1 /* -*- linux-c -*- --------------------------------------------------------- *
2 *
3 * linux/fs/devpts/inode.c
4 *
5 * Copyright 1998-2004 H. Peter Anvin -- All Rights Reserved
6 *
7 * This file is part of the Linux kernel and is made available under
8 * the terms of the GNU General Public License, version 2, or at your
9 * option, any later version, incorporated herein by reference.
10 *
11 * ------------------------------------------------------------------------- */
12
13 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
14
15 #include <linux/module.h>
16 #include <linux/init.h>
17 #include <linux/fs.h>
18 #include <linux/sched.h>
19 #include <linux/namei.h>
20 #include <linux/slab.h>
21 #include <linux/mount.h>
22 #include <linux/tty.h>
23 #include <linux/mutex.h>
24 #include <linux/magic.h>
25 #include <linux/idr.h>
26 #include <linux/devpts_fs.h>
27 #include <linux/parser.h>
28 #include <linux/fsnotify.h>
29 #include <linux/seq_file.h>
30
31 #define DEVPTS_DEFAULT_MODE 0600
32 /*
33 * ptmx is a new node in /dev/pts and will be unused in legacy (single-
34 * instance) mode. To prevent surprises in user space, set permissions of
35 * ptmx to 0. Use 'chmod' or remount with '-o ptmxmode' to set meaningful
36 * permissions.
37 */
38 #define DEVPTS_DEFAULT_PTMX_MODE 0000
39 #define PTMX_MINOR 2
40
41 /*
42 * sysctl support for setting limits on the number of Unix98 ptys allocated.
43 * Otherwise one can eat up all kernel memory by opening /dev/ptmx repeatedly.
44 */
45 static int pty_limit = NR_UNIX98_PTY_DEFAULT;
46 static int pty_reserve = NR_UNIX98_PTY_RESERVE;
47 static int pty_limit_min;
48 static int pty_limit_max = INT_MAX;
49 static atomic_t pty_count = ATOMIC_INIT(0);
50
51 static struct ctl_table pty_table[] = {
52 {
53 .procname = "max",
54 .maxlen = sizeof(int),
55 .mode = 0644,
56 .data = &pty_limit,
57 .proc_handler = proc_dointvec_minmax,
58 .extra1 = &pty_limit_min,
59 .extra2 = &pty_limit_max,
60 }, {
61 .procname = "reserve",
62 .maxlen = sizeof(int),
63 .mode = 0644,
64 .data = &pty_reserve,
65 .proc_handler = proc_dointvec_minmax,
66 .extra1 = &pty_limit_min,
67 .extra2 = &pty_limit_max,
68 }, {
69 .procname = "nr",
70 .maxlen = sizeof(int),
71 .mode = 0444,
72 .data = &pty_count,
73 .proc_handler = proc_dointvec,
74 },
75 {}
76 };
77
78 static struct ctl_table pty_kern_table[] = {
79 {
80 .procname = "pty",
81 .mode = 0555,
82 .child = pty_table,
83 },
84 {}
85 };
86
87 static struct ctl_table pty_root_table[] = {
88 {
89 .procname = "kernel",
90 .mode = 0555,
91 .child = pty_kern_table,
92 },
93 {}
94 };
95
96 struct pts_mount_opts {
97 int setuid;
98 int setgid;
99 kuid_t uid;
100 kgid_t gid;
101 umode_t mode;
102 umode_t ptmxmode;
103 int reserve;
104 int max;
105 };
106
107 enum {
108 Opt_uid, Opt_gid, Opt_mode, Opt_ptmxmode, Opt_newinstance, Opt_max,
109 Opt_err
110 };
111
112 static const match_table_t tokens = {
113 {Opt_uid, "uid=%u"},
114 {Opt_gid, "gid=%u"},
115 {Opt_mode, "mode=%o"},
116 {Opt_ptmxmode, "ptmxmode=%o"},
117 {Opt_newinstance, "newinstance"},
118 {Opt_max, "max=%d"},
119 {Opt_err, NULL}
120 };
121
122 struct pts_fs_info {
123 struct ida allocated_ptys;
124 struct pts_mount_opts mount_opts;
125 struct super_block *sb;
126 struct dentry *ptmx_dentry;
127 };
128
DEVPTS_SB(struct super_block * sb)129 static inline struct pts_fs_info *DEVPTS_SB(struct super_block *sb)
130 {
131 return sb->s_fs_info;
132 }
133
devpts_ptmx_path(struct path * path)134 static int devpts_ptmx_path(struct path *path)
135 {
136 struct super_block *sb;
137 int err;
138
139 /* Is a devpts filesystem at "pts" in the same directory? */
140 err = path_pts(path);
141 if (err)
142 return err;
143
144 /* Is the path the root of a devpts filesystem? */
145 sb = path->mnt->mnt_sb;
146 if ((sb->s_magic != DEVPTS_SUPER_MAGIC) ||
147 (path->mnt->mnt_root != sb->s_root))
148 return -ENODEV;
149
150 return 0;
151 }
152
153 /*
154 * Try to find a suitable devpts filesystem. We support the following
155 * scenarios:
156 * - The ptmx device node is located in the same directory as the devpts
157 * mount where the pts device nodes are located.
