VirtualFileSystem.cpp 33 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592593594595596597598599600601602603604605606607608609610611612613614615616617618619620621622623624625626627628629630631632633634635636637638639640641642643644645646647648649650651652653654655656657658659660661662663664665666667668669670671672673674675676677678679680681682683684685686687688689690691692693694695696697698699700701702703704705706707708709710711712713714715716717718719720721722723724725726727728729730731732733734735736737738739740741742743744745746747748749750751752753754755756757758759760761762763764765766767768769770771772773774775776777778779780781782783784785786787788789790791792793794795796797798799800801802803804805806807808809810811812813814815816817818819820821822823824825826827828829830831832833834835836837838839840841842843844845846847848849850851852853854855856857858859860861862863864865866867868869870871872873874875876877878879880881882883884885886887888889890891892893894895896897898899900901902903904905906907908909910911912913914915916917918919920921922923924925926927928929930931932933934935936937938939940941942943944945946947948949950
  1. /*
  2. * Copyright (c) 2018-2020, Andreas Kling <kling@serenityos.org>
  3. *
  4. * SPDX-License-Identifier: BSD-2-Clause
  5. */
  6. #include <AK/GenericLexer.h>
  7. #include <AK/Singleton.h>
  8. #include <AK/StringBuilder.h>
  9. #include <Kernel/Debug.h>
  10. #include <Kernel/Devices/BlockDevice.h>
  11. #include <Kernel/Devices/DeviceManagement.h>
  12. #include <Kernel/FileSystem/Custody.h>
  13. #include <Kernel/FileSystem/FileBackedFileSystem.h>
  14. #include <Kernel/FileSystem/FileSystem.h>
  15. #include <Kernel/FileSystem/OpenFileDescription.h>
  16. #include <Kernel/FileSystem/VirtualFileSystem.h>
  17. #include <Kernel/KLexicalPath.h>
  18. #include <Kernel/KSyms.h>
  19. #include <Kernel/Process.h>
  20. #include <Kernel/Sections.h>
  21. #include <LibC/errno_numbers.h>
  22. namespace Kernel {
  23. static Singleton<VirtualFileSystem> s_the;
  24. static constexpr int symlink_recursion_limit { 5 }; // FIXME: increase?
  25. static constexpr int root_mount_flags = MS_NODEV | MS_NOSUID | MS_RDONLY;
  26. UNMAP_AFTER_INIT void VirtualFileSystem::initialize()
  27. {
  28. s_the.ensure_instance();
  29. }
  30. VirtualFileSystem& VirtualFileSystem::the()
  31. {
  32. return *s_the;
  33. }
  34. UNMAP_AFTER_INIT VirtualFileSystem::VirtualFileSystem()
  35. {
  36. }
  37. UNMAP_AFTER_INIT VirtualFileSystem::~VirtualFileSystem()
  38. {
  39. }
  40. InodeIdentifier VirtualFileSystem::root_inode_id() const
  41. {
  42. VERIFY(m_root_inode);
  43. return m_root_inode->identifier();
  44. }
  45. ErrorOr<void> VirtualFileSystem::mount(FileSystem& fs, Custody& mount_point, int flags)
  46. {
  47. return m_mounts.with_exclusive([&](auto& mounts) -> ErrorOr<void> {
  48. auto& inode = mount_point.inode();
  49. dbgln("VirtualFileSystem: Mounting {} at inode {} with flags {}",
  50. fs.class_name(),
  51. inode.identifier(),
  52. flags);
  53. // FIXME: check that this is not already a mount point
  54. Mount mount { fs, &mount_point, flags };
  55. mounts.append(move(mount));
  56. return {};
  57. });
  58. }
  59. ErrorOr<void> VirtualFileSystem::bind_mount(Custody& source, Custody& mount_point, int flags)
  60. {
  61. return m_mounts.with_exclusive([&](auto& mounts) -> ErrorOr<void> {
  62. dbgln("VirtualFileSystem: Bind-mounting inode {} at inode {}", source.inode().identifier(), mount_point.inode().identifier());
  63. // FIXME: check that this is not already a mount point
  64. Mount mount { source.inode(), mount_point, flags };
  65. mounts.append(move(mount));
  66. return {};
  67. });
  68. }
  69. ErrorOr<void> VirtualFileSystem::remount(Custody& mount_point, int new_flags)
  70. {
  71. dbgln("VirtualFileSystem: Remounting inode {}", mount_point.inode().identifier());
  72. auto* mount = find_mount_for_guest(mount_point.inode().identifier());
  73. if (!mount)
  74. return ENODEV;
  75. mount->set_flags(new_flags);
  76. return {};
  77. }
  78. ErrorOr<void> VirtualFileSystem::unmount(Inode& guest_inode)
  79. {
  80. dbgln("VirtualFileSystem: unmount called with inode {}", guest_inode.identifier());
  81. return m_mounts.with_exclusive([&](auto& mounts) -> ErrorOr<void> {
  82. for (size_t i = 0; i < mounts.size(); ++i) {
  83. auto& mount = mounts[i];
