mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-11-18 09:44:18 +08:00
a867d7349e
Pull userns vfs updates from Eric Biederman: "This tree contains some very long awaited work on generalizing the user namespace support for mounting filesystems to include filesystems with a backing store. The real world target is fuse but the goal is to update the vfs to allow any filesystem to be supported. This patchset is based on a lot of code review and testing to approach that goal. While looking at what is needed to support the fuse filesystem it became clear that there were things like xattrs for security modules that needed special treatment. That the resolution of those concerns would not be fuse specific. That sorting out these general issues made most sense at the generic level, where the right people could be drawn into the conversation, and the issues could be solved for everyone. At a high level what this patchset does a couple of simple things: - Add a user namespace owner (s_user_ns) to struct super_block. - Teach the vfs to handle filesystem uids and gids not mapping into to kuids and kgids and being reported as INVALID_UID and INVALID_GID in vfs data structures. By assigning a user namespace owner filesystems that are mounted with only user namespace privilege can be detected. This allows security modules and the like to know which mounts may not be trusted. This also allows the set of uids and gids that are communicated to the filesystem to be capped at the set of kuids and kgids that are in the owning user namespace of the filesystem. One of the crazier corner casees this handles is the case of inodes whose i_uid or i_gid are not mapped into the vfs. Most of the code simply doesn't care but it is easy to confuse the inode writeback path so no operation that could cause an inode write-back is permitted for such inodes (aka only reads are allowed). This set of changes starts out by cleaning up the code paths involved in user namespace permirted mounts. Then when things are clean enough adds code that cleanly sets s_user_ns. Then additional restrictions are added that are possible now that the filesystem superblock contains owner information. These changes should not affect anyone in practice, but there are some parts of these restrictions that are changes in behavior. - Andy's restriction on suid executables that does not honor the suid bit when the path is from another mount namespace (think /proc/[pid]/fd/) or when the filesystem was mounted by a less privileged user. - The replacement of the user namespace implicit setting of MNT_NODEV with implicitly setting SB_I_NODEV on the filesystem superblock instead. Using SB_I_NODEV is a stronger form that happens to make this state user invisible. The user visibility can be managed but it caused problems when it was introduced from applications reasonably expecting mount flags to be what they were set to. There is a little bit of work remaining before it is safe to support mounting filesystems with backing store in user namespaces, beyond what is in this set of changes. - Verifying the mounter has permission to read/write the block device during mount. - Teaching the integrity modules IMA and EVM to handle filesystems mounted with only user namespace root and to reduce trust in their security xattrs accordingly. - Capturing the mounters credentials and using that for permission checks in d_automount and the like. (Given that overlayfs already does this, and we need the work in d_automount it make sense to generalize this case). Furthermore there are a few changes that are on the wishlist: - Get all filesystems supporting posix acls using the generic posix acls so that posix_acl_fix_xattr_from_user and posix_acl_fix_xattr_to_user may be removed. [Maintainability] - Reducing the permission checks in places such as remount to allow the superblock owner to perform them. - Allowing the superblock owner to chown files with unmapped uids and gids to something that is mapped so the files may be treated normally. I am not considering even obvious relaxations of permission checks until it is clear there are no more corner cases that need to be locked down and handled generically. Many thanks to Seth Forshee who kept this code alive, and putting up with me rewriting substantial portions of what he did to handle more corner cases, and for his diligent testing and reviewing of my changes" * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace: (30 commits) fs: Call d_automount with the filesystems creds fs: Update i_[ug]id_(read|write) to translate relative to s_user_ns evm: Translate user/group ids relative to s_user_ns when computing HMAC dquot: For now explicitly don't support filesystems outside of init_user_ns quota: Handle quota data stored in s_user_ns in quota_setxquota quota: Ensure qids map to the filesystem vfs: Don't create inodes with a uid or gid unknown to the vfs vfs: Don't modify inodes with a uid or gid unknown to the vfs cred: Reject inodes with invalid ids in set_create_file_as() fs: Check for invalid i_uid in may_follow_link() vfs: Verify acls are valid within superblock's s_user_ns. userns: Handle -1 in k[ug]id_has_mapping when !CONFIG_USER_NS fs: Refuse uid/gid changes which don't map into s_user_ns selinux: Add support for unprivileged mounts from user namespaces Smack: Handle labels consistently in untrusted mounts Smack: Add support for unprivileged mounts from user namespaces fs: Treat foreign mounts as nosuid fs: Limit file caps to the user namespace of the super block userns: Remove the now unnecessary FS_USERNS_DEV_MOUNT flag userns: Remove implicit MNT_NODEV fragility. ...
