fs/mnt_idmapping.c

   1 // SPDX-License-Identifier: GPL-2.0
   2 /* Copyright (c) 2022 Christian Brauner <brauner@kernel.org> */
   3
   4 #include <linux/cred.h>
   5 #include <linux/fs.h>
   6 #include <linux/mnt_idmapping.h>
   7 #include <linux/slab.h>
   8 #include <linux/user_namespace.h>
   9
  10 #include "internal.h"
  11
  12 /*
  13  * Outside of this file vfs{g,u}id_t are always created from k{g,u}id_t,
  14  * never from raw values. These are just internal helpers.
  15  */
  16 #define VFSUIDT_INIT_RAW(val) (vfsuid_t){ val }
  17 #define VFSGIDT_INIT_RAW(val) (vfsgid_t){ val }
  18
  19 struct mnt_idmap {
  20         struct uid_gid_map uid_map;
  21         struct uid_gid_map gid_map;
  22         refcount_t count;
  23 };
  24
  25 /*
  26  * Carries the initial idmapping of 0:0:4294967295 which is an identity
  27  * mapping. This means that {g,u}id 0 is mapped to {g,u}id 0, {g,u}id 1 is
  28  * mapped to {g,u}id 1, [...], {g,u}id 1000 to {g,u}id 1000, [...].
  29  */
  30 struct mnt_idmap nop_mnt_idmap = {
  31         .count  = REFCOUNT_INIT(1),
  32 };
  33 EXPORT_SYMBOL_GPL(nop_mnt_idmap);
  34
  35 /**
  36  * initial_idmapping - check whether this is the initial mapping
  37  * @ns: idmapping to check
  38  *
  39  * Check whether this is the initial mapping, mapping 0 to 0, 1 to 1,
  40  * [...], 1000 to 1000 [...].
  41  *
  42  * Return: true if this is the initial mapping, false if not.
  43  */
  44 static inline bool initial_idmapping(const struct user_namespace *ns)
  45 {
  46         return ns == &init_user_ns;
  47 }
  48
  49 /**
  50  * make_vfsuid - map a filesystem kuid according to an idmapping
  51  * @idmap: the mount's idmapping
  52  * @fs_userns: the filesystem's idmapping
  53  * @kuid : kuid to be mapped
  54  *
  55  * Take a @kuid and remap it from @fs_userns into @idmap. Use this
  56  * function when preparing a @kuid to be reported to userspace.
  57  *
  58  * If initial_idmapping() determines that this is not an idmapped mount
  59  * we can simply return @kuid unchanged.
  60  * If initial_idmapping() tells us that the filesystem is not mounted with an
  61  * idmapping we know the value of @kuid won't change when calling
  62  * from_kuid() so we can simply retrieve the value via __kuid_val()
  63  * directly.
  64  *
  65  * Return: @kuid mapped according to @idmap.
  66  * If @kuid has no mapping in either @idmap or @fs_userns INVALID_UID is
  67  * returned.
  68  */
  69
  70 vfsuid_t make_vfsuid(struct mnt_idmap *idmap,
  71                      struct user_namespace *fs_userns,
  72                      kuid_t kuid)
  73 {
  74         uid_t uid;
  75
  76         if (idmap == &nop_mnt_idmap)
  77                 return VFSUIDT_INIT(kuid);
  78         if (initial_idmapping(fs_userns))
  79                 uid = __kuid_val(kuid);
  80         else
  81                 uid = from_kuid(fs_userns, kuid);
  82         if (uid == (uid_t)-1)
  83                 return INVALID_VFSUID;
  84         return VFSUIDT_INIT_RAW(map_id_down(&idmap->uid_map, uid));
  85 }
  86 EXPORT_SYMBOL_GPL(make_vfsuid);
  87
  88 /**
  89  * make_vfsgid - map a filesystem kgid according to an idmapping
  90  * @idmap: the mount's idmapping
  91  * @fs_userns: the filesystem's idmapping
  92  * @kgid : kgid to be mapped
  93  *
  94  * Take a @kgid and remap it from @fs_userns into @idmap. Use this
  95  * function when preparing a @kgid to be reported to userspace.
  96  *
  97  * If initial_idmapping() determines that this is not an idmapped mount
  98  * we can simply return @kgid unchanged.
  99  * If initial_idmapping() tells us that the filesystem is not mounted with an
 100  * idmapping we know the value of @kgid won't change when calling
 101  * from_kgid() so we can simply retrieve the value via __kgid_val()
 102  * directly.
