3bd858ab1c
Introduce is_owner_or_cap() macro in fs.h, and convert over relevant users to it. This is done because we want to avoid bugs in the future where we check for only effective fsuid of the current task against a file's owning uid, without simultaneously checking for CAP_FOWNER as well, thus violating its semantics. [ XFS uses special macros and structures, and in general looked ... untouchable, so we leave it alone -- but it has been looked over. ] The (current->fsuid != inode->i_uid) check in generic_permission() and exec_permission_lite() is left alone, because those operations are covered by CAP_DAC_OVERRIDE and CAP_DAC_READ_SEARCH. Similarly operations falling under the purview of CAP_CHOWN and CAP_LEASE are also left alone. Signed-off-by: Satyam Sharma <ssatyam@cse.iitk.ac.in> Cc: Al Viro <viro@ftp.linux.org.uk> Acked-by: Serge E. Hallyn <serge@hallyn.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
120 lines
2.7 KiB
C
120 lines
2.7 KiB
C
/*
|
|
* linux/fs/ext2/ioctl.c
|
|
*
|
|
* Copyright (C) 1993, 1994, 1995
|
|
* Remy Card (card@masi.ibp.fr)
|
|
* Laboratoire MASI - Institut Blaise Pascal
|
|
* Universite Pierre et Marie Curie (Paris VI)
|
|
*/
|
|
|
|
#include "ext2.h"
|
|
#include <linux/capability.h>
|
|
#include <linux/time.h>
|
|
#include <linux/sched.h>
|
|
#include <linux/compat.h>
|
|
#include <linux/smp_lock.h>
|
|
#include <asm/current.h>
|
|
#include <asm/uaccess.h>
|
|
|
|
|
|
int ext2_ioctl (struct inode * inode, struct file * filp, unsigned int cmd,
|
|
unsigned long arg)
|
|
{
|
|
struct ext2_inode_info *ei = EXT2_I(inode);
|
|
unsigned int flags;
|
|
|
|
ext2_debug ("cmd = %u, arg = %lu\n", cmd, arg);
|
|
|
|
switch (cmd) {
|
|
case EXT2_IOC_GETFLAGS:
|
|
ext2_get_inode_flags(ei);
|
|
flags = ei->i_flags & EXT2_FL_USER_VISIBLE;
|
|
return put_user(flags, (int __user *) arg);
|
|
case EXT2_IOC_SETFLAGS: {
|
|
unsigned int oldflags;
|
|
|
|
if (IS_RDONLY(inode))
|
|
return -EROFS;
|
|
|
|
if (!is_owner_or_cap(inode))
|
|
return -EACCES;
|
|
|
|
if (get_user(flags, (int __user *) arg))
|
|
return -EFAULT;
|
|
|
|
if (!S_ISDIR(inode->i_mode))
|
|
flags &= ~EXT2_DIRSYNC_FL;
|
|
|
|
mutex_lock(&inode->i_mutex);
|
|
oldflags = ei->i_flags;
|
|
|
|
/*
|
|
* The IMMUTABLE and APPEND_ONLY flags can only be changed by
|
|
* the relevant capability.
|
|
*
|
|
* This test looks nicer. Thanks to Pauline Middelink
|
|
*/
|
|
if ((flags ^ oldflags) & (EXT2_APPEND_FL | EXT2_IMMUTABLE_FL)) {
|
|
if (!capable(CAP_LINUX_IMMUTABLE)) {
|
|
mutex_unlock(&inode->i_mutex);
|
|
return -EPERM;
|
|
}
|
|
}
|
|
|
|
flags = flags & EXT2_FL_USER_MODIFIABLE;
|
|
flags |= oldflags & ~EXT2_FL_USER_MODIFIABLE;
|
|
ei->i_flags = flags;
|
|
mutex_unlock(&inode->i_mutex);
|
|
|
|
ext2_set_inode_flags(inode);
|
|
inode->i_ctime = CURRENT_TIME_SEC;
|
|
mark_inode_dirty(inode);
|
|
return 0;
|
|
}
|
|
case EXT2_IOC_GETVERSION:
|
|
return put_user(inode->i_generation, (int __user *) arg);
|
|
case EXT2_IOC_SETVERSION:
|
|
if (!is_owner_or_cap(inode))
|
|
return -EPERM;
|
|
if (IS_RDONLY(inode))
|
|
return -EROFS;
|
|
if (get_user(inode->i_generation, (int __user *) arg))
|
|
return -EFAULT;
|
|
inode->i_ctime = CURRENT_TIME_SEC;
|
|
mark_inode_dirty(inode);
|
|
return 0;
|
|
default:
|
|
return -ENOTTY;
|
|
}
|
|
}
|
|
|
|
#ifdef CONFIG_COMPAT
|
|
long ext2_compat_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
|
|
{
|
|
struct inode *inode = file->f_path.dentry->d_inode;
|
|
int ret;
|
|
|
|
/* These are just misnamed, they actually get/put from/to user an int */
|
|
switch (cmd) {
|
|
case EXT2_IOC32_GETFLAGS:
|
|
cmd = EXT2_IOC_GETFLAGS;
|
|
break;
|
|
case EXT2_IOC32_SETFLAGS:
|
|
cmd = EXT2_IOC_SETFLAGS;
|
|
break;
|
|
case EXT2_IOC32_GETVERSION:
|
|
cmd = EXT2_IOC_GETVERSION;
|
|
break;
|
|
case EXT2_IOC32_SETVERSION:
|
|
cmd = EXT2_IOC_SETVERSION;
|
|
break;
|
|
default:
|
|
return -ENOIOCTLCMD;
|
|
}
|
|
lock_kernel();
|
|
ret = ext2_ioctl(inode, file, cmd, (unsigned long) compat_ptr(arg));
|
|
unlock_kernel();
|
|
return ret;
|
|
}
|
|
#endif
|