2005-04-17 00:20:36 +02:00
|
|
|
/*
|
|
|
|
* linux/fs/open.c
|
|
|
|
*
|
|
|
|
* Copyright (C) 1991, 1992 Linus Torvalds
|
|
|
|
*/
|
|
|
|
|
|
|
|
#include <linux/string.h>
|
|
|
|
#include <linux/mm.h>
|
|
|
|
#include <linux/file.h>
|
2008-04-24 13:44:08 +02:00
|
|
|
#include <linux/fdtable.h>
|
2005-04-17 00:20:36 +02:00
|
|
|
#include <linux/quotaops.h>
|
[PATCH] inotify
inotify is intended to correct the deficiencies of dnotify, particularly
its inability to scale and its terrible user interface:
* dnotify requires the opening of one fd per each directory
that you intend to watch. This quickly results in too many
open files and pins removable media, preventing unmount.
* dnotify is directory-based. You only learn about changes to
directories. Sure, a change to a file in a directory affects
the directory, but you are then forced to keep a cache of
stat structures.
* dnotify's interface to user-space is awful. Signals?
inotify provides a more usable, simple, powerful solution to file change
notification:
* inotify's interface is a system call that returns a fd, not SIGIO.
You get a single fd, which is select()-able.
* inotify has an event that says "the filesystem that the item
you were watching is on was unmounted."
* inotify can watch directories or files.
Inotify is currently used by Beagle (a desktop search infrastructure),
Gamin (a FAM replacement), and other projects.
See Documentation/filesystems/inotify.txt.
Signed-off-by: Robert Love <rml@novell.com>
Cc: John McCutchan <ttb@tentacle.dhs.org>
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-07-12 23:06:03 +02:00
|
|
|
#include <linux/fsnotify.h>
|
2005-04-17 00:20:36 +02:00
|
|
|
#include <linux/module.h>
|
|
|
|
#include <linux/slab.h>
|
|
|
|
#include <linux/tty.h>
|
|
|
|
#include <linux/namei.h>
|
|
|
|
#include <linux/backing-dev.h>
|
2006-01-11 21:17:46 +01:00
|
|
|
#include <linux/capability.h>
|
2008-07-04 18:59:58 +02:00
|
|
|
#include <linux/securebits.h>
|
2005-04-17 00:20:36 +02:00
|
|
|
#include <linux/security.h>
|
|
|
|
#include <linux/mount.h>
|
|
|
|
#include <linux/vfs.h>
|
2006-01-19 02:43:53 +01:00
|
|
|
#include <linux/fcntl.h>
|
2005-04-17 00:20:36 +02:00
|
|
|
#include <asm/uaccess.h>
|
|
|
|
#include <linux/fs.h>
|
2005-06-23 09:09:58 +02:00
|
|
|
#include <linux/personality.h>
|
2005-04-17 00:20:36 +02:00
|
|
|
#include <linux/pagemap.h>
|
|
|
|
#include <linux/syscalls.h>
|
2005-09-09 22:04:13 +02:00
|
|
|
#include <linux/rcupdate.h>
|
2005-11-03 17:00:25 +01:00
|
|
|
#include <linux/audit.h>
|
sys_fallocate() implementation on i386, x86_64 and powerpc
fallocate() is a new system call being proposed here which will allow
applications to preallocate space to any file(s) in a file system.
Each file system implementation that wants to use this feature will need
to support an inode operation called ->fallocate().
Applications can use this feature to avoid fragmentation to certain
level and thus get faster access speed. With preallocation, applications
also get a guarantee of space for particular file(s) - even if later the
the system becomes full.
Currently, glibc provides an interface called posix_fallocate() which
can be used for similar cause. Though this has the advantage of working
on all file systems, but it is quite slow (since it writes zeroes to
each block that has to be preallocated). Without a doubt, file systems
can do this more efficiently within the kernel, by implementing
the proposed fallocate() system call. It is expected that
posix_fallocate() will be modified to call this new system call first
and incase the kernel/filesystem does not implement it, it should fall
back to the current implementation of writing zeroes to the new blocks.
ToDos:
1. Implementation on other architectures (other than i386, x86_64,
and ppc). Patches for s390(x) and ia64 are already available from
previous posts, but it was decided that they should be added later
once fallocate is in the mainline. Hence not including those patches
in this take.
2. Changes to glibc,
a) to support fallocate() system call
b) to make posix_fallocate() and posix_fallocate64() call fallocate()
Signed-off-by: Amit Arora <aarora@in.ibm.com>
2007-07-18 03:42:44 +02:00
|
|
|
#include <linux/falloc.h>
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2006-06-23 11:02:58 +02:00
|
|
|
int vfs_statfs(struct dentry *dentry, struct kstatfs *buf)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
|
|
|
int retval = -ENODEV;
|
|
|
|
|
2006-06-23 11:02:58 +02:00
|
|
|
if (dentry) {
|
2005-04-17 00:20:36 +02:00
|
|
|
retval = -ENOSYS;
|
2006-06-23 11:02:58 +02:00
|
|
|
if (dentry->d_sb->s_op->statfs) {
|
2005-04-17 00:20:36 +02:00
|
|
|
memset(buf, 0, sizeof(*buf));
|
2006-06-23 11:02:58 +02:00
|
|
|
retval = security_sb_statfs(dentry);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (retval)
|
|
|
|
return retval;
|
2006-06-23 11:02:58 +02:00
|
|
|
retval = dentry->d_sb->s_op->statfs(dentry, buf);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (retval == 0 && buf->f_frsize == 0)
|
|
|
|
buf->f_frsize = buf->f_bsize;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return retval;
|
|
|
|
}
|
|
|
|
|
|
|
|
EXPORT_SYMBOL(vfs_statfs);
|
|
|
|
|
2006-06-23 11:02:58 +02:00
|
|
|
static int vfs_statfs_native(struct dentry *dentry, struct statfs *buf)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
|
|
|
struct kstatfs st;
|
|
|
|
int retval;
|
|
|
|
|
2006-06-23 11:02:58 +02:00
|
|
|
retval = vfs_statfs(dentry, &st);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (retval)
|
|
|
|
return retval;
|
|
|
|
|
|
|
|
if (sizeof(*buf) == sizeof(st))
|
|
|
|
memcpy(buf, &st, sizeof(st));
|
|
|
|
else {
|
|
|
|
if (sizeof buf->f_blocks == 4) {
|
2008-07-24 06:27:55 +02:00
|
|
|
if ((st.f_blocks | st.f_bfree | st.f_bavail |
|
|
|
|
st.f_bsize | st.f_frsize) &
|
2005-04-17 00:20:36 +02:00
|
|
|
0xffffffff00000000ULL)
|
|
|
|
return -EOVERFLOW;
|
|
|
|
/*
|
|
|
|
* f_files and f_ffree may be -1; it's okay to stuff
|
|
|
|
* that into 32 bits
|
|
|
|
*/
|
|
|
|
if (st.f_files != -1 &&
|
|
|
|
(st.f_files & 0xffffffff00000000ULL))
|
|
|
|
return -EOVERFLOW;
|
|
|
|
if (st.f_ffree != -1 &&
|
|
|
|
(st.f_ffree & 0xffffffff00000000ULL))
|
|
|
|
return -EOVERFLOW;
|
|
|
|
}
|
|
|
|
|
|
|
|
buf->f_type = st.f_type;
|
|
|
|
buf->f_bsize = st.f_bsize;
|
|
|
|
buf->f_blocks = st.f_blocks;
|
|
|
|
buf->f_bfree = st.f_bfree;
|
|
|
|
buf->f_bavail = st.f_bavail;
|
|
|
|
buf->f_files = st.f_files;
|
|
|
|
buf->f_ffree = st.f_ffree;
|
|
|
|
buf->f_fsid = st.f_fsid;
|
|
|
|
buf->f_namelen = st.f_namelen;
|
|
|
|
buf->f_frsize = st.f_frsize;
|
|
|
|
memset(buf->f_spare, 0, sizeof(buf->f_spare));
|
|
|
|
}
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2006-06-23 11:02:58 +02:00
|
|
|
static int vfs_statfs64(struct dentry *dentry, struct statfs64 *buf)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
|
|
|
struct kstatfs st;
|
|
|
|
int retval;
|
|
|
|
|
2006-06-23 11:02:58 +02:00
|
|
|
retval = vfs_statfs(dentry, &st);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (retval)
|
|
|
|
return retval;
|
|
|
|
|
|
|
|
if (sizeof(*buf) == sizeof(st))
|
|
|
|
memcpy(buf, &st, sizeof(st));
|
|
|
|
else {
|
|
|
|
buf->f_type = st.f_type;
|
|
|
|
buf->f_bsize = st.f_bsize;
|
|
|
|
buf->f_blocks = st.f_blocks;
|
|
|
|
buf->f_bfree = st.f_bfree;
|
|
|
|
buf->f_bavail = st.f_bavail;
|
|
|
|
buf->f_files = st.f_files;
|
|
|
|
buf->f_ffree = st.f_ffree;
|
|
|
|
buf->f_fsid = st.f_fsid;
|
|
|
|
buf->f_namelen = st.f_namelen;
|
|
|
|
buf->f_frsize = st.f_frsize;
|
|
|
|
memset(buf->f_spare, 0, sizeof(buf->f_spare));
|
|
|
|
}
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2008-07-22 15:59:21 +02:00
|
|
|
asmlinkage long sys_statfs(const char __user *pathname, struct statfs __user * buf)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
2008-07-22 15:59:21 +02:00
|
|
|
struct path path;
|
2005-04-17 00:20:36 +02:00
|
|
|
int error;
|
|
|
|
|
2008-07-22 15:59:21 +02:00
|
|
|
error = user_path(pathname, &path);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (!error) {
|
|
|
|
struct statfs tmp;
|
2008-07-22 15:59:21 +02:00
|
|
|
error = vfs_statfs_native(path.dentry, &tmp);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (!error && copy_to_user(buf, &tmp, sizeof(tmp)))
|
|
|
|
error = -EFAULT;
|
2008-07-22 15:59:21 +02:00
|
|
|
path_put(&path);
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
return error;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2008-07-22 15:59:21 +02:00
|
|
|
asmlinkage long sys_statfs64(const char __user *pathname, size_t sz, struct statfs64 __user *buf)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
