[PATCH 21/29] ovl: implement get acl method

[PATCH 21/29] ovl: implement get acl method

[Christian Brauner]

The current way of setting and getting posix acls through the generic
xattr interface is error prone and type unsafe. The vfs needs to
interpret and fixup posix acls before storing or reporting it to
userspace. Various hacks exist to make this work. The code is hard to
understand and difficult to maintain in it's current form. Instead of
making this work by hacking posix acls through xattr handlers we are
building a dedicated posix acl api around the get and set inode
operations. This removes a lot of hackiness and makes the codepaths
easier to maintain. A lot of background can be found in [1].

In order to build a type safe posix api around get and set acl we need
all filesystem to implement get and set acl.

Now that we have added get and set acl inode operations that allow easy
access to the dentry we give overlayfs it's own get and set acl inode
operations.

Since overlayfs is a stacking filesystem it will use the newly added
posix acl api when retrieving posix acls from the relevant layer.

Since overlayfs can also be mounted on top of idmapped layers. If
idmapped layers are used overlayfs must take the layer's idmapping into
account after it retrieved the posix acls from the relevant layer.

Note, until the vfs has been switched to the new posix acl api this
patch is a non-functional change.

Link: https://lore.kernel.org/all/20220801145520.1532837-1-brauner@kernel.org [1]
Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org>
---
 fs/overlayfs/dir.c       |  3 +-
 fs/overlayfs/inode.c     | 63 ++++++++++++++++++++++++++++++++++++----
 fs/overlayfs/overlayfs.h | 10 +++++--
 3 files changed, 67 insertions(+), 9 deletions(-)

diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
index 7bece7010c00..eb49d5d7b56f 100644
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -1311,7 +1311,8 @@ const struct inode_operations ovl_dir_inode_operations = {
 	.permission	= ovl_permission,
 	.getattr	= ovl_getattr,
 	.listxattr	= ovl_listxattr,
-	.get_inode_acl	= ovl_get_acl,
+	.get_inode_acl	= ovl_get_inode_acl,
+	.get_acl	= ovl_get_acl,
 	.update_time	= ovl_update_time,
 	.fileattr_get	= ovl_fileattr_get,
 	.fileattr_set	= ovl_fileattr_set,
diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
index ecb51c249466..dd11e13cd288 100644
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -14,6 +14,8 @@
 #include <linux/fileattr.h>
 #include <linux/security.h>
 #include <linux/namei.h>
+#include <linux/posix_acl.h>
+#include <linux/posix_acl_xattr.h>
 #include "overlayfs.h"
 
 
@@ -460,9 +462,9 @@ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size)
  * of the POSIX ACLs retrieved from the lower layer to this function to not
  * alter the POSIX ACLs for the underlying filesystem.
  */
-static void ovl_idmap_posix_acl(struct inode *realinode,
-				struct user_namespace *mnt_userns,
-				struct posix_acl *acl)
+void ovl_idmap_posix_acl(struct inode *realinode,
+			 struct user_namespace *mnt_userns,
+			 struct posix_acl *acl)
 {
 	struct user_namespace *fs_userns = i_user_ns(realinode);
 
@@ -495,7 +497,7 @@ static void ovl_idmap_posix_acl(struct inode *realinode,
  *
  * This is obviously only relevant when idmapped layers are used.
  */
-struct posix_acl *ovl_get_acl(struct inode *inode, int type, bool rcu)
+struct posix_acl *ovl_get_inode_acl(struct inode *inode, int type, bool rcu)
 {
 	struct inode *realinode = ovl_inode_real(inode);
 	struct posix_acl *acl, *clone;
@@ -547,6 +549,53 @@ struct posix_acl *ovl_get_acl(struct inode *inode, int type, bool rcu)
 	posix_acl_release(acl);
 	return clone;
 }
+
+static struct posix_acl *ovl_get_acl_path(const struct path *path,
+					  const char *acl_name)
+{
+	struct posix_acl *real_acl, *clone;
+	struct user_namespace *mnt_userns;
+
+	mnt_userns = mnt_user_ns(path->mnt);
+
+	real_acl = vfs_get_acl(mnt_userns, path->dentry, acl_name);
+	if (IS_ERR(real_acl))
+		return real_acl;
+	if (!real_acl)
+		return NULL;
+
+	if (!is_idmapped_mnt(path->mnt))
+		return real_acl;
+
+	/*
+        * We cannot alter the ACLs returned from the relevant layer as that
+        * would alter the cached values filesystem wide for the lower
+        * filesystem. Instead we can clone the ACLs and then apply the
+        * relevant idmapping of the layer.
+        */
+	clone = posix_acl_clone(real_acl, GFP_KERNEL);
+	if (clone)
+		ovl_idmap_posix_acl(d_inode(path->dentry), mnt_userns, clone);
+	else
+		clone = ERR_PTR(-ENOMEM);
+	/* Drop reference to original posix acls. */
+	posix_acl_release(real_acl);
+	return clone;
+}
+
+struct posix_acl *ovl_get_acl(struct user_namespace *mnt_userns,
+			      struct dentry *dentry, int type)
+{
+	struct posix_acl *acl = NULL;
+	const struct cred *old_cred;
+	struct path realpath;
+
+	ovl_path_real(dentry, &realpath);
+	old_cred = ovl_override_creds(dentry->d_sb);
+	acl = ovl_get_acl_path(&realpath, posix_acl_xattr_name(type));
+	revert_creds(old_cred);
+	return acl;
+}
 #endif
 
