fs/attr.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /*
   3  *  linux/fs/attr.c
   4  *
   5  *  Copyright (C) 1991, 1992  Linus Torvalds
   6  *  changes by Thomas Schoebel-Theuer
   7  */
   8
   9 #include <linux/export.h>
  10 #include <linux/time.h>
  11 #include <linux/mm.h>
  12 #include <linux/string.h>
  13 #include <linux/sched/signal.h>
  14 #include <linux/capability.h>
  15 #include <linux/fsnotify.h>
  16 #include <linux/fcntl.h>
  17 #include <linux/security.h>
  18 #include <linux/evm.h>
  19 #include <linux/ima.h>
  20
  21 /**
  22  * chown_ok - verify permissions to chown inode
  23  * @mnt_userns: user namespace of the mount @inode was found from
  24  * @inode:      inode to check permissions on
  25  * @ia_vfsuid:  uid to chown @inode to
  26  *
  27  * If the inode has been found through an idmapped mount the user namespace of
  28  * the vfsmount must be passed through @mnt_userns. This function will then
  29  * take care to map the inode according to @mnt_userns before checking
  30  * permissions. On non-idmapped mounts or if permission checking is to be
  31  * performed on the raw inode simply passs init_user_ns.
  32  */
  33 static bool chown_ok(struct user_namespace *mnt_userns,
  34                      const struct inode *inode, vfsuid_t ia_vfsuid)
  35 {
  36         vfsuid_t vfsuid = i_uid_into_vfsuid(mnt_userns, inode);
  37         if (vfsuid_eq_kuid(vfsuid, current_fsuid()) &&
  38             vfsuid_eq(ia_vfsuid, vfsuid))
  39                 return true;
  40         if (capable_wrt_inode_uidgid(mnt_userns, inode, CAP_CHOWN))
  41                 return true;
  42         if (!vfsuid_valid(vfsuid) &&
  43             ns_capable(inode->i_sb->s_user_ns, CAP_CHOWN))
  44                 return true;
  45         return false;
  46 }
  47
  48 /**
  49  * chgrp_ok - verify permissions to chgrp inode
  50  * @mnt_userns: user namespace of the mount @inode was found from
  51  * @inode:      inode to check permissions on
  52  * @ia_vfsgid:  gid to chown @inode to
  53  *
  54  * If the inode has been found through an idmapped mount the user namespace of
  55  * the vfsmount must be passed through @mnt_userns. This function will then
  56  * take care to map the inode according to @mnt_userns before checking
  57  * permissions. On non-idmapped mounts or if permission checking is to be
  58  * performed on the raw inode simply passs init_user_ns.
  59  */
  60 static bool chgrp_ok(struct user_namespace *mnt_userns,
  61                      const struct inode *inode, vfsgid_t ia_vfsgid)
  62 {
  63         vfsgid_t vfsgid = i_gid_into_vfsgid(mnt_userns, inode);
  64         vfsuid_t vfsuid = i_uid_into_vfsuid(mnt_userns, inode);
  65         if (vfsuid_eq_kuid(vfsuid, current_fsuid())) {
  66                 if (vfsgid_eq(ia_vfsgid, vfsgid))
  67                         return true;
  68                 if (vfsgid_in_group_p(ia_vfsgid))
  69                         return true;
  70         }
  71         if (capable_wrt_inode_uidgid(mnt_userns, inode, CAP_CHOWN))
  72                 return true;
  73         if (!vfsgid_valid(vfsgid) &&
  74             ns_capable(inode->i_sb->s_user_ns, CAP_CHOWN))
  75                 return true;
  76         return false;
  77 }
  78
  79 /**
  80  * setattr_prepare - check if attribute changes to a dentry are allowed
  81  * @mnt_userns: user namespace of the mount the inode was found from
  82  * @dentry:     dentry to check
  83  * @attr:       attributes to change
  84  *
  85  * Check if we are allowed to change the attributes contained in @attr
  86  * in the given dentry.  This includes the normal unix access permission
  87  * checks, as well as checks for rlimits and others. The function also clears
  88  * SGID bit from mode if user is not allowed to set it. Also file capabilities
  89  * and IMA extended attributes are cleared if ATTR_KILL_PRIV is set.
  90  *
  91  * If the inode has been found through an idmapped mount the user namespace of
  92  * the vfsmount must be passed through @mnt_userns. This function will then
  93  * take care to map the inode according to @mnt_userns before checking
  94  * permissions. On non-idmapped mounts or if permission checking is to be
  95  * performed on the raw inode simply passs init_user_ns.
  96  *
  97  * Should be called as the first thing in ->setattr implementations,
  98  * possibly after taking additional locks.
  99  */
 100 int setattr_prepare(struct user_namespace *mnt_userns, struct dentry *dentry,
 101                     struct iattr *attr)
 102 {
 103         struct inode *inode = d_inode(dentry);
 104         unsigned int ia_valid = attr->ia_valid;
 105
 106         /*
 107          * First check size constraints.  These can't be overriden using
 108          * ATTR_FORCE.
 109          */
 110         if (ia_valid & ATTR_SIZE) {
 111                 int error = inode_newsize_ok(inode, attr->ia_size);
 112                 if (error)
 113                         return error;
 114         }
 115
 116         /* If force is set do it anyway. */
 117         if (ia_valid & ATTR_FORCE)
 118                 goto kill_priv;
 119
 120         /* Make sure a caller can chown. */
 121         if ((ia_valid & ATTR_UID) &&
 122             !chown_ok(mnt_userns, inode, attr->ia_vfsuid))
 123                 return -EPERM;
 124
 125         /* Make sure caller can chgrp. */
 126         if ((ia_valid & ATTR_GID) &&
 127             !chgrp_ok(mnt_userns, inode, attr->ia_vfsgid))
 128                 return -EPERM;
 129
 130         /* Make sure a caller can chmod. */
 131         if (ia_valid & ATTR_MODE) {
 132                 vfsgid_t vfsgid;
 133
 134                 if (!inode_owner_or_capable(mnt_userns, inode))
 135                         return -EPERM;
 136
 137                 if (ia_valid & ATTR_GID)
 138                         vfsgid = attr->ia_vfsgid;
 139                 else
 140                         vfsgid = i_gid_into_vfsgid(mnt_userns, inode);
 141
 142                 /* Also check the setgid bit! */
 143                 if (!vfsgid_in_group_p(vfsgid) &&
 144                     !capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FSETID))
 145                         attr->ia_mode &= ~S_ISGID;
 146         }
 147
 148         /* Check for setting the inode time. */
 149         if (ia_valid & (ATTR_MTIME_SET | ATTR_ATIME_SET | ATTR_TIMES_SET)) {
 150                 if (!inode_owner_or_capable(mnt_userns, inode))
 151                         return -EPERM;
 152         }
 153
 154 kill_priv:
 155         /* User has permission for the change */
 156         if (ia_valid & ATTR_KILL_PRIV) {
 157                 int error;
 158
 159                 error = security_inode_killpriv(mnt_userns, dentry);
 160                 if (error)
 161                         return error;
 162         }
 163
 164         return 0;
 165 }
 166 EXPORT_SYMBOL(setattr_prepare);
 167
 168 /**
 169  * inode_newsize_ok - may this inode be truncated to a given size
 170  * @inode:      the inode to be truncated
 171  * @offset:     the new size to assign to the inode
 172  *
 173  * inode_newsize_ok must be called with i_mutex held.
 174  *
 175  * inode_newsize_ok will check filesystem limits and ulimits to check that the
 176  * new inode size is within limits. inode_newsize_ok will also send SIGXFSZ
 177  * when necessary. Caller must not proceed with inode size change if failure is
 178  * returned. @inode must be a file (not directory), with appropriate
 179  * permissions to allow truncate (inode_newsize_ok does NOT check these
 180  * conditions).
 181  *
 182  * Return: 0 on success, -ve errno on failure
 183  */
 184 int inode_newsize_ok(const struct inode *inode, loff_t offset)
 185 {
 186         if (offset < 0)
 187                 return -EINVAL;
 188         if (inode->i_size < offset) {
 189                 unsigned long limit;
 190
 191                 limit = rlimit(RLIMIT_FSIZE);
 192                 if (limit != RLIM_INFINITY && offset > limit)
 193                         goto out_sig;
 194                 if (offset > inode->i_sb->s_maxbytes)
 195                         goto out_big;
 196         } else {
 197                 /*
 198                  * truncation of in-use swapfiles is disallowed - it would
 199                  * cause subsequent swapout to scribble on the now-freed
 200                  * blocks.
 201                  */
 202                 if (IS_SWAPFILE(inode))
 203                         return -ETXTBSY;
 204         }
 205
 206         return 0;
 207 out_sig:
 208         send_sig(SIGXFSZ, current, 0);
 209 out_big:
 210         return -EFBIG;
 211 }
 212 EXPORT_SYMBOL(inode_newsize_ok);
 213
 214 /**
 215  * setattr_copy - copy simple metadata updates into the generic inode
 216  * @mnt_userns: user namespace of the mount the inode was found from
 217  * @inode:      the inode to be updated
 218  * @attr:       the new attributes
 219  *
 220  * setattr_copy must be called with i_mutex held.