2008-07-22 15:59:21 +02:00
|
|
|
struct path path;
|
2005-04-17 00:20:36 +02:00
|
|
|
long error;
|
|
|
|
|
|
|
|
if (sz != sizeof(*buf))
|
|
|
|
return -EINVAL;
|
2008-07-22 15:59:21 +02:00
|
|
|
error = user_path(pathname, &path);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (!error) {
|
|
|
|
struct statfs64 tmp;
|
2008-07-22 15:59:21 +02:00
|
|
|
error = vfs_statfs64(path.dentry, &tmp);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (!error && copy_to_user(buf, &tmp, sizeof(tmp)))
|
|
|
|
error = -EFAULT;
|
2008-07-22 15:59:21 +02:00
|
|
|
path_put(&path);
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
return error;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
asmlinkage long sys_fstatfs(unsigned int fd, struct statfs __user * buf)
|
|
|
|
{
|
|
|
|
struct file * file;
|
|
|
|
struct statfs tmp;
|
|
|
|
int error;
|
|
|
|
|
|
|
|
error = -EBADF;
|
|
|
|
file = fget(fd);
|
|
|
|
if (!file)
|
|
|
|
goto out;
|
2006-12-08 11:36:35 +01:00
|
|
|
error = vfs_statfs_native(file->f_path.dentry, &tmp);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (!error && copy_to_user(buf, &tmp, sizeof(tmp)))
|
|
|
|
error = -EFAULT;
|
|
|
|
fput(file);
|
|
|
|
out:
|
|
|
|
return error;
|
|
|
|
}
|
|
|
|
|
|
|
|
asmlinkage long sys_fstatfs64(unsigned int fd, size_t sz, struct statfs64 __user *buf)
|
|
|
|
{
|
|
|
|
struct file * file;
|
|
|
|
struct statfs64 tmp;
|
|
|
|
int error;
|
|
|
|
|
|
|
|
if (sz != sizeof(*buf))
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
error = -EBADF;
|
|
|
|
file = fget(fd);
|
|
|
|
if (!file)
|
|
|
|
goto out;
|
2006-12-08 11:36:35 +01:00
|
|
|
error = vfs_statfs64(file->f_path.dentry, &tmp);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (!error && copy_to_user(buf, &tmp, sizeof(tmp)))
|
|
|
|
error = -EFAULT;
|
|
|
|
fput(file);
|
|
|
|
out:
|
|
|
|
return error;
|
|
|
|
}
|
|
|
|
|
2006-01-08 10:02:39 +01:00
|
|
|
int do_truncate(struct dentry *dentry, loff_t length, unsigned int time_attrs,
|
|
|
|
struct file *filp)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
|
|
|
int err;
|
|
|
|
struct iattr newattrs;
|
|
|
|
|
|
|
|
/* Not pretty: "inode->i_size" shouldn't really be signed. But it is. */
|
|
|
|
if (length < 0)
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
newattrs.ia_size = length;
|
2006-01-08 10:02:39 +01:00
|
|
|
newattrs.ia_valid = ATTR_SIZE | time_attrs;
|
2005-11-07 09:59:49 +01:00
|
|
|
if (filp) {
|
|
|
|
newattrs.ia_file = filp;
|
|
|
|
newattrs.ia_valid |= ATTR_FILE;
|
|
|
|
}
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2007-05-09 05:10:00 +02:00
|
|
|
/* Remove suid/sgid on truncate too */
|
|
|
|
newattrs.ia_valid |= should_remove_suid(dentry);
|
|
|
|
|
2006-01-10 00:59:24 +01:00
|
|
|
mutex_lock(&dentry->d_inode->i_mutex);
|
2005-04-17 00:20:36 +02:00
|
|
|
err = notify_change(dentry, &newattrs);
|
2006-01-10 00:59:24 +01:00
|
|
|
mutex_unlock(&dentry->d_inode->i_mutex);
|
2005-04-17 00:20:36 +02:00
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
2008-07-22 15:59:21 +02:00
|
|
|
static long do_sys_truncate(const char __user *pathname, loff_t length)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
2008-07-22 15:59:21 +02:00
|
|
|
struct path path;
|
|
|
|
struct inode *inode;
|
2005-04-17 00:20:36 +02:00
|
|
|
int error;
|
|
|
|
|
|
|
|
error = -EINVAL;
|
|
|
|
if (length < 0) /* sorry, but loff_t says... */
|
|
|
|
goto out;
|
|
|
|
|
2008-07-22 15:59:21 +02:00
|
|
|
error = user_path(pathname, &path);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (error)
|
|
|
|
goto out;
|
2008-07-22 15:59:21 +02:00
|
|
|
inode = path.dentry->d_inode;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
/* For directories it's -EISDIR, for other non-regulars - -EINVAL */
|
|
|
|
error = -EISDIR;
|
|
|
|
if (S_ISDIR(inode->i_mode))
|
|
|
|
goto dput_and_out;
|
|
|
|
|
|
|
|
error = -EINVAL;
|
|
|
|
if (!S_ISREG(inode->i_mode))
|
|
|
|
goto dput_and_out;
|
|
|
|
|
2008-07-22 15:59:21 +02:00
|
|
|
error = mnt_want_write(path.mnt);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (error)
|
|
|
|
goto dput_and_out;
|
|
|
|
|
2008-07-22 14:09:30 +02:00
|
|
|
error = inode_permission(inode, MAY_WRITE);
|
2008-02-15 23:37:52 +01:00
|
|
|
if (error)
|
|
|
|
goto mnt_drop_write_and_out;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
error = -EPERM;
|
2008-06-24 16:50:12 +02:00
|
|
|
if (IS_APPEND(inode))
|
2008-02-15 23:37:52 +01:00
|
|
|
goto mnt_drop_write_and_out;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2007-07-31 09:39:12 +02:00
|
|
|
error = get_write_access(inode);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (error)
|
2008-02-15 23:37:52 +01:00
|
|
|
goto mnt_drop_write_and_out;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2007-07-31 09:39:12 +02:00
|
|
|
/*
|
|
|
|
* Make sure that there are no leases. get_write_access() protects
|
|
|
|
* against the truncate racing with a lease-granting setlease().
|
|
|
|
*/
|
|
|
|
error = break_lease(inode, FMODE_WRITE);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (error)
|
2007-07-31 09:39:12 +02:00
|
|
|
goto put_write_and_out;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
error = locks_verify_truncate(inode, NULL, length);
|
|
|
|
if (!error) {
|
|
|
|
DQUOT_INIT(inode);
|
2008-07-22 15:59:21 +02:00
|
|
|
error = do_truncate(path.dentry, length, 0, NULL);
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
2007-07-31 09:39:12 +02:00
|
|
|
put_write_and_out:
|
|
|
|
put_write_access(inode);
|
2008-02-15 23:37:52 +01:00
|
|
|
mnt_drop_write_and_out:
|
2008-07-22 15:59:21 +02:00
|
|
|
mnt_drop_write(path.mnt);
|
2005-04-17 00:20:36 +02:00
|
|
|
dput_and_out:
|
2008-07-22 15:59:21 +02:00
|
|
|
path_put(&path);
|
2005-04-17 00:20:36 +02:00
|
|
|
out:
|
|
|
|
return error;
|
|
|
|
}
|
|
|
|
|
|
|
|
asmlinkage long sys_truncate(const char __user * path, unsigned long length)
|
|
|
|
{
|
|
|
|
/* on 32-bit boxen it will cut the range 2^31--2^32-1 off */
|
|
|
|
return do_sys_truncate(path, (long)length);
|
|
|
|
}
|
|
|
|
|
2006-01-08 10:05:20 +01:00
|
|
|
static long do_sys_ftruncate(unsigned int fd, loff_t length, int small)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
|
|
|
struct inode * inode;
|
|
|
|
struct dentry *dentry;
|
|
|
|
struct file * file;
|
|
|
|
int error;
|
|
|
|
|
|
|
|
error = -EINVAL;
|
|
|
|
if (length < 0)
|
|
|
|
goto out;
|
|
|
|
error = -EBADF;
|
|
|
|
file = fget(fd);
|
|
|
|
if (!file)
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
/* explicitly opened as large or we are on 64-bit box */
|
|
|
|
if (file->f_flags & O_LARGEFILE)
|
|
|
|
small = 0;
|
|
|
|
|
2006-12-08 11:36:35 +01:00
|
|
|
dentry = file->f_path.dentry;
|
2005-04-17 00:20:36 +02:00
|
|
|
inode = dentry->d_inode;
|
|
|
|
error = -EINVAL;
|
|
|
|
if (!S_ISREG(inode->i_mode) || !(file->f_mode & FMODE_WRITE))
|
|
|
|
goto out_putf;
|
|
|
|
|
|
|
|
error = -EINVAL;
|
|
|
|
/* Cannot ftruncate over 2^31 bytes without large file support */
|
|
|
|
if (small && length > MAX_NON_LFS)
|
|
|
|
goto out_putf;
|
|
|
|
|
|
|
|
error = -EPERM;
|
|
|
|
if (IS_APPEND(inode))
|
|
|
|
goto out_putf;
|
|
|
|
|
|
|
|
error = locks_verify_truncate(inode, file, length);
|
|
|
|
if (!error)
|
[PATCH] ftruncate does not always update m/ctime
In the course of trying to track down a bug where a file mtime was not
being updated correctly, it was discovered that the m/ctime updates were
not quite being handled correctly for ftruncate() calls.
Quoth SUSv3:
open(2):
If O_TRUNC is set and the file did previously exist, upon
successful completion, open() shall mark for update the st_ctime
and st_mtime fields of the file.
truncate(2):
Upon successful completion, if the file size is changed, this
function shall mark for update the st_ctime and st_mtime fields
of the file, and the S_ISUID and S_ISGID bits of the file mode
may be cleared.
ftruncate(2):
Upon successful completion, if fildes refers to a regular file,
the ftruncate() function shall mark for update the st_ctime and
st_mtime fields of the file and the S_ISUID and S_ISGID bits of
the file mode may be cleared. If the ftruncate() function is
unsuccessful, the file is unaffected.
The open(O_TRUNC) and truncate cases were being handled correctly, but the
ftruncate case was being handled like the truncate case. The semantics of
truncate and ftruncate don't quite match, so ftruncate needs to be handled
slightly differently.
The attached patch addresses this issue for ftruncate(2).
My thanx to Stephen Tweedie and Trond Myklebust for their help in
understanding the situation and semantics.
