1
// SPDX-License-Identifier: GPL-2.0
2
/*
3
 *  linux/fs/attr.c
4
 *
5
 *  Copyright (C) 1991, 1992  Linus Torvalds
6
 *  changes by Thomas Schoebel-Theuer
7
 */
8

9
#include <linux/export.h>
10
#include <linux/time.h>
11
#include <linux/mm.h>
12
#include <linux/string.h>
13
#include <linux/sched/signal.h>
14
#include <linux/capability.h>
15
#include <linux/fsnotify.h>
16
#include <linux/fcntl.h>
17
#include <linux/filelock.h>
18
#include <linux/security.h>
19

20
/**
21
 * setattr_should_drop_sgid - determine whether the setgid bit needs to be
22
 *                            removed
23
 * @idmap:	idmap of the mount @inode was found from
24
 * @inode:	inode to check
25
 *
26
 * This function determines whether the setgid bit needs to be removed.
27
 * We retain backwards compatibility and require setgid bit to be removed
28
 * unconditionally if S_IXGRP is set. Otherwise we have the exact same
29
 * requirements as setattr_prepare() and setattr_copy().
30
 *
31
 * Return: ATTR_KILL_SGID if setgid bit needs to be removed, 0 otherwise.
32
 */
33
int setattr_should_drop_sgid(struct mnt_idmap *idmap,
34
			     const struct inode *inode)
35
{
36
	umode_t mode = inode->i_mode;
37

38
	if (!(mode & S_ISGID))
39
		return 0;
40
	if (mode & S_IXGRP)
41
		return ATTR_KILL_SGID;
42
	if (!in_group_or_capable(idmap, inode, i_gid_into_vfsgid(idmap, inode)))
43
		return ATTR_KILL_SGID;
44
	return 0;
45
}
46
EXPORT_SYMBOL(setattr_should_drop_sgid);
47

48
/**
49
 * setattr_should_drop_suidgid - determine whether the set{g,u}id bit needs to
50
 *                               be dropped
51
 * @idmap:	idmap of the mount @inode was found from
52
 * @inode:	inode to check
53
 *
54
 * This function determines whether the set{g,u}id bits need to be removed.
55
 * If the setuid bit needs to be removed ATTR_KILL_SUID is returned. If the
56
 * setgid bit needs to be removed ATTR_KILL_SGID is returned. If both
57
 * set{g,u}id bits need to be removed the corresponding mask of both flags is
58
 * returned.
59
 *
60
 * Return: A mask of ATTR_KILL_S{G,U}ID indicating which - if any - setid bits
61
 * to remove, 0 otherwise.
62
 */
63
int setattr_should_drop_suidgid(struct mnt_idmap *idmap,
64
				struct inode *inode)
65
{
66
	umode_t mode = inode->i_mode;
67
	int kill = 0;
68

69
	/* suid always must be killed */
70
	if (unlikely(mode & S_ISUID))
71
		kill = ATTR_KILL_SUID;
72

73
	kill |= setattr_should_drop_sgid(idmap, inode);
74

75
	if (unlikely(kill && !capable(CAP_FSETID) && S_ISREG(mode)))
76
		return kill;
77

