fs/fs_context.c

   1 /* Provide a way to create a superblock configuration context within the kernel
   2  * that allows a superblock to be set up prior to mounting.
   3  *
   4  * Copyright (C) 2017 Red Hat, Inc. All Rights Reserved.
   5  * Written by David Howells (dhowells@redhat.com)
   6  *
   7  * This program is free software; you can redistribute it and/or
   8  * modify it under the terms of the GNU General Public Licence
   9  * as published by the Free Software Foundation; either version
  10  * 2 of the Licence, or (at your option) any later version.
  11  */
  12
  13 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
  14 #include <linux/fs_context.h>
  15 #include <linux/fs_parser.h>
  16 #include <linux/fs.h>
  17 #include <linux/mount.h>
  18 #include <linux/nsproxy.h>
  19 #include <linux/slab.h>
  20 #include <linux/magic.h>
  21 #include <linux/security.h>
  22 #include <linux/mnt_namespace.h>
  23 #include <linux/pid_namespace.h>
  24 #include <linux/user_namespace.h>
  25 #include <net/net_namespace.h>
  26 #include "mount.h"
  27 #include "internal.h"
  28
  29 enum legacy_fs_param {
  30         LEGACY_FS_UNSET_PARAMS,
  31         LEGACY_FS_MONOLITHIC_PARAMS,
  32         LEGACY_FS_INDIVIDUAL_PARAMS,
  33 };
  34
  35 struct legacy_fs_context {
  36         char                    *legacy_data;   /* Data page for legacy filesystems */
  37         size_t                  data_size;
  38         enum legacy_fs_param    param_type;
  39 };
  40
  41 static int legacy_init_fs_context(struct fs_context *fc);
  42
  43 static const struct constant_table common_set_sb_flag[] = {
  44         { "dirsync",    SB_DIRSYNC },
  45         { "lazytime",   SB_LAZYTIME },
  46         { "mand",       SB_MANDLOCK },
  47         { "posixacl",   SB_POSIXACL },
  48         { "ro",         SB_RDONLY },
  49         { "sync",       SB_SYNCHRONOUS },
  50 };
  51
  52 static const struct constant_table common_clear_sb_flag[] = {
  53         { "async",      SB_SYNCHRONOUS },
  54         { "nolazytime", SB_LAZYTIME },
  55         { "nomand",     SB_MANDLOCK },
  56         { "rw",         SB_RDONLY },
  57         { "silent",     SB_SILENT },
  58 };
  59
  60 static const char *const forbidden_sb_flag[] = {
  61         "bind",
  62         "dev",
  63         "exec",
  64         "move",
  65         "noatime",
  66         "nodev",
  67         "nodiratime",
  68         "noexec",
  69         "norelatime",
  70         "nostrictatime",
  71         "nosuid",
  72         "private",
  73         "rec",
  74         "relatime",
  75         "remount",
  76         "shared",
  77         "slave",
  78         "strictatime",
  79         "suid",
  80         "unbindable",
  81 };
  82
  83 /*
  84  * Check for a common mount option that manipulates s_flags.
  85  */
  86 static int vfs_parse_sb_flag(struct fs_context *fc, const char *key)
  87 {
  88         unsigned int token;
  89         unsigned int i;
  90
  91         for (i = 0; i < ARRAY_SIZE(forbidden_sb_flag); i++)
  92                 if (strcmp(key, forbidden_sb_flag[i]) == 0)
  93                         return -EINVAL;
  94
  95         token = lookup_constant(common_set_sb_flag, key, 0);
  96         if (token) {
  97                 fc->sb_flags |= token;
  98                 fc->sb_flags_mask |= token;
  99                 return 0;
 100         }
 101
 102         token = lookup_constant(common_clear_sb_flag, key, 0);
 103         if (token) {
 104                 fc->sb_flags &= ~token;
 105                 fc->sb_flags_mask |= token;
 106                 return 0;
 107         }
 108
 109         return -ENOPARAM;
 110 }
 111
 112 /**
 113  * vfs_parse_fs_param - Add a single parameter to a superblock config
 114  * @fc: The filesystem context to modify
 115  * @param: The parameter
 116  *
 117  * A single mount option in string form is applied to the filesystem context
 118  * being set up.  Certain standard options (for example "ro") are translated
 119  * into flag bits without going to the filesystem.  The active security module
 120  * is allowed to observe and poach options.  Any other options are passed over
 121  * to the filesystem to parse.