 103  *
 104  * Return: @kgid mapped according to @idmap.
 105  * If @kgid has no mapping in either @idmap or @fs_userns INVALID_GID is
 106  * returned.
 107  */
 108 vfsgid_t make_vfsgid(struct mnt_idmap *idmap,
 109                      struct user_namespace *fs_userns, kgid_t kgid)
 110 {
 111         gid_t gid;
 112
 113         if (idmap == &nop_mnt_idmap)
 114                 return VFSGIDT_INIT(kgid);
 115         if (initial_idmapping(fs_userns))
 116                 gid = __kgid_val(kgid);
 117         else
 118                 gid = from_kgid(fs_userns, kgid);
 119         if (gid == (gid_t)-1)
 120                 return INVALID_VFSGID;
 121         return VFSGIDT_INIT_RAW(map_id_down(&idmap->gid_map, gid));
 122 }
 123 EXPORT_SYMBOL_GPL(make_vfsgid);
 124
 125 /**
 126  * from_vfsuid - map a vfsuid into the filesystem idmapping
 127  * @idmap: the mount's idmapping
 128  * @fs_userns: the filesystem's idmapping
 129  * @vfsuid : vfsuid to be mapped
 130  *
 131  * Map @vfsuid into the filesystem idmapping. This function has to be used in
 132  * order to e.g. write @vfsuid to inode->i_uid.
 133  *
 134  * Return: @vfsuid mapped into the filesystem idmapping
 135  */
 136 kuid_t from_vfsuid(struct mnt_idmap *idmap,
 137                    struct user_namespace *fs_userns, vfsuid_t vfsuid)
 138 {
 139         uid_t uid;
 140
 141         if (idmap == &nop_mnt_idmap)
 142                 return AS_KUIDT(vfsuid);
 143         uid = map_id_up(&idmap->uid_map, __vfsuid_val(vfsuid));
 144         if (uid == (uid_t)-1)
 145                 return INVALID_UID;
 146         if (initial_idmapping(fs_userns))
 147                 return KUIDT_INIT(uid);
 148         return make_kuid(fs_userns, uid);
 149 }
 150 EXPORT_SYMBOL_GPL(from_vfsuid);
 151
 152 /**
 153  * from_vfsgid - map a vfsgid into the filesystem idmapping
 154  * @idmap: the mount's idmapping
 155  * @fs_userns: the filesystem's idmapping
 156  * @vfsgid : vfsgid to be mapped
 157  *
 158  * Map @vfsgid into the filesystem idmapping. This function has to be used in
 159  * order to e.g. write @vfsgid to inode->i_gid.
 160  *
 161  * Return: @vfsgid mapped into the filesystem idmapping
 162  */
 163 kgid_t from_vfsgid(struct mnt_idmap *idmap,
 164                    struct user_namespace *fs_userns, vfsgid_t vfsgid)
 165 {
 166         gid_t gid;
 167
 168         if (idmap == &nop_mnt_idmap)
 169                 return AS_KGIDT(vfsgid);
 170         gid = map_id_up(&idmap->gid_map, __vfsgid_val(vfsgid));
 171         if (gid == (gid_t)-1)
 172                 return INVALID_GID;
 173         if (initial_idmapping(fs_userns))
 174                 return KGIDT_INIT(gid);
 175         return make_kgid(fs_userns, gid);
 176 }
 177 EXPORT_SYMBOL_GPL(from_vfsgid);
 178
 179 #ifdef CONFIG_MULTIUSER
 180 /**
 181  * vfsgid_in_group_p() - check whether a vfsuid matches the caller's groups
 182  * @vfsgid: the mnt gid to match
 183  *
 184  * This function can be used to determine whether @vfsuid matches any of the
 185  * caller's groups.
 186  *
 187  * Return: 1 if vfsuid matches caller's groups, 0 if not.
 188  */
 189 int vfsgid_in_group_p(vfsgid_t vfsgid)
 190 {
 191         return in_group_p(AS_KGIDT(vfsgid));
 192 }
 193 #else
 194 int vfsgid_in_group_p(vfsgid_t vfsgid)
 195 {
 196         return 1;
 197 }
 198 #endif
 199 EXPORT_SYMBOL_GPL(vfsgid_in_group_p);
 200
 201 static int copy_mnt_idmap(struct uid_gid_map *map_from,
 202                           struct uid_gid_map *map_to)
 203 {
 204         struct uid_gid_extent *forward, *reverse;
 205         u32 nr_extents = READ_ONCE(map_from->nr_extents);
 206         /* Pairs with smp_wmb() when writing the idmapping. */
 207         smp_rmb();
 208
 209         /*
 210          * Don't blindly copy @map_to into @map_from if nr_extents is
 211          * smaller or equal to UID_GID_MAP_MAX_BASE_EXTENTS. Since we
 212          * read @nr_extents someone could have written an idmapping and
 213          * then we might end up with inconsistent data. So just don't do
 214          * anything at all.