  84. if (&mount.guest() != &guest_inode)
  85. continue;
  86. TRY(mount.guest_fs().prepare_to_unmount());
  87. dbgln("VirtualFileSystem: Unmounting file system {}...", mount.guest_fs().fsid());
  88. mounts.unstable_take(i);
  89. return {};
  90. }
  91. dbgln("VirtualFileSystem: Nothing mounted on inode {}", guest_inode.identifier());
  92. return ENODEV;
  93. });
  94. }
  95. ErrorOr<void> VirtualFileSystem::mount_root(FileSystem& fs)
  96. {
  97. if (m_root_inode) {
  98. dmesgln("VirtualFileSystem: mount_root can't mount another root");
  99. return EEXIST;
  100. }
  101. Mount mount { fs, nullptr, root_mount_flags };
  102. auto& root_inode = fs.root_inode();
  103. if (!root_inode.is_directory()) {
  104. dmesgln("VirtualFileSystem: root inode ({}) for / is not a directory :(", root_inode.identifier());
  105. return ENOTDIR;
  106. }
  107. m_root_inode = root_inode;
  108. auto pseudo_path = TRY(static_cast<FileBackedFileSystem&>(fs).file_description().pseudo_path());
  109. dmesgln("VirtualFileSystem: mounted root from {} ({})", fs.class_name(), pseudo_path);
  110. m_mounts.with_exclusive([&](auto& mounts) {
  111. mounts.append(move(mount));
  112. });
  113. m_root_custody = TRY(Custody::try_create(nullptr, "", *m_root_inode, root_mount_flags));
  114. return {};
  115. }
  116. auto VirtualFileSystem::find_mount_for_host(InodeIdentifier id) -> Mount*
  117. {
  118. return m_mounts.with_exclusive([&](auto& mounts) -> Mount* {
  119. for (auto& mount : mounts) {
  120. if (mount.host() && mount.host()->identifier() == id)
  121. return &mount;
  122. }
  123. return nullptr;
  124. });
  125. }
  126. auto VirtualFileSystem::find_mount_for_guest(InodeIdentifier id) -> Mount*
  127. {
  128. return m_mounts.with_exclusive([&](auto& mounts) -> Mount* {
  129. for (auto& mount : mounts) {
  130. if (mount.guest().identifier() == id)
  131. return &mount;
  132. }
  133. return nullptr;
  134. });
  135. }
  136. bool VirtualFileSystem::is_vfs_root(InodeIdentifier inode) const
  137. {
  138. return inode == root_inode_id();
  139. }
  140. ErrorOr<void> VirtualFileSystem::traverse_directory_inode(Inode& dir_inode, Function<ErrorOr<void>(FileSystem::DirectoryEntryView const&)> callback)
  141. {
  142. return dir_inode.traverse_as_directory([&](auto& entry) -> ErrorOr<void> {
  143. InodeIdentifier resolved_inode;
  144. if (auto mount = find_mount_for_host(entry.inode))
  145. resolved_inode = mount->guest().identifier();
  146. else
  147. resolved_inode = entry.inode;
  148. // FIXME: This is now broken considering chroot and bind mounts.
  149. bool is_root_inode = dir_inode.identifier() == dir_inode.fs().root_inode().identifier();
  150. if (is_root_inode && !is_vfs_root(dir_inode.identifier()) && entry.name == "..") {
  151. auto mount = find_mount_for_guest(dir_inode.identifier());
  152. VERIFY(mount);
  153. VERIFY(mount->host());
  154. resolved_inode = mount->host()->identifier();
  155. }
  156. TRY(callback({ entry.name, resolved_inode, entry.file_type }));
  157. return {};
  158. });
  159. }
  160. ErrorOr<void> VirtualFileSystem::utime(StringView path, Custody& base, time_t atime, time_t mtime)
  161. {
  162. auto custody = TRY(resolve_path(path, base));
  163. auto& inode = custody->inode();
  164. auto& current_process = Process::current();
  165. if (!current_process.is_superuser() && inode.metadata().uid != current_process.euid())
  166. return EACCES;
  167. if (custody->is_readonly())
  168. return EROFS;
  169. TRY(inode.set_atime(atime));
  170. TRY(inode.set_mtime(mtime));
  171. return {};
  172. }
  173. ErrorOr<InodeMetadata> VirtualFileSystem::lookup_metadata(StringView path, Custody& base, int options)
  174. {
  175. auto custody = TRY(resolve_path(path, base, nullptr, options));
  176. return custody->inode().metadata();
  177. }
  178. ErrorOr<NonnullRefPtr<OpenFileDescription>> VirtualFileSystem::open(StringView path, int options, mode_t mode, Custody& base, Optional<UidAndGid> owner)
  179. {
  180. if ((options & O_CREAT) && (options & O_DIRECTORY))
  181. return EINVAL;
  182. RefPtr<Custody> parent_custody;
  183. auto custody_or_error = resolve_path(path, base, &parent_custody, options);
  184. if (custody_or_error.is_error()) {
  185. // NOTE: ENOENT with a non-null parent custody signals us that the immediate parent
  186. // of the file exists, but the file itself does not.