 int ovl_update_time(struct inode *inode, struct timespec64 *ts, int flags)
@@ -721,7 +770,8 @@ static const struct inode_operations ovl_file_inode_operations = {
 	.permission	= ovl_permission,
 	.getattr	= ovl_getattr,
 	.listxattr	= ovl_listxattr,
-	.get_inode_acl	= ovl_get_acl,
+	.get_inode_acl	= ovl_get_inode_acl,
+	.get_acl	= ovl_get_acl,
 	.update_time	= ovl_update_time,
 	.fiemap		= ovl_fiemap,
 	.fileattr_get	= ovl_fileattr_get,
@@ -741,7 +791,8 @@ static const struct inode_operations ovl_special_inode_operations = {
 	.permission	= ovl_permission,
 	.getattr	= ovl_getattr,
 	.listxattr	= ovl_listxattr,
-	.get_inode_acl	= ovl_get_acl,
+	.get_inode_acl	= ovl_get_inode_acl,
+	.get_acl	= ovl_get_acl,
 	.update_time	= ovl_update_time,
 };
 
diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
index ee93c825b06b..68a3030332e9 100644
--- a/fs/overlayfs/overlayfs.h
+++ b/fs/overlayfs/overlayfs.h
@@ -592,9 +592,15 @@ int ovl_xattr_get(struct dentry *dentry, struct inode *inode, const char *name,
 ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size);
 
 #ifdef CONFIG_FS_POSIX_ACL
-struct posix_acl *ovl_get_acl(struct inode *inode, int type, bool rcu);
+struct posix_acl *ovl_get_inode_acl(struct inode *inode, int type, bool rcu);
+struct posix_acl *ovl_get_acl(struct user_namespace *mnt_userns,
+			      struct dentry *dentry, int type);
+void ovl_idmap_posix_acl(struct inode *realinode,
+			 struct user_namespace *mnt_userns,
+			 struct posix_acl *acl);
 #else
-#define ovl_get_acl	NULL
+#define ovl_get_inode_acl	NULL
+#define ovl_get_acl		NULL
 #endif
 
 int ovl_update_time(struct inode *inode, struct timespec64 *ts, int flags);
-- 
2.34.1

[PATCH 22/29] ovl: implement set acl method

[Christian Brauner]

The current way of setting and getting posix acls through the generic
xattr interface is error prone and type unsafe. The vfs needs to
interpret and fixup posix acls before storing or reporting it to
userspace. Various hacks exist to make this work. The code is hard to
understand and difficult to maintain in it's current form. Instead of
making this work by hacking posix acls through xattr handlers we are
building a dedicated posix acl api around the get and set inode
operations. This removes a lot of hackiness and makes the codepaths
easier to maintain. A lot of background can be found in [1].

In order to build a type safe posix api around get and set acl we need
all filesystem to implement get and set acl.

Now that we have added get and set acl inode operations that allow easy
access to the dentry we give overlayfs it's own get and set acl inode
operations.

The set acl inode operation is duplicates most of the ovl posix acl
xattr handler. The main difference being that the set acl inode
operation relies on the new posix acl api. Once the vfs has been
switched over the custom posix acl xattr handler will be removed
completely.

Note, until the vfs has been switched to the new posix acl api this
patch is a non-functional change.