 215          */
 216         if (nr_extents == 0)
 217                 return 0;
 218
 219         /*
 220          * Here we know that nr_extents is greater than zero which means
 221          * a map has been written. Since idmappings can't be changed
 222          * once they have been written we know that we can safely copy
 223          * from @map_to into @map_from.
 224          */
 225
 226         if (nr_extents <= UID_GID_MAP_MAX_BASE_EXTENTS) {
 227                 *map_to = *map_from;
 228                 return 0;
 229         }
 230
 231         forward = kmemdup(map_from->forward,
 232                           nr_extents * sizeof(struct uid_gid_extent),
 233                           GFP_KERNEL_ACCOUNT);
 234         if (!forward)
 235                 return -ENOMEM;
 236
 237         reverse = kmemdup(map_from->reverse,
 238                           nr_extents * sizeof(struct uid_gid_extent),
 239                           GFP_KERNEL_ACCOUNT);
 240         if (!reverse) {
 241                 kfree(forward);
 242                 return -ENOMEM;
 243         }
 244
 245         /*
 246          * The idmapping isn't exposed anywhere so we don't need to care
 247          * about ordering between extent pointers and @nr_extents
 248          * initialization.
 249          */
 250         map_to->forward = forward;
 251         map_to->reverse = reverse;
 252         map_to->nr_extents = nr_extents;
 253         return 0;
 254 }
 255
 256 static void free_mnt_idmap(struct mnt_idmap *idmap)
 257 {
 258         if (idmap->uid_map.nr_extents > UID_GID_MAP_MAX_BASE_EXTENTS) {
 259                 kfree(idmap->uid_map.forward);
 260                 kfree(idmap->uid_map.reverse);
 261         }
 262         if (idmap->gid_map.nr_extents > UID_GID_MAP_MAX_BASE_EXTENTS) {
 263                 kfree(idmap->gid_map.forward);
 264                 kfree(idmap->gid_map.reverse);
 265         }
 266         kfree(idmap);
 267 }
 268
 269 struct mnt_idmap *alloc_mnt_idmap(struct user_namespace *mnt_userns)
 270 {
 271         struct mnt_idmap *idmap;
 272         int ret;
 273
 274         idmap = kzalloc(sizeof(struct mnt_idmap), GFP_KERNEL_ACCOUNT);
 275         if (!idmap)
 276                 return ERR_PTR(-ENOMEM);
 277
 278         refcount_set(&idmap->count, 1);
 279         ret = copy_mnt_idmap(&mnt_userns->uid_map, &idmap->uid_map);
 280         if (!ret)
 281                 ret = copy_mnt_idmap(&mnt_userns->gid_map, &idmap->gid_map);
 282         if (ret) {
 283                 free_mnt_idmap(idmap);
 284                 idmap = ERR_PTR(ret);
 285         }
 286         return idmap;
 287 }
 288
 289 /**
 290  * mnt_idmap_get - get a reference to an idmapping
 291  * @idmap: the idmap to bump the reference on
 292  *
 293  * If @idmap is not the @nop_mnt_idmap bump the reference count.
 294  *
 295  * Return: @idmap with reference count bumped if @not_mnt_idmap isn't passed.
 296  */
 297 struct mnt_idmap *mnt_idmap_get(struct mnt_idmap *idmap)
 298 {
 299         if (idmap != &nop_mnt_idmap)
 300                 refcount_inc(&idmap->count);
 301
 302         return idmap;
 303 }
 304 EXPORT_SYMBOL_GPL(mnt_idmap_get);
 305
 306 /**
 307  * mnt_idmap_put - put a reference to an idmapping
 308  * @idmap: the idmap to put the reference on
 309  *
 310  * If this is a non-initial idmapping, put the reference count when a mount is
 311  * released and free it if we're the last user.
 312  */
 313 void mnt_idmap_put(struct mnt_idmap *idmap)
 314 {
 315         if (idmap != &nop_mnt_idmap && refcount_dec_and_test(&idmap->count))
 316                 free_mnt_idmap(idmap);
 317 }
 318 EXPORT_SYMBOL_GPL(mnt_idmap_put);