From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jeff Layton Subject: Re: [PATCH v23 09/22] richacl: Permission check algorithm Date: Tue, 05 Jul 2016 10:59:07 -0400 Message-ID: <1467730747.3800.34.camel@redhat.com> References: <1467294433-3222-1-git-send-email-agruenba@redhat.com> <1467294433-3222-10-git-send-email-agruenba@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: base64 Cc: "J. Bruce Fields" , linux-nfs@vger.kernel.org, Theodore Ts'o , linux-cifs@vger.kernel.org, linux-api@vger.kernel.org, Trond Myklebust , linux-kernel@vger.kernel.org, xfs@oss.sgi.com, Christoph Hellwig , Andreas Dilger , linux-fsdevel@vger.kernel.org, linux-ext4@vger.kernel.org, Anna Schumaker To: Andreas Gruenbacher , Alexander Viro Return-path: In-Reply-To: <1467294433-3222-10-git-send-email-agruenba@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: xfs-bounces@oss.sgi.com Sender: xfs-bounces@oss.sgi.com List-Id: linux-cifs.vger.kernel.org T24gVGh1LCAyMDE2LTA2LTMwIGF0IDE1OjQ3ICswMjAwLCBBbmRyZWFzIEdydWVuYmFjaGVyIHdy b3RlOgo+IEEgcmljaGFjbCByb3VnaGx5IGdyYW50cyBhIHJlcXVlc3RlZCBhY2Nlc3MgaWYgdGhl IE5GU3Y0IGFjbCBpbiB0aGUKPiByaWNoYWNsIGdyYW50cyB0aGUgcmVxdWVzdGVkIHBlcm1pc3Np b25zIGFjY29yZGluZyB0byB0aGUgTkZTdjQKPiBwZXJtaXNzaW9uIGNoZWNrIGFsZ29yaXRobSBh bmQgdGhlIGZpbGUgbWFzayB0aGF0IGFwcGxpZXMgdG8gdGhlIHByb2Nlc3MKPiBpbmNsdWRlcyB0 aGUgcmVxdWVzdGVkIHBlcm1pc3Npb25zLgo+IAo+IFNpZ25lZC1vZmYtYnk6IEFuZHJlYXMgR3J1 ZW5iYWNoZXIgPGFncnVlbmJhQHJlZGhhdC5jb20+Cj4gUmV2aWV3ZWQtYnk6IEouIEJydWNlIEZp ZWxkcyA8YmZpZWxkc0BmaWVsZHNlcy5vcmc+Cj4gLS0tCj4gwqBmcy9yaWNoYWNsLmPCoMKgwqDC oMKgwqDCoMKgwqDCoMKgwqB8IDEyOCArKysrKysrKysrKysrKysrKysrKysrKysrKysrKysrKysr KysrKysrKysrKysrKysKPiDCoGluY2x1ZGUvbGludXgvcmljaGFjbC5oIHzCoMKgwqAxICsKPiDC oDIgZmlsZXMgY2hhbmdlZCwgMTI5IGluc2VydGlvbnMoKykKPiAKPiBkaWZmIC0tZ2l0IGEvZnMv cmljaGFjbC5jIGIvZnMvcmljaGFjbC5jCj4gaW5kZXggMDU2MjI4Zi4uY2IwZWYzZiAxMDA2NDQK PiAtLS0gYS9mcy9yaWNoYWNsLmMKPiArKysgYi9mcy9yaWNoYWNsLmMKPiBAQCAtMzM4LDMgKzMz OCwxMzEgQEAgcmVzdGFydDoKPiDCoAlhY2wtPmFfZmxhZ3MgJj0gfihSSUNIQUNMX1dSSVRFX1RI Uk9VR0ggfCBSSUNIQUNMX01BU0tFRCk7Cj4gwqB9Cj4gwqBFWFBPUlRfU1lNQk9MX0dQTChyaWNo YWNsX2NvbXB1dGVfbWF4X21hc2tzKTsKPiArCj4gKy8qKgo+ICsgKiByaWNoYWNsX3Blcm1pc3Np b27CoMKgLcKgwqByaWNoYWNsIHBlcm1pc3Npb24gY2hlY2sgYWxnb3JpdGhtCj4gKyAqIEBpbm9k ZToJaW5vZGUgdG8gY2hlY2sKPiArICogQGFjbDoJcmljaCBhY2wgb2YgdGhlIGlub2RlCj4gKyAq IEB3YW50OglyZXF1ZXN0ZWQgYWNjZXNzIChNQVlfKiBmbGFncykKPiArICoKPiArICogQ2hlY2tz IGlmIHRoZSBjdXJyZW50IHByb2Nlc3MgaXMgZ3JhbnRlZCBAbWFzayBmbGFncyBpbiBAYWNsLgo+ ICsgKi8KCm5pdDogdGhlcmUgaXMgbm8gQG1hc2sgcGFybSBoZXJlLiBEbyB5b3UgbWVhbiBAd2Fu