* [PATCH] tmpfs: enforce the immutable flag on open files
@ 2025-12-06 12:03 Ahelenia Ziemiańska
2025-12-06 12:52 ` Matthew Wilcox
0 siblings, 1 reply; 3+ messages in thread
From: Ahelenia Ziemiańska @ 2025-12-06 12:03 UTC (permalink / raw)
To: Matthew Wilcox (Oracle),
Andrew Morton, Hugh Dickins, Baolin Wang, linux-fsdevel,
linux-mm, linux-kernel
[-- Attachment #1: Type: text/plain, Size: 3142 bytes --]
This useful behaviour is implemented for most filesystems,
and wants to be implemented for every filesystem, quoth ref:
There is general agreement that we should standardize all file systems
to prevent modifications even for files that were opened at the time
the immutable flag is set. Eventually, a change to enforce this at
the VFS layer should be landing in mainline.
References: commit 02b016ca7f99 ("ext4: enforce the immutable flag on
open files")
Signed-off-by: Ahelenia Ziemiańska <nabijaczleweli@nabijaczleweli.xyz>
---
/ext4# uname -a
Linux tarta 6.18.0-10912-g416f99c3b16f-dirty #1 SMP PREEMPT_DYNAMIC Sat Dec 6 12:14:41 CET 2025 x86_64 GNU/Linux
/ext4# while sleep 1; do echo $$; done > file &
[1] 262
/ext4# chattr +i file
/ext4# sh: line 25: echo: write error: Operation not permitted
sh: line 25: echo: write error: Operation not permitted
sh: line 25: echo: write error: Operation not permitted
sh: line 25: echo: write error: Operation not permitted
fg
while sleep 1; do
echo $$;
done > file
^C
/ext4# mount -t tmpfs tmpfs /tmp
/ext4# cd /tmp
/tmp# while sleep 1; do echo $$; done > file &
[1] 284
/tmp# chattr +i file
/tmp# sh: line 35: echo: write error: Operation not permitted
sh: line 35: echo: write error: Operation not permitted
sh: line 35: echo: write error: Operation not permitted
mm/filemap.c | 10 ++++++++--
mm/shmem.c | 12 ++++++++++++
2 files changed, 20 insertions(+), 2 deletions(-)
diff --git a/mm/filemap.c b/mm/filemap.c
index ebd75684cb0a..0b0d5cfbcd44 100644
--- a/mm/filemap.c
+++ b/mm/filemap.c
@@ -3945,12 +3945,18 @@ EXPORT_SYMBOL(filemap_map_pages);
vm_fault_t filemap_page_mkwrite(struct vm_fault *vmf)
{
- struct address_space *mapping = vmf->vma->vm_file->f_mapping;
+ struct file *file = vmf->vma->vm_file;
+ struct address_space *mapping = file->f_mapping;
struct folio *folio = page_folio(vmf->page);
vm_fault_t ret = VM_FAULT_LOCKED;
+ if (unlikely(IS_IMMUTABLE(file_inode(file)))) {
+ ret = VM_FAULT_SIGBUS;
+ goto out;
+ }
+
sb_start_pagefault(mapping->host->i_sb);
- file_update_time(vmf->vma->vm_file);
+ file_update_time(file);
folio_lock(folio);
if (folio->mapping != mapping) {
folio_unlock(folio);
diff --git a/mm/shmem.c b/mm/shmem.c
index d578d8e765d7..5d3fbf4efb3d 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -1294,6 +1294,14 @@ static int shmem_setattr(struct mnt_idmap *idmap,
bool update_mtime = false;
bool update_ctime = true;
+ if (unlikely(IS_IMMUTABLE(inode)))
+ return -EPERM;
+
+ if (unlikely(IS_APPEND(inode) &&
+ (attr->ia_valid & (ATTR_MODE | ATTR_UID |
+ ATTR_GID | ATTR_TIMES_SET))))
+ return -EPERM;
+
error = setattr_prepare(idmap, dentry, attr);
if (error)
return error;
@@ -3475,6 +3483,10 @@ static ssize_t shmem_file_write_iter(struct kiocb *iocb, struct iov_iter *from)
ret = generic_write_checks(iocb, from);
if (ret <= 0)
goto unlock;
+ if (unlikely(IS_IMMUTABLE(inode))) {
+ ret = -EPERM;
+ goto unlock;
+ }
ret = file_remove_privs(file);
if (ret)
goto unlock;
--
2.39.5
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] tmpfs: enforce the immutable flag on open files
2025-12-06 12:03 [PATCH] tmpfs: enforce the immutable flag on open files Ahelenia Ziemiańska
@ 2025-12-06 12:52 ` Matthew Wilcox
2025-12-06 15:15 ` Ahelenia Ziemiańska
0 siblings, 1 reply; 3+ messages in thread
From: Matthew Wilcox @ 2025-12-06 12:52 UTC (permalink / raw)
To: Ahelenia Ziemiańska
Cc: Andrew Morton, Hugh Dickins, Baolin Wang, linux-fsdevel,
linux-mm, linux-kernel
On Sat, Dec 06, 2025 at 01:03:35PM +0100, Ahelenia Ziemiańska wrote:
> diff --git a/mm/filemap.c b/mm/filemap.c
> index ebd75684cb0a..0b0d5cfbcd44 100644
> --- a/mm/filemap.c
> +++ b/mm/filemap.c
> @@ -3945,12 +3945,18 @@ EXPORT_SYMBOL(filemap_map_pages);
>
> vm_fault_t filemap_page_mkwrite(struct vm_fault *vmf)
> {
> - struct address_space *mapping = vmf->vma->vm_file->f_mapping;
> + struct file *file = vmf->vma->vm_file;
> + struct address_space *mapping = file->f_mapping;
> struct folio *folio = page_folio(vmf->page);
> vm_fault_t ret = VM_FAULT_LOCKED;
>
> + if (unlikely(IS_IMMUTABLE(file_inode(file)))) {
> + ret = VM_FAULT_SIGBUS;
> + goto out;
I don't believe you tested this code path. It contains a rather obvious
bug.
