1 // SPDX-License-Identifier: GPL-2.0-or-later
2 /* Provide a way to create a superblock configuration context within the kernel
3 * that allows a superblock to be set up prior to mounting.
5 * Copyright (C) 2017 Red Hat, Inc. All Rights Reserved.
6 * Written by David Howells (dhowells@redhat.com)
9 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
10 #include <linux/module.h>
11 #include <linux/fs_context.h>
12 #include <linux/fs_parser.h>
14 #include <linux/mount.h>
15 #include <linux/nsproxy.h>
16 #include <linux/slab.h>
17 #include <linux/magic.h>
18 #include <linux/security.h>
19 #include <linux/mnt_namespace.h>
20 #include <linux/pid_namespace.h>
21 #include <linux/user_namespace.h>
22 #include <net/net_namespace.h>
23 #include <asm/sections.h>
27 enum legacy_fs_param {
28 LEGACY_FS_UNSET_PARAMS,
29 LEGACY_FS_MONOLITHIC_PARAMS,
30 LEGACY_FS_INDIVIDUAL_PARAMS,
33 struct legacy_fs_context {
34 char *legacy_data; /* Data page for legacy filesystems */
36 enum legacy_fs_param param_type;
39 static int legacy_init_fs_context(struct fs_context *fc);
41 static const struct constant_table common_set_sb_flag[] = {
42 { "dirsync", SB_DIRSYNC },
43 { "lazytime", SB_LAZYTIME },
44 { "mand", SB_MANDLOCK },
46 { "sync", SB_SYNCHRONOUS },
50 static const struct constant_table common_clear_sb_flag[] = {
51 { "async", SB_SYNCHRONOUS },
52 { "nolazytime", SB_LAZYTIME },
53 { "nomand", SB_MANDLOCK },
59 * Check for a common mount option that manipulates s_flags.
61 static int vfs_parse_sb_flag(struct fs_context *fc, const char *key)
65 token = lookup_constant(common_set_sb_flag, key, 0);
67 fc->sb_flags |= token;
68 fc->sb_flags_mask |= token;
72 token = lookup_constant(common_clear_sb_flag, key, 0);
74 fc->sb_flags &= ~token;
75 fc->sb_flags_mask |= token;
83 * vfs_parse_fs_param_source - Handle setting "source" via parameter
84 * @fc: The filesystem context to modify
85 * @param: The parameter
87 * This is a simple helper for filesystems to verify that the "source" they
90 * Returns 0 on success, -ENOPARAM if this is not "source" parameter, and
91 * -EINVAL otherwise. In the event of failure, supplementary error information
94 int vfs_parse_fs_param_source(struct fs_context *fc, struct fs_parameter *param)
96 if (strcmp(param->key, "source") != 0)
99 if (param->type != fs_value_is_string)
100 return invalf(fc, "Non-string source");
103 return invalf(fc, "Multiple sources");
105 fc->source = param->string;
106 param->string = NULL;
109 EXPORT_SYMBOL(vfs_parse_fs_param_source);
112 * vfs_parse_fs_param - Add a single parameter to a superblock config
113 * @fc: The filesystem context to modify
114 * @param: The parameter
116 * A single mount option in string form is applied to the filesystem context
117 * being set up. Certain standard options (for example "ro") are translated
118 * into flag bits without going to the filesystem. The active security module
119 * is allowed to observe and poach options. Any other options are passed over
120 * to the filesystem to parse.
122 * This may be called multiple times for a context.
124 * Returns 0 on success and a negative error code on failure. In the event of
125 * failure, supplementary error information may have been set.
127 int vfs_parse_fs_param(struct fs_context *fc, struct fs_parameter *param)
132 return invalf(fc, "Unnamed parameter\n");
134 ret = vfs_parse_sb_flag(fc, param->key);
135 if (ret != -ENOPARAM)
138 ret = security_fs_context_parse_param(fc, param);
139 if (ret != -ENOPARAM)
140 /* Param belongs to the LSM or is disallowed by the LSM; so
141 * don't pass to the FS.
