projects/linux·blob v7.3 · refs

1634 lines · 40.2 KiB

1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * linux/fs/open.c
4 *
5 * Copyright (C) 1991, 1992 Linus Torvalds
6 */
7
8#include <linux/string.h>
9#include <linux/mm.h>
10#include <linux/file.h>
11#include <linux/fdtable.h>
12#include <linux/fsnotify.h>
13#include <linux/module.h>
14#include <linux/tty.h>
15#include <linux/namei.h>
16#include <linux/backing-dev.h>
17#include <linux/capability.h>
18#include <linux/securebits.h>
19#include <linux/security.h>
20#include <linux/mount.h>
21#include <linux/fcntl.h>
22#include <linux/slab.h>
23#include <linux/uaccess.h>
24#include <linux/fs.h>
25#include <linux/personality.h>
26#include <linux/pagemap.h>
27#include <linux/syscalls.h>
28#include <linux/rcupdate.h>
29#include <linux/audit.h>
30#include <linux/falloc.h>
31#include <linux/fs_struct.h>
32#include <linux/dnotify.h>
33#include <linux/compat.h>
34#include <linux/mnt_idmapping.h>
35#include <linux/filelock.h>
36
37#include "internal.h"
38
39int do_truncate(struct mnt_idmap *idmap, struct dentry *dentry,
40 loff_t length, unsigned int time_attrs, struct file *filp)
41{
42 int ret;
43 struct iattr newattrs;
44
45 /* Not pretty: "inode->i_size" shouldn't really be signed. But it is. */
46 if (length < 0)
47 return -EINVAL;
48
49 newattrs.ia_size = length;
50 newattrs.ia_valid = ATTR_SIZE | time_attrs;
51 if (filp) {
52 newattrs.ia_file = filp;
53 newattrs.ia_valid |= ATTR_FILE;
54 }
55
56 /* Remove suid, sgid, and file capabilities on truncate too */
57 ret = dentry_needs_remove_privs(idmap, dentry);
58 if (ret < 0)
59 return ret;
60 if (ret)
61 newattrs.ia_valid |= ret | ATTR_FORCE;
62
63 ret = inode_lock_killable(dentry->d_inode);
64 if (ret)
65 return ret;
66
67 /* Note any delegations or leases have already been broken: */
68 ret = notify_change(idmap, dentry, &newattrs, NULL);
69 inode_unlock(dentry->d_inode);
70 return ret;
71}
72
73int vfs_truncate(const struct path *path, loff_t length)
74{
75 struct mnt_idmap *idmap;
76 struct inode *inode;
77 int error;
78
79 inode = path->dentry->d_inode;
80
81 /* For directories it's -EISDIR, for other non-regulars - -EINVAL */
82 if (S_ISDIR(inode->i_mode))
83 return -EISDIR;
84 if (!S_ISREG(inode->i_mode))
85 return -EINVAL;
86
87 idmap = mnt_idmap(path->mnt);
88 error = inode_permission(idmap, inode, MAY_WRITE);
89 if (error)
90 return error;
91
92 error = fsnotify_truncate_perm(path, length);
93 if (error)
94 return error;
95
96 error = mnt_want_write(path->mnt);
97 if (error)
98 return error;
99
100 error = -EPERM;
101 if (IS_APPEND(inode))
102 goto mnt_drop_write_and_out;
103
104 error = get_write_access(inode);
105 if (error)
106 goto mnt_drop_write_and_out;
107
108 /*
109 * Make sure that there are no leases. get_write_access() protects
110 * against the truncate racing with a lease-granting setlease().
111 */
112 error = break_lease(inode, O_WRONLY);
113 if (error)
114 goto put_write_and_out;
115
116 error = security_path_truncate(path);
117 if (!error)
118 error = do_truncate(idmap, path->dentry, length, 0, NULL);
119
120put_write_and_out:
121 put_write_access(inode);
122mnt_drop_write_and_out:
123 mnt_drop_write(path->mnt);
124
125 return error;
126}
127EXPORT_SYMBOL_GPL(vfs_truncate);
128
129int ksys_truncate(const char __user *pathname, loff_t length)
130{
131 unsigned int lookup_flags = LOOKUP_FOLLOW;
132 struct path path;
133 int error;
134
135 if (length < 0) /* sorry, but loff_t says... */
136 return -EINVAL;
137
138 CLASS(filename, name)(pathname);
139retry:
140 error = filename_lookup(AT_FDCWD, name, lookup_flags, &path, NULL);
141 if (!error) {
142 error = vfs_truncate(&path, length);
143 path_put(&path);
144 if (retry_estale(error, lookup_flags)) {
145 lookup_flags |= LOOKUP_REVAL;
146 goto retry;
147 }
148 }
149 return error;
150}
151
152SYSCALL_DEFINE2(truncate, const char __user *, path, long, length)
153{
154 return ksys_truncate(path, length);
155}
156
157#ifdef CONFIG_COMPAT
158COMPAT_SYSCALL_DEFINE2(truncate, const char __user *, path, compat_off_t, length)
159{
160 return ksys_truncate(path, length);
161}
162#endif
163
164int do_ftruncate(struct file *file, loff_t length, unsigned int flags)
165{
166 struct dentry *dentry = file->f_path.dentry;
167 struct inode *inode = dentry->d_inode;
168 int error;
169
170 if (!S_ISREG(inode->i_mode) || !(file->f_mode & FMODE_WRITE))
171 return -EINVAL;
172
173 /*
174 * Cannot ftruncate over 2^31 bytes without large file support, either
175 * through opening with O_LARGEFILE or by using ftruncate64().
176 */
177 if (length > MAX_NON_LFS &&
178 !(file->f_flags & O_LARGEFILE) && !(flags & FTRUNCATE_LFS))
179 return -EINVAL;
180
181 /* Check IS_APPEND on real upper inode */
182 if (IS_APPEND(file_inode(file)))
183 return -EPERM;
184
185 error = security_file_truncate(file);
186 if (error)
187 return error;
188
189 error = fsnotify_truncate_perm(&file->f_path, length);
190 if (error)
191 return error;
192
193 scoped_guard(super_write, inode->i_sb)
194 return do_truncate(file_mnt_idmap(file), dentry, length,
195 ATTR_MTIME | ATTR_CTIME, file);
196}
197
198int ksys_ftruncate(unsigned int fd, loff_t length, unsigned int flags)
199{
200 if (length < 0)
201 return -EINVAL;
202 CLASS(fd, f)(fd);
203 if (fd_empty(f))
204 return -EBADF;
205
206 return do_ftruncate(fd_file(f), length, flags);
207}
208
209SYSCALL_DEFINE2(ftruncate, unsigned int, fd, off_t, length)
210{
211 return ksys_ftruncate(fd, length, 0);
212}
213
214#ifdef CONFIG_COMPAT
215COMPAT_SYSCALL_DEFINE2(ftruncate, unsigned int, fd, compat_off_t, length)
216{
217 return ksys_ftruncate(fd, length, 0);
218}
219#endif
220
221/* LFS versions of truncate are only needed on 32 bit machines */
222#if BITS_PER_LONG == 32
223SYSCALL_DEFINE2(truncate64, const char __user *, path, loff_t, length)
224{
225 return ksys_truncate(path, length);
226}
227
228SYSCALL_DEFINE2(ftruncate64, unsigned int, fd, loff_t, length)
229{
230 return ksys_ftruncate(fd, length, FTRUNCATE_LFS);
231}
232#endif /* BITS_PER_LONG == 32 */
233
234#if defined(CONFIG_COMPAT) && defined(__ARCH_WANT_COMPAT_TRUNCATE64)
235COMPAT_SYSCALL_DEFINE3(truncate64, const char __user *, pathname,
236 compat_arg_u64_dual(length))
237{
238 return ksys_truncate(pathname, compat_arg_u64_glue(length));
239}
240#endif
241
242#if defined(CONFIG_COMPAT) && defined(__ARCH_WANT_COMPAT_FTRUNCATE64)
243COMPAT_SYSCALL_DEFINE3(ftruncate64, unsigned int, fd,
244 compat_arg_u64_dual(length))
245{
246 return ksys_ftruncate(fd, compat_arg_u64_glue(length), FTRUNCATE_LFS);
247}
248#endif
249
250int vfs_fallocate(struct file *file, int mode, loff_t offset, loff_t len)
251{
252 struct inode *inode = file_inode(file);
253 int ret;
254 loff_t sum;
255
256 if (offset < 0 || len <= 0)
257 return -EINVAL;
258
259 if (mode & ~(FALLOC_FL_MODE_MASK | FALLOC_FL_KEEP_SIZE))
260 return -EOPNOTSUPP;
261
262 /*
263 * Modes are exclusive, even if that is not obvious from the encoding
264 * as bit masks and the mix with the flag in the same namespace.
