1 // SPDX-License-Identifier: GPL-2.0 2 #include <linux/fanotify.h> 3 #include <linux/fcntl.h> 4 #include <linux/fdtable.h> 5 #include <linux/file.h> 6 #include <linux/fs.h> 7 #include <linux/anon_inodes.h> 8 #include <linux/fsnotify_backend.h> 9 #include <linux/init.h> 10 #include <linux/mount.h> 11 #include <linux/namei.h> 12 #include <linux/poll.h> 13 #include <linux/security.h> 14 #include <linux/syscalls.h> 15 #include <linux/slab.h> 16 #include <linux/types.h> 17 #include <linux/uaccess.h> 18 #include <linux/compat.h> 19 #include <linux/sched/signal.h> 20 #include <linux/memcontrol.h> 21 #include <linux/statfs.h> 22 #include <linux/exportfs.h> 23 24 #include <asm/ioctls.h> 25 26 #include "../../mount.h" 27 #include "../fdinfo.h" 28 #include "fanotify.h" 29 30 #define FANOTIFY_DEFAULT_MAX_EVENTS 16384 31 #define FANOTIFY_OLD_DEFAULT_MAX_MARKS 8192 32 #define FANOTIFY_DEFAULT_MAX_GROUPS 128 33 #define FANOTIFY_DEFAULT_FEE_POOL_SIZE 32 34 35 /* 36 * Legacy fanotify marks limits (8192) is per group and we introduced a tunable 37 * limit of marks per user, similar to inotify. Effectively, the legacy limit 38 * of fanotify marks per user is <max marks per group> * <max groups per user>. 39 * This default limit (1M) also happens to match the increased limit of inotify 40 * max_user_watches since v5.10. 41 */ 42 #define FANOTIFY_DEFAULT_MAX_USER_MARKS \ 43 (FANOTIFY_OLD_DEFAULT_MAX_MARKS * FANOTIFY_DEFAULT_MAX_GROUPS) 44 45 /* 46 * Most of the memory cost of adding an inode mark is pinning the marked inode. 47 * The size of the filesystem inode struct is not uniform across filesystems, 48 * so double the size of a VFS inode is used as a conservative approximation. 49 */ 50 #define INODE_MARK_COST (2 * sizeof(struct inode)) 51 52 /* configurable via /proc/sys/fs/fanotify/ */ 53 static int fanotify_max_queued_events __read_mostly; 54 55 #ifdef CONFIG_SYSCTL 56 57 #include <linux/sysctl.h> 58 59 static long ft_zero = 0; 60 static long ft_int_max = INT_MAX; 61 62 struct ctl_table fanotify_table[] = { 63 { 64 .procname = "max_user_groups", 65 .data = &init_user_ns.ucount_max[UCOUNT_FANOTIFY_GROUPS], 66 .maxlen = sizeof(long), 67 .mode = 0644, 68 .proc_handler = proc_doulongvec_minmax, 69 .extra1 = &ft_zero, 70 .extra2 = &ft_int_max, 71 }, 72 { 73 .procname = "max_user_marks", 74 .data = &init_user_ns.ucount_max[UCOUNT_FANOTIFY_MARKS], 75 .maxlen = sizeof(long), 76 .mode = 0644, 77 .proc_handler = proc_doulongvec_minmax, 78 .extra1 = &ft_zero, 79 .extra2 = &ft_int_max, 80 }, 81 { 82 .procname = "max_queued_events", 83 .data = &fanotify_max_queued_events, 84 .maxlen = sizeof(int), 85 .mode = 0644, 86 .proc_handler = proc_dointvec_minmax, 87 .extra1 = SYSCTL_ZERO 88 }, 89 { } 90 }; 91 #endif /* CONFIG_SYSCTL */ 92 93 /* 94 * All flags that may be specified in parameter event_f_flags of fanotify_init. 95 * 96 * Internal and external open flags are stored together in field f_flags of 97 * struct file. Only external open flags shall be allowed in event_f_flags. 98 * Internal flags like FMODE_NONOTIFY, FMODE_EXEC, FMODE_NOCMTIME shall be 99 * excluded. 100 */ 101 #define FANOTIFY_INIT_ALL_EVENT_F_BITS ( \ 102 O_ACCMODE | O_APPEND | O_NONBLOCK | \ 103 __O_SYNC | O_DSYNC | O_CLOEXEC | \ 104 O_LARGEFILE | O_NOATIME ) 105 106 extern const struct fsnotify_ops fanotify_fsnotify_ops; 107 108 struct kmem_cache *fanotify_mark_cache __read_mostly; 109 struct kmem_cache *fanotify_fid_event_cachep __read_mostly; 110 struct kmem_cache *fanotify_path_event_cachep __read_mostly; 111 struct kmem_cache *fanotify_perm_event_cachep __read_mostly; 112 113 #define FANOTIFY_EVENT_ALIGN 4 114 #define FANOTIFY_FID_INFO_HDR_LEN \ 115 (sizeof(struct fanotify_event_info_fid) + sizeof(struct file_handle)) 116 #define FANOTIFY_PIDFD_INFO_HDR_LEN \ 117 sizeof(struct fanotify_event_info_pidfd) 118 #define FANOTIFY_ERROR_INFO_LEN \ 119 (sizeof(struct fanotify_event_info_error)) 120 121 static int fanotify_fid_info_len(int fh_len, int name_len) 122 { 123 int info_len = fh_len; 124 125 if (name_len) 126 info_len += name_len + 1; 127 128 return roundup(FANOTIFY_FID_INFO_HDR_LEN + info_len, 129 FANOTIFY_EVENT_ALIGN); 130 } 131 132 static size_t fanotify_event_len(unsigned int info_mode, 133 struct fanotify_event *event) 134 { 135 size_t event_len = FAN_EVENT_METADATA_LEN; 136 struct fanotify_info *info; 137 int dir_fh_len; 138 int fh_len; 139 int dot_len = 0; 140 141 if (!info_mode) 142 return event_len; 143 144 if (fanotify_is_error_event(event->mask)) 145 event_len += FANOTIFY_ERROR_INFO_LEN; 146 147 info = fanotify_event_info(event); 148 149 if (fanotify_event_has_dir_fh(event)) { 150 dir_fh_len = fanotify_event_dir_fh_len(event); 151 event_len += fanotify_fid_info_len(dir_fh_len, info->name_len); 152 } else if ((info_mode & FAN_REPORT_NAME) && 153 (event->mask & FAN_ONDIR)) { 154 /* 155 * With group flag FAN_REPORT_NAME, if name was not recorded in 156 * event on a directory, we will report the name ".". 157 */ 158 dot_len = 1; 159 } 160 161 if (info_mode & FAN_REPORT_PIDFD) 162 event_len += FANOTIFY_PIDFD_INFO_HDR_LEN; 163 164 if (fanotify_event_has_object_fh(event)) { 165 fh_len = fanotify_event_object_fh_len(event); 166 event_len += fanotify_fid_info_len(fh_len, dot_len); 167 } 168 169 return event_len; 170 } 171 172 /* 173 * Remove an hashed event from merge hash table. 174 */ 175 static void fanotify_unhash_event(struct fsnotify_group *group, 176 struct fanotify_event *event) 177 { 178 assert_spin_locked(&group->notification_lock); 179 180 pr_debug("%s: group=%p event=%p bucket=%u\n", __func__, 181 group, event, fanotify_event_hash_bucket(group, event)); 182 183 if (WARN_ON_ONCE(hlist_unhashed(&event->merge_list))) 184 return; 185 186 hlist_del_init(&event->merge_list); 187 } 188 189 /* 190 * Get an fanotify notification event if one exists and is small 191 * enough to fit in "count". Return an error pointer if the count 192 * is not large enough. When permission event is dequeued, its state is 193 * updated accordingly. 