Files
Ondrej Mosnacek 807cf6dc47 lsm: add backing_file LSM hooks
JIRA: https://issues.redhat.com/browse/RHEL-179443
CVE: CVE-2026-46054
Conflicts:
  - fs/backing-file.c:
    - adjust backing_file_mmap() to downstream state (missing scoped
      guards, ctx->user_file instead of missing user_file variable)
    - backing_tmpfile_open() not present downstream
  - fs/erofs/ishare.c: hunk dropped, file not present downstream
  - fs/file_table.c: context fuzz + put security_backing_file_free() in the
    right place
  - fs/fuse/passthrough.c: hunk dropped, file not present downstream
  - fs/overlayfs/dir.c: hunk dropped, ovl_create_tmpfile() not present downstream
  - fs/overlayfs/file.c: adjust to different indentation
  - include/linux/backing-file.h: backing_tmpfile_open() not present downstream
  - include/linux/lsm_hooks.h: adjust to downstream's definition of struct lsm_blob_sizes
  - security/lsm.h: hunk dropped, file not present downstream
  - security/lsm_init.c: hunk dropped, file not present downstream
  - security/security.c: misc conflicts, port changes to stuff that was
    already in lsm.h/lsm_init.c upstream

commit 6af36aeb147a06dea47c49859cd6ca5659aeb987
Author: Paul Moore <paul@paul-moore.com>
Date:   Fri Dec 19 13:18:22 2025 -0500

    lsm: add backing_file LSM hooks

    Stacked filesystems such as overlayfs do not currently provide the
    necessary mechanisms for LSMs to properly enforce access controls on the
    mmap() and mprotect() operations.  In order to resolve this gap, a LSM
    security blob is being added to the backing_file struct and the following
    new LSM hooks are being created:

     security_backing_file_alloc()
     security_backing_file_free()
     security_mmap_backing_file()

    The first two hooks are to manage the lifecycle of the LSM security blob
    in the backing_file struct, while the third provides a new mmap() access
    control point for the underlying backing file.  It is also expected that
    LSMs will likely want to update their security_file_mprotect() callback
    to address issues with their mprotect() controls, but that does not
    require a change to the security_file_mprotect() LSM hook.

    There are a three other small changes to support these new LSM hooks:
    * Pass the user file associated with a backing file down to
    alloc_empty_backing_file() so it can be included in the
    security_backing_file_alloc() hook.
    * Add getter and setter functions for the backing_file struct LSM blob
    as the backing_file struct remains private to fs/file_table.c.
    * Constify the file struct field in the LSM common_audit_data struct to
    better support LSMs that need to pass a const file struct pointer into
    the common LSM audit code.

    Thanks to Arnd Bergmann for identifying the missing EXPORT_SYMBOL_GPL()
    and supplying a fixup.

    Cc: stable@vger.kernel.org
    Cc: linux-fsdevel@vger.kernel.org
    Cc: linux-unionfs@vger.kernel.org
    Cc: linux-erofs@lists.ozlabs.org
    Reviewed-by: Amir Goldstein <amir73il@gmail.com>
    Reviewed-by: Serge Hallyn <serge@hallyn.com>
    Reviewed-by: Christian Brauner <brauner@kernel.org>
    Signed-off-by: Paul Moore <paul@paul-moore.com>

