1416 lines · c
1// SPDX-License-Identifier: GPL-2.0-only2/*3 File: fs/xattr.c4 5 Extended attribute handling.6 7 Copyright (C) 2001 by Andreas Gruenbacher <a.gruenbacher@computer.org>8 Copyright (C) 2001 SGI - Silicon Graphics, Inc <linux-xfs@oss.sgi.com>9 Copyright (c) 2004 Red Hat, Inc., James Morris <jmorris@redhat.com>10 */11#include <linux/fs.h>12#include <linux/filelock.h>13#include <linux/slab.h>14#include <linux/file.h>15#include <linux/xattr.h>16#include <linux/mount.h>17#include <linux/namei.h>18#include <linux/security.h>19#include <linux/syscalls.h>20#include <linux/export.h>21#include <linux/fsnotify.h>22#include <linux/audit.h>23#include <linux/vmalloc.h>24#include <linux/posix_acl_xattr.h>25 26#include <linux/uaccess.h>27 28#include "internal.h"29 30static const char *31strcmp_prefix(const char *a, const char *a_prefix)32{33 while (*a_prefix && *a == *a_prefix) {34 a++;35 a_prefix++;36 }37 return *a_prefix ? NULL : a;38}39 40/*41 * In order to implement different sets of xattr operations for each xattr42 * prefix, a filesystem should create a null-terminated array of struct43 * xattr_handler (one for each prefix) and hang a pointer to it off of the44 * s_xattr field of the superblock.45 */46#define for_each_xattr_handler(handlers, handler) \47 if (handlers) \48 for ((handler) = *(handlers)++; \49 (handler) != NULL; \50 (handler) = *(handlers)++)51 52/*53 * Find the xattr_handler with the matching prefix.54 */55static const struct xattr_handler *56xattr_resolve_name(struct inode *inode, const char **name)57{58 const struct xattr_handler * const *handlers = inode->i_sb->s_xattr;59 const struct xattr_handler *handler;60 61 if (!(inode->i_opflags & IOP_XATTR)) {62 if (unlikely(is_bad_inode(inode)))63 return ERR_PTR(-EIO);64 return ERR_PTR(-EOPNOTSUPP);65 }66 for_each_xattr_handler(handlers, handler) {67 const char *n;68 69 n = strcmp_prefix(*name, xattr_prefix(handler));70 if (n) {71 if (!handler->prefix ^ !*n) {72 if (*n)73 continue;74 return ERR_PTR(-EINVAL);75 }76 *name = n;77 return handler;78 }79 }80 return ERR_PTR(-EOPNOTSUPP);81}82 83/**84 * may_write_xattr - check whether inode allows writing xattr85 * @idmap: idmap of the mount the inode was found from86 * @inode: the inode on which to set an xattr87 *88 * Check whether the inode allows writing xattrs. Specifically, we can never89 * set or remove an extended attribute on a read-only filesystem or on an90 * immutable / append-only inode.91 *92 * We also need to ensure that the inode has a mapping in the mount to93 * not risk writing back invalid i_{g,u}id values.94 *95 * Return: On success zero is returned. On error a negative errno is returned.96 */97int may_write_xattr(struct mnt_idmap *idmap, struct inode *inode)98{99 if (IS_IMMUTABLE(inode))100 return -EPERM;101 if (IS_APPEND(inode))102 return -EPERM;103 if (HAS_UNMAPPED_ID(idmap, inode))104 return -EPERM;105 return 0;106}107 108/*109 * Check permissions for extended attribute access. This is a bit complicated110 * because different namespaces have very different rules.111 */112static HWJS_SUSPENDS int113xattr_permission(struct mnt_idmap *idmap, struct inode *inode,114 const char *name, int mask)115{116 if (mask & MAY_WRITE) {117 int ret;118 119 ret = may_write_xattr(idmap, inode);120 if (ret)121 return ret;122 }123 124 /*125 * No restriction for security.* and system.* from the VFS. Decision126 * on these is left to the underlying filesystem / security module.127 */128 if (!strncmp(name, XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN) ||129 !strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))130 return 0;131 132 /*133 * The trusted.* namespace can only be accessed by privileged users.134 */135 if (!strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN)) {136 if (!capable(CAP_SYS_ADMIN))137 return (mask & MAY_WRITE) ? -EPERM : -ENODATA;138 return 0;139 }140 141 /*142 * In the user.* namespace, only regular files and directories can have143 * extended attributes. For sticky directories, only the owner and144 * privileged users can write attributes.145 */146 if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)) {147 if (!S_ISREG(inode->i_mode) && !S_ISDIR(inode->i_mode))148 return (mask & MAY_WRITE) ? -EPERM : -ENODATA;149 if (S_ISDIR(inode->i_mode) && (inode->i_mode & S_ISVTX) &&150 (mask & MAY_WRITE) &&151 !inode_owner_or_capable(idmap, inode))152 return -EPERM;153 }154 155 return inode_permission(idmap, inode, mask);156}157 158/*159 * Look for any handler that deals with the specified namespace.160 */161int162xattr_supports_user_prefix(struct inode *inode)163{164 const struct xattr_handler * const *handlers = inode->i_sb->s_xattr;165 const struct xattr_handler *handler;166 167 if (!