194 */ 195 static struct fanotify_event *get_one_event(struct fsnotify_group *group, 196 size_t count) 197 { 198 size_t event_size; 199 struct fanotify_event *event = NULL; 200 struct fsnotify_event *fsn_event; 201 unsigned int info_mode = FAN_GROUP_FLAG(group, FANOTIFY_INFO_MODES); 202 203 pr_debug("%s: group=%p count=%zd\n", __func__, group, count); 204 205 spin_lock(&group->notification_lock); 206 fsn_event = fsnotify_peek_first_event(group); 207 if (!fsn_event) 208 goto out; 209 210 event = FANOTIFY_E(fsn_event); 211 event_size = fanotify_event_len(info_mode, event); 212 213 if (event_size > count) { 214 event = ERR_PTR(-EINVAL); 215 goto out; 216 } 217 218 /* 219 * Held the notification_lock the whole time, so this is the 220 * same event we peeked above. 221 */ 222 fsnotify_remove_first_event(group); 223 if (fanotify_is_perm_event(event->mask)) 224 FANOTIFY_PERM(event)->state = FAN_EVENT_REPORTED; 225 if (fanotify_is_hashed_event(event->mask)) 226 fanotify_unhash_event(group, event); 227 out: 228 spin_unlock(&group->notification_lock); 229 return event; 230 } 231 232 static int create_fd(struct fsnotify_group *group, struct path *path, 233 struct file **file) 234 { 235 int client_fd; 236 struct file *new_file; 237 238 client_fd = get_unused_fd_flags(group->fanotify_data.f_flags); 239 if (client_fd < 0) 240 return client_fd; 241 242 /* 243 * we need a new file handle for the userspace program so it can read even if it was 244 * originally opened O_WRONLY. 245 */ 246 new_file = dentry_open(path, 247 group->fanotify_data.f_flags | FMODE_NONOTIFY, 248 current_cred()); 249 if (IS_ERR(new_file)) { 250 /* 251 * we still send an event even if we can't open the file. this 252 * can happen when say tasks are gone and we try to open their 253 * /proc files or we try to open a WRONLY file like in sysfs 254 * we just send the errno to userspace since there isn't much 255 * else we can do. 256 */ 257 put_unused_fd(client_fd); 258 client_fd = PTR_ERR(new_file); 259 } else { 260 *file = new_file; 261 } 262 263 return client_fd; 264 } 265 266 /* 267 * Finish processing of permission event by setting it to ANSWERED state and 268 * drop group->notification_lock. 269 */ 270 static void finish_permission_event(struct fsnotify_group *group, 271 struct fanotify_perm_event *event, 272 unsigned int response) 273 __releases(&group->notification_lock) 274 { 275 bool destroy = false; 276 277 assert_spin_locked(&group->notification_lock); 278 event->response = response; 279 if (event->state == FAN_EVENT_CANCELED) 280 destroy = true; 281 else 282 event->state = FAN_EVENT_ANSWERED; 283 spin_unlock(&group->notification_lock); 284 if (destroy) 285 fsnotify_destroy_event(group, &event->fae.fse); 286 } 287 288 static int process_access_response(struct fsnotify_group *group, 289 struct fanotify_response *response_struct) 290 { 291 struct fanotify_perm_event *event; 292 int fd = response_struct->fd; 293 int response = response_struct->response; 294 295 pr_debug("%s: group=%p fd=%d response=%d\n", __func__, group, 296 fd, response); 297 /* 298 * make sure the response is valid, if invalid we do nothing and either 299 * userspace can send a valid response or we will clean it up after the 300 * timeout 301 */ 302 switch (response & ~FAN_AUDIT) { 303 case FAN_ALLOW: 304 case FAN_DENY: 305 break; 306 default: 307 return -EINVAL; 308 } 309 310 if (fd < 0) 311 return -EINVAL; 312 313 if ((response & FAN_AUDIT) && !FAN_GROUP_FLAG(group, FAN_ENABLE_AUDIT)) 314 return -EINVAL; 315 316 spin_lock(&group->notification_lock); 317 list_for_each_entry(event, &group->fanotify_data.access_list, 318 fae.fse.list) { 319 if (event->fd != fd) 320 continue; 321 322 list_del_init(&event->fae.fse.list); 323 finish_permission_event(group, event, response); 324 wake_up(&group->fanotify_data.access_waitq); 325 return 0; 326 } 327 spin_unlock(&group->notification_lock); 328 329 return -ENOENT; 330 } 331 332 static size_t copy_error_info_to_user(struct fanotify_event *event, 333 char __user *buf, int count) 334 { 335 struct fanotify_event_info_error info; 336 struct fanotify_error_event *fee = FANOTIFY_EE(event); 337 338 info.hdr.info_type = FAN_EVENT_INFO_TYPE_ERROR; 339 info.hdr.pad = 0; 340 info.hdr.len = FANOTIFY_ERROR_INFO_LEN; 341 342 if (WARN_ON(count < info.hdr.len)) 343 return -EFAULT; 344 345 info.error = fee->error; 346 info.error_count = fee->err_count; 347 348 if (copy_to_user(buf, &info, sizeof(info))) 349 return -EFAULT; 350 351 return info.hdr.len; 352 } 353 354 static int copy_fid_info_to_user(__kernel_fsid_t *fsid, struct fanotify_fh *fh, 355 int info_type, const char *name, 356 size_t name_len, 357 char __user *buf, size_t count) 358 { 359 struct fanotify_event_info_fid info = { }; 360 struct file_handle handle = { }; 361 unsigned char bounce[FANOTIFY_INLINE_FH_LEN], *fh_buf; 362 size_t fh_len = fh ? fh->len : 0; 363 size_t info_len = fanotify_fid_info_len(fh_len, name_len); 364 size_t len = info_len; 365 366 pr_debug("%s: fh_len=%zu name_len=%zu, info_len=%zu, count=%zu\n", 367 __func__, fh_len, name_len, info_len, count); 368 369 if (WARN_ON_ONCE(len < sizeof(info) || len > count)) 370 return -EFAULT; 371 372 /* 373 * Copy event info fid header followed by variable sized file handle 374 * and optionally followed by variable sized filename. 375 */ 376 switch (info_type) { 377 case FAN_EVENT_INFO_TYPE_FID: 378 case FAN_EVENT_INFO_TYPE_DFID: 379 if (WARN_ON_ONCE(name_len)) 380 return -EFAULT; 381 break; 382 case FAN_EVENT_INFO_TYPE_DFID_NAME: 383 if (WARN_ON_ONCE(!name || !name_len)) 384 return -EFAULT; 385 break; 386 default: 387 return -EFAULT; 388 } 389 390 info.hdr.info_type = info_type; 391 info.hdr.len = len; 392 info.fsid = *fsid; 393 if (copy_to_user(buf, &info, sizeof(info))) 394 return -EFAULT; 395 396 buf += sizeof(info); 397 len -= sizeof(info); 398 if (WARN_ON_ONCE(len < sizeof(handle))) 399 return -EFAULT; 400 401 handle.handle_type = fh->type; 402 handle.handle_bytes = fh_len; 403 404 /* Mangle handle_type for bad file_handle */ 405 if (!fh_len) 406 handle.handle_type = FILEID_INVALID; 407 408 if (copy_to_user(buf, &handle, sizeof(handle))) 409 return -EFAULT; 410 411 buf += sizeof(handle); 412 len -= sizeof(handle); 413 if (WARN_ON_ONCE(len < fh_len)) 414 return -EFAULT; 415 416 /* 417 * For an inline fh and inline file name, copy through stack to exclude 418 * the copy from usercopy hardening protections. 