Require X_OK on path ancestors and mountpoint gates via
inode_checkpathperm(), and use inode_checkperm() for inode mode checks.
inode_checkpathperm() takes the inode tree read lock (or INODE_CHECK_LOCKED
when the caller already holds it) and can fold a non-zero amode check onto
the target inode in the same call.
When CONFIG_FS_PERMISSION is disabled, inode_checkperm/inode_checkpathperm
are empty macros returning 0 so there is no stub .text cost.
Skip mountpoint R/W open-mode checks in inode_checkopenperm(); keep
traversal separate from open. Add an optional mountpt_operations.permission
hook (tmpfs when CONFIG_FS_PERMISSION) for in-volume DAC without making the
VFS mount-crossing path depend on it.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
Perform pseudo-filesystem permission checks inside inode_reserve() and
inode_remove() while the inode tree lock is held, and hold that lock across
pseudorename mutations so symlink swaps cannot bypass directory checks.
Hold a read lock around pseudo-fs open permission checks.
On setuid/setgid exec, update saved set-IDs, mark the task group secure,
sanitize dangerous environment variables, clear debug/dumpable flags, and
add issetugid(), secure_getenv(), and PR_SET/GET_DUMPABLE support.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
Add fs_checkmode() and fs_checkopenperm() for reuse across filesystems.
Enforce pseudoFS mode bits in inode_checkperm() and allow world-readable
open of passwd/group entries so getpwnam() works after seteuid().
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
Add pseudoFS permission enforcement for unlink(), mkdir(), and rename() VFS mutation operations.
This change validates parent-directory permissions before modifying pseudoFS inode topology and returns -EACCES for unauthorized operations.
The implementation preserves mountpoint filesystem behavior and fixes multiple inode lifetime/search-state issues in the rename path.
Signed-off-by: Abhishek Mishra <mishra.abhishek2808@gmail.com>
Most tools used for compliance and SBOM generation use SPDX identifiers
This change brings us a step closer to an easy SBOM generation.
Signed-off-by: Alin Jerpelea <alin.jerpelea@sony.com>
Example:
When executing "df -h" on Core A to view mount information, this
process will traverse inode nodes, thereby holding the inode_lock.
Since the inode type of the mount point may be rpmsgfs, it will fetch statfs
information from another Core B.
Meanwhile, rcS on Core B needs to obtain file information from Core A,
which will be achieved by fetching stat information through rpmsgfs.
When this message arrives at Core A, a deadlock can occur between Core A's
rptun ap and nsh task.
However, both of these places involve read operations only, thus a reader-writer lock
can be utilized to prevent such a deadlock.
Signed-off-by: dongjiuzhu1 <dongjiuzhu1@xiaomi.com>
Note: all attributes is guarded by PSEUDOFS_ATTRIBUTES to save the space
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
Change-Id: I664d60382e356068fd920f08aca5b4a49d8d92a9
since these function don't depend on standard input/output function
Signed-off-by: Xiang Xiao <xiaoxiang@xiaomi.com>
Change-Id: I011a387a1e2c1360e8f37716d512bd32f93ad467
Resolution of Issue 619 will require multiple steps, this part of the first step in that resolution: Every call to nxsem_wait_uninterruptible() must handle the return value from nxsem_wait_uninterruptible properly. This commit is only for those files under fs/inode. Utility functions under fs/incode were modified so the changes do extend to other fs/ sub-directories as well.