Signed-off-by: Peter Staubach <staubach@redhat.com>
Cc: "Stephen C. Tweedie" <sct@redhat.com>
Cc: Trond Myklebust <trond.myklebust@fys.uio.no>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Christoph Hellwig <hch@lst.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-06-25 14:48:36 +02:00
|
|
|
error = do_truncate(dentry, length, ATTR_MTIME|ATTR_CTIME, file);
|
2005-04-17 00:20:36 +02:00
|
|
|
out_putf:
|
|
|
|
fput(file);
|
|
|
|
out:
|
|
|
|
return error;
|
|
|
|
}
|
|
|
|
|
|
|
|
asmlinkage long sys_ftruncate(unsigned int fd, unsigned long length)
|
|
|
|
{
|
2006-04-18 22:02:48 +02:00
|
|
|
long ret = do_sys_ftruncate(fd, length, 1);
|
2006-04-18 22:22:59 +02:00
|
|
|
/* avoid REGPARM breakage on x86: */
|
2008-04-11 00:37:38 +02:00
|
|
|
asmlinkage_protect(2, ret, fd, length);
|
2006-04-18 22:02:48 +02:00
|
|
|
return ret;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
/* LFS versions of truncate are only needed on 32 bit machines */
|
|
|
|
#if BITS_PER_LONG == 32
|
|
|
|
asmlinkage long sys_truncate64(const char __user * path, loff_t length)
|
|
|
|
{
|
|
|
|
return do_sys_truncate(path, length);
|
|
|
|
}
|
|
|
|
|
|
|
|
asmlinkage long sys_ftruncate64(unsigned int fd, loff_t length)
|
|
|
|
{
|
2006-04-18 22:02:48 +02:00
|
|
|
long ret = do_sys_ftruncate(fd, length, 0);
|
2006-04-18 22:22:59 +02:00
|
|
|
/* avoid REGPARM breakage on x86: */
|
2008-04-11 00:37:38 +02:00
|
|
|
asmlinkage_protect(2, ret, fd, length);
|
2006-04-18 22:02:48 +02:00
|
|
|
return ret;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
#endif
|
|
|
|
|
sys_fallocate() implementation on i386, x86_64 and powerpc
fallocate() is a new system call being proposed here which will allow
applications to preallocate space to any file(s) in a file system.
Each file system implementation that wants to use this feature will need
to support an inode operation called ->fallocate().
Applications can use this feature to avoid fragmentation to certain
level and thus get faster access speed. With preallocation, applications
also get a guarantee of space for particular file(s) - even if later the
the system becomes full.
Currently, glibc provides an interface called posix_fallocate() which
can be used for similar cause. Though this has the advantage of working
on all file systems, but it is quite slow (since it writes zeroes to
each block that has to be preallocated). Without a doubt, file systems
can do this more efficiently within the kernel, by implementing
the proposed fallocate() system call. It is expected that
posix_fallocate() will be modified to call this new system call first
and incase the kernel/filesystem does not implement it, it should fall
back to the current implementation of writing zeroes to the new blocks.
ToDos:
1. Implementation on other architectures (other than i386, x86_64,
and ppc). Patches for s390(x) and ia64 are already available from
previous posts, but it was decided that they should be added later
once fallocate is in the mainline. Hence not including those patches
in this take.
2. Changes to glibc,
a) to support fallocate() system call
b) to make posix_fallocate() and posix_fallocate64() call fallocate()
Signed-off-by: Amit Arora <aarora@in.ibm.com>
2007-07-18 03:42:44 +02:00
|
|
|
asmlinkage long sys_fallocate(int fd, int mode, loff_t offset, loff_t len)
|
|
|
|
{
|
|
|
|
struct file *file;
|
|
|
|
struct inode *inode;
|
|
|
|
long ret = -EINVAL;
|
|
|
|
|
|
|
|
if (offset < 0 || len <= 0)
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
/* Return error if mode is not supported */
|
|
|
|
ret = -EOPNOTSUPP;
|
|
|
|
if (mode && !(mode & FALLOC_FL_KEEP_SIZE))
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
ret = -EBADF;
|
|
|
|
file = fget(fd);
|
|
|
|
if (!file)
|
|
|
|
goto out;
|
|
|
|
if (!(file->f_mode & FMODE_WRITE))
|
|
|
|
goto out_fput;
|
|
|
|
/*
|
|
|
|
* Revalidate the write permissions, in case security policy has
|
|
|
|
* changed since the files were opened.
|
|
|
|
*/
|
|
|
|
ret = security_file_permission(file, MAY_WRITE);
|
|
|
|
if (ret)
|
|
|
|
goto out_fput;
|
|
|
|
|
|
|
|
inode = file->f_path.dentry->d_inode;
|
|
|
|
|
|
|
|
ret = -ESPIPE;
|
|
|
|
if (S_ISFIFO(inode->i_mode))
|
|
|
|
goto out_fput;
|
|
|
|
|
|
|
|
ret = -ENODEV;
|
|
|
|
/*
|
|
|
|
* Let individual file system decide if it supports preallocation
|
|
|
|
* for directories or not.
|
|
|
|
*/
|
|
|
|
if (!S_ISREG(inode->i_mode) && !S_ISDIR(inode->i_mode))
|
|
|
|
goto out_fput;
|
|
|
|
|
|
|
|
ret = -EFBIG;
|
|
|
|
/* Check for wrap through zero too */
|
|
|
|
if (((offset + len) > inode->i_sb->s_maxbytes) || ((offset + len) < 0))
|
|
|
|
goto out_fput;
|
|
|
|
|
|
|
|
if (inode->i_op && inode->i_op->fallocate)
|
|
|
|
ret = inode->i_op->fallocate(inode, mode, offset, len);
|
|
|
|
else
|
2007-07-24 03:43:46 +02:00
|
|
|
ret = -EOPNOTSUPP;
|
sys_fallocate() implementation on i386, x86_64 and powerpc
fallocate() is a new system call being proposed here which will allow
applications to preallocate space to any file(s) in a file system.
Each file system implementation that wants to use this feature will need
to support an inode operation called ->fallocate().
Applications can use this feature to avoid fragmentation to certain
level and thus get faster access speed. With preallocation, applications
also get a guarantee of space for particular file(s) - even if later the
the system becomes full.
Currently, glibc provides an interface called posix_fallocate() which
can be used for similar cause. Though this has the advantage of working
on all file systems, but it is quite slow (since it writes zeroes to
each block that has to be preallocated). Without a doubt, file systems
can do this more efficiently within the kernel, by implementing
the proposed fallocate() system call. It is expected that
posix_fallocate() will be modified to call this new system call first
and incase the kernel/filesystem does not implement it, it should fall
back to the current implementation of writing zeroes to the new blocks.
ToDos:
1. Implementation on other architectures (other than i386, x86_64,
and ppc). Patches for s390(x) and ia64 are already available from
previous posts, but it was decided that they should be added later
once fallocate is in the mainline. Hence not including those patches
in this take.
2. Changes to glibc,
a) to support fallocate() system call
b) to make posix_fallocate() and posix_fallocate64() call fallocate()
Signed-off-by: Amit Arora <aarora@in.ibm.com>
2007-07-18 03:42:44 +02:00
|
|
|
|
|
|
|
out_fput:
|
|
|
|
fput(file);
|
|
|
|
out:
|
|
|
|
return ret;
|
|
|
|
}
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
/*
|
|
|
|
* access() needs to use the real uid/gid, not the effective uid/gid.
|
|
|
|
* We do this by temporarily clearing all FS-related capabilities and
|
|
|
|
* switching the fsuid/fsgid around to the real ones.
|
|
|
|
*/
|
2006-01-19 02:43:53 +01:00
|
|
|
asmlinkage long sys_faccessat(int dfd, const char __user *filename, int mode)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
2008-07-22 15:59:21 +02:00
|
|
|
struct path path;
|
2008-07-22 14:09:30 +02:00
|
|
|
struct inode *inode;
|
2005-04-17 00:20:36 +02:00
|
|
|
int old_fsuid, old_fsgid;
|
2008-07-04 18:59:58 +02:00
|
|
|
kernel_cap_t uninitialized_var(old_cap); /* !SECURE_NO_SETUID_FIXUP */
|
2005-04-17 00:20:36 +02:00
|
|
|
int res;
|
|
|
|
|
|
|
|
if (mode & ~S_IRWXO) /* where's F_OK, X_OK, W_OK, R_OK? */
|
|
|
|
return -EINVAL;
|
|
|
|
|
|
|
|
old_fsuid = current->fsuid;
|
|
|
|
old_fsgid = current->fsgid;
|
|
|
|
|
|
|
|
current->fsuid = current->uid;
|
|
|
|
current->fsgid = current->gid;
|
|
|
|
|
2008-07-04 18:59:58 +02:00
|
|
|
if (!issecure(SECURE_NO_SETUID_FIXUP)) {
|
|
|
|
/*
|
|
|
|
* Clear the capabilities if we switch to a non-root user
|
|
|
|
*/
|
|
|
|
#ifndef CONFIG_SECURITY_FILE_CAPABILITIES
|
|
|
|
/*
|
|
|
|
* FIXME: There is a race here against sys_capset. The
|
|
|
|
* capabilities can change yet we will restore the old
|
|
|
|
* value below. We should hold task_capabilities_lock,
|
2008-07-22 15:59:21 +02:00
|
|
|
* but we cannot because user_path_at can sleep.
|
2008-07-04 18:59:58 +02:00
|
|
|
*/
|
|
|
|
#endif /* ndef CONFIG_SECURITY_FILE_CAPABILITIES */
|
|
|
|
if (current->uid)
|
|
|
|
old_cap = cap_set_effective(__cap_empty_set);
|
|
|
|
else
|
|
|
|
old_cap = cap_set_effective(current->cap_permitted);
|
|
|
|
}
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2008-07-22 15:59:21 +02:00
|
|
|
res = user_path_at(dfd, filename, LOOKUP_FOLLOW, &path);
|
2006-10-01 08:29:01 +02:00
|
|
|
if (res)
|
|
|
|
goto out;
|
|
|
|
|
2008-07-22 15:59:21 +02:00
|
|
|
inode = path.dentry->d_inode;
|
2008-07-22 14:09:30 +02:00
|
|
|
|
|
|
|
if ((mode & MAY_EXEC) && S_ISREG(inode->i_mode)) {
|
2008-07-22 06:02:33 +02:00
|
|
|
/*
|
|
|
|
* MAY_EXEC on regular files is denied if the fs is mounted
|
|
|
|
* with the "noexec" flag.