 122  *
 123  * This may be called multiple times for a context.
 124  *
 125  * Returns 0 on success and a negative error code on failure.  In the event of
 126  * failure, supplementary error information may have been set.
 127  */
 128 int vfs_parse_fs_param(struct fs_context *fc, struct fs_parameter *param)
 129 {
 130         int ret;
 131
 132         if (!param->key)
 133                 return invalf(fc, "Unnamed parameter\n");
 134
 135         ret = vfs_parse_sb_flag(fc, param->key);
 136         if (ret != -ENOPARAM)
 137                 return ret;
 138
 139         ret = security_fs_context_parse_param(fc, param);
 140         if (ret != -ENOPARAM)
 141                 /* Param belongs to the LSM or is disallowed by the LSM; so
 142                  * don't pass to the FS.
 143                  */
 144                 return ret;
 145
 146         if (fc->ops->parse_param) {
 147                 ret = fc->ops->parse_param(fc, param);
 148                 if (ret != -ENOPARAM)
 149                         return ret;
 150         }
 151
 152         /* If the filesystem doesn't take any arguments, give it the
 153          * default handling of source.
 154          */
 155         if (strcmp(param->key, "source") == 0) {
 156                 if (param->type != fs_value_is_string)
 157                         return invalf(fc, "VFS: Non-string source");
 158                 if (fc->source)
 159                         return invalf(fc, "VFS: Multiple sources");
 160                 fc->source = param->string;
 161                 param->string = NULL;
 162                 return 0;
 163         }
 164
 165         return invalf(fc, "%s: Unknown parameter '%s'",
 166                       fc->fs_type->name, param->key);
 167 }
 168 EXPORT_SYMBOL(vfs_parse_fs_param);
 169
 170 /**
 171  * vfs_parse_fs_string - Convenience function to just parse a string.
 172  */
 173 int vfs_parse_fs_string(struct fs_context *fc, const char *key,
 174                         const char *value, size_t v_size)
 175 {
 176         int ret;
 177
 178         struct fs_parameter param = {
 179                 .key    = key,
 180                 .type   = fs_value_is_string,
 181                 .size   = v_size,
 182         };
 183
 184         if (v_size > 0) {
 185                 param.string = kmemdup_nul(value, v_size, GFP_KERNEL);
 186                 if (!param.string)
 187                         return -ENOMEM;
 188         }
 189
 190         ret = vfs_parse_fs_param(fc, &param);
 191         kfree(param.string);
 192         return ret;
 193 }
 194 EXPORT_SYMBOL(vfs_parse_fs_string);
 195
 196 /**
 197  * generic_parse_monolithic - Parse key[=val][,key[=val]]* mount data
 198  * @ctx: The superblock configuration to fill in.
 199  * @data: The data to parse
 200  *
 201  * Parse a blob of data that's in key[=val][,key[=val]]* form.  This can be
 202  * called from the ->monolithic_mount_data() fs_context operation.
 203  *
 204  * Returns 0 on success or the error returned by the ->parse_option() fs_context
 205  * operation on failure.
 206  */
 207 int generic_parse_monolithic(struct fs_context *fc, void *data)
 208 {
 209         char *options = data, *key;
 210         int ret = 0;
 211
 212         if (!options)
 213                 return 0;
 214
 215         ret = security_sb_eat_lsm_opts(options, &fc->security);
 216         if (ret)
 217                 return ret;
 218
 219         while ((key = strsep(&options, ",")) != NULL) {
 220                 if (*key) {
 221                         size_t v_len = 0;
 222                         char *value = strchr(key, '=');
 223
 224                         if (value) {
 225                                 if (value == key)
 226                                         continue;
 227                                 *value++ = 0;
 228                                 v_len = strlen(value);
 229                         }
 230                         ret = vfs_parse_fs_string(fc, key, value, v_len);
 231                         if (ret < 0)
 232                                 break;
 233                 }
 234         }
 235
 236         return ret;
 237 }
 238 EXPORT_SYMBOL(generic_parse_monolithic);
 239
 240 /**
 241  * alloc_fs_context - Create a filesystem context.