(inode->i_opflags & IOP_XATTR)) {168 if (unlikely(is_bad_inode(inode)))169 return -EIO;170 return -EOPNOTSUPP;171 }172 173 for_each_xattr_handler(handlers, handler) {174 if (!strncmp(xattr_prefix(handler), XATTR_USER_PREFIX,175 XATTR_USER_PREFIX_LEN))176 return 0;177 }178 179 return -EOPNOTSUPP;180}181EXPORT_SYMBOL(xattr_supports_user_prefix);182 183int184__vfs_setxattr(struct mnt_idmap *idmap, struct dentry *dentry,185 struct inode *inode, const char *name, const void *value,186 size_t size, int flags)187{188 const struct xattr_handler *handler;189 190 if (is_posix_acl_xattr(name))191 return -EOPNOTSUPP;192 193 handler = xattr_resolve_name(inode, &name);194 if (IS_ERR(handler))195 return PTR_ERR(handler);196 if (!handler->set)197 return -EOPNOTSUPP;198 if (size == 0)199 value = ""; /* empty EA, do not remove */200 return handler->set(handler, idmap, dentry, inode, name, value,201 size, flags);202}203EXPORT_SYMBOL(__vfs_setxattr);204 205/**206 * __vfs_setxattr_noperm - perform setxattr operation without performing207 * permission checks.208 *209 * @idmap: idmap of the mount the inode was found from210 * @dentry: object to perform setxattr on211 * @name: xattr name to set212 * @value: value to set @name to213 * @size: size of @value214 * @flags: flags to pass into filesystem operations215 *216 * returns the result of the internal setxattr or setsecurity operations.217 *218 * This function requires the caller to lock the inode's i_mutex before it219 * is executed. It also assumes that the caller will make the appropriate220 * permission checks.221 */222int __vfs_setxattr_noperm(struct mnt_idmap *idmap,223 struct dentry *dentry, const char *name,224 const void *value, size_t size, int flags)225{226 struct inode *inode = dentry->d_inode;227 int error = -EAGAIN;228 int issec = !strncmp(name, XATTR_SECURITY_PREFIX,229 XATTR_SECURITY_PREFIX_LEN);230 231 if (issec)232 inode->i_flags &= ~S_NOSEC;233 if (inode->i_opflags & IOP_XATTR) {234 error = __vfs_setxattr(idmap, dentry, inode, name, value,235 size, flags);236 if (!error) {237 fsnotify_xattr(dentry);238 security_inode_post_setxattr(dentry, name, value,239 size, flags);240 }241 } else {242 if (unlikely(is_bad_inode(inode)))243 return -EIO;244 }245 if (error == -EAGAIN) {246 error = -EOPNOTSUPP;247 248 if (issec) {249 const char *suffix = name + XATTR_SECURITY_PREFIX_LEN;250 251 error = security_inode_setsecurity(inode, suffix, value,252 size, flags);253 if (!error)254 fsnotify_xattr(dentry);255 }256 }257 258 return error;259}260 261/**262 * __vfs_setxattr_locked - set an extended attribute while holding the inode263 * lock264 *265 * @idmap: idmap of the mount of the target inode266 * @dentry: object to perform setxattr on267 * @name: xattr name to set268 * @value: value to set @name to269 * @size: size of @value270 * @flags: flags to pass into filesystem operations271 * @delegated_inode: on return, will contain an inode pointer that272 * a delegation was broken on, NULL if none.273 */274int275__vfs_setxattr_locked(struct mnt_idmap *idmap, struct dentry *dentry,276 const char *name, const void *value, size_t size,277 int flags, struct inode **delegated_inode)278{279 struct inode *inode = dentry->d_inode;280 int error;281 282 error = xattr_permission(idmap, inode, name, MAY_WRITE);283 if (error)284 return error;285 286 error = security_inode_setxattr(idmap, dentry, name, value, size,287 flags);288 if (error)289 goto out;290 291 error = try_break_deleg(inode, delegated_inode);292 if (error)293 goto out;294 295 error = __vfs_setxattr_noperm(idmap, dentry, name, value,296 size, flags);297 298out:299 return error;300}301EXPORT_SYMBOL_GPL(__vfs_setxattr_locked);302 303int304vfs_setxattr(struct mnt_idmap *idmap, struct dentry *dentry,305 const char *name, const void *value, size_t size, int flags)306{307 struct inode *inode = dentry->d_inode;308 struct inode *delegated_inode = NULL;309 const void *orig_value = value;310 int error;311 312 if (size && strcmp(name, XATTR_NAME_CAPS) == 0) {313 error = cap_convert_nscap(idmap, dentry, &value, size);314 if (error < 0)315 return error;316 size = error;317 }318 319retry_deleg:320 inode_lock(inode);321 error = __vfs_setxattr_locked(idmap, dentry, name, value, size,322 flags, &delegated_inode);323 inode_unlock(inode);324 325 if (delegated_inode) {326 error = break_deleg_wait(&delegated_inode);327 if (!error)328 goto retry_deleg;329 }330 if (value != orig_value)331 kfree(value);332 333 return error;334}335EXPORT_SYMBOL_GPL(vfs_setxattr);336 337static ssize_t338xattr_getsecurity(struct mnt_idmap *idmap, struct inode *inode,339 const char *name, void *value, size_t size)340{341 void *buffer = NULL;342 ssize_t len;343 344 if (!value || !size) {345 len = security_inode_getsecurity(idmap, inode, name,346 &buffer, false);347 goto out_noalloc;348 }349 350 len = security_inode_getsecurity(idmap, inode, name, &buffer,351 true);352 if (len < 0)353 return len;354 if (size < len) {355 len = -ERANGE;356 goto out;357 }358 memcpy(value, buffer, len);359out:360 kfree(buffer);361out_noalloc:362 return len;363}364 365/*366 * vfs_getxattr_alloc - allocate memory, if necessary, before calling getxattr367 *368 * Allocate memory, if not already