123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331 |
- #include <linux/export.h>
- #include <linux/time.h>
- #include <linux/mm.h>
- #include <linux/string.h>
- #include <linux/capability.h>
- #include <linux/fsnotify.h>
- #include <linux/fcntl.h>
- #include <linux/security.h>
- #include <linux/evm.h>
- #include <linux/ima.h>
- int setattr_prepare(struct dentry *dentry, struct iattr *attr)
- {
- struct inode *inode = d_inode(dentry);
- unsigned int ia_valid = attr->ia_valid;
-
- if (ia_valid & ATTR_SIZE) {
- int error = inode_newsize_ok(inode, attr->ia_size);
- if (error)
- return error;
- }
-
- if (ia_valid & ATTR_FORCE)
- goto kill_priv;
-
- if ((ia_valid & ATTR_UID) &&
- (!uid_eq(current_fsuid(), inode->i_uid) ||
- !uid_eq(attr->ia_uid, inode->i_uid)) &&
- !capable_wrt_inode_uidgid(inode, CAP_CHOWN))
- return -EPERM;
-
- if ((ia_valid & ATTR_GID) &&
- (!uid_eq(current_fsuid(), inode->i_uid) ||
- (!in_group_p(attr->ia_gid) && !gid_eq(attr->ia_gid, inode->i_gid))) &&
- !capable_wrt_inode_uidgid(inode, CAP_CHOWN))
- return -EPERM;
-
- if (ia_valid & ATTR_MODE) {
- if (!inode_owner_or_capable(inode))
- return -EPERM;
-
- if (!in_group_p((ia_valid & ATTR_GID) ? attr->ia_gid :
- inode->i_gid) &&
- !capable_wrt_inode_uidgid(inode, CAP_FSETID))
- attr->ia_mode &= ~S_ISGID;
- }
-
- if (ia_valid & (ATTR_MTIME_SET | ATTR_ATIME_SET | ATTR_TIMES_SET)) {
- if (!inode_owner_or_capable(inode))
- return -EPERM;
- }
- kill_priv:
-
- if (ia_valid & ATTR_KILL_PRIV) {
- int error;
- error = security_inode_killpriv(dentry);
- if (error)
- return error;
- }
- return 0;
- }
- EXPORT_SYMBOL(setattr_prepare);
- int inode_newsize_ok(const struct inode *inode, loff_t offset)
- {
- if (inode->i_size < offset) {
- unsigned long limit;
- limit = rlimit(RLIMIT_FSIZE);
- if (limit != RLIM_INFINITY && offset > limit)
- goto out_sig;
- if (offset > inode->i_sb->s_maxbytes)
- goto out_big;
- } else {
-
- if (IS_SWAPFILE(inode))
- return -ETXTBSY;
- }
- return 0;
- out_sig:
- send_sig(SIGXFSZ, current, 0);
- out_big:
- return -EFBIG;
- }
- EXPORT_SYMBOL(inode_newsize_ok);
- void setattr_copy(struct inode *inode, const struct iattr *attr)
- {
- unsigned int ia_valid = attr->ia_valid;
- if (ia_valid & ATTR_UID)
- inode->i_uid = attr->ia_uid;
- if (ia_valid & ATTR_GID)
- inode->i_gid = attr->ia_gid;
- if (ia_valid & ATTR_ATIME)
- inode->i_atime = timespec_trunc(attr->ia_atime,
- inode->i_sb->s_time_gran);
- if (ia_valid & ATTR_MTIME)
- inode->i_mtime = timespec_trunc(attr->ia_mtime,
- inode->i_sb->s_time_gran);
- if (ia_valid & ATTR_CTIME)
- inode->i_ctime = timespec_trunc(attr->ia_ctime,
- inode->i_sb->s_time_gran);
- if (ia_valid & ATTR_MODE) {
- umode_t mode = attr->ia_mode;
- if (!in_group_p(inode->i_gid) &&
- !capable_wrt_inode_uidgid(inode, CAP_FSETID))
- mode &= ~S_ISGID;
- inode->i_mode = mode;
- }
- }
- EXPORT_SYMBOL(setattr_copy);
- int notify_change2(struct vfsmount *mnt, struct dentry * dentry, struct iattr * attr, struct inode **delegated_inode)
- {
- struct inode *inode = dentry->d_inode;
- umode_t mode = inode->i_mode;
- int error;
- struct timespec now;
- unsigned int ia_valid = attr->ia_valid;
- WARN_ON_ONCE(!inode_is_locked(inode));
- if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID | ATTR_TIMES_SET)) {
- if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
- return -EPERM;
- }
-
- if (ia_valid & ATTR_TOUCH) {
- if (IS_IMMUTABLE(inode))
- return -EPERM;
- if (!inode_owner_or_capable(inode)) {
- error = inode_permission2(mnt, inode, MAY_WRITE);
- if (error)
- return error;
- }
- }
- if ((ia_valid & ATTR_MODE)) {
- umode_t amode = attr->ia_mode;
-
- if (is_sxid(amode))
- inode->i_flags &= ~S_NOSEC;
- }
- now = current_time(inode);
- attr->ia_ctime = now;
- if (!(ia_valid & ATTR_ATIME_SET))
- attr->ia_atime = now;
- if (!(ia_valid & ATTR_MTIME_SET))
- attr->ia_mtime = now;
- if (ia_valid & ATTR_KILL_PRIV) {
- error = security_inode_need_killpriv(dentry);
- if (error < 0)
- return error;
- if (error == 0)
- ia_valid = attr->ia_valid &= ~ATTR_KILL_PRIV;
- }
-
- if ((ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) &&
- (ia_valid & ATTR_MODE))
- BUG();
- if (ia_valid & ATTR_KILL_SUID) {
- if (mode & S_ISUID) {
- ia_valid = attr->ia_valid |= ATTR_MODE;
- attr->ia_mode = (inode->i_mode & ~S_ISUID);
- }
- }
- if (ia_valid & ATTR_KILL_SGID) {
- if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
- if (!(ia_valid & ATTR_MODE)) {
- ia_valid = attr->ia_valid |= ATTR_MODE;
- attr->ia_mode = inode->i_mode;
- }
- attr->ia_mode &= ~S_ISGID;
- }
- }
- if (!(attr->ia_valid & ~(ATTR_KILL_SUID | ATTR_KILL_SGID)))
- return 0;
-
- if (ia_valid & ATTR_UID &&
- !kuid_has_mapping(inode->i_sb->s_user_ns, attr->ia_uid))
- return -EOVERFLOW;
- if (ia_valid & ATTR_GID &&
- !kgid_has_mapping(inode->i_sb->s_user_ns, attr->ia_gid))
- return -EOVERFLOW;
-
- if (!(ia_valid & ATTR_UID) && !uid_valid(inode->i_uid))
- return -EOVERFLOW;
- if (!(ia_valid & ATTR_GID) && !gid_valid(inode->i_gid))
- return -EOVERFLOW;
- error = security_inode_setattr(dentry, attr);
- if (error)
- return error;
- error = try_break_deleg(inode, delegated_inode);
- if (error)
- return error;
- if (mnt && inode->i_op->setattr2)
- error = inode->i_op->setattr2(mnt, dentry, attr);
- else if (inode->i_op->setattr)
- error = inode->i_op->setattr(dentry, attr);
- else
- error = simple_setattr(dentry, attr);
- if (!error) {
- fsnotify_change(dentry, ia_valid);
- ima_inode_post_setattr(dentry);
- evm_inode_post_setattr(dentry, ia_valid);
- }
- return error;
- }
- EXPORT_SYMBOL(notify_change2);
- int notify_change(struct dentry * dentry, struct iattr * attr, struct inode **delegated_inode)
- {
- return notify_change2(NULL, dentry, attr, delegated_inode);
- }
- EXPORT_SYMBOL(notify_change);
|