4 * Copyright (C) 1991, 1992 Linus Torvalds
5 * changes by Thomas Schoebel-Theuer
8 #include <linux/module.h>
9 #include <linux/time.h>
11 #include <linux/string.h>
12 #include <linux/capability.h>
13 #include <linux/fsnotify.h>
14 #include <linux/fcntl.h>
15 #include <linux/security.h>
17 /* Taken over from the old code... */
19 /* POSIX UID/GID verification for setting inode attributes. */
20 int inode_change_ok(const struct inode
*inode
, struct iattr
*attr
)
23 unsigned int ia_valid
= attr
->ia_valid
;
25 /* If force is set do it anyway. */
26 if (ia_valid
& ATTR_FORCE
)
29 /* Make sure a caller can chown. */
30 if ((ia_valid
& ATTR_UID
) &&
31 (current_fsuid() != inode
->i_uid
||
32 attr
->ia_uid
!= inode
->i_uid
) && !capable(CAP_CHOWN
))
35 /* Make sure caller can chgrp. */
36 if ((ia_valid
& ATTR_GID
) &&
37 (current_fsuid() != inode
->i_uid
||
38 (!in_group_p(attr
->ia_gid
) && attr
->ia_gid
!= inode
->i_gid
)) &&
42 /* Make sure a caller can chmod. */
43 if (ia_valid
& ATTR_MODE
) {
44 if (!is_owner_or_cap(inode
))
46 /* Also check the setgid bit! */
47 if (!in_group_p((ia_valid
& ATTR_GID
) ? attr
->ia_gid
:
48 inode
->i_gid
) && !capable(CAP_FSETID
))
49 attr
->ia_mode
&= ~S_ISGID
;
52 /* Check for setting the inode time. */
53 if (ia_valid
& (ATTR_MTIME_SET
| ATTR_ATIME_SET
| ATTR_TIMES_SET
)) {
54 if (!is_owner_or_cap(inode
))
62 EXPORT_SYMBOL(inode_change_ok
);
65 * inode_newsize_ok - may this inode be truncated to a given size
66 * @inode: the inode to be truncated
67 * @offset: the new size to assign to the inode
68 * @Returns: 0 on success, -ve errno on failure
70 * inode_newsize_ok must be called with i_mutex held.
72 * inode_newsize_ok will check filesystem limits and ulimits to check that the
73 * new inode size is within limits. inode_newsize_ok will also send SIGXFSZ
74 * when necessary. Caller must not proceed with inode size change if failure is
75 * returned. @inode must be a file (not directory), with appropriate
76 * permissions to allow truncate (inode_newsize_ok does NOT check these
79 int inode_newsize_ok(const struct inode
*inode
, loff_t offset
)
81 if (inode
->i_size
< offset
) {
84 limit
= rlimit(RLIMIT_FSIZE
);
85 if (limit
!= RLIM_INFINITY
&& offset
> limit
)
87 if (offset
> inode
->i_sb
->s_maxbytes
)
91 * truncation of in-use swapfiles is disallowed - it would
92 * cause subsequent swapout to scribble on the now-freed
95 if (IS_SWAPFILE(inode
))
101 send_sig(SIGXFSZ
, current
, 0);
105 EXPORT_SYMBOL(inode_newsize_ok
);
108 * setattr_copy - copy simple metadata updates into the generic inode
109 * @inode: the inode to be updated
110 * @attr: the new attributes
112 * setattr_copy must be called with i_mutex held.
114 * setattr_copy updates the inode's metadata with that specified
115 * in attr. Noticably missing is inode size update, which is more complex
116 * as it requires pagecache updates. See simple_setsize.
118 * The inode is not marked as dirty after this operation. The rationale is
119 * that for "simple" filesystems, the struct inode is the inode storage.
120 * The caller is free to mark the inode dirty afterwards if needed.
122 void setattr_copy(struct inode
*inode
, const struct iattr
*attr
)
124 unsigned int ia_valid
= attr
->ia_valid
;
126 if (ia_valid
& ATTR_UID
)
127 inode
->i_uid
= attr
->ia_uid
;
128 if (ia_valid
& ATTR_GID
)
129 inode
->i_gid
= attr
->ia_gid
;
130 if (ia_valid
& ATTR_ATIME
)
131 inode
->i_atime
= timespec_trunc(attr
->ia_atime
,
132 inode
->i_sb
->s_time_gran
);
133 if (ia_valid
& ATTR_MTIME
)
134 inode
->i_mtime
= timespec_trunc(attr
->ia_mtime
,
135 inode
->i_sb
->s_time_gran
);
136 if (ia_valid
& ATTR_CTIME
)
137 inode
->i_ctime
= timespec_trunc(attr
->ia_ctime
,
138 inode
->i_sb
->s_time_gran
);
139 if (ia_valid
& ATTR_MODE
) {
140 umode_t mode
= attr
->ia_mode
;
142 if (!in_group_p(inode
->i_gid
) && !capable(CAP_FSETID
))
144 inode
->i_mode
= mode
;
147 EXPORT_SYMBOL(setattr_copy
);
149 int notify_change(struct dentry
* dentry
, struct iattr
* attr
)
151 struct inode
*inode
= dentry
->d_inode
;
152 mode_t mode
= inode
->i_mode
;
155 unsigned int ia_valid
= attr
->ia_valid
;
157 if (ia_valid
& (ATTR_MODE
| ATTR_UID
| ATTR_GID
| ATTR_TIMES_SET
)) {
158 if (IS_IMMUTABLE(inode
) || IS_APPEND(inode
))
162 now
= current_fs_time(inode
->i_sb
);
164 attr
->ia_ctime
= now
;
165 if (!(ia_valid
& ATTR_ATIME_SET
))
166 attr
->ia_atime
= now
;
167 if (!(ia_valid
& ATTR_MTIME_SET
))
168 attr
->ia_mtime
= now
;
169 if (ia_valid
& ATTR_KILL_PRIV
) {
170 attr
->ia_valid
&= ~ATTR_KILL_PRIV
;
171 ia_valid
&= ~ATTR_KILL_PRIV
;
172 error
= security_inode_need_killpriv(dentry
);
174 error
= security_inode_killpriv(dentry
);
180 * We now pass ATTR_KILL_S*ID to the lower level setattr function so
181 * that the function has the ability to reinterpret a mode change
182 * that's due to these bits. This adds an implicit restriction that
183 * no function will ever call notify_change with both ATTR_MODE and
184 * ATTR_KILL_S*ID set.
186 if ((ia_valid
& (ATTR_KILL_SUID
|ATTR_KILL_SGID
)) &&
187 (ia_valid
& ATTR_MODE
))
190 if (ia_valid
& ATTR_KILL_SUID
) {
191 if (mode
& S_ISUID
) {
192 ia_valid
= attr
->ia_valid
|= ATTR_MODE
;
193 attr
->ia_mode
= (inode
->i_mode
& ~S_ISUID
);
196 if (ia_valid
& ATTR_KILL_SGID
) {
197 if ((mode
& (S_ISGID
| S_IXGRP
)) == (S_ISGID
| S_IXGRP
)) {
198 if (!(ia_valid
& ATTR_MODE
)) {
199 ia_valid
= attr
->ia_valid
|= ATTR_MODE
;
200 attr
->ia_mode
= inode
->i_mode
;
202 attr
->ia_mode
&= ~S_ISGID
;
205 if (!(attr
->ia_valid
& ~(ATTR_KILL_SUID
| ATTR_KILL_SGID
)))
208 error
= security_inode_setattr(dentry
, attr
);
212 if (ia_valid
& ATTR_SIZE
)
213 down_write(&dentry
->d_inode
->i_alloc_sem
);
215 if (inode
->i_op
->setattr
)
216 error
= inode
->i_op
->setattr(dentry
, attr
);
218 error
= simple_setattr(dentry
, attr
);
220 if (ia_valid
& ATTR_SIZE
)
221 up_write(&dentry
->d_inode
->i_alloc_sem
);
224 fsnotify_change(dentry
, ia_valid
);
229 EXPORT_SYMBOL(notify_change
);