158 * This is e.g. the case when calling open on the /dev/pts/ptmx device
159 * node when the devpts filesystem is mounted at /dev/pts.
160 * - The ptmx device node is located outside the devpts filesystem mount
161 * where the pts device nodes are located. For example, the ptmx device
162 * is a symlink, separate device node, or bind-mount.
163 * A supported scenario is bind-mounting /dev/pts/ptmx to /dev/ptmx and
164 * then calling open on /dev/ptmx. In this case a suitable pts
165 * subdirectory can be found in the common parent directory /dev of the
166 * devpts mount and the ptmx bind-mount, after resolving the /dev/ptmx
167 * bind-mount.
168 * If no suitable pts subdirectory can be found this function will fail.
169 * This is e.g. the case when bind-mounting /dev/pts/ptmx to /ptmx.
170 */
devpts_mntget(struct file * filp,struct pts_fs_info * fsi)171 struct vfsmount *devpts_mntget(struct file *filp, struct pts_fs_info *fsi)
172 {
173 struct path path;
174 int err = 0;
175
176 path = filp->f_path;
177 path_get(&path);
178
179 /* Walk upward while the start point is a bind mount of
180 * a single file.
181 */
182 while (path.mnt->mnt_root == path.dentry)
183 if (follow_up(&path) == 0)
184 break;
185
186 /* devpts_ptmx_path() finds a devpts fs or returns an error. */
187 if ((path.mnt->mnt_sb->s_magic != DEVPTS_SUPER_MAGIC) ||
188 (DEVPTS_SB(path.mnt->mnt_sb) != fsi))
189 err = devpts_ptmx_path(&path);
190 dput(path.dentry);
191 if (!err) {
192 if (DEVPTS_SB(path.mnt->mnt_sb) == fsi)
193 return path.mnt;
194
195 err = -ENODEV;
196 }
197
198 mntput(path.mnt);
199 return ERR_PTR(err);
200 }
201
devpts_acquire(struct file * filp)202 struct pts_fs_info *devpts_acquire(struct file *filp)
203 {
204 struct pts_fs_info *result;
205 struct path path;
206 struct super_block *sb;
207
208 path = filp->f_path;
209 path_get(&path);
210
211 /* Has the devpts filesystem already been found? */
212 if (path.mnt->mnt_sb->s_magic != DEVPTS_SUPER_MAGIC) {
213 int err;
214
215 err = devpts_ptmx_path(&path);
216 if (err) {
217 result = ERR_PTR(err);
218 goto out;
219 }
220 }
221
222 /*
223 * pty code needs to hold extra references in case of last /dev/tty close
224 */
225 sb = path.mnt->mnt_sb;
226 atomic_inc(&sb->s_active);
227 result = DEVPTS_SB(sb);
228
229 out:
230 path_put(&path);
231 return result;
232 }
233
devpts_release(struct pts_fs_info * fsi)234 void devpts_release(struct pts_fs_info *fsi)
235 {
236 deactivate_super(fsi->sb);
237 }
238
239 #define PARSE_MOUNT 0
240 #define PARSE_REMOUNT 1
241
242 /*
243 * parse_mount_options():
244 * Set @opts to mount options specified in @data. If an option is not
245 * specified in @data, set it to its default value.
246 *
247 * Note: @data may be NULL (in which case all options are set to default).
248 */
parse_mount_options(char * data,int op,struct pts_mount_opts * opts)249 static int parse_mount_options(char *data, int op, struct pts_mount_opts *opts)
250 {
251 char *p;
252 kuid_t uid;
253 kgid_t gid;
254
255 opts->setuid = 0;
256 opts->setgid = 0;
257 opts->uid = GLOBAL_ROOT_UID;
258 opts->gid = GLOBAL_ROOT_GID;
259 opts->mode = DEVPTS_DEFAULT_MODE;
260 opts->ptmxmode = DEVPTS_DEFAULT_PTMX_MODE;
261 opts->max = NR_UNIX98_PTY_MAX;
262
263 /* Only allow instances mounted from the initial mount
264 * namespace to tap the reserve pool of ptys.
