4 Extended attribute handling.
6 Copyright (C) 2001 by Andreas Gruenbacher <a.gruenbacher@computer.org>
7 Copyright (C) 2001 SGI - Silicon Graphics, Inc <linux-xfs@oss.sgi.com>
8 Copyright (c) 2004 Red Hat, Inc., James Morris <jmorris@redhat.com>
11 #include <linux/slab.h>
12 #include <linux/file.h>
13 #include <linux/xattr.h>
14 #include <linux/mount.h>
15 #include <linux/namei.h>
16 #include <linux/security.h>
17 #include <linux/evm.h>
18 #include <linux/syscalls.h>
19 #include <linux/export.h>
20 #include <linux/fsnotify.h>
21 #include <linux/audit.h>
22 #include <linux/vmalloc.h>
23 #include <linux/posix_acl_xattr.h>
25 #include <asm/uaccess.h>
28 strcmp_prefix(const char *a, const char *a_prefix)
30 while (*a_prefix && *a == *a_prefix) {
34 return *a_prefix ? NULL : a;
38 * In order to implement different sets of xattr operations for each xattr
39 * prefix with the generic xattr API, a filesystem should create a
40 * null-terminated array of struct xattr_handler (one for each prefix) and
41 * hang a pointer to it off of the s_xattr field of the superblock.
43 * The generic_fooxattr() functions will use this list to dispatch xattr
44 * operations to the correct xattr_handler.
46 #define for_each_xattr_handler(handlers, handler) \
48 for ((handler) = *(handlers)++; \
50 (handler) = *(handlers)++)
53 * Find the xattr_handler with the matching prefix.
55 static const struct xattr_handler *
56 xattr_resolve_name(struct inode *inode, const char **name)
58 const struct xattr_handler **handlers = inode->i_sb->s_xattr;
59 const struct xattr_handler *handler;
61 if (!(inode->i_opflags & IOP_XATTR))
62 return ERR_PTR(-EOPNOTSUPP);
63 for_each_xattr_handler(handlers, handler) {
66 n = strcmp_prefix(*name, xattr_prefix(handler));
68 if (!handler->prefix ^ !*n) {
71 return ERR_PTR(-EINVAL);
77 return ERR_PTR(-EOPNOTSUPP);
81 * Check permissions for extended attribute access. This is a bit complicated
82 * because different namespaces have very different rules.
85 xattr_permission(struct inode *inode, const char *name, int mask)
88 * We can never set or remove an extended attribute on a read-only
89 * filesystem or on an immutable / append-only inode.
91 if (mask & MAY_WRITE) {
92 if (IS_IMMUTABLE(inode) || IS_APPEND(inode))
95 * Updating an xattr will likely cause i_uid and i_gid
96 * to be writen back improperly if their true value is
99 if (HAS_UNMAPPED_ID(inode))
104 * No restriction for security.* and system.* from the VFS. Decision
105 * on these is left to the underlying filesystem / security module.
107 if (!strncmp(name, XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN) ||
108 !strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN))
112 * The trusted.* namespace can only be accessed by privileged users.
114 if (!strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN)) {
115 if (!capable(CAP_SYS_ADMIN))
116 return (mask & MAY_WRITE) ? -EPERM : -ENODATA;
121 * In the user.* namespace, only regular files and directories can have
122 * extended attributes. For sticky directories, only the owner and
123 * privileged users can write attributes.
125 if (!strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN)) {
126 if (!S_ISREG(inode->i_mode) && !S_ISDIR(inode->i_mode))
127 return (mask & MAY_WRITE) ? -EPERM : -ENODATA;
128 if (S_ISDIR(inode->i_mode) && (inode->i_mode & S_ISVTX) &&
129 (mask & MAY_WRITE) && !inode_owner_or_capable(inode))
133 return inode_permission(inode, mask);
137 * __vfs_setxattr_noperm - perform setxattr operation without performing
140 * @dentry - object to perform setxattr on
141 * @name - xattr name to set
142 * @value - value to set @name to
143 * @size - size of @value
144 * @flags - flags to pass into filesystem operations
146 * returns the result of the internal setxattr or setsecurity operations.
