]>
Commit | Line | Data |
---|---|---|
b2441318 | 1 | // SPDX-License-Identifier: GPL-2.0 |
33d3dfff | 2 | #include <linux/fanotify.h> |
11637e4b | 3 | #include <linux/fcntl.h> |
af579beb | 4 | #include <linux/fdtable.h> |
2a3edf86 | 5 | #include <linux/file.h> |
11637e4b | 6 | #include <linux/fs.h> |
52c923dd | 7 | #include <linux/anon_inodes.h> |
11637e4b | 8 | #include <linux/fsnotify_backend.h> |
2a3edf86 | 9 | #include <linux/init.h> |
a1014f10 | 10 | #include <linux/mount.h> |
2a3edf86 | 11 | #include <linux/namei.h> |
a1014f10 | 12 | #include <linux/poll.h> |
11637e4b EP |
13 | #include <linux/security.h> |
14 | #include <linux/syscalls.h> | |
e4e047a2 | 15 | #include <linux/slab.h> |
2a3edf86 | 16 | #include <linux/types.h> |
a1014f10 | 17 | #include <linux/uaccess.h> |
91c2e0bc | 18 | #include <linux/compat.h> |
174cd4b1 | 19 | #include <linux/sched/signal.h> |
d46eb14b | 20 | #include <linux/memcontrol.h> |
a8b13aa2 AG |
21 | #include <linux/statfs.h> |
22 | #include <linux/exportfs.h> | |
a1014f10 EP |
23 | |
24 | #include <asm/ioctls.h> | |
11637e4b | 25 | |
c63181e6 | 26 | #include "../../mount.h" |
be77196b | 27 | #include "../fdinfo.h" |
7053aee2 | 28 | #include "fanotify.h" |
c63181e6 | 29 | |
2529a0df | 30 | #define FANOTIFY_DEFAULT_MAX_EVENTS 16384 |
5b8fea65 AG |
31 | #define FANOTIFY_OLD_DEFAULT_MAX_MARKS 8192 |
32 | #define FANOTIFY_DEFAULT_MAX_GROUPS 128 | |
734a1a5e | 33 | #define FANOTIFY_DEFAULT_FEE_POOL_SIZE 32 |
5b8fea65 AG |
34 | |
35 | /* | |
36 | * Legacy fanotify marks limits (8192) is per group and we introduced a tunable | |
37 | * limit of marks per user, similar to inotify. Effectively, the legacy limit | |
38 | * of fanotify marks per user is <max marks per group> * <max groups per user>. | |
39 | * This default limit (1M) also happens to match the increased limit of inotify | |
40 | * max_user_watches since v5.10. | |
41 | */ | |
42 | #define FANOTIFY_DEFAULT_MAX_USER_MARKS \ | |
43 | (FANOTIFY_OLD_DEFAULT_MAX_MARKS * FANOTIFY_DEFAULT_MAX_GROUPS) | |
44 | ||
45 | /* | |
46 | * Most of the memory cost of adding an inode mark is pinning the marked inode. | |
47 | * The size of the filesystem inode struct is not uniform across filesystems, | |
48 | * so double the size of a VFS inode is used as a conservative approximation. | |
49 | */ | |
50 | #define INODE_MARK_COST (2 * sizeof(struct inode)) | |
51 | ||
52 | /* configurable via /proc/sys/fs/fanotify/ */ | |
53 | static int fanotify_max_queued_events __read_mostly; | |
54 | ||
55 | #ifdef CONFIG_SYSCTL | |
56 | ||
57 | #include <linux/sysctl.h> | |
58 | ||
f153c224 SS |
59 | static long ft_zero = 0; |
60 | static long ft_int_max = INT_MAX; | |
61 | ||
7b9ad122 | 62 | static struct ctl_table fanotify_table[] = { |
5b8fea65 AG |
63 | { |
64 | .procname = "max_user_groups", | |
65 | .data = &init_user_ns.ucount_max[UCOUNT_FANOTIFY_GROUPS], | |
f153c224 | 66 | .maxlen = sizeof(long), |
5b8fea65 | 67 | .mode = 0644, |
f153c224 SS |
68 | .proc_handler = proc_doulongvec_minmax, |
69 | .extra1 = &ft_zero, | |
70 | .extra2 = &ft_int_max, | |
5b8fea65 AG |
71 | }, |
72 | { | |
73 | .procname = "max_user_marks", | |
74 | .data = &init_user_ns.ucount_max[UCOUNT_FANOTIFY_MARKS], | |
f153c224 | 75 | .maxlen = sizeof(long), |
5b8fea65 | 76 | .mode = 0644, |
f153c224 SS |
77 | .proc_handler = proc_doulongvec_minmax, |
78 | .extra1 = &ft_zero, | |
79 | .extra2 = &ft_int_max, | |
5b8fea65 AG |
80 | }, |
81 | { | |
82 | .procname = "max_queued_events", | |
83 | .data = &fanotify_max_queued_events, | |
84 | .maxlen = sizeof(int), | |
85 | .mode = 0644, | |
86 | .proc_handler = proc_dointvec_minmax, | |
87 | .extra1 = SYSCTL_ZERO | |
88 | }, | |
89 | { } | |
90 | }; | |
7b9ad122 XN |
91 | |
92 | static void __init fanotify_sysctls_init(void) | |
93 | { | |
94 | register_sysctl("fs/fanotify", fanotify_table); | |
95 | } | |
96 | #else | |
97 | #define fanotify_sysctls_init() do { } while (0) | |
5b8fea65 | 98 | #endif /* CONFIG_SYSCTL */ |
2529a0df | 99 | |
48149e9d HS |
100 | /* |
101 | * All flags that may be specified in parameter event_f_flags of fanotify_init. | |
102 | * | |
103 | * Internal and external open flags are stored together in field f_flags of | |
104 | * struct file. Only external open flags shall be allowed in event_f_flags. | |
105 | * Internal flags like FMODE_NONOTIFY, FMODE_EXEC, FMODE_NOCMTIME shall be | |
106 | * excluded. | |
107 | */ | |
108 | #define FANOTIFY_INIT_ALL_EVENT_F_BITS ( \ | |
109 | O_ACCMODE | O_APPEND | O_NONBLOCK | \ | |
110 | __O_SYNC | O_DSYNC | O_CLOEXEC | \ | |
111 | O_LARGEFILE | O_NOATIME ) | |
112 | ||
33d3dfff | 113 | extern const struct fsnotify_ops fanotify_fsnotify_ops; |
11637e4b | 114 | |
054c636e | 115 | struct kmem_cache *fanotify_mark_cache __read_mostly; |
7088f357 JK |
116 | struct kmem_cache *fanotify_fid_event_cachep __read_mostly; |
117 | struct kmem_cache *fanotify_path_event_cachep __read_mostly; | |
f083441b | 118 | struct kmem_cache *fanotify_perm_event_cachep __read_mostly; |
2a3edf86 | 119 | |
5e469c83 | 120 | #define FANOTIFY_EVENT_ALIGN 4 |
d3424c9b | 121 | #define FANOTIFY_FID_INFO_HDR_LEN \ |
44d705b0 | 122 | (sizeof(struct fanotify_event_info_fid) + sizeof(struct file_handle)) |
af579beb MB |
123 | #define FANOTIFY_PIDFD_INFO_HDR_LEN \ |
124 | sizeof(struct fanotify_event_info_pidfd) | |
130a3c74 GKB |
125 | #define FANOTIFY_ERROR_INFO_LEN \ |
126 | (sizeof(struct fanotify_event_info_error)) | |
5e469c83 | 127 | |
44d705b0 | 128 | static int fanotify_fid_info_len(int fh_len, int name_len) |
d766b553 | 129 | { |
44d705b0 AG |
130 | int info_len = fh_len; |
131 | ||
132 | if (name_len) | |
133 | info_len += name_len + 1; | |
134 | ||
d3424c9b MB |
135 | return roundup(FANOTIFY_FID_INFO_HDR_LEN + info_len, |
136 | FANOTIFY_EVENT_ALIGN); | |
d766b553 AG |
137 | } |
138 | ||
7326e382 AG |
139 | /* FAN_RENAME may have one or two dir+name info records */ |
140 | static int fanotify_dir_name_info_len(struct fanotify_event *event) | |
141 | { | |
142 | struct fanotify_info *info = fanotify_event_info(event); | |
143 | int dir_fh_len = fanotify_event_dir_fh_len(event); | |
144 | int dir2_fh_len = fanotify_event_dir2_fh_len(event); | |
145 | int info_len = 0; | |
146 | ||
147 | if (dir_fh_len) | |
148 | info_len += fanotify_fid_info_len(dir_fh_len, | |
149 | info->name_len); | |
150 | if (dir2_fh_len) | |
151 | info_len += fanotify_fid_info_len(dir2_fh_len, | |
152 | info->name2_len); | |
153 | ||
154 | return info_len; | |
155 | } | |
156 | ||
b9928e80 GKB |
157 | static size_t fanotify_event_len(unsigned int info_mode, |
158 | struct fanotify_event *event) | |
5e469c83 | 159 | { |
b9928e80 | 160 | size_t event_len = FAN_EVENT_METADATA_LEN; |
b9928e80 | 161 | int fh_len; |
929943b3 | 162 | int dot_len = 0; |
f454fa61 | 163 | |
b9928e80 GKB |
164 | if (!info_mode) |
165 | return event_len; | |
166 | ||
130a3c74 GKB |
167 | if (fanotify_is_error_event(event->mask)) |
168 | event_len += FANOTIFY_ERROR_INFO_LEN; | |
169 | ||
7326e382 AG |
170 | if (fanotify_event_has_any_dir_fh(event)) { |
171 | event_len += fanotify_dir_name_info_len(event); | |
d3424c9b MB |
172 | } else if ((info_mode & FAN_REPORT_NAME) && |
173 | (event->mask & FAN_ONDIR)) { | |
929943b3 AG |
174 | /* |
175 | * With group flag FAN_REPORT_NAME, if name was not recorded in | |
176 | * event on a directory, we will report the name ".". | |
177 | */ | |
178 | dot_len = 1; | |
179 | } | |
afc894c7 | 180 | |
af579beb | 181 | if (info_mode & FAN_REPORT_PIDFD) |
b9928e80 | 182 | event_len += FANOTIFY_PIDFD_INFO_HDR_LEN; |
af579beb | 183 | |
4bd5a5c8 GKB |
184 | if (fanotify_event_has_object_fh(event)) { |
185 | fh_len = fanotify_event_object_fh_len(event); | |
b9928e80 | 186 | event_len += fanotify_fid_info_len(fh_len, dot_len); |
4bd5a5c8 | 187 | } |
44d705b0 | 188 | |
b9928e80 | 189 | return event_len; |
5e469c83 AG |
190 | } |
191 | ||
94e00d28 AG |
192 | /* |
193 | * Remove an hashed event from merge hash table. | |
194 | */ | |
195 | static void fanotify_unhash_event(struct fsnotify_group *group, | |
196 | struct fanotify_event *event) | |
197 | { | |
198 | assert_spin_locked(&group->notification_lock); | |
199 | ||
200 | pr_debug("%s: group=%p event=%p bucket=%u\n", __func__, | |
201 | group, event, fanotify_event_hash_bucket(group, event)); | |
202 | ||
203 | if (WARN_ON_ONCE(hlist_unhashed(&event->merge_list))) | |
204 | return; | |
205 | ||
206 | hlist_del_init(&event->merge_list); | |
207 | } | |
208 | ||
a1014f10 | 209 | /* |
7088f357 | 210 | * Get an fanotify notification event if one exists and is small |
a1014f10 | 211 | * enough to fit in "count". Return an error pointer if the count |
40873284 JK |
212 | * is not large enough. When permission event is dequeued, its state is |
213 | * updated accordingly. | |
a1014f10 | 214 | */ |
7088f357 | 215 | static struct fanotify_event *get_one_event(struct fsnotify_group *group, |
a1014f10 EP |
216 | size_t count) |
217 | { | |
b9928e80 | 218 | size_t event_size; |
7088f357 | 219 | struct fanotify_event *event = NULL; |
6f73171e | 220 | struct fsnotify_event *fsn_event; |