504 lines
12 KiB
C
504 lines
12 KiB
C
/*
|
|
* linux/fs/proc/inode.c
|
|
*
|
|
* Copyright (C) 1991, 1992 Linus Torvalds
|
|
*/
|
|
|
|
#include <linux/time.h>
|
|
#include <linux/proc_fs.h>
|
|
#include <linux/kernel.h>
|
|
#include <linux/pid_namespace.h>
|
|
#include <linux/mm.h>
|
|
#include <linux/string.h>
|
|
#include <linux/stat.h>
|
|
#include <linux/completion.h>
|
|
#include <linux/poll.h>
|
|
#include <linux/printk.h>
|
|
#include <linux/file.h>
|
|
#include <linux/limits.h>
|
|
#include <linux/init.h>
|
|
#include <linux/module.h>
|
|
#include <linux/sysctl.h>
|
|
#include <linux/seq_file.h>
|
|
#include <linux/slab.h>
|
|
#include <linux/mount.h>
|
|
#include <linux/magic.h>
|
|
|
|
#include <asm/uaccess.h>
|
|
|
|
#include "internal.h"
|
|
|
|
static void proc_evict_inode(struct inode *inode)
|
|
{
|
|
struct proc_dir_entry *de;
|
|
struct ctl_table_header *head;
|
|
|
|
truncate_inode_pages_final(&inode->i_data);
|
|
clear_inode(inode);
|
|
|
|
/* Stop tracking associated processes */
|
|
put_pid(PROC_I(inode)->pid);
|
|
|
|
/* Let go of any associated proc directory entry */
|
|
de = PDE(inode);
|
|
if (de)
|
|
pde_put(de);
|
|
head = PROC_I(inode)->sysctl;
|
|
if (head) {
|
|
RCU_INIT_POINTER(PROC_I(inode)->sysctl, NULL);
|
|
sysctl_head_put(head);
|
|
}
|
|
}
|
|
|
|
static struct kmem_cache * proc_inode_cachep;
|
|
|
|
static struct inode *proc_alloc_inode(struct super_block *sb)
|
|
{
|
|
struct proc_inode *ei;
|
|
struct inode *inode;
|
|
|
|
ei = (struct proc_inode *)kmem_cache_alloc(proc_inode_cachep, GFP_KERNEL);
|
|
if (!ei)
|
|
return NULL;
|
|
ei->pid = NULL;
|
|
ei->fd = 0;
|
|
ei->op.proc_get_link = NULL;
|
|
ei->pde = NULL;
|
|
ei->sysctl = NULL;
|
|
ei->sysctl_entry = NULL;
|
|
ei->ns_ops = NULL;
|
|
inode = &ei->vfs_inode;
|
|
inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
|
|
return inode;
|
|
}
|
|
|
|
static void proc_i_callback(struct rcu_head *head)
|
|
{
|
|
struct inode *inode = container_of(head, struct inode, i_rcu);
|
|
kmem_cache_free(proc_inode_cachep, PROC_I(inode));
|
|
}
|
|
|
|
static void proc_destroy_inode(struct inode *inode)
|
|
{
|
|
call_rcu(&inode->i_rcu, proc_i_callback);
|
|
}
|
|
|
|
static void init_once(void *foo)
|
|
{
|
|
struct proc_inode *ei = (struct proc_inode *) foo;
|
|
|
|
inode_init_once(&ei->vfs_inode);
|
|
}
|
|
|
|
void __init proc_init_inodecache(void)
|
|
{
|
|
proc_inode_cachep = kmem_cache_create("proc_inode_cache",
|
|
sizeof(struct proc_inode),
|
|
0, (SLAB_RECLAIM_ACCOUNT|
|
|
SLAB_MEM_SPREAD|SLAB_ACCOUNT|
|
|
SLAB_PANIC),
|
|
init_once);
|
|
}
|
|
|
|
static int proc_show_options(struct seq_file *seq, struct dentry *root)
|
|
{
|
|
struct super_block *sb = root->d_sb;
|
|
struct pid_namespace *pid = sb->s_fs_info;
|
|
|
|
if (!gid_eq(pid->pid_gid, GLOBAL_ROOT_GID))
|
|
seq_printf(seq, ",gid=%u", from_kgid_munged(&init_user_ns, pid->pid_gid));
|
|
if (pid->hide_pid != 0)
|
|
seq_printf(seq, ",hidepid=%u", pid->hide_pid);