dCA/Cgo+ICtpbnQKPiArcmljaGFjbF9wZXJtaXNzaW9uKHN0cnVjdCBpbm9kZSAqaW5vZGUsIGNv bnN0IHN0cnVjdCByaWNoYWNsICphY2wsCj4gKwkJwqDCoMKgaW50IHdhbnQpCj4gK3sKPiArCWNv bnN0IHN0cnVjdCByaWNoYWNlICphY2U7Cj4gKwl1bnNpZ25lZCBpbnQgbWFzayA9IHJpY2hhY2xf d2FudF90b19tYXNrKHdhbnQpOwo+ICsJdW5zaWduZWQgaW50IHJlcXVlc3RlZCA9IG1hc2ssIGRl bmllZCA9IDA7Cj4gKwlpbnQgaW5fb3duaW5nX2dyb3VwID0gaW5fZ3JvdXBfcChpbm9kZS0+aV9n aWQpOwo+ICsJaW50IGluX293bmVyX29yX2dyb3VwX2NsYXNzID0gaW5fb3duaW5nX2dyb3VwOwo+ ICsKPiArCS8qCj4gKwnCoCogQSBwcm9jZXNzIGlzCj4gKwnCoCrCoMKgwqAtIGluIHRoZSBvd25l ciBmaWxlIGNsYXNzIGlmIGl0IG93bnMgdGhlIGZpbGUsCj4gKwnCoCrCoMKgwqAtIGluIHRoZSBn cm91cCBmaWxlIGNsYXNzIGlmIGl0IGlzIGluIHRoZSBmaWxlJ3Mgb3duaW5nIGdyb3VwIG9yCj4g KwnCoCrCoMKgwqDCoMKgaXQgbWF0Y2hlcyBhbnkgb2YgdGhlIHVzZXIgb3IgZ3JvdXAgZW50cmll cywgYW5kCj4gKwnCoCrCoMKgwqAtIGluIHRoZSBvdGhlciBmaWxlIGNsYXNzIG90aGVyd2lzZS4K PiArCcKgKiBUaGUgZmlsZSBjbGFzcyBpcyBvbmx5IHJlbGV2YW50IGZvciBkZXRlcm1pbmluZyB3 aGljaCBmaWxlIG1hc2sgdG8KPiArCcKgKiBhcHBseSwgd2hpY2ggb25seSBoYXBwZW5zIGZvciBt YXNrZWQgYWNscy4KPiArCcKgKi8KPiArCWlmIChhY2wtPmFfZmxhZ3MgJiBSSUNIQUNMX01BU0tF RCkgewo+ICsJCWlmICgoYWNsLT5hX2ZsYWdzICYgUklDSEFDTF9XUklURV9USFJPVUdIKSAmJgo+ ICsJCcKgwqDCoMKgdWlkX2VxKGN1cnJlbnRfZnN1aWQoKSwgaW5vZGUtPmlfdWlkKSkgewo+ICsJ CQlkZW5pZWQgPSByZXF1ZXN0ZWQgJiB+YWNsLT5hX293bmVyX21hc2s7Cj4gKwkJCWdvdG8gb3V0 Owo+ICsJCX0KPiArCX0gZWxzZSB7Cj4gKwkJLyoKPiArCQnCoCogV2hlbiB0aGUgYWNsIGlzIG5v dCBtYXNrZWQsIHRoZXJlIGlzIG5vIG5lZWQgdG8gZGV0ZXJtaW5lIGlmCj4gKwkJwqAqIHRoZSBw cm9jZXNzIGlzIGluIHRoZSBncm91cCBjbGFzcyBhbmQgd2UgY2FuIGJyZWFrIG91dAo+ICsJCcKg KiBlYXJsaWVyIG9mIHRoZSBsb29wIGJlbG93Lgo+ICsJCcKgKi8KPiArCQlpbl9vd25lcl9vcl9n cm91cF9jbGFzcyA9IDE7Cj4gKwl9Cj4gKwo+ICsJLyoKPiArCcKgKiBDaGVjayBpZiB0aGUgYWNs IGdyYW50cyB0aGUgcmVxdWVzdGVkIGFjY2VzcyBhbmQgZGV0ZXJtaW5lIHdoaWNoCj4gKwnCoCog ZmlsZSBjbGFzcyB0aGUgcHJvY2VzcyBpcyBpbi4KPiArCcKgKi8KPiArCXJpY2hhY2xfZm9yX2Vh Y2hfZW50cnkoYWNlLCBhY2wpIHsKPiArCQl1bnNpZ25lZCBpbnQgYWNlX21hc2sgPSBhY2UtPmVf bWFzazsKPiArCj4gKwkJaWYgKHJpY2hhY2VfaXNfaW5oZXJpdF9vbmx5KGFjZSkpCj4gKwkJCWNv bnRpbnVlOwo+ICsJCWlmIChyaWNoYWNlX2lzX293bmVyKGFjZSkpIHsKPiArCQkJaWYgKCF1aWRf ZXEoY3VycmVudF9mc3VpZCgpLCBpbm9kZS0+aV91aWQpKQo+ICsJCQkJY29udGludWU7Cj4gKwkJ CWdvdG8gZW50cnlfbWF0Y2hlc19vd25lcjsKPiArCQl9IGVsc2UgaWYgKHJpY2hhY2VfaXNfZ3Jv dXAoYWNlKSkgewo+ICsJCQlpZiAoIWluX293bmluZ19ncm91cCkKPiArCQkJCWNvbnRpbnVlOwo+ ICsJCX0gZWxzZSBpZiAocmljaGFjZV9pc191bml4X3VzZXIoYWNlKSkgewo+ICsJCQlpZiAoIXVp ZF9lcShjdXJyZW50X2ZzdWlkKCksIGFjZS0+ZV9pZC51aWQpKQo+ICsJCQkJY29udGludWU7Cj4g KwkJCWlmICh1aWRfZXEoY3VycmVudF9mc3VpZCgpLCBpbm9kZS0+aV91aWQpKQo+ICsJCQkJZ290 