niansa-misc/linux
1
0
Fork 0
mirror of synced 2025-03-06 20:59:54 +01:00
Code Issues Projects Releases Packages Wiki Activity

xfs: hide metadata inodes from everyone because they are special

Browse source 
Metadata inodes are private files and therefore cannot be exposed to
userspace.  This means no bulkstat, no open-by-handle, no linking them
into the directory tree, and no feeding them to LSMs.  As such, we mark
them S_PRIVATE, which stops all that.

Signed-off-by: Darrick J. Wong <djwong@kernel.org>
Reviewed-by: Christoph Hellwig <hch@lst.de>
This commit is contained in:
Darrick J. Wong 2024-11-03 20:18:53 -08:00
parent 8651b410ae
commit bb6cdd5529
2 changed files with 22 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
fs/xfs/scrub/tempfile.c
View file

@ -844,6 +844,14 @@ xrep_is_tempfile(
const struct xfs_inode *ip) const struct xfs_inode *ip)
{ {
const struct inode *inode = &ip->i_vnode; const struct inode *inode = &ip->i_vnode;
struct xfs_mount *mp = ip->i_mount;
/*
* Files in the metadata directory tree also have S_PRIVATE set and
* IOP_XATTR unset, so we must distinguish them separately.
*/
if (xfs_has_metadir(mp) && (ip->i_diflags2 & XFS_DIFLAG2_METADATA))
return false;
if (IS_PRIVATE(inode) && !(inode->i_opflags & IOP_XATTR)) if (IS_PRIVATE(inode) && !(inode->i_opflags & IOP_XATTR))
return true; return true;

15
fs/xfs/xfs_iops.c
View file

@ -42,7 +42,9 @@
* held. For regular files, the lock order is the other way around - the * held. For regular files, the lock order is the other way around - the
* mmap_lock is taken during the page fault, and then we lock the ilock to do * mmap_lock is taken during the page fault, and then we lock the ilock to do
* block mapping. Hence we need a different class for the directory ilock so * block mapping. Hence we need a different class for the directory ilock so
* that lockdep can tell them apart. * that lockdep can tell them apart. Directories in the metadata directory
* tree get a separate class so that lockdep reports will warn us if someone
* ever tries to lock regular directories after locking metadata directories.
*/ */
static struct lock_class_key xfs_nondir_ilock_class; static struct lock_class_key xfs_nondir_ilock_class;
static struct lock_class_key xfs_dir_ilock_class; static struct lock_class_key xfs_dir_ilock_class;
@ -1289,6 +1291,7 @@ xfs_setup_inode(
{ {
struct inode *inode = &ip->i_vnode; struct inode *inode = &ip->i_vnode;
gfp_t gfp_mask; gfp_t gfp_mask;
bool is_meta = xfs_is_internal_inode(ip);
inode->i_ino = ip->i_ino; inode->i_ino = ip->i_ino;
inode->i_state |= I_NEW; inode->i_state |= I_NEW;
@ -1300,6 +1303,16 @@ xfs_setup_inode(
i_size_write(inode, ip->i_disk_size); i_size_write(inode, ip->i_disk_size);
xfs_diflags_to_iflags(ip, true); xfs_diflags_to_iflags(ip, true);
/*
* Mark our metadata files as private so that LSMs and the ACL code
* don't try to add their own metadata or reason about these files,
* and users cannot ever obtain file handles to them.
*/
if (is_meta) {
inode->i_flags |= S_PRIVATE;
inode->i_opflags &= ~IOP_XATTR;
}
if (S_ISDIR(inode->i_mode)) { if (S_ISDIR(inode->i_mode)) {
/* /*
* We set the i_rwsem class here to avoid potential races with * We set the i_rwsem class here to avoid potential races with