|
|
|
|
return 0;
|
|
}
|
|
|
|
static const struct super_operations proc_sops = {
|
|
.alloc_inode = proc_alloc_inode,
|
|
.destroy_inode = proc_destroy_inode,
|
|
.drop_inode = generic_delete_inode,
|
|
.evict_inode = proc_evict_inode,
|
|
.statfs = simple_statfs,
|
|
.remount_fs = proc_remount,
|
|
.show_options = proc_show_options,
|
|
};
|
|
|
|
enum {BIAS = -1U<<31};
|
|
|
|
static inline int use_pde(struct proc_dir_entry *pde)
|
|
{
|
|
return atomic_inc_unless_negative(&pde->in_use);
|
|
}
|
|
|
|
static void unuse_pde(struct proc_dir_entry *pde)
|
|
{
|
|
if (atomic_dec_return(&pde->in_use) == BIAS)
|
|
complete(pde->pde_unload_completion);
|
|
}
|
|
|
|
/* pde is locked */
|
|
static void close_pdeo(struct proc_dir_entry *pde, struct pde_opener *pdeo)
|
|
{
|
|
if (pdeo->closing) {
|
|
/* somebody else is doing that, just wait */
|
|
DECLARE_COMPLETION_ONSTACK(c);
|
|
pdeo->c = &c;
|
|
spin_unlock(&pde->pde_unload_lock);
|
|
wait_for_completion(&c);
|
|
spin_lock(&pde->pde_unload_lock);
|
|
} else {
|
|
struct file *file;
|
|
pdeo->closing = 1;
|
|
spin_unlock(&pde->pde_unload_lock);
|
|
file = pdeo->file;
|
|
pde->proc_fops->release(file_inode(file), file);
|
|
spin_lock(&pde->pde_unload_lock);
|
|
list_del_init(&pdeo->lh);
|
|
if (pdeo->c)
|
|
complete(pdeo->c);
|
|
kfree(pdeo);
|
|
}
|
|
}
|
|
|
|
void proc_entry_rundown(struct proc_dir_entry *de)
|
|
{
|
|
DECLARE_COMPLETION_ONSTACK(c);
|
|
/* Wait until all existing callers into module are done. */
|
|
de->pde_unload_completion = &c;
|
|
if (atomic_add_return(BIAS, &de->in_use) != BIAS)
|
|
wait_for_completion(&c);
|
|
|
|
spin_lock(&de->pde_unload_lock);
|
|
while (!list_empty(&de->pde_openers)) {
|
|
struct pde_opener *pdeo;
|
|
pdeo = list_first_entry(&de->pde_openers, struct pde_opener, lh);
|
|
close_pdeo(de, pdeo);
|
|
}
|
|
spin_unlock(&de->pde_unload_lock);
|
|
}
|
|
|
|
static loff_t proc_reg_llseek(struct file *file, loff_t offset, int whence)
|
|
{
|
|
struct proc_dir_entry *pde = PDE(file_inode(file));
|
|
loff_t rv = -EINVAL;
|
|
if (use_pde(pde)) {
|
|
loff_t (*llseek)(struct file *, loff_t, int);
|
|
llseek = pde->proc_fops->llseek;
|
|
if (!llseek)
|
|
llseek = default_llseek;
|
|
rv = llseek(file, offset, whence);
|
|
unuse_pde(pde);
|
|
}
|
|
return rv;
|
|
}
|
|
|
|
static ssize_t proc_reg_read(struct file *file, char __user *buf, size_t count, loff_t *ppos)
|
|
{
|
|
ssize_t (*read)(struct file *, char __user *, size_t, loff_t *);
|
|
struct proc_dir_entry *pde = PDE(file_inode(file));
|
|
ssize_t rv = -EIO;
|
|
if (use_pde(pde)) {
|
|
read = pde->proc_fops->read;
|
|
if (read)
|
|
rv = read(file, buf, count, ppos);
|
|
unuse_pde(pde);
|
|
}
|
|
return rv;
|
|
}
|
|
|
|
static ssize_t proc_reg_write(struct file *file, const char __user *buf, size_t count, loff_t *ppos)
|
|
{
|
|
ssize_t (*write)(struct file *, const char __user *, size_t, loff_t *);
|
|
struct proc_dir_entry *pde = PDE(file_inode(file));
