@@ -125,6 +125,8 @@ prototypes:
int (*show_options)(struct seq_file *, struct dentry *);
ssize_t (*quota_read)(struct super_block *, int, char *, size_t, loff_t);
ssize_t (*quota_write)(struct super_block *, int, const char *, size_t, loff_t);
+ int (*get_projid) (struct inode *, kprojid_t *);
+ int (*set_projid) (struct inode *, kprojid_t);
int (*bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
locking rules:
@@ -147,6 +149,8 @@ show_options: no (namespace_sem)
quota_read: no (see below)
quota_write: no (see below)
bdev_try_to_free_page: no (see below)
+get_projid no (maybe i_mutex)
+set_projid no (i_mutex)
->statfs() has s_umount (shared) when called by ustat(2) (native or
compat), but that's an accident of bad API; s_umount is used to pin
@@ -228,6 +228,10 @@ struct super_operations {
ssize_t (*quota_read)(struct super_block *, int, char *, size_t, loff_t);
ssize_t (*quota_write)(struct super_block *, int, const char *, size_t, loff_t);
+
+ int (*get_projid) (struct inode *, kprojid_t *);
+ int (*set_projid) (struct inode *, kprojid_t);
+
int (*nr_cached_objects)(struct super_block *);
void (*free_cached_objects)(struct super_block *, int);
};
@@ -319,6 +323,12 @@ or bottom half).
implementations will cause holdoff problems due to large scan batch
sizes.
+ get_projid: called by the VFS and quota to get project id of a inode.
+ This method is called by fcntl() and project quota management.
+
+ set_projid: called by the VFS to set project if of a inode.
+ This method is called by fcntl() with i_mutex locked.
+
Whoever sets up the inode is responsible for filling in the "i_op" field. This
is a pointer to a "struct inode_operations" which describes the methods that
can be performed on individual inodes.
@@ -9,6 +9,7 @@
#include <linux/mm.h>
#include <linux/fs.h>
#include <linux/file.h>
+#include <linux/mount.h>
#include <linux/fdtable.h>
#include <linux/capability.h>
#include <linux/dnotify.h>
@@ -240,6 +241,62 @@ static int f_getowner_uids(struct file *filp, unsigned long arg)
}
#endif
+static int fcntl_get_project(struct file *file, projid_t __user *arg)
+{
+ struct inode *inode = file_inode(file);
+ struct super_block *sb = inode->i_sb;
+ kprojid_t kprojid;
+ projid_t projid;
+ int err;
+
+ if (!sb->s_op->get_projid)
+ return -EPERM;
+
+ err = sb->s_op->get_projid(inode, &kprojid);
+ if (err)
+ return err;
+
+ projid = from_kprojid(current_user_ns(), kprojid);
+ if (projid == (projid_t)-1)
+ return -EACCES;
+
+ return put_user(projid, arg);
+}
+
+static int fcntl_set_project(struct file *file, projid_t projid)
+{
+ struct user_namespace *ns = current_user_ns();
+ struct inode *inode = file_inode(file);
+ struct super_block *sb = inode->i_sb;
+ kprojid_t old_kprojid, kprojid;
+ int err;
+
+ if (!sb->s_op->get_projid || !sb->s_op->set_projid)
+ return -EPERM;
+
+ kprojid = make_kprojid(ns, projid);
+ if (!projid_valid(kprojid))
+ return -EACCES;
+
+ err = mnt_want_write_file(file);
+ if (err)
+ return err;
+
+ mutex_lock(&inode->i_mutex);
+ err = sb->s_op->get_projid(inode, &old_kprojid);
+ if (!err) {
+ if (capable_set_inode_project(inode, old_kprojid, kprojid))
+ err = sb->s_op->set_projid(inode, kprojid);
+ else
+ err = -EACCES;
+ }
+ mutex_unlock(&inode->i_mutex);
+
+ mnt_drop_write_file(file);
+
+ return err;
+}
+
static long do_fcntl(int fd, unsigned int cmd, unsigned long arg,
struct file *filp)
{
@@ -334,6 +391,12 @@ static long do_fcntl(int fd, unsigned int cmd, unsigned long arg,
case F_GET_SEALS:
err = shmem_fcntl(filp, cmd, arg);
break;
+ case F_GET_PROJECT:
+ err = fcntl_get_project(filp, (projid_t __user *) arg);
+ break;
+ case F_SET_PROJECT:
+ err = fcntl_set_project(filp, (projid_t) arg);
+ break;
default:
break;
}
@@ -348,6 +411,8 @@ static int check_fcntl_cmd(unsigned cmd)
case F_GETFD:
case F_SETFD:
case F_GETFL:
+ case F_GET_PROJECT:
+ case F_SET_PROJECT:
return 1;
}
return 0;
@@ -74,3 +74,12 @@ config QUOTACTL_COMPAT
bool
depends on QUOTACTL && COMPAT_FOR_U64_ALIGNMENT
default y
+
+config PROTECTED_PROJECTS_ENABLED_BY_DEFAULT
+ bool "Protected projects by default"
+ default n
+ help
+ This option defines default value for sysctl fs.protected_projects.