265 */
266 if (op == PARSE_MOUNT)
267 opts->reserve =
268 (current->nsproxy->mnt_ns == init_task.nsproxy->mnt_ns);
269
270 while ((p = strsep(&data, ",")) != NULL) {
271 substring_t args[MAX_OPT_ARGS];
272 int token;
273 int option;
274
275 if (!*p)
276 continue;
277
278 token = match_token(p, tokens, args);
279 switch (token) {
280 case Opt_uid:
281 if (match_int(&args[0], &option))
282 return -EINVAL;
283 uid = make_kuid(current_user_ns(), option);
284 if (!uid_valid(uid))
285 return -EINVAL;
286 opts->uid = uid;
287 opts->setuid = 1;
288 break;
289 case Opt_gid:
290 if (match_int(&args[0], &option))
291 return -EINVAL;
292 gid = make_kgid(current_user_ns(), option);
293 if (!gid_valid(gid))
294 return -EINVAL;
295 opts->gid = gid;
296 opts->setgid = 1;
297 break;
298 case Opt_mode:
299 if (match_octal(&args[0], &option))
300 return -EINVAL;
301 opts->mode = option & S_IALLUGO;
302 break;
303 case Opt_ptmxmode:
304 if (match_octal(&args[0], &option))
305 return -EINVAL;
306 opts->ptmxmode = option & S_IALLUGO;
307 break;
308 case Opt_newinstance:
309 break;
310 case Opt_max:
311 if (match_int(&args[0], &option) ||
312 option < 0 || option > NR_UNIX98_PTY_MAX)
313 return -EINVAL;
314 opts->max = option;
315 break;
316 default:
317 pr_err("called with bogus options\n");
318 return -EINVAL;
319 }
320 }
321
322 return 0;
323 }
324
mknod_ptmx(struct super_block * sb)325 static int mknod_ptmx(struct super_block *sb)
326 {
327 int mode;
328 int rc = -ENOMEM;
329 struct dentry *dentry;
330 struct inode *inode;
331 struct dentry *root = sb->s_root;
332 struct pts_fs_info *fsi = DEVPTS_SB(sb);
333 struct pts_mount_opts *opts = &fsi->mount_opts;
334 kuid_t ptmx_uid = current_fsuid();
335 kgid_t ptmx_gid = current_fsgid();
336
337 inode_lock(d_inode(root));
338
339 /* If we have already created ptmx node, return */
340 if (fsi->ptmx_dentry) {
341 rc = 0;
342 goto out;
343 }
344
345 dentry = d_alloc_name(root, "ptmx");
346 if (!dentry) {
347 pr_err("Unable to alloc dentry for ptmx node\n");
348 goto out;
349 }
350
351 /*
352 * Create a new 'ptmx' node in this mount of devpts.
353 */
354 inode = new_inode(sb);
355 if (!inode) {
356 pr_err("Unable to alloc inode for ptmx node\n");
357 dput(dentry);
358 goto out;
359 }
360
361 inode->i_ino = 2;
362 inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode);
363
364 mode = S_IFCHR|opts->ptmxmode;
365 init_special_inode(inode, mode, MKDEV(TTYAUX_MAJOR, 2));
366 inode->i_uid = ptmx_uid;
367 inode->i_gid = ptmx_gid;
368
369 d_add(dentry, inode);
370
371 fsi->ptmx_dentry = dentry;
372 rc = 0;
373 out:
374 inode_unlock(d_inode(root));
375 return rc;
376 }
377
update_ptmx_mode(struct pts_fs_info * fsi)378 static void update_ptmx_mode(struct pts_fs_info *fsi)
379 {
380 struct inode *inode;
381 if (fsi->ptmx_dentry) {
382 inode = d_inode(fsi->ptmx_dentry);
383 inode->i_mode = S_IFCHR|fsi->mount_opts.ptmxmode;
384 }
385 }
386
devpts_remount(struct super_block * sb,int * flags,char * data)387 static int devpts_remount(struct super_block *sb, int *flags, char *data)
388 {
389 int err;
390 struct pts_fs_info *fsi = DEVPTS_SB(sb);
391 struct pts_mount_opts *opts = &fsi->mount_opts;
392
393 err = parse_mount_options(data, PARSE_REMOUNT, opts);
394
395 /*
396 * parse_mount_options() restores options to default values
397 * before parsing and may have changed ptmxmode. So, update the
398 * mode in the inode too. Bogus options don't fail the remount,
399 * so do this even on error return.