|
|
ssize_t rv = -EIO;
|
|
if (use_pde(pde)) {
|
|
write = pde->proc_fops->write;
|
|
if (write)
|
|
rv = write(file, buf, count, ppos);
|
|
unuse_pde(pde);
|
|
}
|
|
return rv;
|
|
}
|
|
|
|
static unsigned int proc_reg_poll(struct file *file, struct poll_table_struct *pts)
|
|
{
|
|
struct proc_dir_entry *pde = PDE(file_inode(file));
|
|
unsigned int rv = DEFAULT_POLLMASK;
|
|
unsigned int (*poll)(struct file *, struct poll_table_struct *);
|
|
if (use_pde(pde)) {
|
|
poll = pde->proc_fops->poll;
|
|
if (poll)
|
|
rv = poll(file, pts);
|
|
unuse_pde(pde);
|
|
}
|
|
return rv;
|
|
}
|
|
|
|
static long proc_reg_unlocked_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
|
|
{
|
|
struct proc_dir_entry *pde = PDE(file_inode(file));
|
|
long rv = -ENOTTY;
|
|
long (*ioctl)(struct file *, unsigned int, unsigned long);
|
|
if (use_pde(pde)) {
|
|
ioctl = pde->proc_fops->unlocked_ioctl;
|
|
if (ioctl)
|
|
rv = ioctl(file, cmd, arg);
|
|
unuse_pde(pde);
|
|
}
|
|
return rv;
|
|
}
|
|
|
|
#ifdef CONFIG_COMPAT
|
|
static long proc_reg_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
|
|
{
|
|
struct proc_dir_entry *pde = PDE(file_inode(file));
|
|
long rv = -ENOTTY;
|
|
long (*compat_ioctl)(struct file *, unsigned int, unsigned long);
|
|
if (use_pde(pde)) {
|
|
compat_ioctl = pde->proc_fops->compat_ioctl;
|
|
if (compat_ioctl)
|
|
rv = compat_ioctl(file, cmd, arg);
|
|
unuse_pde(pde);
|
|
}
|
|
return rv;
|
|
}
|
|
#endif
|
|
|
|
static int proc_reg_mmap(struct file *file, struct vm_area_struct *vma)
|
|
{
|
|
struct proc_dir_entry *pde = PDE(file_inode(file));
|
|
int rv = -EIO;
|
|
int (*mmap)(struct file *, struct vm_area_struct *);
|
|
if (use_pde(pde)) {
|
|
mmap = pde->proc_fops->mmap;
|
|
if (mmap)
|
|
rv = mmap(file, vma);
|
|
unuse_pde(pde);
|
|
}
|
|
return rv;
|
|
}
|
|
|
|
static unsigned long
|
|
proc_reg_get_unmapped_area(struct file *file, unsigned long orig_addr,
|
|
unsigned long len, unsigned long pgoff,
|
|
unsigned long flags)
|
|
{
|
|
struct proc_dir_entry *pde = PDE(file_inode(file));
|
|
unsigned long rv = -EIO;
|
|
|
|
if (use_pde(pde)) {
|
|
typeof(proc_reg_get_unmapped_area) *get_area;
|
|
|
|
get_area = pde->proc_fops->get_unmapped_area;
|
|
#ifdef CONFIG_MMU
|
|
if (!get_area)
|
|
get_area = current->mm->get_unmapped_area;
|
|
#endif
|
|
|
|
if (get_area)
|
|
rv = get_area(file, orig_addr, len, pgoff, flags);
|
|
else
|
|
rv = orig_addr;
|
|
unuse_pde(pde);
|
|
}
|
|
return rv;
|
|
}
|
|
|
|
static int proc_reg_open(struct inode *inode, struct file *file)
|
|
{
|
|
struct proc_dir_entry *pde = PDE(inode);
|
|
int rv = 0;
|
|
int (*open)(struct inode *, struct file *);
|
|
int (*release)(struct inode *, struct file *);
|
|
struct pde_opener *pdeo;
|
|
|
|
/*
|
|
* What for, you ask? Well, we can have open, rmmod, remove_proc_entry
|
|
* sequence. ->release won't be called because ->proc_fops will be
|
|
* cleared. Depending on complexity of ->release, consequences vary.