419 */ 420 fh_buf = fanotify_fh_buf(fh); 421 if (fh_len <= FANOTIFY_INLINE_FH_LEN) { 422 memcpy(bounce, fh_buf, fh_len); 423 fh_buf = bounce; 424 } 425 if (copy_to_user(buf, fh_buf, fh_len)) 426 return -EFAULT; 427 428 buf += fh_len; 429 len -= fh_len; 430 431 if (name_len) { 432 /* Copy the filename with terminating null */ 433 name_len++; 434 if (WARN_ON_ONCE(len < name_len)) 435 return -EFAULT; 436 437 if (copy_to_user(buf, name, name_len)) 438 return -EFAULT; 439 440 buf += name_len; 441 len -= name_len; 442 } 443 444 /* Pad with 0's */ 445 WARN_ON_ONCE(len < 0 || len >= FANOTIFY_EVENT_ALIGN); 446 if (len > 0 && clear_user(buf, len)) 447 return -EFAULT; 448 449 return info_len; 450 } 451 452 static int copy_pidfd_info_to_user(int pidfd, 453 char __user *buf, 454 size_t count) 455 { 456 struct fanotify_event_info_pidfd info = { }; 457 size_t info_len = FANOTIFY_PIDFD_INFO_HDR_LEN; 458 459 if (WARN_ON_ONCE(info_len > count)) 460 return -EFAULT; 461 462 info.hdr.info_type = FAN_EVENT_INFO_TYPE_PIDFD; 463 info.hdr.len = info_len; 464 info.pidfd = pidfd; 465 466 if (copy_to_user(buf, &info, info_len)) 467 return -EFAULT; 468 469 return info_len; 470 } 471 472 static int copy_info_records_to_user(struct fanotify_event *event, 473 struct fanotify_info *info, 474 unsigned int info_mode, int pidfd, 475 char __user *buf, size_t count) 476 { 477 int ret, total_bytes = 0, info_type = 0; 478 unsigned int fid_mode = info_mode & FANOTIFY_FID_BITS; 479 unsigned int pidfd_mode = info_mode & FAN_REPORT_PIDFD; 480 481 /* 482 * Event info records order is as follows: dir fid + name, child fid. 483 */ 484 if (fanotify_event_has_dir_fh(event)) { 485 info_type = info->name_len ? FAN_EVENT_INFO_TYPE_DFID_NAME : 486 FAN_EVENT_INFO_TYPE_DFID; 487 ret = copy_fid_info_to_user(fanotify_event_fsid(event), 488 fanotify_info_dir_fh(info), 489 info_type, 490 fanotify_info_name(info), 491 info->name_len, buf, count); 492 if (ret < 0) 493 return ret; 494 495 buf += ret; 496 count -= ret; 497 total_bytes += ret; 498 } 499 500 if (fanotify_event_has_object_fh(event)) { 501 const char *dot = NULL; 502 int dot_len = 0; 503 504 if (fid_mode == FAN_REPORT_FID || info_type) { 505 /* 506 * With only group flag FAN_REPORT_FID only type FID is 507 * reported. Second info record type is always FID. 508 */ 509 info_type = FAN_EVENT_INFO_TYPE_FID; 510 } else if ((fid_mode & FAN_REPORT_NAME) && 511 (event->mask & FAN_ONDIR)) { 512 /* 513 * With group flag FAN_REPORT_NAME, if name was not 514 * recorded in an event on a directory, report the name 515 * "." with info type DFID_NAME. 516 */ 517 info_type = FAN_EVENT_INFO_TYPE_DFID_NAME; 518 dot = "."; 519 dot_len = 1; 520 } else if ((event->mask & ALL_FSNOTIFY_DIRENT_EVENTS) || 521 (event->mask & FAN_ONDIR)) { 522 /* 523 * With group flag FAN_REPORT_DIR_FID, a single info 524 * record has type DFID for directory entry modification 525 * event and for event on a directory. 526 */ 527 info_type = FAN_EVENT_INFO_TYPE_DFID; 528 } else { 529 /* 530 * With group flags FAN_REPORT_DIR_FID|FAN_REPORT_FID, 531 * a single info record has type FID for event on a 532 * non-directory, when there is no directory to report. 533 * For example, on FAN_DELETE_SELF event. 534 */ 535 info_type = FAN_EVENT_INFO_TYPE_FID; 536 } 537 538 ret = copy_fid_info_to_user(fanotify_event_fsid(event), 539 fanotify_event_object_fh(event), 540 info_type, dot, dot_len, 541 buf, count); 542 if (ret < 0) 543 return ret; 544 545 buf += ret; 546 count -= ret; 547 total_bytes += ret; 548 } 549 550 if (pidfd_mode) { 551 ret = copy_pidfd_info_to_user(pidfd, buf, count); 552 if (ret < 0) 553 return ret; 554 555 buf += ret; 556 count -= ret; 557 total_bytes += ret; 558 } 559 560 if (fanotify_is_error_event(event->mask)) { 561 ret = copy_error_info_to_user(event, buf, count); 562 if (ret < 0) 563 return ret; 564 buf += ret; 565 count -= ret; 566 total_bytes += ret; 567 } 568 569 return total_bytes; 570 } 571 572 static ssize_t copy_event_to_user(struct fsnotify_group *group, 573 struct fanotify_event *event, 574 char __user *buf, size_t count) 575 { 576 struct fanotify_event_metadata metadata; 577 struct path *path = fanotify_event_path(event); 578 struct fanotify_info *info = fanotify_event_info(event); 579 unsigned int info_mode = FAN_GROUP_FLAG(group, FANOTIFY_INFO_MODES); 580 unsigned int pidfd_mode = info_mode & FAN_REPORT_PIDFD; 581 struct file *f = NULL; 582 int ret, pidfd = FAN_NOPIDFD, fd = FAN_NOFD; 583 584 pr_debug("%s: group=%p event=%p\n", __func__, group, event); 585 586 metadata.event_len = fanotify_event_len(info_mode, event); 587 metadata.metadata_len = FAN_EVENT_METADATA_LEN; 588 metadata.vers = FANOTIFY_METADATA_VERSION; 589 metadata.reserved = 0; 590 metadata.mask = event->mask & FANOTIFY_OUTGOING_EVENTS; 591 metadata.pid = pid_vnr(event->pid); 592 /* 593 * For an unprivileged listener, event->pid can be used to identify the 594 * events generated by the listener process itself, without disclosing 595 * the pids of other processes. 596 */ 597 if (FAN_GROUP_FLAG(group, FANOTIFY_UNPRIV) && 598 task_tgid(current) != event->pid) 599 metadata.pid = 0; 600 601 /* 602 * For now, fid mode is required for an unprivileged listener and 603 * fid mode does not report fd in events. Keep this check anyway 604 * for safety in case fid mode requirement is relaxed in the future 605 * to allow unprivileged listener to get events with no fd and no fid. 606 */ 607 if (!FAN_GROUP_FLAG(group, FANOTIFY_UNPRIV) && 608 path && path->mnt && path->dentry) { 609 fd = create_fd(group, path, &f); 610 if (fd < 0) 611 return fd; 612 } 613 metadata.fd = fd; 614 615 if (pidfd_mode) { 616 /* 617 * Complain if the FAN_REPORT_PIDFD and FAN_REPORT_TID mutual 618 * exclusion is ever lifted. At the time of incoporating pidfd 619 * support within fanotify, the pidfd API only supported the 620 * creation of pidfds for thread-group leaders. 621 */ 622 WARN_ON_ONCE(FAN_GROUP_FLAG(group, FAN_REPORT_TID)); 623 624 /* 625 * The PIDTYPE_TGID check for an event->pid is performed 626 * preemptively in an attempt to catch out cases where the event 627 * listener reads events after the event generating process has 628 * already terminated. Report FAN_NOPIDFD to the event listener 629 * in those cases, with all other pidfd creation errors being 630 * reported as FAN_EPIDFD. 