byBlbnRyeV9tYXRjaGVzX293bmVyOwo+ICsJCX0gZWxzZSBpZiAocmljaGFjZV9pc191bml4X2dy b3VwKGFjZSkpIHsKPiArCQkJaWYgKCFpbl9ncm91cF9wKGFjZS0+ZV9pZC5naWQpKQo+ICsJCQkJ Y29udGludWU7Cj4gKwkJfSBlbHNlCj4gKwkJCWdvdG8gZW50cnlfbWF0Y2hlc19ldmVyeW9uZTsK PiArCj4gKwkJLyoKPiArCQnCoCogQXBwbHkgdGhlIGdyb3VwIGZpbGUgbWFzayB0byBlbnRyaWVz IG90aGVyIHRoYW4gb3duZXJAIGFuZAo+ICsJCcKgKiBldmVyeW9uZUAgb3IgdXNlciBlbnRyaWVz IG1hdGNoaW5nIHRoZSBvd25lci7CoMKgVGhpcyBlbnN1cmVzCj4gKwkJwqAqIHRoYXQgd2UgZ3Jh bnQgdGhlIHNhbWUgcGVybWlzc2lvbnMgYXMgdGhlIGFjbCBjb21wdXRlZCBieQo+ICsJCcKgKiBy aWNoYWNsX2FwcGx5X21hc2tzKCkuCj4gKwkJwqAqCj4gKwkJwqAqIFdpdGhvdXQgdGhpcyByZXN0 cmljdGlvbiwgdGhlIGZvbGxvd2luZyByaWNoYWNsIHdvdWxkIGdyYW50Cj4gKwkJwqAqIHJ3IGFj Y2VzcyB0byBwcm9jZXNzZXMgd2hpY2ggYXJlIGJvdGggdGhlIG93bmVyIGFuZCBpbiB0aGUKPiAr CQnCoCogb3duaW5nIGdyb3VwLCBidXQgbm90IHRvIG90aGVyIHVzZXJzIGluIHRoZSBvd25pbmcg Z3JvdXAsCj4gKwkJwqAqIHdoaWNoIGNvdWxkIG5vdCBiZSByZXByZXNlbnRlZCB3aXRob3V0IG1h c2tzOgo+ICsJCcKgKgo+ICsJCcKgKsKgwqBvd25lcjpydzo6bWFzawo+ICsJCcKgKsKgwqBncm91 cEA6cnc6OmFsbG93Cj4gKwkJwqAqLwo+ICsJCWlmICgoYWNsLT5hX2ZsYWdzICYgUklDSEFDTF9N QVNLRUQpICYmIHJpY2hhY2VfaXNfYWxsb3coYWNlKSkKPiArCQkJYWNlX21hc2sgJj0gYWNsLT5h X2dyb3VwX21hc2s7Cj4gKwo+ICtlbnRyeV9tYXRjaGVzX293bmVyOgo+ICsJCS8qIFRoZSBwcm9j ZXNzIGlzIGluIHRoZSBvd25lciBvciBncm91cCBmaWxlIGNsYXNzLiAqLwo+ICsJCWluX293bmVy X29yX2dyb3VwX2NsYXNzID0gMTsKPiArCj4gK2VudHJ5X21hdGNoZXNfZXZlcnlvbmU6Cj4gKwkJ LyogQ2hlY2sgd2hpY2ggbWFzayBmbGFncyB0aGUgQUNFIGFsbG93cyBvciBkZW5pZXMuICovCj4g KwkJaWYgKHJpY2hhY2VfaXNfZGVueShhY2UpKQo+ICsJCQlkZW5pZWQgfD0gYWNlX21hc2sgJiBt YXNrOwo+ICsJCW1hc2sgJj0gfmFjZV9tYXNrOwo+ICsKPiArCQkvKgo+ICsJCcKgKiBLZWVwIGdv aW5nIHVudGlsIHdlIGtub3cgd2hpY2ggZmlsZSBjbGFzcwo+ICsJCcKgKiB0aGUgcHJvY2VzcyBp cyBpbi4KPiArCQnCoCovCj4gKwkJaWYgKCFtYXNrICYmIGluX293bmVyX29yX2dyb3VwX2NsYXNz KQo+ICsJCQlicmVhazsKPiArCX0KPiArCWRlbmllZCB8PSBtYXNrOwo+ICsKPiArCWlmIChhY2wt PmFfZmxhZ3MgJiBSSUNIQUNMX01BU0tFRCkgewo+ICsJCS8qCj4gKwkJwqAqIFRoZSBmaWxlIGNs YXNzIGEgcHJvY2VzcyBpcyBpbiBkZXRlcm1pbmVzIHdoaWNoIGZpbGUgbWFzawo+ICsJCcKgKiBh cHBsaWVzLsKgwqBDaGVjayBpZiB0aGF0IGZpbGUgbWFzayBhbHNvIGdyYW50cyB0aGUgcmVxdWVz dGVkCj4gKwkJwqAqIGFjY2Vzcy4KPiArCQnCoCovCj4gKwkJaWYgKHVpZF9lcShjdXJyZW50X2Zz dWlkKCksIGlub2RlLT5pX3VpZCkpCj4gKwkJCWRlbmllZCB8PSByZXF1ZXN0ZWQgJiB+YWNsLT5h X293bmVyX21hc2s7Cj4gKwkJZWxzZSBpZiAoaW5fb3duZXJfb3JfZ3JvdXBfY2xhc3MpCj4gKwkJ CWRlbmllZCB8PSByZXF1ZXN0ZWQgJiB+YWNsLT5hX2dyb3VwX21hc2s7Cj4gKwkJZWxzZSB7Cj4g KwkJCWlmIChhY2wtPmFfZmxhZ3MgJiBSSUNIQUNMX1dSSVRFX1RIUk9VR0gpCj4gKwkJCQlkZW5p ZWQgPSByZXF1ZXN0ZWQgJiB+YWNsLT5hX290aGVyX21hc2s7Cj4gKwkJCWVsc2UKPiArCQkJCWRl bmllZCB8PSByZXF1ZXN0ZWQgJiB+YWNsLT5hX290aGVyX21hc2s7Cj4gKwkJfQo+ICsJfQo+ICsK PiArb3V0Ogo+ICsJcmV0dXJuIGRlbmllZCA/IC1FQUNDRVMgOiAwOwo+ICt9Cj4gK0VYUE9SVF9T WU1CT0xfR1BMKHJpY2hhY2xfcGVybWlzc2lvbik7Cj4gZGlmZiAtLWdpdCBhL2luY2x1ZGUvbGlu dXgvcmljaGFjbC5oIGIvaW5jbHVkZS9saW51eC9yaWNoYWNsLmgKPiBpbmRleCAzNTU5YjJjLi5i ZTlmYjY1IDEwMDY0NAo+IC0tLSBhL2luY2x1ZGUvbGludXgvcmljaGFjbC5oCj4gKysrIGIvaW5j bHVkZS9saW51eC9yaWNoYWNsLmgKPiBAQCAtMTc5LDUgKzE3OSw2IEBAIGV4dGVybiBpbnQgcmlj aGFjbF9tYXNrc190b19tb2RlKGNvbnN0IHN0cnVjdCByaWNoYWNsICopOwo+IMKgZXh0ZXJuIHVu c2lnbmVkIGludCByaWNoYWNsX21vZGVfdG9fbWFzayh1bW9kZV90KTsKPiDCoGV4dGVybiB1bnNp Z25lZCBpbnQgcmljaGFjbF93YW50X3RvX21hc2sodW5zaWduZWQgaW50KTsKPiDCoGV4dGVybiB2 b2lkIHJpY2hhY2xfY29tcHV0ZV9tYXhfbWFza3Moc3RydWN0IHJpY2hhY2wgKik7Cj4gK2V4dGVy biBpbnQgcmljaGFjbF9wZXJtaXNzaW9uKHN0cnVjdCBpbm9kZSAqLCBjb25zdCBzdHJ1Y3Qgcmlj aGFjbCAqLCBpbnQpOwo+IMKgCj4gwqAjZW5kaWYgLyogX19SSUNIQUNMX0ggKi8KClJldmlld2Vk LWJ5OiBKZWZmIExheXRvbiA8amxheXRvbkByZWRoYXQuY29tPgoKX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX19fX19fX19fX19fX18KeGZzIG1haWxpbmcgbGlzdAp4ZnNAb3NzLnNn aS5jb20KaHR0cDovL29zcy5zZ2kuY29tL21haWxtYW4vbGlzdGluZm8veGZzCg== From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754898AbcGEO7N (ORCPT ); Tue, 5 Jul 2016 10:59:13 -0400 Received: from mail-qt0-f176.google.com ([209.85.216.176]:34934 "EHLO mail-qt0-f176.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751598AbcGEO7K (ORCPT ); Tue, 5 Jul 2016 10:59:10 -0400 Message-ID: <1467730747.3800.34.camel@redhat.com> Subject: Re: [PATCH v23 09/22] richacl: Permission check algorithm From: Jeff Layton To: Andreas Gruenbacher , Alexander Viro Cc: Christoph Hellwig , "Theodore Ts'o" , Andreas Dilger , "J. Bruce Fields" , Trond Myklebust , Anna Schumaker , Dave Chinner , linux-ext4@vger.kernel.org, xfs@oss.sgi.com, linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-nfs@vger.kernel.org, linux-cifs@vger.kernel.org, linux-api@vger.kernel.org Date: Tue, 05 Jul 2016 10:59:07 -0400 In-Reply-To: <1467294433-3222-10-git-send-email-agruenba@redhat.com> References: <1467294433-3222-1-git-send-email-agruenba@redhat.com> <1467294433-3222-10-git-send-email-agruenba@redhat.com> Content-Type: text/plain; charset="UTF-8" X-Mailer: Evolution 3.18.5.2 (3.18.5.2-1.fc23) Mime-Version: 1.0 Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, 2016-06-30 at 15:47 +0200, Andreas Gruenbacher wrote: > A richacl roughly grants a requested access if the NFSv4 acl in the > richacl grants the requested permissions according to the NFSv4 > permission check algorithm and the file mask that applies to the process > includes the requested permissions. > > Signed-off-by: Andreas Gruenbacher > Reviewed-by: J. Bruce Fields > --- >  fs/richacl.c            | 128 ++++++++++++++++++++++++++++++++++++++++++++++++ >  include/linux/richacl.h |   1 + >  2 files changed, 129 insertions(+) > > diff --git a/fs/richacl.c b/fs/richacl.c > index 056228f..cb0ef3f 100644 > --- a/fs/richacl.c > +++ b/fs/richacl.c > @@ -338,3 +338,131 @@ restart: >   acl->a_flags &= ~(RICHACL_WRITE_THROUGH | RICHACL_MASKED); >  } >  EXPORT_SYMBOL_GPL(richacl_compute_max_masks); > + > +/** > + * richacl_permission  -  richacl permission check algorithm > + * @inode: inode to check > + * @acl: rich acl of the inode > + * @want: requested access (MAY_* flags) > + * > + * Checks if the current process is granted @mask flags in @acl. > + */ nit: there is no @mask parm here. Do you mean @want ? > +int > +richacl_permission(struct inode *inode, const struct richacl *acl, > +    int want) > +{ > + const struct richace *ace; > + unsigned int mask = richacl_want_to_mask(want); > + unsigned int requested = mask, denied = 0; > + int in_owning_group = in_group_p(inode->i_gid); > + int in_owner_or_group_class = in_owning_group; > + > + /* > +  * A process is > +  *   - in the owner file class if it owns the file, > +  *   - in the group file class if it is in the file's owning group or > +  *     it matches any of the user or group entries, and > +  *   - in the other file class otherwise. > +  * The file class is only relevant for determining which file mask to > +  * apply, which only happens for masked acls. > +  */ > + if (acl->a_flags & RICHACL_MASKED) { > + if ((acl->a_flags & RICHACL_WRITE_THROUGH) && > +     uid_eq(current_fsuid(), inode->i_uid)) { > + denied = requested & ~acl->a_owner_mask; > + goto out; > + } > + } else { > + /* > +  * When the acl is not masked, there is no need to determine if > +  * the process is in the group class and we can break out > +  * earlier of the loop below. > +  */ > + in_owner_or_group_class = 1; > + } > + > + /* > +  * Check if the acl grants the requested access and determine which > +  * file class the process is in. > +  */ > + richacl_for_each_entry(ace, acl) { > + unsigned int ace_mask = ace->e_mask; > + > + if (richace_is_inherit_only(ace)) > + continue; > + if (richace_is_owner(ace)) { > + if (!uid_eq(current_fsuid(), inode->i_uid)) > + continue; > + goto entry_matches_owner; > + } else if (richace_is_group(ace)) { > + if (!in_owning_group) > + continue; > + } else if (richace_is_unix_user(ace)) { > + if (!uid_eq(current_fsuid(), ace->e_id.uid)) > + continue; > + if (uid_eq(current_fsuid(), inode->i_uid)) > + goto entry_matches_owner; > + } else if (richace_is_unix_group(ace)) { > + if (!in_group_p(ace->e_id.gid)) > + continue; > + } else > + goto entry_matches_everyone; > + > + /* > +  * Apply the group file mask to entries other than owner@ and > +  * everyone@ or user entries matching the owner.  