1
2
3
4
5
6
7
8
9
10#include <linux/fs.h>
11#include <linux/slab.h>
12#include <linux/file.h>
13#include <linux/xattr.h>
14#include <linux/mount.h>
15#include <linux/namei.h>
16#include <linux/security.h>
17#include <linux/syscalls.h>
18#include <linux/module.h>
19#include <linux/fsnotify.h>
20#include <linux/audit.h>
21#include <asm/uaccess.h>
22
23
24
25
26
27
28static int
29xattr_permission(struct inode *inode, const char *name, int mask)
30{
31
32
33
34
35 if (mask & MAY_WRITE) {
36 if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
37 return -EPERM;
38 }
39
40
41
42
43
44 if (!strncmp(name, XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN) ||
45 !strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
46 return 0;
47
48
49
50
51 if (!strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN))
52 return (capable(CAP_SYS_ADMIN) ? 0 : -EPERM);
53
54
55
56
57
58 if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)) {
59 if (!S_ISREG(inode->i_mode) && !S_ISDIR(inode->i_mode))
60 return -EPERM;
61 if (S_ISDIR(inode->i_mode) && (inode->i_mode & S_ISVTX) &&
62 (mask & MAY_WRITE) && !is_owner_or_cap(inode))
63 return -EPERM;
64 }
65
66 return inode_permission(inode, mask);
67}
68
69int
70vfs_setxattr(struct dentry *dentry, const char *name, const void *value,
71 size_t size, int flags)
72{
73 struct inode *inode = dentry->d_inode;
74 int error;
75
76 error = xattr_permission(inode, name, MAY_WRITE);
77 if (error)
78 return error;
79
80 mutex_lock(&inode->i_mutex);
81 error = security_inode_setxattr(dentry, name, value, size, flags);
82 if (error)
83 goto out;
84 error = -EOPNOTSUPP;
85 if (inode->i_op->setxattr) {
86 error = inode->i_op->setxattr(dentry, name, value, size, flags);
87 if (!error) {
88 fsnotify_xattr(dentry);
89 security_inode_post_setxattr(dentry, name, value,
90 size, flags);
91 }
92 } else if (!strncmp(name, XATTR_SECURITY_PREFIX,
93 XATTR_SECURITY_PREFIX_LEN)) {
94 const char *suffix = name + XATTR_SECURITY_PREFIX_LEN;
95 error = security_inode_setsecurity(inode, suffix, value,
96 size, flags);
97 if (!error)
98 fsnotify_xattr(dentry);
99 }
100out:
101 mutex_unlock(&inode->i_mutex);
102 return error;
103}
104EXPORT_SYMBOL_GPL(vfs_setxattr);
105
106ssize_t
107xattr_getsecurity(struct inode *inode, const char *name, void *value,
108 size_t size)
109{
110 void *buffer = NULL;
111 ssize_t len;
112
113 if (!value || !size) {
114 len = security_inode_getsecurity(inode, name, &buffer, false);
115 goto out_noalloc;
116 }
117
118 len = security_inode_getsecurity(inode, name, &buffer, true);
119 if (len < 0)
120 return len;
121 if (size < len) {
122 len = -ERANGE;
123 goto out;
124 }
125 memcpy(value, buffer, len);
126out:
127 security_release_secctx(buffer, len);
128out_noalloc:
129 return len;
130}
131EXPORT_SYMBOL_GPL(xattr_getsecurity);
132
133ssize_t
134vfs_getxattr(struct dentry *dentry, const char *name, void *value, size_t size)
135{
136 struct inode *inode = dentry->d_inode;
137 int error;
138
139 error = xattr_permission(inode, name, MAY_READ);
140 if (error)
141 return error;
142
143 error = security_inode_getxattr(dentry, name);
144 if (error)
145 return error;
146
147 if (!strncmp(name, XATTR_SECURITY_PREFIX,
148 XATTR_SECURITY_PREFIX_LEN)) {
149 const char *suffix = name + XATTR_SECURITY_PREFIX_LEN;
150 int ret = xattr_getsecurity(inode, suffix, value, size);
151
152
153
154
155 if (ret == -EOPNOTSUPP)
156 goto nolsm;
157 return ret;
158 }
159nolsm:
160 if (inode->i_op->getxattr)
161 error = inode->i_op->getxattr(dentry, name, value, size);
162 else
163 error = -EOPNOTSUPP;
164
165 return error;
166}
167EXPORT_SYMBOL_GPL(vfs_getxattr);
168
169ssize_t
170vfs_listxattr(struct dentry *d, char *list, size_t size)
171{
172 ssize_t error;
173
174 error = security_inode_listxattr(d);
175 if (error)
176 return error;
177 error = -EOPNOTSUPP;
178 if (d->d_inode->i_op->listxattr) {
179 error = d->d_inode->i_op->listxattr(d, list, size);
180 } else {
181 error = security_inode_listsecurity(d->d_inode, list, size);
182 if (size && error > size)
183 error = -ERANGE;
184 }
185 return error;
186}
187EXPORT_SYMBOL_GPL(vfs_listxattr);
188
189int
190vfs_removexattr(struct dentry *dentry, const char *name)
191{
192 struct inode *inode = dentry->d_inode;
193 int error;
194
195 if (!inode->i_op->removexattr)
196 return -EOPNOTSUPP;
197
198 error = xattr_permission(inode, name, MAY_WRITE);
199 if (error)
200 return error;
201
202 error = security_inode_removexattr(dentry, name);
203 if (error)
204 return error;
205
206 mutex_lock(&inode->i_mutex);
207 error = inode->i_op->removexattr(dentry, name);
208 mutex_unlock(&inode->i_mutex);
209
210 if (!error)
211 fsnotify_xattr(dentry);
212 return error;
213}
214EXPORT_SYMBOL_GPL(vfs_removexattr);
215
216
217
218
219
220static long
221setxattr(struct dentry *d, const char __user *name, const void __user *value,
222 size_t size, int flags)
223{
224 int error;
225 void *kvalue = NULL;
226 char kname[XATTR_NAME_MAX + 1];
227
228 if (flags & ~(XATTR_CREATE|XATTR_REPLACE))
229 return -EINVAL;
230
231 error = strncpy_from_user(kname, name, sizeof(kname));
232 if (error == 0 || error == sizeof(kname))
233 error = -ERANGE;
234 if (error < 0)
235 return error;
236
237 if (size) {
238 if (size > XATTR_SIZE_MAX)
239 return -E2BIG;
240 kvalue = memdup_user(value, size);
241 if (IS_ERR(kvalue))
242 return PTR_ERR(kvalue);
243 }
244
245 error = vfs_setxattr(d, kname, kvalue, size, flags);
246 kfree(kvalue);
247 return error;
248}
249
250SYSCALL_DEFINE5(setxattr, const char __user *, pathname,
251 const char __user *, name, const void __user *, value,
252 size_t, size, int, flags)
253{
254 struct path path;
255 int error;
256
257 error = user_path(pathname, &path);
258 if (error)
259 return error;
260 error = mnt_want_write(path.mnt);
261 if (!error) {
262 error = setxattr(path.dentry, name, value, size, flags);
263 mnt_drop_write(path.mnt);
264 }
265 path_put(&path);
266 return error;
267}
268
269SYSCALL_DEFINE5(lsetxattr, const char __user *, pathname,
270 const char __user *, name, const void __user *, value,
271 size_t, size, int, flags)
272{
273 struct path path;
274 int error;
275
276 error = user_lpath(pathname, &path);
277 if (error)
278 return error;
279 error = mnt_want_write(path.mnt);
280 if (!error) {
281 error = setxattr(path.dentry, name, value, size, flags);
282 mnt_drop_write(path.mnt);
283 }
284 path_put(&path);
285 return error;
286}
287
288SYSCALL_DEFINE5(fsetxattr, int, fd, const char __user *, name,
289 const void __user *,value, size_t, size, int, flags)
290{
291 struct file *f;
292 struct dentry *dentry;
293 int error = -EBADF;
294
295 f = fget(fd);
296 if (!f)
297 return error;
298 dentry = f->f_path.dentry;
299 audit_inode(NULL, dentry);
300 error = mnt_want_write(f->f_path.mnt);
301 if (!error) {
302 error = setxattr(dentry, name, value, size, flags);
303 mnt_drop_write(f->f_path.mnt);
304 }
305 fput(f);
306 return error;
307}
308
309
310
311
312static ssize_t
313getxattr(struct dentry *d, const char __user *name, void __user *value,
314 size_t size)
315{
316 ssize_t error;
317 void *kvalue = NULL;
318 char kname[XATTR_NAME_MAX + 1];
319
320 error = strncpy_from_user(kname, name, sizeof(kname));
321 if (error == 0 || error == sizeof(kname))
322 error = -ERANGE;
323 if (error < 0)
324 return error;
325
326 if (size) {