|
|
|
|
*/
|
|
|
|
res = -EACCES;
|
2008-07-22 15:59:21 +02:00
|
|
|
if (path.mnt->mnt_flags & MNT_NOEXEC)
|
2008-07-22 06:02:33 +02:00
|
|
|
goto out_path_release;
|
|
|
|
}
|
|
|
|
|
2008-07-22 14:09:30 +02:00
|
|
|
res = inode_permission(inode, mode | MAY_ACCESS);
|
2006-10-01 08:29:01 +02:00
|
|
|
/* SuS v2 requires we report a read only fs too */
|
2008-07-22 14:09:30 +02:00
|
|
|
if (res || !(mode & S_IWOTH) || special_file(inode->i_mode))
|
2006-10-01 08:29:01 +02:00
|
|
|
goto out_path_release;
|
2008-02-15 23:37:55 +01:00
|
|
|
/*
|
|
|
|
* This is a rare case where using __mnt_is_readonly()
|
|
|
|
* is OK without a mnt_want/drop_write() pair. Since
|
|
|
|
* no actual write to the fs is performed here, we do
|
|
|
|
* not need to telegraph to that to anyone.
|
|
|
|
*
|
|
|
|
* By doing this, we accept that this access is
|
|
|
|
* inherently racy and know that the fs may change
|
|
|
|
* state before we even see this result.
|
|
|
|
*/
|
2008-07-22 15:59:21 +02:00
|
|
|
if (__mnt_is_readonly(path.mnt))
|
2006-10-01 08:29:01 +02:00
|
|
|
res = -EROFS;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2006-10-01 08:29:01 +02:00
|
|
|
out_path_release:
|
2008-07-22 15:59:21 +02:00
|
|
|
path_put(&path);
|
2006-10-01 08:29:01 +02:00
|
|
|
out:
|
2005-04-17 00:20:36 +02:00
|
|
|
current->fsuid = old_fsuid;
|
|
|
|
current->fsgid = old_fsgid;
|
2008-07-04 18:59:58 +02:00
|
|
|
|
|
|
|
if (!issecure(SECURE_NO_SETUID_FIXUP))
|
|
|
|
cap_set_effective(old_cap);
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
return res;
|
|
|
|
}
|
|
|
|
|
2006-01-19 02:43:53 +01:00
|
|
|
asmlinkage long sys_access(const char __user *filename, int mode)
|
|
|
|
{
|
|
|
|
return sys_faccessat(AT_FDCWD, filename, mode);
|
|
|
|
}
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
asmlinkage long sys_chdir(const char __user * filename)
|
|
|
|
{
|
2008-07-22 15:59:21 +02:00
|
|
|
struct path path;
|
2005-04-17 00:20:36 +02:00
|
|
|
int error;
|
|
|
|
|
2008-07-22 15:59:21 +02:00
|
|
|
error = user_path_dir(filename, &path);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (error)
|
|
|
|
goto out;
|
|
|
|
|
2008-07-22 15:59:21 +02:00
|
|
|
error = inode_permission(path.dentry->d_inode, MAY_EXEC | MAY_ACCESS);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (error)
|
|
|
|
goto dput_and_out;
|
|
|
|
|
2008-07-22 15:59:21 +02:00
|
|
|
set_fs_pwd(current->fs, &path);
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
dput_and_out:
|
2008-07-22 15:59:21 +02:00
|
|
|
path_put(&path);
|
2005-04-17 00:20:36 +02:00
|
|
|
out:
|
|
|
|
return error;
|
|
|
|
}
|
|
|
|
|
|
|
|
asmlinkage long sys_fchdir(unsigned int fd)
|
|
|
|
{
|
|
|
|
struct file *file;
|
|
|
|
struct inode *inode;
|
|
|
|
int error;
|
|
|
|
|
|
|
|
error = -EBADF;
|
|
|
|
file = fget(fd);
|
|
|
|
if (!file)
|
|
|
|
goto out;
|
|
|
|
|
2008-02-15 04:34:39 +01:00
|
|
|
inode = file->f_path.dentry->d_inode;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
error = -ENOTDIR;
|
|
|
|
if (!S_ISDIR(inode->i_mode))
|
|
|
|
goto out_putf;
|
|
|
|
|
2008-07-22 14:09:30 +02:00
|
|
|
error = inode_permission(inode, MAY_EXEC | MAY_ACCESS);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (!error)
|
2008-02-15 04:34:39 +01:00
|
|
|
set_fs_pwd(current->fs, &file->f_path);
|
2005-04-17 00:20:36 +02:00
|
|
|
out_putf:
|
|
|
|
fput(file);
|
|
|
|
out:
|
|
|
|
return error;
|
|
|
|
}
|
|
|
|
|
|
|
|
asmlinkage long sys_chroot(const char __user * filename)
|
|
|
|
{
|
2008-07-22 15:59:21 +02:00
|
|
|
struct path path;
|
2005-04-17 00:20:36 +02:00
|
|
|
int error;
|
|
|
|
|
2008-07-22 15:59:21 +02:00
|
|
|
error = user_path_dir(filename, &path);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (error)
|
|
|
|
goto out;
|
|
|
|
|
2008-07-22 15:59:21 +02:00
|
|
|
error = inode_permission(path.dentry->d_inode, MAY_EXEC | MAY_ACCESS);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (error)
|
|
|
|
goto dput_and_out;
|
|
|
|
|
|
|
|
error = -EPERM;
|
|
|
|
if (!capable(CAP_SYS_CHROOT))
|
|
|
|
goto dput_and_out;
|
|
|
|
|
2008-07-22 15:59:21 +02:00
|
|
|
set_fs_root(current->fs, &path);
|
2005-04-17 00:20:36 +02:00
|
|
|
error = 0;
|
|
|
|
dput_and_out:
|
2008-07-22 15:59:21 +02:00
|
|
|
path_put(&path);
|
2005-04-17 00:20:36 +02:00
|
|
|
out:
|
|
|
|
return error;
|
|
|
|
}
|
|
|
|
|
|
|
|
asmlinkage long sys_fchmod(unsigned int fd, mode_t mode)
|
|
|
|
{
|
|
|
|
struct inode * inode;
|
|
|
|
struct dentry * dentry;
|
|
|
|
struct file * file;
|
|
|
|
int err = -EBADF;
|
|
|
|
struct iattr newattrs;
|
|
|
|
|
|
|
|
file = fget(fd);
|
|
|
|
if (!file)
|
|
|
|
goto out;
|
|
|
|
|
2006-12-08 11:36:35 +01:00
|
|
|
dentry = file->f_path.dentry;
|
2005-04-17 00:20:36 +02:00
|
|
|
inode = dentry->d_inode;
|
|
|
|
|
2007-06-07 18:19:32 +02:00
|
|
|
audit_inode(NULL, dentry);
|
2005-11-03 17:00:25 +01:00
|
|
|
|
2008-02-15 23:37:50 +01:00
|
|
|
err = mnt_want_write(file->f_path.mnt);
|
|
|
|
if (err)
|
2005-04-17 00:20:36 +02:00
|
|
|
goto out_putf;
|
2006-01-10 00:59:24 +01:00
|
|
|
mutex_lock(&inode->i_mutex);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (mode == (mode_t) -1)
|
|
|
|
mode = inode->i_mode;
|
|
|
|
newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
|
|
|
|
newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
|
|
|
|
err = notify_change(dentry, &newattrs);
|
2006-01-10 00:59:24 +01:00
|
|
|
mutex_unlock(&inode->i_mutex);
|
2008-02-15 23:37:50 +01:00
|
|
|
mnt_drop_write(file->f_path.mnt);
|
2005-04-17 00:20:36 +02:00
|
|
|
out_putf:
|
|
|
|
fput(file);
|
|
|
|
out:
|
|
|
|
return err;
|
|
|
|
}
|
|
|
|
|
2006-01-19 02:43:53 +01:00
|
|
|
asmlinkage long sys_fchmodat(int dfd, const char __user *filename,
|
|
|
|
mode_t mode)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
2008-07-22 15:59:21 +02:00
|
|
|
struct path path;
|
|
|
|
struct inode *inode;
|
2005-04-17 00:20:36 +02:00
|
|
|
int error;
|
|
|
|
struct iattr newattrs;
|
|
|
|
|
2008-07-22 15:59:21 +02:00
|
|
|
error = user_path_at(dfd, filename, LOOKUP_FOLLOW, &path);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (error)
|
|
|
|
goto out;
|
2008-07-22 15:59:21 +02:00
|
|
|
inode = path.dentry->d_inode;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2008-07-22 15:59:21 +02:00
|
|
|
error = mnt_want_write(path.mnt);
|
2008-02-15 23:37:50 +01:00
|
|
|
if (error)
|
2005-04-17 00:20:36 +02:00
|
|
|
goto dput_and_out;
|
2006-01-10 00:59:24 +01:00
|
|
|
mutex_lock(&inode->i_mutex);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (mode == (mode_t) -1)
|
|
|
|
mode = inode->i_mode;
|
|
|
|
newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
|
|
|
|
newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
|
2008-07-22 15:59:21 +02:00
|
|
|
error = notify_change(path.dentry, &newattrs);
|
2006-01-10 00:59:24 +01:00
|
|
|
mutex_unlock(&inode->i_mutex);
|
2008-07-22 15:59:21 +02:00
|
|
|
mnt_drop_write(path.mnt);
|
2005-04-17 00:20:36 +02:00
|
|
|
dput_and_out:
|
2008-07-22 15:59:21 +02:00
|
|
|
path_put(&path);
|
2005-04-17 00:20:36 +02:00
|
|
|
out:
|
|
|
|
return error;
|
|
|
|
}
|
|
|
|
|
2006-01-19 02:43:53 +01:00
|
|
|
asmlinkage long sys_chmod(const char __user *filename, mode_t mode)
|
|
|
|
{
|
|
|
|
return sys_fchmodat(AT_FDCWD, filename, mode);
|
|
|
|
}
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
static int chown_common(struct dentry * dentry, uid_t user, gid_t group)
|
|
|
|
{
|
2008-07-01 15:01:29 +02:00
|
|
|
struct inode *inode = dentry->d_inode;
|
2005-04-17 00:20:36 +02:00
|
|
|
int error;
|
|
|
|
struct iattr newattrs;
|
|
|
|
|
|
|
|
newattrs.ia_valid = ATTR_CTIME;
|
|
|
|
if (user != (uid_t) -1) {
|
|
|
|
newattrs.ia_valid |= ATTR_UID;
|
|
|
|
newattrs.ia_uid = user;
|
|
|
|
}
|
|
|
|
if (group != (gid_t) -1) {
|
|
|
|
newattrs.ia_valid |= ATTR_GID;
|
|
|
|
newattrs.ia_gid = group;
|
|
|
|
}
|
|
|
|
if (!S_ISDIR(inode->i_mode))
|
Implement file posix capabilities
Implement file posix capabilities. This allows programs to be given a
subset of root's powers regardless of who runs them, without having to use
setuid and giving the binary all of root's powers.
This version works with Kaigai Kohei's userspace tools, found at
http://www.kaigai.gr.jp/index.php. For more information on how to use this
patch, Chris Friedhoff has posted a nice page at
http://www.friedhoff.org/fscaps.html.
Changelog:
Nov 27:
Incorporate fixes from Andrew Morton
(security-introduce-file-caps-tweaks and
security-introduce-file-caps-warning-fix)
Fix Kconfig dependency.
Fix change signaling behavior when file caps are not compiled in.
Nov 13:
Integrate comments from Alexey: Remove CONFIG_ ifdef from
capability.h, and use %zd for printing a size_t.
Nov 13:
Fix endianness warnings by sparse as suggested by Alexey
Dobriyan.
Nov 09:
Address warnings of unused variables at cap_bprm_set_security
when file capabilities are disabled, and simultaneously clean
up the code a little, by pulling the new code into a helper
function.
Nov 08:
For pointers to required userspace tools and how to use
them, see http://www.friedhoff.org/fscaps.html.
Nov 07:
Fix the calculation of the highest bit checked in
check_cap_sanity().
Nov 07:
Allow file caps to be enabled without CONFIG_SECURITY, since
capabilities are the default.
Hook cap_task_setscheduler when !CONFIG_SECURITY.
Move capable(TASK_KILL) to end of cap_task_kill to reduce
audit messages.
Nov 05:
Add secondary calls in selinux/hooks.c to task_setioprio and
task_setscheduler so that selinux and capabilities with file
cap support can be stacked.
Sep 05:
As Seth Arnold points out, uid checks are out of place
for capability code.
Sep 01:
Define task_setscheduler, task_setioprio, cap_task_kill, and
task_setnice to make sure a user cannot affect a process in which
they called a program with some fscaps.
One remaining question is the note under task_setscheduler: are we
ok with CAP_SYS_NICE being sufficient to confine a process to a
cpuset?
It is a semantic change, as without fsccaps, attach_task doesn't
allow CAP_SYS_NICE to override the uid equivalence check. But since
it uses security_task_setscheduler, which elsewhere is used where
CAP_SYS_NICE can be used to override the uid equivalence check,
fixing it might be tough.
task_setscheduler
note: this also controls cpuset:attach_task. Are we ok with
CAP_SYS_NICE being used to confine to a cpuset?
task_setioprio
task_setnice
sys_setpriority uses this (through set_one_prio) for another
process. Need same checks as setrlimit
Aug 21:
Updated secureexec implementation to reflect the fact that
euid and uid might be the same and nonzero, but the process
might still have elevated caps.
Aug 15:
Handle endianness of xattrs.
Enforce capability version match between kernel and disk.
Enforce that no bits beyond the known max capability are
set, else return -EPERM.
With this extra processing, it may be worth reconsidering
doing all the work at bprm_set_security rather than
d_instantiate.
Aug 10:
Always call getxattr at bprm_set_security, rather than
caching it at d_instantiate.
[morgan@kernel.org: file-caps clean up for linux/capability.h]
[bunk@kernel.org: unexport cap_inode_killpriv]
Signed-off-by: Serge E. Hallyn <serue@us.ibm.com>
Cc: Stephen Smalley <sds@tycho.nsa.gov>
Cc: James Morris <jmorris@namei.org>
Cc: Chris Wright <chrisw@sous-sol.org>
Cc: Andrew Morgan <morgan@kernel.org>
Signed-off-by: Andrew Morgan <morgan@kernel.org>
Signed-off-by: Adrian Bunk <bunk@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-10-17 08:31:36 +02:00
|
|
|
newattrs.ia_valid |=
|
|
|
|
ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_KILL_PRIV;
|
2006-01-10 00:59:24 +01:00
|
|
|
mutex_lock(&inode->i_mutex);
|
2005-04-17 00:20:36 +02:00
|
|
|
error = notify_change(dentry, &newattrs);
|
2006-01-10 00:59:24 +01:00
|
|
|
mutex_unlock(&inode->i_mutex);
|
2008-07-01 15:01:29 +02:00
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
return error;
|
|
|
|
}
|
|
|
|
|
|
|
|
asmlinkage long sys_chown(const char __user * filename, uid_t user, gid_t group)
|
|
|
|
{
|
2008-07-22 15:59:21 +02:00
|
|
|
struct path path;
|
2005-04-17 00:20:36 +02:00
|
|
|
int error;
|
|
|
|
|
2008-07-22 15:59:21 +02:00
|
|
|
error = user_path(filename, &path);
|
2006-10-01 08:29:01 +02:00
|
|
|
if (error)
|
|
|
|
goto out;
|
2008-07-22 15:59:21 +02:00
|
|
|
error = mnt_want_write(path.mnt);
|
2008-02-15 23:37:50 +01:00
|
|
|
if (error)
|
|
|
|
goto out_release;
|
2008-07-22 15:59:21 +02:00
|
|
|
error = chown_common(path.dentry, user, group);
|
|
|
|
mnt_drop_write(path.mnt);
|
2008-02-15 23:37:50 +01:00
|
|
|
out_release:
|
2008-07-22 15:59:21 +02:00
|
|
|
path_put(&path);
|
2006-10-01 08:29:01 +02:00
|
|
|
out:
|
2005-04-17 00:20:36 +02:00
|
|
|
return error;
|
|
|
|
}
|
|
|
|
|
2006-01-19 02:43:53 +01:00
|
|
|
asmlinkage long sys_fchownat(int dfd, const char __user *filename, uid_t user,
|
|
|
|
gid_t group, int flag)
|
|
|
|
{
|
2008-07-22 15:59:21 +02:00
|
|
|
struct path path;
|
2006-01-19 02:43:53 +01:00
|
|
|
int error = -EINVAL;
|
|
|
|
int follow;
|
|
|
|
|
|
|
|
if ((flag & ~AT_SYMLINK_NOFOLLOW) != 0)
|
|
|
|
goto out;
|
|
|
|
|
|
|
|
follow = (flag & AT_SYMLINK_NOFOLLOW) ? 0 : LOOKUP_FOLLOW;
|
2008-07-22 15:59:21 +02:00
|
|
|
error = user_path_at(dfd, filename, follow, &path);
|
2006-10-01 08:29:01 +02:00
|
|
|
if (error)
|
|
|
|
goto out;
|
2008-07-22 15:59:21 +02:00
|
|
|
error = mnt_want_write(path.mnt);
|
2008-02-15 23:37:50 +01:00
|
|
|
if (error)
|
|
|
|
goto out_release;
|
2008-07-22 15:59:21 +02:00
|
|
|
error = chown_common(path.dentry, user, group);
|
|
|
|
mnt_drop_write(path.mnt);
|
2008-02-15 23:37:50 +01:00
|
|
|
out_release:
|
2008-07-22 15:59:21 +02:00
|
|
|
path_put(&path);
|
2006-01-19 02:43:53 +01:00
|
|
|
out:
|
|
|
|
return error;
|
|
|
|
}
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
asmlinkage long sys_lchown(const char __user * filename, uid_t user, gid_t group)
|
|
|
|
{
|
2008-07-22 15:59:21 +02:00
|
|
|
struct path path;
|
2005-04-17 00:20:36 +02:00
|
|
|
int error;
|
|
|
|
|
2008-07-22 15:59:21 +02:00
|
|
|
error = user_lpath(filename, &path);
|
2006-10-01 08:29:01 +02:00
|
|
|
if (error)
|
|
|
|
goto out;
|
2008-07-22 15:59:21 +02:00
|
|
|
error = mnt_want_write(path.mnt);
|
2008-02-15 23:37:50 +01:00
|
|
|
if (error)
|
|
|
|
goto out_release;
|
2008-07-22 15:59:21 +02:00
|
|
|
error = chown_common(path.dentry, user, group);
|
|
|
|
mnt_drop_write(path.mnt);
|
2008-02-15 23:37:50 +01:00
|
|
|
out_release:
|
2008-07-22 15:59:21 +02:00
|
|
|
path_put(&path);
|
2006-10-01 08:29:01 +02:00
|
|
|
out:
|
2005-04-17 00:20:36 +02:00
|
|
|
return error;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
asmlinkage long sys_fchown(unsigned int fd, uid_t user, gid_t group)
|
|
|
|
{
|
|
|
|
struct file * file;
|
|
|
|
int error = -EBADF;
|
2006-10-01 08:29:01 +02:00
|
|
|
struct dentry * dentry;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
file = fget(fd);
|
2006-10-01 08:29:01 +02:00
|
|
|
if (!file)
|
|
|
|
goto out;
|
|
|
|
|
2008-02-15 23:37:50 +01:00
|
|
|
error = mnt_want_write(file->f_path.mnt);
|
|
|
|
if (error)
|
|
|
|
goto out_fput;
|
2006-12-08 11:36:35 +01:00
|
|
|
dentry = file->f_path.dentry;
|
2007-06-07 18:19:32 +02:00
|
|
|
audit_inode(NULL, dentry);
|
2006-10-01 08:29:01 +02:00
|
|
|
error = chown_common(dentry, user, group);
|
2008-02-15 23:37:50 +01:00
|
|
|
mnt_drop_write(file->f_path.mnt);
|
|
|
|
out_fput:
|
2006-10-01 08:29:01 +02:00
|
|
|
fput(file);
|
|
|
|
out:
|
2005-04-17 00:20:36 +02:00
|
|
|
return error;
|
|
|
|
}
|
|
|
|
|
2008-02-15 23:37:48 +01:00
|
|
|
/*
|
|
|
|
* You have to be very careful that these write
|
|
|
|
* counts get cleaned up in error cases and
|
|
|
|
* upon __fput(). This should probably never
|
|
|
|
* be called outside of __dentry_open().
|
|
|
|
*/
|
|
|
|
static inline int __get_file_write_access(struct inode *inode,
|
|
|
|
struct vfsmount *mnt)
|
|
|
|
{
|
|
|
|
int error;
|
|
|
|
error = get_write_access(inode);
|
|
|
|
if (error)
|
|
|
|
return error;
|
|
|
|
/*
|
|
|
|
* Do not take mount writer counts on
|
|
|
|
* special files since no writes to
|
|
|
|
* the mount itself will occur.
|
|
|
|
*/
|
|
|
|
if (!special_file(inode->i_mode)) {
|
|
|
|
/*
|
|
|
|
* Balanced in __fput()
|
|
|
|
*/
|
|
|
|
error = mnt_want_write(mnt);
|
|
|
|
if (error)
|
|
|
|
put_write_access(inode);
|
|
|
|
}
|
|
|
|
return error;
|
|
|
|
}
|
|
|
|
|
[PATCH] open returns ENFILE but creates file anyway
When open(O_CREAT) is called and the error, ENFILE, is returned, the file
may be created anyway. This is counter intuitive, against the SUS V3
specification, and may cause applications to misbehave if they are not
coded correctly to handle this semantic. The SUS V3 specification
explicitly states "No files shall be created or modified if the function
returns -1.".
