From: Andreas Gruenbacher <andreas.gruenbacher@gmail.com> To: linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-nfs@vger.kernel.org Subject: [RFC v3 22/45] vfs: Add richacl permission checking Date: Fri, 24 Apr 2015 13:04:19 +0200 [thread overview] Message-ID: <5b2624871e0ac5f1d0e5c5da6d99ca7dc93158e3.1429868795.git.agruenba@redhat.com> (raw) In-Reply-To: <cover.1429868795.git.agruenba@redhat.com> In-Reply-To: <cover.1429868795.git.agruenba@redhat.com> Hook the richacl permission checking function into the vfs. Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com> --- fs/namei.c | 51 +++++++++++++++++++++++++++++++++++++++++++++++++-- fs/posix_acl.c | 6 +++--- 2 files changed, 52 insertions(+), 5 deletions(-) diff --git a/fs/namei.c b/fs/namei.c index a8d1674..d5b4fcd 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -35,6 +35,7 @@ #include <linux/fs_struct.h> #include <linux/posix_acl.h> #include <linux/hash.h> +#include <linux/richacl.h> #include <asm/uaccess.h> #include "internal.h" @@ -256,7 +257,40 @@ void putname(struct filename *name) __putname(name); } -static int check_acl(struct inode *inode, int mask) +static int check_richacl(struct inode *inode, int mask) +{ +#ifdef CONFIG_FS_RICHACL + struct richacl *acl; + + if (mask & MAY_NOT_BLOCK) { + acl = get_cached_richacl_rcu(inode); + if (!acl) + goto no_acl; + /* no ->get_richacl() calls in RCU mode... */ + if (acl == ACL_NOT_CACHED) + return -ECHILD; + return richacl_permission(inode, acl, mask & ~MAY_NOT_BLOCK); + } + + acl = get_richacl(inode); + if (IS_ERR(acl)) + return PTR_ERR(acl); + if (acl) { + int error = richacl_permission(inode, acl, mask); + richacl_put(acl); + return error; + } +no_acl: +#endif + if (mask & (MAY_DELETE_SELF | MAY_TAKE_OWNERSHIP | + MAY_CHMOD | MAY_SET_TIMES)) { + /* File permission bits cannot grant this. */ + return -EACCES; + } + return -EAGAIN; +} + +static int check_posix_acl(struct inode *inode, int mask) { #ifdef CONFIG_FS_POSIX_ACL struct posix_acl *acl; @@ -291,11 +325,24 @@ static int acl_permission_check(struct inode *inode, int mask) { unsigned int mode = inode->i_mode; + /* + * With POSIX ACLs, the (mode & S_IRWXU) bits exactly match the owner + * permissions, and we can skip checking posix acls for the owner. + * With richacls, the owner may be granted fewer permissions than the + * mode bits seem to suggest (for example, append but not write), and + * we always need to check the richacl. + */ + + if (IS_RICHACL(inode)) { + int error = check_richacl(inode, mask); + if (error != -EAGAIN) + return error; + } if (likely(uid_eq(current_fsuid(), inode->i_uid))) mode >>= 6; else { if (IS_POSIXACL(inode) && (mode & S_IRWXG)) { - int error = check_acl(inode, mask); + int error = check_posix_acl(inode, mask); if (error != -EAGAIN) return error; } diff --git a/fs/posix_acl.c b/fs/posix_acl.c index ebf96b2..16464f0 100644 --- a/fs/posix_acl.c +++ b/fs/posix_acl.c @@ -100,13 +100,13 @@ struct posix_acl *get_acl(struct inode *inode, int type) { struct posix_acl *acl; + if (!IS_POSIXACL(inode)) + return NULL; + acl = get_cached_acl(inode, type); if (acl != ACL_NOT_CACHED) return acl; - if (!IS_POSIXACL(inode)) - return NULL; - /* * A filesystem can force a ACL callback by just never filling the * ACL cache. But normally you'd fill the cache either at inode -- 2.1.0