 242  * @fs_type: The filesystem type.
 243  * @reference: The dentry from which this one derives (or NULL)
 244  * @sb_flags: Filesystem/superblock flags (SB_*)
 245  * @sb_flags_mask: Applicable members of @sb_flags
 246  * @purpose: The purpose that this configuration shall be used for.
 247  *
 248  * Open a filesystem and create a mount context.  The mount context is
 249  * initialised with the supplied flags and, if a submount/automount from
 250  * another superblock (referred to by @reference) is supplied, may have
 251  * parameters such as namespaces copied across from that superblock.
 252  */
 253 static struct fs_context *alloc_fs_context(struct file_system_type *fs_type,
 254                                       struct dentry *reference,
 255                                       unsigned int sb_flags,
 256                                       unsigned int sb_flags_mask,
 257                                       enum fs_context_purpose purpose)
 258 {
 259         int (*init_fs_context)(struct fs_context *);
 260         struct fs_context *fc;
 261         int ret = -ENOMEM;
 262
 263         fc = kzalloc(sizeof(struct fs_context), GFP_KERNEL);
 264         if (!fc)
 265                 return ERR_PTR(-ENOMEM);
 266
 267         fc->purpose     = purpose;
 268         fc->sb_flags    = sb_flags;
 269         fc->sb_flags_mask = sb_flags_mask;
 270         fc->fs_type     = get_filesystem(fs_type);
 271         fc->cred        = get_current_cred();
 272         fc->net_ns      = get_net(current->nsproxy->net_ns);
 273
 274         switch (purpose) {
 275         case FS_CONTEXT_FOR_MOUNT:
 276                 fc->user_ns = get_user_ns(fc->cred->user_ns);
 277                 break;
 278         case FS_CONTEXT_FOR_SUBMOUNT:
 279                 fc->user_ns = get_user_ns(reference->d_sb->s_user_ns);
 280                 break;
 281         case FS_CONTEXT_FOR_RECONFIGURE:
 282                 /* We don't pin any namespaces as the superblock's
 283                  * subscriptions cannot be changed at this point.
 284                  */
 285                 atomic_inc(&reference->d_sb->s_active);
 286                 fc->root = dget(reference);
 287                 break;
 288         }
 289
 290         /* TODO: Make all filesystems support this unconditionally */
 291         init_fs_context = fc->fs_type->init_fs_context;
 292         if (!init_fs_context)
 293                 init_fs_context = legacy_init_fs_context;
 294
 295         ret = init_fs_context(fc);
 296         if (ret < 0)
 297                 goto err_fc;
 298         fc->need_free = true;
 299         return fc;
 300
 301 err_fc:
 302         put_fs_context(fc);
 303         return ERR_PTR(ret);
 304 }
 305
 306 struct fs_context *fs_context_for_mount(struct file_system_type *fs_type,
 307                                         unsigned int sb_flags)
 308 {
 309         return alloc_fs_context(fs_type, NULL, sb_flags, 0,
 310                                         FS_CONTEXT_FOR_MOUNT);
 311 }
 312 EXPORT_SYMBOL(fs_context_for_mount);
 313
 314 struct fs_context *fs_context_for_reconfigure(struct dentry *dentry,
 315                                         unsigned int sb_flags,
 316                                         unsigned int sb_flags_mask)
 317 {
 318         return alloc_fs_context(dentry->d_sb->s_type, dentry, sb_flags,
 319                                 sb_flags_mask, FS_CONTEXT_FOR_RECONFIGURE);
 320 }
 321 EXPORT_SYMBOL(fs_context_for_reconfigure);
 322
 323 struct fs_context *fs_context_for_submount(struct file_system_type *type,
 324                                            struct dentry *reference)
 325 {
 326         return alloc_fs_context(type, reference, 0, 0, FS_CONTEXT_FOR_SUBMOUNT);
 327 }
 328 EXPORT_SYMBOL(fs_context_for_submount);
 329
 330 void fc_drop_locked(struct fs_context *fc)
 331 {
 332         struct super_block *sb = fc->root->d_sb;
 333         dput(fc->root);
 334         fc->root = NULL;
 335         deactivate_locked_super(sb);
 336 }
 337
 338 static void legacy_fs_context_free(struct fs_context *fc);
 339
 340 /**
 341  * vfs_dup_fc_config: Duplicate a filesystem context.