allocated, or re-allocate correct size,369 * before retrieving the extended attribute. The xattr value buffer should370 * always be freed by the caller, even on error.371 *372 * Returns the result of alloc, if failed, or the getxattr operation.373 */374int375vfs_getxattr_alloc(struct mnt_idmap *idmap, struct dentry *dentry,376 const char *name, char **xattr_value, size_t xattr_size,377 gfp_t flags)378{379 const struct xattr_handler *handler;380 struct inode *inode = dentry->d_inode;381 char *value = *xattr_value;382 int error;383 384 error = xattr_permission(idmap, inode, name, MAY_READ);385 if (error)386 return error;387 388 handler = xattr_resolve_name(inode, &name);389 if (IS_ERR(handler))390 return PTR_ERR(handler);391 if (!handler->get)392 return -EOPNOTSUPP;393 error = handler->get(handler, dentry, inode, name, NULL, 0);394 if (error < 0)395 return error;396 397 if (!value || (error > xattr_size)) {398 value = krealloc(*xattr_value, error + 1, flags);399 if (!value)400 return -ENOMEM;401 memset(value, 0, error + 1);402 }403 404 error = handler->get(handler, dentry, inode, name, value, error);405 *xattr_value = value;406 return error;407}408 409ssize_t410__vfs_getxattr(struct dentry *dentry, struct inode *inode, const char *name,411 void *value, size_t size)412{413 const struct xattr_handler *handler;414 415 if (is_posix_acl_xattr(name))416 return -EOPNOTSUPP;417 418 handler = xattr_resolve_name(inode, &name);419 if (IS_ERR(handler))420 return PTR_ERR(handler);421 if (!handler->get)422 return -EOPNOTSUPP;423 return handler->get(handler, dentry, inode, name, value, size);424}425EXPORT_SYMBOL(__vfs_getxattr);426 427ssize_t428vfs_getxattr(struct mnt_idmap *idmap, struct dentry *dentry,429 const char *name, void *value, size_t size)430{431 struct inode *inode = dentry->d_inode;432 int error;433 434 error = xattr_permission(idmap, inode, name, MAY_READ);435 if (error)436 return error;437 438 error = security_inode_getxattr(dentry, name);439 if (error)440 return error;441 442 if (!strncmp(name, XATTR_SECURITY_PREFIX,443 XATTR_SECURITY_PREFIX_LEN)) {444 const char *suffix = name + XATTR_SECURITY_PREFIX_LEN;445 int ret = xattr_getsecurity(idmap, inode, suffix, value,446 size);447 /*448 * Only overwrite the return value if a security module449 * is actually active.450 */451 if (ret == -EOPNOTSUPP)452 goto nolsm;453 return ret;454 }455nolsm:456 return __vfs_getxattr(dentry, inode, name, value, size);457}458EXPORT_SYMBOL_GPL(vfs_getxattr);459 460/**461 * vfs_listxattr - retrieve \0 separated list of xattr names462 * @dentry: the dentry from whose inode the xattr names are retrieved463 * @list: buffer to store xattr names into464 * @size: size of the buffer465 *466 * This function returns the names of all xattrs associated with the467 * inode of @dentry.468 *469 * Note, for legacy reasons the vfs_listxattr() function lists POSIX470 * ACLs as well. Since POSIX ACLs are decoupled from IOP_XATTR the471 * vfs_listxattr() function doesn't check for this flag since a472 * filesystem could implement POSIX ACLs without implementing any other473 * xattrs.474 *475 * However, since all codepaths that remove IOP_XATTR also assign of476 * inode operations that either don't implement or implement a stub477 * ->listxattr() operation.478 *479 * Return: On success, the size of the buffer that was used. On error a480 * negative error code.481 */482ssize_t483vfs_listxattr(struct dentry *dentry, char *list, size_t size)484{485 struct inode *inode = d_inode(dentry);486 ssize_t error;487 488 error = security_inode_listxattr(dentry);489 if (error)490 return error;491 492 if (inode->i_op->listxattr) {493 error = inode->i_op->listxattr(dentry, list, size);494 } else {495 error = security_inode_listsecurity(inode, list, size);496 if (size && error > size)497 error = -ERANGE;498 }499 return error;500}501EXPORT_SYMBOL_GPL(vfs_listxattr);502 503int504__vfs_removexattr(struct mnt_idmap *idmap, struct dentry *dentry,505 const char *name)506{507 struct inode *inode = d_inode(dentry);508 const struct xattr_handler *handler;509 510 if (is_posix_acl_xattr(name))511 return -EOPNOTSUPP;512 513 handler = xattr_resolve_name(inode, &name);514 if (IS_ERR(handler))515 return PTR_ERR(handler);516 if (!handler->set)517 return -EOPNOTSUPP;518 return handler->set(handler, idmap, dentry, inode, name, NULL, 0,519 XATTR_REPLACE);520}521EXPORT_SYMBOL(__vfs_removexattr);522 523/**524 * __vfs_removexattr_locked - set an extended attribute while holding the inode525 * lock526 *527 * @idmap: idmap of the mount of the target inode528 * @dentry: object to perform setxattr on529 * @name: name of xattr to remove530 * @delegated_inode: on return, will contain an inode pointer that531 * a delegation was broken on, NULL if none.532 */533int534__vfs_removexattr_locked(struct mnt_idmap *idmap,535 struct dentry *dentry, const char *name,536 struct inode **delegated_inode)537{538 struct inode *inode = dentry->d_inode;539 int error;540 541 