> + }
> +
> sb_start_pagefault(mapping->host->i_sb);
> - file_update_time(vmf->vma->vm_file);
> + file_update_time(file);
> folio_lock(folio);
> if (folio->mapping != mapping) {
> folio_unlock(folio);
> diff --git a/mm/shmem.c b/mm/shmem.c
> index d578d8e765d7..5d3fbf4efb3d 100644
> --- a/mm/shmem.c
> +++ b/mm/shmem.c
> @@ -1294,6 +1294,14 @@ static int shmem_setattr(struct mnt_idmap *idmap,
> bool update_mtime = false;
> bool update_ctime = true;
>
> + if (unlikely(IS_IMMUTABLE(inode)))
> + return -EPERM;
> +
> + if (unlikely(IS_APPEND(inode) &&
> + (attr->ia_valid & (ATTR_MODE | ATTR_UID |
> + ATTR_GID | ATTR_TIMES_SET))))
> + return -EPERM;
> +
> error = setattr_prepare(idmap, dentry, attr);
> if (error)
> return error;
> @@ -3475,6 +3483,10 @@ static ssize_t shmem_file_write_iter(struct kiocb *iocb, struct iov_iter *from)
> ret = generic_write_checks(iocb, from);
> if (ret <= 0)
> goto unlock;
> + if (unlikely(IS_IMMUTABLE(inode))) {
> + ret = -EPERM;
> + goto unlock;
> + }
> ret = file_remove_privs(file);
> if (ret)
> goto unlock;
> --
> 2.39.5
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] tmpfs: enforce the immutable flag on open files
2025-12-06 12:52 ` Matthew Wilcox
@ 2025-12-06 15:15 ` Ahelenia Ziemiańska
0 siblings, 0 replies; 3+ messages in thread
From: Ahelenia Ziemiańska @ 2025-12-06 15:15 UTC (permalink / raw)
To: Matthew Wilcox
Cc: Andrew Morton, Hugh Dickins, Baolin Wang, linux-fsdevel,
linux-mm, linux-kernel
[-- Attachment #1: Type: text/plain, Size: 1234 bytes --]
On Sat, Dec 06, 2025 at 12:52:37PM +0000, Matthew Wilcox wrote:
> On Sat, Dec 06, 2025 at 01:03:35PM +0100, Ahelenia Ziemiańska wrote:
> > diff --git a/mm/filemap.c b/mm/filemap.c
> > index ebd75684cb0a..0b0d5cfbcd44 100644
> > --- a/mm/filemap.c
> > +++ b/mm/filemap.c
> > @@ -3945,12 +3945,18 @@ EXPORT_SYMBOL(filemap_map_pages);
> >
> > vm_fault_t filemap_page_mkwrite(struct vm_fault *vmf)
> > {
> > - struct address_space *mapping = vmf->vma->vm_file->f_mapping;
> > + struct file *file = vmf->vma->vm_file;
> > + struct address_space *mapping = file->f_mapping;
> > struct folio *folio = page_folio(vmf->page);
> > vm_fault_t ret = VM_FAULT_LOCKED;
> >
> > + if (unlikely(IS_IMMUTABLE(file_inode(file)))) {
> > + ret = VM_FAULT_SIGBUS;
> > + goto out;
> I don't believe you tested this code path. It contains a rather obvious
> bug.
You're right, I tested this on ext4 twice and didn't realise;
this ought just be return VM_FAULT_SIGBUS;.
But even this doesn't work, because shmem{,_anon}_vm_ops
don't have a page_mkwrite callback at all,
much less it being filemap_page_mkwrite().
I'm not sure how I concluded that they do.
Adding a shmem_page_mkwrite() works for the mmap case.
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 833 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2025-12-06 15:15 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2025-12-06 12:03 [PATCH] tmpfs: enforce the immutable flag on open files Ahelenia Ziemiańska
2025-12-06 12:52 ` Matthew Wilcox
2025-12-06 15:15 ` Ahelenia Ziemiańska
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox