1 // SPDX-License-Identifier: GPL-2.0-only
4 * Copyright (C) 2011 Novell Inc.
8 #include <linux/slab.h>
9 #include <linux/cred.h>
10 #include <linux/xattr.h>
11 #include <linux/posix_acl.h>
12 #include <linux/ratelimit.h>
13 #include <linux/fiemap.h>
14 #include <linux/fileattr.h>
15 #include <linux/security.h>
16 #include <linux/namei.h>
17 #include <linux/posix_acl.h>
18 #include <linux/posix_acl_xattr.h>
19 #include "overlayfs.h"
22 int ovl_setattr(struct mnt_idmap
*idmap
, struct dentry
*dentry
,
26 struct ovl_fs
*ofs
= OVL_FS(dentry
->d_sb
);
27 bool full_copy_up
= false;
28 struct dentry
*upperdentry
;
29 const struct cred
*old_cred
;
31 err
= setattr_prepare(&nop_mnt_idmap
, dentry
, attr
);
35 err
= ovl_want_write(dentry
);
39 if (attr
->ia_valid
& ATTR_SIZE
) {
40 /* Truncate should trigger data copy up as well */
45 err
= ovl_copy_up(dentry
);
47 err
= ovl_copy_up_with_data(dentry
);
49 struct inode
*winode
= NULL
;
51 upperdentry
= ovl_dentry_upper(dentry
);
53 if (attr
->ia_valid
& ATTR_SIZE
) {
54 winode
= d_inode(upperdentry
);
55 err
= get_write_access(winode
);
60 if (attr
->ia_valid
& (ATTR_KILL_SUID
|ATTR_KILL_SGID
))
61 attr
->ia_valid
&= ~ATTR_MODE
;
64 * We might have to translate ovl file into real file object
65 * once use cases emerge. For now, simply don't let underlying
66 * filesystem rely on attr->ia_file
68 attr
->ia_valid
&= ~ATTR_FILE
;
71 * If open(O_TRUNC) is done, VFS calls ->setattr with ATTR_OPEN
72 * set. Overlayfs does not pass O_TRUNC flag to underlying
73 * filesystem during open -> do not pass ATTR_OPEN. This
74 * disables optimization in fuse which assumes open(O_TRUNC)
75 * already set file size to 0. But we never passed O_TRUNC to
76 * fuse. So by clearing ATTR_OPEN, fuse will be forced to send
77 * setattr request to server.
79 attr
->ia_valid
&= ~ATTR_OPEN
;
81 inode_lock(upperdentry
->d_inode
);
82 old_cred
= ovl_override_creds(dentry
->d_sb
);
83 err
= ovl_do_notify_change(ofs
, upperdentry
, attr
);
84 revert_creds(old_cred
);
86 ovl_copyattr(dentry
->d_inode
);
87 inode_unlock(upperdentry
->d_inode
);
90 put_write_access(winode
);
93 ovl_drop_write(dentry
);
98 static void ovl_map_dev_ino(struct dentry
*dentry
, struct kstat
*stat
, int fsid
)
100 bool samefs
= ovl_same_fs(dentry
->d_sb
);
101 unsigned int xinobits
= ovl_xino_bits(dentry
->d_sb
);
102 unsigned int xinoshift
= 64 - xinobits
;
106 * When all layers are on the same fs, all real inode
107 * number are unique, so we use the overlay st_dev,
108 * which is friendly to du -x.
110 stat
->dev
= dentry
->d_sb
->s_dev
;
112 } else if (xinobits
) {
114 * All inode numbers of underlying fs should not be using the
115 * high xinobits, so we use high xinobits to partition the
116 * overlay st_ino address space. The high bits holds the fsid
117 * (upper fsid is 0). The lowest xinobit is reserved for mapping
118 * the non-persistent inode numbers range in case of overflow.
119 * This way all overlay inode numbers are unique and use the
122 if (likely(!(stat
->ino
>> xinoshift
))) {
123 stat
->ino
|= ((u64
)fsid
) << (xinoshift
+ 1);
124 stat
->dev
= dentry
->d_sb
->s_dev
;
126 } else if (ovl_xino_warn(dentry
->d_sb
)) {
127 pr_warn_ratelimited("inode number too big (%pd2, ino=%llu, xinobits=%d)\n",
128 dentry
, stat
->ino
, xinobits
);
132 /* The inode could not be mapped to a unified st_ino address space */
133 if (S_ISDIR(dentry
->d_inode
->i_mode
)) {
135 * Always use the overlay st_dev for directories, so 'find
136 * -xdev' will scan the entire overlay mount and won't cross the
137 * overlay mount boundaries.
139 * If not all layers are on the same fs the pair {real st_ino;
140 * overlay st_dev} is not unique, so use the non persistent
141 * overlay st_ino for directories.
143 stat
->dev
= dentry
->d_sb
->s_dev
;
144 stat
->ino
= dentry
->d_inode
->i_ino
;
147 * For non-samefs setup, if we cannot map all layers st_ino
148 * to a unified address space, we need to make sure that st_dev
149 * is unique per underlying fs, so we use the unique anonymous
150 * bdev assigned to the underlying fs.
152 stat
->dev
= OVL_FS(dentry
->d_sb
)->fs
[fsid
].pseudo_dev
;
156 int ovl_getattr(struct mnt_idmap
*idmap
, const struct path
*path
,
157 struct kstat
*stat
, u32 request_mask
, unsigned int flags
)
159 struct dentry
*dentry
= path
->dentry
;
160 enum ovl_path_type type
;
161 struct path realpath
;
162 const struct cred
*old_cred
;
163 struct inode
*inode
= d_inode(dentry
);
164 bool is_dir
= S_ISDIR(inode
->i_mode
);
167 bool metacopy_blocks
= false;
169 metacopy_blocks
= ovl_is_metacopy_dentry(dentry
);
171 type
= ovl_path_real(dentry
, &realpath
);
172 old_cred
= ovl_override_creds(dentry
->d_sb
);
173 err
= vfs_getattr(&realpath
, stat
, request_mask
, flags
);
177 /* Report the effective immutable/append-only STATX flags */
178 generic_fill_statx_attr(inode
, stat
);
181 * For non-dir or same fs, we use st_ino of the copy up origin.
