dont-allow-any-modifications-to-an-immutable-file

   1 ext4: don't allow any modifications to an immutable file
   2
   3 From: Darrick J. Wong <darrick.wong@oracle.com>
   4
   5 Don't allow any modifications to a file that's marked immutable, which
   6 means that we have to flush all the writable pages to make the readonly
   7 and we have to check the setattr/setflags parameters more closely.
   8
   9 Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>
  10 Signed-off-by: Theodore Ts'o <tytso@mit.edu>
  11 Cc: stable@kernel.org
  12 ---
  13  fs/ext4/ioctl.c | 46 +++++++++++++++++++++++++++++++++++++++++++++-
  14  1 file changed, 45 insertions(+), 1 deletion(-)
  15
  16 diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
  17 index e486e49b31ed..7af835ac8d23 100644
  18 --- a/fs/ext4/ioctl.c
  19 +++ b/fs/ext4/ioctl.c
  20 @@ -269,6 +269,29 @@ static int uuid_is_zero(__u8 u[16])
  21  }
  22  #endif
  23
  24 +/*
  25 + * If immutable is set and we are not clearing it, we're not allowed to change
  26 + * anything else in the inode.  Don't error out if we're only trying to set
  27 + * immutable on an immutable file.
  28 + */
  29 +static int ext4_ioctl_check_immutable(struct inode *inode, __u32 new_projid,
  30 +                                     unsigned int flags)
  31 +{
  32 +       struct ext4_inode_info *ei = EXT4_I(inode);
  33 +       unsigned int oldflags = ei->i_flags;
  34 +
  35 +       if (!(oldflags & EXT4_IMMUTABLE_FL) || !(flags & EXT4_IMMUTABLE_FL))
  36 +               return 0;
  37 +
  38 +       if ((oldflags & ~EXT4_IMMUTABLE_FL) != (flags & ~EXT4_IMMUTABLE_FL))
  39 +               return -EPERM;
  40 +       if (ext4_has_feature_project(inode->i_sb) &&
  41 +           __kprojid_val(ei->i_projid) != new_projid)
  42 +               return -EPERM;
  43 +
  44 +       return 0;
  45 +}
  46 +
  47  static int ext4_ioctl_setflags(struct inode *inode,
  48                                unsigned int flags)
  49  {
  50 @@ -340,6 +363,20 @@ static int ext4_ioctl_setflags(struct inode *inode,
  51                 }
  52         }
  53
  54 +       /*
  55 +        * Wait for all pending directio and then flush all the dirty pages
  56 +        * for this file.  The flush marks all the pages readonly, so any
  57 +        * subsequent attempt to write to the file (particularly mmap pages)
  58 +        * will come through the filesystem and fail.
  59 +        */
  60 +       if (S_ISREG(inode->i_mode) && !IS_IMMUTABLE(inode) &&
  61 +           (flags & EXT4_IMMUTABLE_FL)) {
  62 +               inode_dio_wait(inode);
  63 +               err = filemap_write_and_wait(inode->i_mapping);
  64 +               if (err)
  65 +                       goto flags_out;
  66 +       }
  67 +
  68         handle = ext4_journal_start(inode, EXT4_HT_INODE, 1);
  69         if (IS_ERR(handle)) {
  70                 err = PTR_ERR(handle);
  71 @@ -769,7 +806,11 @@ long ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
  72                         return err;
  73
  74                 inode_lock(inode);
  75 -               err = ext4_ioctl_setflags(inode, flags);
  76 +               err = ext4_ioctl_check_immutable(inode,
  77 +                               from_kprojid(&init_user_ns, ei->i_projid),
  78 +                               flags);
  79 +               if (!err)
  80 +                       err = ext4_ioctl_setflags(inode, flags);
  81                 inode_unlock(inode);
  82                 mnt_drop_write_file(filp);
  83                 return err;
  84 @@ -1139,6 +1180,9 @@ long ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
  85                         goto out;
  86                 flags = (ei->i_flags & ~EXT4_FL_XFLAG_VISIBLE) |
  87                          (flags & EXT4_FL_XFLAG_VISIBLE);
  88 +               err = ext4_ioctl_check_immutable(inode, fa.fsx_projid, flags);
  89 +               if (err)
  90 +                       goto out;
  91                 err = ext4_ioctl_setflags(inode, flags);
  92                 if (err)
  93                         goto out;