25 : send_sig(SIGXFSZ, current, 0);
273 : out_big:
274 : return -EFBIG;
275 : }
276 : EXPORT_SYMBOL(inode_newsize_ok);
277 :
278 : /**
279 : * setattr_copy - copy simple metadata updates into the generic inode
280 : * @idmap: idmap of the mount the inode was found from
281 : * @inode: the inode to be updated
282 : * @attr: the new attributes
283 : *
284 : * setattr_copy must be called with i_mutex held.
285 : *
286 : * setattr_copy updates the inode's metadata with that specified
287 : * in attr on idmapped mounts. Necessary permission checks to determine
288 : * whether or not the S_ISGID property needs to be removed are performed with
289 : * the correct idmapped mount permission helpers.
290 : * Noticeably missing is inode size update, which is more complex
291 : * as it requires pagecache updates.
292 : *
293 : * If the inode has been found through an idmapped mount the idmap of
294 : * the vfsmount must be passed through @idmap. This function will then
295 : * take care to map the inode according to @idmap before checking
296 : * permissions. On non-idmapped mounts or if permission checking is to be
297 : * performed on the raw inode simply pass @nop_mnt_idmap.
298 : *
299 : * The inode is not marked as dirty after this operation. The rationale is
300 : * that for "simple" filesystems, the struct inode is the inode storage.
301 : * The caller is free to mark the inode dirty afterwards if needed.
302 : */
303 54196630 : void setattr_copy(struct mnt_idmap *idmap, struct inode *inode,
304 : const struct iattr *attr)
305 : {
306 54196630 : unsigned int ia_valid = attr->ia_valid;
307 :
308 54196630 : i_uid_update(idmap, attr, inode);
309 54157832 : i_gid_update(idmap, attr, inode);
310 54147280 : if (ia_valid & ATTR_ATIME)
311 15485962 : inode->i_atime = attr->ia_atime;
312 54147280 : if (ia_valid & ATTR_MTIME)
313 34130905 : inode->i_mtime = attr->ia_mtime;
314 54147280 : if (ia_valid & ATTR_CTIME)
315 53580375 : inode->i_ctime = attr->ia_ctime;
316 54147280 : if (ia_valid & ATTR_MODE) {
317 1612351 : umode_t mode = attr->ia_mode;
318 1612351 : if (!in_group_or_capable(idmap, inode,
319 : i_gid_into_vfsgid(idmap, inode)))
320 460 : mode &= ~S_ISGID;
321 1614745 : inode->i_mode = mode;
322 : }
323 54149674 : }
324 : EXPORT_SYMBOL(setattr_copy);
325 :
326 45492655 : int may_setattr(struct mnt_idmap *idmap, struct inode *inode,
327 : unsigned int ia_valid)
328 : {
329 45492655 : int error;
330 :
331 45492655 : if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID | ATTR_TIMES_SET)) {
332 31771986 : if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
333 : return -EPERM;
334 : }
335 :
336 : /*
337 : * If utimes(2) and friends are called with times == NULL (or both
338 : * times are UTIME_NOW), then we need to check for write permission
339 : */
340 45492447 : if (ia_valid & ATTR_TOUCH) {
341 3568906 : if (IS_IMMUTABLE(inode))
342 : return -EPERM;
343 :
344 3568854 : if (!inode_owner_or_capable(idmap, inode)) {
345 65 : error = inode_permission(idmap, inode, MAY_WRITE);
346 65 : if (error)
347 26 : return error;
348 : }
349 : }
350 : return 0;
351 : }
352 : EXPORT_SYMBOL(may_setattr);
353 :
354 : /**
355 : * notify_change - modify attributes of a filesytem object
356 : * @idmap: idmap of the mount the inode was found from
357 : * @dentry: object affected
358 : * @attr: new attributes
359 : * @delegated_inode: returns inode, if the inode is delegated
360 : *
361 : * The caller must hold the i_mutex on the affected object.
362 : *
363 : * If notify_change discovers a delegation in need of breaking,
364 : * it will return -EWOULDBLOCK and return a reference to the inode in
365 : * delegated_inode. The caller should then break the delegation and
366 : * retry. Because breaking a delegation may take a long time, the
367 : * caller should drop the i_mutex before doing so.
368 : *
369 : * Alternatively, a caller may pass NULL for delegated_inode. This may
370 : * be appropriate for callers that expect the underlying filesystem not
371 : * to be NFS exported. Also, passing NULL is fine for callers holding
372 : * the file open for write, as there can be no conflicting delegation in
373 : * that case.
374 : *
375 : * If the inode has been found through an idmapped mount the idmap of
376 : * the vfsmount must be passed through @idmap. This function will then
377 : * take care to map the inode according to @idmap before checking
378 : * permissions. On non-idmapped mounts or if permission checking is to be
379 : * performed on the raw inode simply pass @nop_mnt_idmap.
