1 // SPDX-License-Identifier: GPL-2.0-only
2 /*
3   File: fs/xattr.c
4 
5   Extended attribute handling.
6 
7   Copyright (C) 2001 by Andreas Gruenbacher <a.gruenbacher@computer.org>
8   Copyright (C) 2001 SGI - Silicon Graphics, Inc <linux-xfs@oss.sgi.com>
9   Copyright (c) 2004 Red Hat, Inc., James Morris <jmorris@redhat.com>
10  */
11 #include <linux/fs.h>
12 #include <linux/slab.h>
13 #include <linux/file.h>
14 #include <linux/xattr.h>
15 #include <linux/mount.h>
16 #include <linux/namei.h>
17 #include <linux/security.h>
18 #include <linux/evm.h>
19 #include <linux/syscalls.h>
20 #include <linux/export.h>
21 #include <linux/fsnotify.h>
22 #include <linux/audit.h>
23 #include <linux/vmalloc.h>
24 #include <linux/posix_acl_xattr.h>
25 
26 #include <linux/uaccess.h>
27 
28 #include "internal.h"
29 
30 static const char *
strcmp_prefix(const char * a,const char * a_prefix)31 strcmp_prefix(const char *a, const char *a_prefix)
32 {
33 	while (*a_prefix && *a == *a_prefix) {
34 		a++;
35 		a_prefix++;
36 	}
37 	return *a_prefix ? NULL : a;
38 }
39 
40 /*
41  * In order to implement different sets of xattr operations for each xattr
42  * prefix, a filesystem should create a null-terminated array of struct
43  * xattr_handler (one for each prefix) and hang a pointer to it off of the
44  * s_xattr field of the superblock.
45  */
46 #define for_each_xattr_handler(handlers, handler)		\
47 	if (handlers)						\
48 		for ((handler) = *(handlers)++;			\
49 			(handler) != NULL;			\
50 			(handler) = *(handlers)++)
51 
52 /*
53  * Find the xattr_handler with the matching prefix.
54  */
55 static const struct xattr_handler *
xattr_resolve_name(struct inode * inode,const char ** name)56 xattr_resolve_name(struct inode *inode, const char **name)
57 {
58 	const struct xattr_handler **handlers = inode->i_sb->s_xattr;
59 	const struct xattr_handler *handler;
60 
61 	if (!(inode->i_opflags & IOP_XATTR)) {
62 		if (unlikely(is_bad_inode(inode)))
63 			return ERR_PTR(-EIO);
64 		return ERR_PTR(-EOPNOTSUPP);
65 	}
66 	for_each_xattr_handler(handlers, handler) {
67 		const char *n;
68 
69 		n = strcmp_prefix(*name, xattr_prefix(handler));
70 		if (n) {
71 			if (!handler->prefix ^ !*n) {
72 				if (*n)
73 					continue;
74 				return ERR_PTR(-EINVAL);
75 			}
76 			*name = n;
77 			return handler;
78 		}
79 	}
80 	return ERR_PTR(-EOPNOTSUPP);
81 }
82 
83 /*
84  * Check permissions for extended attribute access.  This is a bit complicated
85  * because different namespaces have very different rules.
86  */
87 static int
xattr_permission(struct user_namespace * mnt_userns,struct inode * inode,const char * name,int mask)88 xattr_permission(struct user_namespace *mnt_userns, struct inode *inode,
89 		 const char *name, int mask)
90 {
91 	/*
92 	 * We can never set or remove an extended attribute on a read-only
93 	 * filesystem  or on an immutable / append-only inode.
94 	 */
95 	if (mask & MAY_WRITE) {
96 		if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
97 			return -EPERM;
98 		/*
99 		 * Updating an xattr will likely cause i_uid and i_gid
100 		 * to be writen back improperly if their true value is
101 		 * unknown to the vfs.
102 		 */
103 		if (HAS_UNMAPPED_ID(mnt_userns, inode))
104 			return -EPERM;
105 	}
106 
107 	/*
108 	 * No restriction for security.* and system.* from the VFS.  Decision
109 	 * on these is left to the underlying filesystem / security module.
110 	 */
111 	if (!strncmp(name, XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN) ||
112 	    !strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
113 		return 0;
114 
115 	/*
116 	 * The trusted.* namespace can only be accessed by privileged users.
117 	 */
118 	if (!strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN)) {
119 		if (!capable(CAP_SYS_ADMIN))
120 			return (mask & MAY_WRITE) ? -EPERM : -ENODATA;
121 		return 0;
122 	}
123 
124 	/*
125 	 * In the user.* namespace, only regular files and directories can have
126 	 * extended attributes. For sticky directories, only the owner and
127 	 * privileged users can write attributes.
128 	 */
129 	if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)) {
130 		if (!S_ISREG(inode->i_mode) && !S_ISDIR(inode->i_mode))
131 			return (mask & MAY_WRITE) ? -EPERM : -ENODATA;
132 		if (S_ISDIR(inode->i_mode) && (inode->i_mode & S_ISVTX) &&
133 		    (mask & MAY_WRITE) &&
134 		    !inode_owner_or_capable(mnt_userns, inode))
135 			return -EPERM;
136 	}
137 
138 	return inode_permission(mnt_userns, inode, mask);
139 }
140 
141 /*
142  * Look for any handler that deals with the specified namespace.
