VirtualFileSystem.cpp 33 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945
  1. /*
  2. * Copyright (c) 2018-2020, Andreas Kling <kling@serenityos.org>
  3. *
  4. * SPDX-License-Identifier: BSD-2-Clause
  5. */
  6. #include <AK/GenericLexer.h>
  7. #include <AK/Singleton.h>
  8. #include <AK/StringBuilder.h>
  9. #include <Kernel/API/POSIX/errno.h>
  10. #include <Kernel/Debug.h>
  11. #include <Kernel/Devices/BlockDevice.h>
  12. #include <Kernel/Devices/DeviceManagement.h>
  13. #include <Kernel/FileSystem/Custody.h>
  14. #include <Kernel/FileSystem/FileBackedFileSystem.h>
  15. #include <Kernel/FileSystem/FileSystem.h>
  16. #include <Kernel/FileSystem/OpenFileDescription.h>
  17. #include <Kernel/FileSystem/VirtualFileSystem.h>
  18. #include <Kernel/KLexicalPath.h>
  19. #include <Kernel/KSyms.h>
  20. #include <Kernel/Process.h>
  21. #include <Kernel/Sections.h>
  22. namespace Kernel {
  23. static Singleton<VirtualFileSystem> s_the;
  24. static constexpr int root_mount_flags = MS_NODEV | MS_NOSUID | MS_RDONLY;
  25. UNMAP_AFTER_INIT void VirtualFileSystem::initialize()
  26. {
  27. s_the.ensure_instance();
  28. }
  29. VirtualFileSystem& VirtualFileSystem::the()
  30. {
  31. return *s_the;
  32. }
  33. UNMAP_AFTER_INIT VirtualFileSystem::VirtualFileSystem()
  34. {
  35. }
  36. UNMAP_AFTER_INIT VirtualFileSystem::~VirtualFileSystem()
  37. {
  38. }
  39. InodeIdentifier VirtualFileSystem::root_inode_id() const
  40. {
  41. VERIFY(m_root_inode);
  42. return m_root_inode->identifier();
  43. }
  44. ErrorOr<void> VirtualFileSystem::mount(FileSystem& fs, Custody& mount_point, int flags)
  45. {
  46. return m_mounts.with_exclusive([&](auto& mounts) -> ErrorOr<void> {
  47. auto& inode = mount_point.inode();
  48. dbgln("VirtualFileSystem: Mounting {} at inode {} with flags {}",
  49. fs.class_name(),
  50. inode.identifier(),
  51. flags);
  52. // FIXME: check that this is not already a mount point
  53. Mount mount { fs, &mount_point, flags };
  54. mounts.append(move(mount));
  55. return {};
  56. });
  57. }
  58. ErrorOr<void> VirtualFileSystem::bind_mount(Custody& source, Custody& mount_point, int flags)
  59. {
  60. return m_mounts.with_exclusive([&](auto& mounts) -> ErrorOr<void> {
  61. dbgln("VirtualFileSystem: Bind-mounting inode {} at inode {}", source.inode().identifier(), mount_point.inode().identifier());
  62. // FIXME: check that this is not already a mount point
  63. Mount mount { source.inode(), mount_point, flags };
  64. mounts.append(move(mount));
  65. return {};
  66. });
  67. }
  68. ErrorOr<void> VirtualFileSystem::remount(Custody& mount_point, int new_flags)
  69. {
  70. dbgln("VirtualFileSystem: Remounting inode {}", mount_point.inode().identifier());
  71. auto* mount = find_mount_for_guest(mount_point.inode().identifier());
  72. if (!mount)
  73. return ENODEV;
  74. mount->set_flags(new_flags);
  75. return {};
  76. }
  77. ErrorOr<void> VirtualFileSystem::unmount(Inode& guest_inode)
  78. {
  79. dbgln("VirtualFileSystem: unmount called with inode {}", guest_inode.identifier());
  80. return m_mounts.with_exclusive([&](auto& mounts) -> ErrorOr<void> {
  81. for (size_t i = 0; i < mounts.size(); ++i) {
  82. auto& mount = mounts[i];
  83. if (&mount.guest() != &guest_inode)
  84. continue;
  85. TRY(mount.guest_fs().prepare_to_unmount());
  86. dbgln("VirtualFileSystem: Unmounting file system {}...", mount.guest_fs().fsid());
  87. mounts.unstable_take(i);
  88. return {};
  89. }
  90. dbgln("VirtualFileSystem: Nothing mounted on inode {}", guest_inode.identifier());
  91. return ENODEV;
  92. });
  93. }
  94. ErrorOr<void> VirtualFileSystem::mount_root(FileSystem& fs)
  95. {
  96. if (m_root_inode) {
  97. dmesgln("VirtualFileSystem: mount_root can't mount another root");
  98. return EEXIST;
  99. }
