1 | // SPDX-License-Identifier: GPL-2.0 |
2 | /* Copyright (c) 2022 Christian Brauner <brauner@kernel.org> */ |
3 | |
4 | #include <linux/cred.h> |
5 | #include <linux/fs.h> |
6 | #include <linux/mnt_idmapping.h> |
7 | #include <linux/slab.h> |
8 | #include <linux/user_namespace.h> |
9 | |
10 | #include "internal.h" |
11 | |
12 | /* |
13 | * Outside of this file vfs{g,u}id_t are always created from k{g,u}id_t, |
14 | * never from raw values. These are just internal helpers. |
15 | */ |
16 | #define VFSUIDT_INIT_RAW(val) (vfsuid_t){ val } |
17 | #define VFSGIDT_INIT_RAW(val) (vfsgid_t){ val } |
18 | |
19 | struct mnt_idmap { |
20 | struct uid_gid_map uid_map; |
21 | struct uid_gid_map gid_map; |
22 | refcount_t count; |
23 | }; |
24 | |
25 | /* |
26 | * Carries the initial idmapping of 0:0:4294967295 which is an identity |
27 | * mapping. This means that {g,u}id 0 is mapped to {g,u}id 0, {g,u}id 1 is |
28 | * mapped to {g,u}id 1, [...], {g,u}id 1000 to {g,u}id 1000, [...]. |
29 | */ |
30 | struct mnt_idmap nop_mnt_idmap = { |
31 | .count = REFCOUNT_INIT(1), |
32 | }; |
33 | EXPORT_SYMBOL_GPL(nop_mnt_idmap); |
34 | |
35 | /** |
36 | * initial_idmapping - check whether this is the initial mapping |
37 | * @ns: idmapping to check |
38 | * |
39 | * Check whether this is the initial mapping, mapping 0 to 0, 1 to 1, |
40 | * [...], 1000 to 1000 [...]. |
41 | * |
42 | * Return: true if this is the initial mapping, false if not. |
43 | */ |
44 | static inline bool initial_idmapping(const struct user_namespace *ns) |
45 | { |
46 | return ns == &init_user_ns; |
47 | } |
48 | |
49 | /** |
50 | * make_vfsuid - map a filesystem kuid according to an idmapping |
51 | * @idmap: the mount's idmapping |
52 | * @fs_userns: the filesystem's idmapping |
53 | * @kuid : kuid to be mapped |
54 | * |
55 | * Take a @kuid and remap it from @fs_userns into @idmap. Use this |
56 | * function when preparing a @kuid to be reported to userspace. |
57 | * |
58 | * If initial_idmapping() determines that this is not an idmapped mount |
59 | * we can simply return @kuid unchanged. |
60 | * If initial_idmapping() tells us that the filesystem is not mounted with an |
61 | * idmapping we know the value of @kuid won't change when calling |
62 | * from_kuid() so we can simply retrieve the value via __kuid_val() |
63 | * directly. |
64 | * |
65 | * Return: @kuid mapped according to @idmap. |
66 | * If @kuid has no mapping in either @idmap or @fs_userns INVALID_UID is |
67 | * returned. |
68 | */ |
69 | |
70 | vfsuid_t make_vfsuid(struct mnt_idmap *idmap, |
71 | struct user_namespace *fs_userns, |
72 | kuid_t kuid) |
73 | { |
74 | uid_t uid; |
75 | |
76 | if (idmap == &nop_mnt_idmap) |
77 | return VFSUIDT_INIT(kuid); |
78 | if (initial_idmapping(ns: fs_userns)) |
79 | uid = __kuid_val(uid: kuid); |
80 | else |
81 | uid = from_kuid(to: fs_userns, uid: kuid); |
82 | if (uid == (uid_t)-1) |
83 | return INVALID_VFSUID; |
84 | return VFSUIDT_INIT_RAW(map_id_down(&idmap->uid_map, uid)); |
85 | } |
86 | EXPORT_SYMBOL_GPL(make_vfsuid); |
87 | |
88 | /** |
89 | * make_vfsgid - map a filesystem kgid according to an idmapping |
90 | * @idmap: the mount's idmapping |
91 | * @fs_userns: the filesystem's idmapping |
92 | * @kgid : kgid to be mapped |
93 | * |
94 | * Take a @kgid and remap it from @fs_userns into @idmap. Use this |
95 | * function when preparing a @kgid to be reported to userspace. |
96 | * |
97 | * If initial_idmapping() determines that this is not an idmapped mount |
98 | * we can simply return @kgid unchanged. |
99 | * If initial_idmapping() tells us that the filesystem is not mounted with an |
100 | * idmapping we know the value of @kgid won't change when calling |