78
	return 0;
79
}
80
EXPORT_SYMBOL(setattr_should_drop_suidgid);
81

82
/**
83
 * chown_ok - verify permissions to chown inode
84
 * @idmap:	idmap of the mount @inode was found from
85
 * @inode:	inode to check permissions on
86
 * @ia_vfsuid:	uid to chown @inode to
87
 *
88
 * If the inode has been found through an idmapped mount the idmap of
89
 * the vfsmount must be passed through @idmap. This function will then
90
 * take care to map the inode according to @idmap before checking
91
 * permissions. On non-idmapped mounts or if permission checking is to be
92
 * performed on the raw inode simply pass @nop_mnt_idmap.
93
 */
94
static bool chown_ok(struct mnt_idmap *idmap,
95
		     const struct inode *inode, vfsuid_t ia_vfsuid)
96
{
97
	vfsuid_t vfsuid = i_uid_into_vfsuid(idmap, inode);
98
	if (vfsuid_eq_kuid(vfsuid, current_fsuid()) &&
99
	    vfsuid_eq(ia_vfsuid, vfsuid))
100
		return true;
101
	if (capable_wrt_inode_uidgid(idmap, inode, CAP_CHOWN))
102
		return true;
103
	if (!vfsuid_valid(vfsuid) &&
104
	    ns_capable(inode->i_sb->s_user_ns, CAP_CHOWN))
105
		return true;
106
	return false;
107
}
108

109
/**
110
 * chgrp_ok - verify permissions to chgrp inode
111
 * @idmap:	idmap of the mount @inode was found from
112
 * @inode:	inode to check permissions on
113
 * @ia_vfsgid:	gid to chown @inode to
114
 *
115
 * If the inode has been found through an idmapped mount the idmap of
116
 * the vfsmount must be passed through @idmap. This function will then
117
 * take care to map the inode according to @idmap before checking
118
 * permissions. On non-idmapped mounts or if permission checking is to be
119
 * performed on the raw inode simply pass @nop_mnt_idmap.
120
 */
121
static bool chgrp_ok(struct mnt_idmap *idmap,
122
		     const struct inode *inode, vfsgid_t ia_vfsgid)
123
{
124
	vfsgid_t vfsgid = i_gid_into_vfsgid(idmap, inode);
125
	vfsuid_t vfsuid = i_uid_into_vfsuid(idmap, inode);
126
	if (vfsuid_eq_kuid(vfsuid, current_fsuid())) {
127
		if (vfsgid_eq(ia_vfsgid, vfsgid))
128
			return true;
129
		if (vfsgid_in_group_p(ia_vfsgid))
130
			return true;
131
	}
132
	if (capable_wrt_inode_uidgid(idmap, inode, CAP_CHOWN))
133
		return true;
134
	if (!vfsgid_valid(vfsgid) &&
135
	    ns_capable(inode->i_sb->s_user_ns, CAP_CHOWN))
136
		return true;
137
	return false;
138
}
139

140
/**
141
 * setattr_prepare - check if attribute changes to a dentry are allowed
142
 * @idmap:	idmap of the mount the inode was found from
143
 * @dentry:	dentry to check
144
 * @attr:	attributes to change
145
 *
146
 * Check if we are allowed to change the attributes contained in @attr
147
 * in the given dentry.  This includes the normal unix access permission
148
 * checks, as well as checks for rlimits and others. The function also clears
149
 * SGID bit from mode if user is not allowed to set it. Also file capabilities
150
 * and IMA extended attributes are cleared if ATTR_KILL_PRIV is set.
151
 *
152
 * If the inode has been found through an idmapped mount the idmap of
153
 * the vfsmount must be passed through @idmap. This function will then
154
 * take care to map the inode according to @idmap before checking
155
 * permissions. On non-idmapped mounts or if permission checking is to be
156
 * performed on the raw inode simply pass @nop_mnt_idmap.
157
 *
158
 * Should be called as the first thing in ->setattr implementations,
159
 * possibly after taking additional locks.
160
 */
161
int setattr_prepare(struct mnt_idmap *idmap, struct dentry *dentry,
162
		    struct iattr *attr)
163
{
164
	struct inode *inode = d_inode(dentry);
165
	unsigned int ia_valid = attr->ia_valid;
166

167
	/*
168
	 * First check size constraints.  These can't be overriden using
169
	 * ATTR_FORCE.
170
	 */
171
	if (ia_valid & ATTR_SIZE) {
172
		int error = inode_newsize_ok(inode, attr->ia_size);
173
		if (error)
174
			return error;
175
	}
176

177
	/* If force is set do it anyway. */
178
	if (ia_valid & ATTR_FORCE)
179
		goto kill_priv;
180