+ Say N if you need XFS-compatible mode when file owner could set any
+ project id. If you need reliable project disk quotas say Y here:
+ in this mode changing project requires capability CAP_SYS_RESOURCE.
@@ -27,6 +27,7 @@
#include <linux/shrinker.h>
#include <linux/migrate_mode.h>
#include <linux/uidgid.h>
+#include <linux/projid.h>
#include <linux/lockdep.h>
#include <linux/percpu-rwsem.h>
#include <linux/blk_types.h>
@@ -62,6 +63,7 @@ extern struct inodes_stat_t inodes_stat;
extern int leases_enable, lease_break_time;
extern int sysctl_protected_symlinks;
extern int sysctl_protected_hardlinks;
+extern int sysctl_protected_projects;
struct buffer_head;
typedef int (get_block_t)(struct inode *inode, sector_t iblock,
@@ -1636,6 +1638,8 @@ struct super_operations {
int (*bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
long (*nr_cached_objects)(struct super_block *, int);
long (*free_cached_objects)(struct super_block *, long, int);
+ int (*get_projid)(struct inode *, kprojid_t *);
+ int (*set_projid)(struct inode *, kprojid_t);
};
/*
@@ -86,4 +86,8 @@ static inline bool kprojid_has_mapping(struct user_namespace *ns, kprojid_t proj
#endif /* CONFIG_USER_NS */
+bool capable_set_inode_project(const struct inode *inode,
+ kprojid_t old_kprojid, kprojid_t kprojid);
+bool capable_mix_inode_project(kprojid_t dir_kprojid, kprojid_t kprojid);
+
#endif /* _LINUX_PROJID_H */
@@ -34,6 +34,12 @@
#define F_GET_SEALS (F_LINUX_SPECIFIC_BASE + 10)
/*
+ * Get/Set project id
+ */
+#define F_GET_PROJECT (F_LINUX_SPECIFIC_BASE + 11)
+#define F_SET_PROJECT (F_LINUX_SPECIFIC_BASE + 12)
+
+/*
* Types of seals
*/
#define F_SEAL_SEAL 0x0001 /* prevent further seals from being set */
@@ -444,3 +444,65 @@ bool capable_wrt_inode_uidgid(const struct inode *inode, int cap)
kgid_has_mapping(ns, inode->i_gid);
}
EXPORT_SYMBOL(capable_wrt_inode_uidgid);
+
+int sysctl_protected_projects =
+ IS_ENABLED(CONFIG_PROTECTED_PROJECTS_ENABLED_BY_DEFAULT);
+
+/**
+ * capable_set_inode_project - Check restrictions for changing project id
+ * @inode: The inode in question
+ * @old_kprojid: current project id
+ * @kprojid: target project id
+ *
+ * Returns true if current task can set new project id for inode:
+ * In XFS-compatible mode (sysctl fs.protected_projects = 0) this is permitted
+ * only in init user namespace if current user owns file or task has CAP_FOWNER.
+ * If sysctl fs.protected_projects = 1 then tasks must have CAP_SYS_RESOURCE in
+ * current user-namespace and both projects must be mapped into this namespace.
+ */
+bool capable_set_inode_project(const struct inode *inode,
+ kprojid_t old_kprojid, kprojid_t kprojid)
+{
+ struct user_namespace *ns = current_user_ns();
+
+ /* In XFS-compat mode file owner can set any project id */
+ if (!sysctl_protected_projects)
+ return ns == &init_user_ns && inode_owner_or_capable(inode);
+
+ return ns_capable(ns, CAP_SYS_RESOURCE) &&
+ kprojid_has_mapping(ns, old_kprojid) &&
+ kprojid_has_mapping(ns, kprojid);
+}
+EXPORT_SYMBOL(capable_set_inode_project);
+
+/**
+ * capable_mix_inode_project - Check project id restrictions for link/rename
+ * @kprojid: inode project id
+ * @dir_kprojid: directory project id
+ *
+ * Returns true if current task can link/rename inode into given directory:
+ * In XFS-compatible mode operation is permitted only if projects are match.
+ * If fs.protected_projects is set then it's permitted also if directory
+ * project is mapped to zero or if task has capability CAP_SYS_RESOURCE.