 342  * @src_fc: The context to copy.
 343  */
 344 struct fs_context *vfs_dup_fs_context(struct fs_context *src_fc)
 345 {
 346         struct fs_context *fc;
 347         int ret;
 348
 349         if (!src_fc->ops->dup)
 350                 return ERR_PTR(-EOPNOTSUPP);
 351
 352         fc = kmemdup(src_fc, sizeof(struct fs_context), GFP_KERNEL);
 353         if (!fc)
 354                 return ERR_PTR(-ENOMEM);
 355
 356         fc->fs_private  = NULL;
 357         fc->s_fs_info   = NULL;
 358         fc->source      = NULL;
 359         fc->security    = NULL;
 360         get_filesystem(fc->fs_type);
 361         get_net(fc->net_ns);
 362         get_user_ns(fc->user_ns);
 363         get_cred(fc->cred);
 364
 365         /* Can't call put until we've called ->dup */
 366         ret = fc->ops->dup(fc, src_fc);
 367         if (ret < 0)
 368                 goto err_fc;
 369
 370         ret = security_fs_context_dup(fc, src_fc);
 371         if (ret < 0)
 372                 goto err_fc;
 373         return fc;
 374
 375 err_fc:
 376         put_fs_context(fc);
 377         return ERR_PTR(ret);
 378 }
 379 EXPORT_SYMBOL(vfs_dup_fs_context);
 380
 381 #ifdef CONFIG_PRINTK
 382 /**
 383  * logfc - Log a message to a filesystem context
 384  * @fc: The filesystem context to log to.
 385  * @fmt: The format of the buffer.
 386  */
 387 void logfc(struct fs_context *fc, const char *fmt, ...)
 388 {
 389         va_list va;
 390
 391         va_start(va, fmt);
 392
 393         switch (fmt[0]) {
 394         case 'w':
 395                 vprintk_emit(0, LOGLEVEL_WARNING, NULL, 0, fmt, va);
 396                 break;
 397         case 'e':
 398                 vprintk_emit(0, LOGLEVEL_ERR, NULL, 0, fmt, va);
 399                 break;
 400         default:
 401                 vprintk_emit(0, LOGLEVEL_NOTICE, NULL, 0, fmt, va);
 402                 break;
 403         }
 404
 405         pr_cont("\n");
 406         va_end(va);
 407 }
 408 EXPORT_SYMBOL(logfc);
 409 #endif
 410
 411 /**
 412  * put_fs_context - Dispose of a superblock configuration context.
 413  * @fc: The context to dispose of.
 414  */
 415 void put_fs_context(struct fs_context *fc)
 416 {
 417         struct super_block *sb;
 418
 419         if (fc->root) {
 420                 sb = fc->root->d_sb;
 421                 dput(fc->root);
 422                 fc->root = NULL;
 423                 deactivate_super(sb);
 424         }
 425
 426         if (fc->need_free && fc->ops && fc->ops->free)
 427                 fc->ops->free(fc);
 428
 429         security_free_mnt_opts(&fc->security);
 430         put_net(fc->net_ns);
 431         put_user_ns(fc->user_ns);
 432         put_cred(fc->cred);
 433         kfree(fc->subtype);
 434         put_filesystem(fc->fs_type);
 435         kfree(fc->source);
 436         kfree(fc);
 437 }
 438 EXPORT_SYMBOL(put_fs_context);
 439
 440 /*
 441  * Free the config for a filesystem that doesn't support fs_context.
