Unverified Commit c220e216 authored by Christian Brauner's avatar Christian Brauner
Browse files

exportfs: add permission method 

This allows filesystems such as pidfs to provide their custom permission
checks.

Link: https://lore.kernel.org/r/20241129-work-pidfs-file_handle-v1-5-87d803a42495@kernel.org


Reviewed-by: default avatarAmir Goldstein <amir73il@gmail.com>
Reviewed-by: default avatarJan Kara <jack@suse.cz>
Signed-off-by: default avatarChristian Brauner <brauner@kernel.org>
parent 6ebb05b4

fs/fhandle.c

+14 −21
Original line number Diff line number Diff line
@@ -187,17 +187,6 @@ static int get_path_from_fd(int fd, struct path *root) 
	return 0;

}



enum handle_to_path_flags {

	HANDLE_CHECK_PERMS   = (1 << 0),

	HANDLE_CHECK_SUBTREE = (1 << 1),

};



struct handle_to_path_ctx {

	struct path root;

	enum handle_to_path_flags flags;

	unsigned int fh_flags;

};



static int vfs_dentry_acceptable(void *context, struct dentry *dentry)

{

	struct handle_to_path_ctx *ctx = context;
@@ -279,13 +268,13 @@ static int do_handle_to_path(struct file_handle *handle, struct path *path, 
	return 0;

}



static inline bool may_decode_fh(struct handle_to_path_ctx *ctx,

static inline int may_decode_fh(struct handle_to_path_ctx *ctx,

				unsigned int o_flags)

{

	struct path *root = &ctx->root;



	if (capable(CAP_DAC_READ_SEARCH))

		return true;

		return 0;



	/*

	 * Allow relaxed permissions of file handles if the caller has
@@ -309,7 +298,7 @@ static inline bool may_decode_fh(struct handle_to_path_ctx *ctx, 
	 * There's only one dentry for each directory inode (VFS rule)...

	 */

	if (!(o_flags & O_DIRECTORY))

		return false;

		return -EPERM;



	if (ns_capable(root->mnt->mnt_sb->s_user_ns, CAP_SYS_ADMIN))

		ctx->flags = HANDLE_CHECK_PERMS;
@@ -319,14 +308,14 @@ static inline bool may_decode_fh(struct handle_to_path_ctx *ctx, 
		 !has_locked_children(real_mount(root->mnt), root->dentry))

		ctx->flags = HANDLE_CHECK_PERMS | HANDLE_CHECK_SUBTREE;

	else

		return false;

		return -EPERM;



	/* Are we able to override DAC permissions? */

	if (!ns_capable(current_user_ns(), CAP_DAC_READ_SEARCH))

		return false;

		return -EPERM;



	ctx->fh_flags = EXPORT_FH_DIR_ONLY;

	return true;

	return 0;

}



static int handle_to_path(int mountdirfd, struct file_handle __user *ufh,
@@ -336,15 +325,19 @@ static int handle_to_path(int mountdirfd, struct file_handle __user *ufh, 
	struct file_handle f_handle;

	struct file_handle *handle = NULL;

	struct handle_to_path_ctx ctx = {};

	const struct export_operations *eops;



	retval = get_path_from_fd(mountdirfd, &ctx.root);

	if (retval)

		goto out_err;



	if (!may_decode_fh(&ctx, o_flags)) {

		retval = -EPERM;

	eops = ctx.root.mnt->mnt_sb->s_export_op;

	if (eops && eops->permission)

		retval = eops->permission(&ctx, o_flags);

	else

		retval = may_decode_fh(&ctx, o_flags);

	if (retval)

		goto out_path;

	}



	if (copy_from_user(&f_handle, ufh, sizeof(struct file_handle))) {

		retval = -EFAULT;

include/linux/exportfs.h

+16 −1
Original line number Diff line number Diff line
@@ -3,6 +3,7 @@ 
#define LINUX_EXPORTFS_H 1



#include <linux/types.h>

#include <linux/path.h>



struct dentry;

struct iattr;
@@ -10,7 +11,6 @@ struct inode; 
struct iomap;

struct super_block;

struct vfsmount;

struct path;



/* limit the handle size to NFSv4 handle size now */

#define MAX_HANDLE_SZ 128
@@ -157,6 +157,17 @@ struct fid { 
	};

};



enum handle_to_path_flags {

	HANDLE_CHECK_PERMS   = (1 << 0),

	HANDLE_CHECK_SUBTREE = (1 << 1),

};



struct handle_to_path_ctx {

	struct path root;

	enum handle_to_path_flags flags;

	unsigned int fh_flags;

};



#define EXPORT_FH_CONNECTABLE	0x1 /* Encode file handle with parent */

#define EXPORT_FH_FID		0x2 /* File handle may be non-decodeable */

#define EXPORT_FH_DIR_ONLY	0x4 /* Only decode file handle for a directory */
@@ -226,6 +237,9 @@ struct fid { 
 *    is also a directory.  In the event that it cannot be found, or storage

 *    space cannot be allocated, a %ERR_PTR should be returned.

 *

 * permission:

 *    Allow filesystems to specify a custom permission function.

 *

 * open:

 *    Allow filesystems to specify a custom open function.

 *
@@ -255,6 +269,7 @@ struct export_operations { 
			  bool write, u32 *device_generation);

	int (*commit_blocks)(struct inode *inode, struct iomap *iomaps,

			     int nr_iomaps, struct iattr *iattr);

	int (*permission)(struct handle_to_path_ctx *ctx, unsigned int oflags);

	struct file * (*open)(struct path *path, unsigned int oflags);

#define	EXPORT_OP_NOWCC			(0x1) /* don't collect v3 wcc data */

#define	EXPORT_OP_NOSUBTREECHK		(0x2) /* no subtree checking */