mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-31 03:35:32 -04:00
Code Issues Packages Projects Releases Wiki Activity

Merge patch series "vfs: call audit_inode_child() in lookup_open() on failure"

Browse Source 
Jori Koolstra <jkoolstra@xs4all.nl> says:

While reworking lookup_open() to implement O_CREAT|O_DIRECTORY I came
across inconsistency in how audit_inode_child() is called in various
file create paths.

audit_inode_child() is called in may_create_dentry() so that failed
filesystem operations still register an audit entry. On success, the
entry is overwritten when, for instance, fsnotify_create() is called.
This is the calling convention in vfs_create() and vfs_mkdir().
In lookup_open(), however, when atomic_open() should have created a
file but didn't, no call to audit_inode_child() is made. The same is
true for the regular ->create() path.

On the suggestion of Christian, I am splitting this series from the
O_CREAT|O_DIRECTORY work, so that this can be discussed with the audit
people without delaying that work.

* patches from https://patch.msgid.link/20260710164233.827744-1-jkoolstra@xs4all.nl:
  fs/namei.c: update kerneldoc of atomic_open()
  vfs: call audit_inode_child() in lookup_open() on failure
  vfs: move create error && negative dentry case in lookup_open() up

Link: https://patch.msgid.link/20260710164233.827744-1-jkoolstra@xs4all.nl
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
This commit is contained in:
Christian Brauner
2026-07-30 12:16:56 +02:00
parent 24f3a09163 ba0e870266
commit 7b53e200d3
1 changed files with 76 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files