265 *
266 * To make things even more complicated, FALLOC_FL_ALLOCATE_RANGE is
267 * encoded as no bit set.
268 */
269 switch (mode & FALLOC_FL_MODE_MASK) {
270 case FALLOC_FL_ALLOCATE_RANGE:
271 case FALLOC_FL_UNSHARE_RANGE:
272 case FALLOC_FL_ZERO_RANGE:
273 break;
274 case FALLOC_FL_PUNCH_HOLE:
275 if (!(mode & FALLOC_FL_KEEP_SIZE))
276 return -EOPNOTSUPP;
277 break;
278 case FALLOC_FL_COLLAPSE_RANGE:
279 case FALLOC_FL_INSERT_RANGE:
280 case FALLOC_FL_WRITE_ZEROES:
281 if (mode & FALLOC_FL_KEEP_SIZE)
282 return -EOPNOTSUPP;
283 break;
284 default:
285 return -EOPNOTSUPP;
286 }
287
288 if (!(file->f_mode & FMODE_WRITE))
289 return -EBADF;
290
291 /*
292 * On append-only files only space preallocation is supported.
293 */
294 if ((mode & ~FALLOC_FL_KEEP_SIZE) && IS_APPEND(inode))
295 return -EPERM;
296
297 if (IS_IMMUTABLE(inode))
298 return -EPERM;
299
300 /*
301 * We cannot allow any fallocate operation on an active swapfile
302 */
303 if (IS_SWAPFILE(inode))
304 return -ETXTBSY;
305
306 /*
307 * Revalidate the write permissions, in case security policy has
308 * changed since the files were opened.
309 */
310 ret = security_file_permission(file, MAY_WRITE);
311 if (ret)
312 return ret;
313
314 ret = fsnotify_file_area_perm(file, MAY_WRITE, &offset, len);
315 if (ret)
316 return ret;
317
318 if (S_ISFIFO(inode->i_mode))
319 return -ESPIPE;
320
321 if (S_ISDIR(inode->i_mode))
322 return -EISDIR;
323
324 if (!S_ISREG(inode->i_mode) && !S_ISBLK(inode->i_mode))
325 return -ENODEV;
326
327 /* Check for wraparound */
328 if (check_add_overflow(offset, len, &sum))
329 return -EFBIG;
330
331 if (sum > inode->i_sb->s_maxbytes)
332 return -EFBIG;
333
334 if (!file->f_op->fallocate)
335 return -EOPNOTSUPP;
336
337 file_start_write(file);
338 ret = file->f_op->fallocate(file, mode, offset, len);
339
340 /*
341 * Create inotify and fanotify events.
342 *
343 * To keep the logic simple always create events if fallocate succeeds.
344 * This implies that events are even created if the file size remains
345 * unchanged, e.g. when using flag FALLOC_FL_KEEP_SIZE.
346 */
347 if (ret == 0)
348 fsnotify_modify(file);
349
350 file_end_write(file);
351 return ret;
352}
353EXPORT_SYMBOL_GPL(vfs_fallocate);
354
355int ksys_fallocate(int fd, int mode, loff_t offset, loff_t len)
356{
357 CLASS(fd, f)(fd);
358
359 if (fd_empty(f))
360 return -EBADF;
361
362 return vfs_fallocate(fd_file(f), mode, offset, len);
363}
364
365SYSCALL_DEFINE4(fallocate, int, fd, int, mode, loff_t, offset, loff_t, len)
366{
367 return ksys_fallocate(fd, mode, offset, len);
368}
369
370#if defined(CONFIG_COMPAT) && defined(__ARCH_WANT_COMPAT_FALLOCATE)
371COMPAT_SYSCALL_DEFINE6(fallocate, int, fd, int, mode, compat_arg_u64_dual(offset),
372 compat_arg_u64_dual(len))
373{
374 return ksys_fallocate(fd, mode, compat_arg_u64_glue(offset),
375 compat_arg_u64_glue(len));
376}
377#endif
378
379/*
380 * access() needs to use the real uid/gid, not the effective uid/gid.
381 * We do this by temporarily clearing all FS-related capabilities and
382 * switching the fsuid/fsgid around to the real ones.
383 *
384 * Creating new credentials is expensive, so we try to skip doing it,
385 * which we can if the result would match what we already got.
386 */
387static bool access_need_override_creds(int flags)
388{
389 const struct cred *cred;
390
391 if (flags & AT_EACCESS)
392 return false;
393
394 cred = current_cred();
395 if (!uid_eq(cred->fsuid, cred->uid) ||
396 !gid_eq(cred->fsgid, cred->gid))
397 return true;
398
399 if (!issecure(SECURE_NO_SETUID_FIXUP)) {
400 kuid_t root_uid = make_kuid(cred->user_ns, 0);
401 if (!uid_eq(cred->uid, root_uid)) {
402 if (!cap_isclear(cred->cap_effective))
403 return true;
404 } else {
405 if (!cap_isidentical(cred->cap_effective,
406 cred->cap_permitted))
407 return true;
408 }
409 }
410
411 return false;
412}
413
414static const struct cred *access_override_creds(void)
415{
416 struct cred *override_cred;
417
418 override_cred = prepare_creds();
419 if (!override_cred)
420 return NULL;
421
422 /*
423 * XXX access_need_override_creds performs checks in hopes of skipping
424 * this work. Make sure it stays in sync if making any changes in this
425 * routine.
