1 // SPDX-License-Identifier: GPL-2.0 2 #include <linux/sched/signal.h> 3 #include <linux/errno.h> 4 #include <linux/dcache.h> 5 #include <linux/path.h> 6 #include <linux/fdtable.h> 7 #include <linux/namei.h> 8 #include <linux/pid.h> 9 #include <linux/ptrace.h> 10 #include <linux/bitmap.h> 11 #include <linux/security.h> 12 #include <linux/file.h> 13 #include <linux/seq_file.h> 14 #include <linux/fs.h> 15 16 #include <linux/proc_fs.h> 17 18 #include "../mount.h" 19 #include "internal.h" 20 #include "fd.h" 21 22 static int seq_show(struct seq_file *m, void *v) 23 { 24 struct files_struct *files = NULL; 25 int f_flags = 0, ret = -ENOENT; 26 struct file *file = NULL; 27 struct task_struct *task; 28 29 task = get_proc_task(m->private); 30 if (!task) 31 return -ENOENT; 32 33 task_lock(task); 34 files = task->files; 35 if (files) { 36 unsigned int fd = proc_fd(m->private); 37 38 spin_lock(&files->file_lock); 39 file = files_lookup_fd_locked(files, fd); 40 if (file) { 41 struct fdtable *fdt = files_fdtable(files); 42 43 f_flags = file->f_flags; 44 if (close_on_exec(fd, fdt)) 45 f_flags |= O_CLOEXEC; 46 47 get_file(file); 48 ret = 0; 49 } 50 spin_unlock(&files->file_lock); 51 } 52 task_unlock(task); 53 put_task_struct(task); 54 55 if (ret) 56 return ret; 57 58 seq_printf(m, "pos:\t%lli\nflags:\t0%o\nmnt_id:\t%i\nino:\t%lu\n", 59 (long long)file->f_pos, f_flags, 60 real_mount(file->f_path.mnt)->mnt_id, 61 file_inode(file)->i_ino); 62 63 /* show_fd_locks() never deferences files so a stale value is safe */ 64 show_fd_locks(m, file, files); 65 if (seq_has_overflowed(m)) 66 goto out; 67 68 if (file->f_op->show_fdinfo) 69 file->f_op->show_fdinfo(m, file); 70 71 out: 72 fput(file); 73 return 0; 74 } 75 76 static int proc_fdinfo_access_allowed(struct inode *inode) 77 { 78 bool allowed = false; 79 struct task_struct *task = get_proc_task(inode); 80 81 if (!task) 82 return -ESRCH; 83 84 allowed = ptrace_may_access(task, PTRACE_MODE_READ_FSCREDS); 85 put_task_struct(task); 86 87 if (!allowed) 88 return -EACCES; 89 90 return 0; 91 } 92 93 static int seq_fdinfo_open(struct inode *inode, struct file *file) 94 { 95 int ret = proc_fdinfo_access_allowed(inode); 96 97 if (ret) 98 return ret; 99 100 return single_open(file, seq_show, inode); 101 } 102 103 static const struct file_operations proc_fdinfo_file_operations = { 104 .open = seq_fdinfo_open, 105 .read = seq_read, 106 .llseek = seq_lseek, 107 .release = single_release, 108 }; 109 110 static bool tid_fd_mode(struct task_struct *task, unsigned fd, fmode_t *mode) 111 { 112 struct file *file; 113 114 rcu_read_lock(); 115 file = task_lookup_fd_rcu(task, fd); 116 if (file) 117 *mode = file->f_mode; 118 rcu_read_unlock(); 119 return !!file; 120 } 121 122 static void tid_fd_update_inode(struct task_struct *task, struct inode *inode, 123 fmode_t f_mode) 124 { 125 task_dump_owner(task, 0, &inode->i_uid, &inode->i_gid); 126 127 if (S_ISLNK(inode->i_mode)) { 128 unsigned i_mode = S_IFLNK; 129 if (f_mode & FMODE_READ) 130 i_mode |= S_IRUSR | S_IXUSR; 131 if (f_mode & FMODE_WRITE) 132 i_mode |= S_IWUSR | S_IXUSR; 133 inode->i_mode = i_mode; 134 } 135 security_task_to_inode(task, inode); 136 } 137 138 static int tid_fd_revalidate(struct dentry *dentry, unsigned int flags) 139 { 140 struct task_struct *task; 141 struct inode *inode; 142 unsigned int fd; 143 144 if (flags & LOOKUP_RCU) 145 return -ECHILD; 146 147 inode = d_inode(dentry); 