1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* Filesystem access-by-fd.
3  *
4  * Copyright (C) 2017 Red Hat, Inc. All Rights Reserved.
5  * Written by David Howells (dhowells@redhat.com)
6  */
7 
8 #include <linux/fs_context.h>
9 #include <linux/fs_parser.h>
10 #include <linux/slab.h>
11 #include <linux/uaccess.h>
12 #include <linux/syscalls.h>
13 #include <linux/security.h>
14 #include <linux/anon_inodes.h>
15 #include <linux/namei.h>
16 #include <linux/file.h>
17 #include <uapi/linux/mount.h>
18 #include "internal.h"
19 #include "mount.h"
20 
21 /*
22  * Allow the user to read back any error, warning or informational messages.
23  */
fscontext_read(struct file * file,char __user * _buf,size_t len,loff_t * pos)24 static ssize_t fscontext_read(struct file *file,
25 			      char __user *_buf, size_t len, loff_t *pos)
26 {
27 	struct fs_context *fc = file->private_data;
28 	struct fc_log *log = fc->log.log;
29 	unsigned int logsize = ARRAY_SIZE(log->buffer);
30 	ssize_t ret;
31 	char *p;
32 	bool need_free;
33 	int index, n;
34 
35 	ret = mutex_lock_interruptible(&fc->uapi_mutex);
36 	if (ret < 0)
37 		return ret;
38 
39 	if (log->head == log->tail) {
40 		mutex_unlock(&fc->uapi_mutex);
41 		return -ENODATA;
42 	}
43 
44 	index = log->tail & (logsize - 1);
45 	p = log->buffer[index];
46 	need_free = log->need_free & (1 << index);
47 	log->buffer[index] = NULL;
48 	log->need_free &= ~(1 << index);
49 	log->tail++;
50 	mutex_unlock(&fc->uapi_mutex);
51 
52 	ret = -EMSGSIZE;
53 	n = strlen(p);
54 	if (n > len)
55 		goto err_free;
56 	ret = -EFAULT;
57 	if (copy_to_user(_buf, p, n) != 0)
58 		goto err_free;
59 	ret = n;
60 
61 err_free:
62 	if (need_free)
63 		kfree(p);
64 	return ret;
65 }
66 
fscontext_release(struct inode * inode,struct file * file)67 static int fscontext_release(struct inode *inode, struct file *file)
68 {
69 	struct fs_context *fc = file->private_data;
70 
71 	if (fc) {
72 		file->private_data = NULL;
73 		put_fs_context(fc);
74 	}
75 	return 0;
76 }
77 
78 const struct file_operations fscontext_fops = {
79 	.read		= fscontext_read,
80 	.release	= fscontext_release,
81 };
82 
83 /*
84  * Attach a filesystem context to a file and an fd.
85  */
fscontext_create_fd(struct fs_context * fc,unsigned int o_flags)86 static int fscontext_create_fd(struct fs_context *fc, unsigned int o_flags)
87 {
88 	int fd;
89 
90 	fd = anon_inode_getfd("[fscontext]", &fscontext_fops, fc,
91 			      O_RDWR | o_flags);
92 	if (fd < 0)
93 		put_fs_context(fc);
94 	return fd;
95 }
96 
fscontext_alloc_log(struct fs_context * fc)97 static int fscontext_alloc_log(struct fs_context *fc)
98 {
99 	fc->log.log = kzalloc(sizeof(*fc->log.log), GFP_KERNEL);
100 	if (!fc->log.log)
101 		return -ENOMEM;
102 	refcount_set(&fc->log.log->usage, 1);
103 	fc->log.log->owner = fc->fs_type->owner;
104 	return 0;
105 }
106 
107 /*
108  * Open a filesystem by name so that it can be configured for mounting.
109  *
110  * We are allowed to specify a container in which the filesystem will be
111  * opened, thereby indicating which namespaces will be used (notably, which
112  * network namespace will be used for network filesystems).