426 */
427
428 override_cred->fsuid = override_cred->uid;
429 override_cred->fsgid = override_cred->gid;
430
431 if (!issecure(SECURE_NO_SETUID_FIXUP)) {
432 /* Clear the capabilities if we switch to a non-root user */
433 kuid_t root_uid = make_kuid(override_cred->user_ns, 0);
434 if (!uid_eq(override_cred->uid, root_uid))
435 cap_clear(override_cred->cap_effective);
436 else
437 override_cred->cap_effective =
438 override_cred->cap_permitted;
439 }
440
441 /*
442 * The new set of credentials can *only* be used in
443 * task-synchronous circumstances, and does not need
444 * RCU freeing, unless somebody then takes a separate
445 * reference to it.
446 *
447 * NOTE! This is _only_ true because this credential
448 * is used purely for override_creds() that installs
449 * it as the subjective cred. Other threads will be
450 * accessing ->real_cred, not the subjective cred.
451 *
452 * If somebody _does_ make a copy of this (using the
453 * 'get_current_cred()' function), that will clear the
454 * non_rcu field, because now that other user may be
455 * expecting RCU freeing. But normal thread-synchronous
456 * cred accesses will keep things non-racy to avoid RCU
457 * freeing.
458 */
459 override_cred->non_rcu = 1;
460 return override_creds(override_cred);
461}
462
463static int do_faccessat(int dfd, const char __user *filename, int mode, int flags)
464{
465 struct path path;
466 struct inode *inode;
467 int res;
468 unsigned int lookup_flags = LOOKUP_FOLLOW;
469 const struct cred *old_cred = NULL;
470
471 if (mode & ~S_IRWXO) /* where's F_OK, X_OK, W_OK, R_OK? */
472 return -EINVAL;
473
474 if (flags & ~(AT_EACCESS | AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH))
475 return -EINVAL;
476
477 if (flags & AT_SYMLINK_NOFOLLOW)
478 lookup_flags &= ~LOOKUP_FOLLOW;
479
480 if (access_need_override_creds(flags)) {
481 old_cred = access_override_creds();
482 if (!old_cred)
483 return -ENOMEM;
484 }
485
486 CLASS(filename_uflags, name)(filename, flags);
487retry:
488 res = filename_lookup(dfd, name, lookup_flags, &path, NULL);
489 if (res)
490 goto out;
491
492 inode = d_backing_inode(path.dentry);
493
494 if ((mode & MAY_EXEC) && S_ISREG(inode->i_mode)) {
495 /*
496 * MAY_EXEC on regular files is denied if the fs is mounted
497 * with the "noexec" flag.
498 */
499 res = -EACCES;
500 if (path_noexec(&path))
501 goto out_path_release;
502 }
503
504 res = inode_permission(mnt_idmap(path.mnt), inode, mode | MAY_ACCESS);
505 /* SuS v2 requires we report a read only fs too */
506 if (res || !(mode & S_IWOTH) || special_file(inode->i_mode))
507 goto out_path_release;
508 /*
509 * This is a rare case where using __mnt_is_readonly()
510 * is OK without a mnt_want/drop_write() pair. Since
511 * no actual write to the fs is performed here, we do
512 * not need to telegraph to that to anyone.
513 *
514 * By doing this, we accept that this access is
515 * inherently racy and know that the fs may change
516 * state before we even see this result.
517 */
518 if (__mnt_is_readonly(path.mnt))
519 res = -EROFS;
520
521out_path_release:
522 path_put(&path);
523 if (retry_estale(res, lookup_flags)) {
524 lookup_flags |= LOOKUP_REVAL;
525 goto retry;
526 }
527out:
528 if (old_cred)
529 put_cred(revert_creds(old_cred));
530
531 return res;
532}
533
534SYSCALL_DEFINE3(faccessat, int, dfd, const char __user *, filename, int, mode)
535{
536 return do_faccessat(dfd, filename, mode, 0);
537}
538
539SYSCALL_DEFINE4(faccessat2, int, dfd, const char __user *, filename, int, mode,
540 int, flags)
541{
542 return do_faccessat(dfd, filename, mode, flags);
543}
544
545SYSCALL_DEFINE2(access, const char __user *, filename, int, mode)
546{
547 return do_faccessat(AT_FDCWD, filename, mode, 0);
548}
549
550SYSCALL_DEFINE1(chdir, const char __user *, filename)
551{
552 struct path path;
553 int error;
554 unsigned int lookup_flags = LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
555 CLASS(filename, name)(filename);
556retry:
557 error = filename_lookup(AT_FDCWD, name, lookup_flags, &path, NULL);
558 if (!error) {
559 error = path_permission(&path, MAY_EXEC | MAY_CHDIR);
560 if (!error)
561 set_fs_pwd(current->fs, &path);
562 path_put(&path);
563 if (retry_estale(error, lookup_flags)) {
564 lookup_flags |= LOOKUP_REVAL;
565 goto retry;
566 }
567 }
568 return error;
569}
570
571SYSCALL_DEFINE1(fchdir, unsigned int, fd)
572{
573 int error;
574
575 if ((int)fd == FD_FAILFS_ROOT)
576 return failfs_current_chdir();
577
578 CLASS(fd_raw, f)(fd);
579 if (fd_empty(f))
580 return -EBADF;
581
582 if (!d_can_lookup(fd_file(f)->f_path.dentry))
583 return -ENOTDIR;
584
585 error = file_permission(fd_file(f), MAY_EXEC | MAY_CHDIR);
586 if (!error)
587 set_fs_pwd(current->fs, &fd_file(f)->f_path);
588 return error;
589}
590
591SYSCALL_DEFINE1(chroot, const char __user *, filename)
592{
593 struct path path;
594 int error;
595 unsigned int lookup_flags = LOOKUP_FOLLOW | LOOKUP_DIRECTORY;
596 CLASS(filename, name)(filename);
597retry:
598 error = filename_lookup(AT_FDCWD, name, lookup_flags, &path, NULL);
599 if (error)
600 return error;
601
602 error = path_permission(&path, MAY_EXEC | MAY_CHDIR);
603 if (error)
604 goto dput_and_out;
605
606 error = -EPERM;
607 if (!ns_capable(current_user_ns(), CAP_SYS_CHROOT))
608 goto dput_and_out;
609 error = security_path_chroot(&path);
610 if (!error)
611 set_fs_root(current->fs, &path);
612dput_and_out:
613 path_put(&path);
614 if (retry_estale(error, lookup_flags)) {
615 lookup_flags |= LOOKUP_REVAL;
616 goto retry;
617 }
618 return error;
619}
620
621SYSCALL_DEFINE2(fchroot, int, fd, unsigned int, flags)
622{
623 struct path path;
624 int error;
625
626 if (flags)
627 return -EINVAL;
628
629 if (fd == FD_FAILFS_ROOT) {
630 if (!ns_capable(current_user_ns(), CAP_SYS_CHROOT)) {
631 if (!task_no_new_privs(current))