+ */
+bool capable_mix_inode_project(kprojid_t dir_kprojid, kprojid_t kprojid)
+{
+ struct user_namespace *ns;
+ projid_t dir_projid;
+
+ if (projid_eq(dir_kprojid, kprojid))
+ return true;
+
+ if (!sysctl_protected_projects)
+ return false;
+
+ ns = current_user_ns();
+ if (!kprojid_has_mapping(ns, kprojid))
+ return false;
+
+ dir_projid = from_kprojid(ns, dir_kprojid);
+ return dir_projid == (projid_t)0 ||
+ (dir_projid != (projid_t)-1 &&
+ ns_capable(ns, CAP_SYS_RESOURCE));
+}
+EXPORT_SYMBOL(capable_mix_inode_project);
@@ -1649,6 +1649,15 @@ static struct ctl_table fs_table[] = {
.extra2 = &one,
},
{
+ .procname = "protected_projects",
+ .data = &sysctl_protected_projects,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+ .proc_handler = proc_dointvec_minmax,
+ .extra1 = &zero,
+ .extra2 = &one,
+ },
+ {
.procname = "suid_dumpable",
.data = &suid_dumpable,
.maxlen = sizeof(int),
@@ -807,8 +807,8 @@ ssize_t proc_projid_map_write(struct file *file, const char __user *buf,
if ((seq_ns != ns) && (seq_ns != ns->parent))
return -EPERM;
- /* Anyone can set any valid project id no capability needed */
- return map_write(file, buf, size, ppos, -1,
+ return map_write(file, buf, size, ppos,
+ sysctl_protected_projects ? CAP_SYS_RESOURCE : -1,
&ns->projid_map, &ns->parent->projid_map);
}
For now project id and quotas are implemented only in XFS. Existing behavior isn't very useful: any unprivileged user can set any project id for its own files and this way he can bypass project limits. XFS interface for getting or changing file project is a very XFS-centric: ioctl XFS_IOC_FSGET/SETXATTR with structure (struct fsxattr) as a argument which has three unrelated fields and twelve reserved padding bytes. Idea of keeping XFS-compatible interface seems overpriced. Old tools checks filesystem name/magic thus without update they anyway will work only for XFS. This patch defines common interface and new behavior. Depending on sysctl fs.protected_projects = 0|1 projects works as: 0 = XFS-compatible projects - changing project id could be performed only from init user-ns - file owner or task with CAP_FOWNER can set any project id - changing user-ns project-id mapping allowed for everybody - cross-project hardlinks and renaming are forbidden (-EXDEV) - new inodes inherits project id from directory if flag XFS_DIFLAG_PROJINHERIT is set for directory inode 1 = Protected projects - changing project id requires CAP_SYS_RESOURCE in current user-ns - changing project id mapping require CAP_SYS_RESOURCE in parent user-ns - cross-project hardlinks and renaming are permitted if current task has CAP_SYS_RESOURCE in current user-namespace or if directory project is mapped to zero in current user-namespace. - new inodes always inherits project id from directory Now project id is more sticky and cross-project sharing is more flexible. User-namespace project mapping defines set of project ids which could be used inside, if it's empty then container cannot change project id at all. CONFIG_PROTECTED_PROJECTS_BY_DEFAULT defines default value for sysctl. This patch adds two new fcntls: int fcntl(fd, F_GET_PROJECT, projid_t *); int fcntl(fd, F_SET_PROJECT, projid_t); Permissions: F_GET_PROJECT is permitted for everybody but if file project isn't mapped into current user-namespace -EACCESS will be returned. F_SET_PROJECT: depending on state of sysctl fs.protected_projects allowed either for file owner and CAP_FOWNER or requires capability CAP_SYS_RESOURCE. Error codes: EINVAL - not implemented in this kernel EPERM - not permitted/supported by this filesystem type ENOTSUPP - not supported for this filesystem instance (no feature at sb) EACCES - not enough permissions or project id isn't mapped Project id is stored in fs-specific inode and exposed via couple super-block operations: get_projid / set_projid. This have to be sb-operations because dquot_initialize() could be called before setting inode->i_op. Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru> --- Documentation/filesystems/Locking | 4 ++ Documentation/filesystems/vfs.txt | 10 ++++++ fs/fcntl.c | 65 +++++++++++++++++++++++++++++++++++++ fs/quota/Kconfig | 9 +++++ include/linux/fs.h | 4 ++ include/linux/projid.h | 4 ++ include/uapi/linux/fcntl.h | 6 +++ kernel/capability.c | 62 +++++++++++++++++++++++++++++++++++ kernel/sysctl.c | 9 +++++ kernel/user_namespace.c | 4 +- 10 files changed, 175 insertions(+), 2 deletions(-) -- To unsubscribe from this list: send the line "unsubscribe linux-fsdevel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html