0aca67bb | 221 | unsigned int info_mode = FAN_GROUP_FLAG(group, FANOTIFY_INFO_MODES); |
a1014f10 EP |
222 | |
223 | pr_debug("%s: group=%p count=%zd\n", __func__, group, count); | |
224 | ||
8c554466 | 225 | spin_lock(&group->notification_lock); |
6f73171e AG |
226 | fsn_event = fsnotify_peek_first_event(group); |
227 | if (!fsn_event) | |
8c554466 | 228 | goto out; |
a1014f10 | 229 | |
6f73171e | 230 | event = FANOTIFY_E(fsn_event); |
b9928e80 | 231 | event_size = fanotify_event_len(info_mode, event); |
5e469c83 | 232 | |
8c554466 | 233 | if (event_size > count) { |
7088f357 | 234 | event = ERR_PTR(-EINVAL); |
8c554466 JK |
235 | goto out; |
236 | } | |
6f73171e AG |
237 | |
238 | /* | |
239 | * Held the notification_lock the whole time, so this is the | |
240 | * same event we peeked above. | |
241 | */ | |
242 | fsnotify_remove_first_event(group); | |
7088f357 JK |
243 | if (fanotify_is_perm_event(event->mask)) |
244 | FANOTIFY_PERM(event)->state = FAN_EVENT_REPORTED; | |
94e00d28 AG |
245 | if (fanotify_is_hashed_event(event->mask)) |
246 | fanotify_unhash_event(group, event); | |
8c554466 JK |
247 | out: |
248 | spin_unlock(&group->notification_lock); | |
7088f357 | 249 | return event; |
a1014f10 EP |
250 | } |
251 | ||
a741c2fe | 252 | static int create_fd(struct fsnotify_group *group, struct path *path, |
7053aee2 | 253 | struct file **file) |
a1014f10 EP |
254 | { |
255 | int client_fd; | |
a1014f10 EP |
256 | struct file *new_file; |
257 | ||
0b37e097 | 258 | client_fd = get_unused_fd_flags(group->fanotify_data.f_flags); |
a1014f10 EP |
259 | if (client_fd < 0) |
260 | return client_fd; | |
261 | ||
a1014f10 EP |
262 | /* |
263 | * we need a new file handle for the userspace program so it can read even if it was | |
264 | * originally opened O_WRONLY. | |
265 | */ | |
a741c2fe | 266 | new_file = dentry_open(path, |
dccd8557 | 267 | group->fanotify_data.f_flags | __FMODE_NONOTIFY, |
a741c2fe | 268 | current_cred()); |
a1014f10 EP |
269 | if (IS_ERR(new_file)) { |
270 | /* | |
271 | * we still send an event even if we can't open the file. this | |
272 | * can happen when say tasks are gone and we try to open their | |
273 | * /proc files or we try to open a WRONLY file like in sysfs | |
274 | * we just send the errno to userspace since there isn't much | |
275 | * else we can do. | |
276 | */ | |
277 | put_unused_fd(client_fd); | |
278 | client_fd = PTR_ERR(new_file); | |
279 | } else { | |
352e3b24 | 280 | *file = new_file; |
a1014f10 EP |
281 | } |
282 | ||
22aa425d | 283 | return client_fd; |
a1014f10 EP |
284 | } |
285 | ||
40873284 JK |
286 | /* |
287 | * Finish processing of permission event by setting it to ANSWERED state and | |
288 | * drop group->notification_lock. | |
289 | */ | |
290 | static void finish_permission_event(struct fsnotify_group *group, | |
291 | struct fanotify_perm_event *event, | |
292 | unsigned int response) | |
293 | __releases(&group->notification_lock) | |
294 | { | |
fabf7f29 JK |
295 | bool destroy = false; |
296 | ||
40873284 JK |
297 | assert_spin_locked(&group->notification_lock); |
298 | event->response = response; | |
fabf7f29 JK |
299 | if (event->state == FAN_EVENT_CANCELED) |
300 | destroy = true; | |
301 | else | |
302 | event->state = FAN_EVENT_ANSWERED; | |
40873284 | 303 | spin_unlock(&group->notification_lock); |
fabf7f29 JK |
304 | if (destroy) |
305 | fsnotify_destroy_event(group, &event->fae.fse); | |
40873284 JK |
306 | } |
307 | ||
b2d87909 EP |
308 | static int process_access_response(struct fsnotify_group *group, |
309 | struct fanotify_response *response_struct) | |
310 | { | |
33913997 | 311 | struct fanotify_perm_event *event; |
f083441b JK |
312 | int fd = response_struct->fd; |
313 | int response = response_struct->response; | |
b2d87909 EP |
314 | |
315 | pr_debug("%s: group=%p fd=%d response=%d\n", __func__, group, | |
316 | fd, response); | |
317 | /* | |
318 | * make sure the response is valid, if invalid we do nothing and either | |
25985edc | 319 | * userspace can send a valid response or we will clean it up after the |
b2d87909 EP |
320 | * timeout |
321 | */ | |
de8cd83e | 322 | switch (response & ~FAN_AUDIT) { |
b2d87909 EP |
323 | case FAN_ALLOW: |
324 | case FAN_DENY: | |
325 | break; | |
326 | default: | |
327 | return -EINVAL; | |
328 | } | |
329 | ||
330 | if (fd < 0) | |
331 | return -EINVAL; | |
332 | ||
96a71f21 | 333 | if ((response & FAN_AUDIT) && !FAN_GROUP_FLAG(group, FAN_ENABLE_AUDIT)) |
de8cd83e SG |
334 | return -EINVAL; |
335 | ||
af6a5113 JK |
336 | spin_lock(&group->notification_lock); |
337 | list_for_each_entry(event, &group->fanotify_data.access_list, | |
338 | fae.fse.list) { | |
339 | if (event->fd != fd) | |
340 | continue; | |
b2d87909 | 341 | |
af6a5113 | 342 | list_del_init(&event->fae.fse.list); |
40873284 | 343 | finish_permission_event(group, event, response); |
af6a5113 JK |
344 | wake_up(&group->fanotify_data.access_waitq); |
345 | return 0; | |
346 | } | |
347 | spin_unlock(&group->notification_lock); | |
b2d87909 | 348 | |
af6a5113 | 349 | return -ENOENT; |
b2d87909 | 350 | } |
b2d87909 | 351 | |
130a3c74 GKB |
352 | static size_t copy_error_info_to_user(struct fanotify_event *event, |
353 | char __user *buf, int count) | |
354 | { | |
3cf984e9 | 355 | struct fanotify_event_info_error info = { }; |
130a3c74 GKB |
356 | struct fanotify_error_event *fee = FANOTIFY_EE(event); |
357 | ||
358 | info.hdr.info_type = FAN_EVENT_INFO_TYPE_ERROR; | |
130a3c74 GKB |
359 | info.hdr.len = FANOTIFY_ERROR_INFO_LEN; |
360 | ||
361 | if (WARN_ON(count < info.hdr.len)) | |
362 | return -EFAULT; | |
363 | ||
364 | info.error = fee->error; | |
365 | info.error_count = fee->err_count; | |
366 | ||
367 | if (copy_to_user(buf, &info, sizeof(info))) | |
368 | return -EFAULT; | |
369 | ||
370 | return info.hdr.len; | |
371 | } | |
372 | ||
d3424c9b MB |
373 | static int copy_fid_info_to_user(__kernel_fsid_t *fsid, struct fanotify_fh *fh, |
374 | int info_type, const char *name, | |
375 | size_t name_len, | |
376 | char __user *buf, size_t count) | |
5e469c83 AG |
377 | { |
378 | struct fanotify_event_info_fid info = { }; | |
379 | struct file_handle handle = { }; | |
afc894c7 | 380 | unsigned char bounce[FANOTIFY_INLINE_FH_LEN], *fh_buf; |
cacfb956 | 381 | size_t fh_len = fh ? fh->len : 0; |
44d705b0 AG |
382 | size_t info_len = fanotify_fid_info_len(fh_len, name_len); |
383 | size_t len = info_len; | |
5e469c83 | 384 | |
44d705b0 AG |
385 | pr_debug("%s: fh_len=%zu name_len=%zu, info_len=%zu, count=%zu\n", |
386 | __func__, fh_len, name_len, info_len, count); | |
387 | ||
44d705b0 | 388 | if (WARN_ON_ONCE(len < sizeof(info) || len > count)) |
5e469c83 AG |
389 | return -EFAULT; |
390 | ||
44d705b0 AG |
391 | /* |
392 | * Copy event info fid header followed by variable sized file handle | |
393 | * and optionally followed by variable sized filename. | |
394 | */ | |
83b7a598 AG |
395 | switch (info_type) { |
396 | case FAN_EVENT_INFO_TYPE_FID: | |
397 | case FAN_EVENT_INFO_TYPE_DFID: | |
398 | if (WARN_ON_ONCE(name_len)) | |
399 | return -EFAULT; | |
400 | break; | |
401 | case FAN_EVENT_INFO_TYPE_DFID_NAME: | |
7326e382 AG |
402 | case FAN_EVENT_INFO_TYPE_OLD_DFID_NAME: |
403 | case FAN_EVENT_INFO_TYPE_NEW_DFID_NAME: | |
83b7a598 AG |
404 | if (WARN_ON_ONCE(!name || !name_len)) |
405 | return -EFAULT; | |
406 | break; | |
407 | default: | |
408 | return -EFAULT; | |
409 | } | |
410 | ||
411 | info.hdr.info_type = info_type; | |
5e469c83 | 412 | info.hdr.len = len; |
d766b553 | 413 | info.fsid = *fsid; |
5e469c83 AG |
414 | if (copy_to_user(buf, &info, sizeof(info))) |
415 | return -EFAULT; | |
416 | ||
417 | buf += sizeof(info); | |
418 | len -= sizeof(info); | |
44d705b0 AG |
419 | if (WARN_ON_ONCE(len < sizeof(handle))) |
420 | return -EFAULT; | |
421 | ||
afc894c7 | 422 | handle.handle_type = fh->type; |
5e469c83 | 423 | handle.handle_bytes = fh_len; |
936d6a38 GKB |
424 | |
425 | /* Mangle handle_type for bad file_handle */ | |
426 | if (!fh_len) | |
427 | handle.handle_type = FILEID_INVALID; | |
428 | ||
5e469c83 AG |
429 | if (copy_to_user(buf, &handle, sizeof(handle))) |
430 | return -EFAULT; | |
431 | ||
432 | buf += sizeof(handle); | |
433 | len -= sizeof(handle); | |
44d705b0 AG |
434 | if (WARN_ON_ONCE(len < fh_len)) |
435 | return -EFAULT; | |
436 | ||
b2d22b6b | 437 | /* |
44d705b0 AG |
438 | * For an inline fh and inline file name, copy through stack to exclude |
439 | * the copy from usercopy hardening protections. | |
b2d22b6b | 440 | */ |
afc894c7 | 441 | fh_buf = fanotify_fh_buf(fh); |
b2d22b6b | 442 | if (fh_len <= FANOTIFY_INLINE_FH_LEN) { |
afc894c7 JK |
443 | memcpy(bounce, fh_buf, fh_len); |
444 | fh_buf = bounce; | |
b2d22b6b | 445 | } |
afc894c7 | 446 | if (copy_to_user(buf, fh_buf, fh_len)) |
5e469c83 AG |
447 | return -EFAULT; |
448 | ||
5e469c83 AG |
449 | buf += fh_len; |
450 | len -= fh_len; | |
44d705b0 AG |
451 | |
452 | if (name_len) { | |
453 | /* Copy the filename with terminating null */ | |
454 | name_len++; | |
455 | if (WARN_ON_ONCE(len < name_len)) | |
456 | return -EFAULT; | |
457 | ||
458 | if (copy_to_user(buf, name, name_len)) | |