143  */
144 int
xattr_supported_namespace(struct inode * inode,const char * prefix)145 xattr_supported_namespace(struct inode *inode, const char *prefix)
146 {
147 	const struct xattr_handler **handlers = inode->i_sb->s_xattr;
148 	const struct xattr_handler *handler;
149 	size_t preflen;
150 
151 	if (!(inode->i_opflags & IOP_XATTR)) {
152 		if (unlikely(is_bad_inode(inode)))
153 			return -EIO;
154 		return -EOPNOTSUPP;
155 	}
156 
157 	preflen = strlen(prefix);
158 
159 	for_each_xattr_handler(handlers, handler) {
160 		if (!strncmp(xattr_prefix(handler), prefix, preflen))
161 			return 0;
162 	}
163 
164 	return -EOPNOTSUPP;
165 }
166 EXPORT_SYMBOL(xattr_supported_namespace);
167 
168 int
__vfs_setxattr(struct user_namespace * mnt_userns,struct dentry * dentry,struct inode * inode,const char * name,const void * value,size_t size,int flags)169 __vfs_setxattr(struct user_namespace *mnt_userns, struct dentry *dentry,
170 	       struct inode *inode, const char *name, const void *value,
171 	       size_t size, int flags)
172 {
173 	const struct xattr_handler *handler;
174 
175 	handler = xattr_resolve_name(inode, &name);
176 	if (IS_ERR(handler))
177 		return PTR_ERR(handler);
178 	if (!handler->set)
179 		return -EOPNOTSUPP;
180 	if (size == 0)
181 		value = "";  /* empty EA, do not remove */
182 	return handler->set(handler, mnt_userns, dentry, inode, name, value,
183 			    size, flags);
184 }
185 EXPORT_SYMBOL(__vfs_setxattr);
186 
187 /**
188  *  __vfs_setxattr_noperm - perform setxattr operation without performing
189  *  permission checks.
190  *
191  *  @mnt_userns: user namespace of the mount the inode was found from
192  *  @dentry: object to perform setxattr on
193  *  @name: xattr name to set
194  *  @value: value to set @name to
195  *  @size: size of @value
196  *  @flags: flags to pass into filesystem operations
197  *
198  *  returns the result of the internal setxattr or setsecurity operations.
199  *
200  *  This function requires the caller to lock the inode's i_mutex before it
201  *  is executed. It also assumes that the caller will make the appropriate
202  *  permission checks.
203  */
__vfs_setxattr_noperm(struct user_namespace * mnt_userns,struct dentry * dentry,const char * name,const void * value,size_t size,int flags)204 int __vfs_setxattr_noperm(struct user_namespace *mnt_userns,
205 			  struct dentry *dentry, const char *name,
206 			  const void *value, size_t size, int flags)
207 {
208 	struct inode *inode = dentry->d_inode;
209 	int error = -EAGAIN;
210 	int issec = !strncmp(name, XATTR_SECURITY_PREFIX,
211 				   XATTR_SECURITY_PREFIX_LEN);
212 
213 	if (issec)
214 		inode->i_flags &= ~S_NOSEC;
215 	if (inode->i_opflags & IOP_XATTR) {
216 		error = __vfs_setxattr(mnt_userns, dentry, inode, name, value,
217 				       size, flags);
218 		if (!error) {
219 			fsnotify_xattr(dentry);
220 			security_inode_post_setxattr(dentry, name, value,
221 						     size, flags);
222 		}
223 	} else {
224 		if (unlikely(is_bad_inode(inode)))
225 			return -EIO;
226 	}
227 	if (error == -EAGAIN) {
228 		error = -EOPNOTSUPP;
229 
230 		if (issec) {
231 			const char *suffix = name + XATTR_SECURITY_PREFIX_LEN;
232 
233 			error = security_inode_setsecurity(inode, suffix, value,
234 							   size, flags);
235 			if (!error)
236 				fsnotify_xattr(dentry);
237 		}
238 	}
239 
240 	return error;
241 }
242 
243 /**
244  * __vfs_setxattr_locked - set an extended attribute while holding the inode
245  * lock
246  *
247  *  @mnt_userns: user namespace of the mount of the target inode
248  *  @dentry: object to perform setxattr on
249  *  @name: xattr name to set
250  *  @value: value to set @name to
251  *  @size: size of @value
252  *  @flags: flags to pass into filesystem operations
253  *  @delegated_inode: on return, will contain an inode pointer that
254  *  a delegation was broken on, NULL if none.
255  */
256 int
__vfs_setxattr_locked(struct user_namespace * mnt_userns,struct dentry * dentry,const char * name,const void * value,size_t size,int flags,struct inode ** delegated_inode)257 __vfs_setxattr_locked(struct user_namespace *mnt_userns, struct dentry *dentry,
258 		      const char *name, const void *value, size_t size,
259 		      int flags, struct inode **delegated_inode)
260 {
261 	struct inode *inode = dentry->d_inode;
262 	int error;
263 
264 	error = xattr_permission(mnt_userns, inode, name, MAY_WRITE);
265 	if (error)
266 		return error;
267 
268 	error = security_inode_setxattr(mnt_userns, dentry, name, value, size,
269 					flags);
270 	if (error)
271 		goto out;
272 
273 	error = try_break_deleg(inode, delegated_inode);
274 	if (error)
275 		goto out;
276 
277 	error = __vfs_setxattr_noperm(mnt_userns, dentry, name, value,
278 				      size, flags);
279 
280 out:
281 	return error;
282 }
283 EXPORT_SYMBOL_GPL(__vfs_setxattr_locked);
284 
is_posix_acl_xattr(const char * name)285 static inline bool is_posix_acl_xattr(const char *name)