WARNING: multiple messages have this Message-ID (diff)
From: Andreas Gruenbacher <andreas.gruenbacher-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> To: linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-fsdevel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-nfs-u79uwXL29TY76Z2rM5mHXA@public.gmane.org Subject: [RFC v3 22/45] vfs: Add richacl permission checking Date: Fri, 24 Apr 2015 13:04:19 +0200 [thread overview] Message-ID: <5b2624871e0ac5f1d0e5c5da6d99ca7dc93158e3.1429868795.git.agruenba@redhat.com> (raw) In-Reply-To: <cover.1429868795.git.agruenba-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org> In-Reply-To: <cover.1429868795.git.agruenba-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org> Hook the richacl permission checking function into the vfs. Signed-off-by: Andreas Gruenbacher <agruenba-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org> --- fs/namei.c | 51 +++++++++++++++++++++++++++++++++++++++++++++++++-- fs/posix_acl.c | 6 +++--- 2 files changed, 52 insertions(+), 5 deletions(-) diff --git a/fs/namei.c b/fs/namei.c index a8d1674..d5b4fcd 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -35,6 +35,7 @@ #include <linux/fs_struct.h> #include <linux/posix_acl.h> #include <linux/hash.h> +#include <linux/richacl.h> #include <asm/uaccess.h> #include "internal.h" @@ -256,7 +257,40 @@ void putname(struct filename *name) __putname(name); } -static int check_acl(struct inode *inode, int mask) +static int check_richacl(struct inode *inode, int mask) +{ +#ifdef CONFIG_FS_RICHACL + struct richacl *acl; + + if (mask & MAY_NOT_BLOCK) { + acl = get_cached_richacl_rcu(inode); + if (!acl) + goto no_acl; + /* no ->get_richacl() calls in RCU mode... */ + if (acl == ACL_NOT_CACHED) + return -ECHILD; + return richacl_permission(inode, acl, mask & ~MAY_NOT_BLOCK); + } + + acl = get_richacl(inode); + if (IS_ERR(acl)) + return PTR_ERR(acl); + if (acl) { + int error = richacl_permission(inode, acl, mask); + richacl_put(acl); + return error; + } +no_acl: +#endif + if (mask & (MAY_DELETE_SELF | MAY_TAKE_OWNERSHIP | + MAY_CHMOD | MAY_SET_TIMES)) { + /* File permission bits cannot grant this. */ + return -EACCES; + } + return -EAGAIN; +} + +static int check_posix_acl(struct inode *inode, int mask) { #ifdef CONFIG_FS_POSIX_ACL struct posix_acl *acl; @@ -291,11 +325,24 @@ static int acl_permission_check(struct inode *inode, int mask) { unsigned int mode = inode->i_mode; + /* + * With POSIX ACLs, the (mode & S_IRWXU) bits exactly match the owner + * permissions, and we can skip checking posix acls for the owner. + * With richacls, the owner may be granted fewer permissions than the + * mode bits seem to suggest (for example, append but not write), and + * we always need to check the richacl. + */ + + if (IS_RICHACL(inode)) { + int error = check_richacl(inode, mask); + if (error != -EAGAIN) + return error; + } if (likely(uid_eq(current_fsuid(), inode->i_uid))) mode >>= 6; else { if (IS_POSIXACL(inode) && (mode & S_IRWXG)) { - int error = check_acl(inode, mask); + int error = check_posix_acl(inode, mask); if (error != -EAGAIN) return error; } diff --git a/fs/posix_acl.c b/fs/posix_acl.c index ebf96b2..16464f0 100644 --- a/fs/posix_acl.c +++ b/fs/posix_acl.c @@ -100,13 +100,13 @@ struct posix_acl *get_acl(struct inode *inode, int type) { struct posix_acl *acl; + if (!IS_POSIXACL(inode)) + return NULL; + acl = get_cached_acl(inode, type); if (acl != ACL_NOT_CACHED) return acl; - if (!IS_POSIXACL(inode)) - return NULL; - /* * A filesystem can force a ACL callback by just never filling the * ACL cache. But normally you'd fill the cache either at inode -- 2.1.0 -- To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to majordomo-u79uwXL29TY76Z2rM5mHXA@public.gmane.org More majordomo info at http://vger.kernel.org/majordomo-info.html
next prev parent reply other threads:[~2015-04-24 11:05 UTC|newest] Thread overview: 154+ messages / expand[flat|nested] mbox.gz Atom feed top 2015-04-24 11:03 [RFC v3 00/45] Richacls Andreas Gruenbacher 2015-04-24 11:03 ` Andreas Gruenbacher 2015-04-24 11:03 ` [RFC v3 01/45] vfs: Minor documentation fix Andreas Gruenbacher 2015-04-24 11:03 ` [RFC v3 02/45] uapi: Remove kernel internal declaration Andreas Gruenbacher 2015-04-24 11:04 ` [RFC v3 03/45] nfsd: Checking for acl support does not require fetching any acls Andreas Gruenbacher 2015-04-24 11:04 ` [RFC v3 04/45] vfs: Shrink struct posix_acl Andreas Gruenbacher 2015-04-25 7:56 ` Rasmus Villemoes 2015-04-27 10:27 ` Andreas Grünbacher 2015-04-24 11:04 ` [RFC v3 05/45] vfs: Add IS_ACL() and IS_RICHACL() tests Andreas Gruenbacher 2015-04-24 11:04 ` [RFC v3 06/45] vfs: Add MAY_CREATE_FILE and MAY_CREATE_DIR permission flags Andreas Gruenbacher 2015-04-24 11:04 ` [RFC v3 07/45] vfs: Add MAY_DELETE_SELF and MAY_DELETE_CHILD " Andreas Gruenbacher 2015-04-24 11:04 ` [RFC v3 08/45] vfs: Make the inode passed to inode_change_ok non-const Andreas Gruenbacher 2015-04-24 11:04 ` Andreas Gruenbacher 2015-04-24 11:04 ` [RFC v3 09/45] vfs: Add permission flags for setting file attributes Andreas Gruenbacher 2015-04-24 11:04 ` [RFC v3 10/45] richacl: In-memory representation and helper functions Andreas Gruenbacher 2015-04-24 11:04 ` [RFC v3 11/45] richacl: Permission mapping functions Andreas Gruenbacher 2015-04-24 11:04 ` [RFC v3 12/45] richacl: Compute maximum file masks from an acl Andreas Gruenbacher 2015-05-12 21:44 ` J. Bruce Fields 2015-04-24 11:04 ` [RFC v3 13/45] richacl: Update the file masks in chmod() Andreas Gruenbacher 2015-04-24 11:04 ` Andreas Gruenbacher 2015-04-24 11:04 ` [RFC v3 14/45] richacl: Permission check algorithm Andreas Gruenbacher 2015-04-24 11:04 ` Andreas Gruenbacher 2015-05-22 21:08 ` J. Bruce Fields 2015-05-27 11:25 ` Andreas Grünbacher 2015-05-27 15:05 ` J. Bruce Fields 2015-04-24 11:04 ` [RFC v3 15/45] vfs: Cache base_acl objects in inodes Andreas Gruenbacher 2015-04-24 11:04 ` [RFC v3 16/45] vfs: Cache richacl in struct inode Andreas Gruenbacher 2015-04-24 11:04 ` [RFC v3 17/45] richacl: Create-time inheritance Andreas Gruenbacher 2015-04-24 11:04 ` [RFC v3 18/45] richacl: Check if an acl is equivalent to a file mode Andreas Gruenbacher 2015-04-24 11:04 ` [RFC v3 19/45] richacl: Also recognize