error = xattr_permission(idmap, inode, name, MAY_WRITE);542 if (error)543 return error;544 545 error = security_inode_removexattr(idmap, dentry, name);546 if (error)547 goto out;548 549 error = try_break_deleg(inode, delegated_inode);550 if (error)551 goto out;552 553 error = __vfs_removexattr(idmap, dentry, name);554 if (error)555 return error;556 557 fsnotify_xattr(dentry);558 security_inode_post_removexattr(dentry, name);559 560out:561 return error;562}563EXPORT_SYMBOL_GPL(__vfs_removexattr_locked);564 565int566vfs_removexattr(struct mnt_idmap *idmap, struct dentry *dentry,567 const char *name)568{569 struct inode *inode = dentry->d_inode;570 struct inode *delegated_inode = NULL;571 int error;572 573retry_deleg:574 inode_lock(inode);575 error = __vfs_removexattr_locked(idmap, dentry,576 name, &delegated_inode);577 inode_unlock(inode);578 579 if (delegated_inode) {580 error = break_deleg_wait(&delegated_inode);581 if (!error)582 goto retry_deleg;583 }584 585 return error;586}587EXPORT_SYMBOL_GPL(vfs_removexattr);588 589/*590 * Extended attribute SET operations591 */592 593int setxattr_copy(const char __user *name, struct xattr_ctx *ctx)594{595 int error;596 597 if (ctx->flags & ~(XATTR_CREATE|XATTR_REPLACE))598 return -EINVAL;599 600 error = strncpy_from_user(ctx->kname->name, name,601 sizeof(ctx->kname->name));602 if (error == 0 || error == sizeof(ctx->kname->name))603 return -ERANGE;604 if (error < 0)605 return error;606 607 error = 0;608 if (ctx->size) {609 if (ctx->size > XATTR_SIZE_MAX)610 return -E2BIG;611 612 ctx->kvalue = vmemdup_user(ctx->cvalue, ctx->size);613 if (IS_ERR(ctx->kvalue)) {614 error = PTR_ERR(ctx->kvalue);615 ctx->kvalue = NULL;616 }617 }618 619 return error;620}621 622int do_setxattr(struct mnt_idmap *idmap, struct dentry *dentry,623 struct xattr_ctx *ctx)624{625 if (is_posix_acl_xattr(ctx->kname->name))626 return do_set_acl(idmap, dentry, ctx->kname->name,627 ctx->kvalue, ctx->size);628 629 return vfs_setxattr(idmap, dentry, ctx->kname->name,630 ctx->kvalue, ctx->size, ctx->flags);631}632 633static HWJS_SUSPENDS int path_setxattr(const char __user *pathname,634 const char __user *name, const void __user *value,635 size_t size, int flags, unsigned int lookup_flags)636{637 struct xattr_name kname;638 struct xattr_ctx ctx = {639 .cvalue = value,640 .kvalue = NULL,641 .size = size,642 .kname = &kname,643 .flags = flags,644 };645 struct path path;646 int error;647 648 error = setxattr_copy(name, &ctx);649 if (error)650 return error;651 652retry:653 error = user_path_at(AT_FDCWD, pathname, lookup_flags, &path);654 if (error)655 goto out;656 error = mnt_want_write(path.mnt);657 if (!error) {658 error = do_setxattr(mnt_idmap(path.mnt), path.dentry, &ctx);659 mnt_drop_write(path.mnt);660 }661 path_put(&path);662 if (retry_estale(error, lookup_flags)) {663 lookup_flags |= LOOKUP_REVAL;664 goto retry;665 }666 667out:668 kvfree(ctx.kvalue);669 return error;670}671 672SYSCALL_DEFINE5(setxattr, const char __user *, pathname,673 const char __user *, name, const void __user *, value,674 size_t, size, int, flags)675{676 return path_setxattr(pathname, name, value, size, flags, LOOKUP_FOLLOW);677}678 679SYSCALL_DEFINE5(lsetxattr, const char __user *, pathname,680 const char __user *, name, const void __user *, value,681 size_t, size, int, flags)682{683 return path_setxattr(pathname, name, value, size, flags, 0);684}685 686SYSCALL_DEFINE5(fsetxattr, int, fd, const char __user *, name,687 const void __user *,value, size_t, size, int, flags)688{689 struct xattr_name kname;690 struct xattr_ctx ctx = {691 .cvalue = value,692 .kvalue = NULL,693 .size = size,694 .kname = &kname,695 .flags = flags,696 };697 int error;698 699 CLASS(fd, f)(fd);700 if (!fd_file(f))701 return -EBADF;702 703 audit_file(fd_file(f));704 error = setxattr_copy(name, &ctx);705 if (error)706 return error;707 708 error = mnt_want_write_file(fd_file(f));709 if (!error) {710 error = do_setxattr(file_mnt_idmap(fd_file(f)),711 fd_file(f)->f_path.dentry, &ctx);712 mnt_drop_write_file(fd_file(f));713 }714 kvfree(ctx.kvalue);715 return error;716}717 718/*719 * Extended attribute GET operations720 */721ssize_t722do_getxattr(struct mnt_idmap *idmap, struct dentry *d,723 struct xattr_ctx *ctx)724{725 ssize_t error;726 char *kname = ctx->kname->name;727 728 if (ctx->size) {729 if (ctx->size > XATTR_SIZE_MAX)730 ctx->size = XATTR_SIZE_MAX;731 ctx->kvalue = kvzalloc(ctx->size, GFP_KERNEL);732 if (!ctx->kvalue)733 return -ENOMEM;734 }735 736 if (is_posix_acl_xattr(ctx->kname->name))737 error = do_get_acl(idmap, d, kname, ctx->kvalue, ctx->size);738 else739 error = vfs_getxattr(idmap, d, kname, ctx->kvalue, ctx->size);740 if (error > 0) {741 if (ctx->size && copy_to_user(ctx->value, ctx->kvalue, error))742 error = -EFAULT;743 } else if (error == -ERANGE && ctx->size >= XATTR_SIZE_MAX) {744 /* The file system tried to returned a value bigger745 than XATTR_SIZE_MAX bytes. Not possible. */746 error = -E2BIG;747 }748 749 return error;750}751 752static HWJS_SUSPENDS ssize_t753getxattr(struct mnt_idmap *idmap, struct dentry *d,754 const char __user *name, void __user *value, size_t size)755{756 ssize_t error;757 struct xattr_name kname;758 struct xattr_ctx ctx = {759 .value = value,760 .kvalue = NULL,761 .size = size,762 .kname = &kname,763 .flags = 0,764 };765 766 error = strncpy_from_user(kname.name, name, sizeof(kname.name));767 if (error == 0 || error == sizeof(kname.name))768 error = -ERANGE;769 if (error < 0)770 return error;771 772 error = do_getxattr(idmap, d, &ctx);773 774 kvfree(ctx.kvalue);775 return error;776}777 778static HWJS_SUSPENDS ssize_t path_getxattr(const char __user *pathname,779 const char __user *name, void __user *value,780 size_t size, unsigned int lookup_flags)781{782 struct path path;783 ssize_t error;784retry:785 error = user_path_at(AT_FDCWD, pathname, lookup_flags, &path);786 if (error)787 return error;788 error = getxattr(mnt_idmap(path.mnt), path.dentry, name, value, size);789 path_put(&path);790 if (retry_estale(error, lookup_flags)) {791 lookup_flags |= LOOKUP_REVAL;792 goto retry;793 }794 return error;795}796 797SYSCALL_DEFINE4(getxattr, const char __user *, pathname,798 const char __user *, name, void __user *, value, size_t, size)799{800 return path_getxattr(pathname, name, value, size, LOOKUP_FOLLOW);801}802 803SYSCALL_DEFINE4(lgetxattr, const char __user *, pathname,804 const char __user *, name, void __user *, value, size_t, size)805{806 return path_getxattr(pathname, name, value, size, 0);807}808 809SYSCALL_DEFINE4(fgetxattr, int, fd, const char __user *, name,810 void __user *, value, size_t, size)811{812 struct fd f = fdget(fd);813 ssize_t error = -EBADF;814 815 if (!fd_file(f))816 return error;817 audit_file(fd_file(f));818 error = getxattr(file_mnt_idmap(fd_file(f)), fd_file(f)->f_path.dentry,819 name, value, size);820 fdput(f);821 return error;822}823 824/*825 * Extended attribute LIST operations826 */827static HWJS_SUSPENDS ssize_t828listxattr(struct dentry *d, char __user *list, size_t size)829{830 ssize_t error;831 char *klist = NULL;832 833 if (size) {834 if (size > XATTR_LIST_MAX)835 size = XATTR_LIST_MAX;836 klist = kvmalloc(size, GFP_KERNEL);837 if (!klist)838 return -ENOMEM;839 }840 841 error = vfs_listxattr(d, klist, size);842 if (error > 0) {843 if (size && copy_to_user(list, klist, error))844 error = -EFAULT;845 } else if (error == -ERANGE && size >= XATTR_LIST_MAX) {846 /* The file system tried to returned a list bigger847 than XATTR_LIST_MAX bytes. Not possible. */848 error = -E2BIG;849 }850 851 kvfree(klist);852 853 return error;854}855 856static HWJS_SUSPENDS ssize_t path_listxattr(const char __user *pathname, char __user *list,857 size_t size, unsigned int lookup_flags)858{859 struct path path;860 ssize_t error;861retry:862 error = user_path_at(AT_FDCWD, pathname, lookup_flags, &path);863 if (error)864 return error;865 error = listxattr(path.dentry, list, size);866 path_put(&path);867 if (retry_estale(error, lookup_flags)) {868 lookup_flags |= LOOKUP_REVAL;869 goto retry;870 }871 return error;872}873 874SYSCALL_DEFINE3(listxattr, const char __user *, pathname, char __user *, list,875 size_t, size)876{877 return path_listxattr(pathname, list, size, LOOKUP_FOLLOW);878}879 880SYSCALL_DEFINE3(llistxattr, const char __user *, pathname, char __user *, list,881 size_t, size)882{883 return path_listxattr(pathname, list, size, 0);884}885 886SYSCALL_DEFINE3(flistxattr, int, fd, char __user *, list, size_t, size)887{888 struct fd f = fdget(fd);889 ssize_t error = -EBADF;890 891 if (!fd_file(f))892 return error;893 audit_file(fd_file(f));894 error = listxattr(fd_file(f)->f_path.dentry, list, size);895 fdput(f);896 return error;897}898 899/*900 * Extended attribute REMOVE operations901 */902static HWJS_SUSPENDS long903removexattr(struct mnt_idmap *idmap, struct dentry *d, const char *name)904{905 if (is_posix_acl_xattr(name))906 return vfs_remove_acl(idmap, d, name);907 return vfs_removexattr(idmap, d, name);908}909 910static HWJS_SUSPENDS int path_removexattr(const char __user *pathname,911 const char __user *name, unsigned int lookup_flags)912{913 struct path path;914 int error;915 char kname[XATTR_NAME_MAX + 1];916 917 error = strncpy_from_user(kname, name, sizeof(kname));918 if (error == 0 || error == sizeof(kname))919 error = -ERANGE;920 if (error < 0)921 return error;922retry:923 error = user_path_at(AT_FDCWD, pathname, lookup_flags, &path);924 if (error)925 return error;926 error = mnt_want_write(path.mnt);927 if (!error) {928 error = removexattr(mnt_idmap(path.mnt), path.dentry, kname);929 mnt_drop_write(path.mnt);930 }931 path_put(&path);932 if (retry_estale(error, lookup_flags)) {933 lookup_flags |= LOOKUP_REVAL;934 goto retry;935 }936 return error;937}938 939SYSCALL_DEFINE2(removexattr, const char __user *, pathname,940 const char __user *, name)941{942 return path_removexattr(pathname, name, LOOKUP_FOLLOW);943}944 