286 {
287 	return (strcmp(name, XATTR_NAME_POSIX_ACL_ACCESS) == 0) ||
288 	       (strcmp(name, XATTR_NAME_POSIX_ACL_DEFAULT) == 0);
289 }
290 
291 int
vfs_setxattr(struct user_namespace * mnt_userns,struct dentry * dentry,const char * name,const void * value,size_t size,int flags)292 vfs_setxattr(struct user_namespace *mnt_userns, struct dentry *dentry,
293 	     const char *name, const void *value, size_t size, int flags)
294 {
295 	struct inode *inode = dentry->d_inode;
296 	struct inode *delegated_inode = NULL;
297 	const void  *orig_value = value;
298 	int error;
299 
300 	if (size && strcmp(name, XATTR_NAME_CAPS) == 0) {
301 		error = cap_convert_nscap(mnt_userns, dentry, &value, size);
302 		if (error < 0)
303 			return error;
304 		size = error;
305 	}
306 
307 retry_deleg:
308 	inode_lock(inode);
309 	error = __vfs_setxattr_locked(mnt_userns, dentry, name, value, size,
310 				      flags, &delegated_inode);
311 	inode_unlock(inode);
312 
313 	if (delegated_inode) {
314 		error = break_deleg_wait(&delegated_inode);
315 		if (!error)
316 			goto retry_deleg;
317 	}
318 	if (value != orig_value)
319 		kfree(value);
320 
321 	return error;
322 }
323 EXPORT_SYMBOL_GPL(vfs_setxattr);
324 
325 static ssize_t
xattr_getsecurity(struct user_namespace * mnt_userns,struct inode * inode,const char * name,void * value,size_t size)326 xattr_getsecurity(struct user_namespace *mnt_userns, struct inode *inode,
327 		  const char *name, void *value, size_t size)
328 {
329 	void *buffer = NULL;
330 	ssize_t len;
331 
332 	if (!value || !size) {
333 		len = security_inode_getsecurity(mnt_userns, inode, name,
334 						 &buffer, false);
335 		goto out_noalloc;
336 	}
337 
338 	len = security_inode_getsecurity(mnt_userns, inode, name, &buffer,
339 					 true);
340 	if (len < 0)
341 		return len;
342 	if (size < len) {
343 		len = -ERANGE;
344 		goto out;
345 	}
346 	memcpy(value, buffer, len);
347 out:
348 	kfree(buffer);
349 out_noalloc:
350 	return len;
351 }
352 
353 /*
354  * vfs_getxattr_alloc - allocate memory, if necessary, before calling getxattr
355  *
356  * Allocate memory, if not already allocated, or re-allocate correct size,
357  * before retrieving the extended attribute.
358  *
359  * Returns the result of alloc, if failed, or the getxattr operation.
360  */
361 ssize_t
vfs_getxattr_alloc(struct user_namespace * mnt_userns,struct dentry * dentry,const char * name,char ** xattr_value,size_t xattr_size,gfp_t flags)362 vfs_getxattr_alloc(struct user_namespace *mnt_userns, struct dentry *dentry,
363 		   const char *name, char **xattr_value, size_t xattr_size,
364 		   gfp_t flags)
365 {
366 	const struct xattr_handler *handler;
367 	struct inode *inode = dentry->d_inode;
368 	char *value = *xattr_value;
369 	int error;
370 
371 	error = xattr_permission(mnt_userns, inode, name, MAY_READ);
372 	if (error)
373 		return error;
374 
375 	handler = xattr_resolve_name(inode, &name);
376 	if (IS_ERR(handler))
377 		return PTR_ERR(handler);
378 	if (!handler->get)
379 		return -EOPNOTSUPP;
380 	error = handler->get(handler, dentry, inode, name, NULL, 0);
381 	if (error < 0)
382 		return error;
383 
384 	if (!value || (error > xattr_size)) {
385 		value = krealloc(*xattr_value, error + 1, flags);
386 		if (!value)
387 			return -ENOMEM;
388 		memset(value, 0, error + 1);
389 	}
390 
391 	error = handler->get(handler, dentry, inode, name, value, error);
392 	*xattr_value = value;
393 	return error;
394 }
395 
396 ssize_t
__vfs_getxattr(struct dentry * dentry,struct inode * inode,const char * name,void * value,size_t size)397 __vfs_getxattr(struct dentry *dentry, struct inode *inode, const char *name,
398 	       void *value, size_t size)
399 {
400 	const struct xattr_handler *handler;
401 
402 	handler = xattr_resolve_name(inode, &name);
403 	if (IS_ERR(handler))
404 		return PTR_ERR(handler);
405 	if (!handler->get)
406 		return -EOPNOTSUPP;
407 	return handler->get(handler, dentry, inode, name, value, size);
408 }
409 EXPORT_SYMBOL(__vfs_getxattr);
410 
411 ssize_t
vfs_getxattr(struct user_namespace * mnt_userns,struct dentry * dentry,const char * name,void * value,size_t size)412 vfs_getxattr(struct user_namespace *mnt_userns, struct dentry *dentry,
413 	     const char *name, void *value, size_t size)
414 {
415 	struct inode *inode = dentry->d_inode;
416 	int error;
417 
418 	error = xattr_permission(mnt_userns, inode, name, MAY_READ);
419 	if (error)
420 		return error;
421 
422 	error = security_inode_getxattr(dentry, name);
423 	if (error)
424 		return error;
425 
426 	if (!strncmp(name, XATTR_SECURITY_PREFIX,
427 				XATTR_SECURITY_PREFIX_LEN)) {
428 		const char *suffix = name + XATTR_SECURITY_PREFIX_LEN;
429 		int ret = xattr_getsecurity(mnt_userns, inode, suffix, value,
430 					    size);
431 		/*
432 		 * Only overwrite the return value if a security module
433 		 * is actually active.