 221  *
 222  * setattr_copy updates the inode's metadata with that specified
 223  * in attr on idmapped mounts. Necessary permission checks to determine
 224  * whether or not the S_ISGID property needs to be removed are performed with
 225  * the correct idmapped mount permission helpers.
 226  * Noticeably missing is inode size update, which is more complex
 227  * as it requires pagecache updates.
 228  *
 229  * If the inode has been found through an idmapped mount the user namespace of
 230  * the vfsmount must be passed through @mnt_userns. This function will then
 231  * take care to map the inode according to @mnt_userns before checking
 232  * permissions. On non-idmapped mounts or if permission checking is to be
 233  * performed on the raw inode simply passs init_user_ns.
 234  *
 235  * The inode is not marked as dirty after this operation. The rationale is
 236  * that for "simple" filesystems, the struct inode is the inode storage.
 237  * The caller is free to mark the inode dirty afterwards if needed.
 238  */
 239 void setattr_copy(struct user_namespace *mnt_userns, struct inode *inode,
 240                   const struct iattr *attr)
 241 {
 242         unsigned int ia_valid = attr->ia_valid;
 243
 244         i_uid_update(mnt_userns, attr, inode);
 245         i_gid_update(mnt_userns, attr, inode);
 246         if (ia_valid & ATTR_ATIME)
 247                 inode->i_atime = attr->ia_atime;
 248         if (ia_valid & ATTR_MTIME)
 249                 inode->i_mtime = attr->ia_mtime;
 250         if (ia_valid & ATTR_CTIME)
 251                 inode->i_ctime = attr->ia_ctime;
 252         if (ia_valid & ATTR_MODE) {
 253                 umode_t mode = attr->ia_mode;
 254                 vfsgid_t vfsgid = i_gid_into_vfsgid(mnt_userns, inode);
 255                 if (!vfsgid_in_group_p(vfsgid) &&
 256                     !capable_wrt_inode_uidgid(mnt_userns, inode, CAP_FSETID))
 257                         mode &= ~S_ISGID;
 258                 inode->i_mode = mode;
 259         }
 260 }
 261 EXPORT_SYMBOL(setattr_copy);
 262
 263 int may_setattr(struct user_namespace *mnt_userns, struct inode *inode,
 264                 unsigned int ia_valid)
 265 {
 266         int error;
 267
 268         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID | ATTR_TIMES_SET)) {
 269                 if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
 270                         return -EPERM;
 271         }
 272
 273         /*
 274          * If utimes(2) and friends are called with times == NULL (or both
 275          * times are UTIME_NOW), then we need to check for write permission
 276          */
 277         if (ia_valid & ATTR_TOUCH) {
 278                 if (IS_IMMUTABLE(inode))
 279                         return -EPERM;
 280
 281                 if (!inode_owner_or_capable(mnt_userns, inode)) {
 282                         error = inode_permission(mnt_userns, inode, MAY_WRITE);
 283                         if (error)
 284                                 return error;
 285                 }
 286         }
 287         return 0;
 288 }
 289 EXPORT_SYMBOL(may_setattr);
 290
 291 /**
 292  * notify_change - modify attributes of a filesytem object
 293  * @mnt_userns: user namespace of the mount the inode was found from
 294  * @dentry:     object affected
 295  * @attr:       new attributes
 296  * @delegated_inode: returns inode, if the inode is delegated
 297  *
 298  * The caller must hold the i_mutex on the affected object.
 299  *
 300  * If notify_change discovers a delegation in need of breaking,
 301  * it will return -EWOULDBLOCK and return a reference to the inode in
 302  * delegated_inode.  The caller should then break the delegation and
 303  * retry.  Because breaking a delegation may take a long time, the
 304  * caller should drop the i_mutex before doing so.
 305  *
 306  * Alternatively, a caller may pass NULL for delegated_inode.  This may
 307  * be appropriate for callers that expect the underlying filesystem not
 308  * to be NFS exported.  Also, passing NULL is fine for callers holding
 309  * the file open for write, as there can be no conflicting delegation in
 310  * that case.
 311  *
 312  * If the inode has been found through an idmapped mount the user namespace of
 313  * the vfsmount must be passed through @mnt_userns. This function will then
 314  * take care to map the inode according to @mnt_userns before checking
 315  * permissions. On non-idmapped mounts or if permission checking is to be
 316  * performed on the raw inode simply passs init_user_ns.