182 * This guaranties constant st_dev/st_ino across copy up.
183 * With xino feature and non-samefs, we use st_ino of the copy up
184 * origin masked with high bits that represent the layer id.
186 * If lower filesystem supports NFS file handles, this also guaranties
187 * persistent st_ino across mount cycle.
189 if (!is_dir
|| ovl_same_dev(dentry
->d_sb
)) {
190 if (!OVL_TYPE_UPPER(type
)) {
191 fsid
= ovl_layer_lower(dentry
)->fsid
;
192 } else if (OVL_TYPE_ORIGIN(type
)) {
193 struct kstat lowerstat
;
194 u32 lowermask
= STATX_INO
| STATX_BLOCKS
|
195 (!is_dir
? STATX_NLINK
: 0);
197 ovl_path_lower(dentry
, &realpath
);
198 err
= vfs_getattr(&realpath
, &lowerstat
,
204 * Lower hardlinks may be broken on copy up to different
205 * upper files, so we cannot use the lower origin st_ino
206 * for those different files, even for the same fs case.
208 * Similarly, several redirected dirs can point to the
209 * same dir on a lower layer. With the "verify_lower"
210 * feature, we do not use the lower origin st_ino, if
211 * we haven't verified that this redirect is unique.
213 * With inodes index enabled, it is safe to use st_ino
214 * of an indexed origin. The index validates that the
215 * upper hardlink is not broken and that a redirected
216 * dir is the only redirect to that origin.
218 if (ovl_test_flag(OVL_INDEX
, d_inode(dentry
)) ||
219 (!ovl_verify_lower(dentry
->d_sb
) &&
220 (is_dir
|| lowerstat
.nlink
== 1))) {
221 fsid
= ovl_layer_lower(dentry
)->fsid
;
222 stat
->ino
= lowerstat
.ino
;
226 * If we are querying a metacopy dentry and lower
227 * dentry is data dentry, then use the blocks we
228 * queried just now. We don't have to do additional
229 * vfs_getattr(). If lower itself is metacopy, then
230 * additional vfs_getattr() is unavoidable.
232 if (metacopy_blocks
&&
233 realpath
.dentry
== ovl_dentry_lowerdata(dentry
)) {
234 stat
->blocks
= lowerstat
.blocks
;
235 metacopy_blocks
= false;
239 if (metacopy_blocks
) {
241 * If lower is not same as lowerdata or if there was
242 * no origin on upper, we can end up here.
244 struct kstat lowerdatastat
;
245 u32 lowermask
= STATX_BLOCKS
;
247 ovl_path_lowerdata(dentry
, &realpath
);
248 err
= vfs_getattr(&realpath
, &lowerdatastat
,
252 stat
->blocks
= lowerdatastat
.blocks
;
256 ovl_map_dev_ino(dentry
, stat
, fsid
);
259 * It's probably not worth it to count subdirs to get the
260 * correct link count. nlink=1 seems to pacify 'find' and
263 if (is_dir
&& OVL_TYPE_MERGE(type
))
267 * Return the overlay inode nlinks for indexed upper inodes.
268 * Overlay inode nlink counts the union of the upper hardlinks
269 * and non-covered lower hardlinks. It does not include the upper
272 if (!is_dir
&& ovl_test_flag(OVL_INDEX
, d_inode(dentry
)))
273 stat
->nlink
= dentry
->d_inode
->i_nlink
;
276 revert_creds(old_cred
);
281 int ovl_permission(struct mnt_idmap
*idmap
,
282 struct inode
*inode
, int mask
)
284 struct inode
*upperinode
= ovl_inode_upper(inode
);
285 struct inode
*realinode
;
286 struct path realpath
;
287 const struct cred
*old_cred
;
290 /* Careful in RCU walk mode */
291 ovl_i_path_real(inode
, &realpath
);
292 if (!realpath
.dentry
) {
293 WARN_ON(!(mask
& MAY_NOT_BLOCK
));
298 * Check overlay inode with the creds of task and underlying inode
299 * with creds of mounter
301 err
= generic_permission(&nop_mnt_idmap
, inode
, mask
);
305 realinode
= d_inode(realpath
.dentry
);
306 old_cred
= ovl_override_creds(inode
->i_sb
);
308 !special_file(realinode
->i_mode
) && mask
& MAY_WRITE
) {
309 mask
&= ~(MAY_WRITE
| MAY_APPEND
);
310 /* Make sure mounter can read file for copy up later */
313 err
= inode_permission(mnt_idmap(realpath
.mnt
), realinode
, mask
);
314 revert_creds(old_cred
);
319 static const char *ovl_get_link(struct dentry
*dentry
,
321 struct delayed_call
*done
)
323 const struct cred
*old_cred
;
327 return ERR_PTR(-ECHILD
);
329 old_cred
= ovl_override_creds(dentry
->d_sb
);
330 p
= vfs_get_link(ovl_dentry_real(dentry
), done
);
331 revert_creds(old_cred
);
335 bool ovl_is_private_xattr(struct super_block
*sb
, const char *name
)
337 struct ovl_fs
*ofs
= sb
->s_fs_info
;
339 if (ofs
->config
.userxattr
)
340 return strncmp(name
, OVL_XATTR_USER_PREFIX
,
341 sizeof(OVL_XATTR_USER_PREFIX
) - 1) == 0;
343 return strncmp(name
, OVL_XATTR_TRUSTED_PREFIX
,
344 sizeof(OVL_XATTR_TRUSTED_PREFIX
) - 1) == 0;
347 int ovl_xattr_set(struct dentry
*dentry
, struct inode
*inode
, const char *name
,
348 const void *value
, size_t size
, int flags
)
351 struct ovl_fs
*ofs
= OVL_FS(dentry
->d_sb
);
352 struct dentry
*upperdentry
= ovl_i_dentry_upper(inode
);
353 struct dentry
*realdentry
= upperdentry
?: ovl_dentry_lower(dentry
);
354 struct path realpath