434 		 */
435 		if (ret == -EOPNOTSUPP)
436 			goto nolsm;
437 		return ret;
438 	}
439 nolsm:
440 	error = __vfs_getxattr(dentry, inode, name, value, size);
441 	if (error > 0 && is_posix_acl_xattr(name))
442 		posix_acl_getxattr_idmapped_mnt(mnt_userns, inode, value, size);
443 	return error;
444 }
445 EXPORT_SYMBOL_GPL(vfs_getxattr);
446 
447 ssize_t
vfs_listxattr(struct dentry * dentry,char * list,size_t size)448 vfs_listxattr(struct dentry *dentry, char *list, size_t size)
449 {
450 	struct inode *inode = d_inode(dentry);
451 	ssize_t error;
452 
453 	error = security_inode_listxattr(dentry);
454 	if (error)
455 		return error;
456 	if (inode->i_op->listxattr && (inode->i_opflags & IOP_XATTR)) {
457 		error = inode->i_op->listxattr(dentry, list, size);
458 	} else {
459 		error = security_inode_listsecurity(inode, list, size);
460 		if (size && error > size)
461 			error = -ERANGE;
462 	}
463 	return error;
464 }
465 EXPORT_SYMBOL_GPL(vfs_listxattr);
466 
467 int
__vfs_removexattr(struct user_namespace * mnt_userns,struct dentry * dentry,const char * name)468 __vfs_removexattr(struct user_namespace *mnt_userns, struct dentry *dentry,
469 		  const char *name)
470 {
471 	struct inode *inode = d_inode(dentry);
472 	const struct xattr_handler *handler;
473 
474 	handler = xattr_resolve_name(inode, &name);
475 	if (IS_ERR(handler))
476 		return PTR_ERR(handler);
477 	if (!handler->set)
478 		return -EOPNOTSUPP;
479 	return handler->set(handler, mnt_userns, dentry, inode, name, NULL, 0,
480 			    XATTR_REPLACE);
481 }
482 EXPORT_SYMBOL(__vfs_removexattr);
483 
484 /**
485  * __vfs_removexattr_locked - set an extended attribute while holding the inode
486  * lock
487  *
488  *  @mnt_userns: user namespace of the mount of the target inode
489  *  @dentry: object to perform setxattr on
490  *  @name: name of xattr to remove
491  *  @delegated_inode: on return, will contain an inode pointer that
492  *  a delegation was broken on, NULL if none.
493  */
494 int
__vfs_removexattr_locked(struct user_namespace * mnt_userns,struct dentry * dentry,const char * name,struct inode ** delegated_inode)495 __vfs_removexattr_locked(struct user_namespace *mnt_userns,
496 			 struct dentry *dentry, const char *name,
497 			 struct inode **delegated_inode)
498 {
499 	struct inode *inode = dentry->d_inode;
500 	int error;
501 
502 	error = xattr_permission(mnt_userns, inode, name, MAY_WRITE);
503 	if (error)
504 		return error;
505 
506 	error = security_inode_removexattr(mnt_userns, dentry, name);
507 	if (error)
508 		goto out;
509 
510 	error = try_break_deleg(inode, delegated_inode);
511 	if (error)
512 		goto out;
513 
514 	error = __vfs_removexattr(mnt_userns, dentry, name);
515 
516 	if (!error) {
517 		fsnotify_xattr(dentry);
518 		evm_inode_post_removexattr(dentry, name);
519 	}
520 
521 out:
522 	return error;
523 }
524 EXPORT_SYMBOL_GPL(__vfs_removexattr_locked);
525 
526 int
vfs_removexattr(struct user_namespace * mnt_userns,struct dentry * dentry,const char * name)527 vfs_removexattr(struct user_namespace *mnt_userns, struct dentry *dentry,
528 		const char *name)
529 {
530 	struct inode *inode = dentry->d_inode;
531 	struct inode *delegated_inode = NULL;
532 	int error;
533 
534 retry_deleg:
535 	inode_lock(inode);
536 	error = __vfs_removexattr_locked(mnt_userns, dentry,
537 					 name, &delegated_inode);
538 	inode_unlock(inode);
539 
540 	if (delegated_inode) {
541 		error = break_deleg_wait(&delegated_inode);
542 		if (!error)
543 			goto retry_deleg;
544 	}
545 
546 	return error;
547 }
548 EXPORT_SYMBOL_GPL(vfs_removexattr);
549 
550 /*
551  * Extended attribute SET operations
552  */
553 
setxattr_copy(const char __user * name,struct xattr_ctx * ctx)554 int setxattr_copy(const char __user *name, struct xattr_ctx *ctx)
555 {
556 	int error;
557 
558 	if (ctx->flags & ~(XATTR_CREATE|XATTR_REPLACE))
559 		return -EINVAL;
560 
561 	error = strncpy_from_user(ctx->kname->name, name,
562 				sizeof(ctx->kname->name));
563 	if (error == 0 || error == sizeof(ctx->kname->name))
564 		return  -ERANGE;
565 	if (error < 0)
566 		return error;
567 
568 	error = 0;
569 	if (ctx->size) {
570 		if (ctx->size > XATTR_SIZE_MAX)
571 			return -E2BIG;
572 
573 		ctx->kvalue = vmemdup_user(ctx->cvalue, ctx->size);
574 		if (IS_ERR(ctx->kvalue)) {
575 			error = PTR_ERR(ctx->kvalue);
576 			ctx->kvalue = NULL;
577 		}
578 	}
579 
580 	return error;
581 }
582 
setxattr_convert(struct user_namespace * mnt_userns,struct dentry * d,struct xattr_ctx * ctx)583 static void setxattr_convert(struct user_namespace *mnt_userns,
584 			     struct dentry *d, struct xattr_ctx *ctx)
585 {
586 	if (ctx->size && is_posix_acl_xattr(ctx->kname->name))
587 		posix_acl_fix_xattr_from_user(ctx->kvalue, ctx->size);
588 }
589 
do_setxattr(struct user_namespace * mnt_userns,struct dentry * dentry,struct xattr_ctx * ctx)590 int do_setxattr(struct user_namespace *mnt_userns, struct dentry *dentry,
591 		struct xattr_ctx *ctx)
592 {
593 	setxattr_convert(mnt_userns, dentry, ctx);
