mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2026-06-21 15:43:21 +02:00
Dorjoy Chowdhury
8b82cacad9
This flag indicates the path should be opened if it's a regular file. This is useful to write secure programs that want to avoid being tricked into opening device nodes with special semantics while thinking they operate on regular files. This is a requested feature from the uapi-group[1]. The previously introduced EFTYPE error code is returned when the path doesn't refer to a regular file. For example, if openat2 is called on path /dev/null with OPENAT2_REGULAR in the flag param, it will return -EFTYPE. When used in combination with O_CREAT, either the regular file is created, or if the path already exists, it is opened if it's a regular file. Otherwise, -EFTYPE is returned. When OPENAT2_REGULAR is combined with O_DIRECTORY, -EINVAL is returned as it doesn't make sense to open a path that is both a directory and a regular file. The UAPI bit lives in the upper 32 bits of open_how::flags (((__u64)1 << 32)) so that open(2) and openat(2) -- whose @flags argument is a C int -- cannot physically express it. This is a structural guarantee, not a runtime mask: the bit is unrepresentable in 32 bits. Because the rest of the VFS open path narrows to 32 bits in several places (op->open_flag, f->f_flags, the unsigned open_flag argument of i_op->atomic_open()), build_open_flags() translates OPENAT2_REGULAR into a kernel-internal lower-32-bit carrier __O_REGULAR (bit 4, unused as an O_* on every architecture) before the assignment to op->open_flag. __O_REGULAR then rides through the existing channels exactly like __FMODE_EXEC. do_dentry_open() strips it so it cannot leak back to userspace via fcntl(F_GETFL). Four BUILD_BUG_ON_MSG() invariants in build_open_flags() prevent any future bit collision or accidental low-32 redefinition: - VALID_OPEN_FLAGS fits in 32 bits. - OPENAT2_REGULAR lives in the upper 32 bits. - OPENAT2_REGULAR does not alias any open()/openat() flag. - __O_REGULAR does not alias any user-visible flag. [1]: https://uapi-group.org/kernel-features/#ability-to-only-open-regular-files Christian Brauner <brauner@kernel.org> says: Move OPENAT2_REGULAR to the upper 32 bits of open_how::flags with a kernel-internal __O_REGULAR carrier so that open(2)/openat(2) cannot encode the flag; add BUILD_BUG_ON_MSG() invariants and register __O_REGULAR in the fcntl_init() allocation-uniqueness BUILD_BUG_ON() (bit count 21 -> 22). Signed-off-by: Dorjoy Chowdhury <dorjoychy111@gmail.com> Link: https://patch.msgid.link/20260328172314.45807-2-dorjoychy111@gmail.com Reviewed-by: Jeff Layton <jlayton@kernel.org> Reviewed-by: Aleksa Sarai <aleksa@amutable.com> Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
51 lines
1.7 KiB
C
51 lines
1.7 KiB
C
/* SPDX-License-Identifier: GPL-2.0 WITH Linux-syscall-note */
|
|
#ifndef _UAPI_LINUX_OPENAT2_H
|
|
#define _UAPI_LINUX_OPENAT2_H
|
|
|
|
#include <linux/types.h>
|
|
|
|
/*
|
|
* Arguments for how openat2(2) should open the target path. If only @flags and
|
|
* @mode are non-zero, then openat2(2) operates very similarly to openat(2).
|
|
*
|
|
* However, unlike openat(2), unknown or invalid bits in @flags result in
|
|
* -EINVAL rather than being silently ignored. @mode must be zero unless one of
|
|
* {O_CREAT, O_TMPFILE} are set.
|
|
*
|
|
* @flags: O_* flags.
|
|
* @mode: O_CREAT/O_TMPFILE file mode.
|
|
* @resolve: RESOLVE_* flags.
|
|
*/
|
|
struct open_how {
|
|
__u64 flags;
|
|
__u64 mode;
|
|
__u64 resolve;
|
|
};
|
|
|
|
/*
|
|
* how->flags bits exclusive to openat2(2). These live in the upper 32 bits
|
|
* of @flags so that they cannot be expressed by open(2) / openat(2), whose
|
|
* @flags argument is a C int.
|
|
*/
|
|
#define OPENAT2_REGULAR ((__u64)1 << 32) /* Only open regular files. */
|
|
|
|
/* how->resolve flags for openat2(2). */
|
|
#define RESOLVE_NO_XDEV 0x01 /* Block mount-point crossings
|
|
(includes bind-mounts). */
|
|
#define RESOLVE_NO_MAGICLINKS 0x02 /* Block traversal through procfs-style
|
|
"magic-links". */
|
|
#define RESOLVE_NO_SYMLINKS 0x04 /* Block traversal through all symlinks
|
|
(implies OEXT_NO_MAGICLINKS) */
|
|
#define RESOLVE_BENEATH 0x08 /* Block "lexical" trickery like
|
|
"..", symlinks, and absolute
|
|
paths which escape the dirfd. */
|
|
#define RESOLVE_IN_ROOT 0x10 /* Make all jumps to "/" and ".."
|
|
be scoped inside the dirfd
|
|
(similar to chroot(2)). */
|
|
#define RESOLVE_CACHED 0x20 /* Only complete if resolution can be
|
|
completed through cached lookup. May
|
|
return -EAGAIN if that's not
|
|
possible. */
|
|
|
|
#endif /* _UAPI_LINUX_OPENAT2_H */
|