|
|
*
|
|
* We can't wait for mercy when close will be done for real, it's
|
|
* deadlockable: rmmod foo </proc/foo . So, we're going to do ->release
|
|
* by hand in remove_proc_entry(). For this, save opener's credentials
|
|
* for later.
|
|
*/
|
|
pdeo = kzalloc(sizeof(struct pde_opener), GFP_KERNEL);
|
|
if (!pdeo)
|
|
return -ENOMEM;
|
|
|
|
if (!use_pde(pde)) {
|
|
kfree(pdeo);
|
|
return -ENOENT;
|
|
}
|
|
open = pde->proc_fops->open;
|
|
release = pde->proc_fops->release;
|
|
|
|
if (open)
|
|
rv = open(inode, file);
|
|
|
|
if (rv == 0 && release) {
|
|
/* To know what to release. */
|
|
pdeo->file = file;
|
|
/* Strictly for "too late" ->release in proc_reg_release(). */
|
|
spin_lock(&pde->pde_unload_lock);
|
|
list_add(&pdeo->lh, &pde->pde_openers);
|
|
spin_unlock(&pde->pde_unload_lock);
|
|
} else
|
|
kfree(pdeo);
|
|
|
|
unuse_pde(pde);
|
|
return rv;
|
|
}
|
|
|
|
static int proc_reg_release(struct inode *inode, struct file *file)
|
|
{
|
|
struct proc_dir_entry *pde = PDE(inode);
|
|
struct pde_opener *pdeo;
|
|
spin_lock(&pde->pde_unload_lock);
|
|
list_for_each_entry(pdeo, &pde->pde_openers, lh) {
|
|
if (pdeo->file == file) {
|
|
close_pdeo(pde, pdeo);
|
|
break;
|
|
}
|
|
}
|
|
spin_unlock(&pde->pde_unload_lock);
|
|
return 0;
|
|
}
|
|
|
|
static const struct file_operations proc_reg_file_ops = {
|
|
.llseek = proc_reg_llseek,
|
|
.read = proc_reg_read,
|
|
.write = proc_reg_write,
|
|
.poll = proc_reg_poll,
|
|
.unlocked_ioctl = proc_reg_unlocked_ioctl,
|
|
#ifdef CONFIG_COMPAT
|
|
.compat_ioctl = proc_reg_compat_ioctl,
|
|
#endif
|
|
.mmap = proc_reg_mmap,
|
|
.get_unmapped_area = proc_reg_get_unmapped_area,
|
|
.open = proc_reg_open,
|
|
.release = proc_reg_release,
|
|
};
|
|
|
|
#ifdef CONFIG_COMPAT
|
|
static const struct file_operations proc_reg_file_ops_no_compat = {
|
|
.llseek = proc_reg_llseek,
|
|
.read = proc_reg_read,
|
|
.write = proc_reg_write,
|
|
.poll = proc_reg_poll,
|
|
.unlocked_ioctl = proc_reg_unlocked_ioctl,
|
|
.mmap = proc_reg_mmap,
|
|
.get_unmapped_area = proc_reg_get_unmapped_area,
|
|
.open = proc_reg_open,
|
|
.release = proc_reg_release,
|
|
};
|
|
#endif
|
|
|
|
static void proc_put_link(void *p)
|
|
{
|
|
unuse_pde(p);
|
|
}
|
|
|
|
static const char *proc_get_link(struct dentry *dentry,
|
|
struct inode *inode,
|
|
struct delayed_call *done)
|
|
{
|
|
struct proc_dir_entry *pde = PDE(inode);
|
|
if (unlikely(!use_pde(pde)))
|
|
return ERR_PTR(-EINVAL);
|
|