  187. if ((options & O_CREAT) && custody_or_error.error().code() == ENOENT && parent_custody)
  188. return create(path, options, mode, *parent_custody, move(owner));
  189. return custody_or_error.release_error();
  190. }
  191. if ((options & O_CREAT) && (options & O_EXCL))
  192. return EEXIST;
  193. auto& custody = *custody_or_error.value();
  194. auto& inode = custody.inode();
  195. auto metadata = inode.metadata();
  196. if ((options & O_DIRECTORY) && !metadata.is_directory())
  197. return ENOTDIR;
  198. bool should_truncate_file = false;
  199. auto& current_process = Process::current();
  200. if ((options & O_RDONLY) && !metadata.may_read(current_process))
  201. return EACCES;
  202. if (options & O_WRONLY) {
  203. if (!metadata.may_write(current_process))
  204. return EACCES;
  205. if (metadata.is_directory())
  206. return EISDIR;
  207. should_truncate_file = options & O_TRUNC;
  208. }
  209. if (options & O_EXEC) {
  210. if (!metadata.may_execute(current_process) || (custody.mount_flags() & MS_NOEXEC))
  211. return EACCES;
  212. }
  213. if (auto preopen_fd = inode.preopen_fd())
  214. return *preopen_fd;
  215. if (metadata.is_fifo()) {
  216. auto fifo = TRY(inode.fifo());
  217. if (options & O_WRONLY) {
  218. auto description = TRY(fifo->open_direction_blocking(FIFO::Direction::Writer));
  219. description->set_rw_mode(options);
  220. description->set_file_flags(options);
  221. description->set_original_inode({}, inode);
  222. return description;
  223. } else if (options & O_RDONLY) {
  224. auto description = TRY(fifo->open_direction_blocking(FIFO::Direction::Reader));
  225. description->set_rw_mode(options);
  226. description->set_file_flags(options);
  227. description->set_original_inode({}, inode);
  228. return description;
  229. }
  230. return EINVAL;
  231. }
  232. if (metadata.is_device()) {
  233. if (custody.mount_flags() & MS_NODEV)
  234. return EACCES;
  235. auto device = DeviceManagement::the().get_device(metadata.major_device, metadata.minor_device);
  236. if (device == nullptr) {
  237. return ENODEV;
  238. }
  239. auto description = TRY(device->open(options));
  240. description->set_original_inode({}, inode);
  241. description->set_original_custody({}, custody);
  242. return description;
  243. }
  244. // Check for read-only FS. Do this after handling preopen FD and devices,
  245. // but before modifying the inode in any way.
  246. if ((options & O_WRONLY) && custody.is_readonly())
  247. return EROFS;
  248. if (should_truncate_file) {
  249. TRY(inode.truncate(0));
  250. TRY(inode.set_mtime(kgettimeofday().to_truncated_seconds()));
  251. }
  252. auto description = TRY(OpenFileDescription::try_create(custody));
  253. description->set_rw_mode(options);
  254. description->set_file_flags(options);
  255. return description;
  256. }
  257. ErrorOr<void> VirtualFileSystem::mknod(StringView path, mode_t mode, dev_t dev, Custody& base)
  258. {
  259. if (!is_regular_file(mode) && !is_block_device(mode) && !is_character_device(mode) && !is_fifo(mode) && !is_socket(mode))
  260. return EINVAL;
  261. RefPtr<Custody> parent_custody;
  262. auto existing_file_or_error = resolve_path(path, base, &parent_custody);
  263. if (!existing_file_or_error.is_error())
  264. return EEXIST;
  265. if (!parent_custody)
  266. return ENOENT;
  267. if (existing_file_or_error.error().code() != ENOENT)
  268. return existing_file_or_error.release_error();
  269. auto& parent_inode = parent_custody->inode();
  270. auto& current_process = Process::current();
  271. if (!parent_inode.metadata().may_write(current_process))
  272. return EACCES;
  273. if (parent_custody->is_readonly())
  274. return EROFS;
  275. auto basename = KLexicalPath::basename(path);
  276. dbgln_if(VFS_DEBUG, "VirtualFileSystem::mknod: '{}' mode={} dev={} in {}", basename, mode, dev, parent_inode.identifier());
  277. (void)TRY(parent_inode.create_child(basename, mode, dev, current_process.euid(), current_process.egid()));
  278. return {};
  279. }
  280. ErrorOr<NonnullRefPtr<OpenFileDescription>> VirtualFileSystem::create(StringView path, int options, mode_t mode, Custody& parent_custody, Optional<UidAndGid> owner)
  281. {
  282. auto basename = KLexicalPath::basename(path);
  283. auto parent_path = TRY(parent_custody.try_serialize_absolute_path());
  284. auto full_path = TRY(KLexicalPath::try_join(parent_path->view(), basename));
  285. TRY(validate_path_against_process_veil(full_path->view(), options));
  286. if (!is_socket(mode) && !is_fifo(mode) && !is_block_device(mode) && !is_character_device(mode)) {
  287. // Turn it into a regular file. (This feels rather hackish.)
  288. mode |= 0100000;
  289. }
  290. auto& parent_inode = parent_custody.inode();
  291. auto& current_process = Process::current();
  292. if (!parent_inode.metadata().may_write(current_process))
  293. return EACCES;
  294. if (parent_custody.is_readonly())
  295. return EROFS;
  296. dbgln_if(VFS_DEBUG, "VirtualFileSystem::create: '{}' in {}", basename, parent_inode.identifier());
  297. auto uid = owner.has_value() ? owner.value().uid : current_process.euid();
  298. auto gid = owner.has_value() ? owner.value().gid : current_process.egid();
  299. auto inode = TRY(parent_inode.create_child(basename, mode, 0, uid, gid));
  300. auto custody = TRY(Custody::try_create(&parent_custody, basename, inode, parent_custody.mount_flags()));
  301. auto description = TRY(OpenFileDescription::try_create(move(custody)));
  302. description->set_rw_mode(options);
  303. description->set_file_flags(options);
  304. return description;
  305. }
  306. ErrorOr<void> VirtualFileSystem::mkdir(StringView path, mode_t mode, Custody& base)
  307. {
  308. // Unlike in basically every other case, where it's only the last
  309. // path component (the one being created) that is allowed not to
  310. // exist, POSIX allows mkdir'ed path to have trailing slashes.
  311. // Let's handle that case by trimming any trailing slashes.
  312. path = path.trim("/"sv, TrimMode::Right);
  313. if (path.is_empty()) {
  314. // NOTE: This means the path was a series of slashes, which resolves to "/".
  315. path = "/";
  316. }
  317. RefPtr<Custody> parent_custody;
  318. auto result = resolve_path(path, base, &parent_custody);
  319. if (!result.is_error())
  320. return EEXIST;
  321. else if (!parent_custody)
  322. return result.release_error();
  323. // NOTE: If resolve_path fails with a non-null parent custody, the error should be ENOENT.
  324. VERIFY(result.error().code() == ENOENT);
  325. auto& parent_inode = parent_custody->inode();
  326. auto& current_process = Process::current();
  327. if (!parent_inode.metadata().may_write(current_process))
  328. return EACCES;
  329. if (parent_custody->is_readonly())
  330. return EROFS;
  331. auto basename = KLexicalPath::basename(path);
  332. dbgln_if(VFS_DEBUG, "VirtualFileSystem::mkdir: '{}' in {}", basename, parent_inode.identifier());
  333. (void)TRY(parent_inode.create_child(basename, S_IFDIR | mode, 0, current_process.euid(), current_process.egid()));
  334. return {};
  335. }
  336. ErrorOr<void> VirtualFileSystem::access(StringView path, int mode, Custody& base)
  337. {
  338. auto custody = TRY(resolve_path(path, base));
  339. auto& inode = custody->inode();
  340. auto metadata = inode.metadata();
  341. auto& current_process = Process::current();
  342. if (mode & R_OK) {
  343. if (!metadata.may_read(current_process))
  344. return EACCES;
  345. }
  346. if (mode & W_OK) {
  347. if (!metadata.may_write(current_process))
  348. return EACCES;
  349. if (custody->is_readonly())
  350. return EROFS;
  351. }
  352. if (mode & X_OK) {
  353. if (!metadata.may_execute(current_process))
  354. return EACCES;
  355. }
  356. return {};
  357. }
  358. ErrorOr<NonnullRefPtr<Custody>> VirtualFileSystem::open_directory(StringView path, Custody& base)
  359. {
  360. auto custody = TRY(resolve_path(path, base));
  361. auto& inode = custody->inode();
  362. if (!inode.is_directory())
  363. return ENOTDIR;
  364. if (!inode.metadata().may_execute(Process::current()))
  365. return EACCES;
  366. return custody;
  367. }
  368. ErrorOr<void> VirtualFileSystem::chmod(Custody& custody, mode_t mode)
  369. {
  370. auto& inode = custody.inode();
  371. auto& current_process = Process::current();
  372. if (current_process.euid() != inode.metadata().uid && !current_process.is_superuser())
  373. return EPERM;
  374. if (custody.is_readonly())
  375. return EROFS;
  376. // Only change the permission bits.