148 * This function requires the caller to lock the inode's i_mutex before it
149 * is executed. It also assumes that the caller will make the appropriate
152 int __vfs_setxattr_noperm(struct dentry *dentry, const char *name,
153 const void *value, size_t size, int flags)
155 struct inode *inode = dentry->d_inode;
156 int error = -EOPNOTSUPP;
157 int issec = !strncmp(name, XATTR_SECURITY_PREFIX,
158 XATTR_SECURITY_PREFIX_LEN);
161 inode->i_flags &= ~S_NOSEC;
162 if (inode->i_op->setxattr) {
163 error = inode->i_op->setxattr(dentry, inode, name, value, size, flags);
165 fsnotify_xattr(dentry);
166 security_inode_post_setxattr(dentry, name, value,
170 const char *suffix = name + XATTR_SECURITY_PREFIX_LEN;
171 error = security_inode_setsecurity(inode, suffix, value,
174 fsnotify_xattr(dentry);
182 vfs_setxattr(struct dentry *dentry, const char *name, const void *value,
183 size_t size, int flags)
185 struct inode *inode = dentry->d_inode;
188 error = xattr_permission(inode, name, MAY_WRITE);
193 error = security_inode_setxattr(dentry, name, value, size, flags);
197 error = __vfs_setxattr_noperm(dentry, name, value, size, flags);
203 EXPORT_SYMBOL_GPL(vfs_setxattr);
206 xattr_getsecurity(struct inode *inode, const char *name, void *value,
212 if (!value || !size) {
213 len = security_inode_getsecurity(inode, name, &buffer, false);
217 len = security_inode_getsecurity(inode, name, &buffer, true);
224 memcpy(value, buffer, len);
226 security_release_secctx(buffer, len);
230 EXPORT_SYMBOL_GPL(xattr_getsecurity);
233 * vfs_getxattr_alloc - allocate memory, if necessary, before calling getxattr
235 * Allocate memory, if not already allocated, or re-allocate correct size,
236 * before retrieving the extended attribute.
238 * Returns the result of alloc, if failed, or the getxattr operation.
241 vfs_getxattr_alloc(struct dentry *dentry, const char *name, char **xattr_value,
242 size_t xattr_size, gfp_t flags)
244 struct inode *inode = dentry->d_inode;
245 char *value = *xattr_value;
248 error = xattr_permission(inode, name, MAY_READ);
252 if (!inode->i_op->getxattr)
255 error = inode->i_op->getxattr(dentry, inode, name, NULL, 0);
259 if (!value || (error > xattr_size)) {
260 value = krealloc(*xattr_value, error + 1, flags);
263 memset(value, 0, error + 1);
266 error = inode->i_op->getxattr(dentry, inode, name, value, error);
267 *xattr_value = value;
272 vfs_getxattr(struct dentry *dentry, const char *name, void *value, size_t size)
274 struct inode *inode = dentry->d_inode;
277 error = xattr_permission(inode, name, MAY_READ);
281 error = security_inode_getxattr(dentry, name);
285 if (!strncmp(name, XATTR_SECURITY_PREFIX,
286 XATTR_SECURITY_PREFIX_LEN)) {
287 const char *suffix = name + XATTR_SECURITY_PREFIX_LEN;
288 int ret = xattr_getsecurity(inode, suffix, value, size);
290 * Only overwrite the return value if a security module
291 * is actually active.