631 */ 632 if (metadata.pid == 0 || 633 !pid_has_task(event->pid, PIDTYPE_TGID)) { 634 pidfd = FAN_NOPIDFD; 635 } else { 636 pidfd = pidfd_create(event->pid, 0); 637 if (pidfd < 0) 638 pidfd = FAN_EPIDFD; 639 } 640 } 641 642 ret = -EFAULT; 643 /* 644 * Sanity check copy size in case get_one_event() and 645 * event_len sizes ever get out of sync. 646 */ 647 if (WARN_ON_ONCE(metadata.event_len > count)) 648 goto out_close_fd; 649 650 if (copy_to_user(buf, &metadata, FAN_EVENT_METADATA_LEN)) 651 goto out_close_fd; 652 653 buf += FAN_EVENT_METADATA_LEN; 654 count -= FAN_EVENT_METADATA_LEN; 655 656 if (fanotify_is_perm_event(event->mask)) 657 FANOTIFY_PERM(event)->fd = fd; 658 659 if (f) 660 fd_install(fd, f); 661 662 if (info_mode) { 663 ret = copy_info_records_to_user(event, info, info_mode, pidfd, 664 buf, count); 665 if (ret < 0) 666 goto out_close_fd; 667 } 668 669 return metadata.event_len; 670 671 out_close_fd: 672 if (fd != FAN_NOFD) { 673 put_unused_fd(fd); 674 fput(f); 675 } 676 677 if (pidfd >= 0) 678 close_fd(pidfd); 679 680 return ret; 681 } 682 683 /* intofiy userspace file descriptor functions */ 684 static __poll_t fanotify_poll(struct file *file, poll_table *wait) 685 { 686 struct fsnotify_group *group = file->private_data; 687 __poll_t ret = 0; 688 689 poll_wait(file, &group->notification_waitq, wait); 690 spin_lock(&group->notification_lock); 691 if (!fsnotify_notify_queue_is_empty(group)) 692 ret = EPOLLIN | EPOLLRDNORM; 693 spin_unlock(&group->notification_lock); 694 695 return ret; 696 } 697 698 static ssize_t fanotify_read(struct file *file, char __user *buf, 699 size_t count, loff_t *pos) 700 { 701 struct fsnotify_group *group; 702 struct fanotify_event *event; 703 char __user *start; 704 int ret; 705 DEFINE_WAIT_FUNC(wait, woken_wake_function); 706 707 start = buf; 708 group = file->private_data; 709 710 pr_debug("%s: group=%p\n", __func__, group); 711 712 add_wait_queue(&group->notification_waitq, &wait); 713 while (1) { 714 /* 715 * User can supply arbitrarily large buffer. Avoid softlockups 716 * in case there are lots of available events. 717 */ 718 cond_resched(); 719 event = get_one_event(group, count); 720 if (IS_ERR(event)) { 721 ret = PTR_ERR(event); 722 break; 723 } 724 725 if (!event) { 726 ret = -EAGAIN; 727 if (file->f_flags & O_NONBLOCK) 728 break; 729 730 ret = -ERESTARTSYS; 731 if (signal_pending(current)) 732 break; 733 734 if (start != buf) 735 break; 736 737 wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT); 738 continue; 739 } 740 741 ret = copy_event_to_user(group, event, buf, count); 742 if (unlikely(ret == -EOPENSTALE)) { 743 /* 744 * We cannot report events with stale fd so drop it. 745 * Setting ret to 0 will continue the event loop and 746 * do the right thing if there are no more events to 747 * read (i.e. return bytes read, -EAGAIN or wait). 748 */ 749 ret = 0; 750 } 751 752 /* 753 * Permission events get queued to wait for response. Other 754 * events can be destroyed now. 755 */ 756 if (!fanotify_is_perm_event(event->mask)) { 757 fsnotify_destroy_event(group, &event->fse); 758 } else { 759 if (ret <= 0) { 760 spin_lock(&group->notification_lock); 761 finish_permission_event(group, 762 FANOTIFY_PERM(event), FAN_DENY); 763 wake_up(&group->fanotify_data.access_waitq); 764 } else { 765 spin_lock(&group->notification_lock); 766 list_add_tail(&event->fse.list, 767 &group->fanotify_data.access_list); 768 spin_unlock(&group->notification_lock); 769 } 770 } 771 if (ret < 0) 772 break; 773 buf += ret; 774 count -= ret; 775 } 776 remove_wait_queue(&group->notification_waitq, &wait); 777 778 if (start != buf && ret != -EFAULT) 779 ret = buf - start; 780 return ret; 781 } 782 783 static ssize_t fanotify_write(struct file *file, const char __user *buf, size_t count, loff_t *pos) 784 { 785 struct fanotify_response response = { .fd = -1, .response = -1 }; 786 struct fsnotify_group *group; 787 int ret; 788 789 if (!IS_ENABLED(CONFIG_FANOTIFY_ACCESS_PERMISSIONS)) 790 return -EINVAL; 791 792 group = file->private_data; 793 794 if (count < sizeof(response)) 795 return -EINVAL; 796 797 count = sizeof(response); 798 799 pr_debug("%s: group=%p count=%zu\n", __func__, group, count); 800 801 if (copy_from_user(&response, buf, count)) 802 return -EFAULT; 803 804 ret = process_access_response(group, &response); 805 if (ret < 0) 806 count = ret; 807 808 return count; 809 } 810 811 static int fanotify_release(struct inode *ignored, struct file *file) 812 { 813 struct fsnotify_group *group = file->private_data; 814 struct fsnotify_event *fsn_event; 815 816 /* 817 * Stop new events from arriving in the notification queue. since 818 * userspace cannot use fanotify fd anymore, no event can enter or 819 * leave access_list by now either. 820 */ 821 fsnotify_group_stop_queueing(group); 822 823 /* 824 * Process all permission events on access_list and notification queue 825 * and simulate reply from userspace. 826 */ 827 spin_lock(&group->notification_lock); 828 while (!list_empty(&group->fanotify_data.access_list)) { 829 struct fanotify_perm_event *event; 830 831 event = list_first_entry(&group->fanotify_data.access_list, 832 struct fanotify_perm_event, fae.fse.list); 833 list_del_init(&event->fae.fse.list); 834 finish_permission_event(group, event, FAN_ALLOW); 835 spin_lock(&group->notification_lock); 836 } 837 838 /* 839 * Destroy all non-permission events. For permission events just 840 * dequeue them and set the response. They will be freed once the 841 * response is consumed and fanotify_get_response() returns. 842 */ 843 while ((fsn_event = fsnotify_remove_first_event(group))) { 844 struct fanotify_event *event = FANOTIFY_E(fsn_event); 845 846 if (!