The error, ENFILE, is used to indicate the system wide open file table is
full and no more file structs can be allocated.
This is due to an ordering problem. The entry in the directory is created
before the file struct is allocated. If the allocation for the file struct
fails, then the system call must return an error, but the directory entry
was already created and can not be safely removed.
The solution to this situation is relatively easy. The file struct should
be allocated before the directory entry is created. If the allocation
fails, then the error can be returned directly. If the creation of the
directory entry fails, then the file struct can be easily freed.
Signed-off-by: Peter Staubach <staubach@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-09-13 10:25:12 +02:00
|
|
|
static struct file *__dentry_open(struct dentry *dentry, struct vfsmount *mnt,
|
2005-10-18 23:20:16 +02:00
|
|
|
int flags, struct file *f,
|
|
|
|
int (*open)(struct inode *, struct file *))
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
|
|
|
struct inode *inode;
|
|
|
|
int error;
|
|
|
|
|
|
|
|
f->f_flags = flags;
|
2008-09-02 21:28:45 +02:00
|
|
|
f->f_mode = (__force fmode_t)((flags+1) & O_ACCMODE) | FMODE_LSEEK |
|
[PATCH] open returns ENFILE but creates file anyway
When open(O_CREAT) is called and the error, ENFILE, is returned, the file
may be created anyway. This is counter intuitive, against the SUS V3
specification, and may cause applications to misbehave if they are not
coded correctly to handle this semantic. The SUS V3 specification
explicitly states "No files shall be created or modified if the function
returns -1.".
The error, ENFILE, is used to indicate the system wide open file table is
full and no more file structs can be allocated.
This is due to an ordering problem. The entry in the directory is created
before the file struct is allocated. If the allocation for the file struct
fails, then the system call must return an error, but the directory entry
was already created and can not be safely removed.
The solution to this situation is relatively easy. The file struct should
be allocated before the directory entry is created. If the allocation
fails, then the error can be returned directly. If the creation of the
directory entry fails, then the file struct can be easily freed.
Signed-off-by: Peter Staubach <staubach@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-09-13 10:25:12 +02:00
|
|
|
FMODE_PREAD | FMODE_PWRITE;
|
2005-04-17 00:20:36 +02:00
|
|
|
inode = dentry->d_inode;
|
|
|
|
if (f->f_mode & FMODE_WRITE) {
|
2008-02-15 23:37:48 +01:00
|
|
|
error = __get_file_write_access(inode, mnt);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (error)
|
|
|
|
goto cleanup_file;
|
2008-02-15 23:38:01 +01:00
|
|
|
if (!special_file(inode->i_mode))
|
|
|
|
file_take_write(f);
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
f->f_mapping = inode->i_mapping;
|
2006-12-08 11:36:35 +01:00
|
|
|
f->f_path.dentry = dentry;
|
|
|
|
f->f_path.mnt = mnt;
|
2005-04-17 00:20:36 +02:00
|
|
|
f->f_pos = 0;
|
|
|
|
f->f_op = fops_get(inode->i_fop);
|
|
|
|
file_move(f, &inode->i_sb->s_files);
|
|
|
|
|
2007-09-14 02:27:07 +02:00
|
|
|
error = security_dentry_open(f);
|
|
|
|
if (error)
|
|
|
|
goto cleanup_all;
|
|
|
|
|
2005-10-18 23:20:16 +02:00
|
|
|
if (!open && f->f_op)
|
|
|
|
open = f->f_op->open;
|
|
|
|
if (open) {
|
|
|
|
error = open(inode, f);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (error)
|
|
|
|
goto cleanup_all;
|
|
|
|
}
|
2005-10-18 23:20:16 +02:00
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
f->f_flags &= ~(O_CREAT | O_EXCL | O_NOCTTY | O_TRUNC);
|
|
|
|
|
|
|
|
file_ra_state_init(&f->f_ra, f->f_mapping->host->i_mapping);
|
|
|
|
|
|
|
|
/* NB: we're sure to have correct a_ops only after f_op->open */
|
|
|
|
if (f->f_flags & O_DIRECT) {
|
2005-06-24 07:05:25 +02:00
|
|
|
if (!f->f_mapping->a_ops ||
|
|
|
|
((!f->f_mapping->a_ops->direct_IO) &&
|
2008-04-28 11:13:02 +02:00
|
|
|
(!f->f_mapping->a_ops->get_xip_mem))) {
|
2005-04-17 00:20:36 +02:00
|
|
|
fput(f);
|
|
|
|
f = ERR_PTR(-EINVAL);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return f;
|
|
|
|
|
|
|
|
cleanup_all:
|
|
|
|
fops_put(f->f_op);
|
2008-02-15 23:37:48 +01:00
|
|
|
if (f->f_mode & FMODE_WRITE) {
|
2005-04-17 00:20:36 +02:00
|
|
|
put_write_access(inode);
|
2008-02-15 23:38:01 +01:00
|
|
|
if (!special_file(inode->i_mode)) {
|
|
|
|
/*
|
|
|
|
* We don't consider this a real
|
|
|
|
* mnt_want/drop_write() pair
|
|
|
|
* because it all happenend right
|
|
|
|
* here, so just reset the state.
|
|
|
|
*/
|
|
|
|
file_reset_write(f);
|
2008-02-15 23:37:48 +01:00
|
|
|
mnt_drop_write(mnt);
|
2008-02-15 23:38:01 +01:00
|
|
|
}
|
2008-02-15 23:37:48 +01:00
|
|
|
}
|
2005-04-17 00:20:36 +02:00
|
|
|
file_kill(f);
|
2006-12-08 11:36:35 +01:00
|
|
|
f->f_path.dentry = NULL;
|
|
|
|
f->f_path.mnt = NULL;
|
2005-04-17 00:20:36 +02:00
|
|
|
cleanup_file:
|
|
|
|
put_filp(f);
|
|
|
|
dput(dentry);
|
|
|
|
mntput(mnt);
|
|
|
|
return ERR_PTR(error);
|
|
|
|
}
|
|
|
|
|
2005-10-18 23:20:16 +02:00
|
|
|
/**
|
|
|
|
* lookup_instantiate_filp - instantiates the open intent filp
|
|
|
|
* @nd: pointer to nameidata
|
|
|
|
* @dentry: pointer to dentry
|
|
|
|
* @open: open callback
|
|
|
|
*
|
|
|
|
* Helper for filesystems that want to use lookup open intents and pass back
|
|
|
|
* a fully instantiated struct file to the caller.
|
|
|
|
* This function is meant to be called from within a filesystem's
|
|
|
|
* lookup method.
|
2006-03-25 12:07:02 +01:00
|
|
|
* Beware of calling it for non-regular files! Those ->open methods might block
|
|
|
|
* (e.g. in fifo_open), leaving you with parent locked (and in case of fifo,
|
|
|
|
* leading to a deadlock, as nobody can open that fifo anymore, because
|
|
|
|
* another process to open fifo will block on locked parent when doing lookup).
|
2005-10-18 23:20:16 +02:00
|
|
|
* Note that in case of error, nd->intent.open.file is destroyed, but the
|
|
|
|
* path information remains valid.
|
|
|
|
* If the open callback is set to NULL, then the standard f_op->open()
|
|
|
|
* filesystem callback is substituted.
|
|
|
|
*/
|
|
|
|
struct file *lookup_instantiate_filp(struct nameidata *nd, struct dentry *dentry,
|
|
|
|
int (*open)(struct inode *, struct file *))
|
|
|
|
{
|
|
|
|
if (IS_ERR(nd->intent.open.file))
|
|
|
|
goto out;
|
|
|
|
if (IS_ERR(dentry))
|
|
|
|
goto out_err;
|
2008-02-15 04:34:32 +01:00
|
|
|
nd->intent.open.file = __dentry_open(dget(dentry), mntget(nd->path.mnt),
|
2005-10-18 23:20:16 +02:00
|
|
|
nd->intent.open.flags - 1,
|
|
|
|
nd->intent.open.file,
|
|
|
|
open);
|
|
|
|
out:
|
|
|
|
return nd->intent.open.file;
|
|
|
|
out_err:
|
|
|
|
release_open_intent(nd);
|
|
|
|
nd->intent.open.file = (struct file *)dentry;
|
|
|
|
goto out;
|
|
|
|
}
|
|
|
|
EXPORT_SYMBOL_GPL(lookup_instantiate_filp);
|
|
|
|
|
|
|
|
/**
|
|
|
|
* nameidata_to_filp - convert a nameidata to an open filp.
|
|
|
|
* @nd: pointer to nameidata
|
|
|
|
* @flags: open flags
|
|
|
|
*
|
|
|
|
* Note that this function destroys the original nameidata
|
|
|
|
*/
|
|
|
|
struct file *nameidata_to_filp(struct nameidata *nd, int flags)
|
|
|
|
{
|
|
|
|
struct file *filp;
|
|
|
|
|
|
|
|
/* Pick up the filp from the open intent */
|
|
|
|
filp = nd->intent.open.file;
|
|
|
|
/* Has the filesystem initialised the file for us? */
|
2006-12-08 11:36:35 +01:00
|
|
|
if (filp->f_path.dentry == NULL)
|
2008-02-15 04:34:32 +01:00
|
|
|
filp = __dentry_open(nd->path.dentry, nd->path.mnt, flags, filp,
|
|
|
|
NULL);
|
2005-10-18 23:20:16 +02:00
|
|
|
else
|
2008-02-15 04:34:35 +01:00
|
|
|
path_put(&nd->path);
|
2005-10-18 23:20:16 +02:00
|
|
|
return filp;
|
|
|
|
}
|
|
|
|
|
2005-11-07 09:59:42 +01:00
|
|
|
/*
|
|
|
|
* dentry_open() will have done dput(dentry) and mntput(mnt) if it returns an
|
|
|
|
* error.
|
|
|
|
*/
|
[PATCH] open returns ENFILE but creates file anyway
When open(O_CREAT) is called and the error, ENFILE, is returned, the file
may be created anyway. This is counter intuitive, against the SUS V3
specification, and may cause applications to misbehave if they are not
coded correctly to handle this semantic. The SUS V3 specification
explicitly states "No files shall be created or modified if the function
returns -1.".