Signed-off-by: Ondrej Mosnacek <omosnace@redhat.com>
2026-06-04 21:25:40 +02:00

347 lines
8.1 KiB
C

// SPDX-License-Identifier: GPL-2.0-only
/*
* Common helpers for stackable filesystems and backing files.
*
* Forked from fs/overlayfs/file.c.
*
* Copyright (C) 2017 Red Hat, Inc.
* Copyright (C) 2023 CTERA Networks.
*/
#include <linux/fs.h>
#include <linux/backing-file.h>
#include <linux/splice.h>
#include <linux/mm.h>
#include <linux/security.h>
#include "internal.h"
/**
* backing_file_open - open a backing file for kernel internal use
* @user_path: path that the user reuqested to open
* @flags: open flags
* @real_path: path of the backing file
* @cred: credentials for open
*
* Open a backing file for a stackable filesystem (e.g., overlayfs).
* @user_path may be on the stackable filesystem and @real_path on the
* underlying filesystem. In this case, we want to be able to return the
* @user_path of the stackable filesystem. This is done by embedding the
* returned file into a container structure that also stores the stacked
* file's path, which can be retrieved using backing_file_user_path().
*/
struct file *backing_file_open(const struct file *user_file, int flags,
const struct path *real_path,
const struct cred *cred)
{
const struct path *user_path = &user_file->f_path;
struct file *f;
int error;
f = alloc_empty_backing_file(flags, cred, user_file);
if (IS_ERR(f))
return f;
path_get(user_path);
backing_file_set_user_path(f, user_path);
error = vfs_open(real_path, f);
if (error) {
fput(f);
f = ERR_PTR(error);
}
return f;
}
EXPORT_SYMBOL_GPL(backing_file_open);
struct backing_aio {
struct kiocb iocb;
refcount_t ref;
struct kiocb *orig_iocb;
/* used for aio completion */
void (*end_write)(struct file *);
struct work_struct work;
long res;
};
static struct kmem_cache *backing_aio_cachep;
#define BACKING_IOCB_MASK \
(IOCB_NOWAIT | IOCB_HIPRI | IOCB_DSYNC | IOCB_SYNC | IOCB_APPEND)
static rwf_t iocb_to_rw_flags(int flags)
{
return (__force rwf_t)(flags & BACKING_IOCB_MASK);
}
static void backing_aio_put(struct backing_aio *aio)
{
if (refcount_dec_and_test(&aio->ref)) {
fput(aio->iocb.ki_filp);
kmem_cache_free(backing_aio_cachep, aio);
}
}
static void backing_aio_cleanup(struct backing_aio *aio, long res)
{
struct kiocb *iocb = &aio->iocb;
struct kiocb *orig_iocb = aio->orig_iocb;
if (iocb->ki_flags & IOCB_WRITE)
kiocb_end_write(iocb);
if (aio->end_write)
aio->end_write(orig_iocb->ki_filp);
orig_iocb->ki_pos = iocb->ki_pos;
backing_aio_put(aio);
}
static void backing_aio_rw_complete(struct kiocb *iocb, long res)
{
struct backing_aio *aio = container_of(iocb, struct backing_aio, iocb);
struct kiocb *orig_iocb = aio->orig_iocb;
backing_aio_cleanup(aio, res);
orig_iocb->ki_complete(orig_iocb, res);
}
static void backing_aio_complete_work(struct work_struct *work)
{
struct backing_aio *aio = container_of(work, struct backing_aio, work);
backing_aio_rw_complete(&aio->iocb, aio->res);
}
static void backing_aio_queue_completion(struct kiocb *iocb, long res)
{
struct backing_aio *aio = container_of(iocb, struct backing_aio, iocb);
/*
* Punt to a work queue to serialize updates of mtime/size.
*/
aio->res = res;
INIT_WORK(&aio->work, backing_aio_complete_work);
queue_work(file_inode(aio->orig_iocb->ki_filp)->i_sb->s_dio_done_wq,
&aio->work);
}
static int backing_aio_init_wq(struct kiocb *iocb)
{
struct super_block *sb = file_inode(iocb->ki_filp)->i_sb;
if (sb->s_dio_done_wq)
return 0;
return sb_init_dio_done_wq(sb);
}
ssize_t backing_file_read_iter(struct file *file, struct iov_iter *iter,
struct kiocb *iocb, int flags,
struct backing_file_ctx *ctx)
{
struct backing_aio *aio = NULL;
const struct cred *old_cred;
ssize_t ret;
if (WARN_ON_ONCE(!(file->f_mode & FMODE_BACKING)))
return -EIO;
if (!iov_iter_count(iter))
return 0;
if (iocb->ki_flags & IOCB_DIRECT &&
!(file->f_mode & FMODE_CAN_ODIRECT))
return -EINVAL;
old_cred = override_creds(ctx->cred);
if (is_sync_kiocb(iocb)) {
rwf_t rwf = iocb_to_rw_flags(flags);