594 	return vfs_setxattr(mnt_userns, dentry, ctx->kname->name,
595 			ctx->kvalue, ctx->size, ctx->flags);
596 }
597 
598 static long
setxattr(struct user_namespace * mnt_userns,struct dentry * d,const char __user * name,const void __user * value,size_t size,int flags)599 setxattr(struct user_namespace *mnt_userns, struct dentry *d,
600 	const char __user *name, const void __user *value, size_t size,
601 	int flags)
602 {
603 	struct xattr_name kname;
604 	struct xattr_ctx ctx = {
605 		.cvalue   = value,
606 		.kvalue   = NULL,
607 		.size     = size,
608 		.kname    = &kname,
609 		.flags    = flags,
610 	};
611 	int error;
612 
613 	error = setxattr_copy(name, &ctx);
614 	if (error)
615 		return error;
616 
617 	error = do_setxattr(mnt_userns, d, &ctx);
618 
619 	kvfree(ctx.kvalue);
620 	return error;
621 }
622 
path_setxattr(const char __user * pathname,const char __user * name,const void __user * value,size_t size,int flags,unsigned int lookup_flags)623 static int path_setxattr(const char __user *pathname,
624 			 const char __user *name, const void __user *value,
625 			 size_t size, int flags, unsigned int lookup_flags)
626 {
627 	struct path path;
628 	int error;
629 
630 retry:
631 	error = user_path_at(AT_FDCWD, pathname, lookup_flags, &path);
632 	if (error)
633 		return error;
634 	error = mnt_want_write(path.mnt);
635 	if (!error) {
636 		error = setxattr(mnt_user_ns(path.mnt), path.dentry, name,
637 				 value, size, flags);
638 		mnt_drop_write(path.mnt);
639 	}
640 	path_put(&path);
641 	if (retry_estale(error, lookup_flags)) {
642 		lookup_flags |= LOOKUP_REVAL;
643 		goto retry;
644 	}
645 	return error;
646 }
647 
SYSCALL_DEFINE5(setxattr,const char __user *,pathname,const char __user *,name,const void __user *,value,size_t,size,int,flags)648 SYSCALL_DEFINE5(setxattr, const char __user *, pathname,
649 		const char __user *, name, const void __user *, value,
650 		size_t, size, int, flags)
651 {
652 	return path_setxattr(pathname, name, value, size, flags, LOOKUP_FOLLOW);
653 }
654 
SYSCALL_DEFINE5(lsetxattr,const char __user *,pathname,const char __user *,name,const void __user *,value,size_t,size,int,flags)655 SYSCALL_DEFINE5(lsetxattr, const char __user *, pathname,
656 		const char __user *, name, const void __user *, value,
657 		size_t, size, int, flags)
658 {
659 	return path_setxattr(pathname, name, value, size, flags, 0);
660 }
661 
SYSCALL_DEFINE5(fsetxattr,int,fd,const char __user *,name,const void __user *,value,size_t,size,int,flags)662 SYSCALL_DEFINE5(fsetxattr, int, fd, const char __user *, name,
663 		const void __user *,value, size_t, size, int, flags)
664 {
665 	struct fd f = fdget(fd);
666 	int error = -EBADF;
667 
668 	if (!f.file)
669 		return error;
670 	audit_file(f.file);
671 	error = mnt_want_write_file(f.file);
672 	if (!error) {
673 		error = setxattr(file_mnt_user_ns(f.file),
674 				 f.file->f_path.dentry, name,
675 				 value, size, flags);
676 		mnt_drop_write_file(f.file);
677 	}
678 	fdput(f);
679 	return error;
680 }
681 
682 /*
683  * Extended attribute GET operations
684  */
685 ssize_t
do_getxattr(struct user_namespace * mnt_userns,struct dentry * d,struct xattr_ctx * ctx)686 do_getxattr(struct user_namespace *mnt_userns, struct dentry *d,
687 	struct xattr_ctx *ctx)
688 {
689 	ssize_t error;
690 	char *kname = ctx->kname->name;
691 
692 	if (ctx->size) {
693 		if (ctx->size > XATTR_SIZE_MAX)
694 			ctx->size = XATTR_SIZE_MAX;
695 		ctx->kvalue = kvzalloc(ctx->size, GFP_KERNEL);
696 		if (!ctx->kvalue)
697 			return -ENOMEM;
698 	}
699 
700 	error = vfs_getxattr(mnt_userns, d, kname, ctx->kvalue, ctx->size);
701 	if (error > 0) {
702 		if (is_posix_acl_xattr(kname))
703 			posix_acl_fix_xattr_to_user(ctx->kvalue, error);
704 		if (ctx->size && copy_to_user(ctx->value, ctx->kvalue, error))
705 			error = -EFAULT;
706 	} else if (error == -ERANGE && ctx->size >= XATTR_SIZE_MAX) {
707 		/* The file system tried to returned a value bigger
708 		   than XATTR_SIZE_MAX bytes. Not possible. */
709 		error = -E2BIG;
710 	}
711 
712 	return error;
713 }
714 
715 static ssize_t
getxattr(struct user_namespace * mnt_userns,struct dentry * d,const char __user * name,void __user * value,size_t size)716 getxattr(struct user_namespace *mnt_userns, struct dentry *d,
717 	 const char __user *name, void __user *value, size_t size)
718 {
719 	ssize_t error;
720 	struct xattr_name kname;
721 	struct xattr_ctx ctx = {
722 		.value    = value,
723 		.kvalue   = NULL,
724 		.size     = size,
725 		.kname    = &kname,
726 		.flags    = 0,
727 	};
728 
729 	error = strncpy_from_user(kname.name, name, sizeof(kname.name));
730 	if (error == 0 || error == sizeof(kname.name))
731 		error = -ERANGE;
732 	if (error < 0)
733 		return error;
734 
735 	error =  do_getxattr(mnt_userns, d, &ctx);
736 
737 	kvfree(ctx.kvalue);
738 	return error;
739 }
740 
path_getxattr(const char __user * pathname,const char __user * name,void __user * value,size_t size,unsigned int lookup_flags)741 static ssize_t path_getxattr(const char __user *pathname,