  377. mode = (inode.mode() & ~07777u) | (mode & 07777u);
  378. return inode.chmod(mode);
  379. }
  380. ErrorOr<void> VirtualFileSystem::chmod(StringView path, mode_t mode, Custody& base)
  381. {
  382. auto custody = TRY(resolve_path(path, base));
  383. return chmod(custody, mode);
  384. }
  385. ErrorOr<void> VirtualFileSystem::rename(StringView old_path, StringView new_path, Custody& base)
  386. {
  387. RefPtr<Custody> old_parent_custody;
  388. auto old_custody = TRY(resolve_path(old_path, base, &old_parent_custody, O_NOFOLLOW_NOERROR));
  389. auto& old_inode = old_custody->inode();
  390. RefPtr<Custody> new_parent_custody;
  391. auto new_custody_or_error = resolve_path(new_path, base, &new_parent_custody);
  392. if (new_custody_or_error.is_error()) {
  393. if (new_custody_or_error.error().code() != ENOENT || !new_parent_custody)
  394. return new_custody_or_error.release_error();
  395. }
  396. if (!old_parent_custody || !new_parent_custody) {
  397. return EPERM;
  398. }
  399. if (!new_custody_or_error.is_error()) {
  400. auto& new_inode = new_custody_or_error.value()->inode();
  401. if (old_inode.index() != new_inode.index() && old_inode.is_directory() && new_inode.is_directory()) {
  402. size_t child_count = 0;
  403. TRY(new_inode.traverse_as_directory([&child_count](auto&) -> ErrorOr<void> {
  404. ++child_count;
  405. return {};
  406. }));
  407. if (child_count > 2)
  408. return ENOTEMPTY;
  409. }
  410. }
  411. auto& old_parent_inode = old_parent_custody->inode();
  412. auto& new_parent_inode = new_parent_custody->inode();
  413. if (&old_parent_inode.fs() != &new_parent_inode.fs())
  414. return EXDEV;
  415. for (auto* new_ancestor = new_parent_custody.ptr(); new_ancestor; new_ancestor = new_ancestor->parent()) {
  416. if (&old_inode == &new_ancestor->inode())
  417. return EDIRINTOSELF;
  418. }
  419. auto& current_process = Process::current();
  420. if (!new_parent_inode.metadata().may_write(current_process))
  421. return EACCES;
  422. if (!old_parent_inode.metadata().may_write(current_process))
  423. return EACCES;
  424. if (old_parent_inode.metadata().is_sticky()) {
  425. if (!current_process.is_superuser() && old_inode.metadata().uid != current_process.euid())
  426. return EACCES;
  427. }
  428. if (old_parent_custody->is_readonly() || new_parent_custody->is_readonly())
  429. return EROFS;
  430. auto old_basename = KLexicalPath::basename(old_path);
  431. if (old_basename.is_empty() || old_basename == "."sv || old_basename == ".."sv)
  432. return EINVAL;
  433. auto new_basename = KLexicalPath::basename(new_path);
  434. if (new_basename.is_empty() || new_basename == "."sv || new_basename == ".."sv)
  435. return EINVAL;
  436. if (old_basename == new_basename && old_parent_inode.index() == new_parent_inode.index())
  437. return {};
  438. if (!new_custody_or_error.is_error()) {
  439. auto& new_custody = *new_custody_or_error.value();
  440. auto& new_inode = new_custody.inode();
  441. // FIXME: Is this really correct? Check what other systems do.
  442. if (&new_inode == &old_inode)
  443. return {};
  444. if (new_parent_inode.metadata().is_sticky()) {
  445. if (!current_process.is_superuser() && new_inode.metadata().uid != current_process.euid())
  446. return EACCES;
  447. }
  448. if (new_inode.is_directory() && !old_inode.is_directory())
  449. return EISDIR;
  450. TRY(new_parent_inode.remove_child(new_basename));
  451. }
  452. TRY(new_parent_inode.add_child(old_inode, new_basename, old_inode.mode()));
  453. TRY(old_parent_inode.remove_child(old_basename));
  454. return {};
  455. }
  456. ErrorOr<void> VirtualFileSystem::chown(Custody& custody, UserID a_uid, GroupID a_gid)
  457. {
  458. auto& inode = custody.inode();
  459. auto metadata = inode.metadata();
  460. auto& current_process = Process::current();
  461. if (current_process.euid() != metadata.uid && !current_process.is_superuser())
  462. return EPERM;
  463. UserID new_uid = metadata.uid;
  464. GroupID new_gid = metadata.gid;
  465. if (a_uid != (uid_t)-1) {
  466. if (current_process.euid() != a_uid && !current_process.is_superuser())
  467. return EPERM;
  468. new_uid = a_uid;
  469. }
  470. if (a_gid != (gid_t)-1) {
  471. if (!current_process.in_group(a_gid) && !current_process.is_superuser())
  472. return EPERM;
  473. new_gid = a_gid;
  474. }
  475. if (custody.is_readonly())
  476. return EROFS;
  477. dbgln_if(VFS_DEBUG, "VirtualFileSystem::chown(): inode {} <- uid={} gid={}", inode.identifier(), new_uid, new_gid);
  478. if (metadata.is_setuid() || metadata.is_setgid()) {