181
	/* Make sure a caller can chown. */
182
	if ((ia_valid & ATTR_UID) &&
183
	    !chown_ok(idmap, inode, attr->ia_vfsuid))
184
		return -EPERM;
185

186
	/* Make sure caller can chgrp. */
187
	if ((ia_valid & ATTR_GID) &&
188
	    !chgrp_ok(idmap, inode, attr->ia_vfsgid))
189
		return -EPERM;
190

191
	/* Make sure a caller can chmod. */
192
	if (ia_valid & ATTR_MODE) {
193
		vfsgid_t vfsgid;
194

195
		if (!inode_owner_or_capable(idmap, inode))
196
			return -EPERM;
197

198
		if (ia_valid & ATTR_GID)
199
			vfsgid = attr->ia_vfsgid;
200
		else
201
			vfsgid = i_gid_into_vfsgid(idmap, inode);
202

203
		/* Also check the setgid bit! */
204
		if (!in_group_or_capable(idmap, inode, vfsgid))
205
			attr->ia_mode &= ~S_ISGID;
206
	}
207

208
	/* Check for setting the inode time. */
209
	if (ia_valid & (ATTR_MTIME_SET | ATTR_ATIME_SET | ATTR_TIMES_SET)) {
210
		if (!inode_owner_or_capable(idmap, inode))
211
			return -EPERM;
212
	}
213

214
kill_priv:
215
	/* User has permission for the change */
216
	if (ia_valid & ATTR_KILL_PRIV) {
217
		int error;
218

219
		error = security_inode_killpriv(idmap, dentry);
220
		if (error)
221
			return error;
222
	}
223

224
	return 0;
225
}
226
EXPORT_SYMBOL(setattr_prepare);
227

228
/**
229
 * inode_newsize_ok - may this inode be truncated to a given size
230
 * @inode:	the inode to be truncated
231
 * @offset:	the new size to assign to the inode
232
 *
233
 * inode_newsize_ok must be called with i_rwsem held exclusively.
234
 *
235
 * inode_newsize_ok will check filesystem limits and ulimits to check that the
236
 * new inode size is within limits. inode_newsize_ok will also send SIGXFSZ
237
 * when necessary. Caller must not proceed with inode size change if failure is
238
 * returned. @inode must be a file (not directory), with appropriate
239
 * permissions to allow truncate (inode_newsize_ok does NOT check these
240
 * conditions).
241
 *
242
 * Return: 0 on success, -ve errno on failure
243
 */
244
int inode_newsize_ok(const struct inode *inode, loff_t offset)
245
{
246
	if (offset < 0)
247
		return -EINVAL;
248
	if (inode->i_size < offset) {
249
		unsigned long limit;
250

251
		limit = rlimit(RLIMIT_FSIZE);
252
		if (limit != RLIM_INFINITY && offset > limit)
253
			goto out_sig;
254
		if (offset > inode->i_sb->s_maxbytes)
255
			goto out_big;
256
	} else {
257
		/*
258
		 * truncation of in-use swapfiles is disallowed - it would
259
		 * cause subsequent swapout to scribble on the now-freed
260
		 * blocks.
261
		 */
262
		if (IS_SWAPFILE(inode))
263
			return -ETXTBSY;
264
	}
265

266
	return 0;
267
out_sig:
268
	send_sig(SIGXFSZ, current, 0);
269
out_big:
270
	return -EFBIG;
271
}
272
EXPORT_SYMBOL(inode_newsize_ok);
273

274
/**
275
 * setattr_copy_mgtime - update timestamps for mgtime inodes
276
 * @inode: inode timestamps to be updated
277
 * @attr: attrs for the update
278
 *
279
 * With multigrain timestamps, take more care to prevent races when
280
 * updating the ctime. Always update the ctime to the very latest using
281
 * the standard mechanism, and use that to populate the atime and mtime
282
 * appropriately (unless those are being set to specific values).
283
 */
284
static void setattr_copy_mgtime(struct inode *inode, const struct iattr *attr)
285
{
286
	unsigned int ia_valid = attr->ia_valid;
287
	struct timespec64 now;
288