Link: https://lore.kernel.org/all/20220801145520.1532837-1-brauner@kernel.org [1]
Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org>
---
 fs/overlayfs/dir.c       |  1 +
 fs/overlayfs/inode.c     | 81 ++++++++++++++++++++++++++++++++++++++++
 fs/overlayfs/overlayfs.h | 17 +++++++++
 3 files changed, 99 insertions(+)

diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
index eb49d5d7b56f..0e817ebce92c 100644
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -1313,6 +1313,7 @@ const struct inode_operations ovl_dir_inode_operations = {
 	.listxattr	= ovl_listxattr,
 	.get_inode_acl	= ovl_get_inode_acl,
 	.get_acl	= ovl_get_acl,
+	.set_acl	= ovl_set_acl,
 	.update_time	= ovl_update_time,
 	.fileattr_get	= ovl_fileattr_get,
 	.fileattr_set	= ovl_fileattr_set,
diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
index dd11e13cd288..b0a19f9deaf1 100644
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -596,6 +596,85 @@ struct posix_acl *ovl_get_acl(struct user_namespace *mnt_userns,
 	revert_creds(old_cred);
 	return acl;
 }
+
+int ovl_set_acl(struct user_namespace *mnt_userns, struct dentry *dentry,
+		struct posix_acl *acl, int type)
+{
+	int err;
+	struct ovl_fs *ofs = OVL_FS(dentry->d_sb);
+	struct inode *inode = d_inode(dentry);
+	struct dentry *upperdentry = ovl_dentry_upper(dentry);
+	struct dentry *realdentry = upperdentry ?: ovl_dentry_lower(dentry);
+	struct dentry *workdir = ovl_workdir(dentry);
+	struct inode *realinode = ovl_inode_real(inode);
+	struct path realpath;
+	const struct cred *old_cred;
+	const char *acl_name;
+
+	if (!IS_POSIXACL(d_inode(workdir)))
+		return -EOPNOTSUPP;
+	if (!realinode->i_op->set_acl)
+		return -EOPNOTSUPP;
+	if (type == ACL_TYPE_DEFAULT && !S_ISDIR(inode->i_mode))
+		return acl ? -EACCES : 0;
+	if (!inode_owner_or_capable(&init_user_ns, inode))
+		return -EPERM;
+
+	/*
+	 * Check if sgid bit needs to be cleared (actual setacl operation will
+	 * be done with mounter's capabilities and so that won't do it for us).
+	 */
+	if (unlikely(inode->i_mode & S_ISGID) && type == ACL_TYPE_ACCESS &&
+	    !in_group_p(inode->i_gid) &&
+	    !capable_wrt_inode_uidgid(&init_user_ns, inode, CAP_FSETID)) {
+		struct iattr iattr = { .ia_valid = ATTR_KILL_SGID };
+
+		err = ovl_setattr(&init_user_ns, dentry, &iattr);
+		if (err)
+			return err;
+	}
+
+	err = ovl_want_write(dentry);
+	if (err)
+		goto out;
+
+	acl_name = posix_acl_xattr_name(type);
+	if (!acl && !upperdentry) {
+		struct posix_acl *real_acl;
+
+		ovl_path_lower(dentry, &realpath);
+		old_cred = ovl_override_creds(dentry->d_sb);
+		real_acl = vfs_get_acl(mnt_user_ns(realpath.mnt), realdentry,
+				       posix_acl_xattr_name(type));
+		revert_creds(old_cred);
+		posix_acl_release(real_acl);
+		if (IS_ERR(real_acl))
+			goto out_drop_write;
+	}
+
+	if (!upperdentry) {
+		err = ovl_copy_up(dentry);
+		if (err)
+			goto out_drop_write;
+
+		realdentry = ovl_dentry_upper(dentry);
+	}
+
+	old_cred = ovl_override_creds(dentry->d_sb);
+	if (acl)
+		err = ovl_do_set_acl(ofs, realdentry, acl_name, acl);
+	else
+		err = ovl_do_remove_acl(ofs, realdentry, acl_name);
+	revert_creds(old_cred);
+
+	/* copy c/mtime */
+	ovl_copyattr(inode);
+
+out_drop_write:
+	ovl_drop_write(dentry);
+out:
+	return err;
+}
 #endif
 
