Re: [RFC PATCH v3 5/7] btrfs-progs: sub list: Allow normal user to call "subvolume list/show"

[Misono, Tomohiro]

On 2018/03/20 2:09, Goffredo Baroncelli wrote:
> On 03/19/2018 08:32 AM, Misono, Tomohiro wrote
[snip]
>>  static void print_subvolume_column(struct root_info *subv,
>> enum btrfs_list_column_enum column)
>>  {
>> @@ -1492,19 +1800,33 @@ next:
>>  static int btrfs_list_subvols(int fd, struct root_lookup *root_lookup,
>>  const char *path)
>>  {
>> +uid_t uid;
>>  int ret;
>>  
>> -ret = list_subvol_search(fd, root_lookup);
>> -if (ret) {
>> -error("can't perform the search: %m");
>> -return ret;
>> +uid = geteuid();
>> +if (!uid) {
> 
> A minor tip: I think uid == 0 is better here, because we should check that 
> uid is root

ok, thanks.

> 
>> +ret = list_subvol_search(fd, root_lookup);
>> +if (ret) {
>> +error("can't perform the search: %s", strerror(-ret));
>> +return ret;
>> +}
>> +/*
>> + * now we have an rbtree full of root_info objects, but we
>> + * need to fill in their path names within the subvol that
>> + * is referencing each one.
>> + */
>> +ret = list_subvol_fill_paths(fd, root_lookup);
>> +} else {
>> +ret = list_subvol_user(fd, root_lookup, path);
>> +if (ret) {
>> +if (ret == -ENOTTY)
>> +error("can't perform the search: Operation by non-privileged user is not 
>> supported by this kernel.");
>> +else
>> +error("can't perform the search: %s",
>> +strerror(-ret));
>> +}
> 
> Sorry for noticing that only now: which is the reason to not using the new 
> api also in "root" case? I know that the behavior is a bit different, so my 
> question is: it is possible to extend the new ioctls to support also the old 
> behavior in the root case? So we could get rid of the "tree search" ioctl, 
> using it only for the old kernel

It is not possible to provide the same functionality for root by current 
implementation of ioctl.

Currently all three ioctls returns the information of subvolume which contains 
the fd's inode.
This is because to prevent a user from getting arbitrary subvolume information 
in the filesystem.

So, in order to work "sub list" with these new ioctls , we need to do:
1. open the path
2. call GET_SUBVOL_INFO to get the subvolume info of opened path.
3. call GET_SUBVOL_ROOTREF to get the list of child subvolume id.
4. call INO_LOOKUP_USER to check if a user can really access the (parent 
directory of) child subvolume and construct the path.
5. for each accessible child subvolume, repeat 1-5. 

Therefore there is no way to search subvolumes outside of mount point if the 
default subvolume
has been changed and cannot be used as an alternative of tree search ioctl for 
root.

If we pass a subvolid to be searched as an argument (allowing for root only), 
it is possible to use
these ioctls to replace tree search ioctl. However, this means the behavior of 
ioctl is different from
root and normal user. Is it a good thing? Also, the number of ioctl call 
certainly increases since 
GET_SUBVOL_INFO/SUBVOL_ROOTREF needs to be called for each subvolume while tree 
search returns multiple
information at once. I'd like to know others' opinions.

--
To unsubscribe from this list: send the line "unsubscribe linux-btrfs" in
the body of a message to majord...@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [RFC PATCH v3 5/7] btrfs-progs: sub list: Allow normal user to call "subvolume list/show"

[Goffredo Baroncelli]