289
	if (ia_valid & ATTR_CTIME_SET)
290
		now = inode_set_ctime_deleg(inode, attr->ia_ctime);
291
	else if (ia_valid & ATTR_CTIME)
292
		now = inode_set_ctime_current(inode);
293
	else
294
		now = current_time(inode);
295

296
	if (ia_valid & ATTR_ATIME_SET)
297
		inode_set_atime_to_ts(inode, attr->ia_atime);
298
	else if (ia_valid & ATTR_ATIME)
299
		inode_set_atime_to_ts(inode, now);
300

301
	if (ia_valid & ATTR_MTIME_SET)
302
		inode_set_mtime_to_ts(inode, attr->ia_mtime);
303
	else if (ia_valid & ATTR_MTIME)
304
		inode_set_mtime_to_ts(inode, now);
305
}
306

307
/**
308
 * setattr_copy - copy simple metadata updates into the generic inode
309
 * @idmap:	idmap of the mount the inode was found from
310
 * @inode:	the inode to be updated
311
 * @attr:	the new attributes
312
 *
313
 * setattr_copy must be called with i_rwsem held exclusively.
314
 *
315
 * setattr_copy updates the inode's metadata with that specified
316
 * in attr on idmapped mounts. Necessary permission checks to determine
317
 * whether or not the S_ISGID property needs to be removed are performed with
318
 * the correct idmapped mount permission helpers.
319
 * Noticeably missing is inode size update, which is more complex
320
 * as it requires pagecache updates.
321
 *
322
 * If the inode has been found through an idmapped mount the idmap of
323
 * the vfsmount must be passed through @idmap. This function will then
324
 * take care to map the inode according to @idmap before checking
325
 * permissions. On non-idmapped mounts or if permission checking is to be
326
 * performed on the raw inode simply pass @nop_mnt_idmap.
327
 *
328
 * The inode is not marked as dirty after this operation. The rationale is
329
 * that for "simple" filesystems, the struct inode is the inode storage.
330
 * The caller is free to mark the inode dirty afterwards if needed.
331
 */
332
void setattr_copy(struct mnt_idmap *idmap, struct inode *inode,
333
		  const struct iattr *attr)
334
{
335
	unsigned int ia_valid = attr->ia_valid;
336

337
	i_uid_update(idmap, attr, inode);
338
	i_gid_update(idmap, attr, inode);
339
	if (ia_valid & ATTR_MODE) {
340
		umode_t mode = attr->ia_mode;
341
		if (!in_group_or_capable(idmap, inode,
342
					 i_gid_into_vfsgid(idmap, inode)))
343
			mode &= ~S_ISGID;
344
		inode->i_mode = mode;
345
	}
346

347
	if (is_mgtime(inode))
348
		return setattr_copy_mgtime(inode, attr);
349

350
	if (ia_valid & ATTR_ATIME)
351
		inode_set_atime_to_ts(inode, attr->ia_atime);
352
	if (ia_valid & ATTR_MTIME)
353
		inode_set_mtime_to_ts(inode, attr->ia_mtime);
354

355
	if (ia_valid & ATTR_CTIME_SET)
356
		inode_set_ctime_deleg(inode, attr->ia_ctime);
357
	else if (ia_valid & ATTR_CTIME)
358
		inode_set_ctime_to_ts(inode, attr->ia_ctime);
359
}
360
EXPORT_SYMBOL(setattr_copy);
361

362
int may_setattr(struct mnt_idmap *idmap, struct inode *inode,
363
		unsigned int ia_valid)
364
{
365
	int error;
366

367
	if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID | ATTR_TIMES_SET)) {
368
		if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
369
			return -EPERM;
370
	}
371