742 			     const char __user *name, void __user *value,
743 			     size_t size, unsigned int lookup_flags)
744 {
745 	struct path path;
746 	ssize_t error;
747 retry:
748 	error = user_path_at(AT_FDCWD, pathname, lookup_flags, &path);
749 	if (error)
750 		return error;
751 	error = getxattr(mnt_user_ns(path.mnt), path.dentry, name, value, size);
752 	path_put(&path);
753 	if (retry_estale(error, lookup_flags)) {
754 		lookup_flags |= LOOKUP_REVAL;
755 		goto retry;
756 	}
757 	return error;
758 }
759 
SYSCALL_DEFINE4(getxattr,const char __user *,pathname,const char __user *,name,void __user *,value,size_t,size)760 SYSCALL_DEFINE4(getxattr, const char __user *, pathname,
761 		const char __user *, name, void __user *, value, size_t, size)
762 {
763 	return path_getxattr(pathname, name, value, size, LOOKUP_FOLLOW);
764 }
765 
SYSCALL_DEFINE4(lgetxattr,const char __user *,pathname,const char __user *,name,void __user *,value,size_t,size)766 SYSCALL_DEFINE4(lgetxattr, const char __user *, pathname,
767 		const char __user *, name, void __user *, value, size_t, size)
768 {
769 	return path_getxattr(pathname, name, value, size, 0);
770 }
771 
SYSCALL_DEFINE4(fgetxattr,int,fd,const char __user *,name,void __user *,value,size_t,size)772 SYSCALL_DEFINE4(fgetxattr, int, fd, const char __user *, name,
773 		void __user *, value, size_t, size)
774 {
775 	struct fd f = fdget(fd);
776 	ssize_t error = -EBADF;
777 
778 	if (!f.file)
779 		return error;
780 	audit_file(f.file);
781 	error = getxattr(file_mnt_user_ns(f.file), f.file->f_path.dentry,
782 			 name, value, size);
783 	fdput(f);
784 	return error;
785 }
786 
787 /*
788  * Extended attribute LIST operations
789  */
790 static ssize_t
listxattr(struct dentry * d,char __user * list,size_t size)791 listxattr(struct dentry *d, char __user *list, size_t size)
792 {
793 	ssize_t error;
794 	char *klist = NULL;
795 
796 	if (size) {
797 		if (size > XATTR_LIST_MAX)
798 			size = XATTR_LIST_MAX;
799 		klist = kvmalloc(size, GFP_KERNEL);
800 		if (!klist)
801 			return -ENOMEM;
802 	}
803 
804 	error = vfs_listxattr(d, klist, size);
805 	if (error > 0) {
806 		if (size && copy_to_user(list, klist, error))
807 			error = -EFAULT;
808 	} else if (error == -ERANGE && size >= XATTR_LIST_MAX) {
809 		/* The file system tried to returned a list bigger
810 		   than XATTR_LIST_MAX bytes. Not possible. */
811 		error = -E2BIG;
812 	}
813 
814 	kvfree(klist);
815 
816 	return error;
817 }
818 
path_listxattr(const char __user * pathname,char __user * list,size_t size,unsigned int lookup_flags)819 static ssize_t path_listxattr(const char __user *pathname, char __user *list,
820 			      size_t size, unsigned int lookup_flags)
821 {
822 	struct path path;
823 	ssize_t error;
824 retry:
825 	error = user_path_at(AT_FDCWD, pathname, lookup_flags, &path);
826 	if (error)
827 		return error;
828 	error = listxattr(path.dentry, list, size);
829 	path_put(&path);
830 	if (retry_estale(error, lookup_flags)) {
831 		lookup_flags |= LOOKUP_REVAL;
832 		goto retry;
833 	}
834 	return error;
835 }
836 
SYSCALL_DEFINE3(listxattr,const char __user *,pathname,char __user *,list,size_t,size)837 SYSCALL_DEFINE3(listxattr, const char __user *, pathname, char __user *, list,
838 		size_t, size)
839 {
840 	return path_listxattr(pathname, list, size, LOOKUP_FOLLOW);
841 }
842 
SYSCALL_DEFINE3(llistxattr,const char __user *,pathname,char __user *,list,size_t,size)843 SYSCALL_DEFINE3(llistxattr, const char __user *, pathname, char __user *, list,
844 		size_t, size)
845 {
846 	return path_listxattr(pathname, list, size, 0);
847 }
848 
SYSCALL_DEFINE3(flistxattr,int,fd,char __user *,list,size_t,size)849 SYSCALL_DEFINE3(flistxattr, int, fd, char __user *, list, size_t, size)
850 {
851 	struct fd f = fdget(fd);
852 	ssize_t error = -EBADF;
853 
854 	if (!f.file)
855 		return error;
856 	audit_file(f.file);
857 	error = listxattr(f.file->f_path.dentry, list, size);
858 	fdput(f);
859 	return error;
860 }
861 
862 /*
863  * Extended attribute REMOVE operations
864  */
865 static long
removexattr(struct user_namespace * mnt_userns,struct dentry * d,const char __user * name)866 removexattr(struct user_namespace *mnt_userns, struct dentry *d,
867 	    const char __user *name)
868 {
869 	int error;
870 	char kname[XATTR_NAME_MAX + 1];
871 
872 	error = strncpy_from_user(kname, name, sizeof(kname));
873 	if (error == 0 || error == sizeof(kname))
874 		error = -ERANGE;
875 	if (error < 0)
876 		return error;
877 
878 	return vfs_removexattr(mnt_userns, d, kname);
879 }
880 
path_removexattr(const char __user * pathname,const char __user * name,unsigned int lookup_flags)881 static int path_removexattr(const char __user *pathname,
882 			    const char __user *name, unsigned int lookup_flags)
883 {
884 	struct path path;
885 	int error;
886 retry:
887 	error = user_path_at(AT_FDCWD, pathname, lookup_flags, &path);
888 	if (error)
889 		return error;
890 	error = mnt_want_write(path.mnt);
891 	if (!error) {
892 		error = removexattr(mnt_user_ns(path.mnt), path.dentry, name);
893 		mnt_drop_write(path.mnt);
894 	}
895 	path_put(&path);
896 	if (retry_estale(error, lookup_flags)) {
897 		lookup_flags |= LOOKUP_REVAL;
898 		goto retry;
899 	}
900 	return error;
901 }
902 
SYSCALL_DEFINE2(removexattr,const char __user *,pathname,const char __user *,name)903 SYSCALL_DEFINE2(removexattr, const char __user *, pathname,
904 		const char __user *, name)
905 {
906 	return path_removexattr(pathname, name, LOOKUP_FOLLOW);
907 }
908 
SYSCALL_DEFINE2(lremovexattr,const char __user *,pathname,const char __user *,name)909 SYSCALL_DEFINE2(lremovexattr, const char __user *, pathname,
910 		const char __user *, name)
911 {
912 	return path_removexattr(pathname, name, 0);
913 }
914 
SYSCALL_DEFINE2(fremovexattr,int,fd,const char __user *,name)915 SYSCALL_DEFINE2(fremovexattr, int, fd, const char __user *, name)
916 {
917 	struct fd f = fdget(fd);
918 	int error = -EBADF;
919 
920 	if (!f.file)
921 		return error;
922 	audit_file(f.file);
923 	error = mnt_want_write_file(f.file);
924 	if (!error) {
925 		error = removexattr(file_mnt_user_ns(f.file),
926 				    f.file->f_path.dentry, name);
927 		mnt_drop_write_file(f.file);
928 	}
929 	fdput(f);
930 	return error;
931 }
932 
933 /*
934  * Combine the results of the list() operation from every xattr_handler in the
935  * list.
936  */
937 ssize_t
generic_listxattr(struct dentry * dentry,char * buffer,size_t buffer_size)938 generic_listxattr(struct dentry *dentry, char *buffer, size_t buffer_size)
939 {
940 	const struct xattr_handler *handler, **handlers = dentry->d_sb->s_xattr;
941 	unsigned int size = 0;
942 
943 	if (!buffer) {
944 		for_each_xattr_handler(handlers, handler) {
945 			if (!handler->name ||
946 			    (handler->list && !handler->list(dentry)))
947 				continue;
948 			size += strlen(handler->name) + 1;
949 		}
950 	} else {
951 		char *buf = buffer;
952 		size_t len;
953 
954 		for_each_xattr_handler(handlers, handler) {
955 			if (!handler->name ||
956 			    (handler->list && !handler->list(dentry)))
957 				continue;
958 			len = strlen(handler->name);
959 			if (len + 1 > buffer_size)
960 				return -ERANGE;
961 			memcpy(buf, handler->name, len + 1);
962 			buf += len + 1;
963 			buffer_size -= len + 1;
964 		}
965 		size = buf - buffer;
966 	}
967 	return size;
968 }
969 EXPORT_SYMBOL(generic_listxattr);
970 
971 /**
972  * xattr_full_name  -  Compute full attribute name from suffix
973  *
974  * @handler:	handler of the xattr_handler operation
975  * @name:	name passed to the xattr_handler operation
976  *
977  * The get and set xattr handler operations are called with the remainder of
978  * the attribute name after skipping the handler's prefix: for example, "foo"
979  * is passed to the get operation of a handler with prefix "user." to get
980  * attribute "user.foo".  The full name is still "there" in the name though.
981  *
982  * Note: the list xattr handler operation when called from the vfs is passed a
983  * NULL name; some file systems use this operation internally, with varying
984  * semantics.
985  */
xattr_full_name(const struct xattr_handler * handler,const char * name)986 const char *xattr_full_name(const struct xattr_handler *handler,
987 			    const char *name)
988 {
989 	size_t prefix_len = strlen(xattr_prefix(handler));
990 
991 	return name - prefix_len;
992 }
993 EXPORT_SYMBOL(xattr_full_name);
994 
995 /*
996  * Allocate new xattr and copy in the value; but leave the name to callers.
997  */
simple_xattr_alloc(const void * value,size_t size)998 struct simple_xattr *simple_xattr_alloc(const void *value, size_t size)
999 {
1000 	struct simple_xattr *new_xattr;
1001 	size_t len;
1002 
1003 	/* wrap around? */
1004 	len = sizeof(*new_xattr) + size;
1005 	if (len < sizeof(*new_xattr))
1006 		return NULL;
1007 
1008 	new_xattr = kvmalloc(len, GFP_KERNEL);
1009 	if (!new_xattr)
1010 		return NULL;
1011 
1012 	new_xattr->size = size;
1013 	memcpy(new_xattr->value, value, size);
1014 	return new_xattr;
1015 }
1016 
1017 /*
1018  * xattr GET operation for in-memory/pseudo filesystems
1019  */
simple_xattr_get(struct simple_xattrs * xattrs,const char * name,void * buffer,size_t size)1020 int simple_xattr_get(struct simple_xattrs *xattrs, const char *name,
1021 		     void *buffer, size_t size)
1022 {
1023 	struct simple_xattr *xattr;
1024 	int ret = -ENODATA;
1025 
1026 	spin_lock(&xattrs->lock);
1027 	list_for_each_entry(xattr, &xattrs->head, list) {
1028 		if (strcmp(name, xattr->name))
1029 			continue;
1030 
1031 		ret = xattr->size;
1032 		if (buffer) {
1033 			if (size < xattr->size)
1034 				ret = -ERANGE;
1035 			else
1036 				memcpy(buffer, xattr->value, xattr->size);
1037 		}
1038 		break;
1039 	}
1040 	spin_unlock(&xattrs->lock);
1041 	return ret;
1042 }
1043 
1044 /**
1045  * simple_xattr_set - xattr SET operation for in-memory/pseudo filesystems
1046  * @xattrs: target simple_xattr list
1047  * @name: name of the extended attribute
1048  * @value: value of the xattr. If %NULL, will remove the attribute.
1049  * @size: size of the new xattr
1050  * @flags: %XATTR_{CREATE|REPLACE}
1051  * @removed_size: returns size of the removed xattr, -1 if none removed
1052  *
1053  * %XATTR_CREATE is set, the xattr shouldn't exist already; otherwise fails
1054  * with -EEXIST.  If %XATTR_REPLACE is set, the xattr should exist;
1055  * otherwise, fails with -ENODATA.
1056  *
1057  * Returns 0 on success, -errno on failure.
1058  */
simple_xattr_set(struct simple_xattrs * xattrs,const char * name,const void * value,size_t size,int flags,ssize_t * removed_size)1059 int simple_xattr_set(struct simple_xattrs *xattrs, const char *name,
1060 		     const void *value, size_t size, int flags,
1061 		     ssize_t *removed_size)
1062 {
1063 	struct simple_xattr *xattr;
1064 	struct simple_xattr *new_xattr = NULL;
1065 	int err = 0;
1066 
1067 	if (removed_size)
1068 		*removed_size = -1;
1069 
1070 	/* value == NULL means remove */
1071 	if (value) {
1072 		new_xattr = simple_xattr_alloc(value, size);
1073 		if (!new_xattr)
1074 			return -ENOMEM;
1075 
1076 		new_xattr->name = kstrdup(name, GFP_KERNEL);
1077 		if (!new_xattr->name) {
1078 			kvfree(new_xattr);
1079 			return -ENOMEM;
1080 		}
1081 	}
1082 
1083 	spin_lock(&xattrs->lock);
1084 	list_for_each_entry(xattr, &xattrs->head, list) {
1085 		if (!strcmp(name, xattr->name)) {
1086 			if (flags & XATTR_CREATE) {
1087 				xattr = new_xattr;
1088 				err = -EEXIST;
1089 			} else if (new_xattr) {
1090 				list_replace(&xattr->list, &new_xattr->list);
1091 				if (removed_size)
1092 					*removed_size = xattr->size;
1093 			} else {
1094 				list_del(&xattr->list);
1095 				if (removed_size)
1096 					*removed_size = xattr->size;
1097 			}
1098 			goto out;
1099 		}
1100 	}
1101 	if (flags & XATTR_REPLACE) {
1102 		xattr = new_xattr;
1103 		err = -ENODATA;
1104 	} else {
1105 		list_add(&new_xattr->list, &xattrs->head);
1106 		xattr = NULL;
1107 	}
1108 out:
1109 	spin_unlock(&xattrs->lock);
1110 	if (xattr) {
1111 		kfree(xattr->name);
1112 		kvfree(xattr);
1113 	}
1114 	return err;
1115 
1116 }
1117 
xattr_is_trusted(const char * name)1118 static bool xattr_is_trusted(const char *name)
1119 {
1120 	return !strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN);
1121 }
1122 
xattr_list_one(char ** buffer,ssize_t * remaining_size,const char * name)1123 static int xattr_list_one(char **buffer, ssize_t *remaining_size,
1124 			  const char *name)
1125 {
1126 	size_t len = strlen(name) + 1;
1127 	if (*buffer) {
1128 		if (*remaining_size < len)
1129 			return -ERANGE;
1130 		memcpy(*buffer, name, len);
1131 		*buffer += len;
1132 	}
1133 	*remaining_size -= len;
1134 	return 0;
1135 }
1136 
1137 /*
1138  * xattr LIST operation for in-memory/pseudo filesystems
1139  */
simple_xattr_list(struct inode * inode,struct simple_xattrs * xattrs,char * buffer,size_t size)1140 ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs *xattrs,
1141 			  char *buffer, size_t size)
1142 {
1143 	bool trusted = ns_capable_noaudit(&init_user_ns, CAP_SYS_ADMIN);
1144 	struct simple_xattr *xattr;
1145 	ssize_t remaining_size = size;
1146 	int err = 0;
1147 
1148 #ifdef CONFIG_FS_POSIX_ACL
1149 	if (IS_POSIXACL(inode)) {
1150 		if (inode->i_acl) {
1151 			err = xattr_list_one(&buffer, &remaining_size,
1152 					     XATTR_NAME_POSIX_ACL_ACCESS);
1153 			if (err)
1154 				return err;
1155 		}
1156 		if (inode->i_default_acl) {
1157 			err = xattr_list_one(&buffer, &remaining_size,
1158 					     XATTR_NAME_POSIX_ACL_DEFAULT);
1159 			if (err)
1160 				return err;
1161 		}
1162 	}
1163 #endif
1164 
1165 	spin_lock(&xattrs->lock);
1166 	list_for_each_entry(xattr, &xattrs->head, list) {
1167 		/* skip "trusted." attributes for unprivileged callers */
1168 		if (!trusted && xattr_is_trusted(xattr->name))
1169 			continue;
1170 
1171 		err = xattr_list_one(&buffer, &remaining_size, xattr->name);
1172 		if (err)
1173 			break;
1174 	}
1175 	spin_unlock(&xattrs->lock);
1176 
1177 	return err ? err : size - remaining_size;
1178 }
1179 
1180 /*
1181  * Adds an extended attribute to the list
1182  */
simple_xattr_list_add(struct simple_xattrs * xattrs,struct simple_xattr * new_xattr)1183 void simple_xattr_list_add(struct simple_xattrs *xattrs,
1184 			   struct simple_xattr *new_xattr)
1185 {
1186 	spin_lock(&xattrs->lock);
1187 	list_add(&new_xattr->list, &xattrs->head);
1188 	spin_unlock(&xattrs->lock);
1189 }
1190