148 task = get_proc_task(inode); 149 fd = proc_fd(inode); 150 151 if (task) { 152 fmode_t f_mode; 153 if (tid_fd_mode(task, fd, &f_mode)) { 154 tid_fd_update_inode(task, inode, f_mode); 155 put_task_struct(task); 156 return 1; 157 } 158 put_task_struct(task); 159 } 160 return 0; 161 } 162 163 static const struct dentry_operations tid_fd_dentry_operations = { 164 .d_revalidate = tid_fd_revalidate, 165 .d_delete = pid_delete_dentry, 166 }; 167 168 static int proc_fd_link(struct dentry *dentry, struct path *path) 169 { 170 struct task_struct *task; 171 int ret = -ENOENT; 172 173 task = get_proc_task(d_inode(dentry)); 174 if (task) { 175 unsigned int fd = proc_fd(d_inode(dentry)); 176 struct file *fd_file; 177 178 fd_file = fget_task(task, fd); 179 if (fd_file) { 180 *path = fd_file->f_path; 181 path_get(&fd_file->f_path); 182 ret = 0; 183 fput(fd_file); 184 } 185 put_task_struct(task); 186 } 187 188 return ret; 189 } 190 191 struct fd_data { 192 fmode_t mode; 193 unsigned fd; 194 }; 195 196 static struct dentry *proc_fd_instantiate(struct dentry *dentry, 197 struct task_struct *task, const void *ptr) 198 { 199 const struct fd_data *data = ptr; 200 struct proc_inode *ei; 201 struct inode *inode; 202 203 inode = proc_pid_make_inode(dentry->d_sb, task, S_IFLNK); 204 if (!inode) 205 return ERR_PTR(-ENOENT); 206 207 ei = PROC_I(inode); 208 ei->fd = data->fd; 209 210 inode->i_op = &proc_pid_link_inode_operations; 211 inode->i_size = 64; 212 213 ei->op.proc_get_link = proc_fd_link; 214 tid_fd_update_inode(task, inode, data->mode); 215 216 d_set_d_op(dentry, &tid_fd_dentry_operations); 217 return d_splice_alias(inode, dentry); 218 } 219 220 static struct dentry *proc_lookupfd_common(struct inode *dir, 221 struct dentry *dentry, 222 instantiate_t instantiate) 223 { 224 struct task_struct *task = get_proc_task(dir); 225 struct fd_data data = {.fd = name_to_int(&dentry->d_name)}; 226 struct dentry *result = ERR_PTR(-ENOENT); 227 228 if (!task) 229 goto out_no_task; 230 if (data.fd == ~0U) 231 goto out; 232 if (!tid_fd_mode(task, data.fd, &data.mode)) 233 goto out; 234 235 result = instantiate(dentry, task, &data); 236 out: 237 put_task_struct(task); 238 out_no_task: 239 return result; 240 } 241 242 static int proc_readfd_common(struct file *file, struct dir_context *ctx, 243 instantiate_t instantiate) 244 { 245 struct task_struct *p = get_proc_task(file_inode(file)); 246 unsigned int fd; 247 248 if (!p) 249 return -ENOENT; 250 251 if (!dir_emit_dots(file, ctx)) 252 goto out; 253 254 rcu_read_lock(); 255 for (fd = ctx->pos - 2;; fd++) { 256 struct file *f; 257 struct fd_data data; 258 char name[10 + 1]; 259 unsigned int len; 260 261 f = task_lookup_next_fd_rcu(p, &fd); 262 ctx->pos = fd + 2LL; 263 if (!f) 264 break; 265 data.mode = f->f_mode; 266 rcu_read_unlock(); 267 data.fd = fd; 268 269 len = snprintf(name, sizeof(name), "%u", fd); 270 if (!proc_fill_cache(file, ctx, 271 name, len, instantiate, p, 272 &data)) 273 goto out; 274 cond_resched(); 275 rcu_read_lock(); 276 } 277 rcu_read_unlock(); 278 out: 279 put_task_struct(p); 280 return 0; 281 } 282 283 static int proc_readfd_count(struct inode *inode, loff_t *count) 284 { 285 struct task_struct *p = get_proc_task(inode); 286 struct fdtable *fdt; 287 288 if (!p) 289 return -ENOENT; 290 291 task_lock(p); 292 if (p->files) { 293 rcu_read_lock(); 294 295 fdt = files_fdtable(p->files); 296 *count = bitmap_weight(fdt->open_fds, fdt->max_fds); 297 298 rcu_read_unlock(); 299 } 300 task_unlock(p); 301 302 put_task_struct(p); 303 304 return 0; 305 } 306 307 static int proc_readfd(struct file *file, struct dir_context *ctx) 308 { 309 return proc_readfd_common(file, ctx, proc_fd_instantiate); 310 } 311 312 const struct file_operations proc_fd_operations = { 313 .read = generic_read_dir, 314 .iterate_shared = proc_readfd, 315 .llseek = generic_file_llseek, 316 }; 317 318 static struct dentry *proc_lookupfd(struct inode *dir, struct dentry *dentry, 319 unsigned int flags) 320 { 321 return proc_lookupfd_common(dir, dentry, proc_fd_instantiate); 322 } 323 324 /* 325 * /proc/pid/fd needs a special permission handler so that a process can still 326 * access /proc/self/fd after it has executed a setuid(). 327 */ 328 int proc_fd_permission(struct user_namespace *mnt_userns, 329 struct inode *inode, int mask) 330 { 331 struct task_struct *p; 332 int rv; 333 334 rv = generic_permission(&init_user_ns, inode, mask); 335 if (rv == 0) 336 return rv; 337 338 rcu_read_lock(); 339 p = pid_task(proc_pid(inode), PIDTYPE_PID); 340 if (p && same_thread_group(p, current)) 341 rv = 0; 342 rcu_read_unlock(); 343 344 return rv; 345 } 346 347 static int proc_fd_getattr(struct user_namespace *mnt_userns, 348 const struct path *path, struct kstat *stat, 349 u32 request_mask, unsigned int query_flags) 350 { 351 struct inode *inode = d_inode(path->dentry); 352 int rv = 0; 353 354 generic_fillattr(&init_user_ns, inode, stat); 355 356 /* If it's a directory, put the number of open fds there */ 357 if (S_ISDIR(inode->i_mode)) { 358 rv = proc_readfd_count(inode, &stat->size); 359 if (rv < 0) 360 return rv; 361 } 362 363 return rv; 364 } 365 366 const struct inode_operations proc_fd_inode_operations = { 367 .lookup = proc_lookupfd, 368 .permission = proc_fd_permission, 369 .getattr = proc_fd_getattr, 370 .setattr = proc_setattr, 371 }; 372 373 static struct dentry *proc_fdinfo_instantiate(struct dentry *dentry, 374 struct task_struct *task, const void *ptr) 375 { 376 const struct fd_data *data = ptr; 377 struct proc_inode *ei; 378 struct inode *inode; 379 380 inode = proc_pid_make_inode(dentry->d_sb, task, S_IFREG | S_IRUGO); 381 if (!inode) 382 return ERR_PTR(-ENOENT); 383 384 ei = PROC_I(inode); 385 ei->fd = data->fd; 386 387 inode->i_fop = &proc_fdinfo_file_operations; 388 tid_fd_update_inode(task, inode, 0); 389 390 d_set_d_op(dentry, &tid_fd_dentry_operations); 391 return d_splice_alias(inode, dentry); 392 } 393 394 static struct dentry * 395 proc_lookupfdinfo(struct inode *dir, struct dentry *dentry, unsigned int flags) 396 { 397 return proc_lookupfd_common(dir, dentry, proc_fdinfo_instantiate); 398 } 399 400 static int proc_readfdinfo(struct file *file, struct dir_context *ctx) 401 { 402 return proc_readfd_common(file, ctx, 403 proc_fdinfo_instantiate); 404 } 405 406 static int proc_open_fdinfo(struct inode *inode, struct file *file) 407 { 408 int ret = proc_fdinfo_access_allowed(inode); 409 410 if (ret) 411 return ret; 412 413 return 0; 414 } 415 416 const struct inode_operations proc_fdinfo_inode_operations = { 417 .lookup = proc_lookupfdinfo, 418 .setattr = proc_setattr, 419 }; 420 421 const struct file_operations proc_fdinfo_operations = { 422 .open = proc_open_fdinfo, 423 .read = generic_read_dir, 424 .iterate_shared = proc_readfdinfo, 425 .llseek = generic_file_llseek, 426 }; 427