1// SPDX-License-Identifier: GPL-2.0
2/* Copyright (c) 2022 Christian Brauner <brauner@kernel.org> */
3
4#include <linux/cred.h>
5#include <linux/fs.h>
6#include <linux/mnt_idmapping.h>
7#include <linux/slab.h>
8#include <linux/user_namespace.h>
9
10#include "internal.h"
11
12/*
13 * Outside of this file vfs{g,u}id_t are always created from k{g,u}id_t,
14 * never from raw values. These are just internal helpers.
15 */
16#define VFSUIDT_INIT_RAW(val) (vfsuid_t){ val }
17#define VFSGIDT_INIT_RAW(val) (vfsgid_t){ val }
18
19struct mnt_idmap {
20 struct uid_gid_map uid_map;
21 struct uid_gid_map gid_map;
22 refcount_t count;
23};
24
25/*
26 * Carries the initial idmapping of 0:0:4294967295 which is an identity
27 * mapping. This means that {g,u}id 0 is mapped to {g,u}id 0, {g,u}id 1 is
28 * mapped to {g,u}id 1, [...], {g,u}id 1000 to {g,u}id 1000, [...].
29 */
30struct mnt_idmap nop_mnt_idmap = {
31 .count = REFCOUNT_INIT(1),
32};
33EXPORT_SYMBOL_GPL(nop_mnt_idmap);
34
35/**
36 * initial_idmapping - check whether this is the initial mapping
37 * @ns: idmapping to check
38 *
39 * Check whether this is the initial mapping, mapping 0 to 0, 1 to 1,
40 * [...], 1000 to 1000 [...].
41 *
42 * Return: true if this is the initial mapping, false if not.
43 */
44static inline bool initial_idmapping(const struct user_namespace *ns)
45{
46 return ns == &init_user_ns;
47}
48
49/**
50 * make_vfsuid - map a filesystem kuid according to an idmapping
51 * @idmap: the mount's idmapping
52 * @fs_userns: the filesystem's idmapping
53 * @kuid : kuid to be mapped
54 *
55 * Take a @kuid and remap it from @fs_userns into @idmap. Use this
56 * function when preparing a @kuid to be reported to userspace.
57 *
58 * If initial_idmapping() determines that this is not an idmapped mount
59 * we can simply return @kuid unchanged.
60 * If initial_idmapping() tells us that the filesystem is not mounted with an
61 * idmapping we know the value of @kuid won't change when calling
62 * from_kuid() so we can simply retrieve the value via __kuid_val()
63 * directly.
64 *
65 * Return: @kuid mapped according to @idmap.
66 * If @kuid has no mapping in either @idmap or @fs_userns INVALID_UID is
67 * returned.
68 */
69
70vfsuid_t make_vfsuid(struct mnt_idmap *idmap,
71 struct user_namespace *fs_userns,
72 kuid_t kuid)
73{
74 uid_t uid;
75
76 if (idmap == &nop_mnt_idmap)
77 return VFSUIDT_INIT(kuid);
78 if (initial_idmapping(ns: fs_userns))
79 uid = __kuid_val(uid: kuid);
80 else
81 uid = from_kuid(to: fs_userns, uid: kuid);
82 if (uid == (uid_t)-1)
83 return INVALID_VFSUID;
84 return VFSUIDT_INIT_RAW(map_id_down(&idmap->uid_map, uid));
85}
86EXPORT_SYMBOL_GPL(make_vfsuid);
87
88/**
89 * make_vfsgid - map a filesystem kgid according to an idmapping
90 * @idmap: the mount's idmapping
91 * @fs_userns: the filesystem's idmapping
92 * @kgid : kgid to be mapped
93 *
94 * Take a @kgid and remap it from @fs_userns into @idmap. Use this
95 * function when preparing a @kgid to be reported to userspace.
96 *
97 * If initial_idmapping() determines that this is not an idmapped mount
98 * we can simply return @kgid unchanged.
99 * If initial_idmapping() tells us that the filesystem is not mounted with an
100 * idmapping we know the value of @kgid won't change when calling
101 * from_kgid() so we can simply retrieve the value via __kgid_val()
102 * directly.
103 *
104 * Return: @kgid mapped according to @idmap.
