blob: 29e38a1f7f77a15100f1d20b3e51507470273633 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001/*
2 * linux/fs/attr.c
3 *
4 * Copyright (C) 1991, 1992 Linus Torvalds
5 * changes by Thomas Schoebel-Theuer
6 */
7
Paul Gortmaker630d9c42011-11-16 23:57:37 -05008#include <linux/export.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -07009#include <linux/time.h>
10#include <linux/mm.h>
11#include <linux/string.h>
Randy Dunlap16f7e0f2006-01-11 12:17:46 -080012#include <linux/capability.h>
Robert Love0eeca282005-07-12 17:06:03 -040013#include <linux/fsnotify.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070014#include <linux/fcntl.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070015#include <linux/security.h>
Mimi Zohar975d2942011-03-09 14:39:57 -050016#include <linux/evm.h>
Linus Torvalds1da177e2005-04-16 15:20:36 -070017
Christoph Hellwig2c27c652010-06-04 11:30:04 +020018/**
19 * inode_change_ok - check if attribute changes to an inode are allowed
20 * @inode: inode to check
21 * @attr: attributes to change
22 *
23 * Check if we are allowed to change the attributes contained in @attr
24 * in the given inode. This includes the normal unix access permission
25 * checks, as well as checks for rlimits and others.
26 *
27 * Should be called as the first thing in ->setattr implementations,
28 * possibly after taking additional locks.
29 */
npiggin@suse.de25d9e2d2009-08-21 02:35:05 +100030int inode_change_ok(const struct inode *inode, struct iattr *attr)
Linus Torvalds1da177e2005-04-16 15:20:36 -070031{
Linus Torvalds1da177e2005-04-16 15:20:36 -070032 unsigned int ia_valid = attr->ia_valid;
33
Christoph Hellwig2c27c652010-06-04 11:30:04 +020034 /*
35 * First check size constraints. These can't be overriden using
36 * ATTR_FORCE.
37 */
38 if (ia_valid & ATTR_SIZE) {
39 int error = inode_newsize_ok(inode, attr->ia_size);
40 if (error)
41 return error;
42 }
43
Linus Torvalds1da177e2005-04-16 15:20:36 -070044 /* If force is set do it anyway. */
45 if (ia_valid & ATTR_FORCE)
Christoph Hellwig2c27c652010-06-04 11:30:04 +020046 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -070047
48 /* Make sure a caller can chown. */
49 if ((ia_valid & ATTR_UID) &&
Eric W. Biederman8e96e3b2012-03-03 21:17:15 -080050 (!uid_eq(current_fsuid(), inode->i_uid) ||
51 !uid_eq(attr->ia_uid, inode->i_uid)) && !capable(CAP_CHOWN))
Christoph Hellwig2c27c652010-06-04 11:30:04 +020052 return -EPERM;
Linus Torvalds1da177e2005-04-16 15:20:36 -070053
54 /* Make sure caller can chgrp. */
55 if ((ia_valid & ATTR_GID) &&
Eric W. Biederman8e96e3b2012-03-03 21:17:15 -080056 (!uid_eq(current_fsuid(), inode->i_uid) ||
57 (!in_group_p(attr->ia_gid) && !gid_eq(attr->ia_gid, inode->i_gid))) &&
Linus Torvalds1da177e2005-04-16 15:20:36 -070058 !capable(CAP_CHOWN))
Christoph Hellwig2c27c652010-06-04 11:30:04 +020059 return -EPERM;
Linus Torvalds1da177e2005-04-16 15:20:36 -070060
61 /* Make sure a caller can chmod. */
62 if (ia_valid & ATTR_MODE) {
Serge E. Hallyn2e149672011-03-23 16:43:26 -070063 if (!inode_owner_or_capable(inode))
Christoph Hellwig2c27c652010-06-04 11:30:04 +020064 return -EPERM;
Linus Torvalds1da177e2005-04-16 15:20:36 -070065 /* Also check the setgid bit! */
66 if (!in_group_p((ia_valid & ATTR_GID) ? attr->ia_gid :
67 inode->i_gid) && !capable(CAP_FSETID))
68 attr->ia_mode &= ~S_ISGID;
69 }
70
71 /* Check for setting the inode time. */
Miklos Szeredi9767d742008-07-01 15:01:26 +020072 if (ia_valid & (ATTR_MTIME_SET | ATTR_ATIME_SET | ATTR_TIMES_SET)) {
Serge E. Hallyn2e149672011-03-23 16:43:26 -070073 if (!inode_owner_or_capable(inode))
Christoph Hellwig2c27c652010-06-04 11:30:04 +020074 return -EPERM;
Linus Torvalds1da177e2005-04-16 15:20:36 -070075 }
Christoph Hellwig2c27c652010-06-04 11:30:04 +020076
77 return 0;
Linus Torvalds1da177e2005-04-16 15:20:36 -070078}
Linus Torvalds1da177e2005-04-16 15:20:36 -070079EXPORT_SYMBOL(inode_change_ok);
80
npiggin@suse.de25d9e2d2009-08-21 02:35:05 +100081/**
82 * inode_newsize_ok - may this inode be truncated to a given size
83 * @inode: the inode to be truncated
84 * @offset: the new size to assign to the inode
85 * @Returns: 0 on success, -ve errno on failure
86 *
npiggin@suse.de7bb46a62010-05-27 01:05:33 +100087 * inode_newsize_ok must be called with i_mutex held.
88 *
npiggin@suse.de25d9e2d2009-08-21 02:35:05 +100089 * inode_newsize_ok will check filesystem limits and ulimits to check that the
90 * new inode size is within limits. inode_newsize_ok will also send SIGXFSZ
91 * when necessary. Caller must not proceed with inode size change if failure is
92 * returned. @inode must be a file (not directory), with appropriate
93 * permissions to allow truncate (inode_newsize_ok does NOT check these
94 * conditions).
npiggin@suse.de25d9e2d2009-08-21 02:35:05 +100095 */
96int inode_newsize_ok(const struct inode *inode, loff_t offset)
97{
98 if (inode->i_size < offset) {
99 unsigned long limit;
100
Jiri Slabyd554ed892010-03-05 13:42:42 -0800101 limit = rlimit(RLIMIT_FSIZE);
npiggin@suse.de25d9e2d2009-08-21 02:35:05 +1000102 if (limit != RLIM_INFINITY && offset > limit)
103 goto out_sig;
104 if (offset > inode->i_sb->s_maxbytes)
105 goto out_big;
106 } else {
107 /*
108 * truncation of in-use swapfiles is disallowed - it would
109 * cause subsequent swapout to scribble on the now-freed
110 * blocks.
111 */
112 if (IS_SWAPFILE(inode))
113 return -ETXTBSY;
114 }
115
116 return 0;
117out_sig:
118 send_sig(SIGXFSZ, current, 0);
119out_big:
120 return -EFBIG;
121}
122EXPORT_SYMBOL(inode_newsize_ok);
123
npiggin@suse.de7bb46a62010-05-27 01:05:33 +1000124/**
Christoph Hellwig6a1a90a2010-06-04 11:30:00 +0200125 * setattr_copy - copy simple metadata updates into the generic inode
npiggin@suse.de7bb46a62010-05-27 01:05:33 +1000126 * @inode: the inode to be updated
127 * @attr: the new attributes
128 *
Christoph Hellwig6a1a90a2010-06-04 11:30:00 +0200129 * setattr_copy must be called with i_mutex held.
npiggin@suse.de7bb46a62010-05-27 01:05:33 +1000130 *
Christoph Hellwig6a1a90a2010-06-04 11:30:00 +0200131 * setattr_copy updates the inode's metadata with that specified
Lucas De Marchi25985ed2011-03-30 22:57:33 -0300132 * in attr. Noticeably missing is inode size update, which is more complex
Christoph Hellwig2c27c652010-06-04 11:30:04 +0200133 * as it requires pagecache updates.
npiggin@suse.de7bb46a62010-05-27 01:05:33 +1000134 *
135 * The inode is not marked as dirty after this operation. The rationale is
136 * that for "simple" filesystems, the struct inode is the inode storage.
137 * The caller is free to mark the inode dirty afterwards if needed.
138 */
Christoph Hellwig6a1a90a2010-06-04 11:30:00 +0200139void setattr_copy(struct inode *inode, const struct iattr *attr)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700140{
141 unsigned int ia_valid = attr->ia_valid;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700142
Linus Torvalds1da177e2005-04-16 15:20:36 -0700143 if (ia_valid & ATTR_UID)
144 inode->i_uid = attr->ia_uid;
145 if (ia_valid & ATTR_GID)
146 inode->i_gid = attr->ia_gid;
147 if (ia_valid & ATTR_ATIME)
148 inode->i_atime = timespec_trunc(attr->ia_atime,
149 inode->i_sb->s_time_gran);
150 if (ia_valid & ATTR_MTIME)
151 inode->i_mtime = timespec_trunc(attr->ia_mtime,
152 inode->i_sb->s_time_gran);
153 if (ia_valid & ATTR_CTIME)
154 inode->i_ctime = timespec_trunc(attr->ia_ctime,
155 inode->i_sb->s_time_gran);
156 if (ia_valid & ATTR_MODE) {
157 umode_t mode = attr->ia_mode;
158
159 if (!in_group_p(inode->i_gid) && !capable(CAP_FSETID))
160 mode &= ~S_ISGID;
161 inode->i_mode = mode;
162 }
npiggin@suse.de7bb46a62010-05-27 01:05:33 +1000163}
Christoph Hellwig6a1a90a2010-06-04 11:30:00 +0200164EXPORT_SYMBOL(setattr_copy);
npiggin@suse.de7bb46a62010-05-27 01:05:33 +1000165
Linus Torvalds1da177e2005-04-16 15:20:36 -0700166int notify_change(struct dentry * dentry, struct iattr * attr)
167{
168 struct inode *inode = dentry->d_inode;
Al Viro8d334ac2011-07-24 23:21:59 -0400169 umode_t mode = inode->i_mode;
Linus Torvalds1da177e2005-04-16 15:20:36 -0700170 int error;
171 struct timespec now;
172 unsigned int ia_valid = attr->ia_valid;
173
Andrew Mortonc4107b32012-06-20 09:55:58 +1000174 WARN_ON_ONCE(!mutex_is_locked(&inode->i_mutex));
175
Miklos Szeredibeb29e02008-07-01 15:01:29 +0200176 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID | ATTR_TIMES_SET)) {
177 if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
178 return -EPERM;
179 }
180
Dmitry Kasatkin799243a2012-05-29 11:02:21 -0700181 if ((ia_valid & ATTR_SIZE) && IS_I_VERSION(inode)) {
182 if (attr->ia_size != inode->i_size)
183 inode_inc_iversion(inode);
184 }
185
Andi Kleen69b45732011-05-28 08:25:51 -0700186 if ((ia_valid & ATTR_MODE)) {
Al Viro8d334ac2011-07-24 23:21:59 -0400187 umode_t amode = attr->ia_mode;
Andi Kleen69b45732011-05-28 08:25:51 -0700188 /* Flag setting protected by i_mutex */
189 if (is_sxid(amode))
190 inode->i_flags &= ~S_NOSEC;
191 }
192
Linus Torvalds1da177e2005-04-16 15:20:36 -0700193 now = current_fs_time(inode->i_sb);
194
195 attr->ia_ctime = now;
196 if (!(ia_valid & ATTR_ATIME_SET))
197 attr->ia_atime = now;
198 if (!(ia_valid & ATTR_MTIME_SET))
199 attr->ia_mtime = now;
Serge E. Hallynb5376772007-10-16 23:31:36 -0700200 if (ia_valid & ATTR_KILL_PRIV) {
201 attr->ia_valid &= ~ATTR_KILL_PRIV;
202 ia_valid &= ~ATTR_KILL_PRIV;
203 error = security_inode_need_killpriv(dentry);
204 if (error > 0)
205 error = security_inode_killpriv(dentry);
206 if (error)
207 return error;
208 }
Jeff Layton6de0ec02007-10-18 03:05:20 -0700209
210 /*
211 * We now pass ATTR_KILL_S*ID to the lower level setattr function so
212 * that the function has the ability to reinterpret a mode change
213 * that's due to these bits. This adds an implicit restriction that
214 * no function will ever call notify_change with both ATTR_MODE and
215 * ATTR_KILL_S*ID set.
216 */
217 if ((ia_valid & (ATTR_KILL_SUID|ATTR_KILL_SGID)) &&
218 (ia_valid & ATTR_MODE))
219 BUG();
220
Linus Torvalds1da177e2005-04-16 15:20:36 -0700221 if (ia_valid & ATTR_KILL_SUID) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700222 if (mode & S_ISUID) {
Jeff Layton6de0ec02007-10-18 03:05:20 -0700223 ia_valid = attr->ia_valid |= ATTR_MODE;
224 attr->ia_mode = (inode->i_mode & ~S_ISUID);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700225 }
226 }
227 if (ia_valid & ATTR_KILL_SGID) {
Linus Torvalds1da177e2005-04-16 15:20:36 -0700228 if ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) {
229 if (!(ia_valid & ATTR_MODE)) {
230 ia_valid = attr->ia_valid |= ATTR_MODE;
231 attr->ia_mode = inode->i_mode;
232 }
233 attr->ia_mode &= ~S_ISGID;
234 }
235 }
Jeff Layton6de0ec02007-10-18 03:05:20 -0700236 if (!(attr->ia_valid & ~(ATTR_KILL_SUID | ATTR_KILL_SGID)))
Linus Torvalds1da177e2005-04-16 15:20:36 -0700237 return 0;
238
Miklos Szeredia77b72d2008-07-30 14:06:22 +0200239 error = security_inode_setattr(dentry, attr);
240 if (error)
241 return error;
242
Christoph Hellwigeef23802010-06-04 11:30:01 +0200243 if (inode->i_op->setattr)
Miklos Szeredia77b72d2008-07-30 14:06:22 +0200244 error = inode->i_op->setattr(dentry, attr);
Christoph Hellwigeef23802010-06-04 11:30:01 +0200245 else
246 error = simple_setattr(dentry, attr);
Linus Torvalds1da177e2005-04-16 15:20:36 -0700247
Mimi Zohar975d2942011-03-09 14:39:57 -0500248 if (!error) {
Robert Love0eeca282005-07-12 17:06:03 -0400249 fsnotify_change(dentry, ia_valid);
Mimi Zohar975d2942011-03-09 14:39:57 -0500250 evm_inode_post_setattr(dentry, ia_valid);
251 }
Robert Love0eeca282005-07-12 17:06:03 -0400252
Linus Torvalds1da177e2005-04-16 15:20:36 -0700253 return error;
254}
Linus Torvalds1da177e2005-04-16 15:20:36 -0700255EXPORT_SYMBOL(notify_change);