632 return -EPERM;
633 /* A shared fs_struct lets a sibling exec setuid past the check above. */
634 if (current->fs->users != 1)
635 return -EINVAL;
636 /* Moving the root to failfs lifts the old root's ".." barrier. */
637 if (current_chrooted())
638 return -EPERM;
639 }
640 failfs_get_root(&path);
641 } else {
642 CLASS(fd_raw, f)(fd);
643 if (fd_empty(f))
644 return -EBADF;
645
646 if (!d_can_lookup(fd_file(f)->f_path.dentry))
647 return -ENOTDIR;
648
649 error = file_permission(fd_file(f), MAY_EXEC | MAY_CHDIR);
650 if (error)
651 return error;
652
653 if (!ns_capable(current_user_ns(), CAP_SYS_CHROOT))
654 return -EPERM;
655
656 path = fd_file(f)->f_path;
657 path_get(&path);
658 }
659
660 error = security_path_chroot(&path);
661 if (!error)
662 set_fs_root(current->fs, &path);
663 path_put(&path);
664 return error;
665}
666
667int chmod_common(const struct path *path, umode_t mode)
668{
669 struct inode *inode = path->dentry->d_inode;
670 struct delegated_inode delegated_inode = { };
671 struct iattr newattrs;
672 int error;
673
674 error = mnt_want_write(path->mnt);
675 if (error)
676 return error;
677retry_deleg:
678 error = inode_lock_killable(inode);
679 if (error)
680 goto out_mnt_unlock;
681 error = security_path_chmod(path, mode);
682 if (error)
683 goto out_unlock;
684 newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
685 newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
686 error = notify_change(mnt_idmap(path->mnt), path->dentry,
687 &newattrs, &delegated_inode);
688out_unlock:
689 inode_unlock(inode);
690 if (is_delegated(&delegated_inode)) {
691 error = break_deleg_wait(&delegated_inode);
692 if (!error)
693 goto retry_deleg;
694 }
695out_mnt_unlock:
696 mnt_drop_write(path->mnt);
697 return error;
698}
699
700int vfs_fchmod(struct file *file, umode_t mode)
701{
702 audit_file(file);
703 return chmod_common(&file->f_path, mode);
704}
705
706SYSCALL_DEFINE2(fchmod, unsigned int, fd, umode_t, mode)
707{
708 CLASS(fd, f)(fd);
709
710 if (fd_empty(f))
711 return -EBADF;
712
713 return vfs_fchmod(fd_file(f), mode);
714}
715
716static int do_fchmodat(int dfd, const char __user *filename, umode_t mode,
717 unsigned int flags)
718{
719 struct path path;
720 int error;
721 unsigned int lookup_flags;
722
723 if (unlikely(flags & ~(AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH)))
724 return -EINVAL;
725
726 lookup_flags = (flags & AT_SYMLINK_NOFOLLOW) ? 0 : LOOKUP_FOLLOW;
727 CLASS(filename_uflags, name)(filename, flags);
728retry:
729 error = filename_lookup(dfd, name, lookup_flags, &path, NULL);
730 if (!error) {
731 error = chmod_common(&path, mode);
732 path_put(&path);
733 if (retry_estale(error, lookup_flags)) {
734 lookup_flags |= LOOKUP_REVAL;
735 goto retry;
736 }
737 }
738 return error;
739}
740
741SYSCALL_DEFINE4(fchmodat2, int, dfd, const char __user *, filename,
742 umode_t, mode, unsigned int, flags)
743{
744 return do_fchmodat(dfd, filename, mode, flags);
745}
746
747SYSCALL_DEFINE3(fchmodat, int, dfd, const char __user *, filename,
748 umode_t, mode)
749{
750 return do_fchmodat(dfd, filename, mode, 0);
751}
752
753SYSCALL_DEFINE2(chmod, const char __user *, filename, umode_t, mode)
754{
755 return do_fchmodat(AT_FDCWD, filename, mode, 0);
756}
757
758/*
759 * Check whether @kuid is valid and if so generate and set vfsuid_t in
760 * ia_vfsuid.
761 *
762 * Return: true if @kuid is valid, false if not.
763 */
764static inline bool setattr_vfsuid(struct iattr *attr, kuid_t kuid)
765{
766 if (!uid_valid(kuid))
767 return false;
768 attr->ia_valid |= ATTR_UID;
769 attr->ia_vfsuid = VFSUIDT_INIT(kuid);
770 return true;
771}
772
773/*
774 * Check whether @kgid is valid and if so generate and set vfsgid_t in
775 * ia_vfsgid.
776 *
777 * Return: true if @kgid is valid, false if not.
778 */
779static inline bool setattr_vfsgid(struct iattr *attr, kgid_t kgid)
780{
781 if (!gid_valid(kgid))
782 return false;
783 attr->ia_valid |= ATTR_GID;
784 attr->ia_vfsgid = VFSGIDT_INIT(kgid);
785 return true;
786}
787
788int chown_common(const struct path *path, uid_t user, gid_t group)
789{
790 struct mnt_idmap *idmap;
791 struct user_namespace *fs_userns;
792 struct inode *inode = path->dentry->d_inode;
793 struct delegated_inode delegated_inode = { };
794 int error;
795 struct iattr newattrs;
796 kuid_t uid;
797 kgid_t gid;
798
799 uid = make_kuid(current_user_ns(), user);
800 gid = make_kgid(current_user_ns(), group);
801
802 idmap = mnt_idmap(path->mnt);
803 fs_userns = i_user_ns(inode);
804
805retry_deleg:
806 newattrs.ia_vfsuid = INVALID_VFSUID;
807 newattrs.ia_vfsgid = INVALID_VFSGID;
808 newattrs.ia_valid = ATTR_CTIME;
809 if ((user != (uid_t)-1) && !setattr_vfsuid(&newattrs, uid))
810 return -EINVAL;
811 if ((group != (gid_t)-1) && !setattr_vfsgid(&newattrs, gid))
812 return -EINVAL;
813 error = inode_lock_killable(inode);
814 if (error)
815 return error;
816 if (!S_ISDIR(inode->i_mode))
817 newattrs.ia_valid |= ATTR_KILL_SUID | ATTR_KILL_PRIV |
818 setattr_should_drop_sgid(idmap, inode);
819 /* Continue to send actual fs values, not the mount values. */
820 error = security_path_chown(
821 path,
822 from_vfsuid(idmap, fs_userns, newattrs.ia_vfsuid),
823 from_vfsgid(idmap, fs_userns, newattrs.ia_vfsgid));
824 if (!error)
825 error = notify_change(idmap, path->dentry, &newattrs,
826 &delegated_inode);
827 inode_unlock(inode);
828 if (is_delegated(&delegated_inode)) {
829 error = break_deleg_wait(&delegated_inode);
830 if (!error)
831 goto retry_deleg;
832 }
833 return error;
834}
835
836int do_fchownat(int dfd, const char __user *filename, uid_t user, gid_t group,
837 int flag)
838{
839 struct path path;
840 int error;
841 int lookup_flags;
842
843 if ((flag & ~(AT_SYMLINK_NOFOLLOW | AT_EMPTY_PATH)) != 0)
844 return -EINVAL;
845
846 lookup_flags = (flag & AT_SYMLINK_NOFOLLOW) ? 0 : LOOKUP_FOLLOW;