459 | return -EFAULT; | |
460 | ||
461 | buf += name_len; | |
462 | len -= name_len; | |
463 | } | |
464 | ||
465 | /* Pad with 0's */ | |
5e469c83 AG |
466 | WARN_ON_ONCE(len < 0 || len >= FANOTIFY_EVENT_ALIGN); |
467 | if (len > 0 && clear_user(buf, len)) | |
468 | return -EFAULT; | |
469 | ||
44d705b0 | 470 | return info_len; |
5e469c83 AG |
471 | } |
472 | ||
af579beb MB |
473 | static int copy_pidfd_info_to_user(int pidfd, |
474 | char __user *buf, | |
475 | size_t count) | |
476 | { | |
477 | struct fanotify_event_info_pidfd info = { }; | |
478 | size_t info_len = FANOTIFY_PIDFD_INFO_HDR_LEN; | |
479 | ||
480 | if (WARN_ON_ONCE(info_len > count)) | |
481 | return -EFAULT; | |
482 | ||
483 | info.hdr.info_type = FAN_EVENT_INFO_TYPE_PIDFD; | |
484 | info.hdr.len = info_len; | |
485 | info.pidfd = pidfd; | |
486 | ||
487 | if (copy_to_user(buf, &info, info_len)) | |
488 | return -EFAULT; | |
489 | ||
490 | return info_len; | |
491 | } | |
492 | ||
0aca67bb MB |
493 | static int copy_info_records_to_user(struct fanotify_event *event, |
494 | struct fanotify_info *info, | |
af579beb | 495 | unsigned int info_mode, int pidfd, |
0aca67bb MB |
496 | char __user *buf, size_t count) |
497 | { | |
498 | int ret, total_bytes = 0, info_type = 0; | |
499 | unsigned int fid_mode = info_mode & FANOTIFY_FID_BITS; | |
af579beb | 500 | unsigned int pidfd_mode = info_mode & FAN_REPORT_PIDFD; |
0aca67bb MB |
501 | |
502 | /* | |
7326e382 AG |
503 | * Event info records order is as follows: |
504 | * 1. dir fid + name | |
505 | * 2. (optional) new dir fid + new name | |
506 | * 3. (optional) child fid | |
0aca67bb | 507 | */ |
4bd5a5c8 | 508 | if (fanotify_event_has_dir_fh(event)) { |
0aca67bb MB |
509 | info_type = info->name_len ? FAN_EVENT_INFO_TYPE_DFID_NAME : |
510 | FAN_EVENT_INFO_TYPE_DFID; | |
7326e382 AG |
511 | |
512 | /* FAN_RENAME uses special info types */ | |
513 | if (event->mask & FAN_RENAME) | |
514 | info_type = FAN_EVENT_INFO_TYPE_OLD_DFID_NAME; | |
515 | ||
0aca67bb MB |
516 | ret = copy_fid_info_to_user(fanotify_event_fsid(event), |
517 | fanotify_info_dir_fh(info), | |
518 | info_type, | |
519 | fanotify_info_name(info), | |
520 | info->name_len, buf, count); | |
521 | if (ret < 0) | |
522 | return ret; | |
523 | ||
524 | buf += ret; | |
525 | count -= ret; | |
526 | total_bytes += ret; | |
527 | } | |
528 | ||
7326e382 AG |
529 | /* New dir fid+name may be reported in addition to old dir fid+name */ |
530 | if (fanotify_event_has_dir2_fh(event)) { | |
531 | info_type = FAN_EVENT_INFO_TYPE_NEW_DFID_NAME; | |
532 | ret = copy_fid_info_to_user(fanotify_event_fsid(event), | |
533 | fanotify_info_dir2_fh(info), | |
534 | info_type, | |
535 | fanotify_info_name2(info), | |
536 | info->name2_len, buf, count); | |
537 | if (ret < 0) | |
538 | return ret; | |
539 | ||
540 | buf += ret; | |
541 | count -= ret; | |
542 | total_bytes += ret; | |
543 | } | |
544 | ||
4bd5a5c8 | 545 | if (fanotify_event_has_object_fh(event)) { |
0aca67bb MB |
546 | const char *dot = NULL; |
547 | int dot_len = 0; | |
548 | ||
549 | if (fid_mode == FAN_REPORT_FID || info_type) { | |
550 | /* | |
551 | * With only group flag FAN_REPORT_FID only type FID is | |
552 | * reported. Second info record type is always FID. | |
553 | */ | |
554 | info_type = FAN_EVENT_INFO_TYPE_FID; | |
555 | } else if ((fid_mode & FAN_REPORT_NAME) && | |
556 | (event->mask & FAN_ONDIR)) { | |
557 | /* | |
558 | * With group flag FAN_REPORT_NAME, if name was not | |
559 | * recorded in an event on a directory, report the name | |
560 | * "." with info type DFID_NAME. | |
561 | */ | |
562 | info_type = FAN_EVENT_INFO_TYPE_DFID_NAME; | |
563 | dot = "."; | |
564 | dot_len = 1; | |
565 | } else if ((event->mask & ALL_FSNOTIFY_DIRENT_EVENTS) || | |
566 | (event->mask & FAN_ONDIR)) { | |
567 | /* | |
568 | * With group flag FAN_REPORT_DIR_FID, a single info | |
569 | * record has type DFID for directory entry modification | |
570 | * event and for event on a directory. | |
571 | */ | |
572 | info_type = FAN_EVENT_INFO_TYPE_DFID; | |
573 | } else { | |
574 | /* | |
575 | * With group flags FAN_REPORT_DIR_FID|FAN_REPORT_FID, | |
576 | * a single info record has type FID for event on a | |
577 | * non-directory, when there is no directory to report. | |
578 | * For example, on FAN_DELETE_SELF event. | |
579 | */ | |
580 | info_type = FAN_EVENT_INFO_TYPE_FID; | |
581 | } | |
582 | ||
583 | ret = copy_fid_info_to_user(fanotify_event_fsid(event), | |
584 | fanotify_event_object_fh(event), | |
585 | info_type, dot, dot_len, | |
586 | buf, count); | |
587 | if (ret < 0) | |
588 | return ret; | |
589 | ||
590 | buf += ret; | |
591 | count -= ret; | |
592 | total_bytes += ret; | |
593 | } | |
594 | ||
af579beb MB |
595 | if (pidfd_mode) { |
596 | ret = copy_pidfd_info_to_user(pidfd, buf, count); | |
597 | if (ret < 0) | |
598 | return ret; | |
599 | ||
600 | buf += ret; | |
601 | count -= ret; | |
602 | total_bytes += ret; | |
603 | } | |
604 | ||
130a3c74 GKB |
605 | if (fanotify_is_error_event(event->mask)) { |
606 | ret = copy_error_info_to_user(event, buf, count); | |
607 | if (ret < 0) | |
608 | return ret; | |
609 | buf += ret; | |
610 | count -= ret; | |
611 | total_bytes += ret; | |
612 | } | |
613 | ||
0aca67bb MB |
614 | return total_bytes; |
615 | } | |
616 | ||
a1014f10 | 617 | static ssize_t copy_event_to_user(struct fsnotify_group *group, |
7088f357 | 618 | struct fanotify_event *event, |
5b03a472 | 619 | char __user *buf, size_t count) |
a1014f10 | 620 | { |
bb2f7b45 | 621 | struct fanotify_event_metadata metadata; |
7088f357 | 622 | struct path *path = fanotify_event_path(event); |
f454fa61 | 623 | struct fanotify_info *info = fanotify_event_info(event); |
0aca67bb | 624 | unsigned int info_mode = FAN_GROUP_FLAG(group, FANOTIFY_INFO_MODES); |
af579beb | 625 | unsigned int pidfd_mode = info_mode & FAN_REPORT_PIDFD; |
bb2f7b45 | 626 | struct file *f = NULL; |
af579beb | 627 | int ret, pidfd = FAN_NOPIDFD, fd = FAN_NOFD; |
a1014f10 | 628 | |
7088f357 | 629 | pr_debug("%s: group=%p event=%p\n", __func__, group, event); |
a1014f10 | 630 | |
b9928e80 | 631 | metadata.event_len = fanotify_event_len(info_mode, event); |
bb2f7b45 AG |
632 | metadata.metadata_len = FAN_EVENT_METADATA_LEN; |
633 | metadata.vers = FANOTIFY_METADATA_VERSION; | |
634 | metadata.reserved = 0; | |
635 | metadata.mask = event->mask & FANOTIFY_OUTGOING_EVENTS; | |
636 | metadata.pid = pid_vnr(event->pid); | |
7cea2a3c AG |
637 | /* |
638 | * For an unprivileged listener, event->pid can be used to identify the | |
639 | * events generated by the listener process itself, without disclosing | |
640 | * the pids of other processes. | |
641 | */ | |
a8b98c80 | 642 | if (FAN_GROUP_FLAG(group, FANOTIFY_UNPRIV) && |
7cea2a3c AG |
643 | task_tgid(current) != event->pid) |
644 | metadata.pid = 0; | |
bb2f7b45 | 645 | |
a8b98c80 AG |
646 | /* |
647 | * For now, fid mode is required for an unprivileged listener and | |
648 | * fid mode does not report fd in events. Keep this check anyway | |
649 | * for safety in case fid mode requirement is relaxed in the future | |
650 | * to allow unprivileged listener to get events with no fd and no fid. | |
651 | */ | |
652 | if (!FAN_GROUP_FLAG(group, FANOTIFY_UNPRIV) && | |
653 | path && path->mnt && path->dentry) { | |
afc894c7 JK |
654 | fd = create_fd(group, path, &f); |
655 | if (fd < 0) | |
656 | return fd; | |
bb2f7b45 AG |
657 | } |
658 | metadata.fd = fd; | |
b2d87909 | 659 | |
af579beb MB |
660 | if (pidfd_mode) { |
661 | /* | |
662 | * Complain if the FAN_REPORT_PIDFD and FAN_REPORT_TID mutual | |
663 | * exclusion is ever lifted. At the time of incoporating pidfd | |
664 | * support within fanotify, the pidfd API only supported the | |
665 | * creation of pidfds for thread-group leaders. | |
666 | */ | |
667 | WARN_ON_ONCE(FAN_GROUP_FLAG(group, FAN_REPORT_TID)); | |
668 | ||
669 | /* | |
670 | * The PIDTYPE_TGID check for an event->pid is performed | |
671 | * preemptively in an attempt to catch out cases where the event | |
672 | * listener reads events after the event generating process has | |
673 | * already terminated. Report FAN_NOPIDFD to the event listener | |
674 | * in those cases, with all other pidfd creation errors being | |
675 | * reported as FAN_EPIDFD. | |
676 | */ | |
677 | if (metadata.pid == 0 || | |
678 | !pid_has_task(event->pid, PIDTYPE_TGID)) { | |
679 | pidfd = FAN_NOPIDFD; | |
680 | } else { | |
681 | pidfd = pidfd_create(event->pid, 0); | |
682 | if (pidfd < 0) | |
683 | pidfd = FAN_EPIDFD; | |
684 | } | |
685 | } | |
686 | ||
b2d87909 | 687 | ret = -EFAULT; |
5b03a472 KC |
688 | /* |
689 | * Sanity check copy size in case get_one_event() and | |
c5e443cb | 690 | * event_len sizes ever get out of sync. |
5b03a472 | 691 | */ |
bb2f7b45 | 692 | if (WARN_ON_ONCE(metadata.event_len > count)) |
5b03a472 | 693 | goto out_close_fd; |
bb2f7b45 | 694 | |
5e469c83 | 695 | if (copy_to_user(buf, &metadata, FAN_EVENT_METADATA_LEN)) |
352e3b24 AV |
696 | goto out_close_fd; |
697 | ||
44d705b0 AG |
698 | buf += FAN_EVENT_METADATA_LEN; |
699 | count -= FAN_EVENT_METADATA_LEN; | |