;
355 const struct cred
*old_cred
;
357 err
= ovl_want_write(dentry
);
361 if (!value
&& !upperdentry
) {
362 ovl_path_lower(dentry
, &realpath
);
363 old_cred
= ovl_override_creds(dentry
->d_sb
);
364 err
= vfs_getxattr(mnt_idmap(realpath
.mnt
), realdentry
, name
, NULL
, 0);
365 revert_creds(old_cred
);
371 err
= ovl_copy_up(dentry
);
375 realdentry
= ovl_dentry_upper(dentry
);
378 old_cred
= ovl_override_creds(dentry
->d_sb
);
380 err
= ovl_do_setxattr(ofs
, realdentry
, name
, value
, size
,
383 WARN_ON(flags
!= XATTR_REPLACE
);
384 err
= ovl_do_removexattr(ofs
, realdentry
, name
);
386 revert_creds(old_cred
);
392 ovl_drop_write(dentry
);
397 int ovl_xattr_get(struct dentry
*dentry
, struct inode
*inode
, const char *name
,
398 void *value
, size_t size
)
401 const struct cred
*old_cred
;
402 struct path realpath
;
404 ovl_i_path_real(inode
, &realpath
);
405 old_cred
= ovl_override_creds(dentry
->d_sb
);
406 res
= vfs_getxattr(mnt_idmap(realpath
.mnt
), realpath
.dentry
, name
, value
, size
);
407 revert_creds(old_cred
);
411 static bool ovl_can_list(struct super_block
*sb
, const char *s
)
413 /* Never list private (.overlay) */
414 if (ovl_is_private_xattr(sb
, s
))
417 /* List all non-trusted xattrs */
418 if (strncmp(s
, XATTR_TRUSTED_PREFIX
, XATTR_TRUSTED_PREFIX_LEN
) != 0)
421 /* list other trusted for superuser only */
422 return ns_capable_noaudit(&init_user_ns
, CAP_SYS_ADMIN
);
425 ssize_t
ovl_listxattr(struct dentry
*dentry
, char *list
, size_t size
)
427 struct dentry
*realdentry
= ovl_dentry_real(dentry
);
431 const struct cred
*old_cred
;
433 old_cred
= ovl_override_creds(dentry
->d_sb
);
434 res
= vfs_listxattr(realdentry
, list
, size
);
435 revert_creds(old_cred
);
436 if (res
<= 0 || size
== 0)
439 /* filter out private xattrs */
440 for (s
= list
, len
= res
; len
;) {
441 size_t slen
= strnlen(s
, len
) + 1;
443 /* underlying fs providing us with an broken xattr list? */
444 if (WARN_ON(slen
> len
))
448 if (!ovl_can_list(dentry
->d_sb
, s
)) {
450 memmove(s
, s
+ slen
, len
);
459 #ifdef CONFIG_FS_POSIX_ACL
461 * Apply the idmapping of the layer to POSIX ACLs. The caller must pass a clone
462 * of the POSIX ACLs retrieved from the lower layer to this function to not
463 * alter the POSIX ACLs for the underlying filesystem.
465 static void ovl_idmap_posix_acl(const struct inode
*realinode
,
466 struct mnt_idmap
*idmap
,
467 struct posix_acl
*acl
)
469 struct user_namespace
*fs_userns
= i_user_ns(realinode
);
471 for (unsigned int i
= 0; i
< acl
->a_count
; i
++) {
475 struct posix_acl_entry
*e
= &acl
->a_entries
[i
];
478 vfsuid
= make_vfsuid(idmap
, fs_userns
, e
->e_uid
);
479 e
->e_uid
= vfsuid_into_kuid(vfsuid
);
482 vfsgid
= make_vfsgid(idmap
, fs_userns
, e
->e_gid
);
483 e
->e_gid
= vfsgid_into_kgid(vfsgid
);
490 * The @noperm argument is used to skip permission checking and is a temporary
491 * measure. Quoting Miklos from an earlier discussion:
493 * > So there are two paths to getting an acl:
494 * > 1) permission checking and 2) retrieving the value via getxattr(2).
495 * > This is a similar situation as reading a symlink vs. following it.
496 * > When following a symlink overlayfs always reads the link on the
497 * > underlying fs just as if it was a readlink(2) call, calling
498 * > security_inode_readlink() instead of security_inode_follow_link().
499 * > This is logical: we are reading the link from the underlying storage,
500 * > and following it on overlayfs.
502 * > Applying the same logic to acl: we do need to call the
503 * > security_inode_getxattr() on the underlying fs, even if just want to
504 * > check permissions on overlay. This is currently not done, which is an
507 * > Maybe adding the check to ovl_get_acl() is the right way to go, but
508 * > I'm a little afraid of a performance regression. Will look into that.
510 * Until we have made a decision allow this helper to take the @noperm
511 * argument. We should hopefully be able to remove it soon.
513 struct posix_acl
*ovl_get_acl_path(const struct path
*path
,
514 const char *acl_name
, bool noperm
)
516 struct posix_acl
*real_acl
, *clone
;
517 struct mnt_idmap
*idmap
;
518 struct inode
*realinode
= d_inode(path
->dentry
);
520 idmap
= mnt_idmap(path
->mnt
);
523 real_acl
= get_inode_acl(realinode
, posix_acl_type(acl_name
));
525 real_acl
= vfs_get_acl(idmap
, path
->dentry
, acl_name
);
526 if (IS_ERR_OR_NULL(real_acl
))
529 if (!is_idmapped_mnt(path
->mnt
))
533 * We cannot alter the ACLs returned from the relevant layer as that
534 * would alter the cached values filesystem wide for the lower
535 * filesystem. Instead we can clone the ACLs and then apply the
536 * relevant idmapping of the layer.