945SYSCALL_DEFINE2(lremovexattr, const char __user *, pathname,946 const char __user *, name)947{948 return path_removexattr(pathname, name, 0);949}950 951SYSCALL_DEFINE2(fremovexattr, int, fd, const char __user *, name)952{953 struct fd f = fdget(fd);954 char kname[XATTR_NAME_MAX + 1];955 int error = -EBADF;956 957 if (!fd_file(f))958 return error;959 audit_file(fd_file(f));960 961 error = strncpy_from_user(kname, name, sizeof(kname));962 if (error == 0 || error == sizeof(kname))963 error = -ERANGE;964 if (error < 0)965 return error;966 967 error = mnt_want_write_file(fd_file(f));968 if (!error) {969 error = removexattr(file_mnt_idmap(fd_file(f)),970 fd_file(f)->f_path.dentry, kname);971 mnt_drop_write_file(fd_file(f));972 }973 fdput(f);974 return error;975}976 977int xattr_list_one(char **buffer, ssize_t *remaining_size, const char *name)978{979 size_t len;980 981 len = strlen(name) + 1;982 if (*buffer) {983 if (*remaining_size < len)984 return -ERANGE;985 memcpy(*buffer, name, len);986 *buffer += len;987 }988 *remaining_size -= len;989 return 0;990}991 992/**993 * generic_listxattr - run through a dentry's xattr list() operations994 * @dentry: dentry to list the xattrs995 * @buffer: result buffer996 * @buffer_size: size of @buffer997 *998 * Combine the results of the list() operation from every xattr_handler in the999 * xattr_handler stack.1000 *1001 * Note that this will not include the entries for POSIX ACLs.1002 */1003ssize_t1004generic_listxattr(struct dentry *dentry, char *buffer, size_t buffer_size)1005{1006 const struct xattr_handler *handler, * const *handlers = dentry->d_sb->s_xattr;1007 ssize_t remaining_size = buffer_size;1008 int err = 0;1009 1010 for_each_xattr_handler(handlers, handler) {1011 if (!handler->name || (handler->list && !handler->list(dentry)))1012 continue;1013 err = xattr_list_one(&buffer, &remaining_size, handler->name);1014 if (err)1015 return err;1016 }1017 1018 return err ? err : buffer_size - remaining_size;1019}1020EXPORT_SYMBOL(generic_listxattr);1021 1022/**1023 * xattr_full_name - Compute full attribute name from suffix1024 *1025 * @handler: handler of the xattr_handler operation1026 * @name: name passed to the xattr_handler operation1027 *1028 * The get and set xattr handler operations are called with the remainder of1029 * the attribute name after skipping the handler's prefix: for example, "foo"1030 * is passed to the get operation of a handler with prefix "user." to get1031 * attribute "user.foo". The full name is still "there" in the name though.1032 *1033 * Note: the list xattr handler operation when called from the vfs is passed a1034 * NULL name; some file systems use this operation internally, with varying1035 * semantics.1036 */1037const char *xattr_full_name(const struct xattr_handler *handler,1038 const char *name)1039{1040 size_t prefix_len = strlen(xattr_prefix(handler));1041 1042 return name - prefix_len;1043}1044EXPORT_SYMBOL(xattr_full_name);1045 1046/**1047 * simple_xattr_space - estimate the memory used by a simple xattr1048 * @name: the full name of the xattr1049 * @size: the size of its value1050 *1051 * This takes no account of how much larger the two slab objects actually are:1052 * that would depend on the slab implementation, when what is required is a1053 * deterministic number, which grows with name length and size and quantity.1054 *1055 * Return: The approximate number of bytes of memory used by such an xattr.1056 */1057size_t simple_xattr_space(const char *name, size_t size)1058{1059 /*1060 * Use "40" instead of sizeof(struct simple_xattr), to return the1061 * same result on 32-bit and 64-bit, and even if simple_xattr grows.1062 */1063 return 40 + size + strlen(name);1064}1065 1066/**1067 * simple_xattr_free - free an xattr object1068 * @xattr: the xattr object1069 *1070 * Free the xattr object. Can handle @xattr being NULL.1071 */1072void simple_xattr_free(struct simple_xattr *xattr)1073{1074 if (xattr)1075 kfree(xattr->name);1076 kvfree(xattr);1077}1078 1079/**1080 * simple_xattr_alloc - allocate new xattr object1081 * @value: value of the xattr object1082 * @size: size of @value1083 *1084 * Allocate a new xattr object and initialize respective members. The caller is1085 * responsible for handling the name of the xattr.1086 *1087 * Return: On success a new xattr object is returned. On failure NULL is1088 * returned.1089 */1090struct simple_xattr *simple_xattr_alloc(const void *value, size_t size)1091{1092 struct simple_xattr *new_xattr;1093 size_t len;1094 1095 /* wrap around? */1096 len = sizeof(*new_xattr) + size;1097 if (len < sizeof(*new_xattr))1098 return NULL;1099 1100 new_xattr = kvmalloc(len, GFP_KERNEL_ACCOUNT);1101 if (!new_xattr)1102 return NULL;1103 1104 new_xattr->size = size;1105 memcpy(new_xattr->value, value, size);1106 return new_xattr;1107}1108 1109/**1110 * rbtree_simple_xattr_cmp - compare xattr name with current rbtree xattr entry1111 * @key: xattr name1112 * @node: current