145 if (fc->ops->parse_param) {
146 ret = fc->ops->parse_param(fc, param);
147 if (ret != -ENOPARAM)
151 /* If the filesystem doesn't take any arguments, give it the
152 * default handling of source.
154 ret = vfs_parse_fs_param_source(fc, param);
155 if (ret != -ENOPARAM)
158 return invalf(fc, "%s: Unknown parameter '%s'",
159 fc->fs_type->name, param->key);
161 EXPORT_SYMBOL(vfs_parse_fs_param);
164 * vfs_parse_fs_string - Convenience function to just parse a string.
165 * @fc: Filesystem context.
166 * @key: Parameter name.
167 * @value: Default value.
168 * @v_size: Maximum number of bytes in the value.
170 int vfs_parse_fs_string(struct fs_context *fc, const char *key,
171 const char *value, size_t v_size)
175 struct fs_parameter param = {
177 .type = fs_value_is_flag,
182 param.string = kmemdup_nul(value, v_size, GFP_KERNEL);
185 param.type = fs_value_is_string;
188 ret = vfs_parse_fs_param(fc, ¶m);
192 EXPORT_SYMBOL(vfs_parse_fs_string);
195 * generic_parse_monolithic - Parse key[=val][,key[=val]]* mount data
196 * @fc: The superblock configuration to fill in.
197 * @data: The data to parse
199 * Parse a blob of data that's in key[=val][,key[=val]]* form. This can be
200 * called from the ->monolithic_mount_data() fs_context operation.
202 * Returns 0 on success or the error returned by the ->parse_option() fs_context
203 * operation on failure.
205 int generic_parse_monolithic(struct fs_context *fc, void *data)
207 char *options = data, *key;
213 ret = security_sb_eat_lsm_opts(options, &fc->security);
217 while ((key = strsep(&options, ",")) != NULL) {
220 char *value = strchr(key, '=');
226 v_len = strlen(value);
228 ret = vfs_parse_fs_string(fc, key, value, v_len);
236 EXPORT_SYMBOL(generic_parse_monolithic);
239 * alloc_fs_context - Create a filesystem context.
240 * @fs_type: The filesystem type.
241 * @reference: The dentry from which this one derives (or NULL)
242 * @sb_flags: Filesystem/superblock flags (SB_*)
243 * @sb_flags_mask: Applicable members of @sb_flags
244 * @purpose: The purpose that this configuration shall be used for.
246 * Open a filesystem and create a mount context. The mount context is
247 * initialised with the supplied flags and, if a submount/automount from
248 * another superblock (referred to by @reference) is supplied, may have
249 * parameters such as namespaces copied across from that superblock.
251 static struct fs_context *alloc_fs_context(struct file_system_type *fs_type,
252 struct dentry *reference,
253 unsigned int sb_flags,
254 unsigned int sb_flags_mask,
255 enum fs_context_purpose purpose)
257 int (*init_fs_context)(struct fs_context *);
258 struct fs_context *fc;
261 fc = kzalloc(sizeof(struct fs_context), GFP_KERNEL_ACCOUNT);
263 return ERR_PTR(-ENOMEM);
265 fc->purpose = purpose;
266 fc->sb_flags = sb_flags;
267 fc->sb_flags_mask = sb_flags_mask;
268 fc->fs_type = get_filesystem(fs_type);
269 fc->cred = get_current_cred();
270 fc->net_ns = get_net(current->nsproxy->net_ns);
271 fc->log.prefix = fs_type->name;
273 mutex_init(&fc->uapi_mutex);
276 case FS_CONTEXT_FOR_MOUNT:
277 fc->user_ns = get_user_ns(fc->cred->user_ns);
279 case FS_CONTEXT_FOR_SUBMOUNT:
280 fc->user_ns = get_user_ns(reference->d_sb->s_user_ns);
282 case FS_CONTEXT_FOR_RECONFIGURE:
283 atomic_inc(&reference->d_sb->s_active);
284 fc->user_ns = get_user_ns(reference->d_sb->s_user_ns);
285 fc->root = dget(reference);
289 /* TODO: Make all filesystems support this unconditionally */
290 init_fs_context = fc->fs_type->init_fs_context;
291 if (!init_fs_context)
292 init_fs_context = legacy_init_fs_context;
294 ret = init_fs_context(fc);
297 fc->need_free = true;
305 struct fs_context *fs_context_for_mount(struct file_system_type *fs_type,
306 unsigned int sb_flags)
308 return alloc_fs_context(fs_type, NULL, sb_flags, 0,
309 FS_CONTEXT_FOR_MOUNT);
311 EXPORT_SYMBOL(fs_context_for_mount);
313 struct fs_context *fs_context_for_reconfigure(struct dentry *dentry,
314 unsigned int sb_flags,
315 unsigned int sb_flags_mask)
317 return alloc_fs_context(dentry->d_sb->s_type, dentry, sb_flags,
318 sb_flags_mask, FS_CONTEXT_FOR_RECONFIGURE);
320 EXPORT_SYMBOL(fs_context_for_reconfigure);
323 * fs_context_for_submount: allocate a new fs_context for a submount
324 * @type: file_system_type of the new context
325 * @reference: reference dentry from which to copy relevant info
327 * Allocate a new fs_context suitable for a submount. This also ensures that
328 * the fc->security object is inherited from @reference (if needed).
330 struct fs_context *fs_context_for_submount(struct file_system_type *type,
331 struct dentry *reference)
333 struct fs_context *fc;
336 fc = alloc_fs_context(type, reference, 0, 0, FS_CONTEXT_FOR_SUBMOUNT);
340 ret = security_fs_context_submount(fc, reference->d_sb);
348 EXPORT_SYMBOL(fs_context_for_submount);
350 void fc_drop_locked(struct fs_context *fc)
352 struct super_block *sb = fc->root->d_sb;
355 deactivate_locked_super(sb);
358 static void legacy_fs_context_free(struct fs_context *fc);
361 * vfs_dup_fs_context - Duplicate a filesystem context.
362 * @src_fc: The context to copy.
364 struct fs_context *vfs_dup_fs_context(struct fs_context *src_fc)
366 struct fs_context *fc;
369 if (!src_fc->ops->dup)
370 return ERR_PTR(-EOPNOTSUPP);
372 fc = kmemdup(src_fc, sizeof(struct fs_context), GFP_KERNEL);
374 return ERR_PTR(-ENOMEM);
376 mutex_init(&fc->uapi_mutex);
378 fc->fs_private = NULL;
379 fc->s_fs_info = NULL;
382 get_filesystem(fc->fs_type);
384 get_user_ns(fc->user_ns);
387 refcount_inc(&fc->log.log->usage);
389 /* Can't call put until we've called ->dup */
390 ret = fc->ops->dup(fc, src_fc);
394 ret = security_fs_context_dup(fc, src_fc);
403 EXPORT_SYMBOL(vfs_dup_fs_context);
406 * logfc - Log a message to a filesystem context
407 * @log: The filesystem context to log to, or NULL to use printk.
408 * @prefix: A string to prefix the output with, or NULL.
409 * @level: 'w' for a warning, 'e' for an error. Anything else is a notice.
410 * @fmt: The format of the buffer.
412 void logfc(struct fc_log *log, const char *prefix, char level, const char *fmt, ...)
415 struct va_format vaf = {.fmt = fmt, .va = &va};
421 printk(KERN_WARNING "%s%s%pV\n", prefix ? prefix : "",
422 prefix ? ": " : "", &vaf);
425 printk(KERN_ERR "%s%s%pV\n", prefix ? prefix : "",
426 prefix ? ": " : "", &vaf);
429 printk(KERN_NOTICE "%s%s%pV\n", prefix ? prefix : "",
430 prefix ? ": " : "", &vaf);
434 unsigned int logsize = ARRAY_SIZE(log->buffer);
436 char *q = kasprintf(GFP_KERNEL, "%c %s%s%pV\n", level,
437 prefix ? prefix : "",
438 prefix ? ": " : "", &vaf);
440 index = log->head & (logsize - 1);
441 BUILD_BUG_ON(sizeof(log->head) != sizeof(u8) ||
442 sizeof(log->tail) != sizeof(u8));
443 if ((u8)(log->head - log->tail) == logsize) {
444 /* The buffer is full, discard the oldest message */
445 if (log->need_free & (1 << index))
446 kfree(log->buffer[index]);
450 log->buffer[index] = q ? q : "OOM: Can't store error string";
452 log->need_free |= 1 << index;
454 log->need_free &= ~(1 << index);
459 EXPORT_SYMBOL(logfc);
462 * Free a logging structure.
464 static void put_fc_log(struct fs_context *fc)
466 struct fc_log *log = fc->log.log;
470 if (refcount_dec_and_test(&log->usage)) {
472 for (i = 0; i <= 7; i++)
473 if (log->need_free & (1 << i))
474 kfree(log->buffer[i]);
481 * put_fs_context - Dispose of a superblock configuration context.
482 * @fc: The context to dispose of.
484 void put_fs_context(struct fs_context *fc)
486 struct super_block *sb;
492 deactivate_super(sb);
495 if (fc->need_free && fc->ops && fc->ops->free)
498 security_free_mnt_opts(&fc->security);
500 put_user_ns(fc->user_ns);
503 put_filesystem(fc->fs_type);
507 EXPORT_SYMBOL(put_fs_context);
510 * Free the config for a filesystem that doesn't support fs_context.
512 static void legacy_fs_context_free(struct fs_context *fc)
514 struct legacy_fs_context *ctx = fc->fs_private;
517 if (ctx->param_type == LEGACY_FS_INDIVIDUAL_PARAMS)
518 kfree(ctx->legacy_data);
524 * Duplicate a legacy config.
526 static int legacy_fs_context_dup(struct fs_context *fc, struct fs_context *src_fc)
528 struct legacy_fs_context *ctx;
529 struct legacy_fs_context *src_ctx = src_fc->fs_private;
531 ctx = kmemdup(src_ctx, sizeof(*src_ctx), GFP_KERNEL);
535 if (ctx->param_type == LEGACY_FS_INDIVIDUAL_PARAMS) {
536 ctx->legacy_data = kmemdup(src_ctx->legacy_data,
537 src_ctx->data_size, GFP_KERNEL);
538 if (!ctx->legacy_data) {
544 fc->fs_private = ctx;
549 * Add a parameter to a legacy config. We build up a comma-separated list of
552 static int legacy_parse_param(struct fs_context *fc, struct fs_parameter *param)
554 struct legacy_fs_context *ctx = fc->fs_private;
555 unsigned int size = ctx->data_size;
559 ret = vfs_parse_fs_param_source(fc, param);
560 if (ret != -ENOPARAM)
563 if (ctx->param_type == LEGACY_FS_MONOLITHIC_PARAMS)
564 return invalf(fc, "VFS: Legacy: Can't mix monolithic and individual options");
566 switch (param->type) {
567 case fs_value_is_string:
568 len = 1 + param->size;
570 case fs_value_is_flag:
571 len += strlen(param->key);
574 return invalf(fc, "VFS: Legacy: Parameter type for '%s' not supported",
578 if (size + len + 2 > PAGE_SIZE)
579 return invalf(fc, "VFS: Legacy: Cumulative options too large");
580 if (strchr(param->key, ',') ||
581 (param->type == fs_value_is_string &&
582 memchr(param->string, ',', param->size)))
583 return invalf(fc, "VFS: Legacy: Option '%s' contained comma",
585 if (!ctx->legacy_data) {
586 ctx->legacy_data = kmalloc(PAGE_SIZE, GFP_KERNEL);
587 if (!ctx->legacy_data)
592 ctx->legacy_data[size++] = ',';
593 len = strlen(param->key);
594 memcpy(ctx->legacy_data + size, param->key, len);
596 if (param->type == fs_value_is_string) {
597 ctx->legacy_data[size++] = '=';
598 memcpy(ctx->legacy_data + size, param->string, param->size);
601 ctx->legacy_data[size] = '\0';
602 ctx->data_size = size;
603 ctx->param_type = LEGACY_FS_INDIVIDUAL_PARAMS;
608 * Add monolithic mount data.