 int ovl_update_time(struct inode *inode, struct timespec64 *ts, int flags)
@@ -772,6 +851,7 @@ static const struct inode_operations ovl_file_inode_operations = {
 	.listxattr	= ovl_listxattr,
 	.get_inode_acl	= ovl_get_inode_acl,
 	.get_acl	= ovl_get_acl,
+	.set_acl	= ovl_set_acl,
 	.update_time	= ovl_update_time,
 	.fiemap		= ovl_fiemap,
 	.fileattr_get	= ovl_fileattr_get,
@@ -793,6 +873,7 @@ static const struct inode_operations ovl_special_inode_operations = {
 	.listxattr	= ovl_listxattr,
 	.get_inode_acl	= ovl_get_inode_acl,
 	.get_acl	= ovl_get_acl,
+	.set_acl	= ovl_set_acl,
 	.update_time	= ovl_update_time,
 };
 
diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
index 68a3030332e9..b2645baeba2f 100644
--- a/fs/overlayfs/overlayfs.h
+++ b/fs/overlayfs/overlayfs.h
@@ -8,6 +8,8 @@
 #include <linux/uuid.h>
 #include <linux/fs.h>
 #include <linux/namei.h>
+#include <linux/posix_acl.h>
+#include <linux/posix_acl_xattr.h>
 #include "ovl_entry.h"
 
 #undef pr_fmt
@@ -278,6 +280,18 @@ static inline int ovl_removexattr(struct ovl_fs *ofs, struct dentry *dentry,
 	return ovl_do_removexattr(ofs, dentry, ovl_xattr(ofs, ox));
 }
 
+static inline int ovl_do_set_acl(struct ovl_fs *ofs, struct dentry *dentry,
+				 const char *acl_name, struct posix_acl *acl)
+{
+	return vfs_set_acl(ovl_upper_mnt_userns(ofs), dentry, acl_name, acl);
+}
+
+static inline int ovl_do_remove_acl(struct ovl_fs *ofs, struct dentry *dentry,
+				    const char *acl_name)
+{
+	return vfs_remove_acl(ovl_upper_mnt_userns(ofs), dentry, acl_name);
+}
+
 static inline int ovl_do_rename(struct ovl_fs *ofs, struct inode *olddir,
 				struct dentry *olddentry, struct inode *newdir,
 				struct dentry *newdentry, unsigned int flags)
@@ -595,12 +609,15 @@ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size);
 struct posix_acl *ovl_get_inode_acl(struct inode *inode, int type, bool rcu);
 struct posix_acl *ovl_get_acl(struct user_namespace *mnt_userns,
 			      struct dentry *dentry, int type);
+int ovl_set_acl(struct user_namespace *mnt_userns, struct dentry *dentry,
+		struct posix_acl *acl, int type);
 void ovl_idmap_posix_acl(struct inode *realinode,
 			 struct user_namespace *mnt_userns,
 			 struct posix_acl *acl);
 #else
 #define ovl_get_inode_acl	NULL
 #define ovl_get_acl		NULL
+#define ovl_set_acl		NULL
 #endif
 
 int ovl_update_time(struct inode *inode, struct timespec64 *ts, int flags);
-- 
2.34.1

[PATCH 23/29] ovl: use posix acl api

[Christian Brauner]

Now that posix acls have a proper api us it to copy them.

All filesystems that can serve as lower or upper layers for overlayfs
have gained support for the new posix acl api in previous patches.
So switch all internal overlayfs codepaths for copying posix acls to the
new posix acl api.

Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org>
---
 fs/overlayfs/copy_up.c   |  9 +++++++++
 fs/overlayfs/dir.c       | 20 ++-----------------
 fs/overlayfs/inode.c     |  4 ++--
 fs/overlayfs/overlayfs.h |  9 +++++++++
 fs/overlayfs/super.c     |  6 ++----
 fs/overlayfs/util.c      | 42 ++++++++++++++++++++++++++++++++++++++++
 fs/xattr.c               |  6 ------
 include/linux/xattr.h    |  6 ++++++
 8 files changed, 72 insertions(+), 30 deletions(-)

diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
index fdde6c56cc3d..93e575021ca1 100644
--- a/fs/overlayfs/copy_up.c
+++ b/fs/overlayfs/copy_up.c
@@ -93,6 +93,15 @@ int ovl_copy_xattr(struct super_block *sb, struct path *oldpath, struct dentry *
 			error = 0;
 			continue; /* Discard */
 		}
+
+		if (is_posix_acl_xattr(name)) {
+			error = ovl_copy_acl(OVL_FS(sb), oldpath, new, name);
+			if (!error)
+				continue;
+			/* POSIX ACLs must be copied. */
+			break;
+		}
+
 retry:
 		size = ovl_do_getxattr(oldpath, name, value, value_size);
 		if (size == -ERANGE)
diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
index 0e817ebce92c..cbb569d5d234 100644
--- a/fs/overlayfs/dir.c
+++ b/fs/overlayfs/dir.c
@@ -435,28 +435,12 @@ static struct dentry *ovl_clear_empty(struct dentry *dentry,
 }
 
