1 /* -*- linux-c -*- --------------------------------------------------------- * 2 * 3 * linux/fs/devpts/inode.c 4 * 5 * Copyright 1998-2004 H. Peter Anvin -- All Rights Reserved 6 * 7 * This file is part of the Linux kernel and is made available under 8 * the terms of the GNU General Public License, version 2, or at your 9 * option, any later version, incorporated herein by reference. 10 * 11 * ------------------------------------------------------------------------- */ 12 13 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt 14 15 #include <linux/module.h> 16 #include <linux/init.h> 17 #include <linux/fs.h> 18 #include <linux/sched.h> 19 #include <linux/namei.h> 20 #include <linux/slab.h> 21 #include <linux/mount.h> 22 #include <linux/tty.h> 23 #include <linux/mutex.h> 24 #include <linux/magic.h> 25 #include <linux/idr.h> 26 #include <linux/devpts_fs.h> 27 #include <linux/parser.h> 28 #include <linux/fsnotify.h> 29 #include <linux/seq_file.h> 30 31 #define DEVPTS_DEFAULT_MODE 0600 32 /* 33 * ptmx is a new node in /dev/pts and will be unused in legacy (single- 34 * instance) mode. To prevent surprises in user space, set permissions of 35 * ptmx to 0. Use 'chmod' or remount with '-o ptmxmode' to set meaningful 36 * permissions. 37 */ 38 #define DEVPTS_DEFAULT_PTMX_MODE 0000 39 #define PTMX_MINOR 2 40 41 /* 42 * sysctl support for setting limits on the number of Unix98 ptys allocated. 43 * Otherwise one can eat up all kernel memory by opening /dev/ptmx repeatedly. 44 */ 45 static int pty_limit = NR_UNIX98_PTY_DEFAULT; 46 static int pty_reserve = NR_UNIX98_PTY_RESERVE; 47 static int pty_limit_min; 48 static int pty_limit_max = INT_MAX; 49 static int pty_count; 50 51 static struct ctl_table pty_table[] = { 52 { 53 .procname = "max", 54 .maxlen = sizeof(int), 55 .mode = 0644, 56 .data = &pty_limit, 57 .proc_handler = proc_dointvec_minmax, 58 .extra1 = &pty_limit_min, 59 .extra2 = &pty_limit_max, 60 }, { 61 .procname = "reserve", 62 .maxlen = sizeof(int), 63 .mode = 0644, 64 .data = &pty_reserve, 65 .proc_handler = proc_dointvec_minmax, 66 .extra1 = &pty_limit_min, 67 .extra2 = &pty_limit_max, 68 }, { 69 .procname = "nr", 70 .maxlen = sizeof(int), 71 .mode = 0444, 72 .data = &pty_count, 73 .proc_handler = proc_dointvec, 74 }, 75 {} 76 }; 77 78 static struct ctl_table pty_kern_table[] = { 79 { 80 .procname = "pty", 81 .mode = 0555, 82 .child = pty_table, 83 }, 84 {} 85 }; 86 87 static struct ctl_table pty_root_table[] = { 88 { 89 .procname = "kernel", 90 .mode = 0555, 91 .child = pty_kern_table, 92 }, 93 {} 94 }; 95 96 static DEFINE_MUTEX(allocated_ptys_lock); 97 98 struct pts_mount_opts { 99 int setuid; 100 int setgid; 101 kuid_t uid; 102 kgid_t gid; 103 umode_t mode; 104 umode_t ptmxmode; 105 int reserve; 106 int max; 107 }; 108 109 enum { 110 Opt_uid, Opt_gid, Opt_mode, Opt_ptmxmode, Opt_newinstance, Opt_max, 111 Opt_err 112 }; 113 114 static const match_table_t tokens = { 115 {Opt_uid, "uid=%u"}, 116 {Opt_gid, "gid=%u"}, 117 {Opt_mode, "mode=%o"}, 118 {Opt_ptmxmode, "ptmxmode=%o"}, 119 {Opt_newinstance, "newinstance"}, 