538 clone
= posix_acl_clone(real_acl
, GFP_KERNEL
);
539 posix_acl_release(real_acl
); /* release original acl */
541 return ERR_PTR(-ENOMEM
);
543 ovl_idmap_posix_acl(realinode
, idmap
, clone
);
548 * When the relevant layer is an idmapped mount we need to take the idmapping
549 * of the layer into account and translate any ACL_{GROUP,USER} values
550 * according to the idmapped mount.
552 * We cannot alter the ACLs returned from the relevant layer as that would
553 * alter the cached values filesystem wide for the lower filesystem. Instead we
554 * can clone the ACLs and then apply the relevant idmapping of the layer.
556 * This is obviously only relevant when idmapped layers are used.
558 struct posix_acl
*do_ovl_get_acl(struct mnt_idmap
*idmap
,
559 struct inode
*inode
, int type
,
560 bool rcu
, bool noperm
)
562 struct inode
*realinode
= ovl_inode_real(inode
);
563 struct posix_acl
*acl
;
564 struct path realpath
;
566 if (!IS_POSIXACL(realinode
))
569 /* Careful in RCU walk mode */
570 ovl_i_path_real(inode
, &realpath
);
571 if (!realpath
.dentry
) {
573 return ERR_PTR(-ECHILD
);
578 * If the layer is idmapped drop out of RCU path walk
579 * so we can clone the ACLs.
581 if (is_idmapped_mnt(realpath
.mnt
))
582 return ERR_PTR(-ECHILD
);
584 acl
= get_cached_acl_rcu(realinode
, type
);
586 const struct cred
*old_cred
;
588 old_cred
= ovl_override_creds(inode
->i_sb
);
589 acl
= ovl_get_acl_path(&realpath
, posix_acl_xattr_name(type
), noperm
);
590 revert_creds(old_cred
);
596 static int ovl_set_or_remove_acl(struct dentry
*dentry
, struct inode
*inode
,
597 struct posix_acl
*acl
, int type
)
600 struct path realpath
;
601 const char *acl_name
;
602 const struct cred
*old_cred
;
603 struct ovl_fs
*ofs
= OVL_FS(dentry
->d_sb
);
604 struct dentry
*upperdentry
= ovl_dentry_upper(dentry
);
605 struct dentry
*realdentry
= upperdentry
?: ovl_dentry_lower(dentry
);
607 err
= ovl_want_write(dentry
);
612 * If ACL is to be removed from a lower file, check if it exists in
613 * the first place before copying it up.
615 acl_name
= posix_acl_xattr_name(type
);
616 if (!acl
&& !upperdentry
) {
617 struct posix_acl
*real_acl
;
619 ovl_path_lower(dentry
, &realpath
);
620 old_cred
= ovl_override_creds(dentry
->d_sb
);
621 real_acl
= vfs_get_acl(mnt_idmap(realpath
.mnt
), realdentry
,
623 revert_creds(old_cred
);
624 if (IS_ERR(real_acl
)) {
625 err
= PTR_ERR(real_acl
);
628 posix_acl_release(real_acl
);
632 err
= ovl_copy_up(dentry
);
636 realdentry
= ovl_dentry_upper(dentry
);
639 old_cred
= ovl_override_creds(dentry
->d_sb
);
641 err
= ovl_do_set_acl(ofs
, realdentry
, acl_name
, acl
);
643 err
= ovl_do_remove_acl(ofs
, realdentry
, acl_name
);
644 revert_creds(old_cred
);
650 ovl_drop_write(dentry
);
654 int ovl_set_acl(struct mnt_idmap
*idmap
, struct dentry
*dentry
,
655 struct posix_acl
*acl
, int type
)
658 struct inode
*inode
= d_inode(dentry
);
659 struct dentry
*workdir
= ovl_workdir(dentry
);
660 struct inode
*realinode
= ovl_inode_real(inode
);
662 if (!IS_POSIXACL(d_inode(workdir
)))
664 if (!realinode
->i_op
->set_acl
)
666 if (type
== ACL_TYPE_DEFAULT
&& !S_ISDIR(inode
->i_mode
))
667 return acl
? -EACCES
: 0;
668 if (!inode_owner_or_capable(&nop_mnt_idmap
, inode
))
672 * Check if sgid bit needs to be cleared (actual setacl operation will
673 * be done with mounter's capabilities and so that won't do it for us).
675 if (unlikely(inode
->i_mode
& S_ISGID
) && type
== ACL_TYPE_ACCESS
&&
676 !in_group_p(inode
->i_gid
) &&
677 !capable_wrt_inode_uidgid(&nop_mnt_idmap
, inode
, CAP_FSETID
)) {
678 struct iattr iattr
= { .ia_valid
= ATTR_KILL_SGID
};
680 err
= ovl_setattr(&nop_mnt_idmap
, dentry
, &iattr
);
685 return ovl_set_or_remove_acl(dentry
, inode
, acl
, type
);
689 int ovl_update_time(struct inode
*inode
, struct timespec64
*ts
, int flags
)
691 if (flags
& S_ATIME
) {
692 struct ovl_fs
*ofs
= inode
->i_sb
->s_fs_info
;
693 struct path upperpath
= {
694 .mnt
= ovl_upper_mnt(ofs
),
695 .dentry
= ovl_upperdentry_dereference(OVL_I(inode
)),
698 if (upperpath
.dentry
) {
699 touch_atime(&upperpath
);
700 inode
->i_atime
= d_inode(upperpath
.dentry
)->i_atime
;
706 static int ovl_fiemap(struct inode
*inode
, struct fiemap_extent_info
*fieinfo
,
710 struct inode
*realinode
= ovl_inode_realdata(inode
);
711 const struct cred
*old_cred
;
713 if (!realinode
->i_op
->fiemap
)
716 old_cred
= ovl_override_creds(inode
->i_sb
);
717 err
= realinode
->i_op
->fiemap(realinode
, fieinfo
, start
, len
);
718 revert_creds(old_cred
);
724 * Work around the fact that security_file_ioctl() takes a file argument.
