1 // SPDX-License-Identifier: GPL-2.0 2 #include <linux/fanotify.h> 3 #include <linux/fdtable.h> 4 #include <linux/fsnotify_backend.h> 5 #include <linux/init.h> 6 #include <linux/jiffies.h> 7 #include <linux/kernel.h> /* UINT_MAX */ 8 #include <linux/mount.h> 9 #include <linux/sched.h> 10 #include <linux/sched/user.h> 11 #include <linux/sched/signal.h> 12 #include <linux/types.h> 13 #include <linux/wait.h> 14 #include <linux/audit.h> 15 #include <linux/sched/mm.h> 16 #include <linux/statfs.h> 17 18 #include "fanotify.h" 19 20 static bool should_merge(struct fsnotify_event *old_fsn, 21 struct fsnotify_event *new_fsn) 22 { 23 struct fanotify_event *old, *new; 24 25 pr_debug("%s: old=%p new=%p\n", __func__, old_fsn, new_fsn); 26 old = FANOTIFY_E(old_fsn); 27 new = FANOTIFY_E(new_fsn); 28 29 if (old_fsn->inode != new_fsn->inode || old->pid != new->pid || 30 old->fh_type != new->fh_type || old->fh_len != new->fh_len) 31 return false; 32 33 if (fanotify_event_has_path(old)) { 34 return old->path.mnt == new->path.mnt && 35 old->path.dentry == new->path.dentry; 36 } else if (fanotify_event_has_fid(old)) { 37 /* 38 * We want to merge many dirent events in the same dir (i.e. 39 * creates/unlinks/renames), but we do not want to merge dirent 40 * events referring to subdirs with dirent events referring to 41 * non subdirs, otherwise, user won't be able to tell from a 42 * mask FAN_CREATE|FAN_DELETE|FAN_ONDIR if it describes mkdir+ 43 * unlink pair or rmdir+create pair of events. 44 */ 45 return (old->mask & FS_ISDIR) == (new->mask & FS_ISDIR) && 46 fanotify_fid_equal(&old->fid, &new->fid, old->fh_len); 47 } 48 49 /* Do not merge events if we failed to encode fid */ 50 return false; 51 } 52 53 /* and the list better be locked by something too! */ 54 static int fanotify_merge(struct list_head *list, struct fsnotify_event *event) 55 { 56 struct fsnotify_event *test_event; 57 struct fanotify_event *new; 58 59 pr_debug("%s: list=%p event=%p\n", __func__, list, event); 60 new = FANOTIFY_E(event); 61 62 /* 63 * Don't merge a permission event with any other event so that we know 64 * the event structure we have created in fanotify_handle_event() is the 65 * one we should check for permission response. 66 */ 67 if (fanotify_is_perm_event(new->mask)) 68 return 0; 69 70 list_for_each_entry_reverse(test_event, list, list) { 71 if (should_merge(test_event, event)) { 72 FANOTIFY_E(test_event)->mask |= new->mask; 73 return 1; 74 } 75 } 76 77 return 0; 78 } 79 80 /* 81 * Wait for response to permission event. The function also takes care of 82 * freeing the permission event (or offloads that in case the wait is canceled 83 * by a signal). The function returns 0 in case access got allowed by userspace, 84 * -EPERM in case userspace disallowed the access, and -ERESTARTSYS in case 85 * the wait got interrupted by a signal. 