(event->mask & FANOTIFY_PERM_EVENTS)) { 847 spin_unlock(&group->notification_lock); 848 fsnotify_destroy_event(group, fsn_event); 849 } else { 850 finish_permission_event(group, FANOTIFY_PERM(event), 851 FAN_ALLOW); 852 } 853 spin_lock(&group->notification_lock); 854 } 855 spin_unlock(&group->notification_lock); 856 857 /* Response for all permission events it set, wakeup waiters */ 858 wake_up(&group->fanotify_data.access_waitq); 859 860 /* matches the fanotify_init->fsnotify_alloc_group */ 861 fsnotify_destroy_group(group); 862 863 return 0; 864 } 865 866 static long fanotify_ioctl(struct file *file, unsigned int cmd, unsigned long arg) 867 { 868 struct fsnotify_group *group; 869 struct fsnotify_event *fsn_event; 870 void __user *p; 871 int ret = -ENOTTY; 872 size_t send_len = 0; 873 874 group = file->private_data; 875 876 p = (void __user *) arg; 877 878 switch (cmd) { 879 case FIONREAD: 880 spin_lock(&group->notification_lock); 881 list_for_each_entry(fsn_event, &group->notification_list, list) 882 send_len += FAN_EVENT_METADATA_LEN; 883 spin_unlock(&group->notification_lock); 884 ret = put_user(send_len, (int __user *) p); 885 break; 886 } 887 888 return ret; 889 } 890 891 static const struct file_operations fanotify_fops = { 892 .show_fdinfo = fanotify_show_fdinfo, 893 .poll = fanotify_poll, 894 .read = fanotify_read, 895 .write = fanotify_write, 896 .fasync = NULL, 897 .release = fanotify_release, 898 .unlocked_ioctl = fanotify_ioctl, 899 .compat_ioctl = compat_ptr_ioctl, 900 .llseek = noop_llseek, 901 }; 902 903 static int fanotify_find_path(int dfd, const char __user *filename, 904 struct path *path, unsigned int flags, __u64 mask, 905 unsigned int obj_type) 906 { 907 int ret; 908 909 pr_debug("%s: dfd=%d filename=%p flags=%x\n", __func__, 910 dfd, filename, flags); 911 912 if (filename == NULL) { 913 struct fd f = fdget(dfd); 914 915 ret = -EBADF; 916 if (!f.file) 917 goto out; 918 919 ret = -ENOTDIR; 920 if ((flags & FAN_MARK_ONLYDIR) && 921 !(S_ISDIR(file_inode(f.file)->i_mode))) { 922 fdput(f); 923 goto out; 924 } 925 926 *path = f.file->f_path; 927 path_get(path); 928 fdput(f); 929 } else { 930 unsigned int lookup_flags = 0; 931 932 if (!(flags & FAN_MARK_DONT_FOLLOW)) 933 lookup_flags |= LOOKUP_FOLLOW; 934 if (flags & FAN_MARK_ONLYDIR) 935 lookup_flags |= LOOKUP_DIRECTORY; 936 937 ret = user_path_at(dfd, filename, lookup_flags, path); 938 if (ret) 939 goto out; 940 } 941 942 /* you can only watch an inode if you have read permissions on it */ 943 ret = path_permission(path, MAY_READ); 944 if (ret) { 945 path_put(path); 946 goto out; 947 } 948 949 ret = security_path_notify(path, mask, obj_type); 950 if (ret) 951 path_put(path); 952 953 out: 954 return ret; 955 } 956 957 static __u32 fanotify_mark_remove_from_mask(struct fsnotify_mark *fsn_mark, 958 __u32 mask, unsigned int flags, 959 __u32 umask, int *destroy) 960 { 961 __u32 oldmask = 0; 962 963 /* umask bits cannot be removed by user */ 964 mask &= ~umask; 965 spin_lock(&fsn_mark->lock); 966 if (!(flags & FAN_MARK_IGNORED_MASK)) { 967 oldmask = fsn_mark->mask; 968 fsn_mark->mask &= ~mask; 969 } else { 970 fsn_mark->ignored_mask &= ~mask; 971 } 972 /* 973 * We need to keep the mark around even if remaining mask cannot 974 * result in any events (e.g. mask == FAN_ONDIR) to support incremenal 975 * changes to the mask. 976 * Destroy mark when only umask bits remain. 977 */ 978 *destroy = !((fsn_mark->mask | fsn_mark->ignored_mask) & ~umask); 979 spin_unlock(&fsn_mark->lock); 980 981 return mask & oldmask; 982 } 983 984 static int fanotify_remove_mark(struct fsnotify_group *group, 985 fsnotify_connp_t *connp, __u32 mask, 986 unsigned int flags, __u32 umask) 987 { 988 struct fsnotify_mark *fsn_mark = NULL; 989 __u32 removed; 990 int destroy_mark; 991 992 mutex_lock(&group->mark_mutex); 993 fsn_mark = fsnotify_find_mark(connp, group); 994 if (!fsn_mark) { 995 mutex_unlock(&group->mark_mutex); 996 return -ENOENT; 997 } 998 999 removed = fanotify_mark_remove_from_mask(fsn_mark, mask, flags, 1000 umask, &destroy_mark); 1001 if (removed & fsnotify_conn_mask(fsn_mark->connector)) 1002 fsnotify_recalc_mask(fsn_mark->connector); 1003 if (destroy_mark) 1004 fsnotify_detach_mark(fsn_mark); 1005 mutex_unlock(&group->mark_mutex); 1006 if (destroy_mark) 1007 fsnotify_free_mark(fsn_mark); 1008 1009 /* matches the fsnotify_find_mark() */ 1010 fsnotify_put_mark(fsn_mark); 1011 return 0; 1012 } 1013 1014 static int fanotify_remove_vfsmount_mark(struct fsnotify_group *group, 1015 struct vfsmount *mnt, __u32 mask, 1016 unsigned int flags, __u32 umask) 1017 { 1018 return fanotify_remove_mark(group, &real_mount(mnt)->mnt_fsnotify_marks, 1019 mask, flags, umask); 1020 } 1021 1022 static int fanotify_remove_sb_mark(struct fsnotify_group *group, 1023 struct super_block *sb, __u32 mask, 1024 unsigned int flags, __u32 umask) 1025 { 1026 return fanotify_remove_mark(group, &sb->s_fsnotify_marks, mask, 1027 flags, umask); 1028 } 1029 1030 static int fanotify_remove_inode_mark(struct fsnotify_group *group, 1031 struct inode *inode, __u32 mask, 1032 unsigned int flags, __u32 umask) 1033 { 1034 return fanotify_remove_mark(group, &inode->i_fsnotify_marks, mask, 1035 flags, umask); 1036 } 1037 1038 static __u32 fanotify_mark_add_to_mask(struct fsnotify_mark *fsn_mark, 1039 __u32 mask, 1040 unsigned int flags) 1041 { 1042 __u32 oldmask = -1; 1043 1044 spin_lock(&fsn_mark->lock); 1045 if (!(flags & FAN_MARK_IGNORED_MASK)) { 1046 oldmask = fsn_mark->mask; 1047 fsn_mark->mask |= mask; 1048 } else { 1049 fsn_mark->ignored_mask |= mask; 1050 if (flags & FAN_MARK_IGNORED_SURV_MODIFY) 1051 fsn_mark->flags |= FSNOTIFY_MARK_FLAG_IGNORED_SURV_MODIFY; 1052 } 1053 spin_unlock(&fsn_mark->lock); 1054 1055 return mask & ~oldmask; 1056 } 1057 1058 static struct fsnotify_mark *fanotify_add_new_mark(struct fsnotify_group *group, 1059 fsnotify_connp_t *connp, 1060 unsigned int type, 1061 __kernel_fsid_t *fsid) 1062 { 1063 struct ucounts *ucounts = group->fanotify_data.ucounts; 1064 struct fsnotify_mark *mark; 1065 int ret; 1066 1067 /* 1068 * Enforce per user marks limits per user in all containing user ns. 1069 * A group with FAN_UNLIMITED_MARKS does not contribute to mark count 1070 * in the limited groups account. 