 442  */
 443 static void legacy_fs_context_free(struct fs_context *fc)
 444 {
 445         struct legacy_fs_context *ctx = fc->fs_private;
 446
 447         if (ctx) {
 448                 if (ctx->param_type == LEGACY_FS_INDIVIDUAL_PARAMS)
 449                         kfree(ctx->legacy_data);
 450                 kfree(ctx);
 451         }
 452 }
 453
 454 /*
 455  * Duplicate a legacy config.
 456  */
 457 static int legacy_fs_context_dup(struct fs_context *fc, struct fs_context *src_fc)
 458 {
 459         struct legacy_fs_context *ctx;
 460         struct legacy_fs_context *src_ctx = src_fc->fs_private;
 461
 462         ctx = kmemdup(src_ctx, sizeof(*src_ctx), GFP_KERNEL);
 463         if (!ctx)
 464                 return -ENOMEM;
 465
 466         if (ctx->param_type == LEGACY_FS_INDIVIDUAL_PARAMS) {
 467                 ctx->legacy_data = kmemdup(src_ctx->legacy_data,
 468                                            src_ctx->data_size, GFP_KERNEL);
 469                 if (!ctx->legacy_data) {
 470                         kfree(ctx);
 471                         return -ENOMEM;
 472                 }
 473         }
 474
 475         fc->fs_private = ctx;
 476         return 0;
 477 }
 478
 479 /*
 480  * Add a parameter to a legacy config.  We build up a comma-separated list of
 481  * options.
 482  */
 483 static int legacy_parse_param(struct fs_context *fc, struct fs_parameter *param)
 484 {
 485         struct legacy_fs_context *ctx = fc->fs_private;
 486         unsigned int size = ctx->data_size;
 487         size_t len = 0;
 488
 489         if (strcmp(param->key, "source") == 0) {
 490                 if (param->type != fs_value_is_string)
 491                         return invalf(fc, "VFS: Legacy: Non-string source");
 492                 if (fc->source)
 493                         return invalf(fc, "VFS: Legacy: Multiple sources");
 494                 fc->source = param->string;
 495                 param->string = NULL;
 496                 return 0;
 497         }
 498
 499         if ((fc->fs_type->fs_flags & FS_HAS_SUBTYPE) &&
 500             strcmp(param->key, "subtype") == 0) {
 501                 if (param->type != fs_value_is_string)
 502                         return invalf(fc, "VFS: Legacy: Non-string subtype");
 503                 if (fc->subtype)
 504                         return invalf(fc, "VFS: Legacy: Multiple subtype");
 505                 fc->subtype = param->string;
 506                 param->string = NULL;
 507                 return 0;
 508         }
 509
 510         if (ctx->param_type == LEGACY_FS_MONOLITHIC_PARAMS)
 511                 return invalf(fc, "VFS: Legacy: Can't mix monolithic and individual options");
 512
 513         switch (param->type) {
 514         case fs_value_is_string:
 515                 len = 1 + param->size;
 516                 /* Fall through */
 517         case fs_value_is_flag:
 518                 len += strlen(param->key);
 519                 break;
 520         default:
 521                 return invalf(fc, "VFS: Legacy: Parameter type for '%s' not supported",
 522                               param->key);
 523         }
 524
 525         if (len > PAGE_SIZE - 2 - size)
 526                 return invalf(fc, "VFS: Legacy: Cumulative options too large");
 527         if (strchr(param->key, ',') ||
 528             (param->type == fs_value_is_string &&
 529              memchr(param->string, ',', param->size)))
 530                 return invalf(fc, "VFS: Legacy: Option '%s' contained comma",
 531                               param->key);
 532         if (!ctx->legacy_data) {
 533                 ctx->legacy_data = kmalloc(PAGE_SIZE, GFP_KERNEL);
 534                 if (!ctx->legacy_data)
 535                         return -ENOMEM;
 536         }
 537
 538         ctx->legacy_data[size++] = ',';
 539         len = strlen(param->key);
 540         memcpy(ctx->legacy_data + size, param->key, len);
 541         size += len;
 542         if (param->type == fs_value_is_string) {
 543                 ctx->legacy_data[size++] = '=';
 544                 memcpy(ctx->legacy_data + size, param->string, param->size);
 545                 size += param->size;
 546         }
 547         ctx->legacy_data[size] = '\0';
 548         ctx->data_size = size;
 549         ctx->param_type = LEGACY_FS_INDIVIDUAL_PARAMS;
 550         return 0;
 551 }
 552
 553 /*
 554  * Add monolithic mount data.