nontrivial mode-equivalent acls Andreas Gruenbacher 2015-05-14 19:28 ` J. Bruce Fields 2015-05-15 20:04 ` J. Bruce Fields 2015-05-15 20:04 ` J. Bruce Fields 2015-05-15 20:51 ` J. Bruce Fields 2015-05-15 20:51 ` J. Bruce Fields 2015-05-27 9:24 ` Andreas Grünbacher 2015-05-27 15:06 ` J. Bruce Fields 2015-05-27 15:06 ` J. Bruce Fields 2015-04-24 11:04 ` [RFC v3 20/45] richacl: Automatic Inheritance Andreas Gruenbacher 2015-05-13 18:01 ` Frank Filz 2015-05-13 18:01 ` Frank Filz 2015-05-13 20:22 ` Andreas Grünbacher 2015-05-13 20:22 ` Andreas Grünbacher 2015-05-13 20:28 ` Jeremy Allison 2015-05-13 20:28 ` Jeremy Allison 2015-05-13 20:47 ` Andreas Grünbacher 2015-05-13 20:47 ` Andreas Grünbacher 2015-05-13 20:55 ` Jeremy Allison 2015-05-13 20:55 ` Jeremy Allison 2015-05-13 21:15 ` Andreas Grünbacher 2015-05-13 21:15 ` Andreas Grünbacher 2015-05-13 20:38 ` Frank Filz 2015-05-13 20:38 ` Frank Filz 2015-05-13 21:05 ` Andreas Grünbacher 2015-05-13 22:56 ` Frank Filz 2015-05-13 22:56 ` Frank Filz 2015-05-13 23:52 ` Andreas Grünbacher 2015-05-14 15:09 ` J. Bruce Fields 2015-05-14 15:09 ` J. Bruce Fields 2015-05-18 20:39 ` Andreas Grünbacher 2015-05-18 20:39 ` Andreas Grünbacher 2015-05-18 20:43 ` J. Bruce Fields 2015-05-18 20:43 ` J. Bruce Fields 2015-04-24 11:04 ` [RFC v3 21/45] richacl: xattr mapping functions Andreas Gruenbacher 2015-04-24 11:04 ` Andreas Gruenbacher 2015-04-24 11:04 ` Andreas Gruenbacher [this message] 2015-04-24 11:04 ` [RFC v3 22/45] vfs: Add richacl permission checking Andreas Gruenbacher 2015-04-24 11:04 ` [RFC v3 23/45] ext4: Add richacl support Andreas Gruenbacher 2015-04-24 11:04 ` [RFC v3 24/45] ext4: Add richacl feature flag Andreas Gruenbacher 2015-04-24 11:04 ` [RFC v3 25/45] richacl: acl editing helper functions Andreas Gruenbacher 2015-04-24 11:04 ` Andreas Gruenbacher 2015-05-15 21:33 ` J. Bruce Fields 2015-05-15 21:33 ` J. Bruce Fields 2015-04-24 11:04 ` [RFC v3 26/45] richacl: Move everyone@ aces down the acl Andreas Gruenbacher 2015-05-18 21:20 ` J. Bruce Fields 2015-04-24 11:04 ` [RFC v3 27/45] richacl: Propagate everyone@ permissions to other aces Andreas Gruenbacher 2015-04-24 11:04 ` [RFC v3 28/45] richacl: Isolate the owner and group classes Andreas Gruenbacher 2015-04-24 11:04 ` [RFC v3 29/45] richacl: Apply the file masks to a richacl Andreas Gruenbacher 2015-05-26 21:56 ` J. Bruce Fields 2015-05-26 21:56 ` J. Bruce Fields 2015-04-24 11:04 ` [RFC v3 30/45] richacl: Create richacl from mode values Andreas Gruenbacher 2015-05-28 19:24 ` J. Bruce Fields 2015-05-28 19:24 ` J. Bruce Fields 2015-05-28 19:25 ` J. Bruce Fields 2015-05-28 19:58 ` Andreas Grünbacher 2015-05-28 19:58 ` Andreas Grünbacher 2015-04-24 11:04 ` [RFC v3 31/45] richacl: Create acl with masks applied in richacl_from_mode() Andreas Gruenbacher 2015-04-24 11:04 ` [RFC v3 32/45] nfsd: Remove dead declarations Andreas Gruenbacher 2015-04-24 11:04 ` [RFC v3 33/45] nfsd: Keep list of acls to dispose of in compoundargs Andreas Gruenbacher 2015-05-28 19:52 ` J. Bruce Fields 2015-05-28 19:52 ` J. Bruce Fields 2015-05-28 20:28 ` Andreas Grünbacher 2015-05-28 20:28 ` Andreas Grünbacher 2015-04-24 11:04 ` [RFC v3 34/45] nfsd: Use richacls as internal