101 | * from_kgid() so we can simply retrieve the value via __kgid_val() |
102 | * directly. |
103 | * |
104 | * Return: @kgid mapped according to @idmap. |
105 | * If @kgid has no mapping in either @idmap or @fs_userns INVALID_GID is |
106 | * returned. |
107 | */ |
108 | vfsgid_t make_vfsgid(struct mnt_idmap *idmap, |
109 | struct user_namespace *fs_userns, kgid_t kgid) |
110 | { |
111 | gid_t gid; |
112 | |
113 | if (idmap == &nop_mnt_idmap) |
114 | return VFSGIDT_INIT(kgid); |
115 | if (initial_idmapping(ns: fs_userns)) |
116 | gid = __kgid_val(gid: kgid); |
117 | else |
118 | gid = from_kgid(to: fs_userns, gid: kgid); |
119 | if (gid == (gid_t)-1) |
120 | return INVALID_VFSGID; |
121 | return VFSGIDT_INIT_RAW(map_id_down(&idmap->gid_map, gid)); |
122 | } |
123 | EXPORT_SYMBOL_GPL(make_vfsgid); |
124 | |
125 | /** |
126 | * from_vfsuid - map a vfsuid into the filesystem idmapping |
127 | * @idmap: the mount's idmapping |
128 | * @fs_userns: the filesystem's idmapping |
129 | * @vfsuid : vfsuid to be mapped |
130 | * |
131 | * Map @vfsuid into the filesystem idmapping. This function has to be used in |
132 | * order to e.g. write @vfsuid to inode->i_uid. |
133 | * |
134 | * Return: @vfsuid mapped into the filesystem idmapping |
135 | */ |
136 | kuid_t from_vfsuid(struct mnt_idmap *idmap, |
137 | struct user_namespace *fs_userns, vfsuid_t vfsuid) |
138 | { |
139 | uid_t uid; |
140 | |
141 | if (idmap == &nop_mnt_idmap) |
142 | return AS_KUIDT(vfsuid); |
143 | uid = map_id_up(map: &idmap->uid_map, id: __vfsuid_val(uid: vfsuid)); |
144 | if (uid == (uid_t)-1) |
145 | return INVALID_UID; |
146 | if (initial_idmapping(ns: fs_userns)) |
147 | return KUIDT_INIT(uid); |
148 | return make_kuid(from: fs_userns, uid); |
149 | } |
150 | EXPORT_SYMBOL_GPL(from_vfsuid); |
151 | |
152 | /** |
153 | * from_vfsgid - map a vfsgid into the filesystem idmapping |
154 | * @idmap: the mount's idmapping |
155 | * @fs_userns: the filesystem's idmapping |
156 | * @vfsgid : vfsgid to be mapped |
157 | * |
158 | * Map @vfsgid into the filesystem idmapping. This function has to be used in |
159 | * order to e.g. write @vfsgid to inode->i_gid. |
160 | * |
161 | * Return: @vfsgid mapped into the filesystem idmapping |
162 | */ |
163 | kgid_t from_vfsgid(struct mnt_idmap *idmap, |
164 | struct user_namespace *fs_userns, vfsgid_t vfsgid) |
165 | { |
166 | gid_t gid; |
167 | |
168 | if (idmap == &nop_mnt_idmap) |
169 | return AS_KGIDT(vfsgid); |
170 | gid = map_id_up(map: &idmap->gid_map, id: __vfsgid_val(gid: vfsgid)); |
171 | if (gid == (gid_t)-1) |
172 | return INVALID_GID; |
173 | if (initial_idmapping(ns: fs_userns)) |
174 | return KGIDT_INIT(gid); |
175 | return make_kgid(from: fs_userns, gid); |
176 | } |
177 | EXPORT_SYMBOL_GPL(from_vfsgid); |
178 | |
179 | #ifdef CONFIG_MULTIUSER |
180 | /** |
181 | * vfsgid_in_group_p() - check whether a vfsuid matches the caller's groups |
182 | * @vfsgid: the mnt gid to match |
183 | * |
184 | * This function can be used to determine whether @vfsuid matches any of the |
185 | * caller's groups. |
186 | * |
187 | * Return: 1 if vfsuid matches caller's groups, 0 if not. |
188 | */ |
189 | int vfsgid_in_group_p(vfsgid_t vfsgid) |
190 | { |
191 | return in_group_p(AS_KGIDT(vfsgid)); |
192 | } |
193 | #else |
194 | int vfsgid_in_group_p(vfsgid_t vfsgid) |
195 | { |
196 | return 1; |
197 | } |
198 | #endif |
199 | EXPORT_SYMBOL_GPL(vfsgid_in_group_p); |
200 | |
201 | static int copy_mnt_idmap(struct uid_gid_map *map_from, |
202 | struct uid_gid_map *map_to) |
203 | { |
204 | struct uid_gid_extent *forward, *reverse; |
205 | u32 nr_extents = READ_ONCE(map_from->nr_extents); |
206 | /* Pairs with smp_wmb() when writing the idmapping. */ |
207 | smp_rmb(); |
208 | |
209 | /* |