  100. Mount mount { fs, nullptr, root_mount_flags };
  101. auto& root_inode = fs.root_inode();
  102. if (!root_inode.is_directory()) {
  103. dmesgln("VirtualFileSystem: root inode ({}) for / is not a directory :(", root_inode.identifier());
  104. return ENOTDIR;
  105. }
  106. m_root_inode = root_inode;
  107. auto pseudo_path = TRY(static_cast<FileBackedFileSystem&>(fs).file_description().pseudo_path());
  108. dmesgln("VirtualFileSystem: mounted root from {} ({})", fs.class_name(), pseudo_path);
  109. m_mounts.with_exclusive([&](auto& mounts) {
  110. mounts.append(move(mount));
  111. });
  112. m_root_custody = TRY(Custody::try_create(nullptr, "", *m_root_inode, root_mount_flags));
  113. return {};
  114. }
  115. auto VirtualFileSystem::find_mount_for_host(InodeIdentifier id) -> Mount*
  116. {
  117. return m_mounts.with_exclusive([&](auto& mounts) -> Mount* {
  118. for (auto& mount : mounts) {
  119. if (mount.host() && mount.host()->identifier() == id)
  120. return &mount;
  121. }
  122. return nullptr;
  123. });
  124. }
  125. auto VirtualFileSystem::find_mount_for_guest(InodeIdentifier id) -> Mount*
  126. {
  127. return m_mounts.with_exclusive([&](auto& mounts) -> Mount* {
  128. for (auto& mount : mounts) {
  129. if (mount.guest().identifier() == id)
  130. return &mount;
  131. }
  132. return nullptr;
  133. });
  134. }
  135. bool VirtualFileSystem::is_vfs_root(InodeIdentifier inode) const
  136. {
  137. return inode == root_inode_id();
  138. }
  139. ErrorOr<void> VirtualFileSystem::traverse_directory_inode(Inode& dir_inode, Function<ErrorOr<void>(FileSystem::DirectoryEntryView const&)> callback)
  140. {
  141. return dir_inode.traverse_as_directory([&](auto& entry) -> ErrorOr<void> {
  142. InodeIdentifier resolved_inode;
  143. if (auto mount = find_mount_for_host(entry.inode))
  144. resolved_inode = mount->guest().identifier();
  145. else
  146. resolved_inode = entry.inode;
  147. // FIXME: This is now broken considering chroot and bind mounts.
  148. bool is_root_inode = dir_inode.identifier() == dir_inode.fs().root_inode().identifier();
  149. if (is_root_inode && !is_vfs_root(dir_inode.identifier()) && entry.name == "..") {
  150. auto mount = find_mount_for_guest(dir_inode.identifier());
  151. VERIFY(mount);
  152. VERIFY(mount->host());
  153. resolved_inode = mount->host()->identifier();
  154. }
  155. TRY(callback({ entry.name, resolved_inode, entry.file_type }));
  156. return {};
  157. });
  158. }
  159. ErrorOr<void> VirtualFileSystem::utime(StringView path, Custody& base, time_t atime, time_t mtime)
  160. {
  161. auto custody = TRY(resolve_path(path, base));
  162. auto& inode = custody->inode();
  163. auto& current_process = Process::current();
  164. if (!current_process.is_superuser() && inode.metadata().uid != current_process.euid())
  165. return EACCES;
  166. if (custody->is_readonly())
  167. return EROFS;
  168. TRY(inode.set_atime(atime));
  169. TRY(inode.set_mtime(mtime));
  170. return {};
  171. }
  172. ErrorOr<InodeMetadata> VirtualFileSystem::lookup_metadata(StringView path, Custody& base, int options)
  173. {
  174. auto custody = TRY(resolve_path(path, base, nullptr, options));
  175. return custody->inode().metadata();
  176. }
  177. ErrorOr<NonnullRefPtr<OpenFileDescription>> VirtualFileSystem::open(StringView path, int options, mode_t mode, Custody& base, Optional<UidAndGid> owner)
  178. {
  179. if ((options & O_CREAT) && (options & O_DIRECTORY))
  180. return EINVAL;
  181. RefPtr<Custody> parent_custody;
  182. auto custody_or_error = resolve_path(path, base, &parent_custody, options);
  183. if (custody_or_error.is_error()) {
  184. // NOTE: ENOENT with a non-null parent custody signals us that the immediate parent
  185. // of the file exists, but the file itself does not.