113  */
SYSCALL_DEFINE2(fsopen,const char __user *,_fs_name,unsigned int,flags)114 SYSCALL_DEFINE2(fsopen, const char __user *, _fs_name, unsigned int, flags)
115 {
116 	struct file_system_type *fs_type;
117 	struct fs_context *fc;
118 	const char *fs_name;
119 	int ret;
120 
121 	if (!may_mount())
122 		return -EPERM;
123 
124 	if (flags & ~FSOPEN_CLOEXEC)
125 		return -EINVAL;
126 
127 	fs_name = strndup_user(_fs_name, PAGE_SIZE);
128 	if (IS_ERR(fs_name))
129 		return PTR_ERR(fs_name);
130 
131 	fs_type = get_fs_type(fs_name);
132 	kfree(fs_name);
133 	if (!fs_type)
134 		return -ENODEV;
135 
136 	fc = fs_context_for_mount(fs_type, 0);
137 	put_filesystem(fs_type);
138 	if (IS_ERR(fc))
139 		return PTR_ERR(fc);
140 
141 	fc->phase = FS_CONTEXT_CREATE_PARAMS;
142 
143 	ret = fscontext_alloc_log(fc);
144 	if (ret < 0)
145 		goto err_fc;
146 
147 	return fscontext_create_fd(fc, flags & FSOPEN_CLOEXEC ? O_CLOEXEC : 0);
148 
149 err_fc:
150 	put_fs_context(fc);
151 	return ret;
152 }
153 
154 /*
155  * Pick a superblock into a context for reconfiguration.
156  */
SYSCALL_DEFINE3(fspick,int,dfd,const char __user *,path,unsigned int,flags)157 SYSCALL_DEFINE3(fspick, int, dfd, const char __user *, path, unsigned int, flags)
158 {
159 	struct fs_context *fc;
160 	struct path target;
161 	unsigned int lookup_flags;
162 	int ret;
163 
164 	if (!may_mount())
165 		return -EPERM;
166 
167 	if ((flags & ~(FSPICK_CLOEXEC |
168 		       FSPICK_SYMLINK_NOFOLLOW |
169 		       FSPICK_NO_AUTOMOUNT |
170 		       FSPICK_EMPTY_PATH)) != 0)
171 		return -EINVAL;
172 
173 	lookup_flags = LOOKUP_FOLLOW | LOOKUP_AUTOMOUNT;
174 	if (flags & FSPICK_SYMLINK_NOFOLLOW)
175 		lookup_flags &= ~LOOKUP_FOLLOW;
176 	if (flags & FSPICK_NO_AUTOMOUNT)
177 		lookup_flags &= ~LOOKUP_AUTOMOUNT;
178 	if (flags & FSPICK_EMPTY_PATH)
179 		lookup_flags |= LOOKUP_EMPTY;
180 	ret = user_path_at(dfd, path, lookup_flags, &target);
181 	if (ret < 0)
182 		goto err;
183 
184 	ret = -EINVAL;
185 	if (target.mnt->mnt_root != target.dentry)
186 		goto err_path;
187 
188 	fc = fs_context_for_reconfigure(target.dentry, 0, 0);
189 	if (IS_ERR(fc)) {
190 		ret = PTR_ERR(fc);
191 		goto err_path;
192 	}
193 
194 	fc->phase = FS_CONTEXT_RECONF_PARAMS;
195 
196 	ret = fscontext_alloc_log(fc);
197 	if (ret < 0)
198 		goto err_fc;
199 
200 	path_put(&target);
201 	return fscontext_create_fd(fc, flags & FSPICK_CLOEXEC ? O_CLOEXEC : 0);
202 
203 err_fc:
204 	put_fs_context(fc);
205 err_path:
206 	path_put(&target);
207 err:
208 	return ret;
209 }
210 
vfs_cmd_create(struct fs_context * fc,bool exclusive)211 static int vfs_cmd_create(struct fs_context *fc, bool exclusive)
212 {
213 	struct super_block *sb;
214 	int ret;
215 
216 	if (fc->phase != FS_CONTEXT_CREATE_PARAMS)
217 		return -EBUSY;
218 
219 	if (!mount_capable(fc))
220 		return -EPERM;
221 
222 	fc->phase = FS_CONTEXT_CREATING;
223 	fc->exclusive = exclusive;
224 
225 	ret = vfs_get_tree(fc);
226 	if (ret) {
227 		fc->phase = FS_CONTEXT_FAILED;
228 		return ret;
229 	}
230 
231 	sb = fc->root->d_sb;
232 	ret = security_sb_kern_mount(sb);
233 	if (unlikely(ret)) {
234 		fc_drop_locked(fc);
235 		fc->phase = FS_CONTEXT_FAILED;
236 		return ret;
237 	}
238 
239 	/* vfs_get_tree() callchains will have grabbed @s_umount */
240 	up_write(&sb->s_umount);
241 	fc->phase = FS_CONTEXT_AWAITING_MOUNT;
242 	return 0;
243 }
244 
vfs_cmd_reconfigure(struct fs_context * fc)245 static int vfs_cmd_reconfigure(struct fs_context *fc)
246 {
247 	struct super_block *sb;
248 	int ret;
249 
250 	if (fc->phase != FS_CONTEXT_RECONF_PARAMS)
251 		return -EBUSY;
252 
253 	fc->phase = FS_CONTEXT_RECONFIGURING;
254 
255 	sb = fc->root->d_sb;
256 	if (!ns_capable(sb->s_user_ns, CAP_SYS_ADMIN)) {
257 		fc->phase = FS_CONTEXT_FAILED;
258 		return -EPERM;
259 	}
260 
261 	down_write(&sb->s_umount);
262 	ret = reconfigure_super(fc);
263 	up_write(&sb->s_umount);
264 	if (ret) {
265 		fc->phase = FS_CONTEXT_FAILED;
266 		return ret;
267 	}
268 
269 	vfs_clean_context(fc);
270 	return 0;
271 }
272 
273 /*
274  * Check the state and apply the configuration.  Note that this function is
275  * allowed to 'steal' the value by setting param->xxx to NULL before returning.
276  */
vfs_fsconfig_locked(struct fs_context * fc,int cmd,struct fs_parameter * param)277 static int vfs_fsconfig_locked(struct fs_context *fc, int cmd,
278 			       struct fs_parameter *param)
279 {
280 	int ret;
281 
282 	ret = finish_clean_context(fc);
283 	if (ret)
284 		return ret;
285 	switch (cmd) {
286 	case FSCONFIG_CMD_CREATE:
287 		return vfs_cmd_create(fc, false);
288 	case FSCONFIG_CMD_CREATE_EXCL:
289 		return vfs_cmd_create(fc, true);
290 	case FSCONFIG_CMD_RECONFIGURE:
291 		return vfs_cmd_reconfigure(fc);
292 	default:
293 		if (fc->phase != FS_CONTEXT_CREATE_PARAMS &&
294 		    fc->phase != FS_CONTEXT_RECONF_PARAMS)
295 			return -EBUSY;
296 
297 		return vfs_parse_fs_param(fc, param);
298 	}
299 }
300 
301 /**
302  * sys_fsconfig - Set parameters and trigger actions on a context
303  * @fd: The filesystem context to act upon
304  * @cmd: The action to take
305  * @_key: Where appropriate, the parameter key to set
306  * @_value: Where appropriate, the parameter value to set
307  * @aux: Additional information for the value
308  *
309  * This system call is used to set parameters on a context, including
310  * superblock settings, data source and security labelling.
311  *
312  * Actions include triggering the creation of a superblock and the
313  * reconfiguration of the superblock attached to the specified context.
314  *
315  * When setting a parameter, @cmd indicates the type of value being proposed
316  * and @_key indicates the parameter to be altered.
317  *
318  * @_value and @aux are used to specify the value, should a value be required:
319  *
320  * (*) fsconfig_set_flag: No value is specified.  The parameter must be boolean
321  *     in nature.  The key may be prefixed with "no" to invert the
322  *     setting. @_value must be NULL and @aux must be 0.
323  *
324  * (*) fsconfig_set_string: A string value is specified.  The parameter can be
325  *     expecting boolean, integer, string or take a path.  A conversion to an
326  *     appropriate type will be attempted (which may include looking up as a
327  *     path).  @_value points to a NUL-terminated string and @aux must be 0.
328  *
329  * (*) fsconfig_set_binary: A binary blob is specified.  @_value points to the
330  *     blob and @aux indicates its size.  The parameter must be expecting a
331  *     blob.
332  *
333  * (*) fsconfig_set_path: A non-empty path is specified.  The parameter must be
334  *     expecting a path object.  @_value points to a NUL-terminated string that
335  *     is the path and @aux is a file descriptor at which to start a relative
336  *     lookup or AT_FDCWD.
337  *
338  * (*) fsconfig_set_path_empty: As fsconfig_set_path, but with AT_EMPTY_PATH
339  *     implied.
340  *
341  * (*) fsconfig_set_fd: An open file descriptor is specified.  @_value must be
342  *     NULL and @aux indicates the file descriptor.