293 if (ret == -EOPNOTSUPP)
298 if (inode->i_op->getxattr)
299 error = inode->i_op->getxattr(dentry, inode, name, value, size);
306 EXPORT_SYMBOL_GPL(vfs_getxattr);
309 vfs_listxattr(struct dentry *d, char *list, size_t size)
313 error = security_inode_listxattr(d);
317 if (d->d_inode->i_op->listxattr) {
318 error = d->d_inode->i_op->listxattr(d, list, size);
320 error = security_inode_listsecurity(d->d_inode, list, size);
321 if (size && error > size)
326 EXPORT_SYMBOL_GPL(vfs_listxattr);
329 vfs_removexattr(struct dentry *dentry, const char *name)
331 struct inode *inode = dentry->d_inode;
334 if (!inode->i_op->removexattr)
337 error = xattr_permission(inode, name, MAY_WRITE);
342 error = security_inode_removexattr(dentry, name);
346 error = inode->i_op->removexattr(dentry, name);
349 fsnotify_xattr(dentry);
350 evm_inode_post_removexattr(dentry, name);
357 EXPORT_SYMBOL_GPL(vfs_removexattr);
361 * Extended attribute SET operations
364 setxattr(struct dentry *d, const char __user *name, const void __user *value,
365 size_t size, int flags)
369 char kname[XATTR_NAME_MAX + 1];
371 if (flags & ~(XATTR_CREATE|XATTR_REPLACE))
374 error = strncpy_from_user(kname, name, sizeof(kname));
375 if (error == 0 || error == sizeof(kname))
381 if (size > XATTR_SIZE_MAX)
383 kvalue = kmalloc(size, GFP_KERNEL | __GFP_NOWARN);
385 kvalue = vmalloc(size);
389 if (copy_from_user(kvalue, value, size)) {
393 if ((strcmp(kname, XATTR_NAME_POSIX_ACL_ACCESS) == 0) ||
394 (strcmp(kname, XATTR_NAME_POSIX_ACL_DEFAULT) == 0))
395 posix_acl_fix_xattr_from_user(kvalue, size);
398 error = vfs_setxattr(d, kname, kvalue, size, flags);
405 static int path_setxattr(const char __user *pathname,
406 const char __user *name, const void __user *value,
407 size_t size, int flags, unsigned int lookup_flags)
412 error = user_path_at(AT_FDCWD, pathname, lookup_flags, &path);
415 error = mnt_want_write(path.mnt);
417 error = setxattr(path.dentry, name, value, size, flags);
418 mnt_drop_write(path.mnt);
421 if (retry_estale(error, lookup_flags)) {
422 lookup_flags |= LOOKUP_REVAL;
428 SYSCALL_DEFINE5(setxattr, const char __user *, pathname,
429 const char __user *, name, const void __user *, value,
430 size_t, size, int, flags)
432 return path_setxattr(pathname, name, value, size, flags, LOOKUP_FOLLOW);
435 SYSCALL_DEFINE5(lsetxattr, const char __user *, pathname,
436 const char __user *, name, const void __user *, value,
437 size_t, size, int, flags)
439 return path_setxattr(pathname, name, value, size, flags, 0);
442 SYSCALL_DEFINE5(fsetxattr, int, fd, const char __user *, name,
443 const void __user *,value, size_t, size, int, flags)
445 struct fd f = fdget(fd);
451 error = mnt_want_write_file(f.file);
453 error = setxattr(f.file->f_path.dentry, name, value, size, flags);
454 mnt_drop_write_file(f.file);
461 * Extended attribute GET operations
464 getxattr(struct dentry *d, const char __user *name, void __user *value,
469 char kname[XATTR_NAME_MAX + 1];
471 error = strncpy_from_user(kname, name, sizeof(kname));
472 if (error == 0 || error == sizeof(kname))
478 if (size > XATTR_SIZE_MAX)
479 size = XATTR_SIZE_MAX;
480 kvalue = kzalloc(size, GFP_KERNEL | __GFP_NOWARN);
482 kvalue = vmalloc(size);
488 error = vfs_getxattr(d, kname, kvalue, size);
490 if ((strcmp(kname, XATTR_NAME_POSIX_ACL_ACCESS) == 0) ||
491 (strcmp(kname, XATTR_NAME_POSIX_ACL_DEFAULT) == 0))
492 posix_acl_fix_xattr_to_user(kvalue, size);
493 if (size && copy_to_user(value, kvalue, error))
495 } else if (error == -ERANGE && size >= XATTR_SIZE_MAX) {
496 /* The file system tried to returned a value bigger