 static int ovl_set_upper_acl(struct ovl_fs *ofs, struct dentry *upperdentry,
-			     const char *name, const struct posix_acl *acl)
+			     const char *acl_name, struct posix_acl *acl)
 {
-	void *buffer;
-	size_t size;
-	int err;
-
 	if (!IS_ENABLED(CONFIG_FS_POSIX_ACL) || !acl)
 		return 0;
 
-	size = posix_acl_xattr_size(acl->a_count);
-	buffer = kmalloc(size, GFP_KERNEL);
-	if (!buffer)
-		return -ENOMEM;
-
-	err = posix_acl_to_xattr(&init_user_ns, acl, buffer, size);
-	if (err < 0)
-		goto out_free;
-
-	err = ovl_do_setxattr(ofs, upperdentry, name, buffer, size, XATTR_CREATE);
-out_free:
-	kfree(buffer);
-	return err;
+	return ovl_do_set_acl(ofs, upperdentry, acl_name, acl);
 }
 
 static int ovl_create_over_whiteout(struct dentry *dentry, struct inode *inode,
diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
index b0a19f9deaf1..c6cb62daa8c2 100644
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -550,8 +550,8 @@ struct posix_acl *ovl_get_inode_acl(struct inode *inode, int type, bool rcu)
 	return clone;
 }
 
-static struct posix_acl *ovl_get_acl_path(const struct path *path,
-					  const char *acl_name)
+struct posix_acl *ovl_get_acl_path(const struct path *path,
+				   const char *acl_name)
 {
 	struct posix_acl *real_acl, *clone;
 	struct user_namespace *mnt_userns;
diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
index b2645baeba2f..3528e5631cb2 100644
--- a/fs/overlayfs/overlayfs.h
+++ b/fs/overlayfs/overlayfs.h
@@ -436,6 +436,8 @@ static inline bool ovl_check_origin_xattr(struct ovl_fs *ofs,
 int ovl_check_setxattr(struct ovl_fs *ofs, struct dentry *upperdentry,
 		       enum ovl_xattr ox, const void *value, size_t size,
 		       int xerr);
+int ovl_copy_acl(struct ovl_fs *ofs, const struct path *path,
+		 struct dentry *dentry, const char *acl_name);
 int ovl_set_impure(struct dentry *dentry, struct dentry *upperdentry);
 bool ovl_inuse_trylock(struct dentry *dentry);
 void ovl_inuse_unlock(struct dentry *dentry);
@@ -614,10 +616,17 @@ int ovl_set_acl(struct user_namespace *mnt_userns, struct dentry *dentry,
 void ovl_idmap_posix_acl(struct inode *realinode,
 			 struct user_namespace *mnt_userns,
 			 struct posix_acl *acl);
+struct posix_acl *ovl_get_acl_path(const struct path *path,
+				   const char *acl_name);
 #else
 #define ovl_get_inode_acl	NULL
 #define ovl_get_acl		NULL
 #define ovl_set_acl		NULL
+static inline struct posix_acl *ovl_get_acl_path(const struct path *path,
+						 const char *acl_name)
+{
+	return NULL;
+}
 #endif
 
 int ovl_update_time(struct inode *inode, struct timespec64 *ts, int flags);
diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index 5da771b218d1..8a13319db1d3 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -812,13 +812,11 @@ static struct dentry *ovl_workdir_create(struct ovl_fs *ofs,
 		 * allowed as upper are limited to "normal" ones, where checking
 		 * for the above two errors is sufficient.
 		 */
-		err = ovl_do_removexattr(ofs, work,
-					 XATTR_NAME_POSIX_ACL_DEFAULT);
+		err = ovl_do_remove_acl(ofs, work, XATTR_NAME_POSIX_ACL_DEFAULT);
 		if (err && err != -ENODATA && err != -EOPNOTSUPP)
 			goto out_dput;
 