700 | ||
bb2f7b45 | 701 | if (fanotify_is_perm_event(event->mask)) |
7088f357 | 702 | FANOTIFY_PERM(event)->fd = fd; |
a1014f10 | 703 | |
0aca67bb | 704 | if (info_mode) { |
af579beb | 705 | ret = copy_info_records_to_user(event, info, info_mode, pidfd, |
0aca67bb | 706 | buf, count); |
5e469c83 | 707 | if (ret < 0) |
f644bc44 | 708 | goto out_close_fd; |
5e469c83 AG |
709 | } |
710 | ||
ee125951 DC |
711 | if (f) |
712 | fd_install(fd, f); | |
713 | ||
bb2f7b45 | 714 | return metadata.event_len; |
b2d87909 | 715 | |
b2d87909 | 716 | out_close_fd: |
352e3b24 AV |
717 | if (fd != FAN_NOFD) { |
718 | put_unused_fd(fd); | |
719 | fput(f); | |
720 | } | |
af579beb MB |
721 | |
722 | if (pidfd >= 0) | |
723 | close_fd(pidfd); | |
724 | ||
b2d87909 | 725 | return ret; |
a1014f10 EP |
726 | } |
727 | ||
728 | /* intofiy userspace file descriptor functions */ | |
076ccb76 | 729 | static __poll_t fanotify_poll(struct file *file, poll_table *wait) |
a1014f10 EP |
730 | { |
731 | struct fsnotify_group *group = file->private_data; | |
076ccb76 | 732 | __poll_t ret = 0; |
a1014f10 EP |
733 | |
734 | poll_wait(file, &group->notification_waitq, wait); | |
c21dbe20 | 735 | spin_lock(&group->notification_lock); |
a1014f10 | 736 | if (!fsnotify_notify_queue_is_empty(group)) |
a9a08845 | 737 | ret = EPOLLIN | EPOLLRDNORM; |
c21dbe20 | 738 | spin_unlock(&group->notification_lock); |
a1014f10 EP |
739 | |
740 | return ret; | |
741 | } | |
742 | ||
743 | static ssize_t fanotify_read(struct file *file, char __user *buf, | |
744 | size_t count, loff_t *pos) | |
745 | { | |
746 | struct fsnotify_group *group; | |
7088f357 | 747 | struct fanotify_event *event; |
a1014f10 EP |
748 | char __user *start; |
749 | int ret; | |
536ebe9c | 750 | DEFINE_WAIT_FUNC(wait, woken_wake_function); |
a1014f10 EP |
751 | |
752 | start = buf; | |
753 | group = file->private_data; | |
754 | ||
755 | pr_debug("%s: group=%p\n", __func__, group); | |
756 | ||
536ebe9c | 757 | add_wait_queue(&group->notification_waitq, &wait); |
a1014f10 | 758 | while (1) { |
47aaabde JK |
759 | /* |
760 | * User can supply arbitrarily large buffer. Avoid softlockups | |
761 | * in case there are lots of available events. | |
762 | */ | |
763 | cond_resched(); | |
7088f357 JK |
764 | event = get_one_event(group, count); |
765 | if (IS_ERR(event)) { | |
766 | ret = PTR_ERR(event); | |
d8aaab4f JK |
767 | break; |
768 | } | |
769 | ||
7088f357 | 770 | if (!event) { |
d8aaab4f JK |
771 | ret = -EAGAIN; |
772 | if (file->f_flags & O_NONBLOCK) | |
a1014f10 | 773 | break; |
d8aaab4f JK |
774 | |
775 | ret = -ERESTARTSYS; | |
776 | if (signal_pending(current)) | |
777 | break; | |
778 | ||
779 | if (start != buf) | |
a1014f10 | 780 | break; |
536ebe9c PZ |
781 | |
782 | wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT); | |
a1014f10 EP |
783 | continue; |
784 | } | |
785 | ||
7088f357 | 786 | ret = copy_event_to_user(group, event, buf, count); |
4ff33aaf AG |
787 | if (unlikely(ret == -EOPENSTALE)) { |
788 | /* | |
789 | * We cannot report events with stale fd so drop it. | |
790 | * Setting ret to 0 will continue the event loop and | |
791 | * do the right thing if there are no more events to | |
792 | * read (i.e. return bytes read, -EAGAIN or wait). | |
793 | */ | |
794 | ret = 0; | |
795 | } | |
796 | ||
d8aaab4f JK |
797 | /* |
798 | * Permission events get queued to wait for response. Other | |
799 | * events can be destroyed now. | |
800 | */ | |
7088f357 JK |
801 | if (!fanotify_is_perm_event(event->mask)) { |
802 | fsnotify_destroy_event(group, &event->fse); | |
d507816b | 803 | } else { |
4ff33aaf | 804 | if (ret <= 0) { |
40873284 JK |
805 | spin_lock(&group->notification_lock); |
806 | finish_permission_event(group, | |
7088f357 | 807 | FANOTIFY_PERM(event), FAN_DENY); |
d507816b | 808 | wake_up(&group->fanotify_data.access_waitq); |
4ff33aaf AG |
809 | } else { |
810 | spin_lock(&group->notification_lock); | |
7088f357 | 811 | list_add_tail(&event->fse.list, |
4ff33aaf AG |
812 | &group->fanotify_data.access_list); |
813 | spin_unlock(&group->notification_lock); | |
d507816b | 814 | } |
d507816b | 815 | } |
4ff33aaf AG |
816 | if (ret < 0) |
817 | break; | |
d8aaab4f JK |
818 | buf += ret; |
819 | count -= ret; | |
a1014f10 | 820 | } |
536ebe9c | 821 | remove_wait_queue(&group->notification_waitq, &wait); |
a1014f10 | 822 | |
a1014f10 EP |
823 | if (start != buf && ret != -EFAULT) |
824 | ret = buf - start; | |
825 | return ret; | |
826 | } | |
827 | ||
b2d87909 EP |
828 | static ssize_t fanotify_write(struct file *file, const char __user *buf, size_t count, loff_t *pos) |
829 | { | |
b2d87909 EP |
830 | struct fanotify_response response = { .fd = -1, .response = -1 }; |
831 | struct fsnotify_group *group; | |
832 | int ret; | |
833 | ||
6685df31 MS |
834 | if (!IS_ENABLED(CONFIG_FANOTIFY_ACCESS_PERMISSIONS)) |
835 | return -EINVAL; | |
836 | ||
b2d87909 EP |
837 | group = file->private_data; |
838 | ||
5e23663b FF |
839 | if (count < sizeof(response)) |
840 | return -EINVAL; | |
841 | ||
842 | count = sizeof(response); | |
b2d87909 EP |
843 | |
844 | pr_debug("%s: group=%p count=%zu\n", __func__, group, count); | |
845 | ||
846 | if (copy_from_user(&response, buf, count)) | |
847 | return -EFAULT; | |
848 | ||
849 | ret = process_access_response(group, &response); | |
850 | if (ret < 0) | |
851 | count = ret; | |
852 | ||
853 | return count; | |
b2d87909 EP |
854 | } |
855 | ||
52c923dd EP |
856 | static int fanotify_release(struct inode *ignored, struct file *file) |
857 | { | |
858 | struct fsnotify_group *group = file->private_data; | |
6f73171e | 859 | struct fsnotify_event *fsn_event; |
19ba54f4 | 860 | |
5838d444 | 861 | /* |
96d41019 JK |
862 | * Stop new events from arriving in the notification queue. since |
863 | * userspace cannot use fanotify fd anymore, no event can enter or | |
864 | * leave access_list by now either. | |
5838d444 | 865 | */ |
96d41019 | 866 | fsnotify_group_stop_queueing(group); |
2eebf582 | 867 | |
96d41019 JK |
868 | /* |
869 | * Process all permission events on access_list and notification queue | |
870 | * and simulate reply from userspace. | |
871 | */ | |
073f6552 | 872 | spin_lock(&group->notification_lock); |
ca6f8699 | 873 | while (!list_empty(&group->fanotify_data.access_list)) { |
7088f357 JK |
874 | struct fanotify_perm_event *event; |
875 | ||
ca6f8699 JK |
876 | event = list_first_entry(&group->fanotify_data.access_list, |
877 | struct fanotify_perm_event, fae.fse.list); | |
f083441b | 878 | list_del_init(&event->fae.fse.list); |
40873284 JK |
879 | finish_permission_event(group, event, FAN_ALLOW); |
880 | spin_lock(&group->notification_lock); | |
2eebf582 | 881 | } |
2eebf582 | 882 | |
5838d444 | 883 | /* |
96d41019 JK |
884 | * Destroy all non-permission events. For permission events just |
885 | * dequeue them and set the response. They will be freed once the | |
886 | * response is consumed and fanotify_get_response() returns. | |
5838d444 | 887 | */ |
6f73171e AG |
888 | while ((fsn_event = fsnotify_remove_first_event(group))) { |
889 | struct fanotify_event *event = FANOTIFY_E(fsn_event); | |
7088f357 | 890 | |
7088f357 | 891 | if (!(event->mask & FANOTIFY_PERM_EVENTS)) { |
c21dbe20 | 892 | spin_unlock(&group->notification_lock); |
6f73171e | 893 | fsnotify_destroy_event(group, fsn_event); |
6685df31 | 894 | } else { |
7088f357 | 895 | finish_permission_event(group, FANOTIFY_PERM(event), |
40873284 | 896 | FAN_ALLOW); |
6685df31 | 897 | } |
40873284 | 898 | spin_lock(&group->notification_lock); |
96d41019 | 899 | } |
c21dbe20 | 900 | spin_unlock(&group->notification_lock); |
96d41019 JK |
901 | |
902 | /* Response for all permission events it set, wakeup waiters */ | |
2eebf582 | 903 | wake_up(&group->fanotify_data.access_waitq); |
0a6b6bd5 | 904 | |
52c923dd | 905 | /* matches the fanotify_init->fsnotify_alloc_group */ |
d8153d4d | 906 | fsnotify_destroy_group(group); |
52c923dd EP |
907 | |
908 | return 0; | |
909 | } | |
910 | ||
a1014f10 EP |
911 | static long fanotify_ioctl(struct file *file, unsigned int cmd, unsigned long arg) |
912 | { | |
913 | struct fsnotify_group *group; | |
7053aee2 | 914 | struct fsnotify_event *fsn_event; |
a1014f10 EP |
915 | void __user *p; |
916 | int ret = -ENOTTY; | |
917 | size_t send_len = 0; | |
918 | ||
919 | group = file->private_data; | |
920 | ||
921 | p = (void __user *) arg; | |
922 | ||
923 | switch (cmd) { | |
924 | case FIONREAD: | |
c21dbe20 | 925 | spin_lock(&group->notification_lock); |
7053aee2 | 926 | list_for_each_entry(fsn_event, &group->notification_list, list) |
a1014f10 | 927 | send_len += FAN_EVENT_METADATA_LEN; |
c21dbe20 | 928 | spin_unlock(&group->notification_lock); |
a1014f10 EP |
929 | ret = put_user(send_len, (int __user *) p); |
930 | break; | |
931 | } | |
932 | ||
933 | return ret; | |
934 | } | |
935 | ||
52c923dd | 936 | static const struct file_operations fanotify_fops = { |
be77196b | 937 | .show_fdinfo = fanotify_show_fdinfo, |
a1014f10 EP |
938 | .poll = fanotify_poll, |
939 | .read = fanotify_read, | |
b2d87909 | 940 | .write = fanotify_write, |