acl representation Andreas Gruenbacher 2015-04-24 11:04 ` [RFC v3 35/45] nfsd: Add richacl support Andreas Gruenbacher 2015-04-24 11:04 ` [RFC v3 36/45] NFSv4: Fix GETATTR bitmap verification Andreas Gruenbacher 2015-05-28 20:33 ` J. Bruce Fields 2015-05-28 20:33 ` J. Bruce Fields 2015-05-28 20:50 ` Trond Myklebust 2015-05-28 20:50 ` Trond Myklebust 2015-05-28 21:05 ` Andreas Grünbacher 2015-05-28 21:05 ` Andreas Grünbacher 2015-05-28 21:40 ` Trond Myklebust 2015-05-28 21:40 ` Trond Myklebust 2015-05-28 21:55 ` Trond Myklebust 2015-05-28 21:55 ` Trond Myklebust 2015-05-28 22:09 ` Andreas Grünbacher 2015-05-28 22:09 ` Andreas Grünbacher 2015-05-28 22:24 ` Trond Myklebust 2015-05-28 22:24 ` Trond Myklebust 2015-05-28 22:28 ` Andreas Grünbacher 2015-05-28 21:15 ` Andreas Grünbacher 2015-05-28 21:28 ` Andreas Grünbacher 2015-05-28 21:28 ` Andreas Grünbacher 2015-04-24 11:04 ` [RFC v3 37/45] nfs/sunrpc: No more encode and decode function pointer casting Andreas Gruenbacher 2015-05-28 23:11 ` Trond Myklebust 2015-05-28 23:40 ` Andreas Grünbacher 2015-05-29 0:37 ` Trond Myklebust 2015-05-29 0:37 ` Trond Myklebust 2015-05-29 15:30 ` Andreas Grünbacher 2015-05-29 15:30 ` Andreas Grünbacher 2015-04-24 11:04 ` [RFC v3 38/45] nfs/sunrpc: Return status code from encode functions Andreas Gruenbacher 2015-05-28 23:39 ` Trond Myklebust 2015-05-28 23:39 ` Trond Myklebust 2015-04-24 11:04 ` [RFC v3 39/45] nfs3: Return posix acl encode errors Andreas Gruenbacher 2015-04-24 11:04 ` Andreas Gruenbacher 2015-04-24 11:04 ` [RFC v3 40/45] nfs: Remove unused xdr page offsets in getacl/setacl arguments Andreas Gruenbacher 2015-04-24 11:04 ` [RFC v3 41/45] rpc: Allow to demand-allocate pages to encode into Andreas Gruenbacher 2015-05-28 23:24 ` Trond Myklebust 2015-05-28 23:24 ` Trond Myklebust 2015-05-29 15:46 ` Andreas Grünbacher 2015-04-24 11:04 ` [RFC v3 42/45] nfs: Add richacl support Andreas Gruenbacher 2015-05-28 23:06 ` Trond Myklebust 2015-05-28 23:29 ` Andreas Grünbacher 2015-05-29 13:15 ` Trond Myklebust 2015-05-29 15:00 ` Andreas Grünbacher 2015-05-29 15:24 ` Trond Myklebust 2015-05-29 15:45 ` Andreas Grünbacher 2015-05-29 15:54 ` Trond Myklebust 2015-05-29 15:54 ` Trond Myklebust 2015-05-29 15:54 ` Frank Filz 2015-05-29 15:54 ` Frank Filz 2016-06-23 16:37 ` Weston Andros Adamson 2016-06-23 17:15 ` Frank Filz 2016-07-15 8:00 ` Andreas Grünbacher 2015-04-24 11:04 ` [RFC v3 43/45] uapi/nfs: Add NFSv4.1 ACL definitions Andreas Gruenbacher 2015-05-29 14:57 ` J. Bruce Fields 2015-04-24 11:04 ` [RFC v3 44/45] nfsd: Add support for the v4.1 dacl attribute Andreas Gruenbacher 2015-04-24 11:04 ` [RFC v3 45/45] nfs: " Andreas Gruenbacher 2015-05-23 15:50 ` [RFC v3 00/45] Richacls Jeremy Allison 2015-05-23 15:50 ` Jeremy Allison 2015-05-23 15:56 ` Andreas Grünbacher 2015-05-23 15:56 ` Andreas Grünbacher 2015-06-25 20:03 ` Stefan (metze) Metzmacher
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=5b2624871e0ac5f1d0e5c5da6d99ca7dc93158e3.1429868795.git.agruenba@redhat.com \ --to=andreas.gruenbacher@gmail.com \ --cc=linux-fsdevel@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-nfs@vger.kernel.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.