1071 */ 1072 if (!FAN_GROUP_FLAG(group, FAN_UNLIMITED_MARKS) && 1073 !inc_ucount(ucounts->ns, ucounts->uid, UCOUNT_FANOTIFY_MARKS)) 1074 return ERR_PTR(-ENOSPC); 1075 1076 mark = kmem_cache_alloc(fanotify_mark_cache, GFP_KERNEL); 1077 if (!mark) { 1078 ret = -ENOMEM; 1079 goto out_dec_ucounts; 1080 } 1081 1082 fsnotify_init_mark(mark, group); 1083 ret = fsnotify_add_mark_locked(mark, connp, type, 0, fsid); 1084 if (ret) { 1085 fsnotify_put_mark(mark); 1086 goto out_dec_ucounts; 1087 } 1088 1089 return mark; 1090 1091 out_dec_ucounts: 1092 if (!FAN_GROUP_FLAG(group, FAN_UNLIMITED_MARKS)) 1093 dec_ucount(ucounts, UCOUNT_FANOTIFY_MARKS); 1094 return ERR_PTR(ret); 1095 } 1096 1097 static int fanotify_group_init_error_pool(struct fsnotify_group *group) 1098 { 1099 if (mempool_initialized(&group->fanotify_data.error_events_pool)) 1100 return 0; 1101 1102 return mempool_init_kmalloc_pool(&group->fanotify_data.error_events_pool, 1103 FANOTIFY_DEFAULT_FEE_POOL_SIZE, 1104 sizeof(struct fanotify_error_event)); 1105 } 1106 1107 static int fanotify_add_mark(struct fsnotify_group *group, 1108 fsnotify_connp_t *connp, unsigned int type, 1109 __u32 mask, unsigned int flags, 1110 __kernel_fsid_t *fsid) 1111 { 1112 struct fsnotify_mark *fsn_mark; 1113 __u32 added; 1114 int ret = 0; 1115 1116 mutex_lock(&group->mark_mutex); 1117 fsn_mark = fsnotify_find_mark(connp, group); 1118 if (!fsn_mark) { 1119 fsn_mark = fanotify_add_new_mark(group, connp, type, fsid); 1120 if (IS_ERR(fsn_mark)) { 1121 mutex_unlock(&group->mark_mutex); 1122 return PTR_ERR(fsn_mark); 1123 } 1124 } 1125 1126 /* 1127 * Error events are pre-allocated per group, only if strictly 1128 * needed (i.e. FAN_FS_ERROR was requested). 1129 */ 1130 if (!(flags & FAN_MARK_IGNORED_MASK) && (mask & FAN_FS_ERROR)) { 1131 ret = fanotify_group_init_error_pool(group); 1132 if (ret) 1133 goto out; 1134 } 1135 1136 added = fanotify_mark_add_to_mask(fsn_mark, mask, flags); 1137 if (added & ~fsnotify_conn_mask(fsn_mark->connector)) 1138 fsnotify_recalc_mask(fsn_mark->connector); 1139 1140 out: 1141 mutex_unlock(&group->mark_mutex); 1142 1143 fsnotify_put_mark(fsn_mark); 1144 return ret; 1145 } 1146 1147 static int fanotify_add_vfsmount_mark(struct fsnotify_group *group, 1148 struct vfsmount *mnt, __u32 mask, 1149 unsigned int flags, __kernel_fsid_t *fsid) 1150 { 1151 return fanotify_add_mark(group, &real_mount(mnt)->mnt_fsnotify_marks, 1152 FSNOTIFY_OBJ_TYPE_VFSMOUNT, mask, flags, fsid); 1153 } 1154 1155 static int fanotify_add_sb_mark(struct fsnotify_group *group, 1156 struct super_block *sb, __u32 mask, 1157 unsigned int flags, __kernel_fsid_t *fsid) 1158 { 1159 return fanotify_add_mark(group, &sb->s_fsnotify_marks, 1160 FSNOTIFY_OBJ_TYPE_SB, mask, flags, fsid); 1161 } 1162 1163 static int fanotify_add_inode_mark(struct fsnotify_group *group, 1164 struct inode *inode, __u32 mask, 1165 unsigned int flags, __kernel_fsid_t *fsid) 1166 { 1167 pr_debug("%s: group=%p inode=%p\n", __func__, group, inode); 1168 1169 /* 1170 * If some other task has this inode open for write we should not add 1171 * an ignored mark, unless that ignored mark is supposed to survive 1172 * modification changes anyway. 1173 */ 1174 if ((flags & FAN_MARK_IGNORED_MASK) && 1175 !(flags & FAN_MARK_IGNORED_SURV_MODIFY) && 1176 inode_is_open_for_write(inode)) 1177 return 0; 1178 1179 return fanotify_add_mark(group, &inode->i_fsnotify_marks, 1180 FSNOTIFY_OBJ_TYPE_INODE, mask, flags, fsid); 1181 } 1182 1183 static struct fsnotify_event *fanotify_alloc_overflow_event(void) 1184 { 1185 struct fanotify_event *oevent; 1186 1187 oevent = kmalloc(sizeof(*oevent), GFP_KERNEL_ACCOUNT); 1188 if (!oevent) 1189 return NULL; 1190 1191 fanotify_init_event(oevent, 0, FS_Q_OVERFLOW); 1192 oevent->type = FANOTIFY_EVENT_TYPE_OVERFLOW; 1193 1194 return &oevent->fse; 1195 } 1196 1197 static struct hlist_head *fanotify_alloc_merge_hash(void) 1198 { 1199 struct hlist_head *hash; 1200 1201 hash = kmalloc(sizeof(struct hlist_head) << FANOTIFY_HTABLE_BITS, 1202 GFP_KERNEL_ACCOUNT); 1203 if (!hash) 1204 return NULL; 1205 1206 __hash_init(hash, FANOTIFY_HTABLE_SIZE); 1207 1208 return hash; 1209 } 1210 1211 /* fanotify syscalls */ 1212 SYSCALL_DEFINE2(fanotify_init, unsigned int, flags, unsigned int, event_f_flags) 1213 { 1214 struct fsnotify_group *group; 1215 int f_flags, fd; 1216 unsigned int fid_mode = flags & FANOTIFY_FID_BITS; 1217 unsigned int class = flags & FANOTIFY_CLASS_BITS; 1218 unsigned int internal_flags = 0; 1219 1220 pr_debug("%s: flags=%x event_f_flags=%x\n", 1221 __func__, flags, event_f_flags); 1222 1223 if (!capable(CAP_SYS_ADMIN)) { 1224 /* 1225 * An unprivileged user can setup an fanotify group with 1226 * limited functionality - an unprivileged group is limited to 1227 * notification events with file handles and it cannot use 1228 * unlimited queue/marks. 1229 */ 1230 if ((flags & FANOTIFY_ADMIN_INIT_FLAGS) || !fid_mode) 1231 return -EPERM; 1232 1233 /* 1234 * Setting the internal flag FANOTIFY_UNPRIV on the group 1235 * prevents setting mount/filesystem marks on this group and 1236 * prevents reporting pid and open fd in events. 1237 */ 1238 internal_flags |= FANOTIFY_UNPRIV; 1239 } 1240 1241 #ifdef CONFIG_AUDITSYSCALL 1242 if (flags & ~(FANOTIFY_INIT_FLAGS | FAN_ENABLE_AUDIT)) 1243 #else 1244 if (flags & ~FANOTIFY_INIT_FLAGS) 1245 #endif 1246 return -EINVAL; 1247 1248 /* 1249 * A pidfd can only be returned for a thread-group leader; thus 1250 * FAN_REPORT_PIDFD and FAN_REPORT_TID need to remain mutually 1251 * exclusive. 1252 */ 1253 if ((flags & FAN_REPORT_PIDFD) && (flags & FAN_REPORT_TID)) 1254 return -EINVAL; 1255 1256 if (event_f_flags & ~FANOTIFY_INIT_ALL_EVENT_F_BITS) 1257 return -EINVAL; 1258 1259 switch (event_f_flags & O_ACCMODE) { 1260 case O_RDONLY: 1261 case O_RDWR: 1262 case O_WRONLY: 1263 break; 1264 default: 1265 return -EINVAL; 1266 } 1267 1268 if (fid_mode && class != FAN_CLASS_NOTIF) 1269 return -EINVAL; 1270 1271 /* 1272 * Child name is reported with parent fid so requires dir fid. 1273 * We can report both child fid and dir fid with or without name. 1274 */ 1275 if ((fid_mode & FAN_REPORT_NAME) && !