52c923dd EP |
941 | .fasync = NULL, |
942 | .release = fanotify_release, | |
a1014f10 | 943 | .unlocked_ioctl = fanotify_ioctl, |
1832f2d8 | 944 | .compat_ioctl = compat_ptr_ioctl, |
6038f373 | 945 | .llseek = noop_llseek, |
52c923dd EP |
946 | }; |
947 | ||
2a3edf86 | 948 | static int fanotify_find_path(int dfd, const char __user *filename, |
ac5656d8 AG |
949 | struct path *path, unsigned int flags, __u64 mask, |
950 | unsigned int obj_type) | |
2a3edf86 EP |
951 | { |
952 | int ret; | |
953 | ||
954 | pr_debug("%s: dfd=%d filename=%p flags=%x\n", __func__, | |
955 | dfd, filename, flags); | |
956 | ||
957 | if (filename == NULL) { | |
2903ff01 | 958 | struct fd f = fdget(dfd); |
2a3edf86 EP |
959 | |
960 | ret = -EBADF; | |
2903ff01 | 961 | if (!f.file) |
2a3edf86 EP |
962 | goto out; |
963 | ||
964 | ret = -ENOTDIR; | |
965 | if ((flags & FAN_MARK_ONLYDIR) && | |
496ad9aa | 966 | !(S_ISDIR(file_inode(f.file)->i_mode))) { |
2903ff01 | 967 | fdput(f); |
2a3edf86 EP |
968 | goto out; |
969 | } | |
970 | ||
2903ff01 | 971 | *path = f.file->f_path; |
2a3edf86 | 972 | path_get(path); |
2903ff01 | 973 | fdput(f); |
2a3edf86 EP |
974 | } else { |
975 | unsigned int lookup_flags = 0; | |
976 | ||
977 | if (!(flags & FAN_MARK_DONT_FOLLOW)) | |
978 | lookup_flags |= LOOKUP_FOLLOW; | |
979 | if (flags & FAN_MARK_ONLYDIR) | |
980 | lookup_flags |= LOOKUP_DIRECTORY; | |
981 | ||
982 | ret = user_path_at(dfd, filename, lookup_flags, path); | |
983 | if (ret) | |
984 | goto out; | |
985 | } | |
986 | ||
987 | /* you can only watch an inode if you have read permissions on it */ | |
02f92b38 | 988 | ret = path_permission(path, MAY_READ); |
ac5656d8 AG |
989 | if (ret) { |
990 | path_put(path); | |
991 | goto out; | |
992 | } | |
993 | ||
994 | ret = security_path_notify(path, mask, obj_type); | |
2a3edf86 EP |
995 | if (ret) |
996 | path_put(path); | |
ac5656d8 | 997 | |
2a3edf86 EP |
998 | out: |
999 | return ret; | |
1000 | } | |
1001 | ||
b9e4e3bd | 1002 | static __u32 fanotify_mark_remove_from_mask(struct fsnotify_mark *fsn_mark, |
4ed6814a AG |
1003 | __u32 mask, unsigned int flags, |
1004 | __u32 umask, int *destroy) | |
088b09b0 | 1005 | { |
4f0b903d | 1006 | __u32 oldmask, newmask; |
088b09b0 | 1007 | |
4ed6814a AG |
1008 | /* umask bits cannot be removed by user */ |
1009 | mask &= ~umask; | |
088b09b0 | 1010 | spin_lock(&fsn_mark->lock); |
4f0b903d | 1011 | oldmask = fsnotify_calc_mask(fsn_mark); |
b9e4e3bd | 1012 | if (!(flags & FAN_MARK_IGNORED_MASK)) { |
a72fd224 | 1013 | fsn_mark->mask &= ~mask; |
b9e4e3bd | 1014 | } else { |
a72fd224 | 1015 | fsn_mark->ignored_mask &= ~mask; |
b9e4e3bd | 1016 | } |
4f0b903d | 1017 | newmask = fsnotify_calc_mask(fsn_mark); |
4ed6814a AG |
1018 | /* |
1019 | * We need to keep the mark around even if remaining mask cannot | |
1020 | * result in any events (e.g. mask == FAN_ONDIR) to support incremenal | |
1021 | * changes to the mask. | |
1022 | * Destroy mark when only umask bits remain. | |
1023 | */ | |
1024 | *destroy = !((fsn_mark->mask | fsn_mark->ignored_mask) & ~umask); | |
088b09b0 AG |
1025 | spin_unlock(&fsn_mark->lock); |
1026 | ||
4f0b903d | 1027 | return oldmask & ~newmask; |
088b09b0 AG |
1028 | } |
1029 | ||
eaa2c6b0 AG |
1030 | static int fanotify_remove_mark(struct fsnotify_group *group, |
1031 | fsnotify_connp_t *connp, __u32 mask, | |
4ed6814a | 1032 | unsigned int flags, __u32 umask) |
88826276 EP |
1033 | { |
1034 | struct fsnotify_mark *fsn_mark = NULL; | |
088b09b0 | 1035 | __u32 removed; |
6dfbd149 | 1036 | int destroy_mark; |
88826276 | 1037 | |
e79719a2 | 1038 | fsnotify_group_lock(group); |
eaa2c6b0 | 1039 | fsn_mark = fsnotify_find_mark(connp, group); |
7b18527c | 1040 | if (!fsn_mark) { |
e79719a2 | 1041 | fsnotify_group_unlock(group); |
f3640192 | 1042 | return -ENOENT; |
7b18527c | 1043 | } |
88826276 | 1044 | |
6dfbd149 | 1045 | removed = fanotify_mark_remove_from_mask(fsn_mark, mask, flags, |
4ed6814a | 1046 | umask, &destroy_mark); |
3ac70bfc AG |
1047 | if (removed & fsnotify_conn_mask(fsn_mark->connector)) |
1048 | fsnotify_recalc_mask(fsn_mark->connector); | |
6dfbd149 | 1049 | if (destroy_mark) |
4712e722 | 1050 | fsnotify_detach_mark(fsn_mark); |
e79719a2 | 1051 | fsnotify_group_unlock(group); |
4712e722 JK |
1052 | if (destroy_mark) |
1053 | fsnotify_free_mark(fsn_mark); | |
6dfbd149 | 1054 | |
eaa2c6b0 | 1055 | /* matches the fsnotify_find_mark() */ |
f3640192 | 1056 | fsnotify_put_mark(fsn_mark); |
f3640192 AG |
1057 | return 0; |
1058 | } | |
2a3edf86 | 1059 | |
eaa2c6b0 AG |
1060 | static int fanotify_remove_vfsmount_mark(struct fsnotify_group *group, |
1061 | struct vfsmount *mnt, __u32 mask, | |
4ed6814a | 1062 | unsigned int flags, __u32 umask) |
eaa2c6b0 AG |
1063 | { |
1064 | return fanotify_remove_mark(group, &real_mount(mnt)->mnt_fsnotify_marks, | |
4ed6814a | 1065 | mask, flags, umask); |
eaa2c6b0 AG |
1066 | } |
1067 | ||
d54f4fba | 1068 | static int fanotify_remove_sb_mark(struct fsnotify_group *group, |
4ed6814a AG |
1069 | struct super_block *sb, __u32 mask, |
1070 | unsigned int flags, __u32 umask) | |
d54f4fba | 1071 | { |
4ed6814a AG |
1072 | return fanotify_remove_mark(group, &sb->s_fsnotify_marks, mask, |
1073 | flags, umask); | |
d54f4fba AG |
1074 | } |
1075 | ||
f3640192 | 1076 | static int fanotify_remove_inode_mark(struct fsnotify_group *group, |
b9e4e3bd | 1077 | struct inode *inode, __u32 mask, |
4ed6814a | 1078 | unsigned int flags, __u32 umask) |
f3640192 | 1079 | { |
eaa2c6b0 | 1080 | return fanotify_remove_mark(group, &inode->i_fsnotify_marks, mask, |
4ed6814a | 1081 | flags, umask); |
2a3edf86 EP |
1082 | } |
1083 | ||
8998d110 AG |
1084 | static bool fanotify_mark_update_flags(struct fsnotify_mark *fsn_mark, |
1085 | unsigned int fan_flags) | |
04e317ba | 1086 | { |
7d5e005d | 1087 | bool want_iref = !(fan_flags & FAN_MARK_EVICTABLE); |
8998d110 | 1088 | bool recalc = false; |
04e317ba AG |
1089 | |
1090 | /* | |
1091 | * Setting FAN_MARK_IGNORED_SURV_MODIFY for the first time may lead to | |
1092 | * the removal of the FS_MODIFY bit in calculated mask if it was set | |
1093 | * because of an ignored mask that is now going to survive FS_MODIFY. | |
1094 | */ | |
8998d110 AG |
1095 | if ((fan_flags & FAN_MARK_IGNORED_MASK) && |
1096 | (fan_flags & FAN_MARK_IGNORED_SURV_MODIFY) && | |
04e317ba AG |
1097 | !(fsn_mark->flags & FSNOTIFY_MARK_FLAG_IGNORED_SURV_MODIFY)) { |
1098 | fsn_mark->flags |= FSNOTIFY_MARK_FLAG_IGNORED_SURV_MODIFY; | |
1099 | if (!(fsn_mark->mask & FS_MODIFY)) | |
8998d110 | 1100 | recalc = true; |
04e317ba | 1101 | } |
8998d110 | 1102 | |
7d5e005d AG |
1103 | if (fsn_mark->connector->type != FSNOTIFY_OBJ_TYPE_INODE || |
1104 | want_iref == !(fsn_mark->flags & FSNOTIFY_MARK_FLAG_NO_IREF)) | |
1105 | return recalc; | |
1106 | ||
1107 | /* | |
1108 | * NO_IREF may be removed from a mark, but not added. | |
1109 | * When removed, fsnotify_recalc_mask() will take the inode ref. | |
1110 | */ | |
1111 | WARN_ON_ONCE(!want_iref); | |
1112 | fsn_mark->flags &= ~FSNOTIFY_MARK_FLAG_NO_IREF; | |
1113 | ||
1114 | return true; | |
04e317ba AG |
1115 | } |
1116 | ||
8998d110 AG |
1117 | static bool fanotify_mark_add_to_mask(struct fsnotify_mark *fsn_mark, |
1118 | __u32 mask, unsigned int fan_flags) | |
912ee394 | 1119 | { |
8998d110 | 1120 | bool recalc; |
912ee394 AG |
1121 | |
1122 | spin_lock(&fsn_mark->lock); | |
8998d110 | 1123 | if (!(fan_flags & FAN_MARK_IGNORED_MASK)) |
a72fd224 | 1124 | fsn_mark->mask |= mask; |
8998d110 AG |
1125 | else |
1126 | fsn_mark->ignored_mask |= mask; | |
1127 | ||
1128 | recalc = fsnotify_calc_mask(fsn_mark) & | |
1129 | ~fsnotify_conn_mask(fsn_mark->connector); | |
1130 | ||
1131 | recalc |= fanotify_mark_update_flags(fsn_mark, fan_flags); | |
912ee394 AG |
1132 | spin_unlock(&fsn_mark->lock); |
1133 | ||
8998d110 | 1134 | return recalc; |
912ee394 AG |
1135 | } |
1136 | ||
5e9c070c | 1137 | static struct fsnotify_mark *fanotify_add_new_mark(struct fsnotify_group *group, |
b812a9f5 | 1138 | fsnotify_connp_t *connp, |
ad69cd99 | 1139 | unsigned int obj_type, |
7d5e005d | 1140 | unsigned int fan_flags, |
77115225 | 1141 | __kernel_fsid_t *fsid) |
5e9c070c | 1142 | { |
5b8fea65 | 1143 | struct ucounts *ucounts = group->fanotify_data.ucounts; |
5e9c070c LS |
1144 | struct fsnotify_mark *mark; |
1145 | int ret; | |
1146 | ||
5b8fea65 AG |
1147 | /* |
1148 | * Enforce per user marks limits per user in all containing user ns. | |
1149 | * A group with FAN_UNLIMITED_MARKS does not contribute to mark count | |
1150 | * in the limited groups account. | |
1151 | */ | |
1152 | if (!FAN_GROUP_FLAG(group, FAN_UNLIMITED_MARKS) && | |
1153 | !inc_ucount(ucounts->ns, ucounts->uid, UCOUNT_FANOTIFY_MARKS)) | |
5e9c070c LS |
1154 | return ERR_PTR(-ENOSPC); |
1155 | ||
1156 | mark = kmem_cache_alloc(fanotify_mark_cache, GFP_KERNEL); | |
5b8fea65 AG |
1157 | if (!mark) { |
1158 | ret = -ENOMEM; | |
1159 | goto out_dec_ucounts; | |
1160 | } | |
5e9c070c | 1161 | |
054c636e | 1162 | fsnotify_init_mark(mark, group); |
7d5e005d AG |
1163 | if (fan_flags & FAN_MARK_EVICTABLE) |
1164 | mark->flags |= FSNOTIFY_MARK_FLAG_NO_IREF; | |