  186. if ((options & O_CREAT) && custody_or_error.error().code() == ENOENT && parent_custody)
  187. return create(path, options, mode, *parent_custody, move(owner));
  188. return custody_or_error.release_error();
  189. }
  190. if ((options & O_CREAT) && (options & O_EXCL))
  191. return EEXIST;
  192. auto& custody = *custody_or_error.value();
  193. auto& inode = custody.inode();
  194. auto metadata = inode.metadata();
  195. if ((options & O_DIRECTORY) && !metadata.is_directory())
  196. return ENOTDIR;
  197. bool should_truncate_file = false;
  198. auto& current_process = Process::current();
  199. if ((options & O_RDONLY) && !metadata.may_read(current_process))
  200. return EACCES;
  201. if (options & O_WRONLY) {
  202. if (!metadata.may_write(current_process))
  203. return EACCES;
  204. if (metadata.is_directory())
  205. return EISDIR;
  206. should_truncate_file = options & O_TRUNC;
  207. }
  208. if (options & O_EXEC) {
  209. if (!metadata.may_execute(current_process) || (custody.mount_flags() & MS_NOEXEC))
  210. return EACCES;
  211. }
  212. if (metadata.is_fifo()) {
  213. auto fifo = TRY(inode.fifo());
  214. if (options & O_WRONLY) {
  215. auto description = TRY(fifo->open_direction_blocking(FIFO::Direction::Writer));
  216. description->set_rw_mode(options);
  217. description->set_file_flags(options);
  218. description->set_original_inode({}, inode);
  219. return description;
  220. } else if (options & O_RDONLY) {
  221. auto description = TRY(fifo->open_direction_blocking(FIFO::Direction::Reader));
  222. description->set_rw_mode(options);
  223. description->set_file_flags(options);
  224. description->set_original_inode({}, inode);
  225. return description;
  226. }
  227. return EINVAL;
  228. }
  229. if (metadata.is_device()) {
  230. if (custody.mount_flags() & MS_NODEV)
  231. return EACCES;
  232. auto device = DeviceManagement::the().get_device(metadata.major_device, metadata.minor_device);
  233. if (device == nullptr) {
  234. return ENODEV;
  235. }
  236. auto description = TRY(device->open(options));
  237. description->set_original_inode({}, inode);
  238. description->set_original_custody({}, custody);
  239. return description;
  240. }
  241. // Check for read-only FS. Do this after handling devices, but before modifying the inode in any way.
  242. if ((options & O_WRONLY) && custody.is_readonly())
  243. return EROFS;
  244. if (should_truncate_file) {
  245. TRY(inode.truncate(0));
  246. TRY(inode.set_mtime(kgettimeofday().to_truncated_seconds()));
  247. }
  248. auto description = TRY(OpenFileDescription::try_create(custody));
  249. description->set_rw_mode(options);
  250. description->set_file_flags(options);
  251. return description;
  252. }
  253. ErrorOr<void> VirtualFileSystem::mknod(StringView path, mode_t mode, dev_t dev, Custody& base)
  254. {
  255. if (!is_regular_file(mode) && !is_block_device(mode) && !is_character_device(mode) && !is_fifo(mode) && !is_socket(mode))
  256. return EINVAL;
  257. RefPtr<Custody> parent_custody;
  258. auto existing_file_or_error = resolve_path(path, base, &parent_custody);
  259. if (!existing_file_or_error.is_error())
  260. return EEXIST;
  261. if (!parent_custody)
  262. return ENOENT;
  263. if (existing_file_or_error.error().code() != ENOENT)
  264. return existing_file_or_error.release_error();
  265. auto& parent_inode = parent_custody->inode();
  266. auto& current_process = Process::current();
  267. if (!parent_inode.metadata().may_write(current_process))
  268. return EACCES;
  269. if (parent_custody->is_readonly())
  270. return EROFS;
  271. auto basename = KLexicalPath::basename(path);
  272. dbgln_if(VFS_DEBUG, "VirtualFileSystem::mknod: '{}' mode={} dev={} in {}", basename, mode, dev, parent_inode.identifier());
  273. (void)TRY(parent_inode.create_child(basename, mode, dev, current_process.euid(), current_process.egid()));
  274. return {};
  275. }
  276. ErrorOr<NonnullRefPtr<OpenFileDescription>> VirtualFileSystem::create(StringView path, int options, mode_t mode, Custody& parent_custody, Optional<UidAndGid> owner)
  277. {
  278. auto basename = KLexicalPath::basename(path);
  279. auto parent_path = TRY(parent_custody.try_serialize_absolute_path());
  280. auto full_path = TRY(KLexicalPath::try_join(parent_path->view(), basename));
  281. TRY(validate_path_against_process_veil(full_path->view(), options));
  282. if (!is_socket(mode) && !is_fifo(mode) && !is_block_device(mode) && !is_character_device(mode)) {
  283. // Turn it into a regular file. (This feels rather hackish.)