120 {Opt_max, "max=%d"}, 121 {Opt_err, NULL} 122 }; 123 124 struct pts_fs_info { 125 struct ida allocated_ptys; 126 struct pts_mount_opts mount_opts; 127 struct super_block *sb; 128 struct dentry *ptmx_dentry; 129 }; 130 131 static inline struct pts_fs_info *DEVPTS_SB(struct super_block *sb) 132 { 133 return sb->s_fs_info; 134 } 135 136 struct pts_fs_info *devpts_acquire(struct file *filp) 137 { 138 struct pts_fs_info *result; 139 struct path path; 140 struct super_block *sb; 141 int err; 142 143 path = filp->f_path; 144 path_get(&path); 145 146 /* Has the devpts filesystem already been found? */ 147 sb = path.mnt->mnt_sb; 148 if (sb->s_magic != DEVPTS_SUPER_MAGIC) { 149 /* Is a devpts filesystem at "pts" in the same directory? */ 150 err = path_pts(&path); 151 if (err) { 152 result = ERR_PTR(err); 153 goto out; 154 } 155 156 /* Is the path the root of a devpts filesystem? */ 157 result = ERR_PTR(-ENODEV); 158 sb = path.mnt->mnt_sb; 159 if ((sb->s_magic != DEVPTS_SUPER_MAGIC) || 160 (path.mnt->mnt_root != sb->s_root)) 161 goto out; 162 } 163 164 /* 165 * pty code needs to hold extra references in case of last /dev/tty close 166 */ 167 atomic_inc(&sb->s_active); 168 result = DEVPTS_SB(sb); 169 170 out: 171 path_put(&path); 172 return result; 173 } 174 175 void devpts_release(struct pts_fs_info *fsi) 176 { 177 deactivate_super(fsi->sb); 178 } 179 180 #define PARSE_MOUNT 0 181 #define PARSE_REMOUNT 1 182 183 /* 184 * parse_mount_options(): 185 * Set @opts to mount options specified in @data. If an option is not 186 * specified in @data, set it to its default value. 187 * 188 * Note: @data may be NULL (in which case all options are set to default). 189 */ 190 static int parse_mount_options(char *data, int op, struct pts_mount_opts *opts) 191 { 192 char *p; 193 kuid_t uid; 194 kgid_t gid; 195 196 opts->setuid = 0; 197 opts->setgid = 0; 198 opts->uid = GLOBAL_ROOT_UID; 199 opts->gid = GLOBAL_ROOT_GID; 200 opts->mode = DEVPTS_DEFAULT_MODE; 201 opts->ptmxmode = DEVPTS_DEFAULT_PTMX_MODE; 202 opts->max = NR_UNIX98_PTY_MAX; 203 204 /* Only allow instances mounted from the initial mount 205 * namespace to tap the reserve pool of ptys. 206 */ 207 if (op == PARSE_MOUNT) 208 opts->reserve = 209 (current->nsproxy->mnt_ns == init_task.nsproxy->mnt_ns); 210 211 while ((p = strsep(&data, ",")) != NULL) { 212 substring_t args[MAX_OPT_ARGS]; 213 int token; 214 int option; 215 216 if (!*p) 217 continue; 218 219 token = match_token(p, tokens, args); 220 switch (token) { 221 case Opt_uid: 222 if (match_int(&args[0], &option)) 223 return -EINVAL; 224 uid = make_kuid(current_user_ns(), option); 225 if (!uid_valid(uid)) 226 return -EINVAL; 227 opts->uid = uid; 228 opts->setuid = 1; 229 break; 230 case Opt_gid: 231 if (match_int(&args[0], &option)) 232 return -EINVAL; 233 gid = make_kgid(current_user_ns(), option); 234 if (!gid_valid(gid)) 235 return -EINVAL; 236 opts->gid = gid; 237 opts->setgid = 1; 238 break; 239 case Opt_mode: 240 if (match_octal(&args[0], &option)) 241 return -EINVAL; 242 opts->mode = option & S_IALLUGO; 243 break; 244 case