node1113 *1114 * Compare the xattr name with the xattr name attached to @node in the rbtree.1115 *1116 * Return: Negative value if continuing left, positive if continuing right, 01117 * if the xattr attached to @node matches @key.1118 */1119static int rbtree_simple_xattr_cmp(const void *key, const struct rb_node *node)1120{1121 const char *xattr_name = key;1122 const struct simple_xattr *xattr;1123 1124 xattr = rb_entry(node, struct simple_xattr, rb_node);1125 return strcmp(xattr->name, xattr_name);1126}1127 1128/**1129 * rbtree_simple_xattr_node_cmp - compare two xattr rbtree nodes1130 * @new_node: new node1131 * @node: current node1132 *1133 * Compare the xattr attached to @new_node with the xattr attached to @node.1134 *1135 * Return: Negative value if continuing left, positive if continuing right, 01136 * if the xattr attached to @new_node matches the xattr attached to @node.1137 */1138static int rbtree_simple_xattr_node_cmp(struct rb_node *new_node,1139 const struct rb_node *node)1140{1141 struct simple_xattr *xattr;1142 xattr = rb_entry(new_node, struct simple_xattr, rb_node);1143 return rbtree_simple_xattr_cmp(xattr->name, node);1144}1145 1146/**1147 * simple_xattr_get - get an xattr object1148 * @xattrs: the header of the xattr object1149 * @name: the name of the xattr to retrieve1150 * @buffer: the buffer to store the value into1151 * @size: the size of @buffer1152 *1153 * Try to find and retrieve the xattr object associated with @name.1154 * If @buffer is provided store the value of @xattr in @buffer1155 * otherwise just return the length. The size of @buffer is limited1156 * to XATTR_SIZE_MAX which currently is 65536.1157 *1158 * Return: On success the length of the xattr value is returned. On error a1159 * negative error code is returned.1160 */1161int simple_xattr_get(struct simple_xattrs *xattrs, const char *name,1162 void *buffer, size_t size)1163{1164 struct simple_xattr *xattr = NULL;1165 struct rb_node *rbp;1166 int ret = -ENODATA;1167 1168 read_lock(&xattrs->lock);1169 rbp = rb_find(name, &xattrs->rb_root, rbtree_simple_xattr_cmp);1170 if (rbp) {1171 xattr = rb_entry(rbp, struct simple_xattr, rb_node);1172 ret = xattr->size;1173 if (buffer) {1174 if (size < xattr->size)1175 ret = -ERANGE;1176 else1177 memcpy(buffer, xattr->value, xattr->size);1178 }1179 }1180 read_unlock(&xattrs->lock);1181 return ret;1182}1183 1184/**1185 * simple_xattr_set - set an xattr object1186 * @xattrs: the header of the xattr object1187 * @name: the name of the xattr to retrieve1188 * @value: the value to store along the xattr1189 * @size: the size of @value1190 * @flags: the flags determining how to set the xattr1191 *1192 * Set a new xattr object.1193 * If @value is passed a new xattr object will be allocated. If XATTR_REPLACE1194 * is specified in @flags a matching xattr object for @name must already exist.1195 * If it does it will be replaced with the new xattr object. If it doesn't we1196 * fail. If XATTR_CREATE is specified and a matching xattr does already exist1197 * we fail. If it doesn't we create a new xattr. If @flags is zero we simply1198 * insert the new xattr replacing any existing one.1199 *1200 * If @value is empty and a matching xattr object is found we delete it if1201 * XATTR_REPLACE is specified in @flags or @flags is zero.1202 *1203 * If @value is empty and no matching xattr object for @name is found we do1204 * nothing if XATTR_CREATE is specified in @flags or @flags is zero. For1205 * XATTR_REPLACE we fail as mentioned above.1206 *1207 * Return: On success, the removed or replaced xattr is returned, to be freed1208 * by the caller; or NULL if none. On failure a negative error code is returned.1209 */1210struct simple_xattr *simple_xattr_set(struct simple_xattrs *xattrs,1211 const char *name, const void *value,1212 size_t size, int flags)1213{1214 struct simple_xattr *old_xattr = NULL, *new_xattr = NULL;1215 struct rb_node *parent = NULL, **rbp;1216 int err = 0, ret;1217 1218 /* value == NULL means remove */1219 if (value) {1220 new_xattr = simple_xattr_alloc(value, size);1221 if (!new_xattr)1222 return ERR_PTR(-ENOMEM);1223 1224 new_xattr->name = kstrdup(name, GFP_KERNEL_ACCOUNT);1225 if (!new_xattr->name) {1226 simple_xattr_free(new_xattr);1227 return ERR_PTR(-ENOMEM);1228 }1229 }1230 1231 write_lock(&xattrs->lock);1232 rbp = &xattrs->rb_root.rb_node;1233 while (*rbp) {1234 parent = *rbp;1235 ret = rbtree_simple_xattr_cmp(name, *rbp);1236 if (ret < 0)1237 rbp = &(*rbp)->rb_left;1238 else if (ret > 0)1239 rbp = &(*rbp)->rb_right;1240 else1241 old_xattr = rb_entry(*rbp, struct simple_xattr, rb_node);1242 if (old_xattr)1243 break;1244 }1245 1246 if (old_xattr) {1247 /* Fail if XATTR_CREATE is requested and the xattr exists. */1248 if (flags & XATTR_CREATE) {1249 err = -EEXIST;1250 goto out_unlock;1251 }1252 1253 if (new_xattr)1254 rb_replace_node(&old_xattr->rb_node,1255 &new_xattr->rb_node, &xattrs->rb_root);1256 else1257 rb_erase(&old_xattr->rb_node, &xattrs->rb_root);1258 } else {1259 /* Fail if XATTR_REPLACE is requested but no xattr is found. */1260 if (flags & XATTR_REPLACE) {1261 err = -ENODATA;1262 goto out_unlock;1263 }1264 1265 /*1266 * If XATTR_CREATE or no flags are specified together with a1267 * new value simply insert it.1268 */1269 if (new_xattr) {1270 rb_link_node(&new_xattr->rb_node, parent, rbp);1271 rb_insert_color(&new_xattr->rb_node, &xattrs->rb_root);1272 }1273 1274 /*1275 * If XATTR_CREATE or no flags are specified and neither an1276 * old or new xattr exist then we don't need to do anything.1277 */1278 }1279 1280out_unlock:1281 write_unlock(&xattrs->lock);1282 if (!err)1283 return old_xattr;1284 simple_xattr_free(new_xattr);1285 return ERR_PTR(err);1286}1287 1288static bool xattr_is_trusted(const char *name)1289{1290 return !strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN);1291}1292 1293/**1294 * simple_xattr_list - list all xattr objects1295 * @inode: inode from which to get the xattrs1296 * @xattrs: the header of the xattr object1297 * @buffer: the buffer to store all xattrs into1298 * @size: the size of @buffer1299 *1300 * List all xattrs associated with @inode. If @buffer is NULL we returned1301 * the required size of the buffer. If @buffer is provided we store the1302 * xattrs value into it provided it is big enough.1303 *1304 * Note, the number of xattr names that can be listed with listxattr(2) is1305 * limited to XATTR_LIST_MAX aka 65536 bytes. If a larger buffer is passed1306 * then vfs_listxattr() caps it to XATTR_LIST_MAX and if more xattr names1307 * are found it will return -E2BIG.1308 *1309 * Return: On success the required size or the size of the copied xattrs is1310 * returned. On error a negative error code is returned.1311 */1312ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs *xattrs,1313 char *buffer, size_t size)1314{1315 bool trusted = ns_capable_noaudit(&init_user_ns, CAP_SYS_ADMIN);1316 struct simple_xattr *xattr;1317 struct rb_node *rbp;1318 ssize_t remaining_size = size;1319 int err = 0;1320 1321 err = posix_acl_listxattr(inode, &buffer, &remaining_size);1322 if (err)1323 return err;1324 1325 read_lock(&xattrs->lock);1326 for (rbp = rb_first(&xattrs->rb_root); rbp; rbp = rb_next(rbp)) {1327 xattr = rb_entry(rbp, struct simple_xattr, rb_node);1328 1329 /* skip "trusted." attributes for unprivileged callers */1330 if (!trusted && xattr_is_trusted(xattr->name))1331 continue;1332 1333 err = xattr_list_one(&buffer, &remaining_size, xattr->name);1334 if (err)1335 break;1336 }1337 read_unlock(&xattrs->lock);1338 1339 return err ? err : size - remaining_size;1340}1341 1342/**1343 * rbtree_simple_xattr_less - compare two xattr rbtree nodes1344 * @new_node: new node1345 * @node: current node1346 *1347 * Compare the xattr attached to @new_node with the xattr attached to @node.1348 * Note that this function technically tolerates duplicate entries.1349 *1350 * Return: True if insertion point in the rbtree is found.1351 */1352static bool rbtree_simple_xattr_less(struct rb_node *new_node,1353 const struct rb_node *node)1354{1355 return rbtree_simple_xattr_node_cmp(new_node, node) < 0;1356}1357 1358/**1359 * simple_xattr_add - add xattr objects1360 * @xattrs: the header of the xattr object1361 * @new_xattr: the xattr object to add1362 *1363 * Add an xattr object to @xattrs. This assumes no replacement or removal1364 * of matching xattrs is wanted. Should only be called during inode1365 * initialization when a few distinct initial xattrs are supposed to be set.1366 */1367void simple_xattr_add(struct simple_xattrs *xattrs,1368 struct simple_xattr *new_xattr)1369{1370 write_lock(&xattrs->lock);1371 rb_add(&new_xattr->rb_node, &xattrs->rb_root, rbtree_simple_xattr_less);1372 write_unlock(&xattrs->lock);1373}1374 1375/**1376 * simple_xattrs_init - initialize new xattr header1377 * @xattrs: header to initialize1378 *1379 * Initialize relevant fields of a an xattr header.1380 */1381void simple_xattrs_init(struct simple_xattrs *xattrs)1382{1383 xattrs->rb_root = RB_ROOT;1384 rwlock_init(&xattrs->lock);1385}1386 1387/**1388 * simple_xattrs_free - free xattrs1389 * @xattrs: xattr header whose xattrs to destroy1390 * @freed_space: approximate number of bytes of memory freed from @xattrs1391 *1392 * Destroy all xattrs in @xattr. When this is called no one can hold a1393 * reference to any of the xattrs anymore.1394 */1395void simple_xattrs_free(struct simple_xattrs *xattrs, size_t *freed_space)1396{1397 struct rb_node *rbp;1398 1399 if (freed_space)1400 *freed_space = 0;1401 rbp = rb_first(&xattrs->rb_root);1402 while (rbp) {1403 struct simple_xattr *xattr;1404 struct rb_node *rbp_next;1405 1406 rbp_next = rb_next(rbp);1407 xattr = rb_entry(rbp, struct simple_xattr, rb_node);1408 rb_erase(&xattr->rb_node, &xattrs->rb_root);1409 if (freed_space)1410 *freed_space += simple_xattr_space(xattr->name,1411 xattr->size);1412 simple_xattr_free(xattr);1413 rbp = rbp_next;1414 }1415}1416