namei: LOOKUP_BENEATH: O_BENEATH-like scoped resolution (adb21d2b) · Commits · 戴 / test

fs/namei.c

+74 −6

Original line number	Diff line number	Diff line
		@@ -641,6 +641,14 @@ static bool legitimize_links(struct nameidata *nd)

		static bool legitimize_root(struct nameidata *nd)
		{
		/*
		* For scoped-lookups (where nd->root has been zeroed), we need to
		* restart the whole lookup from scratch -- because set_root() is wrong
		* for these lookups (nd->dfd is the root, not the filesystem root).
		*/
		if (!nd->root.mnt && (nd->flags & LOOKUP_IS_SCOPED))
		return false;
		/* Nothing to do if nd->root is zero or is managed by the VFS user. */
		if (!nd->root.mnt \|\| (nd->flags & LOOKUP_ROOT))
		return true;
		nd->flags \|= LOOKUP_ROOT_GRABBED;
		@@ -776,12 +784,37 @@ static int complete_walk(struct nameidata *nd)
		int status;

		if (nd->flags & LOOKUP_RCU) {
		if (!(nd->flags & LOOKUP_ROOT))
		/*
		* We don't want to zero nd->root for scoped-lookups or
		* externally-managed nd->root.
		*/
		if (!(nd->flags & (LOOKUP_ROOT \| LOOKUP_IS_SCOPED)))
		nd->root.mnt = NULL;
		if (unlikely(unlazy_walk(nd)))
		return -ECHILD;
		}

		if (unlikely(nd->flags & LOOKUP_IS_SCOPED)) {
		/*
		* While the guarantee of LOOKUP_IS_SCOPED is (roughly) "don't
		* ever step outside the root during lookup" and should already
		* be guaranteed by the rest of namei, we want to avoid a namei
		* BUG resulting in userspace being given a path that was not
		* scoped within the root at some point during the lookup.
		*
		* So, do a final sanity-check to make sure that in the
		* worst-case scenario (a complete bypass of LOOKUP_IS_SCOPED)
		* we won't silently return an fd completely outside of the
		* requested root to userspace.
		*
		* Userspace could move the path outside the root after this
		* check, but as discussed elsewhere this is not a concern (the
		* resolved file was inside the root at some point).
		*/
		if (!path_is_under(&nd->path, &nd->root))
		return -EXDEV;
		}

		if (likely(!(nd->flags & LOOKUP_JUMPED)))
		return 0;

		@@ -802,6 +835,14 @@ static int set_root(struct nameidata *nd)
		{
		struct fs_struct *fs = current->fs;

		/*
		* Jumping to the real root in a scoped-lookup is a BUG in namei, but we
		* still have to ensure it doesn't happen because it will cause a breakout
		* from the dirfd.
		*/
		if (WARN_ON(nd->flags & LOOKUP_IS_SCOPED))
		return -ENOTRECOVERABLE;

		if (nd->flags & LOOKUP_RCU) {
		unsigned seq;

		@@ -838,6 +879,8 @@ static inline void path_to_nameidata(const struct path *path,

		static int nd_jump_root(struct nameidata *nd)
		{
		if (unlikely(nd->flags & LOOKUP_BENEATH))
		return -EXDEV;
		if (unlikely(nd->flags & LOOKUP_NO_XDEV)) {
		/* Absolute path arguments to path_init() are allowed. */
		if (nd->path.mnt != NULL && nd->path.mnt != nd->root.mnt)
		@@ -883,6 +926,9 @@ int nd_jump_link(struct path *path)
		if (nd->path.mnt != path->mnt)
		goto err;
		}
		/* Not currently safe for scoped-lookups. */
		if (unlikely(nd->flags & LOOKUP_IS_SCOPED))
		goto err;

		path_put(&nd->path);
		nd->path = *path;
		@@ -1385,8 +1431,11 @@ static int follow_dotdot_rcu(struct nameidata *nd)
		struct inode *inode = nd->inode;

		while (1) {
		if (path_equal(&nd->path, &nd->root))
		if (path_equal(&nd->path, &nd->root)) {
		if (unlikely(nd->flags & LOOKUP_BENEATH))
		return -ECHILD;
		break;
		}
		if (nd->path.dentry != nd->path.mnt->mnt_root) {
		struct dentry *old = nd->path.dentry;
		struct dentry *parent = old->d_parent;
		@@ -1517,8 +1566,11 @@ static int path_parent_directory(struct path *path)
		static int follow_dotdot(struct nameidata *nd)
		{
		while (1) {
		if (path_equal(&nd->path, &nd->root))
		if (path_equal(&nd->path, &nd->root)) {
		if (unlikely(nd->flags & LOOKUP_BENEATH))
		return -EXDEV;
		break;
		}
		if (nd->path.dentry != nd->path.mnt->mnt_root) {
		int ret = path_parent_directory(&nd->path);
		if (ret)
		@@ -1741,6 +1793,13 @@ static inline int handle_dots(struct nameidata *nd, int type)
		if (type == LAST_DOTDOT) {
		int error = 0;

		/*
		* Scoped-lookup flags resolving ".." is not currently safe --
		* races can cause our parent to have moved outside of the root
		* and us to skip over it.
		*/
		if (unlikely(nd->flags & LOOKUP_IS_SCOPED))
		return -EXDEV;
		if (!nd->root.mnt) {
		error = set_root(nd);
		if (error)
		@@ -2258,7 +2317,6 @@ static const char path_init(struct nameidata nd, unsigned flags)
		get_fs_pwd(current->fs, &nd->path);
		nd->inode = nd->path.dentry->d_inode;
		}
		return s;
		} else {
		/* Caller must check execute permissions on the starting path component */
		struct fd f = fdget_raw(nd->dfd);
		@@ -2283,8 +2341,18 @@ static const char path_init(struct nameidata nd, unsigned flags)
		nd->inode = nd->path.dentry->d_inode;
		}
		fdput(f);
		return s;
		}
		/* For scoped-lookups we need to set the root to the dirfd as well. */
		if (flags & LOOKUP_IS_SCOPED) {
		nd->root = nd->path;
		if (flags & LOOKUP_RCU) {
		nd->root_seq = nd->seq;
		} else {
		path_get(&nd->root);
		nd->flags \|= LOOKUP_ROOT_GRABBED;
		}
		}
		return s;
		}

		static const char trailing_symlink(struct nameidata nd)

include/linux/namei.h

+4 −0

Original line number	Diff line number	Diff line
		@@ -2,6 +2,7 @@
		#ifndef _LINUX_NAMEI_H
		#define _LINUX_NAMEI_H

		#include <linux/fs.h>
		#include <linux/kernel.h>
		#include <linux/path.h>
		#include <linux/fcntl.h>
		@@ -43,6 +44,9 @@ enum {LAST_NORM, LAST_ROOT, LAST_DOT, LAST_DOTDOT, LAST_BIND};
		#define LOOKUP_NO_SYMLINKS 0x010000 /* No symlink crossing. */
		#define LOOKUP_NO_MAGICLINKS 0x020000 /* No nd_jump_link() crossing. */
		#define LOOKUP_NO_XDEV 0x040000 /* No mountpoint crossing. */
		#define LOOKUP_BENEATH 0x080000 /* No escaping from starting point. */
		/* LOOKUP_* flags which do scope-related checks based on the dirfd. */
		#define LOOKUP_IS_SCOPED LOOKUP_BENEATH

		extern int path_pts(struct path *path);

Admin message