From: Alexey Gladkov <legion@kernel.org>
To: Christian Brauner <brauner@kernel.org>
Cc: Florian Weimer <fweimer@redhat.com>,
LKML <linux-kernel@vger.kernel.org>,
Arnd Bergmann <arnd@arndb.de>,
linux-api@vger.kernel.org, linux-fsdevel@vger.kernel.org,
viro@zeniv.linux.org.uk, James.Bottomley@hansenpartnership.com,
acme@kernel.org, alexander.shishkin@linux.intel.com,
axboe@kernel.dk, benh@kernel.crashing.org,
borntraeger@de.ibm.com, bp@alien8.de, catalin.marinas@arm.com,
christian@brauner.io, dalias@libc.org, davem@davemloft.net,
deepa.kernel@gmail.com, deller@gmx.de, dhowells@redhat.com,
fenghua.yu@intel.com, geert@linux-m68k.org, glebfm@altlinux.org,
gor@linux.ibm.com, hare@suse.com, hpa@zytor.com,
ink@jurassic.park.msu.ru, jhogan@kernel.org,
kim.phillips@arm.com, ldv@altlinux.org,
linux-alpha@vger.kernel.org, linux-arch@vger.kernel.org,
linux-arm-kernel@lists.infradead.org, linux-ia64@vger.kernel.org,
linux-m68k@lists.linux-m68k.org, linux-mips@vger.kernel.org,
linux-parisc@vger.kernel.org, linux-s390@vger.kernel.org,
linux-sh@vger.kernel.org, linux@armlinux.org.uk,
linuxppc-dev@lists.ozlabs.org, luto@kernel.org,
mattst88@gmail.com, mingo@redhat.com, monstr@monstr.eu,
mpe@ellerman.id.au, namhyung@kernel.org, paul.burton@mips.com,
paulus@samba.org, peterz@infradead.org, ralf@linux-mips.org,
rth@twiddle.net, sparclinux@vger.kernel.org, stefan@agner.ch,
tglx@linutronix.de, tony.luck@intel.com, tycho@tycho.ws,
will@kernel.org, x86@kernel.org, ysato@users.sourceforge.jp
Subject: Re: [PATCH v3 0/5] Add a new fchmodat4() syscall
Date: Tue, 25 Jul 2023 13:05:40 +0200 [thread overview]
Message-ID: <ZL+shMg5LJgYlsDd@example.org> (raw)
In-Reply-To: <20230711-quintessenz-auswechseln-92a4640c073d@brauner>
On Tue, Jul 11, 2023 at 05:14:24PM +0200, Christian Brauner wrote:
> On Tue, Jul 11, 2023 at 02:24:51PM +0200, Florian Weimer wrote:
> > * Alexey Gladkov:
> >
> > > This patch set adds fchmodat4(), a new syscall. The actual
> > > implementation is super simple: essentially it's just the same as
> > > fchmodat(), but LOOKUP_FOLLOW is conditionally set based on the flags.
> > > I've attempted to make this match "man 2 fchmodat" as closely as
> > > possible, which says EINVAL is returned for invalid flags (as opposed to
> > > ENOTSUPP, which is currently returned by glibc for AT_SYMLINK_NOFOLLOW).
> > > I have a sketch of a glibc patch that I haven't even compiled yet, but
> > > seems fairly straight-forward:
> > >
> > > diff --git a/sysdeps/unix/sysv/linux/fchmodat.c b/sysdeps/unix/sysv/linux/fchmodat.c
> > > index 6d9cbc1ce9e0..b1beab76d56c 100644
> > > --- a/sysdeps/unix/sysv/linux/fchmodat.c
> > > +++ b/sysdeps/unix/sysv/linux/fchmodat.c
> > > @@ -29,12 +29,36 @@
> > > int
> > > fchmodat (int fd, const char *file, mode_t mode, int flag)
> > > {
> > > - if (flag & ~AT_SYMLINK_NOFOLLOW)
> > > - return INLINE_SYSCALL_ERROR_RETURN_VALUE (EINVAL);
> > > -#ifndef __NR_lchmod /* Linux so far has no lchmod syscall. */
> > > + /* There are four paths through this code:
> > > + - The flags are zero. In this case it's fine to call fchmodat.