(fid_mode & FAN_REPORT_DIR_FID)) 1276 return -EINVAL; 1277 1278 f_flags = O_RDWR | FMODE_NONOTIFY; 1279 if (flags & FAN_CLOEXEC) 1280 f_flags |= O_CLOEXEC; 1281 if (flags & FAN_NONBLOCK) 1282 f_flags |= O_NONBLOCK; 1283 1284 /* fsnotify_alloc_group takes a ref. Dropped in fanotify_release */ 1285 group = fsnotify_alloc_user_group(&fanotify_fsnotify_ops); 1286 if (IS_ERR(group)) { 1287 return PTR_ERR(group); 1288 } 1289 1290 /* Enforce groups limits per user in all containing user ns */ 1291 group->fanotify_data.ucounts = inc_ucount(current_user_ns(), 1292 current_euid(), 1293 UCOUNT_FANOTIFY_GROUPS); 1294 if (!group->fanotify_data.ucounts) { 1295 fd = -EMFILE; 1296 goto out_destroy_group; 1297 } 1298 1299 group->fanotify_data.flags = flags | internal_flags; 1300 group->memcg = get_mem_cgroup_from_mm(current->mm); 1301 1302 group->fanotify_data.merge_hash = fanotify_alloc_merge_hash(); 1303 if (!group->fanotify_data.merge_hash) { 1304 fd = -ENOMEM; 1305 goto out_destroy_group; 1306 } 1307 1308 group->overflow_event = fanotify_alloc_overflow_event(); 1309 if (unlikely(!group->overflow_event)) { 1310 fd = -ENOMEM; 1311 goto out_destroy_group; 1312 } 1313 1314 if (force_o_largefile()) 1315 event_f_flags |= O_LARGEFILE; 1316 group->fanotify_data.f_flags = event_f_flags; 1317 init_waitqueue_head(&group->fanotify_data.access_waitq); 1318 INIT_LIST_HEAD(&group->fanotify_data.access_list); 1319 switch (class) { 1320 case FAN_CLASS_NOTIF: 1321 group->priority = FS_PRIO_0; 1322 break; 1323 case FAN_CLASS_CONTENT: 1324 group->priority = FS_PRIO_1; 1325 break; 1326 case FAN_CLASS_PRE_CONTENT: 1327 group->priority = FS_PRIO_2; 1328 break; 1329 default: 1330 fd = -EINVAL; 1331 goto out_destroy_group; 1332 } 1333 1334 if (flags & FAN_UNLIMITED_QUEUE) { 1335 fd = -EPERM; 1336 if (!capable(CAP_SYS_ADMIN)) 1337 goto out_destroy_group; 1338 group->max_events = UINT_MAX; 1339 } else { 1340 group->max_events = fanotify_max_queued_events; 1341 } 1342 1343 if (flags & FAN_UNLIMITED_MARKS) { 1344 fd = -EPERM; 1345 if (!capable(CAP_SYS_ADMIN)) 1346 goto out_destroy_group; 1347 } 1348 1349 if (flags & FAN_ENABLE_AUDIT) { 1350 fd = -EPERM; 1351 if (!capable(CAP_AUDIT_WRITE)) 1352 goto out_destroy_group; 1353 } 1354 1355 fd = anon_inode_getfd("[fanotify]", &fanotify_fops, group, f_flags); 1356 if (fd < 0) 1357 goto out_destroy_group; 1358 1359 return fd; 1360 1361 out_destroy_group: 1362 fsnotify_destroy_group(group); 1363 return fd; 1364 } 1365 1366 static int fanotify_test_fsid(struct dentry *dentry, __kernel_fsid_t *fsid) 1367 { 1368 __kernel_fsid_t root_fsid; 1369 int err; 1370 1371 /* 1372 * Make sure dentry is not of a filesystem with zero fsid (e.g. fuse). 1373 */ 1374 err = vfs_get_fsid(dentry, fsid); 1375 if (err) 1376 return err; 1377 1378 if (!fsid->val[0] && !fsid->val[1]) 1379 return -ENODEV; 1380 1381 /* 1382 * Make sure dentry is not of a filesystem subvolume (e.g. btrfs) 1383 * which uses a different fsid than sb root. 1384 */ 1385 err = vfs_get_fsid(dentry->d_sb->s_root, &root_fsid); 1386 if (err) 1387 return err; 1388 1389 if (root_fsid.val[0] != fsid->val[0] || 1390 root_fsid.val[1] != fsid->val[1]) 1391 return -EXDEV; 1392 1393 return 0; 1394 } 1395 1396 /* Check if filesystem can encode a unique fid */ 1397 static int fanotify_test_fid(struct dentry *dentry) 1398 { 1399 /* 1400 * We need to make sure that the file system supports at least 1401 * encoding a file handle so user can use name_to_handle_at() to 1402 * compare fid returned with event to the file handle of watched 1403 * objects. However, name_to_handle_at() requires that the 1404 * filesystem also supports decoding file handles. 1405 */ 1406 if (!dentry->d_sb->s_export_op || 1407 !dentry->d_sb->s_export_op->fh_to_dentry) 1408 return -EOPNOTSUPP; 1409 1410 return 0; 1411 } 1412 1413 static int fanotify_events_supported(struct path *path, __u64 mask) 1414 { 1415 /* 1416 * Some filesystems such as 'proc' acquire unusual locks when opening 1417 * files. For them fanotify permission events have high chances of 1418 * deadlocking the system - open done when reporting fanotify event 1419 * blocks on this "unusual" lock while another process holding the lock 1420 * waits for fanotify permission event to be answered. Just disallow 1421 * permission events for such filesystems. 1422 */ 1423 if (mask & FANOTIFY_PERM_EVENTS && 1424 path->mnt->mnt_sb->s_type->fs_flags & FS_DISALLOW_NOTIFY_PERM) 1425 return -EINVAL; 1426 return 0; 1427 } 1428 1429 static int do_fanotify_mark(int fanotify_fd, unsigned int flags, __u64 mask, 1430 int dfd, const char __user *pathname) 1431 { 1432 struct inode *inode = NULL; 1433 struct vfsmount *mnt = NULL; 1434 struct fsnotify_group *group; 1435 struct fd f; 1436 struct path path; 1437 __kernel_fsid_t __fsid, *fsid = NULL; 1438 u32 valid_mask = FANOTIFY_EVENTS | FANOTIFY_EVENT_FLAGS; 1439 unsigned int mark_type = flags & FANOTIFY_MARK_TYPE_BITS; 1440 bool ignored = flags & FAN_MARK_IGNORED_MASK; 1441 unsigned int obj_type, fid_mode; 1442 u32 umask = 0; 1443 int ret; 1444 1445 pr_debug("%s: fanotify_fd=%d flags=%x dfd=%d pathname=%p mask=%llx\n", 1446 __func__, fanotify_fd, flags, dfd, pathname, mask); 1447 1448 /* we only use the lower 32 bits as of right now. */ 1449 if (upper_32_bits(mask)) 1450 return -EINVAL; 1451 1452 if (flags & ~FANOTIFY_MARK_FLAGS) 1453 return -EINVAL; 1454 1455 switch (mark_type) { 1456 case FAN_MARK_INODE: 1457 obj_type = FSNOTIFY_OBJ_TYPE_INODE; 1458 break; 1459 case FAN_MARK_MOUNT: 1460 obj_type = FSNOTIFY_OBJ_TYPE_VFSMOUNT; 1461 break; 1462 case FAN_MARK_FILESYSTEM: 1463 obj_type = FSNOTIFY_OBJ_TYPE_SB; 1464 break; 1465 default: 1466 return -EINVAL; 1467 } 1468 1469 switch (flags & (FAN_MARK_ADD | FAN_MARK_REMOVE | FAN_MARK_FLUSH)) { 1470 case FAN_MARK_ADD: 1471 case FAN_MARK_REMOVE: 1472 if (!mask) 1473 return -EINVAL; 1474 break; 1475 case FAN_MARK_FLUSH: 1476 if (flags & ~(FANOTIFY_MARK_TYPE_BITS | FAN_MARK_FLUSH)) 1477 return -EINVAL; 1478 break; 1479 default: 1480 return -EINVAL; 1481 } 1482 1483 if (IS_ENABLED(CONFIG_FANOTIFY_ACCESS_PERMISSIONS)) 1484 valid_mask |= FANOTIFY_PERM_EVENTS; 1485 1486 if (mask & ~valid_mask) 1487 return -EINVAL; 1488 1489 /* Event flags (ONDIR, ON_CHILD) are meaningless in ignored mask */ 1490 if (ignored) 1491 mask &= ~FANOTIFY_EVENT_FLAGS; 1492 1493 f = fdget(fanotify_fd); 1494 if (unlikely(!f.file)) 1495 return -EBADF; 1496 1497 /* verify that this is indeed an fanotify instance */ 1498 ret = -EINVAL; 1499 if (unlikely(f.file->f_op != &fanotify_fops)) 1500 goto fput_and_out; 1501 group = f.file->private_data; 1502 1503 /* 1504 * An unprivileged user is not allowed to setup mount nor filesystem 1505 * marks. This also includes setting up such marks by a group that 1506 * was initialized by an unprivileged user. 1507 */ 1508 ret = -EPERM; 1509 if ((!capable(CAP_SYS_ADMIN) || 1510 FAN_GROUP_FLAG(group, FANOTIFY_UNPRIV)) && 1511 mark_type != FAN_MARK_INODE) 1512 goto fput_and_out; 1513 1514 /* 1515 * group->priority == FS_PRIO_0 == FAN_CLASS_NOTIF. These are not 1516 * allowed to set permissions events. 