set_delayed_call(done, proc_put_link, pde);
|
|
return pde->data;
|
|
}
|
|
|
|
const struct inode_operations proc_link_inode_operations = {
|
|
.readlink = generic_readlink,
|
|
.get_link = proc_get_link,
|
|
};
|
|
|
|
struct inode *proc_get_inode(struct super_block *sb, struct proc_dir_entry *de)
|
|
{
|
|
struct inode *inode = new_inode_pseudo(sb);
|
|
|
|
if (inode) {
|
|
inode->i_ino = de->low_ino;
|
|
inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
|
|
PROC_I(inode)->pde = de;
|
|
|
|
if (is_empty_pde(de)) {
|
|
make_empty_dir_inode(inode);
|
|
return inode;
|
|
}
|
|
if (de->mode) {
|
|
inode->i_mode = de->mode;
|
|
inode->i_uid = de->uid;
|
|
inode->i_gid = de->gid;
|
|
}
|
|
if (de->size)
|
|
inode->i_size = de->size;
|
|
if (de->nlink)
|
|
set_nlink(inode, de->nlink);
|
|
WARN_ON(!de->proc_iops);
|
|
inode->i_op = de->proc_iops;
|
|
if (de->proc_fops) {
|
|
if (S_ISREG(inode->i_mode)) {
|
|
#ifdef CONFIG_COMPAT
|
|
if (!de->proc_fops->compat_ioctl)
|
|
inode->i_fop =
|
|
&proc_reg_file_ops_no_compat;
|
|
else
|
|
#endif
|
|
inode->i_fop = &proc_reg_file_ops;
|
|
} else {
|
|
inode->i_fop = de->proc_fops;
|
|
}
|
|
}
|
|
} else
|
|
pde_put(de);
|
|
return inode;
|
|
}
|
|
|
|
int proc_fill_super(struct super_block *s, void *data, int silent)
|
|
{
|
|
struct pid_namespace *ns = get_pid_ns(s->s_fs_info);
|
|
struct inode *root_inode;
|
|
int ret;
|
|
|
|
if (!proc_parse_options(data, ns))
|
|
return -EINVAL;
|
|
|
|
/* User space would break if executables or devices appear on proc */
|
|
s->s_iflags |= SB_I_USERNS_VISIBLE | SB_I_NOEXEC | SB_I_NODEV;
|
|
s->s_flags |= MS_NODIRATIME | MS_NOSUID | MS_NOEXEC;
|
|
s->s_blocksize = 1024;
|
|
s->s_blocksize_bits = 10;
|
|
s->s_magic = PROC_SUPER_MAGIC;
|
|
s->s_op = &proc_sops;
|
|
s->s_time_gran = 1;
|
|
|
|
/*
|
|
* procfs isn't actually a stacking filesystem; however, there is
|
|
* too much magic going on inside it to permit stacking things on
|
|
* top of it
|
|
*/
|
|
s->s_stack_depth = FILESYSTEM_MAX_STACK_DEPTH;
|
|
|
|
pde_get(&proc_root);
|
|
root_inode = proc_get_inode(s, &proc_root);
|
|
if (!root_inode) {
|
|
pr_err("proc_fill_super: get root inode failed\n");
|
|
return -ENOMEM;
|
|
}
|
|
|
|
s->s_root = d_make_root(root_inode);
|
|
if (!s->s_root) {
|
|
pr_err("proc_fill_super: allocate dentry failed\n");
|
|
return -ENOMEM;
|
|
}
|
|
|
|
ret = proc_setup_self(s);
|
|
if (ret) {
|
|
return ret;
|
|
}
|
|
return proc_setup_thread_self(s);
|
|
}
|