On 03/19/2018 08:32 AM, Misono, Tomohiro wrote:
> Allow normal user to call "subvolume list/show" by using 3 new
> unprivileged ioctls (BTRFS_IOC_GET_SUBVOL_INFO,
> BTRFS_IOC_GET_SUBVOL_ROOTREF and BTRFS_IOC_INO_LOOKUP_USER).
> 
> Note that for root, "subvolume list" returns all the subvolume in the
> filesystem by default, but for normal user, it returns subvolumes
> which exist under the specified path (including the path itself).
> The specified path itself is not needed to be a subvolume.
> If the subvolume cannot be opend but the parent directory can be,
> the information other than name or id would be zeroed out.
> 
> Also, for normal user, snapshot filed of "subvolume show" just lists
> the snapshots under the specified subvolume.
> 
> Signed-off-by: Tomohiro Misono 
> ---
>  btrfs-list.c | 344 
> +--
>  cmds-subvolume.c |   8 ++
>  2 files changed, 341 insertions(+), 11 deletions(-)
> 
> diff --git a/btrfs-list.c b/btrfs-list.c
> index 833ff912..c819499f 100644
> --- a/btrfs-list.c
> +++ b/btrfs-list.c
> @@ -33,6 +33,7 @@
>  #include 
>  #include "btrfs-list.h"
>  #include "rbtree-utils.h"
> +#include 
>  
>  #define BTRFS_LIST_NFILTERS_INCREASE (2 * BTRFS_LIST_FILTER_MAX)
>  #define BTRFS_LIST_NCOMPS_INCREASE   (2 * BTRFS_LIST_COMP_MAX)
> @@ -549,6 +550,9 @@ static int resolve_root(struct root_lookup *rl, struct 
> root_info *ri,
>   int len = 0;
>   struct root_info *found;
>  
> + if (ri->full_path != NULL)
> + return 0;
> +
>   /*
>* we go backwards from the root_info object and add pathnames
>* from parent directories as we go.
> @@ -672,6 +676,50 @@ static int lookup_ino_path(int fd, struct root_info *ri)
>   return 0;
>  }
>  
> +/* user version of lookup_ino_path which also cheks the access right */
> +static int lookup_ino_path_user(int fd, struct root_info *ri)
> +{
> + struct btrfs_ioctl_ino_lookup_user_args args;
> + int ret = 0;
> +
> + if (ri->path)
> + return 0;
> + if (!ri->ref_tree)
> + return -ENOENT;
> +
> + memset(, 0, sizeof(args));
> + args.dirid = ri->dir_id;
> + args.subvolid = ri->root_id;
> +
> + ret = ioctl(fd, BTRFS_IOC_INO_LOOKUP_USER, );
> + if (ret < 0) {
> + if (errno == ENOENT) {
> + ri->ref_tree = 0;
> + return -ENOENT;
> + }
> + if (errno != EACCES) {
> + error("failed to lookup path for root %llu: %m",
> + (unsigned long long)ri->ref_tree);
> + return ret;
> + } else {
> + return -EACCES;
> + }
> + }
> +
> + ri->path = malloc(strlen(args.path) + strlen(args.name) + 1);
> + if (!ri->path)
> + return -ENOMEM;
> + strcpy(ri->path, args.path);
> +
> + ri->name = malloc(strlen(args.name) + 1);
> + if (!ri->name)
> + return -ENOMEM;
> + strcpy(ri->name, args.name);
> +
> + strcat(ri->path, ri->name);
> + return ret;
> +}
> +
>  /* finding the generation for a given path is a two step process.
>   * First we use the inode lookup routine to find out the root id
>   *
> @@ -1310,6 +1358,266 @@ static int list_subvol_fill_paths(int fd, struct 
> root_lookup *root_lookup)
>   return 0;
>  }
>  
> +static int fill_subvol_info(struct root_lookup *root_lookup, int fd)
> +{
> + struct btrfs_ioctl_get_subvol_info_args subvol_info;
> + u64 root_offset;
> + int ret;
> +
> + ret = ioctl(fd, BTRFS_IOC_GET_SUBVOL_INFO, _info);
> + if (ret < 0)
> + return -errno;
> +
> + if (!uuid_is_null(subvol_info.parent_uuid))
> + root_offset = subvol_info.otransid;
> + else
> + root_offset = 0;
> +
> + add_root(root_lookup, subvol_info.id, 0,
> +  root_offset, subvol_info.flags, subvol_info.dirid,
> +  NULL, 0,
> +  subvol_info.otransid, subvol_info.generation,
> +  subvol_info.otime.sec, subvol_info.uuid,
> +  subvol_info.parent_uuid, subvol_info.received_uuid);
> +
> + return 0;
> +}
> +
> +static int fill_subvol_info_top(struct root_lookup *root_lookup, int fd)
> +{
> + struct btrfs_ioctl_get_subvol_info_args subvol_info;
> + struct root_info *ri;
> + u64 root_offset;
> + int ret;
> +
> + ret = ioctl(fd, BTRFS_IOC_GET_SUBVOL_INFO, _info);
> + if (ret < 0)
> + return -errno;
> +
> + if (!uuid_is_null(subvol_info.parent_uuid))
> + root_offset = subvol_info.otransid;
> + else
> + root_offset = 0;
> +
> + add_root(root_lookup, subvol_info.id, subvol_info.parent_id,
> +  root_offset, subvol_info.flags, subvol_info.dirid,
> +  subvol_info.name, strlen(subvol_info.name),
> +  subvol_info.otransid, subvol_info.generation,
> + 

[RFC PATCH v3 5/7] btrfs-progs: sub list: Allow normal user to call "subvolume list/show"

[Misono, Tomohiro]

Allow normal user to call "subvolume list/show" by using 3 new
unprivileged ioctls (BTRFS_IOC_GET_SUBVOL_INFO,
BTRFS_IOC_GET_SUBVOL_ROOTREF and BTRFS_IOC_INO_LOOKUP_USER).

Note that for root, "subvolume list" returns all the subvolume in the
filesystem by default, but for normal user, it returns subvolumes
which exist under the specified path (including the path itself).
The specified path itself is not needed to be a subvolume.
If the subvolume cannot be opend but the parent directory can be,
the information other than name or id would be zeroed out.