1517 */ 1518 ret = -EINVAL; 1519 if (mask & FANOTIFY_PERM_EVENTS && 1520 group->priority == FS_PRIO_0) 1521 goto fput_and_out; 1522 1523 if (mask & FAN_FS_ERROR && 1524 mark_type != FAN_MARK_FILESYSTEM) 1525 goto fput_and_out; 1526 1527 /* 1528 * Events that do not carry enough information to report 1529 * event->fd require a group that supports reporting fid. Those 1530 * events are not supported on a mount mark, because they do not 1531 * carry enough information (i.e. path) to be filtered by mount 1532 * point. 1533 */ 1534 fid_mode = FAN_GROUP_FLAG(group, FANOTIFY_FID_BITS); 1535 if (mask & ~(FANOTIFY_FD_EVENTS|FANOTIFY_EVENT_FLAGS) && 1536 (!fid_mode || mark_type == FAN_MARK_MOUNT)) 1537 goto fput_and_out; 1538 1539 if (flags & FAN_MARK_FLUSH) { 1540 ret = 0; 1541 if (mark_type == FAN_MARK_MOUNT) 1542 fsnotify_clear_vfsmount_marks_by_group(group); 1543 else if (mark_type == FAN_MARK_FILESYSTEM) 1544 fsnotify_clear_sb_marks_by_group(group); 1545 else 1546 fsnotify_clear_inode_marks_by_group(group); 1547 goto fput_and_out; 1548 } 1549 1550 ret = fanotify_find_path(dfd, pathname, &path, flags, 1551 (mask & ALL_FSNOTIFY_EVENTS), obj_type); 1552 if (ret) 1553 goto fput_and_out; 1554 1555 if (flags & FAN_MARK_ADD) { 1556 ret = fanotify_events_supported(&path, mask); 1557 if (ret) 1558 goto path_put_and_out; 1559 } 1560 1561 if (fid_mode) { 1562 ret = fanotify_test_fsid(path.dentry, &__fsid); 1563 if (ret) 1564 goto path_put_and_out; 1565 1566 ret = fanotify_test_fid(path.dentry); 1567 if (ret) 1568 goto path_put_and_out; 1569 1570 fsid = &__fsid; 1571 } 1572 1573 /* inode held in place by reference to path; group by fget on fd */ 1574 if (mark_type == FAN_MARK_INODE) 1575 inode = path.dentry->d_inode; 1576 else 1577 mnt = path.mnt; 1578 1579 /* Mask out FAN_EVENT_ON_CHILD flag for sb/mount/non-dir marks */ 1580 if (mnt || !S_ISDIR(inode->i_mode)) { 1581 mask &= ~FAN_EVENT_ON_CHILD; 1582 umask = FAN_EVENT_ON_CHILD; 1583 /* 1584 * If group needs to report parent fid, register for getting 1585 * events with parent/name info for non-directory. 1586 */ 1587 if ((fid_mode & FAN_REPORT_DIR_FID) && 1588 (flags & FAN_MARK_ADD) && !ignored) 1589 mask |= FAN_EVENT_ON_CHILD; 1590 } 1591 1592 /* create/update an inode mark */ 1593 switch (flags & (FAN_MARK_ADD | FAN_MARK_REMOVE)) { 1594 case FAN_MARK_ADD: 1595 if (mark_type == FAN_MARK_MOUNT) 1596 ret = fanotify_add_vfsmount_mark(group, mnt, mask, 1597 flags, fsid); 1598 else if (mark_type == FAN_MARK_FILESYSTEM) 1599 ret = fanotify_add_sb_mark(group, mnt->mnt_sb, mask, 1600 flags, fsid); 1601 else 1602 ret = fanotify_add_inode_mark(group, inode, mask, 1603 flags, fsid); 1604 break; 1605 case FAN_MARK_REMOVE: 1606 if (mark_type == FAN_MARK_MOUNT) 1607 ret = fanotify_remove_vfsmount_mark(group, mnt, mask, 1608 flags, umask); 1609 else if (mark_type == FAN_MARK_FILESYSTEM) 1610 ret = fanotify_remove_sb_mark(group, mnt->mnt_sb, mask, 1611 flags, umask); 1612 else 1613 ret = fanotify_remove_inode_mark(group, inode, mask, 1614 flags, umask); 1615 break; 1616 default: 1617 ret = -EINVAL; 1618 } 1619 1620 path_put_and_out: 1621 path_put(&path); 1622 fput_and_out: 1623 fdput(f); 1624 return ret; 1625 } 1626 1627 #ifndef CONFIG_ARCH_SPLIT_ARG64 1628 SYSCALL_DEFINE5(fanotify_mark, int, fanotify_fd, unsigned int, flags, 1629 __u64, mask, int, dfd, 1630 const char __user *, pathname) 1631 { 1632 return do_fanotify_mark(fanotify_fd, flags, mask, dfd, pathname); 1633 } 1634 #endif 1635 1636 #if defined(CONFIG_ARCH_SPLIT_ARG64) || defined(CONFIG_COMPAT) 1637 SYSCALL32_DEFINE6(fanotify_mark, 1638 int, fanotify_fd, unsigned int, flags, 1639 SC_ARG64(mask), int, dfd, 1640 const char __user *, pathname) 1641 { 1642 return do_fanotify_mark(fanotify_fd, flags, SC_VAL64(__u64, mask), 1643 dfd, pathname); 1644 } 1645 #endif 1646 1647 /* 1648 * fanotify_user_setup - Our initialization function. Note that we cannot return 1649 * error because we have compiled-in VFS hooks. So an (unlikely) failure here 1650 * must result in panic(). 1651 */ 1652 static int __init fanotify_user_setup(void) 1653 { 1654 struct sysinfo si; 1655 int max_marks; 1656 1657 si_meminfo(&si); 1658 /* 1659 * Allow up to 1% of addressable memory to be accounted for per user 1660 * marks limited to the range [8192, 1048576]. mount and sb marks are 1661 * a lot cheaper than inode marks, but there is no reason for a user 1662 * to have many of those, so calculate by the cost of inode marks. 1663 */ 1664 max_marks = (((si.totalram - si.totalhigh) / 100) << PAGE_SHIFT) / 1665 INODE_MARK_COST; 1666 max_marks = clamp(max_marks, FANOTIFY_OLD_DEFAULT_MAX_MARKS, 1667 FANOTIFY_DEFAULT_MAX_USER_MARKS); 1668 1669 BUILD_BUG_ON(FANOTIFY_INIT_FLAGS & FANOTIFY_INTERNAL_GROUP_FLAGS); 1670 BUILD_BUG_ON(HWEIGHT32(FANOTIFY_INIT_FLAGS) != 11); 1671 BUILD_BUG_ON(HWEIGHT32(FANOTIFY_MARK_FLAGS) != 9); 1672 1673 fanotify_mark_cache = KMEM_CACHE(fsnotify_mark, 1674 SLAB_PANIC|SLAB_ACCOUNT); 1675 fanotify_fid_event_cachep = KMEM_CACHE(fanotify_fid_event, 1676 SLAB_PANIC); 1677 fanotify_path_event_cachep = KMEM_CACHE(fanotify_path_event, 1678 SLAB_PANIC); 1679 if (IS_ENABLED(CONFIG_FANOTIFY_ACCESS_PERMISSIONS)) { 1680 fanotify_perm_event_cachep = 1681 KMEM_CACHE(fanotify_perm_event, SLAB_PANIC); 1682 } 1683 1684 fanotify_max_queued_events = FANOTIFY_DEFAULT_MAX_EVENTS; 1685 init_user_ns.ucount_max[UCOUNT_FANOTIFY_GROUPS] = 1686 FANOTIFY_DEFAULT_MAX_GROUPS; 1687 init_user_ns.ucount_max[UCOUNT_FANOTIFY_MARKS] = max_marks; 1688 1689 return 0; 1690 } 1691 device_initcall(fanotify_user_setup); 1692