> > > + - The flags are non-zero and glibc doesn't have access to
> > > + __NR_fchmodat4. In this case all we can do is emulate the error codes
> > > + defined by the glibc interface from userspace.
> > > + - The flags are non-zero, glibc has __NR_fchmodat4, and the kernel has
> > > + fchmodat4. This is the simplest case, as the fchmodat4 syscall exactly
> > > + matches glibc's library interface so it can be called directly.
> > > + - The flags are non-zero, glibc has __NR_fchmodat4, but the kernel does
> >
> > If you define __NR_fchmodat4 on all architectures, we can use these
> > constants directly in glibc. We no longer depend on the UAPI
> > definitions of those constants, to cut down the number of code variants,
> > and to make glibc's system call profile independent of the kernel header
> > version at build time.
> >
> > Your version is based on 2.31, more recent versions have some reasonable
> > emulation for fchmodat based on /proc/self/fd. I even wrote a comment
> > describing the same buggy behavior that you witnessed:
> >
> > + /* Some Linux versions with some file systems can actually
> > + change symbolic link permissions via /proc, but this is not
> > + intentional, and it gives inconsistent results (e.g., error
> > + return despite mode change). The expected behavior is that
> > + symbolic link modes cannot be changed at all, and this check
> > + enforces that. */
> > + if (S_ISLNK (st.st_mode))
> > + {
> > + __close_nocancel (pathfd);
> > + __set_errno (EOPNOTSUPP);
> > + return -1;
> > + }
> >
> > I think there was some kernel discussion about that behavior before, but
> > apparently, it hasn't led to fixes.
>
> I think I've explained this somewhere else a couple of months ago but
> just in case you weren't on that thread or don't remember and apologies
> if you should already know.
>
> A lot of filesystem will happily update the mode of a symlink. The VFS
> doesn't do anything to prevent this from happening. This is filesystem
> specific.
>
> The EOPNOTSUPP you're seeing very likely comes from POSIX ACLs.
> Specifically it comes from filesystems that call posix_acl_chmod(),
> e.g., btrfs via
>
> if (!err && attr->ia_valid & ATTR_MODE)
> err = posix_acl_chmod(idmap, dentry, inode->i_mode);
>
> Most filesystems don't implement i_op->set_acl() for POSIX ACLs.
> So posix_acl_chmod() will report EOPNOTSUPP. By the time
> posix_acl_chmod() is called, most filesystems will have finished
> updating the inode. POSIX ACLs also often aren't integrated into
> transactions so a rollback wouldn't even be possible on some
> filesystems.
>
> Any filesystem that doesn't implement POSIX ACLs at all will obviously
> never fail unless it blocks mode changes on symlinks. Or filesystems
> that do have a way to rollback failures from posix_acl_chmod(), or
> filesystems that do return an error on chmod() on symlinks such as 9p,
> ntfs, ocfs2.
>
> >
> > I wonder if it makes sense to add a similar error return to the system
> > call implementation?
>
> Hm, blocking symlink mode changes is pretty regression prone. And just
> blocking it through one interface seems weird and makes things even more
> inconsistent.
>
> So two options I see:
> (1) minimally invasive:
> Filesystems that do call posix_acl_chmod() on symlinks need to be
> changed to stop doing that.
> (2) might hit us on the head invasive:
> Try and block symlink mode changes in chmod_common().
>
> Thoughts?
>
We have third option. We can choose not to call chmod_common and return an
error right away:
diff --git a/fs/open.c b/fs/open.c
index 39a7939f0d00..86a427a2a083 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -679,7 +679,9 @@ static int do_fchmodat(int dfd, const char __user *filename, umode_t mode, int l
retry:
error = user_path_at(dfd, filename, lookup_flags, &path);
if (!error) {
- error = chmod_common(&path, mode);
+ error = -EOPNOTSUPP;
+ if (!(flags & AT_SYMLINK_NOFOLLOW) || !S_ISLNK(path.dentry->d_inode->i_mode))
+ error = chmod_common(&path, mode);
path_put(&path);
if (retry_estale(error, lookup_flags)) {
lookup_flags |= LOOKUP_REVAL;
It doesn't seem to be invasive.