Opt_ptmxmode: 245 if (match_octal(&args[0], &option)) 246 return -EINVAL; 247 opts->ptmxmode = option & S_IALLUGO; 248 break; 249 case Opt_newinstance: 250 break; 251 case Opt_max: 252 if (match_int(&args[0], &option) || 253 option < 0 || option > NR_UNIX98_PTY_MAX) 254 return -EINVAL; 255 opts->max = option; 256 break; 257 default: 258 pr_err("called with bogus options\n"); 259 return -EINVAL; 260 } 261 } 262 263 return 0; 264 } 265 266 static int mknod_ptmx(struct super_block *sb) 267 { 268 int mode; 269 int rc = -ENOMEM; 270 struct dentry *dentry; 271 struct inode *inode; 272 struct dentry *root = sb->s_root; 273 struct pts_fs_info *fsi = DEVPTS_SB(sb); 274 struct pts_mount_opts *opts = &fsi->mount_opts; 275 kuid_t root_uid; 276 kgid_t root_gid; 277 278 root_uid = make_kuid(current_user_ns(), 0); 279 root_gid = make_kgid(current_user_ns(), 0); 280 if (!uid_valid(root_uid) || !gid_valid(root_gid)) 281 return -EINVAL; 282 283 inode_lock(d_inode(root)); 284 285 /* If we have already created ptmx node, return */ 286 if (fsi->ptmx_dentry) { 287 rc = 0; 288 goto out; 289 } 290 291 dentry = d_alloc_name(root, "ptmx"); 292 if (!dentry) { 293 pr_err("Unable to alloc dentry for ptmx node\n"); 294 goto out; 295 } 296 297 /* 298 * Create a new 'ptmx' node in this mount of devpts. 299 */ 300 inode = new_inode(sb); 301 if (!inode) { 302 pr_err("Unable to alloc inode for ptmx node\n"); 303 dput(dentry); 304 goto out; 305 } 306 307 inode->i_ino = 2; 308 inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME; 309 310 mode = S_IFCHR|opts->ptmxmode; 311 init_special_inode(inode, mode, MKDEV(TTYAUX_MAJOR, 2)); 312 inode->i_uid = root_uid; 313 inode->i_gid = root_gid; 314 315 d_add(dentry, inode); 316 317 fsi->ptmx_dentry = dentry; 318 rc = 0; 319 out: 320 inode_unlock(d_inode(root)); 321 return rc; 322 } 323 324 static void update_ptmx_mode(struct pts_fs_info *fsi) 325 { 326 struct inode *inode; 327 if (fsi->ptmx_dentry) { 328 inode = d_inode(fsi->ptmx_dentry); 329 inode->i_mode = S_IFCHR|fsi->mount_opts.ptmxmode; 330 } 331 } 332 333 static int devpts_remount(struct super_block *sb, int *flags, char *data) 334 { 335 int err; 336 struct pts_fs_info *fsi = DEVPTS_SB(sb); 337 struct pts_mount_opts *opts = &fsi->mount_opts; 338 339 err = parse_mount_options(data, PARSE_REMOUNT, opts); 340 341 /* 342 * parse_mount_options() restores options to default values 343 * before parsing and may have changed ptmxmode. So, update the 344 * mode in the inode too. Bogus options don't fail the remount, 345 * so do this even on error return. 346 */ 347 update_ptmx_mode(fsi); 348 349 return err; 350 } 351 352 static int devpts_show_options(struct seq_file *seq, struct dentry *root) 353 { 354 struct pts_fs_info *fsi = DEVPTS_SB(root->d_sb); 355 struct pts_mount_opts *opts = &fsi->mount_opts; 356 357 if (opts->setuid) 358 seq_printf(seq, ",uid=%u", 359 from_kuid_munged(&init_user_ns, opts->uid)); 360 if (opts->setgid) 361 seq_printf(seq, ",gid=%u", 362 from_kgid_munged(&init_user_ns, opts->gid)); 363 seq_printf(seq, ",mode=%03o", opts->mode); 364 