  284. mode |= 0100000;
  285. }
  286. auto& parent_inode = parent_custody.inode();
  287. auto& current_process = Process::current();
  288. if (!parent_inode.metadata().may_write(current_process))
  289. return EACCES;
  290. if (parent_custody.is_readonly())
  291. return EROFS;
  292. dbgln_if(VFS_DEBUG, "VirtualFileSystem::create: '{}' in {}", basename, parent_inode.identifier());
  293. auto uid = owner.has_value() ? owner.value().uid : current_process.euid();
  294. auto gid = owner.has_value() ? owner.value().gid : current_process.egid();
  295. auto inode = TRY(parent_inode.create_child(basename, mode, 0, uid, gid));
  296. auto custody = TRY(Custody::try_create(&parent_custody, basename, inode, parent_custody.mount_flags()));
  297. auto description = TRY(OpenFileDescription::try_create(move(custody)));
  298. description->set_rw_mode(options);
  299. description->set_file_flags(options);
  300. return description;
  301. }
  302. ErrorOr<void> VirtualFileSystem::mkdir(StringView path, mode_t mode, Custody& base)
  303. {
  304. // Unlike in basically every other case, where it's only the last
  305. // path component (the one being created) that is allowed not to
  306. // exist, POSIX allows mkdir'ed path to have trailing slashes.
  307. // Let's handle that case by trimming any trailing slashes.
  308. path = path.trim("/"sv, TrimMode::Right);
  309. if (path.is_empty()) {
  310. // NOTE: This means the path was a series of slashes, which resolves to "/".
  311. path = "/";
  312. }
  313. RefPtr<Custody> parent_custody;
  314. auto result = resolve_path(path, base, &parent_custody);
  315. if (!result.is_error())
  316. return EEXIST;
  317. else if (!parent_custody)
  318. return result.release_error();
  319. // NOTE: If resolve_path fails with a non-null parent custody, the error should be ENOENT.
  320. VERIFY(result.error().code() == ENOENT);
  321. auto& parent_inode = parent_custody->inode();
  322. auto& current_process = Process::current();
  323. if (!parent_inode.metadata().may_write(current_process))
  324. return EACCES;
  325. if (parent_custody->is_readonly())
  326. return EROFS;
  327. auto basename = KLexicalPath::basename(path);
  328. dbgln_if(VFS_DEBUG, "VirtualFileSystem::mkdir: '{}' in {}", basename, parent_inode.identifier());
  329. (void)TRY(parent_inode.create_child(basename, S_IFDIR | mode, 0, current_process.euid(), current_process.egid()));
  330. return {};
  331. }
  332. ErrorOr<void> VirtualFileSystem::access(StringView path, int mode, Custody& base)
  333. {
  334. auto custody = TRY(resolve_path(path, base));
  335. auto& inode = custody->inode();
  336. auto metadata = inode.metadata();
  337. auto& current_process = Process::current();
  338. if (mode & R_OK) {
  339. if (!metadata.may_read(current_process))
  340. return EACCES;
  341. }
  342. if (mode & W_OK) {
  343. if (!metadata.may_write(current_process))
  344. return EACCES;
  345. if (custody->is_readonly())
  346. return EROFS;
  347. }
  348. if (mode & X_OK) {
  349. if (!metadata.may_execute(current_process))
  350. return EACCES;
  351. }
  352. return {};
  353. }
  354. ErrorOr<NonnullRefPtr<Custody>> VirtualFileSystem::open_directory(StringView path, Custody& base)
  355. {
  356. auto custody = TRY(resolve_path(path, base));
  357. auto& inode = custody->inode();
  358. if (!inode.is_directory())
  359. return ENOTDIR;
  360. if (!inode.metadata().may_execute(Process::current()))
  361. return EACCES;
  362. return custody;
  363. }
  364. ErrorOr<void> VirtualFileSystem::chmod(Custody& custody, mode_t mode)
  365. {
  366. auto& inode = custody.inode();
  367. auto& current_process = Process::current();
  368. if (current_process.euid() != inode.metadata().uid && !current_process.is_superuser())
  369. return EPERM;
  370. if (custody.is_readonly())
  371. return EROFS;
  372. // Only change the permission bits.