 317  */
 318 int notify_change(struct user_namespace *mnt_userns, struct dentry *dentry,
 319                   struct iattr *attr, struct inode **delegated_inode)
 320 {
 321         struct inode *inode = dentry->d_inode;
 322         umode_t mode = inode->i_mode;
 323         int error;
 324         struct timespec64 now;
 325         unsigned int ia_valid = attr->ia_valid;
 326
 327         WARN_ON_ONCE(!inode_is_locked(inode));
 328
 329         error = may_setattr(mnt_userns, inode, ia_valid);
 330         if (error)
 331                 return error;
 332
 333         if ((ia_valid & ATTR_MODE)) {
 334                 umode_t amode = attr->ia_mode;
 335                 /* Flag setting protected by i_mutex */
 336                 if (is_sxid(amode))
 337                         inode->i_flags &= ~S_NOSEC;
 338         }
 339
 340         now = current_time(inode);
 341
 342         attr->ia_ctime = now;
 343         if (!(ia_valid & ATTR_ATIME_SET))
 344                 attr->ia_atime = now;
 345         else
 346                 attr->ia_atime = timestamp_truncate(attr->ia_atime, inode);
 347         if (!(ia_valid & ATTR_MTIME_SET))
 348                 attr->ia_mtime = now;
 349         else
 350                 attr->ia_mtime = timestamp_truncate(attr->ia_mtime, inode);
 351
 352         if (ia_valid & ATTR_KILL_PRIV) {
 353                 error = security_inode_need_killpriv(dentry);
 354                 if (error < 0)
 355                         return error;
 356                 if (error == 0)
 357                         ia_valid = attr->ia_valid &= ~ATTR_KILL_PRIV;
 358         }
 359
 360         /*
 361          * We now pass ATTR_KILL_S*ID to the lower level setattr function so
 362          * that the function has the ability to reinterpret a mode change
 363          * that's due to these bits. This adds an implicit restriction that
 364          * no function will ever call notify_change with both ATTR_MODE and
 365          * ATTR_KILL_S*ID set.
 366          */
 367         if ((ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) &&
 368             (ia_valid & ATTR_MODE))
 369                 BUG();
 370
 371         if (ia_valid & ATTR_KILL_SUID) {
 372                 if (mode & S_ISUID) {
 373                         ia_valid = attr->ia_valid |= ATTR_MODE;
 374                         attr->ia_mode = (inode->i_mode & ~S_ISUID);
 375                 }
 376         }
 377         if (ia_valid & ATTR_KILL_SGID) {
 378                 if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
 379                         if (!(ia_valid & ATTR_MODE)) {
 380                                 ia_valid = attr->ia_valid |= ATTR_MODE;
 381                                 attr->ia_mode = inode->i_mode;
 382                         }
 383                         attr->ia_mode &= ~S_ISGID;
 384                 }
 385         }
 386         if (!(attr->ia_valid & ~(ATTR_KILL_SUID | ATTR_KILL_SGID)))
 387                 return 0;
 388
 389         /*
 390          * Verify that uid/gid changes are valid in the target
 391          * namespace of the superblock.
 392          */
 393         if (ia_valid & ATTR_UID &&
 394             !vfsuid_has_fsmapping(mnt_userns, inode->i_sb->s_user_ns,
 395                                   attr->ia_vfsuid))
 396                 return -EOVERFLOW;
 397         if (ia_valid & ATTR_GID &&
 398             !vfsgid_has_fsmapping(mnt_userns, inode->i_sb->s_user_ns,
 399                                   attr->ia_vfsgid))
 400                 return -EOVERFLOW;
 401
 402         /* Don't allow modifications of files with invalid uids or
 403          * gids unless those uids & gids are being made valid.
 404          */
 405         if (!(ia_valid & ATTR_UID) &&
 406             !vfsuid_valid(i_uid_into_vfsuid(mnt_userns, inode)))
 407                 return -EOVERFLOW;
 408         if (!(ia_valid & ATTR_GID) &&
 409             !vfsgid_valid(i_gid_into_vfsgid(mnt_userns, inode)))
 410                 return -EOVERFLOW;
 411
 412         error = security_inode_setattr(mnt_userns, dentry, attr);
 413         if (error)
 414                 return error;
 415         error = try_break_deleg(inode, delegated_inode);
 416         if (error)
 417                 return error;
 418
 419         if (inode->i_op->setattr)
 420                 error = inode->i_op->setattr(mnt_userns, dentry, attr);
 421         else
 422                 error = simple_setattr(mnt_userns, dentry, attr);
 423
 424         if (!error) {
 425                 fsnotify_change(dentry, ia_valid);
 426                 ima_inode_post_setattr(mnt_userns, dentry);
 427                 evm_inode_post_setattr(dentry, ia_valid);
 428         }
 429
 430         return error;
 431 }
 432 EXPORT_SYMBOL(notify_change);