Commit 05045329 authored by Linus Torvalds's avatar Linus Torvalds

Merge branch 'work.sane_pwd' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs

Pull misc vfs updates from Al Viro:
 "Making sure that something like a referral point won't end up as pwd
  or root.

  The main part is the last commit (fixing mntns_install()); that one
  fixes a hard-to-hit race. The fchdir() commit is making fchdir(2) a
  bit more robust - it should be impossible to get opened files (even
  O_PATH ones) for referral points in the first place, so the existing
  checks are OK, but checking the same thing as in chdir(2) is just as
  cheap.

  The path_init() commit removes a redundant check that shouldn't have
  been there in the first place"

* 'work.sane_pwd' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  make sure that mntns_install() doesn't end up with referral for root
  path_init(): don't bother with checking MAY_EXEC for LOOKUP_ROOT
  make sure that fchdir() won't accept referral points, etc.
parents e0c4a5fc 4f757f3c
...@@ -2142,7 +2142,6 @@ static int link_path_walk(const char *name, struct nameidata *nd) ...@@ -2142,7 +2142,6 @@ static int link_path_walk(const char *name, struct nameidata *nd)
static const char *path_init(struct nameidata *nd, unsigned flags) static const char *path_init(struct nameidata *nd, unsigned flags)
{ {
int retval = 0;
const char *s = nd->name->name; const char *s = nd->name->name;
if (!*s) if (!*s)
...@@ -2154,13 +2153,8 @@ static const char *path_init(struct nameidata *nd, unsigned flags) ...@@ -2154,13 +2153,8 @@ static const char *path_init(struct nameidata *nd, unsigned flags)
if (flags & LOOKUP_ROOT) { if (flags & LOOKUP_ROOT) {
struct dentry *root = nd->root.dentry; struct dentry *root = nd->root.dentry;
struct inode *inode = root->d_inode; struct inode *inode = root->d_inode;
if (*s) { if (*s && unlikely(!d_can_lookup(root)))
if (!d_can_lookup(root)) return ERR_PTR(-ENOTDIR);
return ERR_PTR(-ENOTDIR);
retval = inode_permission(inode, MAY_EXEC);
if (retval)
return ERR_PTR(retval);
}
nd->path = nd->root; nd->path = nd->root;
nd->inode = inode; nd->inode = inode;
if (flags & LOOKUP_RCU) { if (flags & LOOKUP_RCU) {
...@@ -2258,6 +2252,35 @@ static inline int lookup_last(struct nameidata *nd) ...@@ -2258,6 +2252,35 @@ static inline int lookup_last(struct nameidata *nd)
return walk_component(nd, 0); return walk_component(nd, 0);
} }
static int handle_lookup_down(struct nameidata *nd)
{
struct path path = nd->path;
struct inode *inode = nd->inode;
unsigned seq = nd->seq;
int err;
if (nd->flags & LOOKUP_RCU) {
/*
* don't bother with unlazy_walk on failure - we are
* at the very beginning of walk, so we lose nothing
* if we simply redo everything in non-RCU mode
*/
if (unlikely(!__follow_mount_rcu(nd, &path, &inode, &seq)))
return -ECHILD;
} else {
dget(path.dentry);
err = follow_managed(&path, nd);
if (unlikely(err < 0))
return err;
inode = d_backing_inode(path.dentry);
seq = 0;
}
path_to_nameidata(&path, nd);
nd->inode = inode;
nd->seq = seq;
return 0;
}
/* Returns 0 and nd will be valid on success; Retuns error, otherwise. */ /* Returns 0 and nd will be valid on success; Retuns error, otherwise. */
static int path_lookupat(struct nameidata *nd, unsigned flags, struct path *path) static int path_lookupat(struct nameidata *nd, unsigned flags, struct path *path)
{ {
...@@ -2266,6 +2289,15 @@ static int path_lookupat(struct nameidata *nd, unsigned flags, struct path *path ...@@ -2266,6 +2289,15 @@ static int path_lookupat(struct nameidata *nd, unsigned flags, struct path *path