1165 | ||
ad69cd99 | 1166 | ret = fsnotify_add_mark_locked(mark, connp, obj_type, 0, fsid); |
5e9c070c LS |
1167 | if (ret) { |
1168 | fsnotify_put_mark(mark); | |
5b8fea65 | 1169 | goto out_dec_ucounts; |
5e9c070c LS |
1170 | } |
1171 | ||
1172 | return mark; | |
5b8fea65 AG |
1173 | |
1174 | out_dec_ucounts: | |
1175 | if (!FAN_GROUP_FLAG(group, FAN_UNLIMITED_MARKS)) | |
1176 | dec_ucount(ucounts, UCOUNT_FANOTIFY_MARKS); | |
1177 | return ERR_PTR(ret); | |
5e9c070c LS |
1178 | } |
1179 | ||
734a1a5e GKB |
1180 | static int fanotify_group_init_error_pool(struct fsnotify_group *group) |
1181 | { | |
1182 | if (mempool_initialized(&group->fanotify_data.error_events_pool)) | |
1183 | return 0; | |
1184 | ||
1185 | return mempool_init_kmalloc_pool(&group->fanotify_data.error_events_pool, | |
1186 | FANOTIFY_DEFAULT_FEE_POOL_SIZE, | |
1187 | sizeof(struct fanotify_error_event)); | |
1188 | } | |
5e9c070c | 1189 | |
eaa2c6b0 | 1190 | static int fanotify_add_mark(struct fsnotify_group *group, |
ad69cd99 | 1191 | fsnotify_connp_t *connp, unsigned int obj_type, |
8998d110 | 1192 | __u32 mask, unsigned int fan_flags, |
77115225 | 1193 | __kernel_fsid_t *fsid) |
2a3edf86 EP |
1194 | { |
1195 | struct fsnotify_mark *fsn_mark; | |
8998d110 | 1196 | bool recalc; |
734a1a5e | 1197 | int ret = 0; |
2a3edf86 | 1198 | |
e79719a2 | 1199 | fsnotify_group_lock(group); |
b812a9f5 | 1200 | fsn_mark = fsnotify_find_mark(connp, group); |
88826276 | 1201 | if (!fsn_mark) { |
7d5e005d AG |
1202 | fsn_mark = fanotify_add_new_mark(group, connp, obj_type, |
1203 | fan_flags, fsid); | |
5e9c070c | 1204 | if (IS_ERR(fsn_mark)) { |
e79719a2 | 1205 | fsnotify_group_unlock(group); |
5e9c070c | 1206 | return PTR_ERR(fsn_mark); |
7b18527c | 1207 | } |
88826276 | 1208 | } |
734a1a5e | 1209 | |
7d5e005d AG |
1210 | /* |
1211 | * Non evictable mark cannot be downgraded to evictable mark. | |
1212 | */ | |
1213 | if (fan_flags & FAN_MARK_EVICTABLE && | |
1214 | !(fsn_mark->flags & FSNOTIFY_MARK_FLAG_NO_IREF)) { | |
1215 | ret = -EEXIST; | |
1216 | goto out; | |
1217 | } | |
1218 | ||
734a1a5e GKB |
1219 | /* |
1220 | * Error events are pre-allocated per group, only if strictly | |
1221 | * needed (i.e. FAN_FS_ERROR was requested). | |
1222 | */ | |
8998d110 | 1223 | if (!(fan_flags & FAN_MARK_IGNORED_MASK) && (mask & FAN_FS_ERROR)) { |
734a1a5e GKB |
1224 | ret = fanotify_group_init_error_pool(group); |
1225 | if (ret) | |
1226 | goto out; | |
1227 | } | |
1228 | ||
8998d110 AG |
1229 | recalc = fanotify_mark_add_to_mask(fsn_mark, mask, fan_flags); |
1230 | if (recalc) | |
3ac70bfc | 1231 | fsnotify_recalc_mask(fsn_mark->connector); |
734a1a5e GKB |
1232 | |
1233 | out: | |
e79719a2 | 1234 | fsnotify_group_unlock(group); |
5e9c070c | 1235 | |
fa218ab9 | 1236 | fsnotify_put_mark(fsn_mark); |
734a1a5e | 1237 | return ret; |
88826276 EP |
1238 | } |
1239 | ||
eaa2c6b0 AG |
1240 | static int fanotify_add_vfsmount_mark(struct fsnotify_group *group, |
1241 | struct vfsmount *mnt, __u32 mask, | |
77115225 | 1242 | unsigned int flags, __kernel_fsid_t *fsid) |
eaa2c6b0 AG |
1243 | { |
1244 | return fanotify_add_mark(group, &real_mount(mnt)->mnt_fsnotify_marks, | |
77115225 | 1245 | FSNOTIFY_OBJ_TYPE_VFSMOUNT, mask, flags, fsid); |
eaa2c6b0 AG |
1246 | } |
1247 | ||
d54f4fba | 1248 | static int fanotify_add_sb_mark(struct fsnotify_group *group, |
77115225 AG |
1249 | struct super_block *sb, __u32 mask, |
1250 | unsigned int flags, __kernel_fsid_t *fsid) | |
d54f4fba AG |
1251 | { |
1252 | return fanotify_add_mark(group, &sb->s_fsnotify_marks, | |
77115225 | 1253 | FSNOTIFY_OBJ_TYPE_SB, mask, flags, fsid); |
d54f4fba AG |
1254 | } |
1255 | ||
52202dfb | 1256 | static int fanotify_add_inode_mark(struct fsnotify_group *group, |
b9e4e3bd | 1257 | struct inode *inode, __u32 mask, |
77115225 | 1258 | unsigned int flags, __kernel_fsid_t *fsid) |
88826276 | 1259 | { |
88826276 | 1260 | pr_debug("%s: group=%p inode=%p\n", __func__, group, inode); |
2a3edf86 | 1261 | |
5322a59f EP |
1262 | /* |
1263 | * If some other task has this inode open for write we should not add | |
1264 | * an ignored mark, unless that ignored mark is supposed to survive | |
1265 | * modification changes anyway. | |
1266 | */ | |
1267 | if ((flags & FAN_MARK_IGNORED_MASK) && | |
1268 | !(flags & FAN_MARK_IGNORED_SURV_MODIFY) && | |
ac9498d6 | 1269 | inode_is_open_for_write(inode)) |
5322a59f EP |
1270 | return 0; |
1271 | ||
eaa2c6b0 | 1272 | return fanotify_add_mark(group, &inode->i_fsnotify_marks, |
77115225 | 1273 | FSNOTIFY_OBJ_TYPE_INODE, mask, flags, fsid); |
88826276 | 1274 | } |
2a3edf86 | 1275 | |
b8a6c3a2 AG |
1276 | static struct fsnotify_event *fanotify_alloc_overflow_event(void) |
1277 | { | |
1278 | struct fanotify_event *oevent; | |
1279 | ||
1280 | oevent = kmalloc(sizeof(*oevent), GFP_KERNEL_ACCOUNT); | |
1281 | if (!oevent) | |
1282 | return NULL; | |
1283 | ||
1284 | fanotify_init_event(oevent, 0, FS_Q_OVERFLOW); | |
1285 | oevent->type = FANOTIFY_EVENT_TYPE_OVERFLOW; | |
1286 | ||
1287 | return &oevent->fse; | |
1288 | } | |
1289 | ||
94e00d28 AG |
1290 | static struct hlist_head *fanotify_alloc_merge_hash(void) |
1291 | { | |
1292 | struct hlist_head *hash; | |
1293 | ||
1294 | hash = kmalloc(sizeof(struct hlist_head) << FANOTIFY_HTABLE_BITS, | |
1295 | GFP_KERNEL_ACCOUNT); | |
1296 | if (!hash) | |
1297 | return NULL; | |
1298 | ||
1299 | __hash_init(hash, FANOTIFY_HTABLE_SIZE); | |
1300 | ||
1301 | return hash; | |
1302 | } | |
1303 | ||
52c923dd | 1304 | /* fanotify syscalls */ |
08ae8938 | 1305 | SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags) |
11637e4b | 1306 | { |
52c923dd EP |
1307 | struct fsnotify_group *group; |
1308 | int f_flags, fd; | |
83b7a598 AG |
1309 | unsigned int fid_mode = flags & FANOTIFY_FID_BITS; |
1310 | unsigned int class = flags & FANOTIFY_CLASS_BITS; | |
a8b98c80 | 1311 | unsigned int internal_flags = 0; |
52c923dd | 1312 | |
96a71f21 AG |
1313 | pr_debug("%s: flags=%x event_f_flags=%x\n", |
1314 | __func__, flags, event_f_flags); | |
52c923dd | 1315 | |
7cea2a3c AG |
1316 | if (!capable(CAP_SYS_ADMIN)) { |
1317 | /* | |
1318 | * An unprivileged user can setup an fanotify group with | |
1319 | * limited functionality - an unprivileged group is limited to | |
1320 | * notification events with file handles and it cannot use | |
1321 | * unlimited queue/marks. | |
1322 | */ | |
1323 | if ((flags & FANOTIFY_ADMIN_INIT_FLAGS) || !fid_mode) | |
1324 | return -EPERM; | |
a8b98c80 AG |
1325 | |
1326 | /* | |
1327 | * Setting the internal flag FANOTIFY_UNPRIV on the group | |
1328 | * prevents setting mount/filesystem marks on this group and | |
1329 | * prevents reporting pid and open fd in events. | |
1330 | */ | |
1331 | internal_flags |= FANOTIFY_UNPRIV; | |
7cea2a3c | 1332 | } |
52c923dd | 1333 | |
de8cd83e | 1334 | #ifdef CONFIG_AUDITSYSCALL |
23c9deeb | 1335 | if (flags & ~(FANOTIFY_INIT_FLAGS | FAN_ENABLE_AUDIT)) |
de8cd83e | 1336 | #else |
23c9deeb | 1337 | if (flags & ~FANOTIFY_INIT_FLAGS) |
de8cd83e | 1338 | #endif |
52c923dd EP |
1339 | return -EINVAL; |
1340 | ||
af579beb MB |
1341 | /* |
1342 | * A pidfd can only be returned for a thread-group leader; thus | |
1343 | * FAN_REPORT_PIDFD and FAN_REPORT_TID need to remain mutually | |
1344 | * exclusive. | |
1345 | */ | |
1346 | if ((flags & FAN_REPORT_PIDFD) && (flags & FAN_REPORT_TID)) | |
1347 | return -EINVAL; | |
1348 | ||
48149e9d HS |
1349 | if (event_f_flags & ~FANOTIFY_INIT_ALL_EVENT_F_BITS) |
1350 | return -EINVAL; | |
1351 | ||
1352 | switch (event_f_flags & O_ACCMODE) { | |
1353 | case O_RDONLY: | |
1354 | case O_RDWR: | |
1355 | case O_WRONLY: | |
1356 | break; | |
1357 | default: | |
1358 | return -EINVAL; | |
1359 | } | |
1360 | ||
83b7a598 | 1361 | if (fid_mode && class != FAN_CLASS_NOTIF) |
a8b13aa2 AG |
1362 | return -EINVAL; |
1363 | ||
929943b3 | 1364 | /* |
929943b3 | 1365 | * Child name is reported with parent fid so requires dir fid. |
691d9763 | 1366 | * We can report both child fid and dir fid with or without name. |
929943b3 | 1367 | */ |
691d9763 | 1368 | if ((fid_mode & FAN_REPORT_NAME) && !(fid_mode & FAN_REPORT_DIR_FID)) |
83b7a598 | 1369 | return -EINVAL; |
83b7a598 | 1370 | |
d61fd650 AG |
1371 | /* |
1372 | * FAN_REPORT_TARGET_FID requires FAN_REPORT_NAME and FAN_REPORT_FID | |
1373 | * and is used as an indication to report both dir and child fid on all | |
1374 | * dirent events. | |
1375 | */ | |
1376 | if ((fid_mode & FAN_REPORT_TARGET_FID) && | |
1377 | (!(fid_mode & FAN_REPORT_NAME) || !(fid_mode & FAN_REPORT_FID))) | |
1378 | return -EINVAL; | |
1379 | ||
dccd8557 | 1380 | f_flags = O_RDWR | __FMODE_NONOTIFY; |
52c923dd EP |
1381 | if (flags & FAN_CLOEXEC) |
1382 | f_flags |= O_CLOEXEC; | |
1383 | if (flags & FAN_NONBLOCK) | |
1384 | f_flags |= O_NONBLOCK; | |
1385 | ||
1386 | /* fsnotify_alloc_group takes a ref. Dropped in fanotify_release */ | |
867a448d | 1387 | group = fsnotify_alloc_group(&fanotify_fsnotify_ops, |
e79719a2 | 1388 | FSNOTIFY_GROUP_USER | FSNOTIFY_GROUP_NOFS); |
26379198 | 1389 | if (IS_ERR(group)) { |
52c923dd | 1390 | return PTR_ERR(group); |