497 than XATTR_SIZE_MAX bytes. Not possible. */
506 static ssize_t path_getxattr(const char __user *pathname,
507 const char __user *name, void __user *value,
508 size_t size, unsigned int lookup_flags)
513 error = user_path_at(AT_FDCWD, pathname, lookup_flags, &path);
516 error = getxattr(path.dentry, name, value, size);
518 if (retry_estale(error, lookup_flags)) {
519 lookup_flags |= LOOKUP_REVAL;
525 SYSCALL_DEFINE4(getxattr, const char __user *, pathname,
526 const char __user *, name, void __user *, value, size_t, size)
528 return path_getxattr(pathname, name, value, size, LOOKUP_FOLLOW);
531 SYSCALL_DEFINE4(lgetxattr, const char __user *, pathname,
532 const char __user *, name, void __user *, value, size_t, size)
534 return path_getxattr(pathname, name, value, size, 0);
537 SYSCALL_DEFINE4(fgetxattr, int, fd, const char __user *, name,
538 void __user *, value, size_t, size)
540 struct fd f = fdget(fd);
541 ssize_t error = -EBADF;
546 error = getxattr(f.file->f_path.dentry, name, value, size);
552 * Extended attribute LIST operations
555 listxattr(struct dentry *d, char __user *list, size_t size)
561 if (size > XATTR_LIST_MAX)
562 size = XATTR_LIST_MAX;
563 klist = kmalloc(size, __GFP_NOWARN | GFP_KERNEL);
565 klist = vmalloc(size);
571 error = vfs_listxattr(d, klist, size);
573 if (size && copy_to_user(list, klist, error))
575 } else if (error == -ERANGE && size >= XATTR_LIST_MAX) {
576 /* The file system tried to returned a list bigger
577 than XATTR_LIST_MAX bytes. Not possible. */
586 static ssize_t path_listxattr(const char __user *pathname, char __user *list,
587 size_t size, unsigned int lookup_flags)
592 error = user_path_at(AT_FDCWD, pathname, lookup_flags, &path);
595 error = listxattr(path.dentry, list, size);
597 if (retry_estale(error, lookup_flags)) {
598 lookup_flags |= LOOKUP_REVAL;
604 SYSCALL_DEFINE3(listxattr, const char __user *, pathname, char __user *, list,
607 return path_listxattr(pathname, list, size, LOOKUP_FOLLOW);
610 SYSCALL_DEFINE3(llistxattr, const char __user *, pathname, char __user *, list,
613 return path_listxattr(pathname, list, size, 0);
616 SYSCALL_DEFINE3(flistxattr, int, fd, char __user *, list, size_t, size)
618 struct fd f = fdget(fd);
619 ssize_t error = -EBADF;
624 error = listxattr(f.file->f_path.dentry, list, size);
630 * Extended attribute REMOVE operations
633 removexattr(struct dentry *d, const char __user *name)
636 char kname[XATTR_NAME_MAX + 1];
638 error = strncpy_from_user(kname, name, sizeof(kname));
639 if (error == 0 || error == sizeof(kname))
644 return vfs_removexattr(d, kname);
647 static int path_removexattr(const char __user *pathname,
648 const char __user *name, unsigned int lookup_flags)
653 error = user_path_at(AT_FDCWD, pathname, lookup_flags, &path);
656 error = mnt_want_write(path.mnt);
658 error = removexattr(path.dentry, name);
659 mnt_drop_write(path.mnt);
662 if (retry_estale(error, lookup_flags)) {
663 lookup_flags |= LOOKUP_REVAL;
669 SYSCALL_DEFINE2(removexattr, const char __user *, pathname,
670 const char __user *, name)
672 return path_removexattr(pathname, name, LOOKUP_FOLLOW);
675 SYSCALL_DEFINE2(lremovexattr, const char __user *, pathname,
676 const char __user *, name)
678 return path_removexattr(pathname, name, 0);
681 SYSCALL_DEFINE2(fremovexattr, int, fd, const char __user *, name)
683 struct fd f = fdget(fd);
689 error = mnt_want_write_file(f.file);
691 error = removexattr(f.file->f_path.dentry, name);
692 mnt_drop_write_file(f.file);
699 * Find the handler for the prefix and dispatch its get() operation.
702 generic_getxattr(struct dentry *dentry, struct inode *inode,
703 const char *name, void *buffer, size_t size)
705 const struct xattr_handler *handler;
707 handler = xattr_resolve_name(inode, &name);
709 return PTR_ERR(handler);
710 return handler->get(handler, dentry, inode,
715 * Combine the results of the list() operation from every xattr_handler in the
719 generic_listxattr(struct dentry *dentry, char *buffer, size_t buffer_size)
721 const struct xattr_handler *handler, **handlers = dentry->d_sb->s_xattr;
722 unsigned int size = 0;
725 for_each_xattr_handler(handlers, handler) {
726 if (!handler->name ||
727 (handler->list && !handler->list(dentry)))
729 size += strlen(handler->name) + 1;
735 for_each_xattr_handler(handlers, handler) {
736 if (!handler->name ||
737 (handler->list && !handler->list(dentry)))
739 len = strlen(handler->name);
740 if (len + 1 > buffer_size)
742 memcpy(buf, handler->name, len + 1);
744 buffer_size -= len + 1;
752 * Find the handler for the prefix and dispatch its set() operation.
755 generic_setxattr(struct dentry *dentry, struct inode *inode, const char *name,
756 const void *value, size_t size, int flags)
758 const struct xattr_handler *handler;
761 value = ""; /* empty EA, do not remove */
762 handler = xattr_resolve_name(inode, &name);
764 return PTR_ERR(handler);
765 return handler->set(handler, dentry, inode, name, value, size, flags);
769 * Find the handler for the prefix and dispatch its set() operation to remove
770 * any associated extended attribute.
773 generic_removexattr(struct dentry *dentry, const char *name)
775 const struct xattr_handler *handler;
777 handler = xattr_resolve_name(d_inode(dentry), &name);
779 return PTR_ERR(handler);
780 return handler->set(handler, dentry, d_inode(dentry), name, NULL,
784 EXPORT_SYMBOL(generic_getxattr);
785 EXPORT_SYMBOL(generic_listxattr);
786 EXPORT_SYMBOL(generic_setxattr);
787 EXPORT_SYMBOL(generic_removexattr);
790 * xattr_full_name - Compute full attribute name from suffix
792 * @handler: handler of the xattr_handler operation
793 * @name: name passed to the xattr_handler operation
795 * The get and set xattr handler operations are called with the remainder of
796 * the attribute name after skipping the handler's prefix: for example, "foo"
797 * is passed to the get operation of a handler with prefix "user." to get
798 * attribute "user.foo". The full name is still "there" in the name though.
800 * Note: the list xattr handler operation when called from the vfs is passed a
801 * NULL name; some file systems use this operation internally, with varying
804 const char *xattr_full_name(const struct xattr_handler *handler,
807 size_t prefix_len = strlen(xattr_prefix(handler));
809 return name - prefix_len;
811 EXPORT_SYMBOL(xattr_full_name);
814 * Allocate new xattr and copy in the value; but leave the name to callers.
816 struct simple_xattr *simple_xattr_alloc(const void *value, size_t size)
818 struct simple_xattr *new_xattr;
822 len = sizeof(*new_xattr) + size;
823 if (len < sizeof(*new_xattr))
826 new_xattr = kmalloc(len, GFP_KERNEL);
830 new_xattr->size = size;
831 memcpy(new_xattr->value, value, size);
836 * xattr GET operation for in-memory/pseudo filesystems
838 int simple_xattr_get(struct simple_xattrs *xattrs, const char *name,
839 void *buffer, size_t size)
841 struct simple_xattr *xattr;
844 spin_lock(&xattrs->lock);
845 list_for_each_entry(xattr, &xattrs->head, list) {
846 if (strcmp(name, xattr->name))
851 if (size < xattr->size)
854 memcpy(buffer, xattr->value, xattr->size);
858 spin_unlock(&xattrs->lock);
863 * simple_xattr_set - xattr SET operation for in-memory/pseudo filesystems
864 * @xattrs: target simple_xattr list
865 * @name: name of the extended attribute
866 * @value: value of the xattr. If %NULL, will remove the attribute.
867 * @size: size of the new xattr
868 * @flags: %XATTR_{CREATE|REPLACE}
870 * %XATTR_CREATE is set, the xattr shouldn't exist already; otherwise fails
871 * with -EEXIST. If %XATTR_REPLACE is set, the xattr should exist;
872 * otherwise, fails with -ENODATA.
874 * Returns 0 on success, -errno on failure.
876 int simple_xattr_set(struct simple_xattrs *xattrs, const char *name,
877 const void *value, size_t size, int flags)
879 struct simple_xattr *xattr;
880 struct simple_xattr *new_xattr = NULL;
883 /* value == NULL means remove */
885 new_xattr = simple_xattr_alloc(value, size);
889 new_xattr->name = kstrdup(name, GFP_KERNEL);
890 if (!new_xattr->name) {
896 spin_lock(&xattrs->lock);
897 list_for_each_entry(xattr, &xattrs->head, list) {
898 if (!strcmp(name, xattr->name)) {
899 if (flags & XATTR_CREATE) {
902 } else if (new_xattr) {
903 list_replace(&xattr->list, &new_xattr->list);
905 list_del(&xattr->list);
910 if (flags & XATTR_REPLACE) {
914 list_add(&new_xattr->list, &xattrs->head);
918 spin_unlock(&xattrs->lock);
927 static bool xattr_is_trusted(const char *name)
929 return !strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN);
932 static int xattr_list_one(char **buffer, ssize_t *remaining_size,
935 size_t len = strlen(name) + 1;
937 if (*remaining_size < len)
939 memcpy(*buffer, name, len);
942 *remaining_size -= len;
947 * xattr LIST operation for in-memory/pseudo filesystems
949 ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs *xattrs,
950 char *buffer, size_t size)
952 bool trusted = capable(CAP_SYS_ADMIN);
953 struct simple_xattr *xattr;
954 ssize_t remaining_size = size;
957 #ifdef CONFIG_FS_POSIX_ACL
959 err = xattr_list_one(&buffer, &remaining_size,
960 XATTR_NAME_POSIX_ACL_ACCESS);
964 if (inode->i_default_acl) {
965 err = xattr_list_one(&buffer, &remaining_size,
966 XATTR_NAME_POSIX_ACL_DEFAULT);
972 spin_lock(&xattrs->lock);
973 list_for_each_entry(xattr, &xattrs->head, list) {
974 /* skip "trusted." attributes for unprivileged callers */
975 if (!trusted && xattr_is_trusted(xattr->name))
978 err = xattr_list_one(&buffer, &remaining_size, xattr->name);
982 spin_unlock(&xattrs->lock);
984 return err ? err : size - remaining_size;
988 * Adds an extended attribute to the list
990 void simple_xattr_list_add(struct simple_xattrs *xattrs,
991 struct simple_xattr *new_xattr)
993 spin_lock(&xattrs->lock);
994 list_add(&new_xattr->list, &xattrs->head);
995 spin_unlock(&xattrs->lock);