The error, ENFILE, is used to indicate the system wide open file table is
full and no more file structs can be allocated.
This is due to an ordering problem. The entry in the directory is created
before the file struct is allocated. If the allocation for the file struct
fails, then the system call must return an error, but the directory entry
was already created and can not be safely removed.
The solution to this situation is relatively easy. The file struct should
be allocated before the directory entry is created. If the allocation
fails, then the error can be returned directly. If the creation of the
directory entry fails, then the file struct can be easily freed.
Signed-off-by: Peter Staubach <staubach@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-09-13 10:25:12 +02:00
|
|
|
struct file *dentry_open(struct dentry *dentry, struct vfsmount *mnt, int flags)
|
|
|
|
{
|
|
|
|
int error;
|
|
|
|
struct file *f;
|
|
|
|
|
2008-02-15 23:37:24 +01:00
|
|
|
/*
|
|
|
|
* We must always pass in a valid mount pointer. Historically
|
|
|
|
* callers got away with not passing it, but we must enforce this at
|
|
|
|
* the earliest possible point now to avoid strange problems deep in the
|
|
|
|
* filesystem stack.
|
|
|
|
*/
|
|
|
|
if (!mnt) {
|
|
|
|
printk(KERN_WARNING "%s called with NULL vfsmount\n", __func__);
|
|
|
|
dump_stack();
|
|
|
|
return ERR_PTR(-EINVAL);
|
|
|
|
}
|
|
|
|
|
[PATCH] open returns ENFILE but creates file anyway
When open(O_CREAT) is called and the error, ENFILE, is returned, the file
may be created anyway. This is counter intuitive, against the SUS V3
specification, and may cause applications to misbehave if they are not
coded correctly to handle this semantic. The SUS V3 specification
explicitly states "No files shall be created or modified if the function
returns -1.".
The error, ENFILE, is used to indicate the system wide open file table is
full and no more file structs can be allocated.
This is due to an ordering problem. The entry in the directory is created
before the file struct is allocated. If the allocation for the file struct
fails, then the system call must return an error, but the directory entry
was already created and can not be safely removed.
The solution to this situation is relatively easy. The file struct should
be allocated before the directory entry is created. If the allocation
fails, then the error can be returned directly. If the creation of the
directory entry fails, then the file struct can be easily freed.
Signed-off-by: Peter Staubach <staubach@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-09-13 10:25:12 +02:00
|
|
|
error = -ENFILE;
|
|
|
|
f = get_empty_filp();
|
2005-11-07 09:59:42 +01:00
|
|
|
if (f == NULL) {
|
|
|
|
dput(dentry);
|
|
|
|
mntput(mnt);
|
[PATCH] open returns ENFILE but creates file anyway
When open(O_CREAT) is called and the error, ENFILE, is returned, the file
may be created anyway. This is counter intuitive, against the SUS V3
specification, and may cause applications to misbehave if they are not
coded correctly to handle this semantic. The SUS V3 specification
explicitly states "No files shall be created or modified if the function
returns -1.".
The error, ENFILE, is used to indicate the system wide open file table is
full and no more file structs can be allocated.
This is due to an ordering problem. The entry in the directory is created
before the file struct is allocated. If the allocation for the file struct
fails, then the system call must return an error, but the directory entry
was already created and can not be safely removed.
The solution to this situation is relatively easy. The file struct should
be allocated before the directory entry is created. If the allocation
fails, then the error can be returned directly. If the creation of the
directory entry fails, then the file struct can be easily freed.
Signed-off-by: Peter Staubach <staubach@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-09-13 10:25:12 +02:00
|
|
|
return ERR_PTR(error);
|
2005-11-07 09:59:42 +01:00
|
|
|
}
|
[PATCH] open returns ENFILE but creates file anyway
When open(O_CREAT) is called and the error, ENFILE, is returned, the file
may be created anyway. This is counter intuitive, against the SUS V3
specification, and may cause applications to misbehave if they are not
coded correctly to handle this semantic. The SUS V3 specification
explicitly states "No files shall be created or modified if the function
returns -1.".
The error, ENFILE, is used to indicate the system wide open file table is
full and no more file structs can be allocated.
This is due to an ordering problem. The entry in the directory is created
before the file struct is allocated. If the allocation for the file struct
fails, then the system call must return an error, but the directory entry
was already created and can not be safely removed.
The solution to this situation is relatively easy. The file struct should
be allocated before the directory entry is created. If the allocation
fails, then the error can be returned directly. If the creation of the
directory entry fails, then the file struct can be easily freed.
Signed-off-by: Peter Staubach <staubach@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-09-13 10:25:12 +02:00
|
|
|
|
2005-10-18 23:20:16 +02:00
|
|
|
return __dentry_open(dentry, mnt, flags, f, NULL);
|
[PATCH] open returns ENFILE but creates file anyway
When open(O_CREAT) is called and the error, ENFILE, is returned, the file
may be created anyway. This is counter intuitive, against the SUS V3
specification, and may cause applications to misbehave if they are not
coded correctly to handle this semantic. The SUS V3 specification
explicitly states "No files shall be created or modified if the function
returns -1.".
The error, ENFILE, is used to indicate the system wide open file table is
full and no more file structs can be allocated.
This is due to an ordering problem. The entry in the directory is created
before the file struct is allocated. If the allocation for the file struct
fails, then the system call must return an error, but the directory entry
was already created and can not be safely removed.
The solution to this situation is relatively easy. The file struct should
be allocated before the directory entry is created. If the allocation
fails, then the error can be returned directly. If the creation of the
directory entry fails, then the file struct can be easily freed.
Signed-off-by: Peter Staubach <staubach@redhat.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2005-09-13 10:25:12 +02:00
|
|
|
}
|
2005-04-17 00:20:36 +02:00
|
|
|
EXPORT_SYMBOL(dentry_open);
|
|
|
|
|
2006-01-08 10:05:20 +01:00
|
|
|
static void __put_unused_fd(struct files_struct *files, unsigned int fd)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
2005-09-09 22:04:10 +02:00
|
|
|
struct fdtable *fdt = files_fdtable(files);
|
|
|
|
__FD_CLR(fd, fdt->open_fds);
|
[PATCH] Shrinks sizeof(files_struct) and better layout
1) Reduce the size of (struct fdtable) to exactly 64 bytes on 32bits
platforms, lowering kmalloc() allocated space by 50%.
2) Reduce the size of (files_struct), using a special 32 bits (or
64bits) embedded_fd_set, instead of a 1024 bits fd_set for the
close_on_exec_init and open_fds_init fields. This save some ram (248
bytes per task) as most tasks dont open more than 32 files. D-Cache
footprint for such tasks is also reduced to the minimum.
3) Reduce size of allocated fdset. Currently two full pages are
allocated, that is 32768 bits on x86 for example, and way too much. The
minimum is now L1_CACHE_BYTES.
UP and SMP should benefit from this patch, because most tasks will touch
only one cache line when open()/close() stdin/stdout/stderr (0/1/2),
(next_fd, close_on_exec_init, open_fds_init, fd_array[0 .. 2] being in the
same cache line)
Signed-off-by: Eric Dumazet <dada1@cosmosbay.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
2006-03-23 12:00:12 +01:00
|
|
|
if (fd < files->next_fd)
|
|
|
|
files->next_fd = fd;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
2008-02-08 13:19:52 +01:00
|
|
|
void put_unused_fd(unsigned int fd)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
|
|
|
struct files_struct *files = current->files;
|
|
|
|
spin_lock(&files->file_lock);
|
|
|
|
__put_unused_fd(files, fd);
|
|
|
|
spin_unlock(&files->file_lock);
|
|
|
|
}
|
|
|
|
|
|
|
|
EXPORT_SYMBOL(put_unused_fd);
|
|
|
|
|
|
|
|
/*
|
2006-01-19 02:43:53 +01:00
|
|
|
* Install a file pointer in the fd array.
|
2005-04-17 00:20:36 +02:00
|
|
|
*
|
|
|
|
* The VFS is full of places where we drop the files lock between
|
|
|
|
* setting the open_fds bitmap and installing the file in the file
|
|
|
|
* array. At any such point, we are vulnerable to a dup2() race
|
|
|
|
* installing a file in the array before us. We need to detect this and
|
|
|
|
* fput() the struct file we are about to overwrite in this case.
|
|
|
|
*
|
|
|
|
* It should never happen - if we allow dup2() do it, _really_ bad things
|
|
|
|
* will follow.
|
|
|
|
*/
|
|
|
|
|
2008-02-08 13:19:52 +01:00
|
|
|
void fd_install(unsigned int fd, struct file *file)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
|
|
|
struct files_struct *files = current->files;
|
2005-09-09 22:04:10 +02:00
|
|
|
struct fdtable *fdt;
|
2005-04-17 00:20:36 +02:00
|
|
|
spin_lock(&files->file_lock);
|
2005-09-09 22:04:10 +02:00
|
|
|
fdt = files_fdtable(files);
|
2005-09-09 22:04:13 +02:00
|
|
|
BUG_ON(fdt->fd[fd] != NULL);
|
|
|
|
rcu_assign_pointer(fdt->fd[fd], file);
|
2005-04-17 00:20:36 +02:00
|
|
|
spin_unlock(&files->file_lock);
|
|
|
|
}
|
|
|
|
|
|
|
|
EXPORT_SYMBOL(fd_install);
|
|
|
|
|
2006-01-19 02:43:53 +01:00
|
|
|
long do_sys_open(int dfd, const char __user *filename, int flags, int mode)
|
2005-04-17 00:20:36 +02:00
|
|
|
{
|
2005-09-07 00:18:25 +02:00
|
|
|
char *tmp = getname(filename);
|
|
|
|
int fd = PTR_ERR(tmp);
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
if (!IS_ERR(tmp)) {
|
Introduce O_CLOEXEC
The problem is as follows: in multi-threaded code (or more correctly: all
code using clone() with CLONE_FILES) we have a race when exec'ing.
thread #1 thread #2
fd=open()
fork + exec
fcntl(fd,F_SETFD,FD_CLOEXEC)
In some applications this can happen frequently. Take a web browser. One
thread opens a file and another thread starts, say, an external PDF viewer.