26379198 | 1391 | } |
52c923dd | 1392 | |
5b8fea65 AG |
1393 | /* Enforce groups limits per user in all containing user ns */ |
1394 | group->fanotify_data.ucounts = inc_ucount(current_user_ns(), | |
1395 | current_euid(), | |
1396 | UCOUNT_FANOTIFY_GROUPS); | |
1397 | if (!group->fanotify_data.ucounts) { | |
1398 | fd = -EMFILE; | |
1399 | goto out_destroy_group; | |
1400 | } | |
1401 | ||
a8b98c80 | 1402 | group->fanotify_data.flags = flags | internal_flags; |
d46eb14b | 1403 | group->memcg = get_mem_cgroup_from_mm(current->mm); |
4afeff85 | 1404 | |
94e00d28 AG |
1405 | group->fanotify_data.merge_hash = fanotify_alloc_merge_hash(); |
1406 | if (!group->fanotify_data.merge_hash) { | |
1407 | fd = -ENOMEM; | |
1408 | goto out_destroy_group; | |
1409 | } | |
1410 | ||
b8a6c3a2 AG |
1411 | group->overflow_event = fanotify_alloc_overflow_event(); |
1412 | if (unlikely(!group->overflow_event)) { | |
ff57cd58 JK |
1413 | fd = -ENOMEM; |
1414 | goto out_destroy_group; | |
1415 | } | |
ff57cd58 | 1416 | |
1e2ee49f WW |
1417 | if (force_o_largefile()) |
1418 | event_f_flags |= O_LARGEFILE; | |
80af2588 | 1419 | group->fanotify_data.f_flags = event_f_flags; |
9e66e423 EP |
1420 | init_waitqueue_head(&group->fanotify_data.access_waitq); |
1421 | INIT_LIST_HEAD(&group->fanotify_data.access_list); | |
83b7a598 | 1422 | switch (class) { |
4231a235 EP |
1423 | case FAN_CLASS_NOTIF: |
1424 | group->priority = FS_PRIO_0; | |
1425 | break; | |
1426 | case FAN_CLASS_CONTENT: | |
1427 | group->priority = FS_PRIO_1; | |
1428 | break; | |
1429 | case FAN_CLASS_PRE_CONTENT: | |
1430 | group->priority = FS_PRIO_2; | |
1431 | break; | |
1432 | default: | |
1433 | fd = -EINVAL; | |
d8153d4d | 1434 | goto out_destroy_group; |
4231a235 | 1435 | } |
cb2d429f | 1436 | |
5dd03f55 EP |
1437 | if (flags & FAN_UNLIMITED_QUEUE) { |
1438 | fd = -EPERM; | |
1439 | if (!capable(CAP_SYS_ADMIN)) | |
d8153d4d | 1440 | goto out_destroy_group; |
5dd03f55 EP |
1441 | group->max_events = UINT_MAX; |
1442 | } else { | |
5b8fea65 | 1443 | group->max_events = fanotify_max_queued_events; |
5dd03f55 | 1444 | } |
2529a0df | 1445 | |
ac7e22dc EP |
1446 | if (flags & FAN_UNLIMITED_MARKS) { |
1447 | fd = -EPERM; | |
1448 | if (!capable(CAP_SYS_ADMIN)) | |
d8153d4d | 1449 | goto out_destroy_group; |
ac7e22dc | 1450 | } |
e7099d8a | 1451 | |
de8cd83e SG |
1452 | if (flags & FAN_ENABLE_AUDIT) { |
1453 | fd = -EPERM; | |
1454 | if (!capable(CAP_AUDIT_WRITE)) | |
1455 | goto out_destroy_group; | |
de8cd83e SG |
1456 | } |
1457 | ||
52c923dd EP |
1458 | fd = anon_inode_getfd("[fanotify]", &fanotify_fops, group, f_flags); |
1459 | if (fd < 0) | |
d8153d4d | 1460 | goto out_destroy_group; |
52c923dd EP |
1461 | |
1462 | return fd; | |
1463 | ||
d8153d4d LS |
1464 | out_destroy_group: |
1465 | fsnotify_destroy_group(group); | |
52c923dd | 1466 | return fd; |
11637e4b | 1467 | } |
bbaa4168 | 1468 | |
8299212c | 1469 | static int fanotify_test_fsid(struct dentry *dentry, __kernel_fsid_t *fsid) |
a8b13aa2 | 1470 | { |
73072283 | 1471 | __kernel_fsid_t root_fsid; |
a8b13aa2 AG |
1472 | int err; |
1473 | ||
1474 | /* | |
8299212c | 1475 | * Make sure dentry is not of a filesystem with zero fsid (e.g. fuse). |
a8b13aa2 | 1476 | */ |
8299212c | 1477 | err = vfs_get_fsid(dentry, fsid); |
a8b13aa2 AG |
1478 | if (err) |
1479 | return err; | |
1480 | ||
73072283 | 1481 | if (!fsid->val[0] && !fsid->val[1]) |
a8b13aa2 AG |
1482 | return -ENODEV; |
1483 | ||
1484 | /* | |
8299212c | 1485 | * Make sure dentry is not of a filesystem subvolume (e.g. btrfs) |
a8b13aa2 AG |
1486 | * which uses a different fsid than sb root. |
1487 | */ | |
8299212c | 1488 | err = vfs_get_fsid(dentry->d_sb->s_root, &root_fsid); |
a8b13aa2 AG |
1489 | if (err) |
1490 | return err; | |
1491 | ||
73072283 AG |
1492 | if (root_fsid.val[0] != fsid->val[0] || |
1493 | root_fsid.val[1] != fsid->val[1]) | |
a8b13aa2 AG |
1494 | return -EXDEV; |
1495 | ||
8299212c GKB |
1496 | return 0; |
1497 | } | |
1498 | ||
1499 | /* Check if filesystem can encode a unique fid */ | |
1500 | static int fanotify_test_fid(struct dentry *dentry) | |
1501 | { | |
a8b13aa2 AG |
1502 | /* |
1503 | * We need to make sure that the file system supports at least | |
1504 | * encoding a file handle so user can use name_to_handle_at() to | |
1505 | * compare fid returned with event to the file handle of watched | |
1506 | * objects. However, name_to_handle_at() requires that the | |
1507 | * filesystem also supports decoding file handles. | |
1508 | */ | |
8299212c GKB |
1509 | if (!dentry->d_sb->s_export_op || |
1510 | !dentry->d_sb->s_export_op->fh_to_dentry) | |
a8b13aa2 AG |
1511 | return -EOPNOTSUPP; |
1512 | ||
1513 | return 0; | |
1514 | } | |
1515 | ||
8698e3ba AG |
1516 | static int fanotify_events_supported(struct fsnotify_group *group, |
1517 | struct path *path, __u64 mask, | |
1518 | unsigned int flags) | |
0b3b094a | 1519 | { |
8698e3ba AG |
1520 | unsigned int mark_type = flags & FANOTIFY_MARK_TYPE_BITS; |
1521 | /* Strict validation of events in non-dir inode mask with v5.17+ APIs */ | |
1522 | bool strict_dir_events = FAN_GROUP_FLAG(group, FAN_REPORT_TARGET_FID) || | |
1523 | (mask & FAN_RENAME); | |
1524 | ||
0b3b094a JK |
1525 | /* |
1526 | * Some filesystems such as 'proc' acquire unusual locks when opening | |
1527 | * files. For them fanotify permission events have high chances of | |
1528 | * deadlocking the system - open done when reporting fanotify event | |
1529 | * blocks on this "unusual" lock while another process holding the lock | |
1530 | * waits for fanotify permission event to be answered. Just disallow | |
1531 | * permission events for such filesystems. | |
1532 | */ | |
1533 | if (mask & FANOTIFY_PERM_EVENTS && | |
1534 | path->mnt->mnt_sb->s_type->fs_flags & FS_DISALLOW_NOTIFY_PERM) | |
1535 | return -EINVAL; | |
8698e3ba AG |
1536 | |
1537 | /* | |
1538 | * We shouldn't have allowed setting dirent events and the directory | |
1539 | * flags FAN_ONDIR and FAN_EVENT_ON_CHILD in mask of non-dir inode, | |
1540 | * but because we always allowed it, error only when using new APIs. | |
1541 | */ | |
1542 | if (strict_dir_events && mark_type == FAN_MARK_INODE && | |
1543 | !d_is_dir(path->dentry) && (mask & FANOTIFY_DIRONLY_EVENT_BITS)) | |
1544 | return -ENOTDIR; | |
1545 | ||
0b3b094a JK |
1546 | return 0; |
1547 | } | |
1548 | ||
183caa3c DB |
1549 | static int do_fanotify_mark(int fanotify_fd, unsigned int flags, __u64 mask, |
1550 | int dfd, const char __user *pathname) | |
bbaa4168 | 1551 | { |
0ff21db9 EP |
1552 | struct inode *inode = NULL; |
1553 | struct vfsmount *mnt = NULL; | |
2a3edf86 | 1554 | struct fsnotify_group *group; |
2903ff01 | 1555 | struct fd f; |
2a3edf86 | 1556 | struct path path; |
73072283 | 1557 | __kernel_fsid_t __fsid, *fsid = NULL; |
bdd5a46f | 1558 | u32 valid_mask = FANOTIFY_EVENTS | FANOTIFY_EVENT_FLAGS; |
23c9deeb | 1559 | unsigned int mark_type = flags & FANOTIFY_MARK_TYPE_BITS; |
3ef86653 | 1560 | bool ignored = flags & FAN_MARK_IGNORED_MASK; |
d809daf1 | 1561 | unsigned int obj_type, fid_mode; |
85af5d92 | 1562 | u32 umask = 0; |
2903ff01 | 1563 | int ret; |
2a3edf86 EP |
1564 | |
1565 | pr_debug("%s: fanotify_fd=%d flags=%x dfd=%d pathname=%p mask=%llx\n", | |
1566 | __func__, fanotify_fd, flags, dfd, pathname, mask); | |
1567 | ||
1568 | /* we only use the lower 32 bits as of right now. */ | |
22d483b9 | 1569 | if (upper_32_bits(mask)) |
2a3edf86 EP |
1570 | return -EINVAL; |
1571 | ||
23c9deeb | 1572 | if (flags & ~FANOTIFY_MARK_FLAGS) |
88380fe6 | 1573 | return -EINVAL; |
d54f4fba AG |
1574 | |
1575 | switch (mark_type) { | |
1576 | case FAN_MARK_INODE: | |
ac5656d8 AG |
1577 | obj_type = FSNOTIFY_OBJ_TYPE_INODE; |
1578 | break; | |
d54f4fba | 1579 | case FAN_MARK_MOUNT: |
ac5656d8 AG |
1580 | obj_type = FSNOTIFY_OBJ_TYPE_VFSMOUNT; |
1581 | break; | |
d54f4fba | 1582 | case FAN_MARK_FILESYSTEM: |
ac5656d8 | 1583 | obj_type = FSNOTIFY_OBJ_TYPE_SB; |
d54f4fba AG |
1584 | break; |
1585 | default: | |
1586 | return -EINVAL; | |
1587 | } | |
1588 | ||
4d92604c | 1589 | switch (flags & (FAN_MARK_ADD | FAN_MARK_REMOVE | FAN_MARK_FLUSH)) { |
df561f66 | 1590 | case FAN_MARK_ADD: |
88380fe6 | 1591 | case FAN_MARK_REMOVE: |
1734dee4 LS |
1592 | if (!mask) |
1593 | return -EINVAL; | |
cc299a98 | 1594 | break; |
4d92604c | 1595 | case FAN_MARK_FLUSH: |
23c9deeb | 1596 | if (flags & ~(FANOTIFY_MARK_TYPE_BITS | FAN_MARK_FLUSH)) |
cc299a98 | 1597 | return -EINVAL; |
88380fe6 AG |
1598 | break; |
1599 | default: | |
1600 | return -EINVAL; | |
1601 | } | |
8fcd6528 | 1602 | |
6685df31 | 1603 | if (IS_ENABLED(CONFIG_FANOTIFY_ACCESS_PERMISSIONS)) |
23c9deeb | 1604 | valid_mask |= FANOTIFY_PERM_EVENTS; |
6685df31 MS |
1605 | |
1606 | if (mask & ~valid_mask) | |
2a3edf86 EP |
1607 | return -EINVAL; |
1608 | ||
3ef86653 AG |
1609 | /* Event flags (ONDIR, ON_CHILD) are meaningless in ignored mask */ |
1610 | if (ignored) | |
1611 | mask &= ~FANOTIFY_EVENT_FLAGS; | |
1612 | ||
2903ff01 AV |
1613 | f = fdget(fanotify_fd); |
1614 | if (unlikely(!f.file)) | |
2a3edf86 EP |
1615 | return -EBADF; |