-		err = ovl_do_removexattr(ofs, work,
-					 XATTR_NAME_POSIX_ACL_ACCESS);
+		err = ovl_do_remove_acl(ofs, work, XATTR_NAME_POSIX_ACL_ACCESS);
 		if (err && err != -ENODATA && err != -EOPNOTSUPP)
 			goto out_dput;
 
diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c
index 87f811c089e4..0246babce4d2 100644
--- a/fs/overlayfs/util.c
+++ b/fs/overlayfs/util.c
@@ -1117,3 +1117,45 @@ void ovl_copyattr(struct inode *inode)
 	inode->i_ctime = realinode->i_ctime;
 	i_size_write(inode, i_size_read(realinode));
 }
+
+int ovl_copy_acl(struct ovl_fs *ofs, const struct path *path,
+		 struct dentry *dentry, const char *acl_name)
+{
+	int err;
+	struct posix_acl *real_acl = NULL;
+
+	real_acl = ovl_get_acl_path(path, acl_name);
+	if (!real_acl)
+		return 0;
+
+	if (IS_ERR(real_acl)) {
+		err = PTR_ERR(real_acl);
+		if (err == -ENODATA || err == -EOPNOTSUPP)
+			return 0;
+		return err;
+	}
+
+	/*
+	 * If we didn't have to create a copy already because @path was on an
+	 * idmapped mount we need to do so if the upper layer is so we don't
+	 * alter the POSIX ACLs of the filesystem we retrieved them from.
+	 */
+	if (!is_idmapped_mnt(path->mnt) && is_idmapped_mnt(ovl_upper_mnt(ofs))) {
+		struct posix_acl *clone;
+
+		clone = posix_acl_clone(real_acl, GFP_KERNEL);
+		if (!clone) {
+			err = -ENOMEM;
+			goto out;
+		}
+		/* release original acl */
+		posix_acl_release(real_acl);
+		real_acl = clone;
+	}
+
+	err = ovl_do_set_acl(ofs, dentry, acl_name, real_acl);
+out:
+	/* release original or cloned acl */
+	posix_acl_release(real_acl);
+	return err;
+}
diff --git a/fs/xattr.c b/fs/xattr.c
index e16d7bde4935..0b9a84921c4d 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -281,12 +281,6 @@ __vfs_setxattr_locked(struct user_namespace *mnt_userns, struct dentry *dentry,
 }
 EXPORT_SYMBOL_GPL(__vfs_setxattr_locked);
 
-static inline bool is_posix_acl_xattr(const char *name)
-{
-	return (strcmp(name, XATTR_NAME_POSIX_ACL_ACCESS) == 0) ||
-	       (strcmp(name, XATTR_NAME_POSIX_ACL_DEFAULT) == 0);
-}
-
 int
 vfs_setxattr(struct user_namespace *mnt_userns, struct dentry *dentry,
 	     const char *name, const void *value, size_t size, int flags)
diff --git a/include/linux/xattr.h b/include/linux/xattr.h
index 8267e547e631..d44d59177026 100644
--- a/include/linux/xattr.h
+++ b/include/linux/xattr.h
@@ -22,6 +22,12 @@
 struct inode;
 struct dentry;
 
+static inline bool is_posix_acl_xattr(const char *name)
+{
+	return (strcmp(name, XATTR_NAME_POSIX_ACL_ACCESS) == 0) ||
+	       (strcmp(name, XATTR_NAME_POSIX_ACL_DEFAULT) == 0);
+}
+
 /*
  * struct xattr_handler: When @name is set, match attributes with exactly that
  * name.  When @prefix is set instead, match attributes with that prefix and
-- 
2.34.1

[PATCH 26/29] ovl: use stub posix acl handlers

[Christian Brauner]

Now that ovl supports the get and set acl inode operations and the vfs
has been switched to the new posi api, ovl can simply rely on the stub
posix acl handlers. The custom xattr handlers and associated unused
helpers can be removed.

Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org>
---
 fs/overlayfs/super.c | 101 ++-----------------------------------------
 1 file changed, 4 insertions(+), 97 deletions(-)

diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
index 8a13319db1d3..0c7ae79b10b1 100644
--- a/fs/overlayfs/super.c
+++ b/fs/overlayfs/super.c
@@ -998,83 +998,6 @@ static unsigned int ovl_split_lowerdirs(char *str)
 	return ctr;
 }
 
-static int __maybe_unused
-ovl_posix_acl_xattr_get(const struct xattr_handler *handler,
-			struct dentry *dentry, struct inode *inode,
-			const char *name, void *buffer, size_t size)
-{
-	return ovl_xattr_get(dentry, inode, handler->name, buffer, size);
-}
-
-static int __maybe_unused
-ovl_posix_acl_xattr_set(const struct xattr_handler *handler,
-			struct user_namespace *mnt_userns,
-			struct dentry *dentry, struct inode *inode,
-			const char *name, const void *value,
-			size_t size, int flags)
-{
-	struct dentry *workdir = ovl_workdir(dentry);
-	struct inode *realinode = ovl_inode_real(inode);
-	struct posix_acl *acl = NULL;
-	int err;
-
-	/* Check that everything is OK before copy-up */
-	if (value) {
-		/* The above comment can be understood in two ways:
-		 *
-		 * 1. We just want to check whether the basic POSIX ACL format
-		 *    is ok. For example, if the header is correct and the size
-		 *    is sane.
-		 * 2. We want to know whether the ACL_{GROUP,USER} entries can
-		 *    be mapped according to the underlying filesystem.
-		 *
-		 * Currently, we only check 1. If we wanted to check 2. we
-		 * would need to pass the mnt_userns and the fs_userns of the
-		 * underlying filesystem. But frankly, I think checking 1. is
-		 * enough to start the copy-up.
-		 */
-		acl = vfs_set_acl_prepare(&init_user_ns, &init_user_ns, value, size);
-		if (IS_ERR(acl))
-			return PTR_ERR(acl);
-	}
-	err = -EOPNOTSUPP;
-	if (!IS_POSIXACL(d_inode(workdir)))
-		goto out_acl_release;
-	if (!realinode->i_op->set_acl)
-		goto out_acl_release;
-	if (handler->flags == ACL_TYPE_DEFAULT && !S_ISDIR(inode->i_mode)) {
-		err = acl ? -EACCES : 0;
-		goto out_acl_release;
-	}
-	err = -EPERM;
-	if (!inode_owner_or_capable(&init_user_ns, inode))
-		goto out_acl_release;
-
-	posix_acl_release(acl);
-
-	/*
-	 * Check if sgid bit needs to be cleared (actual setacl operation will
-	 * be done with mounter's capabilities and so that won't do it for us).
-	 */
-	if (unlikely(inode->i_mode & S_ISGID) &&
-	    handler->flags == ACL_TYPE_ACCESS &&
-	    !in_group_p(inode->i_gid) &&
-	    !capable_wrt_inode_uidgid(&init_user_ns, inode, CAP_FSETID)) {
-		struct iattr iattr = { .ia_valid = ATTR_KILL_SGID };
-
-		err = ovl_setattr(&init_user_ns, dentry, &iattr);
-		if (err)
-			return err;
-	}
-
-	err = ovl_xattr_set(dentry, inode, handler->name, value, size, flags);
-	return err;
-
-out_acl_release:
-	posix_acl_release(acl);
-	return err;
-}
-
 static int ovl_own_xattr_get(const struct xattr_handler *handler,
 			     struct dentry *dentry, struct inode *inode,
 			     const char *name, void *buffer, size_t size)
@@ -1107,22 +1030,6 @@ static int ovl_other_xattr_set(const struct xattr_handler *handler,
 	return ovl_xattr_set(dentry, inode, name, value, size, flags);
 }
 
-static const struct xattr_handler __maybe_unused
-ovl_posix_acl_access_xattr_handler = {
-	.name = XATTR_NAME_POSIX_ACL_ACCESS,
-	.flags = ACL_TYPE_ACCESS,
-	.get = ovl_posix_acl_xattr_get,
-	.set = ovl_posix_acl_xattr_set,
-};
-
-static const struct xattr_handler __maybe_unused
-ovl_posix_acl_default_xattr_handler = {
-	.name = XATTR_NAME_POSIX_ACL_DEFAULT,
-	.flags = ACL_TYPE_DEFAULT,
-	.get = ovl_posix_acl_xattr_get,
-	.set = ovl_posix_acl_xattr_set,
-};
-
 static const struct xattr_handler ovl_own_trusted_xattr_handler = {
 	.prefix	= OVL_XATTR_TRUSTED_PREFIX,
 	.get = ovl_own_xattr_get,
@@ -1143,8 +1050,8 @@ static const struct xattr_handler ovl_other_xattr_handler = {
 