400 */
401 update_ptmx_mode(fsi);
402
403 return err;
404 }
405
devpts_show_options(struct seq_file * seq,struct dentry * root)406 static int devpts_show_options(struct seq_file *seq, struct dentry *root)
407 {
408 struct pts_fs_info *fsi = DEVPTS_SB(root->d_sb);
409 struct pts_mount_opts *opts = &fsi->mount_opts;
410
411 if (opts->setuid)
412 seq_printf(seq, ",uid=%u",
413 from_kuid_munged(&init_user_ns, opts->uid));
414 if (opts->setgid)
415 seq_printf(seq, ",gid=%u",
416 from_kgid_munged(&init_user_ns, opts->gid));
417 seq_printf(seq, ",mode=%03o", opts->mode);
418 seq_printf(seq, ",ptmxmode=%03o", opts->ptmxmode);
419 if (opts->max < NR_UNIX98_PTY_MAX)
420 seq_printf(seq, ",max=%d", opts->max);
421
422 return 0;
423 }
424
425 static const struct super_operations devpts_sops = {
426 .statfs = simple_statfs,
427 .remount_fs = devpts_remount,
428 .show_options = devpts_show_options,
429 };
430
new_pts_fs_info(struct super_block * sb)431 static void *new_pts_fs_info(struct super_block *sb)
432 {
433 struct pts_fs_info *fsi;
434
435 fsi = kzalloc(sizeof(struct pts_fs_info), GFP_KERNEL);
436 if (!fsi)
437 return NULL;
438
439 ida_init(&fsi->allocated_ptys);
440 fsi->mount_opts.mode = DEVPTS_DEFAULT_MODE;
441 fsi->mount_opts.ptmxmode = DEVPTS_DEFAULT_PTMX_MODE;
442 fsi->sb = sb;
443
444 return fsi;
445 }
446
447 static int
devpts_fill_super(struct super_block * s,void * data,int silent)448 devpts_fill_super(struct super_block *s, void *data, int silent)
449 {
450 struct inode *inode;
451 int error;
452
453 s->s_iflags &= ~SB_I_NODEV;
454 s->s_blocksize = 1024;
455 s->s_blocksize_bits = 10;
456 s->s_magic = DEVPTS_SUPER_MAGIC;
457 s->s_op = &devpts_sops;
458 s->s_d_op = &simple_dentry_operations;
459 s->s_time_gran = 1;
460
461 error = -ENOMEM;
462 s->s_fs_info = new_pts_fs_info(s);
463 if (!s->s_fs_info)
464 goto fail;
465
466 error = parse_mount_options(data, PARSE_MOUNT, &DEVPTS_SB(s)->mount_opts);
467 if (error)
468 goto fail;
469
470 error = -ENOMEM;
471 inode = new_inode(s);
472 if (!inode)
473 goto fail;
474 inode->i_ino = 1;
475 inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode);
476 inode->i_mode = S_IFDIR | S_IRUGO | S_IXUGO | S_IWUSR;
477 inode->i_op = &simple_dir_inode_operations;
478 inode->i_fop = &simple_dir_operations;
479 set_nlink(inode, 2);
480
481 s->s_root = d_make_root(inode);
482 if (!s->s_root) {
483 pr_err("get root dentry failed\n");
484 goto fail;
485 }
486
487 error = mknod_ptmx(s);
488 if (error)
489 goto fail_dput;
490
491 return 0;
492 fail_dput:
493 dput(s->s_root);
494 s->s_root = NULL;
495 fail:
496 return error;
497 }
498
499 /*
500 * devpts_mount()
501 *
502 * Mount a new (private) instance of devpts. PTYs created in this
503 * instance are independent of the PTYs in other devpts instances.