  479. dbgln_if(VFS_DEBUG, "VirtualFileSystem::chown(): Stripping SUID/SGID bits from {}", inode.identifier());
  480. TRY(inode.chmod(metadata.mode & ~(04000 | 02000)));
  481. }
  482. return inode.chown(new_uid, new_gid);
  483. }
  484. ErrorOr<void> VirtualFileSystem::chown(StringView path, UserID a_uid, GroupID a_gid, Custody& base)
  485. {
  486. auto custody = TRY(resolve_path(path, base));
  487. return chown(custody, a_uid, a_gid);
  488. }
  489. static bool hard_link_allowed(const Inode& inode)
  490. {
  491. auto metadata = inode.metadata();
  492. if (Process::current().euid() == metadata.uid)
  493. return true;
  494. if (metadata.is_regular_file()
  495. && !metadata.is_setuid()
  496. && !(metadata.is_setgid() && metadata.mode & S_IXGRP)
  497. && metadata.may_write(Process::current())) {
  498. return true;
  499. }
  500. return false;
  501. }
  502. ErrorOr<void> VirtualFileSystem::link(StringView old_path, StringView new_path, Custody& base)
  503. {
  504. auto old_custody = TRY(resolve_path(old_path, base));
  505. auto& old_inode = old_custody->inode();
  506. RefPtr<Custody> parent_custody;
  507. auto new_custody_or_error = resolve_path(new_path, base, &parent_custody);
  508. if (!new_custody_or_error.is_error())
  509. return EEXIST;
  510. if (!parent_custody)
  511. return ENOENT;
  512. auto& parent_inode = parent_custody->inode();
  513. if (parent_inode.fsid() != old_inode.fsid())
  514. return EXDEV;
  515. if (!parent_inode.metadata().may_write(Process::current()))
  516. return EACCES;
  517. if (old_inode.is_directory())
  518. return EPERM;
  519. if (parent_custody->is_readonly())
  520. return EROFS;
  521. if (!hard_link_allowed(old_inode))
  522. return EPERM;
  523. return parent_inode.add_child(old_inode, KLexicalPath::basename(new_path), old_inode.mode());
  524. }
  525. ErrorOr<void> VirtualFileSystem::unlink(StringView path, Custody& base)
  526. {
  527. RefPtr<Custody> parent_custody;
  528. auto custody = TRY(resolve_path(path, base, &parent_custody, O_NOFOLLOW_NOERROR | O_UNLINK_INTERNAL));
  529. auto& inode = custody->inode();
  530. if (inode.is_directory())
  531. return EISDIR;
  532. // We have just checked that the inode is not a directory, and thus it's not
  533. // the root. So it should have a parent. Note that this would be invalidated
  534. // if we were to support bind-mounting regular files on top of the root.
  535. VERIFY(parent_custody);
  536. auto& parent_inode = parent_custody->inode();
  537. auto& current_process = Process::current();
  538. if (!parent_inode.metadata().may_write(current_process))
  539. return EACCES;
  540. if (parent_inode.metadata().is_sticky()) {
  541. if (!current_process.is_superuser() && inode.metadata().uid != current_process.euid())
  542. return EACCES;
  543. }
  544. if (parent_custody->is_readonly())
  545. return EROFS;
  546. return parent_inode.remove_child(KLexicalPath::basename(path));
  547. }
  548. ErrorOr<void> VirtualFileSystem::symlink(StringView target, StringView linkpath, Custody& base)
  549. {
  550. RefPtr<Custody> parent_custody;
  551. auto existing_custody_or_error = resolve_path(linkpath, base, &parent_custody);
  552. if (!existing_custody_or_error.is_error())
  553. return EEXIST;
  554. if (!parent_custody)
  555. return ENOENT;
  556. if (existing_custody_or_error.is_error() && existing_custody_or_error.error().code() != ENOENT)
  557. return existing_custody_or_error.release_error();
  558. auto& parent_inode = parent_custody->inode();
  559. auto& current_process = Process::current();
  560. if (!parent_inode.metadata().may_write(current_process))
  561. return EACCES;
  562. if (parent_custody->is_readonly())
  563. return EROFS;
  564. auto basename = KLexicalPath::basename(linkpath);
  565. dbgln_if(VFS_DEBUG, "VirtualFileSystem::symlink: '{}' (-> '{}') in {}", basename, target, parent_inode.identifier());
  566. auto inode = TRY(parent_inode.create_child(basename, S_IFLNK | 0644, 0, current_process.euid(), current_process.egid()));
  567. auto target_buffer = UserOrKernelBuffer::for_kernel_buffer(const_cast<u8*>((const u8*)target.characters_without_null_termination()));
  568. TRY(inode->write_bytes(0, target.length(), target_buffer, nullptr));
  569. return {};
  570. }
  571. ErrorOr<void> VirtualFileSystem::rmdir(StringView path, Custody& base)
  572. {
  573. RefPtr<Custody> parent_custody;
  574. auto custody = TRY(resolve_path(path, base, &parent_custody));
  575. auto& inode = custody->inode();
  576. // FIXME: We should return EINVAL if the last component of the path is "."
  577. // FIXME: We should return ENOTEMPTY if the last component of the path is ".."
  578. if (!inode.is_directory())
  579. return ENOTDIR;
  580. if (!parent_custody)
  581. return EBUSY;
  582. auto& parent_inode = parent_custody->inode();
  583. auto parent_metadata = parent_inode.metadata();
  584. auto& current_process = Process::current();
  585. if (!parent_metadata.may_write(current_process))
  586. return EACCES;
  587. if (parent_metadata.is_sticky()) {
  588. if (!current_process.is_superuser() && inode.metadata().uid != current_process.euid())
  589. return EACCES;
  590. }
  591. size_t child_count = 0;
  592. TRY(inode.traverse_as_directory([&child_count](auto&) -> ErrorOr<void> {
  593. ++child_count;
  594. return {};
  595. }));
  596. if (child_count != 2)
  597. return ENOTEMPTY;
  598. if (custody->is_readonly())
  599. return EROFS;
  600. TRY(inode.remove_child("."));
  601. TRY(inode.remove_child(".."));
  602. return parent_inode.remove_child(KLexicalPath::basename(path));
  603. }
  604. void VirtualFileSystem::for_each_mount(Function<IterationDecision(Mount const&)> callback) const
  605. {
  606. m_mounts.with_shared([&](auto& mounts) {
  607. for (auto& mount : mounts) {
  608. if (callback(mount) == IterationDecision::Break)
  609. break;
  610. }
  611. });
  612. }
  613. void VirtualFileSystem::sync()
  614. {
  615. FileSystem::sync();
  616. }
  617. Custody& VirtualFileSystem::root_custody()
  618. {
  619. return *m_root_custody;
  620. }
  621. UnveilNode const& VirtualFileSystem::find_matching_unveiled_path(StringView path)
  622. {
  623. auto& current_process = Process::current();
  624. VERIFY(current_process.veil_state() != VeilState::None);
  625. auto& unveil_root = current_process.unveiled_paths();
  626. auto path_parts = KLexicalPath::parts(path);
  627. return unveil_root.traverse_until_last_accessible_node(path_parts.begin(), path_parts.end());
  628. }
  629. ErrorOr<void> VirtualFileSystem::validate_path_against_process_veil(Custody const& custody, int options)
  630. {
  631. if (Process::current().veil_state() == VeilState::None)
  632. return {};
  633. auto absolute_path = TRY(custody.try_serialize_absolute_path());
  634. return validate_path_against_process_veil(absolute_path->view(), options);
  635. }
  636. ErrorOr<void> VirtualFileSystem::validate_path_against_process_veil(StringView path, int options)
  637. {
  638. if (Process::current().veil_state() == VeilState::None)
  639. return {};
  640. if (options == O_EXEC && path == "/usr/lib/Loader.so")
  641. return {};
  642. VERIFY(path.starts_with('/'));
  643. VERIFY(!path.contains("/../"sv) && !path.ends_with("/.."sv));
  644. VERIFY(!path.contains("/./"sv) && !path.ends_with("/."sv));
  645. auto& unveiled_path = find_matching_unveiled_path(path);
  646. if (unveiled_path.permissions() == UnveilAccess::None) {
  647. dbgln("Rejecting path '{}' since it hasn't been unveiled.", path);
  648. dump_backtrace();
  649. return ENOENT;
  650. }
  651. if (options & O_CREAT) {
  652. if (!(unveiled_path.permissions() & UnveilAccess::CreateOrRemove)) {
  653. dbgln("Rejecting path '{}' since it hasn't been unveiled with 'c' permission.", path);
  654. dump_backtrace();
  655. return EACCES;
  656. }
  657. }
  658. if (options & O_UNLINK_INTERNAL) {
  659. if (!(unveiled_path.permissions() & UnveilAccess::CreateOrRemove)) {
  660. dbgln("Rejecting path '{}' for unlink since it hasn't been unveiled with 'c' permission.", path);
  661. dump_backtrace();
  662. return EACCES;
  663. }
  664. return {};
  665. }
  666. if (options & O_RDONLY) {
  667. if (options & O_DIRECTORY) {
  668. if (!(unveiled_path.permissions() & (UnveilAccess::Read | UnveilAccess::Browse))) {
  669. dbgln("Rejecting path '{}' since it hasn't been unveiled with 'r' or 'b' permissions.", path);
  670. dump_backtrace();
  671. return EACCES;
  672. }
  673. } else {
  674. if (!(unveiled_path.permissions() & UnveilAccess::Read)) {
  675. dbgln("Rejecting path '{}' since it hasn't been unveiled with 'r' permission.", path);
  676. dump_backtrace();
  677. return EACCES;
  678. }
  679. }
  680. }
  681. if (options & O_WRONLY) {
  682. if (!(unveiled_path.permissions() & UnveilAccess::Write)) {
  683. dbgln("Rejecting path '{}' since it hasn't been unveiled with 'w' permission.", path);
  684. dump_backtrace();
  685. return EACCES;
  686. }
  687. }
  688. if (options & O_EXEC) {
  689. if (!(unveiled_path.permissions() & UnveilAccess::Execute)) {
  690. dbgln("Rejecting path '{}' since it hasn't been unveiled with 'x' permission.", path);