Also, for normal user, snapshot filed of "subvolume show" just lists
the snapshots under the specified subvolume.

Signed-off-by: Tomohiro Misono 
---
 btrfs-list.c | 344 +--
 cmds-subvolume.c |   8 ++
 2 files changed, 341 insertions(+), 11 deletions(-)

diff --git a/btrfs-list.c b/btrfs-list.c
index 833ff912..c819499f 100644
--- a/btrfs-list.c
+++ b/btrfs-list.c
@@ -33,6 +33,7 @@
 #include 
 #include "btrfs-list.h"
 #include "rbtree-utils.h"
+#include 
 
 #define BTRFS_LIST_NFILTERS_INCREASE   (2 * BTRFS_LIST_FILTER_MAX)
 #define BTRFS_LIST_NCOMPS_INCREASE (2 * BTRFS_LIST_COMP_MAX)
@@ -549,6 +550,9 @@ static int resolve_root(struct root_lookup *rl, struct 
root_info *ri,
int len = 0;
struct root_info *found;
 
+   if (ri->full_path != NULL)
+   return 0;
+
/*
 * we go backwards from the root_info object and add pathnames
 * from parent directories as we go.
@@ -672,6 +676,50 @@ static int lookup_ino_path(int fd, struct root_info *ri)
return 0;
 }
 
+/* user version of lookup_ino_path which also cheks the access right */
+static int lookup_ino_path_user(int fd, struct root_info *ri)
+{
+   struct btrfs_ioctl_ino_lookup_user_args args;
+   int ret = 0;
+
+   if (ri->path)
+   return 0;
+   if (!ri->ref_tree)
+   return -ENOENT;
+
+   memset(, 0, sizeof(args));
+   args.dirid = ri->dir_id;
+   args.subvolid = ri->root_id;
+
+   ret = ioctl(fd, BTRFS_IOC_INO_LOOKUP_USER, );
+   if (ret < 0) {
+   if (errno == ENOENT) {
+   ri->ref_tree = 0;
+   return -ENOENT;
+   }
+   if (errno != EACCES) {
+   error("failed to lookup path for root %llu: %m",
+   (unsigned long long)ri->ref_tree);
+   return ret;
+   } else {
+   return -EACCES;
+   }
+   }
+
+   ri->path = malloc(strlen(args.path) + strlen(args.name) + 1);
+   if (!ri->path)
+   return -ENOMEM;
+   strcpy(ri->path, args.path);
+
+   ri->name = malloc(strlen(args.name) + 1);
+   if (!ri->name)
+   return -ENOMEM;
+   strcpy(ri->name, args.name);
+
+   strcat(ri->path, ri->name);
+   return ret;
+}
+
 /* finding the generation for a given path is a two step process.
  * First we use the inode lookup routine to find out the root id
  *
@@ -1310,6 +1358,266 @@ static int list_subvol_fill_paths(int fd, struct 
root_lookup *root_lookup)
return 0;
 }
 
+static int fill_subvol_info(struct root_lookup *root_lookup, int fd)
+{
+   struct btrfs_ioctl_get_subvol_info_args subvol_info;
+   u64 root_offset;
+   int ret;
+
+   ret = ioctl(fd, BTRFS_IOC_GET_SUBVOL_INFO, _info);
+   if (ret < 0)
+   return -errno;
+
+   if (!uuid_is_null(subvol_info.parent_uuid))
+   root_offset = subvol_info.otransid;
+   else
+   root_offset = 0;
+
+   add_root(root_lookup, subvol_info.id, 0,
+root_offset, subvol_info.flags, subvol_info.dirid,
+NULL, 0,
+subvol_info.otransid, subvol_info.generation,
+subvol_info.otime.sec, subvol_info.uuid,
+subvol_info.parent_uuid, subvol_info.received_uuid);
+
+   return 0;
+}
+
+static int fill_subvol_info_top(struct root_lookup *root_lookup, int fd)
+{
+   struct btrfs_ioctl_get_subvol_info_args subvol_info;
+   struct root_info *ri;
+   u64 root_offset;
+   int ret;
+
+   ret = ioctl(fd, BTRFS_IOC_GET_SUBVOL_INFO, _info);
+   if (ret < 0)
+   return -errno;
+
+   if (!uuid_is_null(subvol_info.parent_uuid))
+   root_offset = subvol_info.otransid;
+   else
+   root_offset = 0;
+
+   add_root(root_lookup, subvol_info.id, subvol_info.parent_id,
+root_offset, subvol_info.flags, subvol_info.dirid,
+subvol_info.name, strlen(subvol_info.name),
+subvol_info.otransid, subvol_info.generation,
+subvol_info.otime.sec, subvol_info.uuid,
+subvol_info.parent_uuid, subvol_info.received_uuid);
+
+   /*
+* fill the path since we won't lookup