exportfs: add permission method

This allows filesystems such as pidfs to provide their custom permission
checks.

Link: https://lore.kernel.org/r/20241129-work-pidfs-file_handle-v1-5-87d803a42495@kernel.org
Reviewed-by: Amir Goldstein <amir73il@gmail.com>
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner <brauner@kernel.org>

diff --git a/fs/fhandle.c b/fs/fhandle.c
index e17029b1dc4456e57846d220074345ca81b9bc2f..3e092ae6d142aedf52885202815d6022455b93bc 100644 (file)
--- a/fs/fhandle.c
+++ b/fs/fhandle.c
@@ -187,17 +187,6 @@ static int get_path_from_fd(int fd, struct path *root)
        return 0;
 }
 
-enum handle_to_path_flags {
-       HANDLE_CHECK_PERMS   = (1 << 0),
-       HANDLE_CHECK_SUBTREE = (1 << 1),
-};
-
-struct handle_to_path_ctx {
-       struct path root;
-       enum handle_to_path_flags flags;
-       unsigned int fh_flags;
-};
-
 static int vfs_dentry_acceptable(void *context, struct dentry *dentry)
 {
        struct handle_to_path_ctx *ctx = context;
@@ -279,13 +268,13 @@ static int do_handle_to_path(struct file_handle *handle, struct path *path,
        return 0;
 }
 
-static inline bool may_decode_fh(struct handle_to_path_ctx *ctx,
-                                unsigned int o_flags)
+static inline int may_decode_fh(struct handle_to_path_ctx *ctx,
+                               unsigned int o_flags)
 {
        struct path *root = &ctx->root;
 
        if (capable(CAP_DAC_READ_SEARCH))
-               return true;
+               return 0;
 
        /*
         * Allow relaxed permissions of file handles if the caller has
@@ -309,7 +298,7 @@ static inline bool may_decode_fh(struct handle_to_path_ctx *ctx,
         * There's only one dentry for each directory inode (VFS rule)...
         */
        if (!(o_flags & O_DIRECTORY))
-               return false;
+               return -EPERM;
 
        if (ns_capable(root->mnt->mnt_sb->s_user_ns, CAP_SYS_ADMIN))
                ctx->flags = HANDLE_CHECK_PERMS;
@@ -319,14 +308,14 @@ static inline bool may_decode_fh(struct handle_to_path_ctx *ctx,
                 !has_locked_children(real_mount(root->mnt), root->dentry))
                ctx->flags = HANDLE_CHECK_PERMS | HANDLE_CHECK_SUBTREE;
        else
-               return false;
+               return -EPERM;
 
        /* Are we able to override DAC permissions? */
        if (!ns_capable(current_user_ns(), CAP_DAC_READ_SEARCH))
-               return false;
+               return -EPERM;
 
        ctx->fh_flags = EXPORT_FH_DIR_ONLY;
-       return true;
+       return 0;
 }
 
 static int handle_to_path(int mountdirfd, struct file_handle __user *ufh,
@@ -336,15 +325,19 @@ static int handle_to_path(int mountdirfd, struct file_handle __user *ufh,
        struct file_handle f_handle;
        struct file_handle *handle = NULL;
        struct handle_to_path_ctx ctx = {};
+       const struct export_operations *eops;
 
        retval = get_path_from_fd(mountdirfd, &ctx.root);
        if (retval)
                goto out_err;
 
-       if (!may_decode_fh(&ctx, o_flags)) {
-               retval = -EPERM;
+       eops = ctx.root.mnt->mnt_sb->s_export_op;
+       if (eops && eops->permission)
+               retval = eops->permission(&ctx, o_flags);
+       else
+               retval = may_decode_fh(&ctx, o_flags);
+       if (retval)
                goto out_path;
-       }
 
        if (copy_from_user(&f_handle, ufh, sizeof(struct file_handle))) {
                retval = -EFAULT;

diff --git a/include/linux/exportfs.h b/include/linux/exportfs.h
index c69b79b64466d5bc32ffe9b2796a388130fe72d8..a087606ace194ccc9d1250f990ce55627aaf8dc5 100644 (file)
--- a/include/linux/exportfs.h
+++ b/include/linux/exportfs.h
@@ -3,6 +3,7 @@
 #define LINUX_EXPORTFS_H 1
 
 #include <linux/types.h>
+#include <linux/path.h>
 
 struct dentry;
 struct iattr;
@@ -10,7 +11,6 @@ struct inode;
 struct iomap;
 struct super_block;
 struct vfsmount;
-struct path;
 
 /* limit the handle size to NFSv4 handle size now */
 #define MAX_HANDLE_SZ 128
@@ -157,6 +157,17 @@ struct fid {
        };
 };
 
+enum handle_to_path_flags {
+       HANDLE_CHECK_PERMS   = (1 << 0),
+       HANDLE_CHECK_SUBTREE = (1 << 1),
+};
+
+struct handle_to_path_ctx {
+       struct path root;
+       enum handle_to_path_flags flags;
+       unsigned int fh_flags;
+};
+
 #define EXPORT_FH_CONNECTABLE  0x1 /* Encode file handle with parent */
 #define EXPORT_FH_FID          0x2 /* File handle may be non-decodeable */
 #define EXPORT_FH_DIR_ONLY     0x4 /* Only decode file handle for a directory */
@@ -226,6 +237,9 @@ struct fid {
  *    is also a directory.  In the event that it cannot be found, or storage
  *    space cannot be allocated, a %ERR_PTR should be returned.
  *
+ * permission:
+ *    Allow filesystems to specify a custom permission function.
+ *
  * open:
  *    Allow filesystems to specify a custom open function.
  *
@@ -255,6 +269,7 @@ struct export_operations {
                          bool write, u32 *device_generation);
        int (*commit_blocks)(struct inode *inode, struct iomap *iomaps,
                             int nr_iomaps, struct iattr *iattr);
+       int (*permission)(struct handle_to_path_ctx *ctx, unsigned int oflags);
        struct file * (*open)(struct path *path, unsigned int oflags);
 #define        EXPORT_OP_NOWCC                 (0x1) /* don't collect v3 wcc data */
 #define        EXPORT_OP_NOSUBTREECHK          (0x2) /* no subtree checking */