327 if (size > XATTR_SIZE_MAX)
328 size = XATTR_SIZE_MAX;
329 kvalue = kzalloc(size, GFP_KERNEL);
330 if (!kvalue)
331 return -ENOMEM;
332 }
333
334 error = vfs_getxattr(d, kname, kvalue, size);
335 if (error > 0) {
336 if (size && copy_to_user(value, kvalue, error))
337 error = -EFAULT;
338 } else if (error == -ERANGE && size >= XATTR_SIZE_MAX) {
339
340
341 error = -E2BIG;
342 }
343 kfree(kvalue);
344 return error;
345}
346
347SYSCALL_DEFINE4(getxattr, const char __user *, pathname,
348 const char __user *, name, void __user *, value, size_t, size)
349{
350 struct path path;
351 ssize_t error;
352
353 error = user_path(pathname, &path);
354 if (error)
355 return error;
356 error = getxattr(path.dentry, name, value, size);
357 path_put(&path);
358 return error;
359}
360
361SYSCALL_DEFINE4(lgetxattr, const char __user *, pathname,
362 const char __user *, name, void __user *, value, size_t, size)
363{
364 struct path path;
365 ssize_t error;
366
367 error = user_lpath(pathname, &path);
368 if (error)
369 return error;
370 error = getxattr(path.dentry, name, value, size);
371 path_put(&path);
372 return error;
373}
374
375SYSCALL_DEFINE4(fgetxattr, int, fd, const char __user *, name,
376 void __user *, value, size_t, size)
377{
378 struct file *f;
379 ssize_t error = -EBADF;
380
381 f = fget(fd);
382 if (!f)
383 return error;
384 audit_inode(NULL, f->f_path.dentry);
385 error = getxattr(f->f_path.dentry, name, value, size);
386 fput(f);
387 return error;
388}
389
390
391
392
393static ssize_t
394listxattr(struct dentry *d, char __user *list, size_t size)
395{
396 ssize_t error;
397 char *klist = NULL;
398
399 if (size) {
400 if (size > XATTR_LIST_MAX)
401 size = XATTR_LIST_MAX;
402 klist = kmalloc(size, GFP_KERNEL);
403 if (!klist)
404 return -ENOMEM;
405 }
406
407 error = vfs_listxattr(d, klist, size);
408 if (error > 0) {
409 if (size && copy_to_user(list, klist, error))
410 error = -EFAULT;
411 } else if (error == -ERANGE && size >= XATTR_LIST_MAX) {
412
413
414 error = -E2BIG;
415 }
416 kfree(klist);
417 return error;
418}
419
420SYSCALL_DEFINE3(listxattr, const char __user *, pathname, char __user *, list,
421 size_t, size)
422{
423 struct path path;
424 ssize_t error;
425
426 error = user_path(pathname, &path);
427 if (error)
428 return error;
429 error = listxattr(path.dentry, list, size);
430 path_put(&path);
431 return error;
432}
433
434SYSCALL_DEFINE3(llistxattr, const char __user *, pathname, char __user *, list,
435 size_t, size)
436{
437 struct path path;
438 ssize_t error;
439
440 error = user_lpath(pathname, &path);
441 if (error)
442 return error;
443 error = listxattr(path.dentry, list, size);
444 path_put(&path);
445 return error;
446}
447
448SYSCALL_DEFINE3(flistxattr, int, fd, char __user *, list, size_t, size)
449{
450 struct file *f;
451 ssize_t error = -EBADF;
452
453 f = fget(fd);
454 if (!f)
455 return error;
456 audit_inode(NULL, f->f_path.dentry);
457 error = listxattr(f->f_path.dentry, list, size);
458 fput(f);
459 return error;
460}
461
462
463
464
465static long
466removexattr(struct dentry *d, const char __user *name)
467{
468 int error;
469 char kname[XATTR_NAME_MAX + 1];
470
471 error = strncpy_from_user(kname, name, sizeof(kname));
472 if (error == 0 || error == sizeof(kname))
473 error = -ERANGE;
474 if (error < 0)
475 return error;
476
477 return vfs_removexattr(d, kname);
478}
479
480SYSCALL_DEFINE2(removexattr, const char __user *, pathname,
481 const char __user *, name)
482{
483 struct path path;
484 int error;
485
486 error = user_path(pathname, &path);
487 if (error)
488 return error;
489 error = mnt_want_write(path.mnt);
490 if (!error) {
491 error = removexattr(path.dentry, name);
492 mnt_drop_write(path.mnt);
493 }
494 path_put(&path);
495 return error;
496}
497
498SYSCALL_DEFINE2(lremovexattr, const char __user *, pathname,
499 const char __user *, name)
500{
501 struct path path;
502 int error;
503
504 error = user_lpath(pathname, &path);
505 if (error)
506 return error;
507 error = mnt_want_write(path.mnt);
508 if (!error) {
509 error = removexattr(path.dentry, name);
510 mnt_drop_write(path.mnt);
511 }
512 path_put(&path);
513 return error;
514}
515
516SYSCALL_DEFINE2(fremovexattr, int, fd, const char __user *, name)
517{
518 struct file *f;
519 struct dentry *dentry;
520 int error = -EBADF;
521
522 f = fget(fd);
523 if (!f)
524 return error;
525 dentry = f->f_path.dentry;
526 audit_inode(NULL, dentry);
527 error = mnt_want_write(f->f_path.mnt);
528 if (!error) {
529 error = removexattr(dentry, name);
530 mnt_drop_write(f->f_path.mnt);
531 }
532 fput(f);
533 return error;
534}
535
536
537static const char *
538strcmp_prefix(const char *a, const char *a_prefix)
539{
540 while (*a_prefix && *a == *a_prefix) {
541 a++;
542 a_prefix++;
543 }
544 return *a_prefix ? NULL : a;
545}
546
547
548
549
550
551
552
553
554
555
556#define for_each_xattr_handler(handlers, handler) \
557 for ((handler) = *(handlers)++; \
558 (handler) != NULL; \
559 (handler) = *(handlers)++)
560
561
562
563
564static struct xattr_handler *
565xattr_resolve_name(struct xattr_handler **handlers, const char **name)
566{
567 struct xattr_handler *handler;
568
569 if (!*name)
570 return NULL;
571
572 for_each_xattr_handler(handlers, handler) {
573 const char *n = strcmp_prefix(*name, handler->prefix);
574 if (n) {
575 *name = n;
576 break;
577 }
578 }
579 return handler;
580}
581
582
583
584
585ssize_t
586generic_getxattr(struct dentry *dentry, const char *name, void *buffer, size_t size)
587{
588 struct xattr_handler *handler;
589 struct inode *inode = dentry->d_inode;
590
591 handler = xattr_resolve_name(inode->i_sb->s_xattr, &name);
592 if (!handler)
593 return -EOPNOTSUPP;
594 return handler->get(inode, name, buffer, size);
595}
596
597
598
599
600
601ssize_t
602generic_listxattr(struct dentry *dentry, char *buffer, size_t buffer_size)
603{
604 struct inode *inode = dentry->d_inode;
605 struct xattr_handler *handler, **handlers = inode->i_sb->s_xattr;
606 unsigned int size = 0;
607
608 if (!buffer) {
609 for_each_xattr_handler(handlers, handler)
610 size += handler->list(inode, NULL, 0, NULL, 0);
611 } else {
612 char *buf = buffer;
613
614 for_each_xattr_handler(handlers, handler) {
615 size = handler->list(inode, buf, buffer_size, NULL, 0);
616 if (size > buffer_size)
617 return -ERANGE;
618 buf += size;
619 buffer_size -= size;
620 }
621 size = buf - buffer;
622 }
623 return size;
624}
625
626
627
628
629int
630generic_setxattr(struct dentry *dentry, const char *name, const void *value, size_t size, int flags)
631{
632 struct xattr_handler *handler;
633 struct inode *inode = dentry->d_inode;
634
635 if (size == 0)
636 value = "";
637 handler = xattr_resolve_name(inode->i_sb->s_xattr, &name);
638 if (!handler)
639 return -EOPNOTSUPP;
640 return handler->set(inode, name, value, size, flags);
641}
642
643
644
645
646
647int
648generic_removexattr(struct dentry *dentry, const char *name)
649{
650 struct xattr_handler *handler;
651 struct inode *inode = dentry->d_inode;
652
653 handler = xattr_resolve_name(inode->i_sb->s_xattr, &name);
654 if (!handler)
655 return -EOPNOTSUPP;
656 return handler->set(inode, name, NULL, 0, XATTR_REPLACE);
657}
658
659EXPORT_SYMBOL(generic_getxattr);
660EXPORT_SYMBOL(generic_listxattr);
661EXPORT_SYMBOL(generic_setxattr);
662EXPORT_SYMBOL(generic_removexattr);
663