  691. dump_backtrace();
  692. return EACCES;
  693. }
  694. }
  695. return {};
  696. }
  697. ErrorOr<NonnullRefPtr<Custody>> VirtualFileSystem::resolve_path(StringView path, Custody& base, RefPtr<Custody>* out_parent, int options, int symlink_recursion_level)
  698. {
  699. auto custody = TRY(resolve_path_without_veil(path, base, out_parent, options, symlink_recursion_level));
  700. TRY(validate_path_against_process_veil(*custody, options));
  701. return custody;
  702. }
  703. static bool safe_to_follow_symlink(const Inode& inode, const InodeMetadata& parent_metadata)
  704. {
  705. auto metadata = inode.metadata();
  706. if (Process::current().euid() == metadata.uid)
  707. return true;
  708. if (!(parent_metadata.is_sticky() && parent_metadata.mode & S_IWOTH))
  709. return true;
  710. if (metadata.uid == parent_metadata.uid)
  711. return true;
  712. return false;
  713. }
  714. ErrorOr<NonnullRefPtr<Custody>> VirtualFileSystem::resolve_path_without_veil(StringView path, Custody& base, RefPtr<Custody>* out_parent, int options, int symlink_recursion_level)
  715. {
  716. if (symlink_recursion_level >= symlink_recursion_limit)
  717. return ELOOP;
  718. if (path.is_empty())
  719. return EINVAL;
  720. GenericLexer path_lexer(path);
  721. auto& current_process = Process::current();
  722. NonnullRefPtr<Custody> custody = path[0] == '/' ? root_custody() : base;
  723. bool extra_iteration = path[path.length() - 1] == '/';
  724. while (!path_lexer.is_eof() || extra_iteration) {
  725. if (path_lexer.is_eof())
  726. extra_iteration = false;
  727. auto part = path_lexer.consume_until('/');
  728. path_lexer.consume_specific('/');
  729. Custody& parent = custody;
  730. auto parent_metadata = parent.inode().metadata();
  731. if (!parent_metadata.is_directory())
  732. return ENOTDIR;
  733. // Ensure the current user is allowed to resolve paths inside this directory.
  734. if (!parent_metadata.may_execute(current_process))
  735. return EACCES;
  736. bool have_more_parts = !path_lexer.is_eof() || extra_iteration;
  737. if (part == "..") {
  738. // If we encounter a "..", take a step back, but don't go beyond the root.
  739. if (custody->parent())
  740. custody = *custody->parent();
  741. continue;
  742. } else if (part == "." || part.is_empty()) {
  743. continue;
  744. }
  745. // Okay, let's look up this part.
  746. auto child_or_error = parent.inode().lookup(part);
  747. if (child_or_error.is_error()) {
  748. if (out_parent) {
  749. // ENOENT with a non-null parent custody signals to caller that
  750. // we found the immediate parent of the file, but the file itself
  751. // does not exist yet.
  752. *out_parent = have_more_parts ? nullptr : &parent;
  753. }
  754. return child_or_error.release_error();
  755. }
  756. auto child_inode = child_or_error.release_value();
  757. int mount_flags_for_child = parent.mount_flags();
  758. // See if there's something mounted on the child; in that case
  759. // we would need to return the guest inode, not the host inode.
  760. if (auto mount = find_mount_for_host(child_inode->identifier())) {
  761. child_inode = mount->guest();
  762. mount_flags_for_child = mount->flags();
  763. }
  764. custody = TRY(Custody::try_create(&parent, part, *child_inode, mount_flags_for_child));
  765. if (child_inode->metadata().is_symlink()) {
  766. if (!have_more_parts) {
  767. if (options & O_NOFOLLOW)
  768. return ELOOP;
  769. if (options & O_NOFOLLOW_NOERROR)
  770. break;
  771. }
  772. if (!safe_to_follow_symlink(*child_inode, parent_metadata))
  773. return EACCES;
  774. TRY(validate_path_against_process_veil(*custody, options));
  775. auto symlink_target = TRY(child_inode->resolve_as_link(parent, out_parent, options, symlink_recursion_level + 1));
  776. if (!have_more_parts)
  777. return symlink_target;
  778. // Now, resolve the remaining path relative to the symlink target.
  779. // We prepend a "." to it to ensure that it's not empty and that
  780. // any initial slashes it might have get interpreted properly.
  781. StringBuilder remaining_path;
  782. remaining_path.append('.');
  783. remaining_path.append(path.substring_view_starting_after_substring(part));
  784. return resolve_path_without_veil(remaining_path.to_string(), symlink_target, out_parent, options, symlink_recursion_level + 1);
  785. }
  786. }
  787. if (out_parent)
  788. *out_parent = custody->parent();
  789. return custody;
  790. }
  791. }