123
fs/namei.c
View File

@@ -4336,50 +4336,78 @@ static int may_o_create(struct mnt_idmap *idmap,
return security_inode_create(dir->dentry->d_inode, dentry, mode);
}
/*
* Attempt to atomically look up, create and open a file from a negative
* dentry.
/**
* atomic_open() - attempt to atomically look up, create and open a file
* from a negative dentry.
* @path: parent directory path
* @dentry: child to ->atomic_open()
* @file: file to attach child to
* @open_flag: open flags
* @mode: create mode
* @create_error: return value from may_o_create()
*
* Returns 0 if successful. The file will have been created and attached to
* @file by the filesystem calling finish_open().
* If a non-error dentry is returned then: when FMODE_OPENED is set,
* the file will have been attached to @file by the filesystem calling
* finish_open(). If FMODE_OPENED isn't set, the filesystem instead called
* finish_no_open() and the caller will need to perform the open themselves.
*
* If the file was looked up only or didn't need creating, FMODE_OPENED won't
* be set. The caller will need to perform the open themselves. @path will
* have been updated to point to the new dentry. This may be negative.
* FMODE_CREATED is set when the call to ->atomic_open() actually created
* the file.
*
* Returns an error code otherwise.
* Returns the opened/looked-up dentry on success or ERR_PTR(-E) on failure.
* On error, atomic_open() consumes @dentry.
*/
static struct dentry *atomic_open(const struct path *path, struct dentry *dentry,
struct file *file,
int open_flag, umode_t mode)
int open_flag, umode_t mode, int create_error)
{
struct dentry *const DENTRY_NOT_SET = (void *) -1UL;
struct inode *dir = path->dentry->d_inode;
struct inode *dir_inode = path->dentry->d_inode;
int error;
file->__f_path.dentry = DENTRY_NOT_SET;
file->__f_path.mnt = path->mnt;
error = dir->i_op->atomic_open(dir, dentry, file,
error = dir_inode->i_op->atomic_open(dir_inode, dentry, file,
open_to_namei_flags(open_flag), mode);
d_lookup_done(dentry);
if (!error) {
if (file->f_mode & FMODE_OPENED) {
if (unlikely(dentry != file->f_path.dentry)) {
/* finish_open() called */
struct dentry *opened = file->f_path.dentry;
if (unlikely(opened != dentry)) {
dput(dentry);
dentry = dget(file->f_path.dentry);
dentry = dget(opened);
}
} else if (WARN_ON(file->f_path.dentry == DENTRY_NOT_SET)) {
error = -EIO;
} else {
if (file->f_path.dentry) {
} else if (likely(file->f_path.dentry != DENTRY_NOT_SET)) {
/* finish_no_open() called */
struct dentry *replaced = file->f_path.dentry;
if (replaced) {
dput(dentry);
dentry = file->f_path.dentry;
dentry = replaced;
}
if (unlikely(d_is_negative(dentry)))
error = -ENOENT;
} else {
const char *fsname = dentry->d_sb->s_type->name;
WARN(1, "%s: ->atomic_open() left file->f_path.dentry unset!\n",
fsname);
error = -EIO;
}
}
if (error) {
if (unlikely(create_error) && error == -ENOENT) {
/*
* Should have done a create, but errored before.
* Some filesystems return -ENOENT directly instead of
* calling finish_no_open() with a negative dentry;
* either way it should only mean the child doesn't exist,
* so a refused create is safe to record here.
*/
audit_inode_child(dir_inode, dentry, AUDIT_TYPE_CHILD_CREATE);
error = create_error;
}
dput(dentry);
dentry = ERR_PTR(error);
}
@@ -4459,7 +4487,7 @@ static struct dentry *lookup_open(struct nameidata *nd, struct file *file,
dentry = NULL;
}
if (dentry->d_inode) {
/* Cached positive dentry: will open in f_op->open */
/* Cached positive dentry: will open in do_open(). */
goto out;
}
@@ -4493,9 +4521,8 @@ static struct dentry *lookup_open(struct nameidata *nd, struct file *file,
if (dir_inode->i_op->atomic_open) {
if (nd->flags & LOOKUP_DIRECTORY)
open_flag |= O_DIRECTORY;
dentry = atomic_open(&nd->path, dentry, file, open_flag, mode);
if (unlikely(create_error) && dentry == ERR_PTR(-ENOENT))
dentry = ERR_PTR(create_error);
dentry = atomic_open(&nd->path, dentry, file, open_flag, mode,
create_error);
goto out;
}
@@ -4512,30 +4539,35 @@ static struct dentry *lookup_open(struct nameidata *nd, struct file *file,
dentry = res;
}
}
/* Negative dentry, just create the file */
if (!dentry->d_inode && (open_flag & O_CREAT)) {
/* but break the directory lease first! */
error = try_break_deleg(dir_inode, LEASE_BREAK_DIR_CREATE, &delegated_inode);
if (error)
goto out_dput;
file->f_mode |= FMODE_CREATED;
audit_inode_child(dir_inode, dentry, AUDIT_TYPE_CHILD_CREATE);
if (!dir_inode->i_op->create) {
error = -EACCES;
goto out_dput;
}
error = dir_inode->i_op->create(idmap, dir_inode, dentry,
mode, open_flag & O_EXCL);
if (error)
goto out_dput;
if (dentry->d_inode || !(op->open_flag & O_CREAT)) {
/* No need to create a file. If lookup returned a positive
* dentry, the file will be opened in do_open(). */
goto out;
}
if (unlikely(create_error) && !dentry->d_inode) {
/* Negative dentry with O_CREAT flag set */
audit_inode_child(dir_inode, dentry, AUDIT_TYPE_CHILD_CREATE);
if (unlikely(create_error)) {
/* should have done a create, but we already errored */
error = create_error;
goto out_dput;
}
error = try_break_deleg(dir_inode, LEASE_BREAK_DIR_CREATE, &delegated_inode);
if (error)
goto out_dput;
file->f_mode |= FMODE_CREATED;
if (!dir_inode->i_op->create) {
error = -EACCES;
goto out_dput;
}
error = dir_inode->i_op->create(idmap, dir_inode, dentry,
mode, open_flag & O_EXCL);
if (error)
goto out_dput;
out:
if (!IS_ERR(dentry)) {
if (file->f_mode & FMODE_CREATED)
@@ -5153,7 +5185,7 @@ struct file *dentry_create(struct path *path, int flags, umode_t mode,
/* atomic_open will dput(dentry) on error */
dget(orig_dentry);
dentry = atomic_open(path, dentry, file, flags, mode);
dentry = atomic_open(path, dentry, file, flags, mode, create_error);
error = PTR_ERR_OR_ZERO(dentry);
if (IS_ERR(dentry))
@@ -5163,9 +5195,6 @@ struct file *dentry_create(struct path *path, int flags, umode_t mode,
/* Drop the extra reference */
dput(orig_dentry);
if (unlikely(create_error) && error == -ENOENT)
error = create_error;
if (!error) {
if (file->f_mode & FMODE_CREATED)
fsnotify_create(dir->d_inode, dentry);