The result can even be a security issue if that open file descriptor
refers to a sensitive file and the external program can somehow be tricked
into using that descriptor.
Just adding O_CLOEXEC support to open() doesn't solve the whole set of
problems. There are other ways to create file descriptors (socket,
epoll_create, Unix domain socket transfer, etc). These can and should be
addressed separately though. open() is such an easy case that it makes not
much sense putting the fix off.
The test program:
#include <errno.h>
#include <fcntl.h>
#include <stdio.h>
#include <unistd.h>
#ifndef O_CLOEXEC
# define O_CLOEXEC 02000000
#endif
int
main (int argc, char *argv[])
{
int fd;
if (argc > 1)
{
fd = atol (argv[1]);
printf ("child: fd = %d\n", fd);
if (fcntl (fd, F_GETFD) == 0 || errno != EBADF)
{
puts ("file descriptor valid in child");
return 1;
}
return 0;
}
fd = open ("/proc/self/exe", O_RDONLY | O_CLOEXEC);
printf ("in parent: new fd = %d\n", fd);
char buf[20];
snprintf (buf, sizeof (buf), "%d", fd);
execl ("/proc/self/exe", argv[0], buf, NULL);
puts ("execl failed");
return 1;
}
[kyle@parisc-linux.org: parisc fix]
Signed-off-by: Ulrich Drepper <drepper@redhat.com>
Acked-by: Ingo Molnar <mingo@elte.hu>
Cc: Davide Libenzi <davidel@xmailserver.org>
Cc: Michael Kerrisk <mtk-manpages@gmx.net>
Cc: Chris Zankel <chris@zankel.net>
Signed-off-by: Kyle McMartin <kyle@parisc-linux.org>
Acked-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-07-16 08:40:32 +02:00
|
|
|
fd = get_unused_fd_flags(flags);
|
2005-04-17 00:20:36 +02:00
|
|
|
if (fd >= 0) {
|
2006-01-19 02:43:53 +01:00
|
|
|
struct file *f = do_filp_open(dfd, tmp, flags, mode);
|
2005-06-23 09:10:33 +02:00
|
|
|
if (IS_ERR(f)) {
|
|
|
|
put_unused_fd(fd);
|
|
|
|
fd = PTR_ERR(f);
|
|
|
|
} else {
|
2006-12-08 11:36:35 +01:00
|
|
|
fsnotify_open(f->f_path.dentry);
|
2005-06-23 09:10:33 +02:00
|
|
|
fd_install(fd, f);
|
|
|
|
}
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
putname(tmp);
|
|
|
|
}
|
|
|
|
return fd;
|
|
|
|
}
|
2005-09-07 00:18:25 +02:00
|
|
|
|
|
|
|
asmlinkage long sys_open(const char __user *filename, int flags, int mode)
|
|
|
|
{
|
2006-04-18 22:22:59 +02:00
|
|
|
long ret;
|
|
|
|
|
2005-09-07 00:18:25 +02:00
|
|
|
if (force_o_largefile())
|
|
|
|
flags |= O_LARGEFILE;
|
|
|
|
|
2006-04-18 22:22:59 +02:00
|
|
|
ret = do_sys_open(AT_FDCWD, filename, flags, mode);
|
|
|
|
/* avoid REGPARM breakage on x86: */
|
2008-04-11 00:37:38 +02:00
|
|
|
asmlinkage_protect(3, ret, filename, flags, mode);
|
2006-04-18 22:22:59 +02:00
|
|
|
return ret;
|
2005-09-07 00:18:25 +02:00
|
|
|
}
|
2005-04-17 00:20:36 +02:00
|
|
|
|
2006-01-19 02:43:53 +01:00
|
|
|
asmlinkage long sys_openat(int dfd, const char __user *filename, int flags,
|
|
|
|
int mode)
|
|
|
|
{
|
2006-04-18 22:22:59 +02:00
|
|
|
long ret;
|
|
|
|
|
2006-01-19 02:43:53 +01:00
|
|
|
if (force_o_largefile())
|
|
|
|
flags |= O_LARGEFILE;
|
|
|
|
|
2006-04-18 22:22:59 +02:00
|
|
|
ret = do_sys_open(dfd, filename, flags, mode);
|
|
|
|
/* avoid REGPARM breakage on x86: */
|
2008-04-11 00:37:38 +02:00
|
|
|
asmlinkage_protect(4, ret, dfd, filename, flags, mode);
|
2006-04-18 22:22:59 +02:00
|
|
|
return ret;
|
2006-01-19 02:43:53 +01:00
|
|
|
}
|
|
|
|
|
2005-04-17 00:20:36 +02:00
|
|
|
#ifndef __alpha__
|
|
|
|
|
|
|
|
/*
|
|
|
|
* For backward compatibility? Maybe this should be moved
|
|
|
|
* into arch/i386 instead?
|
|
|
|
*/
|
|
|
|
asmlinkage long sys_creat(const char __user * pathname, int mode)
|
|
|
|
{
|
|
|
|
return sys_open(pathname, O_CREAT | O_WRONLY | O_TRUNC, mode);
|
|
|
|
}
|
|
|
|
|
|
|
|
#endif
|
|
|
|
|
|
|
|
/*
|
|
|
|
* "id" is the POSIX thread ID. We use the
|
|
|
|
* files pointer for this..
|
|
|
|
*/
|
|
|
|
int filp_close(struct file *filp, fl_owner_t id)
|
|
|
|
{
|
2005-06-23 09:10:17 +02:00
|
|
|
int retval = 0;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
if (!file_count(filp)) {
|
|
|
|
printk(KERN_ERR "VFS: Close: file count is 0\n");
|
2005-06-23 09:10:17 +02:00
|
|
|
return 0;
|
2005-04-17 00:20:36 +02:00
|
|
|
}
|
|
|
|
|
2005-06-23 09:10:17 +02:00
|
|
|
if (filp->f_op && filp->f_op->flush)
|
2006-06-23 11:05:12 +02:00
|
|
|
retval = filp->f_op->flush(filp, id);
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
dnotify_flush(filp, id);
|
|
|
|
locks_remove_posix(filp, id);
|
|
|
|
fput(filp);
|
|
|
|
return retval;
|
|
|
|
}
|
|
|
|
|
|
|
|
EXPORT_SYMBOL(filp_close);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Careful here! We test whether the file pointer is NULL before
|
|
|
|
* releasing the fd. This ensures that one clone task can't release
|
|
|
|
* an fd while another clone is opening it.
|
|
|
|
*/
|
|
|
|
asmlinkage long sys_close(unsigned int fd)
|
|
|
|
{
|
|
|
|
struct file * filp;
|
|
|
|
struct files_struct *files = current->files;
|
2005-09-09 22:04:10 +02:00
|
|
|
struct fdtable *fdt;
|
2006-09-29 11:00:13 +02:00
|
|
|
int retval;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
spin_lock(&files->file_lock);
|
2005-09-09 22:04:10 +02:00
|
|
|
fdt = files_fdtable(files);
|
|
|
|
if (fd >= fdt->max_fds)
|
2005-04-17 00:20:36 +02:00
|
|
|
goto out_unlock;
|
2005-09-09 22:04:10 +02:00
|
|
|
filp = fdt->fd[fd];
|
2005-04-17 00:20:36 +02:00
|
|
|
if (!filp)
|
|
|
|
goto out_unlock;
|
2005-09-09 22:04:13 +02:00
|
|
|
rcu_assign_pointer(fdt->fd[fd], NULL);
|
2005-09-09 22:04:10 +02:00
|
|
|
FD_CLR(fd, fdt->close_on_exec);
|
2005-04-17 00:20:36 +02:00
|
|
|
__put_unused_fd(files, fd);
|
|
|
|
spin_unlock(&files->file_lock);
|
2006-09-29 11:00:13 +02:00
|
|
|
retval = filp_close(filp, files);
|
|
|
|
|
|
|
|
/* can't restart close syscall because file table entry was cleared */
|
|
|
|
if (unlikely(retval == -ERESTARTSYS ||
|
|
|
|
retval == -ERESTARTNOINTR ||
|
|
|
|
retval == -ERESTARTNOHAND ||
|
|
|
|
retval == -ERESTART_RESTARTBLOCK))
|
|
|
|
retval = -EINTR;
|
|
|
|
|
|
|
|
return retval;
|
2005-04-17 00:20:36 +02:00
|
|
|
|
|
|
|
out_unlock:
|
|
|
|
spin_unlock(&files->file_lock);
|
|
|
|
return -EBADF;
|
|
|
|
}
|
|
|
|
|
|
|
|
EXPORT_SYMBOL(sys_close);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* This routine simulates a hangup on the tty, to arrange that users
|
|
|
|
* are given clean terminals at login time.
|
|
|
|
*/
|
|
|
|
asmlinkage long sys_vhangup(void)
|
|
|
|
{
|
|
|
|
if (capable(CAP_SYS_TTY_CONFIG)) {
|
2008-10-13 11:40:30 +02:00
|
|
|
tty_vhangup_self();
|
2005-04-17 00:20:36 +02:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
return -EPERM;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Called when an inode is about to be open.
|
|
|
|
* We use this to disallow opening large files on 32bit systems if
|
|
|
|
* the caller didn't specify O_LARGEFILE. On 64bit systems we force
|
|
|
|
* on this flag in sys_open.
|
|
|
|
*/
|
|
|
|
int generic_file_open(struct inode * inode, struct file * filp)
|
|
|
|
{
|
|
|
|
if (!(filp->f_flags & O_LARGEFILE) && i_size_read(inode) > MAX_NON_LFS)
|
2007-10-17 08:30:22 +02:00
|
|
|
return -EOVERFLOW;
|
2005-04-17 00:20:36 +02:00
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
EXPORT_SYMBOL(generic_file_open);
|
|
|
|
|
|
|
|
/*
|
|
|
|
* This is used by subsystems that don't want seekable
|
|
|
|
* file descriptors
|
|
|
|
*/
|
|
|
|
int nonseekable_open(struct inode *inode, struct file *filp)
|
|
|
|
{
|
|
|
|
filp->f_mode &= ~(FMODE_LSEEK | FMODE_PREAD | FMODE_PWRITE);
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
EXPORT_SYMBOL(nonseekable_open);
|