seq_printf(seq, ",ptmxmode=%03o", opts->ptmxmode); 365 if (opts->max < NR_UNIX98_PTY_MAX) 366 seq_printf(seq, ",max=%d", opts->max); 367 368 return 0; 369 } 370 371 static const struct super_operations devpts_sops = { 372 .statfs = simple_statfs, 373 .remount_fs = devpts_remount, 374 .show_options = devpts_show_options, 375 }; 376 377 static void *new_pts_fs_info(struct super_block *sb) 378 { 379 struct pts_fs_info *fsi; 380 381 fsi = kzalloc(sizeof(struct pts_fs_info), GFP_KERNEL); 382 if (!fsi) 383 return NULL; 384 385 ida_init(&fsi->allocated_ptys); 386 fsi->mount_opts.mode = DEVPTS_DEFAULT_MODE; 387 fsi->mount_opts.ptmxmode = DEVPTS_DEFAULT_PTMX_MODE; 388 fsi->sb = sb; 389 390 return fsi; 391 } 392 393 static int 394 devpts_fill_super(struct super_block *s, void *data, int silent) 395 { 396 struct inode *inode; 397 int error; 398 399 s->s_iflags &= ~SB_I_NODEV; 400 s->s_blocksize = 1024; 401 s->s_blocksize_bits = 10; 402 s->s_magic = DEVPTS_SUPER_MAGIC; 403 s->s_op = &devpts_sops; 404 s->s_time_gran = 1; 405 406 error = -ENOMEM; 407 s->s_fs_info = new_pts_fs_info(s); 408 if (!s->s_fs_info) 409 goto fail; 410 411 error = parse_mount_options(data, PARSE_MOUNT, &DEVPTS_SB(s)->mount_opts); 412 if (error) 413 goto fail; 414 415 error = -ENOMEM; 416 inode = new_inode(s); 417 if (!inode) 418 goto fail; 419 inode->i_ino = 1; 420 inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME; 421 inode->i_mode = S_IFDIR | S_IRUGO | S_IXUGO | S_IWUSR; 422 inode->i_op = &simple_dir_inode_operations; 423 inode->i_fop = &simple_dir_operations; 424 set_nlink(inode, 2); 425 426 s->s_root = d_make_root(inode); 427 if (!s->s_root) { 428 pr_err("get root dentry failed\n"); 429 goto fail; 430 } 431 432 error = mknod_ptmx(s); 433 if (error) 434 goto fail_dput; 435 436 return 0; 437 fail_dput: 438 dput(s->s_root); 439 s->s_root = NULL; 440 fail: 441 return error; 442 } 443 444 /* 445 * devpts_mount() 446 * 447 * Mount a new (private) instance of devpts. PTYs created in this 448 * instance are independent of the PTYs in other devpts instances. 449 */ 450 static struct dentry *devpts_mount(struct file_system_type *fs_type, 451 int flags, const char *dev_name, void *data) 452 { 453 return mount_nodev(fs_type, flags, data, devpts_fill_super); 454 } 455 456 static void devpts_kill_sb(struct super_block *sb) 457 { 458 struct pts_fs_info *fsi = DEVPTS_SB(sb); 459 460 if (fsi) 461 ida_destroy(&fsi->allocated_ptys); 462 kfree(fsi); 463 kill_litter_super(sb); 464 } 465 466 static struct file_system_type devpts_fs_type = { 467 .name = "devpts", 468 .mount = devpts_mount, 469 .kill_sb = devpts_kill_sb, 470 .fs_flags = FS_USERNS_MOUNT, 471 }; 472 473 /* 474 * The normal naming convention is simply /dev/pts/<number>; this conforms 475 * to the System V naming convention 476 */ 477 478 int devpts_new_index(struct pts_fs_info *fsi) 479 { 480 int index; 481 int ida_ret; 482 483 retry: 484 if (!ida_pre_get(&fsi->allocated_ptys, GFP_KERNEL)) 485 return -ENOMEM; 486 487 mutex_lock(&allocated_ptys_lock); 488 if (pty_count >= (pty_limit - 489 (fsi->mount_opts.reserve ? 