725 * Introducing security_inode_fileattr_get/set() hooks would solve this issue
728 static int ovl_security_fileattr(const struct path
*realpath
, struct fileattr
*fa
,
735 file
= dentry_open(realpath
, O_RDONLY
, current_cred());
737 return PTR_ERR(file
);
740 cmd
= fa
->fsx_valid
? FS_IOC_FSSETXATTR
: FS_IOC_SETFLAGS
;
742 cmd
= fa
->fsx_valid
? FS_IOC_FSGETXATTR
: FS_IOC_GETFLAGS
;
744 err
= security_file_ioctl(file
, cmd
, 0);
750 int ovl_real_fileattr_set(const struct path
*realpath
, struct fileattr
*fa
)
754 err
= ovl_security_fileattr(realpath
, fa
, true);
758 return vfs_fileattr_set(mnt_idmap(realpath
->mnt
), realpath
->dentry
, fa
);
761 int ovl_fileattr_set(struct mnt_idmap
*idmap
,
762 struct dentry
*dentry
, struct fileattr
*fa
)
764 struct inode
*inode
= d_inode(dentry
);
765 struct path upperpath
;
766 const struct cred
*old_cred
;
770 err
= ovl_want_write(dentry
);
774 err
= ovl_copy_up(dentry
);
776 ovl_path_real(dentry
, &upperpath
);
778 old_cred
= ovl_override_creds(inode
->i_sb
);
780 * Store immutable/append-only flags in xattr and clear them
781 * in upper fileattr (in case they were set by older kernel)
782 * so children of "ovl-immutable" directories lower aliases of
783 * "ovl-immutable" hardlinks could be copied up.
784 * Clear xattr when flags are cleared.
786 err
= ovl_set_protattr(inode
, upperpath
.dentry
, fa
);
788 err
= ovl_real_fileattr_set(&upperpath
, fa
);
789 revert_creds(old_cred
);
792 * Merge real inode flags with inode flags read from
793 * overlay.protattr xattr
795 flags
= ovl_inode_real(inode
)->i_flags
& OVL_COPY_I_FLAGS_MASK
;
797 BUILD_BUG_ON(OVL_PROT_I_FLAGS_MASK
& ~OVL_COPY_I_FLAGS_MASK
);
798 flags
|= inode
->i_flags
& OVL_PROT_I_FLAGS_MASK
;
799 inode_set_flags(inode
, flags
, OVL_COPY_I_FLAGS_MASK
);
804 ovl_drop_write(dentry
);
809 /* Convert inode protection flags to fileattr flags */
810 static void ovl_fileattr_prot_flags(struct inode
*inode
, struct fileattr
*fa
)
812 BUILD_BUG_ON(OVL_PROT_FS_FLAGS_MASK
& ~FS_COMMON_FL
);
813 BUILD_BUG_ON(OVL_PROT_FSX_FLAGS_MASK
& ~FS_XFLAG_COMMON
);
815 if (inode
->i_flags
& S_APPEND
) {
816 fa
->flags
|= FS_APPEND_FL
;
817 fa
->fsx_xflags
|= FS_XFLAG_APPEND
;
819 if (inode
->i_flags
& S_IMMUTABLE
) {
820 fa
->flags
|= FS_IMMUTABLE_FL
;
821 fa
->fsx_xflags
|= FS_XFLAG_IMMUTABLE
;
825 int ovl_real_fileattr_get(const struct path
*realpath
, struct fileattr
*fa
)
829 err
= ovl_security_fileattr(realpath
, fa
, false);
833 err
= vfs_fileattr_get(realpath
->dentry
, fa
);
834 if (err
== -ENOIOCTLCMD
)
839 int ovl_fileattr_get(struct dentry
*dentry
, struct fileattr
*fa
)
841 struct inode
*inode
= d_inode(dentry
);
842 struct path realpath
;
843 const struct cred
*old_cred
;
846 ovl_path_real(dentry
, &realpath
);
848 old_cred
= ovl_override_creds(inode
->i_sb
);
849 err
= ovl_real_fileattr_get(&realpath
, fa
);
850 ovl_fileattr_prot_flags(inode
, fa
);
851 revert_creds(old_cred
);
856 static const struct inode_operations ovl_file_inode_operations
= {
857 .setattr
= ovl_setattr
,
858 .permission
= ovl_permission
,
859 .getattr
= ovl_getattr
,
860 .listxattr
= ovl_listxattr
,
861 .get_inode_acl
= ovl_get_inode_acl
,
862 .get_acl
= ovl_get_acl
,
863 .set_acl
= ovl_set_acl
,
864 .update_time
= ovl_update_time
,
865 .fiemap
= ovl_fiemap
,
866 .fileattr_get
= ovl_fileattr_get
,
867 .fileattr_set
= ovl_fileattr_set
,
870 static const struct inode_operations ovl_symlink_inode_operations
= {
871 .setattr
= ovl_setattr
,
872 .get_link
= ovl_get_link
,
873 .getattr
= ovl_getattr
,
874 .listxattr
= ovl_listxattr
,
875 .update_time
= ovl_update_time
,
878 static const struct inode_operations ovl_special_inode_operations
= {
879 .setattr
= ovl_setattr
,
880 .permission
= ovl_permission
,
881 .getattr
= ovl_getattr
,
882 .listxattr
= ovl_listxattr
,
883 .get_inode_acl
= ovl_get_inode_acl
,
884 .get_acl
= ovl_get_acl
,
885 .set_acl
= ovl_set_acl
,
886 .update_time
= ovl_update_time
,
889 static const struct address_space_operations ovl_aops
= {
890 /* For O_DIRECT dentry_open() checks f_mapping->a_ops->direct_IO */
891 .direct_IO
= noop_direct_IO
,
895 * It is possible to stack overlayfs instance on top of another
896 * overlayfs instance as lower layer. We need to annotate the
897 * stackable i_mutex locks according to stack level of the super
898 * block instance. An overlayfs instance can never be in stack
899 * depth 0 (there is always a real fs below it). An overlayfs
900 * inode lock will use the lockdep annotation ovl_i_mutex_key[depth].