343  */
SYSCALL_DEFINE5(fsconfig,int,fd,unsigned int,cmd,const char __user *,_key,const void __user *,_value,int,aux)344 SYSCALL_DEFINE5(fsconfig,
345 		int, fd,
346 		unsigned int, cmd,
347 		const char __user *, _key,
348 		const void __user *, _value,
349 		int, aux)
350 {
351 	struct fs_context *fc;
352 	struct fd f;
353 	int ret;
354 	int lookup_flags = 0;
355 
356 	struct fs_parameter param = {
357 		.type	= fs_value_is_undefined,
358 	};
359 
360 	if (fd < 0)
361 		return -EINVAL;
362 
363 	switch (cmd) {
364 	case FSCONFIG_SET_FLAG:
365 		if (!_key || _value || aux)
366 			return -EINVAL;
367 		break;
368 	case FSCONFIG_SET_STRING:
369 		if (!_key || !_value || aux)
370 			return -EINVAL;
371 		break;
372 	case FSCONFIG_SET_BINARY:
373 		if (!_key || !_value || aux <= 0 || aux > 1024 * 1024)
374 			return -EINVAL;
375 		break;
376 	case FSCONFIG_SET_PATH:
377 	case FSCONFIG_SET_PATH_EMPTY:
378 		if (!_key || !_value || (aux != AT_FDCWD && aux < 0))
379 			return -EINVAL;
380 		break;
381 	case FSCONFIG_SET_FD:
382 		if (!_key || _value || aux < 0)
383 			return -EINVAL;
384 		break;
385 	case FSCONFIG_CMD_CREATE:
386 	case FSCONFIG_CMD_CREATE_EXCL:
387 	case FSCONFIG_CMD_RECONFIGURE:
388 		if (_key || _value || aux)
389 			return -EINVAL;
390 		break;
391 	default:
392 		return -EOPNOTSUPP;
393 	}
394 
395 	f = fdget(fd);
396 	if (!fd_file(f))
397 		return -EBADF;
398 	ret = -EINVAL;
399 	if (fd_file(f)->f_op != &fscontext_fops)
400 		goto out_f;
401 
402 	fc = fd_file(f)->private_data;
403 	if (fc->ops == &legacy_fs_context_ops) {
404 		switch (cmd) {
405 		case FSCONFIG_SET_BINARY:
406 		case FSCONFIG_SET_PATH:
407 		case FSCONFIG_SET_PATH_EMPTY:
408 		case FSCONFIG_SET_FD:
409 		case FSCONFIG_CMD_CREATE_EXCL:
410 			ret = -EOPNOTSUPP;
411 			goto out_f;
412 		}
413 	}
414 
415 	if (_key) {
416 		param.key = strndup_user(_key, 256);
417 		if (IS_ERR(param.key)) {
418 			ret = PTR_ERR(param.key);
419 			goto out_f;
420 		}
421 	}
422 
423 	switch (cmd) {
424 	case FSCONFIG_SET_FLAG:
425 		param.type = fs_value_is_flag;
426 		break;
427 	case FSCONFIG_SET_STRING:
428 		param.type = fs_value_is_string;
429 		param.string = strndup_user(_value, 256);
430 		if (IS_ERR(param.string)) {
431 			ret = PTR_ERR(param.string);
432 			goto out_key;
433 		}
434 		param.size = strlen(param.string);
435 		break;
436 	case FSCONFIG_SET_BINARY:
437 		param.type = fs_value_is_blob;
438 		param.size = aux;
439 		param.blob = memdup_user_nul(_value, aux);
440 		if (IS_ERR(param.blob)) {
441 			ret = PTR_ERR(param.blob);
442 			goto out_key;
443 		}
444 		break;
445 	case FSCONFIG_SET_PATH_EMPTY:
446 		lookup_flags = LOOKUP_EMPTY;
447 		fallthrough;
448 	case FSCONFIG_SET_PATH:
449 		param.type = fs_value_is_filename;
450 		param.name = getname_flags(_value, lookup_flags);
451 		if (IS_ERR(param.name)) {
452 			ret = PTR_ERR(param.name);
453 			goto out_key;
454 		}
455 		param.dirfd = aux;
456 		param.size = strlen(param.name->name);
457 		break;
458 	case FSCONFIG_SET_FD:
459 		param.type = fs_value_is_file;
460 		ret = -EBADF;
461 		param.file = fget(aux);
462 		if (!param.file)
463 			goto out_key;
464 		param.dirfd = aux;
465 		break;
466 	default:
467 		break;
468 	}
469 
470 	ret = mutex_lock_interruptible(&fc->uapi_mutex);
471 	if (ret == 0) {
472 		ret = vfs_fsconfig_locked(fc, cmd, &param);
473 		mutex_unlock(&fc->uapi_mutex);
474 	}
475 
476 	/* Clean up the our record of any value that we obtained from
477 	 * userspace.  Note that the value may have been stolen by the LSM or
478 	 * filesystem, in which case the value pointer will have been cleared.
479 	 */
480 	switch (cmd) {
481 	case FSCONFIG_SET_STRING:
482 	case FSCONFIG_SET_BINARY:
483 		kfree(param.string);
484 		break;
485 	case FSCONFIG_SET_PATH:
486 	case FSCONFIG_SET_PATH_EMPTY:
487 		if (param.name)
488 			putname(param.name);
489 		break;
490 	case FSCONFIG_SET_FD:
491 		if (param.file)
492 			fput(param.file);
493 		break;
494 	default:
495 		break;
496 	}
497 out_key:
498 	kfree(param.key);
499 out_f:
500 	fdput(f);
501 	return ret;
502 }
503