86 */ 87 static int fanotify_get_response(struct fsnotify_group *group, 88 struct fanotify_perm_event *event, 89 struct fsnotify_iter_info *iter_info) 90 { 91 int ret; 92 93 pr_debug("%s: group=%p event=%p\n", __func__, group, event); 94 95 ret = wait_event_killable(group->fanotify_data.access_waitq, 96 event->state == FAN_EVENT_ANSWERED); 97 /* Signal pending? */ 98 if (ret < 0) { 99 spin_lock(&group->notification_lock); 100 /* Event reported to userspace and no answer yet? */ 101 if (event->state == FAN_EVENT_REPORTED) { 102 /* Event will get freed once userspace answers to it */ 103 event->state = FAN_EVENT_CANCELED; 104 spin_unlock(&group->notification_lock); 105 return ret; 106 } 107 /* Event not yet reported? Just remove it. */ 108 if (event->state == FAN_EVENT_INIT) 109 fsnotify_remove_queued_event(group, &event->fae.fse); 110 /* 111 * Event may be also answered in case signal delivery raced 112 * with wakeup. In that case we have nothing to do besides 113 * freeing the event and reporting error. 114 */ 115 spin_unlock(&group->notification_lock); 116 goto out; 117 } 118 119 /* userspace responded, convert to something usable */ 120 switch (event->response & ~FAN_AUDIT) { 121 case FAN_ALLOW: 122 ret = 0; 123 break; 124 case FAN_DENY: 125 default: 126 ret = -EPERM; 127 } 128 129 /* Check if the response should be audited */ 130 if (event->response & FAN_AUDIT) 131 audit_fanotify(event->response & ~FAN_AUDIT); 132 133 pr_debug("%s: group=%p event=%p about to return ret=%d\n", __func__, 134 group, event, ret); 135 out: 136 fsnotify_destroy_event(group, &event->fae.fse); 137 138 return ret; 139 } 140 141 /* 142 * This function returns a mask for an event that only contains the flags 143 * that have been specifically requested by the user. Flags that may have 144 * been included within the event mask, but have not been explicitly 145 * requested by the user, will not be present in the returned mask. 146 */ 147 static u32 fanotify_group_event_mask(struct fsnotify_group *group, 148 struct fsnotify_iter_info *iter_info, 149 u32 event_mask, const void *data, 150 int data_type) 151 { 152 __u32 marks_mask = 0, marks_ignored_mask = 0; 153 __u32 test_mask, user_mask = FANOTIFY_OUTGOING_EVENTS; 154 const struct path *path = data; 155 struct fsnotify_mark *mark; 156 int type; 157 158 pr_debug("%s: report_mask=%x mask=%x data=%p data_type=%d\n", 159 __func__, iter_info->report_mask, event_mask, data, data_type); 160 161 if (!FAN_GROUP_FLAG(group, FAN_REPORT_FID)) { 162 /* Do we have path to open a file descriptor? */ 163 if (data_type != FSNOTIFY_EVENT_PATH) 164 return 0; 165 /* Path type events are only relevant for files and dirs */ 166 if (!d_is_reg(path->dentry) && !d_can_lookup(path->dentry)) 167 return 0; 168 } 169 170 fsnotify_foreach_obj_type(type) { 171 if (!fsnotify_iter_should_report_type(iter_info, type)) 172 continue; 173 mark = iter_info->marks[type]; 174 /* 175 * If the event is for a child and this mark doesn't care about 176 * events on a child, don't send it! 177 */ 178 if (event_mask & FS_EVENT_ON_CHILD && 179 (type != FSNOTIFY_OBJ_TYPE_INODE || 180 !(mark->mask & FS_EVENT_ON_CHILD))) 181 continue; 182 183 marks_mask |= mark->mask; 184 marks_ignored_mask |= mark->ignored_mask; 185 } 186 187 test_mask = event_mask & marks_mask & ~marks_ignored_mask; 188 189 /* 190 * dirent modification events (create/delete/move) do not carry the 191 * child entry name/inode information. Instead, we report FAN_ONDIR 192 * for mkdir/rmdir so user can differentiate them from creat/unlink. 