372
	/*
373
	 * If utimes(2) and friends are called with times == NULL (or both
374
	 * times are UTIME_NOW), then we need to check for write permission
375
	 */
376
	if (ia_valid & ATTR_TOUCH) {
377
		if (IS_IMMUTABLE(inode))
378
			return -EPERM;
379

380
		if (!inode_owner_or_capable(idmap, inode)) {
381
			error = inode_permission(idmap, inode, MAY_WRITE);
382
			if (error)
383
				return error;
384
		}
385
	}
386
	return 0;
387
}
388
EXPORT_SYMBOL(may_setattr);
389

390
/**
391
 * notify_change - modify attributes of a filesystem object
392
 * @idmap:	idmap of the mount the inode was found from
393
 * @dentry:	object affected
394
 * @attr:	new attributes
395
 * @delegated_inode: returns inode, if the inode is delegated
396
 *
397
 * The caller must hold the i_rwsem exclusively on the affected object.
398
 *
399
 * If notify_change discovers a delegation in need of breaking,
400
 * it will return -EWOULDBLOCK and return a reference to the inode in
401
 * delegated_inode.  The caller should then break the delegation and
402
 * retry.  Because breaking a delegation may take a long time, the
403
 * caller should drop the i_rwsem before doing so.
404
 *
405
 * Alternatively, a caller may pass NULL for delegated_inode.  This may
406
 * be appropriate for callers that expect the underlying filesystem not
407
 * to be NFS exported.  Also, passing NULL is fine for callers holding
408
 * the file open for write, as there can be no conflicting delegation in
409
 * that case.
410
 *
411
 * If the inode has been found through an idmapped mount the idmap of
412
 * the vfsmount must be passed through @idmap. This function will then
413
 * take care to map the inode according to @idmap before checking
414
 * permissions. On non-idmapped mounts or if permission checking is to be
415
 * performed on the raw inode simply pass @nop_mnt_idmap.
416
 */
417
int notify_change(struct mnt_idmap *idmap, struct dentry *dentry,
418
		  struct iattr *attr, struct inode **delegated_inode)
419
{
420
	struct inode *inode = dentry->d_inode;
421
	umode_t mode = inode->i_mode;
422
	int error;
423
	struct timespec64 now;
424
	unsigned int ia_valid = attr->ia_valid;
425

426
	WARN_ON_ONCE(!inode_is_locked(inode));
427

428
	error = may_setattr(idmap, inode, ia_valid);
429
	if (error)
430
		return error;
431

432
	if ((ia_valid & ATTR_MODE)) {
433
		/*
434
		 * Don't allow changing the mode of symlinks:
435
		 *
436
		 * (1) The vfs doesn't take the mode of symlinks into account
437
		 *     during permission checking.
438
		 * (2) This has never worked correctly. Most major filesystems
439
		 *     did return EOPNOTSUPP due to interactions with POSIX ACLs
440
		 *     but did still updated the mode of the symlink.
441
		 *     This inconsistency led system call wrapper providers such
442
		 *     as libc to block changing the mode of symlinks with
443
		 *     EOPNOTSUPP already.
444
		 * (3) To even do this in the first place one would have to use
445
		 *     specific file descriptors and quite some effort.
446
		 */
447
		if (S_ISLNK(inode->i_mode))
448
			return -EOPNOTSUPP;
449

450
		/* Flag setting protected by i_rwsem */
451
		if (is_sxid(attr->ia_mode))
452
			inode->i_flags &= ~S_NOSEC;
453
	}
454

455
	now = current_time(inode);
456

457
	if (ia_valid & ATTR_ATIME_SET)
458
		attr->ia_atime = timestamp_truncate(attr->ia_atime, inode);
459
	else
460
		attr->ia_atime = now;
461
	if (ia_valid & ATTR_CTIME_SET)
462
		attr->ia_ctime = timestamp_truncate(attr->ia_ctime, inode);
463
	else
464
		attr->ia_ctime = now;
465
	if (ia_valid & ATTR_MTIME_SET)
466
		attr->ia_mtime = timestamp_truncate(attr->ia_mtime, inode);
467
	else
468
		attr->ia_mtime = now;
469

