ptp: Add PHC file mode checks. Allow RO adjtime() without FMODE_WRITE.

[ Upstream commit b4e53b15c04e3852949003752f48f7a14ae39e86 ]

Many devices implement highly accurate clocks, which the kernel manages
as PTP Hardware Clocks (PHCs). Userspace applications rely on these
clocks to timestamp events, trace workload execution, correlate
timescales across devices, and keep various clocks in sync.

The kernel’s current implementation of PTP clocks does not enforce file
permissions checks for most device operations except for POSIX clock
operations, where file mode is verified in the POSIX layer before
forwarding the call to the PTP subsystem. Consequently, it is common
practice to not give unprivileged userspace applications any access to
PTP clocks whatsoever by giving the PTP chardevs 600 permissions. An
example of users running into this limitation is documented in [1].
Additionally, POSIX layer requires WRITE permission even for readonly
adjtime() calls which are used in PTP layer to return current frequency
offset applied to the PHC.

Add permission checks for functions that modify the state of a PTP
device. Continue enforcing permission checks for POSIX clock operations
(settime, adjtime) in the POSIX layer. Only require WRITE access for
dynamic clocks adjtime() if any flags are set in the modes field.

[1] https://lists.nwtime.org/sympa/arc/linuxptp-users/2024-01/msg00036.html

Changes in v4:
- Require FMODE_WRITE in ajtime() only for calls modifying the clock in
  any way.

Acked-by: Richard Cochran <richardcochran@gmail.com>
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
Signed-off-by: Wojtek Wasko <wwasko@nvidia.com>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/ptp/ptp_chardev.c b/drivers/ptp/ptp_chardev.c
index 6eecb53b3e6708d49f650ed6174e5d964a73c14c..1ed12e86ee000bc49935ea0fca9fb4d1bb049653 100644 (file)
--- a/drivers/ptp/ptp_chardev.c
+++ b/drivers/ptp/ptp_chardev.c
@@ -153,6 +153,10 @@ long ptp_ioctl(struct posix_clock_context *pccontext, unsigned int cmd,
 
        case PTP_EXTTS_REQUEST:
        case PTP_EXTTS_REQUEST2:
+               if ((pccontext->fp->f_mode & FMODE_WRITE) == 0) {
+                       err = -EACCES;
+                       break;
+               }
                memset(&req, 0, sizeof(req));
 
                if (copy_from_user(&req.extts, (void __user *)arg,
@@ -194,6 +198,10 @@ long ptp_ioctl(struct posix_clock_context *pccontext, unsigned int cmd,
 
        case PTP_PEROUT_REQUEST:
        case PTP_PEROUT_REQUEST2:
+               if ((pccontext->fp->f_mode & FMODE_WRITE) == 0) {
+                       err = -EACCES;
+                       break;
+               }
                memset(&req, 0, sizeof(req));
 
                if (copy_from_user(&req.perout, (void __user *)arg,
@@ -262,6 +270,10 @@ long ptp_ioctl(struct posix_clock_context *pccontext, unsigned int cmd,
 
        case PTP_ENABLE_PPS:
        case PTP_ENABLE_PPS2:
+               if ((pccontext->fp->f_mode & FMODE_WRITE) == 0) {
+                       err = -EACCES;
+                       break;
+               }
                memset(&req, 0, sizeof(req));
 
                if (!capable(CAP_SYS_TIME))
@@ -400,6 +412,10 @@ long ptp_ioctl(struct posix_clock_context *pccontext, unsigned int cmd,
 
        case PTP_PIN_SETFUNC:
        case PTP_PIN_SETFUNC2:
+               if ((pccontext->fp->f_mode & FMODE_WRITE) == 0) {
+                       err = -EACCES;
+                       break;
+               }
                if (copy_from_user(&pd, (void __user *)arg, sizeof(pd))) {
                        err = -EFAULT;
                        break;

diff --git a/kernel/time/posix-clock.c b/kernel/time/posix-clock.c
index b130bb56cc4e03d62dc697d2e6e9bd5d5946580d..827abede72745f9ef1344531dfefe9def11a5dab 100644 (file)
--- a/kernel/time/posix-clock.c
+++ b/kernel/time/posix-clock.c
@@ -253,7 +253,7 @@ static int pc_clock_adjtime(clockid_t id, struct __kernel_timex *tx)
        if (err)
                return err;
 
-       if ((cd.fp->f_mode & FMODE_WRITE) == 0) {
+       if (tx->modes && (cd.fp->f_mode & FMODE_WRITE) == 0) {
                err = -EACCES;
                goto out;
        }