902 * For example, here is a snip from /proc/lockdep_chains after
903 * dir_iterate of nested overlayfs:
905 * [...] &ovl_i_mutex_dir_key[depth] (stack_depth=2)
906 * [...] &ovl_i_mutex_dir_key[depth]#2 (stack_depth=1)
907 * [...] &type->i_mutex_dir_key (stack_depth=0)
909 * Locking order w.r.t ovl_want_write() is important for nested overlayfs.
911 * This chain is valid:
912 * - inode->i_rwsem (inode_lock[2])
913 * - upper_mnt->mnt_sb->s_writers (ovl_want_write[0])
914 * - OVL_I(inode)->lock (ovl_inode_lock[2])
915 * - OVL_I(lowerinode)->lock (ovl_inode_lock[1])
917 * And this chain is valid:
918 * - inode->i_rwsem (inode_lock[2])
919 * - OVL_I(inode)->lock (ovl_inode_lock[2])
920 * - lowerinode->i_rwsem (inode_lock[1])
921 * - OVL_I(lowerinode)->lock (ovl_inode_lock[1])
923 * But lowerinode->i_rwsem SHOULD NOT be acquired while ovl_want_write() is
924 * held, because it is in reverse order of the non-nested case using the same
926 * - inode->i_rwsem (inode_lock[1])
927 * - upper_mnt->mnt_sb->s_writers (ovl_want_write[0])
928 * - OVL_I(inode)->lock (ovl_inode_lock[1])
930 #define OVL_MAX_NESTING FILESYSTEM_MAX_STACK_DEPTH
932 static inline void ovl_lockdep_annotate_inode_mutex_key(struct inode
*inode
)
934 #ifdef CONFIG_LOCKDEP
935 static struct lock_class_key ovl_i_mutex_key
[OVL_MAX_NESTING
];
936 static struct lock_class_key ovl_i_mutex_dir_key
[OVL_MAX_NESTING
];
937 static struct lock_class_key ovl_i_lock_key
[OVL_MAX_NESTING
];
939 int depth
= inode
->i_sb
->s_stack_depth
- 1;
941 if (WARN_ON_ONCE(depth
< 0 || depth
>= OVL_MAX_NESTING
))
944 if (S_ISDIR(inode
->i_mode
))
945 lockdep_set_class(&inode
->i_rwsem
, &ovl_i_mutex_dir_key
[depth
]);
947 lockdep_set_class(&inode
->i_rwsem
, &ovl_i_mutex_key
[depth
]);
949 lockdep_set_class(&OVL_I(inode
)->lock
, &ovl_i_lock_key
[depth
]);
953 static void ovl_next_ino(struct inode
*inode
)
955 struct ovl_fs
*ofs
= inode
->i_sb
->s_fs_info
;
957 inode
->i_ino
= atomic_long_inc_return(&ofs
->last_ino
);
958 if (unlikely(!inode
->i_ino
))
959 inode
->i_ino
= atomic_long_inc_return(&ofs
->last_ino
);
962 static void ovl_map_ino(struct inode
*inode
, unsigned long ino
, int fsid
)
964 int xinobits
= ovl_xino_bits(inode
->i_sb
);
965 unsigned int xinoshift
= 64 - xinobits
;
968 * When d_ino is consistent with st_ino (samefs or i_ino has enough
969 * bits to encode layer), set the same value used for st_ino to i_ino,
970 * so inode number exposed via /proc/locks and a like will be
971 * consistent with d_ino and st_ino values. An i_ino value inconsistent
972 * with d_ino also causes nfsd readdirplus to fail.
975 if (ovl_same_fs(inode
->i_sb
)) {
977 } else if (xinobits
&& likely(!(ino
>> xinoshift
))) {
978 inode
->i_ino
|= (unsigned long)fsid
<< (xinoshift
+ 1);
983 * For directory inodes on non-samefs with xino disabled or xino
984 * overflow, we allocate a non-persistent inode number, to be used for
985 * resolving st_ino collisions in ovl_map_dev_ino().
987 * To avoid ino collision with legitimate xino values from upper
988 * layer (fsid 0), use the lowest xinobit to map the non
989 * persistent inode numbers to the unified st_ino address space.
991 if (S_ISDIR(inode
->i_mode
)) {
994 inode
->i_ino
&= ~0UL >> xinobits
;
995 inode
->i_ino
|= 1UL << xinoshift
;
1000 void ovl_inode_init(struct inode
*inode
, struct ovl_inode_params
*oip
,
1001 unsigned long ino
, int fsid
)
1003 struct inode
*realinode
;
1004 struct ovl_inode
*oi
= OVL_I(inode
);
1006 if (oip
->upperdentry
)
1007 oi
->__upperdentry
= oip
->upperdentry
;
1008 if (oip
->lowerpath
&& oip
->lowerpath
->dentry
) {
1009 oi
->lowerpath
.dentry
= dget(oip
->lowerpath
->dentry
);
1010 oi
->lowerpath
.layer
= oip
->lowerpath
->layer
;
1013 oi
->lowerdata
= igrab(d_inode(oip
->lowerdata
));
1015 realinode
= ovl_inode_real(inode
);
1016 ovl_copyattr(inode
);
1017 ovl_copyflags(realinode
, inode
);
1018 ovl_map_ino(inode
, ino
, fsid
);
1021 static void ovl_fill_inode(struct inode
*inode
, umode_t mode
, dev_t rdev
)
1023 inode
->i_mode
= mode
;
1024 inode
->i_flags
|= S_NOCMTIME
;
1025 #ifdef CONFIG_FS_POSIX_ACL
1026 inode
->i_acl
= inode
->i_default_acl
= ACL_DONT_CACHE
;
1029 ovl_lockdep_annotate_inode_mutex_key(inode
);
1031 switch (mode
& S_IFMT
) {
1033 inode
->i_op
= &ovl_file_inode_operations
;
1034 inode
->i_fop
= &ovl_file_operations
;
1035 inode
->i_mapping
->a_ops
= &ovl_aops
;
1039 inode
->i_op
= &ovl_dir_inode_operations
;
1040 inode
->i_fop
= &ovl_dir_operations
;
1044 inode
->i_op
= &ovl_symlink_inode_operations
;
1048 inode
->i_op
= &ovl_special_inode_operations
;
1049 init_special_inode(inode
, mode
, rdev
);
1055 * With inodes index enabled, an overlay inode nlink counts the union of upper
1056 * hardlinks and non-covered lower hardlinks. During the lifetime of a non-pure
1057 * upper inode, the following nlink modifying operations can happen:
1059 * 1. Lower hardlink copy up
1060 * 2. Upper hardlink created, unlinked or renamed over
1061 * 3. Lower hardlink whiteout or renamed over
1063 * For the first, copy up case, the union nlink does not change, whether the
1064 * operation succeeds or fails, but the upper inode nlink may change.
1065 * Therefore, before copy up, we store the union nlink value relative to the
1066 * lower inode nlink in the index inode xattr .overlay.nlink.
1068 * For the second, upper hardlink case, the union nlink should be incremented
1069 * or decremented IFF the operation succeeds, aligned with nlink change of the
1070 * upper inode. Therefore, before link/unlink/rename, we store the union nlink
1071 * value relative to the upper inode nlink in the index inode.
1073 * For the last, lower cover up case, we simplify things by preceding the
1074 * whiteout or cover up with copy up. This makes sure that there is an index
1075 * upper inode where the nlink xattr can be stored before the copied up upper
1078 #define OVL_NLINK_ADD_UPPER (1 << 0)
1081 * On-disk format for indexed nlink:
1083 * nlink relative to the upper inode - "U[+-]NUM"
1084 * nlink relative to the lower inode - "L[+-]NUM"
1087 static int ovl_set_nlink_common(struct dentry
*dentry
,
1088 struct dentry
*realdentry
, const char *format
)
1090 struct inode
*inode
= d_inode(dentry
);
1091 struct inode
*realinode
= d_inode(realdentry
);
1095 len
= snprintf(buf
, sizeof(buf
), format
,
1096 (int) (inode
->i_nlink
- realinode
->i_nlink
));
1098 if (WARN_ON(len
>= sizeof(buf
)))
1101 return ovl_setxattr(OVL_FS(inode
->i_sb
), ovl_dentry_upper(dentry
),
1102 OVL_XATTR_NLINK
, buf
, len
);
1105 int ovl_set_nlink_upper(struct dentry
*dentry
)
1107 return ovl_set_nlink_common(dentry
, ovl_dentry_upper(dentry
), "U%+i");
1110 int ovl_set_nlink_lower(struct dentry
*dentry
)
1112 return ovl_set_nlink_common(dentry
, ovl_dentry_lower(dentry
), "L%+i");
1115 unsigned int ovl_get_nlink(struct ovl_fs
*ofs
, struct dentry
*lowerdentry
,
1116 struct dentry
*upperdentry
,
1117 unsigned int fallback
)
1124 if (!lowerdentry
|| !upperdentry
|| d_inode(lowerdentry
)->i_nlink
== 1)
1127 err
= ovl_getxattr_upper(ofs
, upperdentry
, OVL_XATTR_NLINK
,
1128 &buf
, sizeof(buf
) - 1);
1133 if ((buf
[0] != 'L' && buf
[0] != 'U') ||
1134 (buf
[1] != '+' && buf
[1] != '-'))
1137 err
= kstrtoint(buf
+ 1, 10, &nlink_diff
);
1141 nlink
= d_inode(buf
[0] == 'L' ? lowerdentry
: upperdentry
)->i_nlink
;
1142 nlink
+= nlink_diff
;
1150 pr_warn_ratelimited("failed to get index nlink (%pd2, err=%i)\n",
1155 struct inode
*ovl_new_inode(struct super_block
*sb
, umode_t mode
, dev_t rdev
)
1157 struct inode
*inode
;
1159 inode
= new_inode(sb
);
1161 ovl_fill_inode(inode
, mode
, rdev
);
1166 static int ovl_inode_test(struct inode
*inode
, void *data
)
1168 return inode
->i_private
== data
;
1171 static int ovl_inode_set(struct inode
*inode
, void *data
)
1173 inode
->i_private
= data
;
1177 static bool ovl_verify_inode(struct inode
*inode
, struct dentry
*lowerdentry
,
1178 struct dentry
*upperdentry
, bool strict
)
1181 * For directories, @strict verify from lookup path performs consistency
1182 * checks, so NULL lower/upper in dentry must match NULL lower/upper in
1183 * inode. Non @strict verify from NFS handle decode path passes NULL for
1184 * 'unknown' lower/upper.
1186 if (S_ISDIR(inode
->i_mode
) && strict
) {
1187 /* Real lower dir moved to upper layer under us? */
1188 if (!lowerdentry
&& ovl_inode_lower(inode
))
1191 /* Lookup of an uncovered redirect origin? */
1192 if (!upperdentry
&& ovl_inode_upper(inode
))
1197 * Allow non-NULL lower inode in ovl_inode even if lowerdentry is NULL.
1198 * This happens when finding a copied up overlay inode for a renamed
1199 * or hardlinked overlay dentry and lower dentry cannot be followed
1200 * by origin because lower fs does not support file handles.
1202 if (lowerdentry
&& ovl_inode_lower(inode
) != d_inode(lowerdentry
))
1206 * Allow non-NULL __upperdentry in inode even if upperdentry is NULL.
1207 * This happens when finding a lower alias for a copied up hard link.