847 CLASS(filename_uflags, name)(filename, flag);
848retry:
849 error = filename_lookup(dfd, name, lookup_flags, &path, NULL);
850 if (!error) {
851 error = mnt_want_write(path.mnt);
852 if (!error) {
853 error = chown_common(&path, user, group);
854 mnt_drop_write(path.mnt);
855 }
856 path_put(&path);
857 if (retry_estale(error, lookup_flags)) {
858 lookup_flags |= LOOKUP_REVAL;
859 goto retry;
860 }
861 }
862 return error;
863}
864
865SYSCALL_DEFINE5(fchownat, int, dfd, const char __user *, filename, uid_t, user,
866 gid_t, group, int, flag)
867{
868 return do_fchownat(dfd, filename, user, group, flag);
869}
870
871SYSCALL_DEFINE3(chown, const char __user *, filename, uid_t, user, gid_t, group)
872{
873 return do_fchownat(AT_FDCWD, filename, user, group, 0);
874}
875
876SYSCALL_DEFINE3(lchown, const char __user *, filename, uid_t, user, gid_t, group)
877{
878 return do_fchownat(AT_FDCWD, filename, user, group,
879 AT_SYMLINK_NOFOLLOW);
880}
881
882int vfs_fchown(struct file *file, uid_t user, gid_t group)
883{
884 int error;
885
886 error = mnt_want_write_file(file);
887 if (error)
888 return error;
889 audit_file(file);
890 error = chown_common(&file->f_path, user, group);
891 mnt_drop_write_file(file);
892 return error;
893}
894
895int ksys_fchown(unsigned int fd, uid_t user, gid_t group)
896{
897 CLASS(fd, f)(fd);
898
899 if (fd_empty(f))
900 return -EBADF;
901
902 return vfs_fchown(fd_file(f), user, group);
903}
904
905SYSCALL_DEFINE3(fchown, unsigned int, fd, uid_t, user, gid_t, group)
906{
907 return ksys_fchown(fd, user, group);
908}
909
910static inline int file_get_write_access(struct file *f)
911{
912 int error;
913
914 error = get_write_access(f->f_inode);
915 if (unlikely(error))
916 return error;
917 error = mnt_get_write_access(f->f_path.mnt);
918 if (unlikely(error))
919 goto cleanup_inode;
920 if (unlikely(f->f_mode & FMODE_BACKING)) {
921 error = mnt_get_write_access(backing_file_user_path(f)->mnt);
922 if (unlikely(error))
923 goto cleanup_mnt;
924 }
925 return 0;
926
927cleanup_mnt:
928 mnt_put_write_access(f->f_path.mnt);
929cleanup_inode:
930 put_write_access(f->f_inode);
931 return error;
932}
933
934static int do_dentry_open(struct file *f,
935 int (*open)(struct inode *, struct file *))
936{
937 static const struct file_operations empty_fops = {};
938 struct inode *inode = f->f_path.dentry->d_inode;
939 int error;
940
941 path_get(&f->f_path);
942 f->f_inode = inode;
943 f->f_mapping = inode->i_mapping;
944 f->f_wb_err = filemap_sample_wb_err(f->f_mapping);
945 f->f_sb_err = file_sample_sb_err(f);
946
947 if (unlikely(f->f_flags & O_PATH)) {
948 f->f_mode = FMODE_PATH | FMODE_OPENED;
949 file_set_fsnotify_mode(f, FMODE_NONOTIFY);
950 f->f_op = &empty_fops;
951 return 0;
952 }
953
954 if ((f->f_mode & (FMODE_READ | FMODE_WRITE)) == FMODE_READ) {
955 i_readcount_inc(inode);
956 } else if (f->f_mode & FMODE_WRITE && !special_file(inode->i_mode)) {
957 error = file_get_write_access(f);
958 if (unlikely(error))
959 goto cleanup_file;
960 f->f_mode |= FMODE_WRITER;
961 }
962
963 /* POSIX.1-2008/SUSv4 Section XSI 2.9.7 */
964 if (S_ISREG(inode->i_mode) || S_ISDIR(inode->i_mode))
965 f->f_mode |= FMODE_ATOMIC_POS;
966
967 f->f_op = fops_get(inode->i_fop);
968 if (WARN_ON(!f->f_op)) {
969 error = -ENODEV;
970 goto cleanup_all;
971 }
972
973 error = security_file_open(f);
974 if (unlikely(error))
975 goto cleanup_all;
976
977 /*
978 * Call fsnotify open permission hook and set FMODE_NONOTIFY_* bits
979 * according to existing permission watches.
980 * If FMODE_NONOTIFY mode was already set for an fanotify fd or for a
981 * pseudo file, this call will not change the mode.
982 */
983 error = fsnotify_open_perm_and_set_mode(f);
984 if (unlikely(error))
985 goto cleanup_all;
986
987 error = break_lease(file_inode(f), f->f_flags);
988 if (unlikely(error))
989 goto cleanup_all;
990
991 /* normally all 3 are set; ->open() can clear them if needed */
992 f->f_mode |= FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE;
993 if (!open)
994 open = f->f_op->open;
995 if (open) {
996 error = open(inode, f);
997 if (error)
998 goto cleanup_all;
999 }
1000 f->f_mode |= FMODE_OPENED;
1001 if ((f->f_mode & FMODE_READ) &&
1002 likely(f->f_op->read || f->f_op->read_iter))
1003 f->f_mode |= FMODE_CAN_READ;
1004 if ((f->f_mode & FMODE_WRITE) &&
1005 likely(f->f_op->write || f->f_op->write_iter))
1006 f->f_mode |= FMODE_CAN_WRITE;
1007 if ((f->f_mode & FMODE_LSEEK) && !f->f_op->llseek)
1008 f->f_mode &= ~FMODE_LSEEK;
1009 if (f->f_mapping->a_ops && f->f_mapping->a_ops->direct_IO)
1010 f->f_mode |= FMODE_CAN_ODIRECT;
1011
1012 f->f_flags &= ~(O_CREAT | O_EXCL | O_NOCTTY | O_TRUNC | __O_REGULAR);
1013 f->f_iocb_flags = iocb_flags(f);
1014
1015 file_ra_state_init(&f->f_ra, f->f_mapping->host->i_mapping);
1016
1017 if ((f->f_flags & O_DIRECT) && !(f->f_mode & FMODE_CAN_ODIRECT))
1018 return -EINVAL;
1019
1020 return 0;
1021
1022cleanup_all:
1023 if (WARN_ON_ONCE(error > 0))
1024 error = -EINVAL;
1025 fops_put(f->f_op);
1026 put_file_access(f);
1027cleanup_file:
1028 path_put(&f->f_path);
1029 f->__f_path.mnt = NULL;
1030 f->__f_path.dentry = NULL;
1031 f->f_inode = NULL;
1032 return error;
1033}
1034
1035/**
1036 * finish_open - finish opening a file
1037 * @file: file pointer
1038 * @dentry: pointer to dentry
1039 * @open: open callback
1040 *
1041 * This can be used to finish opening a file passed to i_op->atomic_open().
1042 *
1043 * If the open callback is set to NULL, then the standard f_op->open()
1044 * filesystem callback is substituted.
1045 *
1046 * NB: the dentry reference is _not_ consumed. If, for example, the dentry is
1047 * the return value of d_splice_alias(), then the caller needs to perform dput()
1048 * on it after finish_open().
1049 *
1050 * Returns zero on success or -errno if the open failed.