193 * 194 * For backward compatibility and consistency, do not report FAN_ONDIR 195 * to user in legacy fanotify mode (reporting fd) and report FAN_ONDIR 196 * to user in FAN_REPORT_FID mode for all event types. 197 */ 198 if (FAN_GROUP_FLAG(group, FAN_REPORT_FID)) { 199 /* Do not report FAN_ONDIR without any event */ 200 if (!(test_mask & ~FAN_ONDIR)) 201 return 0; 202 } else { 203 user_mask &= ~FAN_ONDIR; 204 } 205 206 if (event_mask & FS_ISDIR && 207 !(marks_mask & FS_ISDIR & ~marks_ignored_mask)) 208 return 0; 209 210 return test_mask & user_mask; 211 } 212 213 static int fanotify_encode_fid(struct fanotify_event *event, 214 struct inode *inode, gfp_t gfp, 215 __kernel_fsid_t *fsid) 216 { 217 struct fanotify_fid *fid = &event->fid; 218 int dwords, bytes = 0; 219 int err, type; 220 221 fid->ext_fh = NULL; 222 dwords = 0; 223 err = -ENOENT; 224 type = exportfs_encode_inode_fh(inode, NULL, &dwords, NULL); 225 if (!dwords) 226 goto out_err; 227 228 bytes = dwords << 2; 229 if (bytes > FANOTIFY_INLINE_FH_LEN) { 230 /* Treat failure to allocate fh as failure to allocate event */ 231 err = -ENOMEM; 232 fid->ext_fh = kmalloc(bytes, gfp); 233 if (!fid->ext_fh) 234 goto out_err; 235 } 236 237 type = exportfs_encode_inode_fh(inode, fanotify_fid_fh(fid, bytes), 238 &dwords, NULL); 239 err = -EINVAL; 240 if (!type || type == FILEID_INVALID || bytes != dwords << 2) 241 goto out_err; 242 243 fid->fsid = *fsid; 244 event->fh_len = bytes; 245 246 return type; 247 248 out_err: 249 pr_warn_ratelimited("fanotify: failed to encode fid (fsid=%x.%x, " 250 "type=%d, bytes=%d, err=%i)\n", 251 fsid->val[0], fsid->val[1], type, bytes, err); 252 kfree(fid->ext_fh); 253 fid->ext_fh = NULL; 254 event->fh_len = 0; 255 256 return FILEID_INVALID; 257 } 258 259 /* 260 * The inode to use as identifier when reporting fid depends on the event. 261 * Report the modified directory inode on dirent modification events. 262 * Report the "victim" inode otherwise. 263 * For example: 264 * FS_ATTRIB reports the child inode even if reported on a watched parent. 265 * FS_CREATE reports the modified dir inode and not the created inode. 266 */ 267 static struct inode *fanotify_fid_inode(struct inode *to_tell, u32 event_mask, 268 const void *data, int data_type) 269 { 270 if (event_mask & ALL_FSNOTIFY_DIRENT_EVENTS) 271 return to_tell; 272 else if (data_type == FSNOTIFY_EVENT_INODE) 273 return (struct inode *)data; 274 else if (data_type == FSNOTIFY_EVENT_PATH) 275 return d_inode(((struct path *)data)->dentry); 276 return NULL; 277 } 278 279 struct fanotify_event *fanotify_alloc_event(struct fsnotify_group *group, 280 struct inode *inode, u32 mask, 281 const void *data, int data_type, 282 __kernel_fsid_t *fsid) 283 { 284 struct fanotify_event *event = NULL; 285 gfp_t gfp = GFP_KERNEL_ACCOUNT; 286 struct inode *id = fanotify_fid_inode(inode, mask, data, data_type); 287 288 /* 289 * For queues with unlimited length lost events are not expected and 290 * can possibly have security implications. Avoid losing events when 291 * memory is short. 