if (IS_ERR(s)) if (IS_ERR(s))
return PTR_ERR(s); return PTR_ERR(s);
if (unlikely(flags & LOOKUP_DOWN)) {
err = handle_lookup_down(nd);
if (unlikely(err < 0)) {
terminate_walk(nd);
return err;
}
}
while (!(err = link_path_walk(s, nd)) while (!(err = link_path_walk(s, nd))
&& ((err = lookup_last(nd)) > 0)) { && ((err = lookup_last(nd)) > 0)) {
s = trailing_symlink(nd); s = trailing_symlink(nd);
......
...@@ -3462,8 +3462,9 @@ static void mntns_put(struct ns_common *ns) ...@@ -3462,8 +3462,9 @@ static void mntns_put(struct ns_common *ns)
static int mntns_install(struct nsproxy *nsproxy, struct ns_common *ns) static int mntns_install(struct nsproxy *nsproxy, struct ns_common *ns)
{ {
struct fs_struct *fs = current->fs; struct fs_struct *fs = current->fs;
struct mnt_namespace *mnt_ns = to_mnt_ns(ns); struct mnt_namespace *mnt_ns = to_mnt_ns(ns), *old_mnt_ns;
struct path root; struct path root;
int err;
if (!ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN) || if (!ns_capable(mnt_ns->user_ns, CAP_SYS_ADMIN) ||
!ns_capable(current_user_ns(), CAP_SYS_CHROOT) || !ns_capable(current_user_ns(), CAP_SYS_CHROOT) ||
...@@ -3474,15 +3475,18 @@ static int mntns_install(struct nsproxy *nsproxy, struct ns_common *ns) ...@@ -3474,15 +3475,18 @@ static int mntns_install(struct nsproxy *nsproxy, struct ns_common *ns)
return -EINVAL; return -EINVAL;
get_mnt_ns(mnt_ns); get_mnt_ns(mnt_ns);
put_mnt_ns(nsproxy->mnt_ns); old_mnt_ns = nsproxy->mnt_ns;
nsproxy->mnt_ns = mnt_ns; nsproxy->mnt_ns = mnt_ns;
/* Find the root */ /* Find the root */
root.mnt = &mnt_ns->root->mnt; err = vfs_path_lookup(mnt_ns->root->mnt.mnt_root, &mnt_ns->root->mnt,
root.dentry = mnt_ns->root->mnt.mnt_root; "/", LOOKUP_DOWN, &root);
path_get(&root); if (err) {
while(d_mountpoint(root.dentry) && follow_down_one(&root)) /* revert to old namespace */
; nsproxy->mnt_ns = old_mnt_ns;
put_mnt_ns(mnt_ns);
return err;
}
/* Update the pwd and root */ /* Update the pwd and root */
set_fs_pwd(fs, &root); set_fs_pwd(fs, &root);
......
...@@ -460,20 +460,17 @@ SYSCALL_DEFINE1(chdir, const char __user *, filename) ...@@ -460,20 +460,17 @@ SYSCALL_DEFINE1(chdir, const char __user *, filename)
SYSCALL_DEFINE1(fchdir, unsigned int, fd) SYSCALL_DEFINE1(fchdir, unsigned int, fd)
{ {
struct fd f = fdget_raw(fd); struct fd f = fdget_raw(fd);
struct inode *inode; int error;
int error = -EBADF;
error = -EBADF; error = -EBADF;
if (!f.file) if (!f.file)
goto out; goto out;
inode = file_inode(f.file);
error = -ENOTDIR; error = -ENOTDIR;
if (!S_ISDIR(inode->i_mode)) if (!d_can_lookup(f.file->f_path.dentry))
goto out_putf; goto out_putf;
error = inode_permission(inode, MAY_EXEC | MAY_CHDIR); error = inode_permission(file_inode(f.file), MAY_EXEC | MAY_CHDIR);
if (!error) if (!error)
set_fs_pwd(current->fs, &f.file->f_path); set_fs_pwd(current->fs, &f.file->f_path);
out_putf: out_putf:
......
...@@ -44,6 +44,7 @@ enum {LAST_NORM, LAST_ROOT, LAST_DOT, LAST_DOTDOT, LAST_BIND}; ...@@ -44,6 +44,7 @@ enum {LAST_NORM, LAST_ROOT, LAST_DOT, LAST_DOTDOT, LAST_BIND};
#define LOOKUP_JUMPED 0x1000 #define LOOKUP_JUMPED 0x1000
#define LOOKUP_ROOT 0x2000 #define LOOKUP_ROOT 0x2000
#define LOOKUP_EMPTY 0x4000 #define LOOKUP_EMPTY 0x4000
#define LOOKUP_DOWN 0x8000
extern int path_pts(struct path *path); extern int path_pts(struct path *path);
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment