diff mbox series

[08/16] fs: add vfs_get_fscaps()

Message ID 20231129-idmap-fscap-refactor-v1-8-da5a26058a5b@kernel.org (mailing list archive)
State Changes Requested
Delegated to: Paul Moore
Headers show
Series fs: use type-safe uid representation for filesystem capabilities | expand

Commit Message

Seth Forshee (DigitalOcean) Nov. 29, 2023, 9:50 p.m. UTC
Provide a type-safe interface for retrieving filesystem capabilities and
a generic implementation suitable for most filesystems. Also add an
internal interface, __vfs_get_fscaps(), which skips security checks for
later use from the capability code.

Signed-off-by: Seth Forshee (DigitalOcean) <sforshee@kernel.org>
---
 fs/xattr.c         | 66 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 include/linux/fs.h |  4 ++++
 2 files changed, 70 insertions(+)

Comments

Christian Brauner Dec. 1, 2023, 5:09 p.m. UTC | #1
On Wed, Nov 29, 2023 at 03:50:26PM -0600, Seth Forshee (DigitalOcean) wrote:
> Provide a type-safe interface for retrieving filesystem capabilities and
> a generic implementation suitable for most filesystems. Also add an
> internal interface, __vfs_get_fscaps(), which skips security checks for
> later use from the capability code.
> 
> Signed-off-by: Seth Forshee (DigitalOcean) <sforshee@kernel.org>
> ---
>  fs/xattr.c         | 66 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
>  include/linux/fs.h |  4 ++++
>  2 files changed, 70 insertions(+)
> 
> diff --git a/fs/xattr.c b/fs/xattr.c
> index 09d927603433..3abaf9bef0a5 100644
> --- a/fs/xattr.c
> +++ b/fs/xattr.c
> @@ -181,6 +181,72 @@ xattr_supports_user_prefix(struct inode *inode)
>  }
>  EXPORT_SYMBOL(xattr_supports_user_prefix);
>  
> +static int generic_get_fscaps(struct mnt_idmap *idmap, struct dentry *dentry,
> +			      struct vfs_caps *caps)
> +{
> +	struct inode *inode = d_inode(dentry);
> +	struct vfs_ns_cap_data *nscaps = NULL;
> +	int ret;
> +
> +	ret = (int)vfs_getxattr_alloc(idmap, dentry, XATTR_NAME_CAPS,

I don't think you need that case here.

> +				      (char **)&nscaps, 0, GFP_NOFS);
> +
> +	if (ret >= 0)
> +		ret = vfs_caps_from_xattr(idmap, i_user_ns(inode), caps, nscaps, ret);
> +
> +	kfree(nscaps);
> +	return ret;
> +}
> +
> +/**
> + * __vfs_get_fscaps - get filesystem capabilities without security checks
> + * @idmap: idmap of the mount the inode was found from
> + * @dentry: the dentry from which to get filesystem capabilities
> + * @caps: storage in which to return the filesystem capabilities
> + *
> + * This function gets the filesystem capabilities for the dentry and returns
> + * them in @caps. It does not perform security checks.
> + *
> + * Return: 0 on success, a negative errno on error.
> + */
> +int __vfs_get_fscaps(struct mnt_idmap *idmap, struct dentry *dentry,
> +		     struct vfs_caps *caps)

I would rename that to vfs_get_fscaps_nosec(). We do that for
vfs_getxattr_nosec() as well. It's not pretty but it's better than just
slapping underscores onto it imo.
Seth Forshee (DigitalOcean) Dec. 1, 2023, 5:41 p.m. UTC | #2
On Fri, Dec 01, 2023 at 06:09:36PM +0100, Christian Brauner wrote:
> On Wed, Nov 29, 2023 at 03:50:26PM -0600, Seth Forshee (DigitalOcean) wrote:
> > Provide a type-safe interface for retrieving filesystem capabilities and
> > a generic implementation suitable for most filesystems. Also add an
> > internal interface, __vfs_get_fscaps(), which skips security checks for
> > later use from the capability code.
> > 
> > Signed-off-by: Seth Forshee (DigitalOcean) <sforshee@kernel.org>
> > ---
> >  fs/xattr.c         | 66 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
> >  include/linux/fs.h |  4 ++++
> >  2 files changed, 70 insertions(+)
> > 
> > diff --git a/fs/xattr.c b/fs/xattr.c
> > index 09d927603433..3abaf9bef0a5 100644
> > --- a/fs/xattr.c
> > +++ b/fs/xattr.c
> > @@ -181,6 +181,72 @@ xattr_supports_user_prefix(struct inode *inode)
> >  }
> >  EXPORT_SYMBOL(xattr_supports_user_prefix);
> >  
> > +static int generic_get_fscaps(struct mnt_idmap *idmap, struct dentry *dentry,
> > +			      struct vfs_caps *caps)
> > +{
> > +	struct inode *inode = d_inode(dentry);
> > +	struct vfs_ns_cap_data *nscaps = NULL;
> > +	int ret;
> > +
> > +	ret = (int)vfs_getxattr_alloc(idmap, dentry, XATTR_NAME_CAPS,
> 
> I don't think you need that case here.

Yep. I played with a few different implementations of this function, so
I'm guessing I did need it at one point and failed to notice when it was
no longer needed.

> 
> > +				      (char **)&nscaps, 0, GFP_NOFS);
> > +
> > +	if (ret >= 0)
> > +		ret = vfs_caps_from_xattr(idmap, i_user_ns(inode), caps, nscaps, ret);
> > +
> > +	kfree(nscaps);
> > +	return ret;
> > +}
> > +
> > +/**
> > + * __vfs_get_fscaps - get filesystem capabilities without security checks
> > + * @idmap: idmap of the mount the inode was found from
> > + * @dentry: the dentry from which to get filesystem capabilities
> > + * @caps: storage in which to return the filesystem capabilities
> > + *
> > + * This function gets the filesystem capabilities for the dentry and returns
> > + * them in @caps. It does not perform security checks.
> > + *
> > + * Return: 0 on success, a negative errno on error.
> > + */
> > +int __vfs_get_fscaps(struct mnt_idmap *idmap, struct dentry *dentry,
> > +		     struct vfs_caps *caps)
> 
> I would rename that to vfs_get_fscaps_nosec(). We do that for
> vfs_getxattr_nosec() as well. It's not pretty but it's better than just
> slapping underscores onto it imo.

Will do.
diff mbox series

Patch

diff --git a/fs/xattr.c b/fs/xattr.c
index 09d927603433..3abaf9bef0a5 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -181,6 +181,72 @@  xattr_supports_user_prefix(struct inode *inode)
 }
 EXPORT_SYMBOL(xattr_supports_user_prefix);
 
+static int generic_get_fscaps(struct mnt_idmap *idmap, struct dentry *dentry,
+			      struct vfs_caps *caps)
+{
+	struct inode *inode = d_inode(dentry);
+	struct vfs_ns_cap_data *nscaps = NULL;
+	int ret;
+
+	ret = (int)vfs_getxattr_alloc(idmap, dentry, XATTR_NAME_CAPS,
+				      (char **)&nscaps, 0, GFP_NOFS);
+
+	if (ret >= 0)
+		ret = vfs_caps_from_xattr(idmap, i_user_ns(inode), caps, nscaps, ret);
+
+	kfree(nscaps);
+	return ret;
+}
+
+/**
+ * __vfs_get_fscaps - get filesystem capabilities without security checks
+ * @idmap: idmap of the mount the inode was found from
+ * @dentry: the dentry from which to get filesystem capabilities
+ * @caps: storage in which to return the filesystem capabilities
+ *
+ * This function gets the filesystem capabilities for the dentry and returns
+ * them in @caps. It does not perform security checks.
+ *
+ * Return: 0 on success, a negative errno on error.
+ */
+int __vfs_get_fscaps(struct mnt_idmap *idmap, struct dentry *dentry,
+		     struct vfs_caps *caps)
+{
+	struct inode *inode = d_inode(dentry);
+
+	if (inode->i_op->get_fscaps)
+		return inode->i_op->get_fscaps(idmap, dentry, caps);
+	return generic_get_fscaps(idmap, dentry, caps);
+}
+
+/**
+ * vfs_get_fscaps - get filesystem capabilities
+ * @idmap: idmap of the mount the inode was found from
+ * @dentry: the dentry from which to get filesystem capabilities
+ * @caps: storage in which to return the filesystem capabilities
+ *
+ * This function gets the filesystem capabilities for the dentry and returns
+ * them in @caps.
+ *
+ * Return: 0 on success, a negative errno on error.
+ */
+int vfs_get_fscaps(struct mnt_idmap *idmap, struct dentry *dentry,
+		   struct vfs_caps *caps)
+{
+	int error;
+
+	/*
+	 * The VFS has no restrictions on reading security.* xattrs, so
+	 * xattr_permission() isn't needed. Only LSMs get a say.
+	 */
+	error = security_inode_getxattr(dentry, XATTR_NAME_CAPS);
+	if (error)
+		return error;
+
+	return __vfs_get_fscaps(idmap, dentry, caps);
+}
+EXPORT_SYMBOL(vfs_get_fscaps);
+
 int
 __vfs_setxattr(struct mnt_idmap *idmap, struct dentry *dentry,
 	       struct inode *inode, const char *name, const void *value,
diff --git a/include/linux/fs.h b/include/linux/fs.h
index a0a77f67b999..e25b39e4017a 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2055,6 +2055,10 @@  extern int vfs_dedupe_file_range(struct file *file,
 extern loff_t vfs_dedupe_file_range_one(struct file *src_file, loff_t src_pos,
 					struct file *dst_file, loff_t dst_pos,
 					loff_t len, unsigned int remap_flags);
+extern int __vfs_get_fscaps(struct mnt_idmap *idmap, struct dentry *dentry,
+			    struct vfs_caps *caps);
+extern int vfs_get_fscaps(struct mnt_idmap *idmap, struct dentry *dentry,
+			  struct vfs_caps *caps);
 
 enum freeze_holder {
 	FREEZE_HOLDER_KERNEL	= (1U << 0),