504 */
devpts_mount(struct file_system_type * fs_type,int flags,const char * dev_name,void * data)505 static struct dentry *devpts_mount(struct file_system_type *fs_type,
506 int flags, const char *dev_name, void *data)
507 {
508 return mount_nodev(fs_type, flags, data, devpts_fill_super);
509 }
510
devpts_kill_sb(struct super_block * sb)511 static void devpts_kill_sb(struct super_block *sb)
512 {
513 struct pts_fs_info *fsi = DEVPTS_SB(sb);
514
515 if (fsi)
516 ida_destroy(&fsi->allocated_ptys);
517 kfree(fsi);
518 kill_litter_super(sb);
519 }
520
521 static struct file_system_type devpts_fs_type = {
522 .name = "devpts",
523 .mount = devpts_mount,
524 .kill_sb = devpts_kill_sb,
525 .fs_flags = FS_USERNS_MOUNT,
526 };
527
528 /*
529 * The normal naming convention is simply /dev/pts/<number>; this conforms
530 * to the System V naming convention
531 */
532
devpts_new_index(struct pts_fs_info * fsi)533 int devpts_new_index(struct pts_fs_info *fsi)
534 {
535 int index = -ENOSPC;
536
537 if (atomic_inc_return(&pty_count) >= (pty_limit -
538 (fsi->mount_opts.reserve ? 0 : pty_reserve)))
539 goto out;
540
541 index = ida_alloc_max(&fsi->allocated_ptys, fsi->mount_opts.max - 1,
542 GFP_KERNEL);
543
544 out:
545 if (index < 0)
546 atomic_dec(&pty_count);
547 return index;
548 }
549
devpts_kill_index(struct pts_fs_info * fsi,int idx)550 void devpts_kill_index(struct pts_fs_info *fsi, int idx)
551 {
552 ida_free(&fsi->allocated_ptys, idx);
553 atomic_dec(&pty_count);
554 }
555
556 /**
557 * devpts_pty_new -- create a new inode in /dev/pts/
558 * @ptmx_inode: inode of the master
559 * @device: major+minor of the node to be created
560 * @index: used as a name of the node
561 * @priv: what's given back by devpts_get_priv
562 *
563 * The created inode is returned. Remove it from /dev/pts/ by devpts_pty_kill.
564 */
devpts_pty_new(struct pts_fs_info * fsi,int index,void * priv)565 struct dentry *devpts_pty_new(struct pts_fs_info *fsi, int index, void *priv)
566 {
567 struct dentry *dentry;
568 struct super_block *sb = fsi->sb;
569 struct inode *inode;
570 struct dentry *root;
571 struct pts_mount_opts *opts;
572 char s[12];
573
574 root = sb->s_root;
575 opts = &fsi->mount_opts;
576
577 inode = new_inode(sb);
578 if (!inode)
579 return ERR_PTR(-ENOMEM);
580
581 inode->i_ino = index + 3;
582 inode->i_uid = opts->setuid ? opts->uid : current_fsuid();
583 inode->i_gid = opts->setgid ? opts->gid : current_fsgid();
584 inode->i_mtime = inode->i_atime = inode->i_ctime = current_time(inode);
585 init_special_inode(inode, S_IFCHR|opts->mode, MKDEV(UNIX98_PTY_SLAVE_MAJOR, index));
586
587 sprintf(s, "%d", index);
588
589 dentry = d_alloc_name(root, s);
590 if (dentry) {
591 dentry->d_fsdata = priv;
592 d_add(dentry, inode);
593 fsnotify_create(d_inode(root), dentry);
594 } else {
595 iput(inode);
596 dentry = ERR_PTR(-ENOMEM);
597 }
598
599 return dentry;
600 }
601
602 /**
603 * devpts_get_priv -- get private data for a slave
604 * @pts_inode: inode of the slave
605 *
606 * Returns whatever was passed as priv in devpts_pty_new for a given inode.
607 */
devpts_get_priv(struct dentry * dentry)608 void *devpts_get_priv(struct dentry *dentry)
609 {
610 if (dentry->d_sb->s_magic != DEVPTS_SUPER_MAGIC)
611 return NULL;
612 return dentry->d_fsdata;
613 }
614
615 /**
616 * devpts_pty_kill -- remove inode form /dev/pts/
617 * @inode: inode of the slave to be removed
618 *
619 * This is an inverse operation of devpts_pty_new.
620 */
devpts_pty_kill(struct dentry * dentry)621 void devpts_pty_kill(struct dentry *dentry)
622 {
623 WARN_ON_ONCE(dentry->d_sb->s_magic != DEVPTS_SUPER_MAGIC);
624
625 dentry->d_fsdata = NULL;
626 drop_nlink(dentry->d_inode);
627 d_delete(dentry);
628 dput(dentry); /* d_alloc_name() in devpts_pty_new() */
629 }
630
init_devpts_fs(void)631 static int __init init_devpts_fs(void)
632 {
633 int err = register_filesystem(&devpts_fs_type);
634 if (!err) {
635 register_sysctl_table(pty_root_table);
636 }
637 return err;
638 }
639 module_init(init_devpts_fs)
640