  373. mode = (inode.mode() & ~07777u) | (mode & 07777u);
  374. return inode.chmod(mode);
  375. }
  376. ErrorOr<void> VirtualFileSystem::chmod(StringView path, mode_t mode, Custody& base, int options)
  377. {
  378. auto custody = TRY(resolve_path(path, base, nullptr, options));
  379. return chmod(custody, mode);
  380. }
  381. ErrorOr<void> VirtualFileSystem::rename(StringView old_path, StringView new_path, Custody& base)
  382. {
  383. RefPtr<Custody> old_parent_custody;
  384. auto old_custody = TRY(resolve_path(old_path, base, &old_parent_custody, O_NOFOLLOW_NOERROR));
  385. auto& old_inode = old_custody->inode();
  386. RefPtr<Custody> new_parent_custody;
  387. auto new_custody_or_error = resolve_path(new_path, base, &new_parent_custody);
  388. if (new_custody_or_error.is_error()) {
  389. if (new_custody_or_error.error().code() != ENOENT || !new_parent_custody)
  390. return new_custody_or_error.release_error();
  391. }
  392. if (!old_parent_custody || !new_parent_custody) {
  393. return EPERM;
  394. }
  395. if (!new_custody_or_error.is_error()) {
  396. auto& new_inode = new_custody_or_error.value()->inode();
  397. if (old_inode.index() != new_inode.index() && old_inode.is_directory() && new_inode.is_directory()) {
  398. size_t child_count = 0;
  399. TRY(new_inode.traverse_as_directory([&child_count](auto&) -> ErrorOr<void> {
  400. ++child_count;
  401. return {};
  402. }));
  403. if (child_count > 2)
  404. return ENOTEMPTY;
  405. }
  406. }
  407. auto& old_parent_inode = old_parent_custody->inode();
  408. auto& new_parent_inode = new_parent_custody->inode();
  409. if (&old_parent_inode.fs() != &new_parent_inode.fs())
  410. return EXDEV;
  411. for (auto* new_ancestor = new_parent_custody.ptr(); new_ancestor; new_ancestor = new_ancestor->parent()) {
  412. if (&old_inode == &new_ancestor->inode())
  413. return EDIRINTOSELF;
  414. }
  415. auto& current_process = Process::current();
  416. if (!new_parent_inode.metadata().may_write(current_process))
  417. return EACCES;
  418. if (!old_parent_inode.metadata().may_write(current_process))
  419. return EACCES;
  420. if (old_parent_inode.metadata().is_sticky()) {
  421. if (!current_process.is_superuser() && old_inode.metadata().uid != current_process.euid())
  422. return EACCES;
  423. }
  424. if (old_parent_custody->is_readonly() || new_parent_custody->is_readonly())
  425. return EROFS;
  426. auto old_basename = KLexicalPath::basename(old_path);
  427. if (old_basename.is_empty() || old_basename == "."sv || old_basename == ".."sv)
  428. return EINVAL;
  429. auto new_basename = KLexicalPath::basename(new_path);
  430. if (new_basename.is_empty() || new_basename == "."sv || new_basename == ".."sv)
  431. return EINVAL;
  432. if (old_basename == new_basename && old_parent_inode.index() == new_parent_inode.index())
  433. return {};
  434. if (!new_custody_or_error.is_error()) {
  435. auto& new_custody = *new_custody_or_error.value();
  436. auto& new_inode = new_custody.inode();
  437. // FIXME: Is this really correct? Check what other systems do.
  438. if (&new_inode == &old_inode)
  439. return {};
  440. if (new_parent_inode.metadata().is_sticky()) {
  441. if (!current_process.is_superuser() && new_inode.metadata().uid != current_process.euid())
  442. return EACCES;
  443. }
  444. if (new_inode.is_directory() && !old_inode.is_directory())
  445. return EISDIR;
  446. TRY(new_parent_inode.remove_child(new_basename));
  447. }
  448. TRY(new_parent_inode.add_child(old_inode, new_basename, old_inode.mode()));
  449. TRY(old_parent_inode.remove_child(old_basename));
  450. return {};
  451. }
  452. ErrorOr<void> VirtualFileSystem::chown(Custody& custody, UserID a_uid, GroupID a_gid)
  453. {
  454. auto& inode = custody.inode();
  455. auto metadata = inode.metadata();
  456. auto& current_process = Process::current();
  457. if (current_process.euid() != metadata.uid && !current_process.is_superuser())
  458. return EPERM;
  459. UserID new_uid = metadata.uid;
  460. GroupID new_gid = metadata.gid;
  461. if (a_uid != (uid_t)-1) {
  462. if (current_process.euid() != a_uid && !current_process.is_superuser())
  463. return EPERM;
  464. new_uid = a_uid;
  465. }
  466. if (a_gid != (gid_t)-1) {
  467. if (!current_process.in_group(a_gid) && !current_process.is_superuser())
  468. return EPERM;
  469. new_gid = a_gid;
  470. }
  471. if (custody.is_readonly())
  472. return EROFS;
  473. dbgln_if(VFS_DEBUG, "VirtualFileSystem::chown(): inode {} <- uid={} gid={}", inode.identifier(), new_uid, new_gid);
  474. if (metadata.is_setuid() || metadata.is_setgid()) {