105 * If @kgid has no mapping in either @idmap or @fs_userns INVALID_GID is
106 * returned.
107 */
108vfsgid_t make_vfsgid(struct mnt_idmap *idmap,
109 struct user_namespace *fs_userns, kgid_t kgid)
110{
111 gid_t gid;
112
113 if (idmap == &nop_mnt_idmap)
114 return VFSGIDT_INIT(kgid);
115 if (initial_idmapping(ns: fs_userns))
116 gid = __kgid_val(gid: kgid);
117 else
118 gid = from_kgid(to: fs_userns, gid: kgid);
119 if (gid == (gid_t)-1)
120 return INVALID_VFSGID;
121 return VFSGIDT_INIT_RAW(map_id_down(&idmap->gid_map, gid));
122}
123EXPORT_SYMBOL_GPL(make_vfsgid);
124
125/**
126 * from_vfsuid - map a vfsuid into the filesystem idmapping
127 * @idmap: the mount's idmapping
128 * @fs_userns: the filesystem's idmapping
129 * @vfsuid : vfsuid to be mapped
130 *
131 * Map @vfsuid into the filesystem idmapping. This function has to be used in
132 * order to e.g. write @vfsuid to inode->i_uid.
133 *
134 * Return: @vfsuid mapped into the filesystem idmapping
135 */
136kuid_t from_vfsuid(struct mnt_idmap *idmap,
137 struct user_namespace *fs_userns, vfsuid_t vfsuid)
138{
139 uid_t uid;
140
141 if (idmap == &nop_mnt_idmap)
142 return AS_KUIDT(vfsuid);
143 uid = map_id_up(map: &idmap->uid_map, id: __vfsuid_val(uid: vfsuid));
144 if (uid == (uid_t)-1)
145 return INVALID_UID;
146 if (initial_idmapping(ns: fs_userns))
147 return KUIDT_INIT(uid);
148 return make_kuid(from: fs_userns, uid);
149}
150EXPORT_SYMBOL_GPL(from_vfsuid);
151
152/**
153 * from_vfsgid - map a vfsgid into the filesystem idmapping
154 * @idmap: the mount's idmapping
155 * @fs_userns: the filesystem's idmapping
156 * @vfsgid : vfsgid to be mapped
157 *
158 * Map @vfsgid into the filesystem idmapping. This function has to be used in
159 * order to e.g. write @vfsgid to inode->i_gid.
160 *
161 * Return: @vfsgid mapped into the filesystem idmapping
162 */
163kgid_t from_vfsgid(struct mnt_idmap *idmap,
164 struct user_namespace *fs_userns, vfsgid_t vfsgid)
165{
166 gid_t gid;
167
168 if (idmap == &nop_mnt_idmap)
169 return AS_KGIDT(vfsgid);
170 gid = map_id_up(map: &idmap->gid_map, id: __vfsgid_val(gid: vfsgid));
171 if (gid == (gid_t)-1)
172 return INVALID_GID;
173 if (initial_idmapping(ns: fs_userns))
174 return KGIDT_INIT(gid);
175 return make_kgid(from: fs_userns, gid);
176}
177EXPORT_SYMBOL_GPL(from_vfsgid);
178
179#ifdef CONFIG_MULTIUSER
180/**
181 * vfsgid_in_group_p() - check whether a vfsuid matches the caller's groups
182 * @vfsgid: the mnt gid to match
183 *
184 * This function can be used to determine whether @vfsuid matches any of the
185 * caller's groups.
186 *
187 * Return: 1 if vfsuid matches caller's groups, 0 if not.
188 */
189int vfsgid_in_group_p(vfsgid_t vfsgid)
190{
191 return in_group_p(AS_KGIDT(vfsgid));
192}
193#else
194int vfsgid_in_group_p(vfsgid_t vfsgid)
195{
196 return 1;
197}
198#endif
199EXPORT_SYMBOL_GPL(vfsgid_in_group_p);
200
201static int copy_mnt_idmap(struct uid_gid_map *map_from,
202 struct uid_gid_map *map_to)
203{
204 struct uid_gid_extent *forward, *reverse;
205 u32 nr_extents = READ_ONCE(map_from->nr_extents);
206 /* Pairs with smp_wmb() when writing the idmapping. */
207 smp_rmb();
208
209 /*
210 * Don't blindly copy @map_to into @map_from if nr_extents is
211 * smaller or equal to UID_GID_MAP_MAX_BASE_EXTENTS. Since we
212 * read @nr_extents someone could have written an idmapping and
213 * then we might end up with inconsistent data. So just don't do
214 * anything at all.
