linux/fs/xfs/xfs_acl.c
<<
>>
Prefs
   1/*
   2 * Copyright (c) 2008, Christoph Hellwig
   3 * All Rights Reserved.
   4 *
   5 * This program is free software; you can redistribute it and/or
   6 * modify it under the terms of the GNU General Public License as
   7 * published by the Free Software Foundation.
   8 *
   9 * This program is distributed in the hope that it would be useful,
  10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  12 * GNU General Public License for more details.
  13 *
  14 * You should have received a copy of the GNU General Public License
  15 * along with this program; if not, write the Free Software Foundation,
  16 * Inc.,  51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  17 */
  18#include "xfs.h"
  19#include "xfs_acl.h"
  20#include "xfs_attr.h"
  21#include "xfs_bmap_btree.h"
  22#include "xfs_inode.h"
  23#include "xfs_vnodeops.h"
  24#include "xfs_sb.h"
  25#include "xfs_mount.h"
  26#include "xfs_trace.h"
  27#include <linux/slab.h>
  28#include <linux/xattr.h>
  29#include <linux/posix_acl_xattr.h>
  30
  31
  32/*
  33 * Locking scheme:
  34 *  - all ACL updates are protected by inode->i_mutex, which is taken before
  35 *    calling into this file.
  36 */
  37
  38STATIC struct posix_acl *
  39xfs_acl_from_disk(
  40        struct xfs_acl  *aclp,
  41        int             max_entries)
  42{
  43        struct posix_acl_entry *acl_e;
  44        struct posix_acl *acl;
  45        struct xfs_acl_entry *ace;
  46        unsigned int count, i;
  47
  48        count = be32_to_cpu(aclp->acl_cnt);
  49        if (count > max_entries)
  50                return ERR_PTR(-EFSCORRUPTED);
  51
  52        acl = posix_acl_alloc(count, GFP_KERNEL);
  53        if (!acl)
  54                return ERR_PTR(-ENOMEM);
  55
  56        for (i = 0; i < count; i++) {
  57                acl_e = &acl->a_entries[i];
  58                ace = &aclp->acl_entry[i];
  59
  60                /*
  61                 * The tag is 32 bits on disk and 16 bits in core.
  62                 *
  63                 * Because every access to it goes through the core
  64                 * format first this is not a problem.
  65                 */
  66                acl_e->e_tag = be32_to_cpu(ace->ae_tag);
  67                acl_e->e_perm = be16_to_cpu(ace->ae_perm);
  68
  69                switch (acl_e->e_tag) {
  70                case ACL_USER:
  71                case ACL_GROUP:
  72                        acl_e->e_id = be32_to_cpu(ace->ae_id);
  73                        break;
  74                case ACL_USER_OBJ:
  75                case ACL_GROUP_OBJ:
  76                case ACL_MASK:
  77                case ACL_OTHER:
  78                        acl_e->e_id = ACL_UNDEFINED_ID;
  79                        break;
  80                default:
  81                        goto fail;
  82                }
  83        }
  84        return acl;
  85
  86fail:
  87        posix_acl_release(acl);
  88        return ERR_PTR(-EINVAL);
  89}
  90
  91STATIC void
  92xfs_acl_to_disk(struct xfs_acl *aclp, const struct posix_acl *acl)
  93{
  94        const struct posix_acl_entry *acl_e;
  95        struct xfs_acl_entry *ace;
  96        int i;
  97
  98        aclp->acl_cnt = cpu_to_be32(acl->a_count);
  99        for (i = 0; i < acl->a_count; i++) {
 100                ace = &aclp->acl_entry[i];
 101                acl_e = &acl->a_entries[i];
 102
 103                ace->ae_tag = cpu_to_be32(acl_e->e_tag);
 104                ace->ae_id = cpu_to_be32(acl_e->e_id);
 105                ace->ae_perm = cpu_to_be16(acl_e->e_perm);
 106        }
 107}
 108
 109struct posix_acl *
 110xfs_get_acl(struct inode *inode, int type)
 111{
 112        struct xfs_inode *ip = XFS_I(inode);
 113        struct posix_acl *acl;
 114        struct xfs_acl *xfs_acl;
 115        unsigned char *ea_name;
 116        int error;
 117        int len;
 118
 119        acl = get_cached_acl(inode, type);
 120        if (acl != ACL_NOT_CACHED)
 121                return acl;
 122
 123        trace_xfs_get_acl(ip);
 124
 125        switch (type) {
 126        case ACL_TYPE_ACCESS:
 127                ea_name = SGI_ACL_FILE;
 128                break;
 129        case ACL_TYPE_DEFAULT:
 130                ea_name = SGI_ACL_DEFAULT;
 131                break;
 132        default:
 133                BUG();
 134        }
 135
 136        /*
 137         * If we have a cached ACLs value just return it, not need to
 138         * go out to the disk.