1051 */
1052int finish_open(struct file *file, struct dentry *dentry,
1053 int (*open)(struct inode *, struct file *))
1054{
1055 BUG_ON(file->f_mode & FMODE_OPENED); /* once it's opened, it's opened */
1056
1057 file->__f_path.dentry = dentry;
1058 return do_dentry_open(file, open);
1059}
1060EXPORT_SYMBOL(finish_open);
1061
1062/**
1063 * finish_no_open - finish ->atomic_open() without opening the file
1064 *
1065 * @file: file pointer
1066 * @dentry: dentry, ERR_PTR(-E...) or NULL (as returned from ->lookup())
1067 *
1068 * This can be used to set the result of a lookup in ->atomic_open().
1069 *
1070 * NB: unlike finish_open() this function does consume the dentry reference and
1071 * the caller need not dput() it.
1072 *
1073 * Returns 0 or -E..., which must be the return value of ->atomic_open() after
1074 * having called this function.
1075 */
1076int finish_no_open(struct file *file, struct dentry *dentry)
1077{
1078 if (IS_ERR(dentry))
1079 return PTR_ERR(dentry);
1080 file->__f_path.dentry = dentry;
1081 return 0;
1082}
1083EXPORT_SYMBOL(finish_no_open);
1084
1085char *file_path(struct file *filp, char *buf, int buflen)
1086{
1087 return d_path(&filp->f_path, buf, buflen);
1088}
1089EXPORT_SYMBOL(file_path);
1090
1091/**
1092 * vfs_open - open the file at the given path
1093 * @path: path to open
1094 * @file: newly allocated file with f_flag initialized
1095 */
1096int vfs_open(const struct path *path, struct file *file)
1097{
1098 int ret;
1099
1100 file->__f_path = *path;
1101 ret = do_dentry_open(file, NULL);
1102 if (!ret) {
1103 /*
1104 * Once we return a file with FMODE_OPENED, __fput() will call
1105 * fsnotify_close(), so we need fsnotify_open() here for
1106 * symmetry.
1107 */
1108 fsnotify_open(file);
1109 }
1110 return ret;
1111}
1112
1113struct file *dentry_open(const struct path *path, int flags,
1114 const struct cred *cred)
1115{
1116 int error;
1117 struct file *f;
1118
1119 /* We must always pass in a valid mount pointer. */
1120 BUG_ON(!path->mnt);
1121
1122 f = alloc_empty_file(flags, cred);
1123 if (!IS_ERR(f)) {
1124 error = vfs_open(path, f);
1125 if (error) {
1126 fput(f);
1127 f = ERR_PTR(error);
1128 }
1129 }
1130 return f;
1131}
1132EXPORT_SYMBOL(dentry_open);
1133
1134struct file *dentry_open_nonotify(const struct path *path, int flags,
1135 const struct cred *cred)
1136{
1137 struct file *f = alloc_empty_file(flags, cred);
1138 if (!IS_ERR(f)) {
1139 int error;
1140
1141 file_set_fsnotify_mode(f, FMODE_NONOTIFY);
1142 error = vfs_open(path, f);
1143 if (error) {
1144 fput(f);
1145 f = ERR_PTR(error);
1146 }
1147 }
1148 return f;
1149}
1150
1151/**
1152 * kernel_file_open - open a file for kernel internal use
1153 * @path: path of the file to open
1154 * @flags: open flags
1155 * @cred: credentials for open
1156 *
1157 * Open a file for use by in-kernel consumers. The file is not accounted
1158 * against nr_files and must not be installed into the file descriptor
1159 * table.
1160 *
1161 * Return: Opened file on success, an error pointer on failure.
1162 */
1163struct file *kernel_file_open(const struct path *path, int flags,
1164 const struct cred *cred)
1165{
1166 struct file *f;
1167 int error;
1168
1169 f = alloc_empty_file_noaccount(flags, cred);
1170 if (IS_ERR(f))
1171 return f;
1172
1173 error = vfs_open(path, f);
1174 if (error) {
1175 fput(f);
1176 return ERR_PTR(error);
1177 }
1178 return f;
1179}
1180EXPORT_SYMBOL_GPL(kernel_file_open);
1181
1182#define WILL_CREATE(flags) (flags & (O_CREAT | __O_TMPFILE))
1183#define O_PATH_FLAGS (O_DIRECTORY | O_NOFOLLOW | O_PATH | O_CLOEXEC | O_EMPTYPATH)
1184
1185inline struct open_how build_open_how(int flags, umode_t mode)
1186{
1187 struct open_how how = {
1188 .flags = flags & VALID_OPEN_FLAGS,
1189 .mode = mode & S_IALLUGO,
1190 };
1191
1192 /* O_PATH beats everything else. */
1193 if (how.flags & O_PATH)
1194 how.flags &= O_PATH_FLAGS;
1195 /* Modes should only be set for create-like flags. */
1196 if (!WILL_CREATE(how.flags))
1197 how.mode = 0;
1198 return how;
1199}
1200
1201inline int build_open_flags(const struct open_how *how, struct open_flags *op)
1202{
1203 u64 flags = how->flags;
1204 u64 strip = O_CLOEXEC;
1205 int lookup_flags = 0;
1206 int acc_mode = ACC_MODE(flags);
1207
1208 BUILD_BUG_ON_MSG(upper_32_bits(VALID_OPEN_FLAGS),
1209 "VALID_OPEN_FLAGS must fit in 32 bits");
1210 /* The whole point: OPENAT2_REGULAR must be unrepresentable in int. */
1211 BUILD_BUG_ON_MSG(!upper_32_bits(OPENAT2_REGULAR),
1212 "OPENAT2_REGULAR must live in the upper 32 bits of open_how::flags");
1213 /* Prevent a future bit collision between UAPI and internal carrier. */
1214 BUILD_BUG_ON_MSG(OPENAT2_REGULAR & VALID_OPEN_FLAGS,
1215 "OPENAT2_REGULAR must not alias any open()/openat() flag");
1216 BUILD_BUG_ON_MSG(__O_REGULAR & VALID_OPENAT2_FLAGS,
1217 "__O_REGULAR must not alias any user-visible flag");
1218
1219 /*
1220 * Strip flags that aren't relevant in determining struct open_flags.
1221 */
1222 flags &= ~strip;
1223
1224 /*
1225 * Older syscalls implicitly clear all of the invalid flags or argument
1226 * values before calling build_open_flags(), but openat2(2) checks all
1227 * of its arguments.
1228 */
1229 if (flags & ~VALID_OPENAT2_FLAGS)
1230 return -EINVAL;
1231 if (how->resolve & ~VALID_RESOLVE_FLAGS)
1232 return -EINVAL;
1233
1234 /* Scoping flags are mutually exclusive. */
1235 if ((how->resolve & RESOLVE_BENEATH) && (how->resolve & RESOLVE_IN_ROOT))
1236 return -EINVAL;
1237
1238 /* Deal with the mode. */
1239 if (WILL_CREATE(flags)) {
1240 if (how->mode & ~S_IALLUGO)
1241 return -EINVAL;
1242 op->mode = how->mode | S_IFREG;
1243 } else {
1244 if (how->mode != 0)
1245 return -EINVAL;
1246 op->mode = 0;
1247 }
1248
1249 /*
1250 * Block bugs where O_DIRECTORY | O_CREAT created regular files.
1251 * Note, that blocking O_DIRECTORY | O_CREAT here also protects
1252 * O_TMPFILE below which requires O_DIRECTORY being raised.
1253 */
1254 if ((flags & (O_DIRECTORY | O_CREAT)) == (O_DIRECTORY | O_CREAT))
1255 return -EINVAL;
1256
1257 /* Now handle the creative implementation of O_TMPFILE. */
1258 if (flags & __O_TMPFILE) {
1259 /*
1260 * In order to ensure programs get explicit errors when trying
1261 * to use O_TMPFILE on old kernels we enforce that O_DIRECTORY
1262 * is raised alongside __O_TMPFILE.
1263 */
1264 if (!(flags & O_DIRECTORY))
1265 return -EINVAL;
1266 if (!(acc_mode & MAY_WRITE))
1267 return -EINVAL;
1268 }
1269 /*
1270 * Asking to open a directory and a regular file at the same time is
1271 * contradictory.
1272 */
1273 if ((flags & (O_DIRECTORY | OPENAT2_REGULAR)) ==
1274 (O_DIRECTORY | OPENAT2_REGULAR))
1275 return -EINVAL;
1276
1277 if (flags & O_PATH) {
1278 /* O_PATH only permits certain other flags to be set. */
1279 if (flags & ~O_PATH_FLAGS)
1280 return -EINVAL;
1281 acc_mode = 0;
1282 }
1283
1284 /*
1285 * O_SYNC is implemented as __O_SYNC|O_DSYNC. As many places only
1286 * check for O_DSYNC if the need any syncing at all we enforce it's
1287 * always set instead of having to deal with possibly weird behaviour
1288 * for malicious applications setting only __O_SYNC.
1289 */
1290 if (flags & __O_SYNC)
1291 flags |= O_DSYNC;
1292
1293 /*
1294 * Translate the upper-32-bit UAPI bit OPENAT2_REGULAR into the
1295 * kernel-internal lower-32-bit __O_REGULAR carrier so the bit
1296 * survives the assignment to op->open_flag (an int) below and the
1297 * subsequent flow through f->f_flags (unsigned int) and the
1298 * i_op->atomic_open() callback (unsigned). do_dentry_open() strips
1299 * __O_REGULAR before the file becomes visible to userspace.
1300 */
1301 if (flags & OPENAT2_REGULAR) {
1302 flags &= ~OPENAT2_REGULAR;
1303 flags |= __O_REGULAR;
1304 }
1305
1306 op->open_flag = flags;
1307
1308 /* O_TRUNC implies we need access checks for write permissions */
1309 if (flags & O_TRUNC)
1310 acc_mode |= MAY_WRITE;
1311
1312 /* Allow the LSM permission hook to distinguish append
1313 access from general write access. */
1314 if (flags & O_APPEND)
1315 acc_mode |= MAY_APPEND;
1316
1317 op->acc_mode = acc_mode;
1318
1319 op->intent = flags & O_PATH ? 0 : LOOKUP_OPEN;
1320
1321 if (flags & O_CREAT) {
1322 op->intent |= LOOKUP_CREATE;
1323 if (flags & O_EXCL) {
1324 op->intent |= LOOKUP_EXCL;
1325 flags |= O_NOFOLLOW;
1326 }
1327 }
1328
1329 if (flags & O_DIRECTORY)
1330 lookup_flags |= LOOKUP_DIRECTORY;
1331 if (!(flags & O_NOFOLLOW))
1332 lookup_flags |= LOOKUP_FOLLOW;
1333 if (flags & O_EMPTYPATH)
1334 lookup_flags |= LOOKUP_EMPTY;
1335
1336 if (how->resolve & RESOLVE_NO_XDEV)
1337 lookup_flags |= LOOKUP_NO_XDEV;
1338 if (how->resolve & RESOLVE_NO_MAGICLINKS)
1339 lookup_flags |= LOOKUP_NO_MAGICLINKS;
1340 if (how->resolve & RESOLVE_NO_SYMLINKS)
1341 lookup_flags |= LOOKUP_NO_SYMLINKS;
1342 if (how->resolve & RESOLVE_BENEATH)
1343 lookup_flags |= LOOKUP_BENEATH;
1344 if (how->resolve & RESOLVE_IN_ROOT)
1345 lookup_flags |= LOOKUP_IN_ROOT;
1346 if (how->resolve & RESOLVE_CACHED) {
1347 /* Don't bother even trying for create/truncate/tmpfile open */
1348 if (flags & (O_TRUNC | O_CREAT | __O_TMPFILE))
1349 return -EAGAIN;
1350 lookup_flags |= LOOKUP_CACHED;
1351 }
1352
1353 op->lookup_flags = lookup_flags;
1354 return 0;
1355}
1356
1357/**
1358 * file_open_name - open file and return file pointer
1359 *
1360 * @name: struct filename containing path to open
1361 * @flags: open flags as per the open(2) second argument
1362 * @mode: mode for the new file if O_CREAT is set, else ignored
1363 *
1364 * This is the helper to open a file from kernelspace if you really
1365 * have to. But in generally you should not do this, so please move
1366 * along, nothing to see here..
1367 */
1368struct file *file_open_name(struct filename *name, int flags, umode_t mode)
1369{
1370 struct open_flags op;
1371 struct open_how how = build_open_how(flags, mode);
1372 int err = build_open_flags(&how, &op);
1373 if (err)
1374 return ERR_PTR(err);
1375 return do_file_open(AT_FDCWD, name, &op);
1376}
1377
1378/**
1379 * filp_open - open file and return file pointer
1380 *
1381 * @filename: path to open
1382 * @flags: open flags as per the open(2) second argument
1383 * @mode: mode for the new file if O_CREAT is set, else ignored
1384 *
1385 * This is the helper to open a file from kernelspace if you really
1386 * have to. But in generally you should not do this, so please move
1387 * along, nothing to see here..
1388 */
1389struct file *filp_open(const char *filename, int flags, umode_t mode)
1390{
1391 CLASS(filename_kernel, name)(filename);
1392 return file_open_name(name, flags, mode);
1393}
1394EXPORT_SYMBOL(filp_open);
1395
1396struct file *file_open_root(const struct path *root,
1397 const char *filename, int flags, umode_t mode)
1398{
1399 struct open_flags op;
1400 struct open_how how = build_open_how(flags, mode);
1401 int err = build_open_flags(&how, &op);
1402 if (err)
1403 return ERR_PTR(err);
1404 return do_file_open_root(root, filename, &op);
1405}
1406EXPORT_SYMBOL(file_open_root);
1407
1408static int do_sys_openat2(int dfd, const char __user *filename,
1409 struct open_how *how)
1410{
1411 struct open_flags op;
1412 int err = build_open_flags(how, &op);
1413 if (unlikely(err))
1414 return err;
1415
1416 CLASS(filename_flags, name)(filename, op.lookup_flags);
1417 return FD_ADD(how->flags, do_file_open(dfd, name, &op));
1418}
1419
1420int do_sys_open(int dfd, const char __user *filename, int flags, umode_t mode)
1421{
1422 struct open_how how = build_open_how(flags, mode);
1423 return do_sys_openat2(dfd, filename, &how);
1424}
1425
1426
1427SYSCALL_DEFINE3(open, const char __user *, filename, int, flags, umode_t, mode)
1428{
1429 if (force_o_largefile())
1430 flags |= O_LARGEFILE;
1431 return do_sys_open(AT_FDCWD, filename, flags, mode);
1432}
1433
1434SYSCALL_DEFINE4(openat, int, dfd, const char __user *, filename, int, flags,
1435 umode_t, mode)
1436{
1437 if (force_o_largefile())
1438 flags |= O_LARGEFILE;
1439 return do_sys_open(dfd, filename, flags, mode);
1440}
1441
1442SYSCALL_DEFINE4(openat2, int, dfd, const char __user *, filename,
1443 struct open_how __user *, how, size_t, usize)
1444{
1445 int err;
1446 struct open_how tmp;
1447
1448 BUILD_BUG_ON(sizeof(struct open_how) < OPEN_HOW_SIZE_VER0);
1449 BUILD_BUG_ON(sizeof(struct open_how) != OPEN_HOW_SIZE_LATEST);
1450
1451 if (unlikely(usize < OPEN_HOW_SIZE_VER0))
1452 return -EINVAL;
1453 if (unlikely(usize > PAGE_SIZE))
1454 return -E2BIG;
1455
1456 err = copy_struct_from_user(&tmp, sizeof(tmp), how, usize);
1457 if (err)
1458 return err;
1459
1460 audit_openat2_how(&tmp);
1461
1462 /* O_LARGEFILE is only allowed for non-O_PATH. */
1463 if (!(tmp.flags & O_PATH) && force_o_largefile())
1464 tmp.flags |= O_LARGEFILE;
1465
1466 return do_sys_openat2(dfd, filename, &tmp);
1467}
1468
1469#ifdef CONFIG_COMPAT
1470/*
1471 * Exactly like sys_open(), except that it doesn't set the
1472 * O_LARGEFILE flag.
1473 */
1474COMPAT_SYSCALL_DEFINE3(open, const char __user *, filename, int, flags, umode_t, mode)
1475{
1476 return do_sys_open(AT_FDCWD, filename, flags, mode);
1477}
1478
1479/*
1480 * Exactly like sys_openat(), except that it doesn't set the
1481 * O_LARGEFILE flag.
1482 */
1483COMPAT_SYSCALL_DEFINE4(openat, int, dfd, const char __user *, filename, int, flags, umode_t, mode)
1484{
1485 return do_sys_open(dfd, filename, flags, mode);
1486}
1487#endif
1488
1489#ifndef __alpha__
1490
1491/*
1492 * For backward compatibility? Maybe this should be moved
1493 * into arch/i386 instead?
1494 */
1495SYSCALL_DEFINE2(creat, const char __user *, pathname, umode_t, mode)
1496{
1497 int flags = O_CREAT | O_WRONLY | O_TRUNC;
1498
1499 if (force_o_largefile())
1500 flags |= O_LARGEFILE;
1501 return do_sys_open(AT_FDCWD, pathname, flags, mode);
1502}
1503#endif
1504
1505/*
1506 * "id" is the POSIX thread ID. We use the
1507 * files pointer for this..
1508 */
1509static int filp_flush(struct file *filp, fl_owner_t id)
1510{
1511 int retval = 0;
1512
1513 if (CHECK_DATA_CORRUPTION(file_count(filp) == 0, filp,
1514 "VFS: Close: file count is 0 (f_op=%ps)",
1515 filp->f_op)) {
1516 return 0;
1517 }
1518
1519 if (filp->f_op->flush)
1520 retval = filp->f_op->flush(filp, id);
1521
1522 if (likely(!(filp->f_mode & FMODE_PATH))) {
1523 dnotify_flush(filp, id);
1524 locks_remove_posix(filp, id);
1525 }
1526 return retval;
1527}
1528
1529int filp_close(struct file *filp, fl_owner_t id)
1530{
1531 int retval;
1532
1533 retval = filp_flush(filp, id);
1534 fput_close(filp);
1535
1536 return retval;
1537}
1538EXPORT_SYMBOL(filp_close);
1539
1540/*
1541 * Careful here! We test whether the file pointer is NULL before
1542 * releasing the fd. This ensures that one clone task can't release
1543 * an fd while another clone is opening it.
1544 */
1545SYSCALL_DEFINE1(close, unsigned int, fd)
1546{
1547 int retval;
1548 struct file *file;
1549
1550 file = file_close_fd(fd);
1551 if (!file)
1552 return -EBADF;
1553
1554 retval = filp_flush(file, current->files);
1555
1556 /*
1557 * We're returning to user space. Don't bother
1558 * with any delayed fput() cases.
1559 */
1560 fput_close_sync(file);
1561
1562 if (likely(retval == 0))
1563 return 0;
1564
1565 /* can't restart close syscall because file table entry was cleared */
1566 if (retval == -ERESTARTSYS ||
1567 retval == -ERESTARTNOINTR ||
1568 retval == -ERESTARTNOHAND ||
1569 retval == -ERESTART_RESTARTBLOCK)
1570 retval = -EINTR;
1571
1572 return retval;
1573}
1574
1575/*
1576 * This routine simulates a hangup on the tty, to arrange that users
1577 * are given clean terminals at login time.
1578 */
1579SYSCALL_DEFINE0(vhangup)
1580{
1581 if (capable(CAP_SYS_TTY_CONFIG)) {
1582 tty_vhangup_self();
1583 return 0;
1584 }
1585 return -EPERM;
1586}
1587
1588/*
1589 * Called when an inode is about to be open.
1590 * We use this to disallow opening large files on 32bit systems if
1591 * the caller didn't specify O_LARGEFILE. On 64bit systems we force
1592 * on this flag in sys_open.
1593 */
1594int generic_file_open(struct inode * inode, struct file * filp)
1595{
1596 if (!(filp->f_flags & O_LARGEFILE) && i_size_read(inode) > MAX_NON_LFS)
1597 return -EOVERFLOW;
1598 return 0;
1599}
1600
1601EXPORT_SYMBOL(generic_file_open);
1602
1603/*
1604 * This is used by subsystems that don't want seekable
1605 * file descriptors. The function is not supposed to ever fail, the only
1606 * reason it returns an 'int' and not 'void' is so that it can be plugged
1607 * directly into file_operations structure.
1608 */
1609int nonseekable_open(struct inode *inode, struct file *filp)
1610{
1611 filp->f_mode &= ~(FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE);
1612 return 0;
1613}
1614
1615EXPORT_SYMBOL(nonseekable_open);
1616
1617/*
1618 * stream_open is used by subsystems that want stream-like file descriptors.
1619 * Such file descriptors are not seekable and don't have notion of position
1620 * (file.f_pos is always 0 and ppos passed to .read()/.write() is always NULL).
1621 * Contrary to file descriptors of other regular files, .read() and .write()
1622 * can run simultaneously.
1623 *
1624 * stream_open never fails and is marked to return int so that it could be
1625 * directly used as file_operations.open .
1626 */
1627int stream_open(struct inode *inode, struct file *filp)
1628{
1629 filp->f_mode &= ~(FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE | FMODE_ATOMIC_POS);
1630 filp->f_mode |= FMODE_STREAM;
1631 return 0;
1632}
1633
1634EXPORT_SYMBOL(stream_open);