380 : */
381 45539651 : int notify_change(struct mnt_idmap *idmap, struct dentry *dentry,
382 : struct iattr *attr, struct inode **delegated_inode)
383 : {
384 45539651 : struct inode *inode = dentry->d_inode;
385 45539651 : umode_t mode = inode->i_mode;
386 45539651 : int error;
387 45539651 : struct timespec64 now;
388 45539651 : unsigned int ia_valid = attr->ia_valid;
389 :
390 45539651 : WARN_ON_ONCE(!inode_is_locked(inode));
391 :
392 45539651 : error = may_setattr(idmap, inode, ia_valid);
393 45449331 : if (error)
394 : return error;
395 :
396 45449045 : if ((ia_valid & ATTR_MODE)) {
397 1617958 : umode_t amode = attr->ia_mode;
398 : /* Flag setting protected by i_mutex */
399 1617958 : if (is_sxid(amode))
400 1729 : inode->i_flags &= ~S_NOSEC;
401 : }
402 :
403 45449045 : now = current_time(inode);
404 :
405 45598442 : attr->ia_ctime = now;
406 45598442 : if (!(ia_valid & ATTR_ATIME_SET))
407 33501312 : attr->ia_atime = now;
408 : else
409 12097130 : attr->ia_atime = timestamp_truncate(attr->ia_atime, inode);
410 45606932 : if (!(ia_valid & ATTR_MTIME_SET))
411 33467321 : attr->ia_mtime = now;
412 : else
413 12139611 : attr->ia_mtime = timestamp_truncate(attr->ia_mtime, inode);
414 :
415 45601408 : if (ia_valid & ATTR_KILL_PRIV) {
416 17172593 : error = security_inode_need_killpriv(dentry);
417 17196805 : if (error < 0)
418 : return error;
419 17196805 : if (error == 0)
420 17197709 : ia_valid = attr->ia_valid &= ~ATTR_KILL_PRIV;
421 : }
422 :
423 : /*
424 : * We now pass ATTR_KILL_S*ID to the lower level setattr function so
425 : * that the function has the ability to reinterpret a mode change
426 : * that's due to these bits. This adds an implicit restriction that
427 : * no function will ever call notify_change with both ATTR_MODE and
428 : * ATTR_KILL_S*ID set.
429 : */
430 45625620 : if ((ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) &&
431 17188972 : (ia_valid & ATTR_MODE))
432 0 : BUG();
433 :
434 45625620 : if (ia_valid & ATTR_KILL_SUID) {
435 17187523 : if (mode & S_ISUID) {
436 488 : ia_valid = attr->ia_valid |= ATTR_MODE;
437 488 : attr->ia_mode = (inode->i_mode & ~S_ISUID);
438 : }
439 : }
440 45625620 : if (ia_valid & ATTR_KILL_SGID) {
441 590 : if (mode & S_ISGID) {
442 590 : if (!(ia_valid & ATTR_MODE)) {
443 180 : ia_valid = attr->ia_valid |= ATTR_MODE;
444 180 : attr->ia_mode = inode->i_mode;
445 : }
446 590 : attr->ia_mode &= ~S_ISGID;
447 : }
448 : }
449 45625620 : if (!(attr->ia_valid & ~(ATTR_KILL_SUID | ATTR_KILL_SGID)))
450 : return 0;
451 :
452 : /*
453 : * Verify that uid/gid changes are valid in the target
454 : * namespace of the superblock.
455 : */
456 45625620 : if (ia_valid & ATTR_UID &&
457 18317725 : !vfsuid_has_fsmapping(idmap, inode->i_sb->s_user_ns,
458 : attr->ia_vfsuid))
459 : return -EOVERFLOW;
460 45584740 : if (ia_valid & ATTR_GID &&
461 18275508 : !vfsgid_has_fsmapping(idmap, inode->i_sb->s_user_ns,
462 : attr->ia_vfsgid))
463 : return -EOVERFLOW;
464 :
465 : /* Don't allow modifications of files with invalid uids or
466 : * gids unless those uids & gids are being made valid.
467 : */
468 72760327 : if (!(ia_valid & ATTR_UID) &&
469 : !vfsuid_valid(i_uid_into_vfsuid(idmap, inode)))
470 : return -EOVERFLOW;
471 72694336 : if (!(ia_valid & ATTR_GID) &&
472 : !vfsgid_valid(i_gid_into_vfsgid(idmap, inode)))
473 : return -EOVERFLOW;
474 :
475 45476645 : error = security_inode_setattr(idmap, dentry, attr);
476 45476645 : if (error)
477 : return error;
478 45476645 : error = try_break_deleg(inode, delegated_inode);
479 45634228 : if (error)
480 : return error;
481 :
482 45634228 : if (inode->i_op->setattr)
483 45634198 : error = inode->i_op->setattr(idmap, dentry, attr);
484 : else
485 30 : error = simple_setattr(idmap, dentry, attr);
486 :
487 45674638 : if (!error) {
488 45637176 : fsnotify_change(dentry, ia_valid);
489 45637176 : ima_inode_post_setattr(idmap, dentry);
490 45637176 : evm_inode_post_setattr(dentry, ia_valid);
491 : }
492 :
493 : return error;
494 : }
495 : EXPORT_SYMBOL(notify_change);
|