470
	if (ia_valid & ATTR_KILL_PRIV) {
471
		error = security_inode_need_killpriv(dentry);
472
		if (error < 0)
473
			return error;
474
		if (error == 0)
475
			ia_valid = attr->ia_valid &= ~ATTR_KILL_PRIV;
476
	}
477

478
	/*
479
	 * We now pass ATTR_KILL_S*ID to the lower level setattr function so
480
	 * that the function has the ability to reinterpret a mode change
481
	 * that's due to these bits. This adds an implicit restriction that
482
	 * no function will ever call notify_change with both ATTR_MODE and
483
	 * ATTR_KILL_S*ID set.
484
	 */
485
	if ((ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) &&
486
	    (ia_valid & ATTR_MODE))
487
		BUG();
488

489
	if (ia_valid & ATTR_KILL_SUID) {
490
		if (mode & S_ISUID) {
491
			ia_valid = attr->ia_valid |= ATTR_MODE;
492
			attr->ia_mode = (inode->i_mode & ~S_ISUID);
493
		}
494
	}
495
	if (ia_valid & ATTR_KILL_SGID) {
496
		if (mode & S_ISGID) {
497
			if (!(ia_valid & ATTR_MODE)) {
498
				ia_valid = attr->ia_valid |= ATTR_MODE;
499
				attr->ia_mode = inode->i_mode;
500
			}
501
			attr->ia_mode &= ~S_ISGID;
502
		}
503
	}
504
	if (!(attr->ia_valid & ~(ATTR_KILL_SUID | ATTR_KILL_SGID)))
505
		return 0;
506

507
	/*
508
	 * Verify that uid/gid changes are valid in the target
509
	 * namespace of the superblock.
510
	 */
511
	if (ia_valid & ATTR_UID &&
512
	    !vfsuid_has_fsmapping(idmap, inode->i_sb->s_user_ns,
513
				  attr->ia_vfsuid))
514
		return -EOVERFLOW;
515
	if (ia_valid & ATTR_GID &&
516
	    !vfsgid_has_fsmapping(idmap, inode->i_sb->s_user_ns,
517
				  attr->ia_vfsgid))
518
		return -EOVERFLOW;
519

520
	/* Don't allow modifications of files with invalid uids or
521
	 * gids unless those uids & gids are being made valid.
522
	 */
523
	if (!(ia_valid & ATTR_UID) &&
524
	    !vfsuid_valid(i_uid_into_vfsuid(idmap, inode)))
525
		return -EOVERFLOW;
526
	if (!(ia_valid & ATTR_GID) &&
527
	    !vfsgid_valid(i_gid_into_vfsgid(idmap, inode)))
528
		return -EOVERFLOW;
529

530
	error = security_inode_setattr(idmap, dentry, attr);
531
	if (error)
532
		return error;
533

534
	/*
535
	 * If ATTR_DELEG is set, then these attributes are being set on
536
	 * behalf of the holder of a write delegation. We want to avoid
537
	 * breaking the delegation in this case.
538
	 */
539
	if (!(ia_valid & ATTR_DELEG)) {
540
		error = try_break_deleg(inode, delegated_inode);
541
		if (error)
542
			return error;
543
	}
544

545
	if (inode->i_op->setattr)
546
		error = inode->i_op->setattr(idmap, dentry, attr);
547
	else
548
		error = simple_setattr(idmap, dentry, attr);
549

550
	if (!error) {
551
		fsnotify_change(dentry, ia_valid);
552
		security_inode_post_setattr(idmap, dentry, ia_valid);
553
	}
554

555
	return error;
556
}
557
EXPORT_SYMBOL(notify_change);
558

559