1616 | ||
1617 | /* verify that this is indeed an fanotify instance */ | |
1618 | ret = -EINVAL; | |
2903ff01 | 1619 | if (unlikely(f.file->f_op != &fanotify_fops)) |
2a3edf86 | 1620 | goto fput_and_out; |
2903ff01 | 1621 | group = f.file->private_data; |
4231a235 | 1622 | |
7cea2a3c | 1623 | /* |
a8b98c80 AG |
1624 | * An unprivileged user is not allowed to setup mount nor filesystem |
1625 | * marks. This also includes setting up such marks by a group that | |
1626 | * was initialized by an unprivileged user. | |
7cea2a3c AG |
1627 | */ |
1628 | ret = -EPERM; | |
a8b98c80 AG |
1629 | if ((!capable(CAP_SYS_ADMIN) || |
1630 | FAN_GROUP_FLAG(group, FANOTIFY_UNPRIV)) && | |
7cea2a3c AG |
1631 | mark_type != FAN_MARK_INODE) |
1632 | goto fput_and_out; | |
1633 | ||
4231a235 EP |
1634 | /* |
1635 | * group->priority == FS_PRIO_0 == FAN_CLASS_NOTIF. These are not | |
1636 | * allowed to set permissions events. | |
1637 | */ | |
1638 | ret = -EINVAL; | |
23c9deeb | 1639 | if (mask & FANOTIFY_PERM_EVENTS && |
4231a235 EP |
1640 | group->priority == FS_PRIO_0) |
1641 | goto fput_and_out; | |
2a3edf86 | 1642 | |
9709bd54 GKB |
1643 | if (mask & FAN_FS_ERROR && |
1644 | mark_type != FAN_MARK_FILESYSTEM) | |
1645 | goto fput_and_out; | |
1646 | ||
7d5e005d AG |
1647 | /* |
1648 | * Evictable is only relevant for inode marks, because only inode object | |
1649 | * can be evicted on memory pressure. | |
1650 | */ | |
1651 | if (flags & FAN_MARK_EVICTABLE && | |
1652 | mark_type != FAN_MARK_INODE) | |
1653 | goto fput_and_out; | |
1654 | ||
235328d1 | 1655 | /* |
4fe595cf GKB |
1656 | * Events that do not carry enough information to report |
1657 | * event->fd require a group that supports reporting fid. Those | |
1658 | * events are not supported on a mount mark, because they do not | |
1659 | * carry enough information (i.e. path) to be filtered by mount | |
1660 | * point. | |
235328d1 | 1661 | */ |
d809daf1 | 1662 | fid_mode = FAN_GROUP_FLAG(group, FANOTIFY_FID_BITS); |
4fe595cf | 1663 | if (mask & ~(FANOTIFY_FD_EVENTS|FANOTIFY_EVENT_FLAGS) && |
d809daf1 | 1664 | (!fid_mode || mark_type == FAN_MARK_MOUNT)) |
235328d1 AG |
1665 | goto fput_and_out; |
1666 | ||
8cc3b1cc AG |
1667 | /* |
1668 | * FAN_RENAME uses special info type records to report the old and | |
1669 | * new parent+name. Reporting only old and new parent id is less | |
1670 | * useful and was not implemented. | |
1671 | */ | |
1672 | if (mask & FAN_RENAME && !(fid_mode & FAN_REPORT_NAME)) | |
1673 | goto fput_and_out; | |
1674 | ||
0a8dd2db HS |
1675 | if (flags & FAN_MARK_FLUSH) { |
1676 | ret = 0; | |
d54f4fba | 1677 | if (mark_type == FAN_MARK_MOUNT) |
0a8dd2db | 1678 | fsnotify_clear_vfsmount_marks_by_group(group); |
d54f4fba AG |
1679 | else if (mark_type == FAN_MARK_FILESYSTEM) |
1680 | fsnotify_clear_sb_marks_by_group(group); | |
0a8dd2db HS |
1681 | else |
1682 | fsnotify_clear_inode_marks_by_group(group); | |
1683 | goto fput_and_out; | |
1684 | } | |
1685 | ||
ac5656d8 AG |
1686 | ret = fanotify_find_path(dfd, pathname, &path, flags, |
1687 | (mask & ALL_FSNOTIFY_EVENTS), obj_type); | |
2a3edf86 EP |
1688 | if (ret) |
1689 | goto fput_and_out; | |
1690 | ||
0b3b094a | 1691 | if (flags & FAN_MARK_ADD) { |
8698e3ba | 1692 | ret = fanotify_events_supported(group, &path, mask, flags); |
0b3b094a JK |
1693 | if (ret) |
1694 | goto path_put_and_out; | |
1695 | } | |
1696 | ||
d809daf1 | 1697 | if (fid_mode) { |
8299212c GKB |
1698 | ret = fanotify_test_fsid(path.dentry, &__fsid); |
1699 | if (ret) | |
1700 | goto path_put_and_out; | |
1701 | ||
1702 | ret = fanotify_test_fid(path.dentry); | |
a8b13aa2 AG |
1703 | if (ret) |
1704 | goto path_put_and_out; | |
77115225 | 1705 | |
73072283 | 1706 | fsid = &__fsid; |
a8b13aa2 AG |
1707 | } |
1708 | ||
2a3edf86 | 1709 | /* inode held in place by reference to path; group by fget on fd */ |
d54f4fba | 1710 | if (mark_type == FAN_MARK_INODE) |
0ff21db9 EP |
1711 | inode = path.dentry->d_inode; |
1712 | else | |
1713 | mnt = path.mnt; | |
2a3edf86 | 1714 | |
85af5d92 AG |
1715 | /* Mask out FAN_EVENT_ON_CHILD flag for sb/mount/non-dir marks */ |
1716 | if (mnt || !S_ISDIR(inode->i_mode)) { | |
1717 | mask &= ~FAN_EVENT_ON_CHILD; | |
1718 | umask = FAN_EVENT_ON_CHILD; | |
51280637 AG |
1719 | /* |
1720 | * If group needs to report parent fid, register for getting | |
1721 | * events with parent/name info for non-directory. | |
1722 | */ | |
1723 | if ((fid_mode & FAN_REPORT_DIR_FID) && | |
1724 | (flags & FAN_MARK_ADD) && !ignored) | |
1725 | mask |= FAN_EVENT_ON_CHILD; | |
85af5d92 AG |
1726 | } |
1727 | ||
2a3edf86 | 1728 | /* create/update an inode mark */ |
0a8dd2db | 1729 | switch (flags & (FAN_MARK_ADD | FAN_MARK_REMOVE)) { |
c6223f46 | 1730 | case FAN_MARK_ADD: |
d54f4fba | 1731 | if (mark_type == FAN_MARK_MOUNT) |
77115225 AG |
1732 | ret = fanotify_add_vfsmount_mark(group, mnt, mask, |
1733 | flags, fsid); | |
d54f4fba | 1734 | else if (mark_type == FAN_MARK_FILESYSTEM) |
77115225 AG |
1735 | ret = fanotify_add_sb_mark(group, mnt->mnt_sb, mask, |
1736 | flags, fsid); | |
0ff21db9 | 1737 | else |
77115225 AG |
1738 | ret = fanotify_add_inode_mark(group, inode, mask, |
1739 | flags, fsid); | |
c6223f46 AG |
1740 | break; |
1741 | case FAN_MARK_REMOVE: | |
d54f4fba | 1742 | if (mark_type == FAN_MARK_MOUNT) |
77115225 | 1743 | ret = fanotify_remove_vfsmount_mark(group, mnt, mask, |
85af5d92 | 1744 | flags, umask); |
d54f4fba | 1745 | else if (mark_type == FAN_MARK_FILESYSTEM) |
77115225 | 1746 | ret = fanotify_remove_sb_mark(group, mnt->mnt_sb, mask, |
85af5d92 | 1747 | flags, umask); |
f3640192 | 1748 | else |
77115225 | 1749 | ret = fanotify_remove_inode_mark(group, inode, mask, |
85af5d92 | 1750 | flags, umask); |
c6223f46 AG |
1751 | break; |
1752 | default: | |
1753 | ret = -EINVAL; | |
1754 | } | |
2a3edf86 | 1755 | |
a8b13aa2 | 1756 | path_put_and_out: |
2a3edf86 EP |
1757 | path_put(&path); |
1758 | fput_and_out: | |
2903ff01 | 1759 | fdput(f); |
2a3edf86 EP |
1760 | return ret; |
1761 | } | |
1762 | ||
2ca408d9 | 1763 | #ifndef CONFIG_ARCH_SPLIT_ARG64 |
183caa3c DB |
1764 | SYSCALL_DEFINE5(fanotify_mark, int, fanotify_fd, unsigned int, flags, |
1765 | __u64, mask, int, dfd, | |
1766 | const char __user *, pathname) | |
1767 | { | |
1768 | return do_fanotify_mark(fanotify_fd, flags, mask, dfd, pathname); | |
1769 | } | |
2ca408d9 | 1770 | #endif |
183caa3c | 1771 | |
2ca408d9 BG |
1772 | #if defined(CONFIG_ARCH_SPLIT_ARG64) || defined(CONFIG_COMPAT) |
1773 | SYSCALL32_DEFINE6(fanotify_mark, | |
91c2e0bc | 1774 | int, fanotify_fd, unsigned int, flags, |
2ca408d9 | 1775 | SC_ARG64(mask), int, dfd, |
91c2e0bc AV |
1776 | const char __user *, pathname) |
1777 | { | |
2ca408d9 BG |
1778 | return do_fanotify_mark(fanotify_fd, flags, SC_VAL64(__u64, mask), |
1779 | dfd, pathname); | |
91c2e0bc AV |
1780 | } |
1781 | #endif | |
1782 | ||
2a3edf86 | 1783 | /* |
ae0e47f0 | 1784 | * fanotify_user_setup - Our initialization function. Note that we cannot return |
2a3edf86 EP |
1785 | * error because we have compiled-in VFS hooks. So an (unlikely) failure here |
1786 | * must result in panic(). | |
1787 | */ | |
1788 | static int __init fanotify_user_setup(void) | |
1789 | { | |
5b8fea65 AG |
1790 | struct sysinfo si; |
1791 | int max_marks; | |
1792 | ||
1793 | si_meminfo(&si); | |
1794 | /* | |
1795 | * Allow up to 1% of addressable memory to be accounted for per user | |
1796 | * marks limited to the range [8192, 1048576]. mount and sb marks are | |
1797 | * a lot cheaper than inode marks, but there is no reason for a user | |
1798 | * to have many of those, so calculate by the cost of inode marks. | |
1799 | */ | |
1800 | max_marks = (((si.totalram - si.totalhigh) / 100) << PAGE_SHIFT) / | |
1801 | INODE_MARK_COST; | |
1802 | max_marks = clamp(max_marks, FANOTIFY_OLD_DEFAULT_MAX_MARKS, | |
1803 | FANOTIFY_DEFAULT_MAX_USER_MARKS); | |
1804 | ||
a8b98c80 | 1805 | BUILD_BUG_ON(FANOTIFY_INIT_FLAGS & FANOTIFY_INTERNAL_GROUP_FLAGS); |
d61fd650 | 1806 | BUILD_BUG_ON(HWEIGHT32(FANOTIFY_INIT_FLAGS) != 12); |
5f9d3bd5 | 1807 | BUILD_BUG_ON(HWEIGHT32(FANOTIFY_MARK_FLAGS) != 10); |
bdd5a46f | 1808 | |
d46eb14b SB |
1809 | fanotify_mark_cache = KMEM_CACHE(fsnotify_mark, |
1810 | SLAB_PANIC|SLAB_ACCOUNT); | |
7088f357 JK |
1811 | fanotify_fid_event_cachep = KMEM_CACHE(fanotify_fid_event, |
1812 | SLAB_PANIC); | |
1813 | fanotify_path_event_cachep = KMEM_CACHE(fanotify_path_event, | |
1814 | SLAB_PANIC); | |
6685df31 MS |
1815 | if (IS_ENABLED(CONFIG_FANOTIFY_ACCESS_PERMISSIONS)) { |
1816 | fanotify_perm_event_cachep = | |
33913997 | 1817 | KMEM_CACHE(fanotify_perm_event, SLAB_PANIC); |
6685df31 | 1818 | } |
2a3edf86 | 1819 | |
5b8fea65 AG |
1820 | fanotify_max_queued_events = FANOTIFY_DEFAULT_MAX_EVENTS; |
1821 | init_user_ns.ucount_max[UCOUNT_FANOTIFY_GROUPS] = | |
1822 | FANOTIFY_DEFAULT_MAX_GROUPS; | |
1823 | init_user_ns.ucount_max[UCOUNT_FANOTIFY_MARKS] = max_marks; | |
7b9ad122 | 1824 | fanotify_sysctls_init(); |
5b8fea65 | 1825 | |
2a3edf86 | 1826 | return 0; |
bbaa4168 | 1827 | } |
2a3edf86 | 1828 | device_initcall(fanotify_user_setup); |