This ensures > +  * that we grant the same permissions as the acl computed by > +  * richacl_apply_masks(). > +  * > +  * Without this restriction, the following richacl would grant > +  * rw access to processes which are both the owner and in the > +  * owning group, but not to other users in the owning group, > +  * which could not be represented without masks: > +  * > +  *  owner:rw::mask > +  *  group@:rw::allow > +  */ > + if ((acl->a_flags & RICHACL_MASKED) && richace_is_allow(ace)) > + ace_mask &= acl->a_group_mask; > + > +entry_matches_owner: > + /* The process is in the owner or group file class. */ > + in_owner_or_group_class = 1; > + > +entry_matches_everyone: > + /* Check which mask flags the ACE allows or denies. */ > + if (richace_is_deny(ace)) > + denied |= ace_mask & mask; > + mask &= ~ace_mask; > + > + /* > +  * Keep going until we know which file class > +  * the process is in. > +  */ > + if (!mask && in_owner_or_group_class) > + break; > + } > + denied |= mask; > + > + if (acl->a_flags & RICHACL_MASKED) { > + /* > +  * The file class a process is in determines which file mask > +  * applies.  Check if that file mask also grants the requested > +  * access. > +  */ > + if (uid_eq(current_fsuid(), inode->i_uid)) > + denied |= requested & ~acl->a_owner_mask; > + else if (in_owner_or_group_class) > + denied |= requested & ~acl->a_group_mask; > + else { > + if (acl->a_flags & RICHACL_WRITE_THROUGH) > + denied = requested & ~acl->a_other_mask; > + else > + denied |= requested & ~acl->a_other_mask; > + } > + } > + > +out: > + return denied ? -EACCES : 0; > +} > +EXPORT_SYMBOL_GPL(richacl_permission); > diff --git a/include/linux/richacl.h b/include/linux/richacl.h > index 3559b2c..be9fb65 100644 > --- a/include/linux/richacl.h > +++ b/include/linux/richacl.h > @@ -179,5 +179,6 @@ extern int richacl_masks_to_mode(const struct richacl *); >  extern unsigned int richacl_mode_to_mask(umode_t); >  extern unsigned int richacl_want_to_mask(unsigned int); >  extern void richacl_compute_max_masks(struct richacl *); > +extern int richacl_permission(struct inode *, const struct richacl *, int); >   >  #endif /* __RICHACL_H */ Reviewed-by: Jeff Layton