0 : pty_reserve))) { 490 mutex_unlock(&allocated_ptys_lock); 491 return -ENOSPC; 492 } 493 494 ida_ret = ida_get_new(&fsi->allocated_ptys, &index); 495 if (ida_ret < 0) { 496 mutex_unlock(&allocated_ptys_lock); 497 if (ida_ret == -EAGAIN) 498 goto retry; 499 return -EIO; 500 } 501 502 if (index >= fsi->mount_opts.max) { 503 ida_remove(&fsi->allocated_ptys, index); 504 mutex_unlock(&allocated_ptys_lock); 505 return -ENOSPC; 506 } 507 pty_count++; 508 mutex_unlock(&allocated_ptys_lock); 509 return index; 510 } 511 512 void devpts_kill_index(struct pts_fs_info *fsi, int idx) 513 { 514 mutex_lock(&allocated_ptys_lock); 515 ida_remove(&fsi->allocated_ptys, idx); 516 pty_count--; 517 mutex_unlock(&allocated_ptys_lock); 518 } 519 520 /** 521 * devpts_pty_new -- create a new inode in /dev/pts/ 522 * @ptmx_inode: inode of the master 523 * @device: major+minor of the node to be created 524 * @index: used as a name of the node 525 * @priv: what's given back by devpts_get_priv 526 * 527 * The created inode is returned. Remove it from /dev/pts/ by devpts_pty_kill. 528 */ 529 struct dentry *devpts_pty_new(struct pts_fs_info *fsi, int index, void *priv) 530 { 531 struct dentry *dentry; 532 struct super_block *sb = fsi->sb; 533 struct inode *inode; 534 struct dentry *root; 535 struct pts_mount_opts *opts; 536 char s[12]; 537 538 root = sb->s_root; 539 opts = &fsi->mount_opts; 540 541 inode = new_inode(sb); 542 if (!inode) 543 return ERR_PTR(-ENOMEM); 544 545 inode->i_ino = index + 3; 546 inode->i_uid = opts->setuid ? opts->uid : current_fsuid(); 547 inode->i_gid = opts->setgid ? opts->gid : current_fsgid(); 548 inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME; 549 init_special_inode(inode, S_IFCHR|opts->mode, MKDEV(UNIX98_PTY_SLAVE_MAJOR, index)); 550 551 sprintf(s, "%d", index); 552 553 dentry = d_alloc_name(root, s); 554 if (dentry) { 555 dentry->d_fsdata = priv; 556 d_add(dentry, inode); 557 fsnotify_create(d_inode(root), dentry); 558 } else { 559 iput(inode); 560 dentry = ERR_PTR(-ENOMEM); 561 } 562 563 return dentry; 564 } 565 566 /** 567 * devpts_get_priv -- get private data for a slave 568 * @pts_inode: inode of the slave 569 * 570 * Returns whatever was passed as priv in devpts_pty_new for a given inode. 571 */ 572 void *devpts_get_priv(struct dentry *dentry) 573 { 574 if (dentry->d_sb->s_magic != DEVPTS_SUPER_MAGIC) 575 return NULL; 576 return dentry->d_fsdata; 577 } 578 579 /** 580 * devpts_pty_kill -- remove inode form /dev/pts/ 581 * @inode: inode of the slave to be removed 582 * 583 * This is an inverse operation of devpts_pty_new. 584 */ 585 void devpts_pty_kill(struct dentry *dentry) 586 { 587 WARN_ON_ONCE(dentry->d_sb->s_magic != DEVPTS_SUPER_MAGIC); 588 589 dentry->d_fsdata = NULL; 590 drop_nlink(dentry->d_inode); 591 d_delete(dentry); 592 dput(dentry); /* d_alloc_name() in devpts_pty_new() */ 593 } 594 595 static int __init init_devpts_fs(void) 596 { 597 int err = register_filesystem(&devpts_fs_type); 598 if (!err) { 599 register_sysctl_table(pty_root_table); 600 } 601 return err; 602 } 603 module_init(init_devpts_fs) 604