--
Rgrds, legion
next prev parent reply other threads:[~2023-07-25 11:07 UTC|newest]
Thread overview: 69+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-07-17 1:27 Add a new fchmodat4() syscall, v2 Palmer Dabbelt
2019-07-17 1:27 ` [PATCH v2 1/4] Non-functional cleanup of a "__user * filename" Palmer Dabbelt
2019-07-17 1:27 ` [PATCH v2 2/4] Add fchmodat4(), a new syscall Palmer Dabbelt
2019-07-17 1:48 ` Al Viro
2019-07-17 2:12 ` Palmer Dabbelt
2019-07-17 2:40 ` Rich Felker
2019-07-17 3:02 ` Al Viro
2019-07-17 1:27 ` [PATCH v2 3/4] arch: Register fchmodat4, usually as syscall 434 Palmer Dabbelt
2019-07-17 1:27 ` [PATCH v2 4/4] tools: Add fchmodat4 Palmer Dabbelt
2019-07-17 12:39 ` Arnaldo Carvalho de Melo
2020-06-09 13:52 ` Add a new fchmodat4() syscall, v2 Florian Weimer
2023-07-11 11:25 ` [PATCH v3 0/5] Add a new fchmodat4() syscall Alexey Gladkov
2023-07-11 11:25 ` [PATCH v3 1/5] Non-functional cleanup of a "__user * filename" Alexey Gladkov
2023-07-11 11:32 ` Arnd Bergmann
2023-07-11 11:25 ` [PATCH v3 2/5] fs: Add fchmodat4() Alexey Gladkov
2023-07-11 11:42 ` Arnd Bergmann
2023-07-11 11:52 ` Christian Brauner
2023-07-11 12:51 ` Alexey Gladkov
2023-07-11 14:01 ` Christian Brauner
2023-07-11 15:23 ` Alexey Gladkov
2023-07-11 12:28 ` Matthew Wilcox
2023-07-11 12:49 ` Alexey Gladkov
2023-07-11 11:25 ` [PATCH v3 3/5] arch: Register fchmodat4, usually as syscall 451 Alexey Gladkov
2023-07-11 11:31 ` Arnd Bergmann
2023-07-11 11:25 ` [PATCH v3 4/5] tools headers UAPI: Sync files changed by new fchmodat4 syscall Alexey Gladkov
2023-07-11 11:25 ` [PATCH v3 5/5] selftests: add fchmodat4(2) selftest Alexey Gladkov
2023-07-11 12:10 ` Florian Weimer
2023-07-11 13:38 ` Alexey Gladkov
2023-07-11 12:24 ` [PATCH v3 0/5] Add a new fchmodat4() syscall Florian Weimer
2023-07-11 15:14 ` Christian Brauner
2023-07-25 11:05 ` Alexey Gladkov [this message]
2023-07-25 12:05 ` Christian Brauner
2023-07-11 16:16 ` [PATCH v4 0/5] Add a new fchmodat2() syscall Alexey Gladkov
2023-07-11 16:16 ` [PATCH v4 1/5] Non-functional cleanup of a "__user * filename" Alexey Gladkov
2023-07-11 16:16 ` [PATCH v4 2/5] fs: Add fchmodat2() Alexey Gladkov
2023-07-11 17:05 ` Christian Brauner
2023-07-25 16:36 ` Aleksa Sarai
2023-07-26 13:45 ` Alexey Gladkov
2023-07-27 10:26 ` Christian Brauner
2023-07-27 17:12 ` Aleksa Sarai
2023-07-27 17:39 ` Aleksa Sarai
2023-07-28 8:43 ` David Laight
2023-07-28 18:42 ` dalias
2023-07-27 9:01 ` David Laight
2023-07-27 16:28 ` Andreas Schwab
2023-07-27 17:02 ` Christian Brauner
2023-07-27 17:13 ` dalias
2023-07-27 17:36 ` Christian Brauner
2023-07-27 16:31 ` dalias
2023-07-11 16:16 ` [PATCH v4 3/5] arch: Register fchmodat2, usually as syscall 452 Alexey Gladkov