210 | * Don't blindly copy @map_to into @map_from if nr_extents is |
211 | * smaller or equal to UID_GID_MAP_MAX_BASE_EXTENTS. Since we |
212 | * read @nr_extents someone could have written an idmapping and |
213 | * then we might end up with inconsistent data. So just don't do |
214 | * anything at all. |
215 | */ |
216 | if (nr_extents == 0) |
217 | return -EINVAL; |
218 | |
219 | /* |
220 | * Here we know that nr_extents is greater than zero which means |
221 | * a map has been written. Since idmappings can't be changed |
222 | * once they have been written we know that we can safely copy |
223 | * from @map_to into @map_from. |
224 | */ |
225 | |
226 | if (nr_extents <= UID_GID_MAP_MAX_BASE_EXTENTS) { |
227 | *map_to = *map_from; |
228 | return 0; |
229 | } |
230 | |
231 | forward = kmemdup(p: map_from->forward, |
232 | size: nr_extents * sizeof(struct uid_gid_extent), |
233 | GFP_KERNEL_ACCOUNT); |
234 | if (!forward) |
235 | return -ENOMEM; |
236 | |
237 | reverse = kmemdup(p: map_from->reverse, |
238 | size: nr_extents * sizeof(struct uid_gid_extent), |
239 | GFP_KERNEL_ACCOUNT); |
240 | if (!reverse) { |
241 | kfree(objp: forward); |
242 | return -ENOMEM; |
243 | } |
244 | |
245 | /* |
246 | * The idmapping isn't exposed anywhere so we don't need to care |
247 | * about ordering between extent pointers and @nr_extents |
248 | * initialization. |
249 | */ |
250 | map_to->forward = forward; |
251 | map_to->reverse = reverse; |
252 | map_to->nr_extents = nr_extents; |
253 | return 0; |
254 | } |
255 | |
256 | static void free_mnt_idmap(struct mnt_idmap *idmap) |
257 | { |
258 | if (idmap->uid_map.nr_extents > UID_GID_MAP_MAX_BASE_EXTENTS) { |
259 | kfree(objp: idmap->uid_map.forward); |
260 | kfree(objp: idmap->uid_map.reverse); |
261 | } |
262 | if (idmap->gid_map.nr_extents > UID_GID_MAP_MAX_BASE_EXTENTS) { |
263 | kfree(objp: idmap->gid_map.forward); |
264 | kfree(objp: idmap->gid_map.reverse); |
265 | } |
266 | kfree(objp: idmap); |
267 | } |
268 | |
269 | struct mnt_idmap *alloc_mnt_idmap(struct user_namespace *mnt_userns) |
270 | { |
271 | struct mnt_idmap *idmap; |
272 | int ret; |
273 | |
274 | idmap = kzalloc(size: sizeof(struct mnt_idmap), GFP_KERNEL_ACCOUNT); |
275 | if (!idmap) |
276 | return ERR_PTR(error: -ENOMEM); |
277 | |
278 | refcount_set(r: &idmap->count, n: 1); |
279 | ret = copy_mnt_idmap(map_from: &mnt_userns->uid_map, map_to: &idmap->uid_map); |
280 | if (!ret) |
281 | ret = copy_mnt_idmap(map_from: &mnt_userns->gid_map, map_to: &idmap->gid_map); |
282 | if (ret) { |
283 | free_mnt_idmap(idmap); |
284 | idmap = ERR_PTR(error: ret); |
285 | } |
286 | return idmap; |
287 | } |
288 | |
289 | /** |
290 | * mnt_idmap_get - get a reference to an idmapping |
291 | * @idmap: the idmap to bump the reference on |
292 | * |
293 | * If @idmap is not the @nop_mnt_idmap bump the reference count. |
294 | * |
295 | * Return: @idmap with reference count bumped if @not_mnt_idmap isn't passed. |
296 | */ |
297 | struct mnt_idmap *mnt_idmap_get(struct mnt_idmap *idmap) |
298 | { |
299 | if (idmap != &nop_mnt_idmap) |
300 | refcount_inc(r: &idmap->count); |
301 | |
302 | return idmap; |
303 | } |
304 | EXPORT_SYMBOL_GPL(mnt_idmap_get); |
305 | |
306 | /** |
307 | * mnt_idmap_put - put a reference to an idmapping |
308 | * @idmap: the idmap to put the reference on |
309 | * |
310 | * If this is a non-initial idmapping, put the reference count when a mount is |
311 | * released and free it if we're the last user. |
312 | */ |
313 | void mnt_idmap_put(struct mnt_idmap *idmap) |
314 | { |
315 | if (idmap != &nop_mnt_idmap && refcount_dec_and_test(r: &idmap->count)) |
316 | free_mnt_idmap(idmap); |
317 | } |
318 | EXPORT_SYMBOL_GPL(mnt_idmap_put); |
319 | |