 139         */
 140        len = XFS_ACL_MAX_SIZE(ip->i_mount);
 141        xfs_acl = kzalloc(len, GFP_KERNEL);
 142        if (!xfs_acl)
 143                return ERR_PTR(-ENOMEM);
 144
 145        error = -xfs_attr_get(ip, ea_name, (unsigned char *)xfs_acl,
 146                                                        &len, ATTR_ROOT);
 147        if (error) {
 148                /*
 149                 * If the attribute doesn't exist make sure we have a negative
 150                 * cache entry, for any other error assume it is transient and
 151                 * leave the cache entry as ACL_NOT_CACHED.
 152                 */
 153                if (error == -ENOATTR) {
 154                        acl = NULL;
 155                        goto out_update_cache;
 156                }
 157                goto out;
 158        }
 159
 160        acl = xfs_acl_from_disk(xfs_acl, XFS_ACL_MAX_ENTRIES(ip->i_mount));
 161        if (IS_ERR(acl))
 162                goto out;
 163
 164 out_update_cache:
 165        set_cached_acl(inode, type, acl);
 166 out:
 167        kfree(xfs_acl);
 168        return acl;
 169}
 170
 171STATIC int
 172xfs_set_acl(struct inode *inode, int type, struct posix_acl *acl)
 173{
 174        struct xfs_inode *ip = XFS_I(inode);
 175        unsigned char *ea_name;
 176        int error;
 177
 178        if (S_ISLNK(inode->i_mode))
 179                return -EOPNOTSUPP;
 180
 181        switch (type) {
 182        case ACL_TYPE_ACCESS:
 183                ea_name = SGI_ACL_FILE;
 184                break;
 185        case ACL_TYPE_DEFAULT:
 186                if (!S_ISDIR(inode->i_mode))
 187                        return acl ? -EACCES : 0;
 188                ea_name = SGI_ACL_DEFAULT;
 189                break;
 190        default:
 191                return -EINVAL;
 192        }
 193
 194        if (acl) {
 195                struct xfs_acl *xfs_acl;
 196                int len = XFS_ACL_MAX_SIZE(ip->i_mount);
 197
 198                xfs_acl = kzalloc(len, GFP_KERNEL);
 199                if (!xfs_acl)
 200                        return -ENOMEM;
 201
 202                xfs_acl_to_disk(xfs_acl, acl);
 203
 204                /* subtract away the unused acl entries */
 205                len -= sizeof(struct xfs_acl_entry) *
 206                         (XFS_ACL_MAX_ENTRIES(ip->i_mount) - acl->a_count);
 207
 208                error = -xfs_attr_set(ip, ea_name, (unsigned char *)xfs_acl,
 209                                len, ATTR_ROOT);
 210
 211                kfree(xfs_acl);
 212        } else {
 213                /*
 214                 * A NULL ACL argument means we want to remove the ACL.
 215                 */
 216                error = -xfs_attr_remove(ip, ea_name, ATTR_ROOT);
 217
 218                /*
 219                 * If the attribute didn't exist to start with that's fine.
 220                 */
 221                if (error == -ENOATTR)
 222                        error = 0;
 223        }
 224
 225        if (!error)
 226                set_cached_acl(inode, type, acl);
 227        return error;
 228}
 229
 230static int
 231xfs_set_mode(struct inode *inode, umode_t mode)
 232{
 233        int error = 0;
 234
 235        if (mode != inode->i_mode) {
 236                struct iattr iattr;
 237
 238                iattr.ia_valid = ATTR_MODE | ATTR_CTIME;
 239                iattr.ia_mode = mode;
 240                iattr.ia_ctime = current_fs_time(inode->i_sb);
 241
 242                error = -xfs_setattr_nonsize(XFS_I(inode), &iattr, XFS_ATTR_NOACL);
 243        }
 244
 245        return error;
 246}
 247
 248static int
 249xfs_acl_exists(struct inode *inode, unsigned char *name)
 250{
 251        int len = XFS_ACL_MAX_SIZE(XFS_M(inode->i_sb));
 252
 253        return (xfs_attr_get(XFS_I(inode), name, NULL, &len,
 254                            ATTR_ROOT|ATTR_KERNOVAL) == 0);
 255}
 256
 257int
 258posix_acl_access_exists(struct inode *inode)
 259{
 260        return xfs_acl_exists(inode, SGI_ACL_FILE);
 261}
 262
 263int
 264posix_acl_default_exists(struct inode *inode)
 265{
 266        if (!S_ISDIR(inode->i_mode))
 267                return 0;
 268        return xfs_acl_exists(inode, SGI_ACL_DEFAULT);
 269}
 270
 271/*
 272 * No need for i_mutex because the inode is not yet exposed to the VFS.
 273 */
 274int
 275xfs_inherit_acl(struct inode *inode, struct posix_acl *acl)
 276{
 277        umode_t mode = inode->i_mode;
 278        int error = 0, inherit = 0;
 279
 280        if (S_ISDIR(inode->i_mode)) {
 281                error = xfs_set_acl(inode, ACL_TYPE_DEFAULT, acl);
 282                if (error)
 283                        goto out;
 284        }
 285
 286        error = posix_acl_create(&acl, GFP_KERNEL, &mode);
 287        if (error < 0)
 288                return error;
 289
 290        /*
 291         * If posix_acl_create returns a positive value we need to
 292         * inherit a permission that can't be represented using the Unix
 293         * mode bits and we actually need to set an ACL.
 294         */
 295        if (error > 0)
 296                inherit = 1;
 297
 298        error = xfs_set_mode(inode, mode);
 299        if (error)
 300                goto out;
 301
 302        if (inherit)
 303                error = xfs_set_acl(inode, ACL_TYPE_ACCESS, acl);
 304
 305out:
 306        posix_acl_release(acl);
 307        return error;
 308}
 309
 310int
 311xfs_acl_chmod(struct inode *inode)
 312{
 313        struct posix_acl *acl;
 314        int error;
 315
 316        if (S_ISLNK(inode->i_mode))
 317                return -EOPNOTSUPP;
 318
 319        acl = xfs_get_acl(inode, ACL_TYPE_ACCESS);
 320        if (IS_ERR(acl) || !acl)
 321                return PTR_ERR(acl);
 322
 323        error = posix_acl_chmod(&acl, GFP_KERNEL, inode->i_mode);
 324        if (error)
 325                return error;
 326
 327        error = xfs_set_acl(inode, ACL_TYPE_ACCESS, acl);
 328        posix_acl_release(acl);
 329        return error;
 330}
 331
 332static int
 333xfs_xattr_acl_get(struct dentry *dentry, const char *name,
 334                void *value, size_t size, int type)
 335{
 336        struct posix_acl *acl;
 337        int error;
 338
 339        acl = xfs_get_acl(dentry->d_inode, type);
 340        if (IS_ERR(acl))
 341                return PTR_ERR(acl);
 342        if (acl == NULL)
 343                return -ENODATA;
 344
 345        error = posix_acl_to_xattr(&init_user_ns, acl, value, size);
 346        posix_acl_release(acl);
 347
 348        return error;
 349}
 350
 351static int
 352xfs_xattr_acl_set(struct dentry *dentry, const char *name,
 353                const void *value, size_t size, int flags, int type)
 354{
 355        struct inode *inode = dentry->d_inode;
 356        struct posix_acl *acl = NULL;
 357        int error = 0;
 358
 359        if (flags & XATTR_CREATE)
 360                return -EINVAL;
 361        if (type == ACL_TYPE_DEFAULT && !S_ISDIR(inode->i_mode))
 362                return value ? -EACCES : 0;
 363        if ((current_fsuid() != inode->i_uid) && !capable(CAP_FOWNER))
 364                return -EPERM;
 365
 366        if (!value)
 367                goto set_acl;
 368
 369        acl = posix_acl_from_xattr(&init_user_ns, value, size);
 370        if (!acl) {
 371                /*
 372                 * acl_set_file(3) may request that we set default ACLs with
 373                 * zero length -- defend (gracefully) against that here.
 374                 */
 375                goto out;
 376        }
 377        if (IS_ERR(acl)) {
 378                error = PTR_ERR(acl);
 379                goto out;
 380        }
 381
 382        error = posix_acl_valid(acl);
 383        if (error)
 384                goto out_release;
 385
 386        error = -EINVAL;
 387        if (acl->a_count > XFS_ACL_MAX_ENTRIES(XFS_M(inode->i_sb)))
 388                goto out_release;
 389
 390        if (type == ACL_TYPE_ACCESS) {
 391                umode_t mode = inode->i_mode;
 392                error = posix_acl_equiv_mode(acl, &mode);
 393
 394                if (error <= 0) {
 395                        posix_acl_release(acl);
 396                        acl = NULL;
 397
 398                        if (error < 0)
 399                                return error;
 400                }
 401
 402                error = xfs_set_mode(inode, mode);
 403                if (error)
 404                        goto out_release;
 405        }
 406
 407 set_acl:
 408        error = xfs_set_acl(inode, type, acl);
 409 out_release:
 410        posix_acl_release(acl);
 411 out:
 412        return error;
 413}
 414
 415const struct xattr_handler xfs_xattr_acl_access_handler = {
 416        .prefix = POSIX_ACL_XATTR_ACCESS,
 417        .flags  = ACL_TYPE_ACCESS,
 418        .get    = xfs_xattr_acl_get,
 419        .set    = xfs_xattr_acl_set,
 420};
 421
 422const struct xattr_handler xfs_xattr_acl_default_handler = {
 423        .prefix = POSIX_ACL_XATTR_DEFAULT,
 424        .flags  = ACL_TYPE_DEFAULT,
 425        .get    = xfs_xattr_acl_get,
 426        .set    = xfs_xattr_acl_set,
 427};
 428
lxr.linux.no kindly hosted by Redpill Linpro AS, provider of Linux consulting and operations services since 1995.