  475. dbgln_if(VFS_DEBUG, "VirtualFileSystem::chown(): Stripping SUID/SGID bits from {}", inode.identifier());
  476. TRY(inode.chmod(metadata.mode & ~(04000 | 02000)));
  477. }
  478. return inode.chown(new_uid, new_gid);
  479. }
  480. ErrorOr<void> VirtualFileSystem::chown(StringView path, UserID a_uid, GroupID a_gid, Custody& base, int options)
  481. {
  482. auto custody = TRY(resolve_path(path, base, nullptr, options));
  483. return chown(custody, a_uid, a_gid);
  484. }
  485. static bool hard_link_allowed(const Inode& inode)
  486. {
  487. auto metadata = inode.metadata();
  488. if (Process::current().euid() == metadata.uid)
  489. return true;
  490. if (metadata.is_regular_file()
  491. && !metadata.is_setuid()
  492. && !(metadata.is_setgid() && metadata.mode & S_IXGRP)
  493. && metadata.may_write(Process::current())) {
  494. return true;
  495. }
  496. return false;
  497. }
  498. ErrorOr<void> VirtualFileSystem::link(StringView old_path, StringView new_path, Custody& base)
  499. {
  500. auto old_custody = TRY(resolve_path(old_path, base));
  501. auto& old_inode = old_custody->inode();
  502. RefPtr<Custody> parent_custody;
  503. auto new_custody_or_error = resolve_path(new_path, base, &parent_custody);
  504. if (!new_custody_or_error.is_error())
  505. return EEXIST;
  506. if (!parent_custody)
  507. return ENOENT;
  508. auto& parent_inode = parent_custody->inode();
  509. if (parent_inode.fsid() != old_inode.fsid())
  510. return EXDEV;
  511. if (!parent_inode.metadata().may_write(Process::current()))
  512. return EACCES;
  513. if (old_inode.is_directory())
  514. return EPERM;
  515. if (parent_custody->is_readonly())
  516. return EROFS;
  517. if (!hard_link_allowed(old_inode))
  518. return EPERM;
  519. return parent_inode.add_child(old_inode, KLexicalPath::basename(new_path), old_inode.mode());
  520. }
  521. ErrorOr<void> VirtualFileSystem::unlink(StringView path, Custody& base)
  522. {
  523. RefPtr<Custody> parent_custody;
  524. auto custody = TRY(resolve_path(path, base, &parent_custody, O_NOFOLLOW_NOERROR | O_UNLINK_INTERNAL));
  525. auto& inode = custody->inode();
  526. if (inode.is_directory())
  527. return EISDIR;
  528. // We have just checked that the inode is not a directory, and thus it's not
  529. // the root. So it should have a parent. Note that this would be invalidated
  530. // if we were to support bind-mounting regular files on top of the root.
  531. VERIFY(parent_custody);
  532. auto& parent_inode = parent_custody->inode();
  533. auto& current_process = Process::current();
  534. if (!parent_inode.metadata().may_write(current_process))
  535. return EACCES;
  536. if (parent_inode.metadata().is_sticky()) {
  537. if (!current_process.is_superuser() && inode.metadata().uid != current_process.euid())
  538. return EACCES;
  539. }
  540. if (parent_custody->is_readonly())
  541. return EROFS;
  542. return parent_inode.remove_child(KLexicalPath::basename(path));
  543. }
  544. ErrorOr<void> VirtualFileSystem::symlink(StringView target, StringView linkpath, Custody& base)
  545. {
  546. RefPtr<Custody> parent_custody;
  547. auto existing_custody_or_error = resolve_path(linkpath, base, &parent_custody);
  548. if (!existing_custody_or_error.is_error())
  549. return EEXIST;
  550. if (!parent_custody)
  551. return ENOENT;
  552. if (existing_custody_or_error.is_error() && existing_custody_or_error.error().code() != ENOENT)
  553. return existing_custody_or_error.release_error();
  554. auto& parent_inode = parent_custody->inode();
  555. auto& current_process = Process::current();
  556. if (!parent_inode.metadata().may_write(current_process))
  557. return EACCES;
  558. if (parent_custody->is_readonly())
  559. return EROFS;
  560. auto basename = KLexicalPath::basename(linkpath);
  561. dbgln_if(VFS_DEBUG, "VirtualFileSystem::symlink: '{}' (-> '{}') in {}", basename, target, parent_inode.identifier());
  562. auto inode = TRY(parent_inode.create_child(basename, S_IFLNK | 0644, 0, current_process.euid(), current_process.egid()));
  563. auto target_buffer = UserOrKernelBuffer::for_kernel_buffer(const_cast<u8*>((const u8*)target.characters_without_null_termination()));
  564. TRY(inode->write_bytes(0, target.length(), target_buffer, nullptr));
  565. return {};
  566. }
  567. ErrorOr<void> VirtualFileSystem::rmdir(StringView path, Custody& base)
  568. {
  569. RefPtr<Custody> parent_custody;
  570. auto custody = TRY(resolve_path(path, base, &parent_custody));
  571. auto& inode = custody->inode();
  572. // FIXME: We should return EINVAL if the last component of the path is "."
  573. // FIXME: We should return ENOTEMPTY if the last component of the path is ".."
  574. if (!inode.is_directory())
  575. return ENOTDIR;
  576. if (!parent_custody)
  577. return EBUSY;
  578. auto& parent_inode = parent_custody->inode();
  579. auto parent_metadata = parent_inode.metadata();
  580. auto& current_process = Process::current();
  581. if (!parent_metadata.may_write(current_process))
  582. return EACCES;
  583. if (parent_metadata.is_sticky()) {
  584. if (!current_process.is_superuser() && inode.metadata().uid != current_process.euid())
  585. return EACCES;
  586. }
  587. size_t child_count = 0;
  588. TRY(inode.traverse_as_directory([&child_count](auto&) -> ErrorOr<void> {
  589. ++child_count;
  590. return {};
  591. }));
  592. if (child_count != 2)
  593. return ENOTEMPTY;
  594. if (custody->is_readonly())
  595. return EROFS;
  596. TRY(inode.remove_child("."));
  597. TRY(inode.remove_child(".."));
  598. return parent_inode.remove_child(KLexicalPath::basename(path));
  599. }
  600. void VirtualFileSystem::for_each_mount(Function<IterationDecision(Mount const&)> callback) const
  601. {
  602. m_mounts.with_shared([&](auto& mounts) {
  603. for (auto& mount : mounts) {
  604. if (callback(mount) == IterationDecision::Break)
  605. break;
  606. }
  607. });
  608. }
  609. void VirtualFileSystem::sync()
  610. {
  611. FileSystem::sync();
  612. }
  613. Custody& VirtualFileSystem::root_custody()
  614. {
  615. return *m_root_custody;
  616. }
  617. UnveilNode const& VirtualFileSystem::find_matching_unveiled_path(StringView path)
  618. {
  619. auto& current_process = Process::current();
  620. VERIFY(current_process.veil_state() != VeilState::None);
  621. auto& unveil_root = current_process.unveiled_paths();
  622. auto path_parts = KLexicalPath::parts(path);
  623. return unveil_root.traverse_until_last_accessible_node(path_parts.begin(), path_parts.end());
  624. }
  625. ErrorOr<void> VirtualFileSystem::validate_path_against_process_veil(Custody const& custody, int options)
  626. {
  627. if (Process::current().veil_state() == VeilState::None)
  628. return {};
  629. auto absolute_path = TRY(custody.try_serialize_absolute_path());
  630. return validate_path_against_process_veil(absolute_path->view(), options);
  631. }
  632. ErrorOr<void> VirtualFileSystem::validate_path_against_process_veil(StringView path, int options)
  633. {
  634. if (Process::current().veil_state() == VeilState::None)
  635. return {};
  636. if (options == O_EXEC && path == "/usr/lib/Loader.so")
  637. return {};
  638. VERIFY(path.starts_with('/'));
  639. VERIFY(!path.contains("/../"sv) && !path.ends_with("/.."sv));
  640. VERIFY(!path.contains("/./"sv) && !path.ends_with("/."sv));
  641. auto& unveiled_path = find_matching_unveiled_path(path);
  642. if (unveiled_path.permissions() == UnveilAccess::None) {
  643. dbgln("Rejecting path '{}' since it hasn't been unveiled.", path);
  644. dump_backtrace();
  645. return ENOENT;
  646. }
  647. if (options & O_CREAT) {
  648. if (!(unveiled_path.permissions() & UnveilAccess::CreateOrRemove)) {
  649. dbgln("Rejecting path '{}' since it hasn't been unveiled with 'c' permission.", path);
  650. dump_backtrace();
  651. return EACCES;
  652. }
  653. }
  654. if (options & O_UNLINK_INTERNAL) {
  655. if (!(unveiled_path.permissions() & UnveilAccess::CreateOrRemove)) {
  656. dbgln("Rejecting path '{}' for unlink since it hasn't been unveiled with 'c' permission.", path);
  657. dump_backtrace();
  658. return EACCES;
  659. }
  660. return {};
  661. }
  662. if (options & O_RDONLY) {
  663. if (options & O_DIRECTORY) {
  664. if (!(unveiled_path.permissions() & (UnveilAccess::Read | UnveilAccess::Browse))) {
  665. dbgln("Rejecting path '{}' since it hasn't been unveiled with 'r' or 'b' permissions.", path);
  666. dump_backtrace();
  667. return EACCES;
  668. }
  669. } else {
  670. if (!(unveiled_path.permissions() & UnveilAccess::Read)) {
  671. dbgln("Rejecting path '{}' since it hasn't been unveiled with 'r' permission.", path);
  672. dump_backtrace();
  673. return EACCES;
  674. }
  675. }
  676. }
  677. if (options & O_WRONLY) {
  678. if (!(unveiled_path.permissions() & UnveilAccess::Write)) {
  679. dbgln("Rejecting path '{}' since it hasn't been unveiled with 'w' permission.", path);
  680. dump_backtrace();
  681. return EACCES;
  682. }
  683. }
  684. if (options & O_EXEC) {
  685. if (!(unveiled_path.permissions() & UnveilAccess::Execute)) {
  686. dbgln("Rejecting path '{}' since it hasn't been unveiled with 'x' permission.", path);
  687. dump_backtrace();
  688. return EACCES;
  689. }
  690. }
  691. return {};
  692. }
  693. ErrorOr<NonnullRefPtr<Custody>> VirtualFileSystem::resolve_path(StringView path, Custody& base, RefPtr<Custody>* out_parent, int options, int symlink_recursion_level)
  694. {
  695. auto custody = TRY(resolve_path_without_veil(path, base, out_parent, options, symlink_recursion_level));
  696. TRY(validate_path_against_process_veil(*custody, options));
  697. return custody;
  698. }
  699. static bool safe_to_follow_symlink(const Inode& inode, const InodeMetadata& parent_metadata)
  700. {
  701. auto metadata = inode.metadata();
  702. if (Process::current().euid() == metadata.uid)
  703. return true;
  704. if (!(parent_metadata.is_sticky() && parent_metadata.mode & S_IWOTH))
  705. return true;
  706. if (metadata.uid == parent_metadata.uid)
  707. return true;
  708. return false;
  709. }
  710. ErrorOr<NonnullRefPtr<Custody>> VirtualFileSystem::resolve_path_without_veil(StringView path, Custody& base, RefPtr<Custody>* out_parent, int options, int symlink_recursion_level)
  711. {
  712. if (symlink_recursion_level >= symlink_recursion_limit)
  713. return ELOOP;
  714. if (path.is_empty())
  715. return EINVAL;
  716. GenericLexer path_lexer(path);
  717. auto& current_process = Process::current();
  718. NonnullRefPtr<Custody> custody = path[0] == '/' ? root_custody() : base;
  719. bool extra_iteration = path[path.length() - 1] == '/';
  720. while (!path_lexer.is_eof() || extra_iteration) {
  721. if (path_lexer.is_eof())
  722. extra_iteration = false;
  723. auto part = path_lexer.consume_until('/');
  724. path_lexer.consume_specific('/');
  725. Custody& parent = custody;
  726. auto parent_metadata = parent.inode().metadata();
  727. if (!parent_metadata.is_directory())
  728. return ENOTDIR;
  729. // Ensure the current user is allowed to resolve paths inside this directory.
  730. if (!parent_metadata.may_execute(current_process))
  731. return EACCES;
  732. bool have_more_parts = !path_lexer.is_eof() || extra_iteration;
  733. if (part == "..") {
  734. // If we encounter a "..", take a step back, but don't go beyond the root.
  735. if (custody->parent())
  736. custody = *custody->parent();
  737. continue;
  738. } else if (part == "." || part.is_empty()) {
  739. continue;
  740. }
  741. // Okay, let's look up this part.
  742. auto child_or_error = parent.inode().lookup(part);
  743. if (child_or_error.is_error()) {
  744. if (out_parent) {
  745. // ENOENT with a non-null parent custody signals to caller that
  746. // we found the immediate parent of the file, but the file itself
  747. // does not exist yet.
  748. *out_parent = have_more_parts ? nullptr : &parent;
  749. }
  750. return child_or_error.release_error();
  751. }
  752. auto child_inode = child_or_error.release_value();
  753. int mount_flags_for_child = parent.mount_flags();
  754. // See if there's something mounted on the child; in that case
  755. // we would need to return the guest inode, not the host inode.
  756. if (auto mount = find_mount_for_host(child_inode->identifier())) {
  757. child_inode = mount->guest();
  758. mount_flags_for_child = mount->flags();
  759. }
  760. custody = TRY(Custody::try_create(&parent, part, *child_inode, mount_flags_for_child));
  761. if (child_inode->metadata().is_symlink()) {
  762. if (!have_more_parts) {
  763. if (options & O_NOFOLLOW)
  764. return ELOOP;
  765. if (options & O_NOFOLLOW_NOERROR)
  766. break;
  767. }
  768. if (!safe_to_follow_symlink(*child_inode, parent_metadata))
  769. return EACCES;
  770. TRY(validate_path_against_process_veil(*custody, options));
  771. auto symlink_target = TRY(child_inode->resolve_as_link(parent, out_parent, options, symlink_recursion_level + 1));
  772. if (!have_more_parts)
  773. return symlink_target;
  774. // Now, resolve the remaining path relative to the symlink target.
  775. // We prepend a "." to it to ensure that it's not empty and that
  776. // any initial slashes it might have get interpreted properly.
  777. StringBuilder remaining_path;
  778. TRY(remaining_path.try_append('.'));
  779. TRY(remaining_path.try_append(path.substring_view_starting_after_substring(part)));
  780. return resolve_path_without_veil(remaining_path.string_view(), symlink_target, out_parent, options, symlink_recursion_level + 1);
  781. }
  782. }
  783. if (out_parent)
  784. *out_parent = custody->parent();
  785. return custody;
  786. }
  787. }