215 */
216 if (nr_extents == 0)
217 return -EINVAL;
218
219 /*
220 * Here we know that nr_extents is greater than zero which means
221 * a map has been written. Since idmappings can't be changed
222 * once they have been written we know that we can safely copy
223 * from @map_to into @map_from.
224 */
225
226 if (nr_extents <= UID_GID_MAP_MAX_BASE_EXTENTS) {
227 *map_to = *map_from;
228 return 0;
229 }
230
231 forward = kmemdup(p: map_from->forward,
232 size: nr_extents * sizeof(struct uid_gid_extent),
233 GFP_KERNEL_ACCOUNT);
234 if (!forward)
235 return -ENOMEM;
236
237 reverse = kmemdup(p: map_from->reverse,
238 size: nr_extents * sizeof(struct uid_gid_extent),
239 GFP_KERNEL_ACCOUNT);
240 if (!reverse) {
241 kfree(objp: forward);
242 return -ENOMEM;
243 }
244
245 /*
246 * The idmapping isn't exposed anywhere so we don't need to care
247 * about ordering between extent pointers and @nr_extents
248 * initialization.
249 */
250 map_to->forward = forward;
251 map_to->reverse = reverse;
252 map_to->nr_extents = nr_extents;
253 return 0;
254}
255
256static void free_mnt_idmap(struct mnt_idmap *idmap)
257{
258 if (idmap->uid_map.nr_extents > UID_GID_MAP_MAX_BASE_EXTENTS) {
259 kfree(objp: idmap->uid_map.forward);
260 kfree(objp: idmap->uid_map.reverse);
261 }
262 if (idmap->gid_map.nr_extents > UID_GID_MAP_MAX_BASE_EXTENTS) {
263 kfree(objp: idmap->gid_map.forward);
264 kfree(objp: idmap->gid_map.reverse);
265 }
266 kfree(objp: idmap);
267}
268
269struct mnt_idmap *alloc_mnt_idmap(struct user_namespace *mnt_userns)
270{
271 struct mnt_idmap *idmap;
272 int ret;
273
274 idmap = kzalloc(size: sizeof(struct mnt_idmap), GFP_KERNEL_ACCOUNT);
275 if (!idmap)
276 return ERR_PTR(error: -ENOMEM);
277
278 refcount_set(r: &idmap->count, n: 1);
279 ret = copy_mnt_idmap(map_from: &mnt_userns->uid_map, map_to: &idmap->uid_map);
280 if (!ret)
281 ret = copy_mnt_idmap(map_from: &mnt_userns->gid_map, map_to: &idmap->gid_map);
282 if (ret) {
283 free_mnt_idmap(idmap);
284 idmap = ERR_PTR(error: ret);
285 }
286 return idmap;
287}
288
289/**
290 * mnt_idmap_get - get a reference to an idmapping
291 * @idmap: the idmap to bump the reference on
292 *
293 * If @idmap is not the @nop_mnt_idmap bump the reference count.
294 *
295 * Return: @idmap with reference count bumped if @not_mnt_idmap isn't passed.
296 */
297struct mnt_idmap *mnt_idmap_get(struct mnt_idmap *idmap)
298{
299 if (idmap != &nop_mnt_idmap)
300 refcount_inc(r: &idmap->count);
301
302 return idmap;
303}
304EXPORT_SYMBOL_GPL(mnt_idmap_get);
305
306/**
307 * mnt_idmap_put - put a reference to an idmapping
308 * @idmap: the idmap to put the reference on
309 *
310 * If this is a non-initial idmapping, put the reference count when a mount is
311 * released and free it if we're the last user.
312 */
313void mnt_idmap_put(struct mnt_idmap *idmap)
314{
315 if (idmap != &nop_mnt_idmap && refcount_dec_and_test(r: &idmap->count))
316 free_mnt_idmap(idmap);
317}
318EXPORT_SYMBOL_GPL(mnt_idmap_put);
319

source code of linux/fs/mnt_idmapping.c