ret = vfs_iter_read(file, iter, &iocb->ki_pos, rwf);
} else {
ret = -ENOMEM;
aio = kmem_cache_zalloc(backing_aio_cachep, GFP_KERNEL);
if (!aio)
goto out;
aio->orig_iocb = iocb;
kiocb_clone(&aio->iocb, iocb, get_file(file));
aio->iocb.ki_complete = backing_aio_rw_complete;
refcount_set(&aio->ref, 2);
ret = vfs_iocb_iter_read(file, &aio->iocb, iter);
backing_aio_put(aio);
if (ret != -EIOCBQUEUED)
backing_aio_cleanup(aio, ret);
}
out:
revert_creds(old_cred);
if (ctx->accessed)
ctx->accessed(ctx->user_file);
return ret;
}
EXPORT_SYMBOL_GPL(backing_file_read_iter);
ssize_t backing_file_write_iter(struct file *file, struct iov_iter *iter,
struct kiocb *iocb, int flags,
struct backing_file_ctx *ctx)
{
const struct cred *old_cred;
ssize_t ret;
if (WARN_ON_ONCE(!(file->f_mode & FMODE_BACKING)))
return -EIO;
if (!iov_iter_count(iter))
return 0;
ret = file_remove_privs(ctx->user_file);
if (ret)
return ret;
if (iocb->ki_flags & IOCB_DIRECT &&
!(file->f_mode & FMODE_CAN_ODIRECT))
return -EINVAL;
/*
* Stacked filesystems don't support deferred completions, don't copy
* this property in case it is set by the issuer.
*/
flags &= ~IOCB_DIO_CALLER_COMP;
old_cred = override_creds(ctx->cred);
if (is_sync_kiocb(iocb)) {
rwf_t rwf = iocb_to_rw_flags(flags);
file_start_write(file);
ret = vfs_iter_write(file, iter, &iocb->ki_pos, rwf);
file_end_write(file);
if (ctx->end_write)
ctx->end_write(ctx->user_file);
} else {
struct backing_aio *aio;
ret = backing_aio_init_wq(iocb);
if (ret)
goto out;
ret = -ENOMEM;
aio = kmem_cache_zalloc(backing_aio_cachep, GFP_KERNEL);
if (!aio)
goto out;
aio->orig_iocb = iocb;
aio->end_write = ctx->end_write;
kiocb_clone(&aio->iocb, iocb, get_file(file));
aio->iocb.ki_flags = flags;
aio->iocb.ki_complete = backing_aio_queue_completion;
refcount_set(&aio->ref, 2);
kiocb_start_write(&aio->iocb);
ret = vfs_iocb_iter_write(file, &aio->iocb, iter);
backing_aio_put(aio);
if (ret != -EIOCBQUEUED)
backing_aio_cleanup(aio, ret);
}
out:
revert_creds(old_cred);
return ret;
}
EXPORT_SYMBOL_GPL(backing_file_write_iter);
ssize_t backing_file_splice_read(struct file *in, loff_t *ppos,
struct pipe_inode_info *pipe, size_t len,
unsigned int flags,
struct backing_file_ctx *ctx)
{
const struct cred *old_cred;
ssize_t ret;
if (WARN_ON_ONCE(!(in->f_mode & FMODE_BACKING)))
return -EIO;
old_cred = override_creds(ctx->cred);
ret = vfs_splice_read(in, ppos, pipe, len, flags);
revert_creds(old_cred);
if (ctx->accessed)
ctx->accessed(ctx->user_file);
return ret;
}
EXPORT_SYMBOL_GPL(backing_file_splice_read);
ssize_t backing_file_splice_write(struct pipe_inode_info *pipe,
struct file *out, loff_t *ppos, size_t len,
unsigned int flags,
struct backing_file_ctx *ctx)
{
const struct cred *old_cred;
ssize_t ret;
if (WARN_ON_ONCE(!(out->f_mode & FMODE_BACKING)))
return -EIO;
ret = file_remove_privs(ctx->user_file);
if (ret)
return ret;
old_cred = override_creds(ctx->cred);
file_start_write(out);
ret = iter_file_splice_write(pipe, out, ppos, len, flags);
file_end_write(out);
revert_creds(old_cred);
if (ctx->end_write)
ctx->end_write(ctx->user_file);
return ret;
}
EXPORT_SYMBOL_GPL(backing_file_splice_write);
int backing_file_mmap(struct file *file, struct vm_area_struct *vma,
struct backing_file_ctx *ctx)
{
const struct cred *old_cred;
int ret;
if (WARN_ON_ONCE(!(file->f_mode & FMODE_BACKING)) ||
WARN_ON_ONCE(ctx->user_file != vma->vm_file))
return -EIO;
if (!file->f_op->mmap)
return -ENODEV;
vma_set_file(vma, file);
old_cred = override_creds(ctx->cred);
ret = security_mmap_backing_file(vma, file, ctx->user_file);
if (ret) {
revert_creds(old_cred);
return ret;
}
ret = call_mmap(vma->vm_file, vma);
revert_creds(old_cred);
if (ctx->accessed)
ctx->accessed(ctx->user_file);
return ret;
}
EXPORT_SYMBOL_GPL(backing_file_mmap);
static int __init backing_aio_init(void)
{
backing_aio_cachep = kmem_cache_create("backing_aio",
sizeof(struct backing_aio),
0, SLAB_HWCACHE_ALIGN, NULL);
if (!backing_aio_cachep)
return -ENOMEM;
return 0;
}
fs_initcall(backing_aio_init);