292 */ 293 if (group->max_events == UINT_MAX) 294 gfp |= __GFP_NOFAIL; 295 296 /* Whoever is interested in the event, pays for the allocation. */ 297 memalloc_use_memcg(group->memcg); 298 299 if (fanotify_is_perm_event(mask)) { 300 struct fanotify_perm_event *pevent; 301 302 pevent = kmem_cache_alloc(fanotify_perm_event_cachep, gfp); 303 if (!pevent) 304 goto out; 305 event = &pevent->fae; 306 pevent->response = 0; 307 pevent->state = FAN_EVENT_INIT; 308 goto init; 309 } 310 event = kmem_cache_alloc(fanotify_event_cachep, gfp); 311 if (!event) 312 goto out; 313 init: __maybe_unused 314 fsnotify_init_event(&event->fse, inode); 315 event->mask = mask; 316 if (FAN_GROUP_FLAG(group, FAN_REPORT_TID)) 317 event->pid = get_pid(task_pid(current)); 318 else 319 event->pid = get_pid(task_tgid(current)); 320 event->fh_len = 0; 321 if (id && FAN_GROUP_FLAG(group, FAN_REPORT_FID)) { 322 /* Report the event without a file identifier on encode error */ 323 event->fh_type = fanotify_encode_fid(event, id, gfp, fsid); 324 } else if (data_type == FSNOTIFY_EVENT_PATH) { 325 event->fh_type = FILEID_ROOT; 326 event->path = *((struct path *)data); 327 path_get(&event->path); 328 } else { 329 event->fh_type = FILEID_INVALID; 330 event->path.mnt = NULL; 331 event->path.dentry = NULL; 332 } 333 out: 334 memalloc_unuse_memcg(); 335 return event; 336 } 337 338 /* 339 * Get cached fsid of the filesystem containing the object from any connector. 340 * All connectors are supposed to have the same fsid, but we do not verify that 341 * here. 342 */ 343 static __kernel_fsid_t fanotify_get_fsid(struct fsnotify_iter_info *iter_info) 344 { 345 int type; 346 __kernel_fsid_t fsid = {}; 347 348 fsnotify_foreach_obj_type(type) { 349 struct fsnotify_mark_connector *conn; 350 351 if (!fsnotify_iter_should_report_type(iter_info, type)) 352 continue; 353 354 conn = READ_ONCE(iter_info->marks[type]->connector); 355 /* Mark is just getting destroyed or created? */ 356 if (!conn) 357 continue; 358 fsid = conn->fsid; 359 if (WARN_ON_ONCE(!fsid.val[0] && !fsid.val[1])) 360 continue; 361 return fsid; 362 } 363 364 return fsid; 365 } 366 367 static int fanotify_handle_event(struct fsnotify_group *group, 368 struct inode *inode, 369 u32 mask, const void *data, int data_type, 370 const struct qstr *file_name, u32 cookie, 371 struct fsnotify_iter_info *iter_info) 372 { 373 int ret = 0; 374 struct fanotify_event *event; 375 struct fsnotify_event *fsn_event; 376 __kernel_fsid_t fsid = {}; 377 378 BUILD_BUG_ON(FAN_ACCESS != FS_ACCESS); 379 BUILD_BUG_ON(FAN_MODIFY != FS_MODIFY); 380 BUILD_BUG_ON(FAN_ATTRIB != FS_ATTRIB); 381 BUILD_BUG_ON(FAN_CLOSE_NOWRITE != FS_CLOSE_NOWRITE); 382 BUILD_BUG_ON(FAN_CLOSE_WRITE != FS_CLOSE_WRITE); 383 BUILD_BUG_ON(FAN_OPEN != FS_OPEN); 384 BUILD_BUG_ON(FAN_MOVED_TO != FS_MOVED_TO); 385 BUILD_BUG_ON(FAN_MOVED_FROM != FS_MOVED_FROM); 386 BUILD_BUG_ON(FAN_CREATE != FS_CREATE); 387 BUILD_BUG_ON(FAN_DELETE != FS_DELETE); 388 BUILD_BUG_ON(FAN_DELETE_SELF != FS_DELETE_SELF); 389 BUILD_BUG_ON(FAN_MOVE_SELF != FS_MOVE_SELF); 390 BUILD_BUG_ON(FAN_EVENT_ON_CHILD != FS_EVENT_ON_CHILD); 391 BUILD_BUG_ON(FAN_Q_OVERFLOW != FS_Q_OVERFLOW); 392 BUILD_BUG_ON(FAN_OPEN_PERM != FS_OPEN_PERM); 393 BUILD_BUG_ON(FAN_ACCESS_PERM != FS_ACCESS_PERM); 394 BUILD_BUG_ON(FAN_ONDIR != FS_ISDIR); 395 BUILD_BUG_ON(FAN_OPEN_EXEC != FS_OPEN_EXEC); 396 BUILD_BUG_ON(FAN_OPEN_EXEC_PERM != FS_OPEN_EXEC_PERM); 397 398 BUILD_BUG_ON(HWEIGHT32(ALL_FANOTIFY_EVENT_BITS) != 19); 399 400 mask = fanotify_group_event_mask(group, iter_info, mask, data, 401 data_type); 402 if (!mask) 403 return 0; 404 405 pr_debug("%s: group=%p inode=%p mask=%x\n", __func__, group, inode, 406 mask); 407 408 if (fanotify_is_perm_event(mask)) { 409 /* 410 * fsnotify_prepare_user_wait() fails if we race with mark 411 * deletion. Just let the operation pass in that case. 412 */ 413 if (!fsnotify_prepare_user_wait(iter_info)) 414 return 0; 415 } 416 417 if (FAN_GROUP_FLAG(group, FAN_REPORT_FID)) { 418 fsid = fanotify_get_fsid(iter_info); 419 /* Racing with mark destruction or creation? */ 420 if (!fsid.val[0] && !fsid.val[1]) 421 return 0; 422 } 423 424 event = fanotify_alloc_event(group, inode, mask, data, data_type, 425 &fsid); 426 ret = -ENOMEM; 427 if (unlikely(!event)) { 428 /* 429 * We don't queue overflow events for permission events as 430 * there the access is denied and so no event is in fact lost. 431 */ 432 if (!fanotify_is_perm_event(mask)) 433 fsnotify_queue_overflow(group); 434 goto finish; 435 } 436 437 fsn_event = &event->fse; 438 ret = fsnotify_add_event(group, fsn_event, fanotify_merge); 439 if (ret) { 440 /* Permission events shouldn't be merged */ 441 BUG_ON(ret == 1 && mask & FANOTIFY_PERM_EVENTS); 442 /* Our event wasn't used in the end. Free it. */ 443 fsnotify_destroy_event(group, fsn_event); 444 445 ret = 0; 446 } else if (fanotify_is_perm_event(mask)) { 447 ret = fanotify_get_response(group, FANOTIFY_PE(fsn_event), 448 iter_info); 449 } 450 finish: 451 if (fanotify_is_perm_event(mask)) 452 fsnotify_finish_user_wait(iter_info); 453 454 return ret; 455 } 456 457 static void fanotify_free_group_priv(struct fsnotify_group *group) 458 { 459 struct user_struct *user; 460 461 user = group->fanotify_data.user; 462 atomic_dec(&user->fanotify_listeners); 463 free_uid(user); 464 } 465 466 static void fanotify_free_event(struct fsnotify_event *fsn_event) 467 { 468 struct fanotify_event *event; 469 470 event = FANOTIFY_E(fsn_event); 471 if (fanotify_event_has_path(event)) 472 path_put(&event->path); 473 else if (fanotify_event_has_ext_fh(event)) 474 kfree(event->fid.ext_fh); 475 put_pid(event->pid); 476 if (fanotify_is_perm_event(event->mask)) { 477 kmem_cache_free(fanotify_perm_event_cachep, 478 FANOTIFY_PE(fsn_event)); 479 return; 480 } 481 kmem_cache_free(fanotify_event_cachep, event); 482 } 483 484 static void fanotify_free_mark(struct fsnotify_mark *fsn_mark) 485 { 486 kmem_cache_free(fanotify_mark_cache, fsn_mark); 487 } 488 489 const struct fsnotify_ops fanotify_fsnotify_ops = { 490 .handle_event = fanotify_handle_event, 491 .free_group_priv = fanotify_free_group_priv, 492 .free_event = fanotify_free_event, 493 .free_mark = fanotify_free_mark, 494 }; 495