From patchwork Fri Jun 30 11:08:25 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Alexey Gladkov X-Patchwork-Id: 13298068 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 01A05EB64D7 for ; Fri, 30 Jun 2023 11:12:18 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232632AbjF3LMP (ORCPT ); Fri, 30 Jun 2023 07:12:15 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:55776 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S232912AbjF3LL7 (ORCPT ); Fri, 30 Jun 2023 07:11:59 -0400 X-Greylist: delayed 64 seconds by postgrey-1.37 at lindbergh.monkeyblade.net; Fri, 30 Jun 2023 04:11:51 PDT Received: from us-smtp-delivery-44.mimecast.com (us-smtp-delivery-44.mimecast.com [205.139.111.44]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 41C174204 for ; Fri, 30 Jun 2023 04:11:50 -0700 (PDT) Received: from mimecast-mx02.redhat.com (mimecast-mx02.redhat.com [66.187.233.88]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-58-9uE2y5jYOzqoK4RnKsOZFA-1; Fri, 30 Jun 2023 07:10:42 -0400 X-MC-Unique: 9uE2y5jYOzqoK4RnKsOZFA-1 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.rdu2.redhat.com [10.11.54.4]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 9289310504B0; Fri, 30 Jun 2023 11:10:41 +0000 (UTC) Received: from localhost.localdomain.com (unknown [10.45.226.211]) by smtp.corp.redhat.com (Postfix) with ESMTP id 4E03F200A3AD; Fri, 30 Jun 2023 11:10:40 +0000 (UTC) From: Alexey Gladkov To: Alexander Viro , Alexei Starovoitov , Christian Brauner Cc: bpf@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v1] fs: Add kfuncs to handle idmapped mounts Date: Fri, 30 Jun 2023 13:08:25 +0200 Message-Id: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 3.1 on 10.11.54.4 Precedence: bulk List-ID: X-Mailing-List: linux-fsdevel@vger.kernel.org Since the introduction of idmapped mounts, file handling has become somewhat more complicated. If the inode has been found through an idmapped mount the idmap of the vfsmount must be used to get proper i_uid / i_gid. This is important, for example, to correctly take into account idmapped files when caching, LSM or for an audit. Signed-off-by: Alexey Gladkov --- fs/mnt_idmapping.c | 69 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 69 insertions(+) diff --git a/fs/mnt_idmapping.c b/fs/mnt_idmapping.c index 4905665c47d0..ba98ce26b883 100644 --- a/fs/mnt_idmapping.c +++ b/fs/mnt_idmapping.c @@ -6,6 +6,7 @@ #include #include #include +#include #include "internal.h" @@ -271,3 +272,71 @@ void mnt_idmap_put(struct mnt_idmap *idmap) kfree(idmap); } } + +__diag_push(); +__diag_ignore_all("-Wmissing-prototypes", + "Global functions as their definitions will be in vmlinux BTF"); + +/** + * bpf_is_idmapped_mnt - check whether a mount is idmapped + * @mnt: the mount to check + * + * Return: true if mount is mapped, false if not. + */ +__bpf_kfunc bool bpf_is_idmapped_mnt(struct vfsmount *mnt) +{ + return is_idmapped_mnt(mnt); +} + +/** + * bpf_file_mnt_idmap - get file idmapping + * @file: the file from which to get mapping + * + * Return: The idmap for the @file. + */ +__bpf_kfunc struct mnt_idmap *bpf_file_mnt_idmap(struct file *file) +{ + return file_mnt_idmap(file); +} + +/** + * bpf_inode_into_vfs_ids - map an inode's i_uid and i_gid down according to an idmapping + * @idmap: idmap of the mount the inode was found from + * @inode: inode to map + * + * The inode's i_uid and i_gid mapped down according to @idmap. If the inode's + * i_uid or i_gid has no mapping INVALID_VFSUID or INVALID_VFSGID is returned in + * the corresponding position. + * + * Return: A 64-bit integer containing the current GID and UID, and created as + * such: *gid* **<< 32 \|** *uid*. + */ +__bpf_kfunc uint64_t bpf_inode_into_vfs_ids(struct mnt_idmap *idmap, + const struct inode *inode) +{ + vfsuid_t vfsuid = i_uid_into_vfsuid(idmap, inode); + vfsgid_t vfsgid = i_gid_into_vfsgid(idmap, inode); + + return (u64) __vfsgid_val(vfsgid) << 32 | + __vfsuid_val(vfsuid); +} + +__diag_pop(); + +BTF_SET8_START(idmap_btf_ids) +BTF_ID_FLAGS(func, bpf_is_idmapped_mnt) +BTF_ID_FLAGS(func, bpf_file_mnt_idmap) +BTF_ID_FLAGS(func, bpf_inode_into_vfs_ids) +BTF_SET8_END(idmap_btf_ids) + +static const struct btf_kfunc_id_set idmap_kfunc_set = { + .owner = THIS_MODULE, + .set = &idmap_btf_ids, +}; + +static int __init bpf_idmap_kfunc_init(void) +{ + return register_btf_kfunc_id_set(BPF_PROG_TYPE_UNSPEC, &idmap_kfunc_set); +} + +late_initcall(bpf_idmap_kfunc_init);