 555  */
 556 static int legacy_parse_monolithic(struct fs_context *fc, void *data)
 557 {
 558         struct legacy_fs_context *ctx = fc->fs_private;
 559
 560         if (ctx->param_type != LEGACY_FS_UNSET_PARAMS) {
 561                 pr_warn("VFS: Can't mix monolithic and individual options\n");
 562                 return -EINVAL;
 563         }
 564
 565         ctx->legacy_data = data;
 566         ctx->param_type = LEGACY_FS_MONOLITHIC_PARAMS;
 567         if (!ctx->legacy_data)
 568                 return 0;
 569
 570         if (fc->fs_type->fs_flags & FS_BINARY_MOUNTDATA)
 571                 return 0;
 572         return security_sb_eat_lsm_opts(ctx->legacy_data, &fc->security);
 573 }
 574
 575 /*
 576  * Get a mountable root with the legacy mount command.
 577  */
 578 static int legacy_get_tree(struct fs_context *fc)
 579 {
 580         struct legacy_fs_context *ctx = fc->fs_private;
 581         struct super_block *sb;
 582         struct dentry *root;
 583
 584         root = fc->fs_type->mount(fc->fs_type, fc->sb_flags,
 585                                       fc->source, ctx->legacy_data);
 586         if (IS_ERR(root))
 587                 return PTR_ERR(root);
 588
 589         sb = root->d_sb;
 590         BUG_ON(!sb);
 591
 592         fc->root = root;
 593         return 0;
 594 }
 595
 596 /*
 597  * Handle remount.
 598  */
 599 static int legacy_reconfigure(struct fs_context *fc)
 600 {
 601         struct legacy_fs_context *ctx = fc->fs_private;
 602         struct super_block *sb = fc->root->d_sb;
 603
 604         if (!sb->s_op->remount_fs)
 605                 return 0;
 606
 607         return sb->s_op->remount_fs(sb, &fc->sb_flags,
 608                                     ctx ? ctx->legacy_data : NULL);
 609 }
 610
 611 const struct fs_context_operations legacy_fs_context_ops = {
 612         .free                   = legacy_fs_context_free,
 613         .dup                    = legacy_fs_context_dup,
 614         .parse_param            = legacy_parse_param,
 615         .parse_monolithic       = legacy_parse_monolithic,
 616         .get_tree               = legacy_get_tree,
 617         .reconfigure            = legacy_reconfigure,
 618 };
 619
 620 /*
 621  * Initialise a legacy context for a filesystem that doesn't support
 622  * fs_context.
 623  */
 624 static int legacy_init_fs_context(struct fs_context *fc)
 625 {
 626         fc->fs_private = kzalloc(sizeof(struct legacy_fs_context), GFP_KERNEL);
 627         if (!fc->fs_private)
 628                 return -ENOMEM;
 629         fc->ops = &legacy_fs_context_ops;
 630         return 0;
 631 }
 632
 633 int parse_monolithic_mount_data(struct fs_context *fc, void *data)
 634 {
 635         int (*monolithic_mount_data)(struct fs_context *, void *);
 636
 637         monolithic_mount_data = fc->ops->parse_monolithic;
 638         if (!monolithic_mount_data)
 639                 monolithic_mount_data = generic_parse_monolithic;
 640
 641         return monolithic_mount_data(fc, data);
 642 }