1209 if (upperdentry
&& ovl_inode_upper(inode
) != d_inode(upperdentry
))
1215 struct inode
*ovl_lookup_inode(struct super_block
*sb
, struct dentry
*real
,
1218 struct inode
*inode
, *key
= d_inode(real
);
1220 inode
= ilookup5(sb
, (unsigned long) key
, ovl_inode_test
, key
);
1224 if (!ovl_verify_inode(inode
, is_upper
? NULL
: real
,
1225 is_upper
? real
: NULL
, false)) {
1227 return ERR_PTR(-ESTALE
);
1233 bool ovl_lookup_trap_inode(struct super_block
*sb
, struct dentry
*dir
)
1235 struct inode
*key
= d_inode(dir
);
1239 trap
= ilookup5(sb
, (unsigned long) key
, ovl_inode_test
, key
);
1243 res
= IS_DEADDIR(trap
) && !ovl_inode_upper(trap
) &&
1244 !ovl_inode_lower(trap
);
1251 * Create an inode cache entry for layer root dir, that will intentionally
1252 * fail ovl_verify_inode(), so any lookup that will find some layer root
1255 struct inode
*ovl_get_trap_inode(struct super_block
*sb
, struct dentry
*dir
)
1257 struct inode
*key
= d_inode(dir
);
1261 return ERR_PTR(-ENOTDIR
);
1263 trap
= iget5_locked(sb
, (unsigned long) key
, ovl_inode_test
,
1264 ovl_inode_set
, key
);
1266 return ERR_PTR(-ENOMEM
);
1268 if (!(trap
->i_state
& I_NEW
)) {
1269 /* Conflicting layer roots? */
1271 return ERR_PTR(-ELOOP
);
1274 trap
->i_mode
= S_IFDIR
;
1275 trap
->i_flags
= S_DEAD
;
1276 unlock_new_inode(trap
);
1282 * Does overlay inode need to be hashed by lower inode?
1284 static bool ovl_hash_bylower(struct super_block
*sb
, struct dentry
*upper
,
1285 struct dentry
*lower
, bool index
)
1287 struct ovl_fs
*ofs
= sb
->s_fs_info
;
1289 /* No, if pure upper */
1293 /* Yes, if already indexed */
1297 /* Yes, if won't be copied up */
1298 if (!ovl_upper_mnt(ofs
))
1301 /* No, if lower hardlink is or will be broken on copy up */
1302 if ((upper
|| !ovl_indexdir(sb
)) &&
1303 !d_is_dir(lower
) && d_inode(lower
)->i_nlink
> 1)
1306 /* No, if non-indexed upper with NFS export */
1307 if (sb
->s_export_op
&& upper
)
1310 /* Otherwise, hash by lower inode for fsnotify */
1314 static struct inode
*ovl_iget5(struct super_block
*sb
, struct inode
*newinode
,
1317 return newinode
? inode_insert5(newinode
, (unsigned long) key
,
1318 ovl_inode_test
, ovl_inode_set
, key
) :
1319 iget5_locked(sb
, (unsigned long) key
,
1320 ovl_inode_test
, ovl_inode_set
, key
);
1323 struct inode
*ovl_get_inode(struct super_block
*sb
,
1324 struct ovl_inode_params
*oip
)
1326 struct ovl_fs
*ofs
= OVL_FS(sb
);
1327 struct dentry
*upperdentry
= oip
->upperdentry
;
1328 struct ovl_path
*lowerpath
= oip
->lowerpath
;
1329 struct inode
*realinode
= upperdentry
? d_inode(upperdentry
) : NULL
;
1330 struct inode
*inode
;
1331 struct dentry
*lowerdentry
= lowerpath
? lowerpath
->dentry
: NULL
;
1332 struct path realpath
= {
1333 .dentry
= upperdentry
?: lowerdentry
,
1334 .mnt
= upperdentry
? ovl_upper_mnt(ofs
) : lowerpath
->layer
->mnt
,
1336 bool bylower
= ovl_hash_bylower(sb
, upperdentry
, lowerdentry
,
1338 int fsid
= bylower
? lowerpath
->layer
->fsid
: 0;
1340 unsigned long ino
= 0;
1341 int err
= oip
->newinode
? -EEXIST
: -ENOMEM
;
1344 realinode
= d_inode(lowerdentry
);
1347 * Copy up origin (lower) may exist for non-indexed upper, but we must
1348 * not use lower as hash key if this is a broken hardlink.
1350 is_dir
= S_ISDIR(realinode
->i_mode
);
1351 if (upperdentry
|| bylower
) {
1352 struct inode
*key
= d_inode(bylower
? lowerdentry
:
1354 unsigned int nlink
= is_dir
? 1 : realinode
->i_nlink
;
1356 inode
= ovl_iget5(sb
, oip
->newinode
, key
);
1359 if (!(inode
->i_state
& I_NEW
)) {
1361 * Verify that the underlying files stored in the inode
1362 * match those in the dentry.
1364 if (!ovl_verify_inode(inode
, lowerdentry
, upperdentry
,
1372 kfree(oip
->redirect
);
1376 /* Recalculate nlink for non-dir due to indexing */
1378 nlink
= ovl_get_nlink(ofs
, lowerdentry
, upperdentry
,
1380 set_nlink(inode
, nlink
);
1383 /* Lower hardlink that will be broken on copy up */
1384 inode
= new_inode(sb
);
1389 ino
= realinode
->i_ino
;
1390 fsid
= lowerpath
->layer
->fsid
;
1392 ovl_fill_inode(inode
, realinode
->i_mode
, realinode
->i_rdev
);
1393 ovl_inode_init(inode
, oip
, ino
, fsid
);
1395 if (upperdentry
&& ovl_is_impuredir(sb
, upperdentry
))
1396 ovl_set_flag(OVL_IMPURE
, inode
);
1399 ovl_set_flag(OVL_INDEX
, inode
);
1401 OVL_I(inode
)->redirect
= oip
->redirect
;
1404 ovl_set_flag(OVL_CONST_INO
, inode
);
1406 /* Check for non-merge dir that may have whiteouts */
1408 if (((upperdentry
&& lowerdentry
) || oip
->numlower
> 1) ||
1409 ovl_path_check_origin_xattr(ofs
, &realpath
)) {
1410 ovl_set_flag(OVL_WHITEOUTS
, inode
);
1414 /* Check for immutable/append-only inode flags in xattr */
1416 ovl_check_protattr(inode
, upperdentry
);
1418 if (inode
->i_state
& I_NEW
)
1419 unlock_new_inode(inode
);
1424 pr_warn_ratelimited("failed to get inode (%i)\n", err
);
1425 inode
= ERR_PTR(err
);