610 static int legacy_parse_monolithic(struct fs_context *fc, void *data)
612 struct legacy_fs_context *ctx = fc->fs_private;
614 if (ctx->param_type != LEGACY_FS_UNSET_PARAMS) {
615 pr_warn("VFS: Can't mix monolithic and individual options\n");
619 ctx->legacy_data = data;
620 ctx->param_type = LEGACY_FS_MONOLITHIC_PARAMS;
621 if (!ctx->legacy_data)
624 if (fc->fs_type->fs_flags & FS_BINARY_MOUNTDATA)
626 return security_sb_eat_lsm_opts(ctx->legacy_data, &fc->security);
630 * Get a mountable root with the legacy mount command.
632 static int legacy_get_tree(struct fs_context *fc)
634 struct legacy_fs_context *ctx = fc->fs_private;
635 struct super_block *sb;
638 root = fc->fs_type->mount(fc->fs_type, fc->sb_flags,
639 fc->source, ctx->legacy_data);
641 return PTR_ERR(root);
653 static int legacy_reconfigure(struct fs_context *fc)
655 struct legacy_fs_context *ctx = fc->fs_private;
656 struct super_block *sb = fc->root->d_sb;
658 if (!sb->s_op->remount_fs)
661 return sb->s_op->remount_fs(sb, &fc->sb_flags,
662 ctx ? ctx->legacy_data : NULL);
665 const struct fs_context_operations legacy_fs_context_ops = {
666 .free = legacy_fs_context_free,
667 .dup = legacy_fs_context_dup,
668 .parse_param = legacy_parse_param,
669 .parse_monolithic = legacy_parse_monolithic,
670 .get_tree = legacy_get_tree,
671 .reconfigure = legacy_reconfigure,
675 * Initialise a legacy context for a filesystem that doesn't support
678 static int legacy_init_fs_context(struct fs_context *fc)
680 fc->fs_private = kzalloc(sizeof(struct legacy_fs_context), GFP_KERNEL_ACCOUNT);
683 fc->ops = &legacy_fs_context_ops;
687 int parse_monolithic_mount_data(struct fs_context *fc, void *data)
689 int (*monolithic_mount_data)(struct fs_context *, void *);
691 monolithic_mount_data = fc->ops->parse_monolithic;
692 if (!monolithic_mount_data)
693 monolithic_mount_data = generic_parse_monolithic;
695 return monolithic_mount_data(fc, data);
699 * Clean up a context after performing an action on it and put it into a state
700 * from where it can be used to reconfigure a superblock.
702 * Note that here we do only the parts that can't fail; the rest is in
703 * finish_clean_context() below and in between those fs_context is marked
704 * FS_CONTEXT_AWAITING_RECONF. The reason for splitup is that after
705 * successful mount or remount we need to report success to userland.
706 * Trying to do full reinit (for the sake of possible subsequent remount)
707 * and failing to allocate memory would've put us into a nasty situation.
708 * So here we only discard the old state and reinitialization is left
709 * until we actually try to reconfigure.
711 void vfs_clean_context(struct fs_context *fc)
713 if (fc->need_free && fc->ops && fc->ops->free)
715 fc->need_free = false;
716 fc->fs_private = NULL;
717 fc->s_fs_info = NULL;
719 security_free_mnt_opts(&fc->security);
722 fc->exclusive = false;
724 fc->purpose = FS_CONTEXT_FOR_RECONFIGURE;
725 fc->phase = FS_CONTEXT_AWAITING_RECONF;
728 int finish_clean_context(struct fs_context *fc)
732 if (fc->phase != FS_CONTEXT_AWAITING_RECONF)
735 if (fc->fs_type->init_fs_context)
736 error = fc->fs_type->init_fs_context(fc);
738 error = legacy_init_fs_context(fc);
739 if (unlikely(error)) {
740 fc->phase = FS_CONTEXT_FAILED;
743 fc->need_free = true;
744 fc->phase = FS_CONTEXT_RECONF_PARAMS;