2023-07-11 16:26 ` Arnd Bergmann
2023-07-25 7:16 ` Geert Uytterhoeven
2023-07-25 16:43 ` Aleksa Sarai
2023-07-27 10:37 ` Christian Brauner
2023-07-27 17:42 ` Aleksa Sarai
2023-07-11 16:16 ` [PATCH v4 4/5] tools headers UAPI: Sync files changed by new fchmodat2 syscall Alexey Gladkov
2023-07-11 17:19 ` Namhyung Kim
2023-07-11 17:23 ` Alexey Gladkov
2023-07-11 16:16 ` [PATCH v4 5/5] selftests: Add fchmodat2 selftest Alexey Gladkov
2023-07-11 17:36 ` (subset) [PATCH v4 0/5] Add a new fchmodat2() syscall Christian Brauner
2023-07-12 2:42 ` Rich Felker
2023-07-25 15:58 ` Add fchmodat2() - or add a more general syscall? David Howells
2023-07-25 16:10 ` Florian Weimer
2023-07-25 16:50 ` Aleksa Sarai
2023-07-25 18:39 ` David Howells
2023-07-25 18:44 ` Rich Felker
2023-07-26 13:30 ` Christian Brauner
2023-07-27 3:57 ` Eric Biggers
2023-07-27 10:27 ` Christian Brauner
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZL+shMg5LJgYlsDd@example.org \
--to=legion@kernel.org \
--cc=James.Bottomley@hansenpartnership.com \
--cc=acme@kernel.org \
--cc=alexander.shishkin@linux.intel.com \
--cc=arnd@arndb.de \
--cc=axboe@kernel.dk \
--cc=benh@kernel.crashing.org \
--cc=borntraeger@de.ibm.com \
--cc=bp@alien8.de \
--cc=brauner@kernel.org \
--cc=catalin.marinas@arm.com \
--cc=christian@brauner.io \
--cc=dalias@libc.org \
--cc=davem@davemloft.net \
--cc=deepa.kernel@gmail.com \
--cc=deller@gmx.de \
--cc=dhowells@redhat.com \
--cc=fenghua.yu@intel.com \
--cc=fweimer@redhat.com \
--cc=geert@linux-m68k.org \
--cc=glebfm@altlinux.org \
--cc=gor@linux.ibm.com \
--cc=hare@suse.com \
--cc=hpa@zytor.com \
--cc=ink@jurassic.park.msu.ru \
--cc=jhogan@kernel.org \
--cc=kim.phillips@arm.com \
--cc=ldv@altlinux.org \
--cc=linux-alpha@vger.kernel.org \
--cc=linux-api@vger.kernel.org \
--cc=linux-arch@vger.kernel.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-ia64@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-m68k@lists.linux-m68k.org \
--cc=linux-mips@vger.kernel.org \
--cc=linux-parisc@vger.kernel.org \
--cc=linux-s390@vger.kernel.org \
--cc=linux-sh@vger.kernel.org \
--cc=linux@armlinux.org.uk \
--cc=linuxppc-dev@lists.ozlabs.org \
--cc=luto@kernel.org \
--cc=mattst88@gmail.com \
--cc=mingo@redhat.com \
--cc=monstr@monstr.eu \
--cc=mpe@ellerman.id.au \
--cc=namhyung@kernel.org \
--cc=paul.burton@mips.com \
--cc=paulus@samba.org \
--cc=peterz@infradead.org \
--cc=ralf@linux-mips.org \
--cc=rth@twiddle.net \
--cc=sparclinux@vger.kernel.org \
--cc=stefan@agner.ch \
--cc=tglx@linutronix.de \
--cc=tony.luck@intel.com \
--cc=tycho@tycho.ws \
--cc=viro@zeniv.linux.org.uk \
--cc=will@kernel.org \
--cc=x86@kernel.org \
--cc=ysato@users.sourceforge.jp \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).