 static const struct xattr_handler *ovl_trusted_xattr_handlers[] = {
 #ifdef CONFIG_FS_POSIX_ACL
-	&ovl_posix_acl_access_xattr_handler,
-	&ovl_posix_acl_default_xattr_handler,
+	&posix_acl_access_xattr_handler,
+	&posix_acl_default_xattr_handler,
 #endif
 	&ovl_own_trusted_xattr_handler,
 	&ovl_other_xattr_handler,
@@ -1153,8 +1060,8 @@ static const struct xattr_handler *ovl_trusted_xattr_handlers[] = {
 
 static const struct xattr_handler *ovl_user_xattr_handlers[] = {
 #ifdef CONFIG_FS_POSIX_ACL
-	&ovl_posix_acl_access_xattr_handler,
-	&ovl_posix_acl_default_xattr_handler,
+	&posix_acl_access_xattr_handler,
+	&posix_acl_default_xattr_handler,
 #endif
 	&ovl_own_user_xattr_handler,
 	&ovl_other_xattr_handler,
-- 
2.34.1

Re: [PATCH 21/29] ovl: implement get acl method

[Miklos Szeredi]

On Thu, 22 Sept 2022 at 17:18, Christian Brauner <brauner@kernel.org> wrote:
>
> The current way of setting and getting posix acls through the generic
> xattr interface is error prone and type unsafe. The vfs needs to
> interpret and fixup posix acls before storing or reporting it to
> userspace. Various hacks exist to make this work. The code is hard to
> understand and difficult to maintain in it's current form. Instead of
> making this work by hacking posix acls through xattr handlers we are
> building a dedicated posix acl api around the get and set inode
> operations. This removes a lot of hackiness and makes the codepaths
> easier to maintain. A lot of background can be found in [1].
>
> In order to build a type safe posix api around get and set acl we need
> all filesystem to implement get and set acl.
>
> Now that we have added get and set acl inode operations that allow easy
> access to the dentry we give overlayfs it's own get and set acl inode
> operations.
>
> Since overlayfs is a stacking filesystem it will use the newly added
> posix acl api when retrieving posix acls from the relevant layer.
>
> Since overlayfs can also be mounted on top of idmapped layers. If
> idmapped layers are used overlayfs must take the layer's idmapping into
> account after it retrieved the posix acls from the relevant layer.
>
> Note, until the vfs has been switched to the new posix acl api this
> patch is a non-functional change.
>
> Link: https://lore.kernel.org/all/20220801145520.1532837-1-brauner@kernel.org [1]
> Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org>
> ---
>  fs/overlayfs/dir.c       |  3 +-
>  fs/overlayfs/inode.c     | 63 ++++++++++++++++++++++++++++++++++++----
>  fs/overlayfs/overlayfs.h | 10 +++++--
>  3 files changed, 67 insertions(+), 9 deletions(-)
>
> diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
> index 7bece7010c00..eb49d5d7b56f 100644
> --- a/fs/overlayfs/dir.c
> +++ b/fs/overlayfs/dir.c
> @@ -1311,7 +1311,8 @@ const struct inode_operations ovl_dir_inode_operations = {
>         .permission     = ovl_permission,
>         .getattr        = ovl_getattr,
>         .listxattr      = ovl_listxattr,
> -       .get_inode_acl  = ovl_get_acl,
> +       .get_inode_acl  = ovl_get_inode_acl,
> +       .get_acl        = ovl_get_acl,
>         .update_time    = ovl_update_time,
>         .fileattr_get   = ovl_fileattr_get,
>         .fileattr_set   = ovl_fileattr_set,
> diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
> index ecb51c249466..dd11e13cd288 100644
> --- a/fs/overlayfs/inode.c
> +++ b/fs/overlayfs/inode.c
> @@ -14,6 +14,8 @@
>  #include <linux/fileattr.h>
>  #include <linux/security.h>
>  #include <linux/namei.h>
> +#include <linux/posix_acl.h>
> +#include <linux/posix_acl_xattr.h>
>  #include "overlayfs.h"
>
>
> @@ -460,9 +462,9 @@ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size)
>   * of the POSIX ACLs retrieved from the lower layer to this function to not
>   * alter the POSIX ACLs for the underlying filesystem.
>   */
> -static void ovl_idmap_posix_acl(struct inode *realinode,
> -                               struct user_namespace *mnt_userns,
> -                               struct posix_acl *acl)
> +void ovl_idmap_posix_acl(struct inode *realinode,
> +                        struct user_namespace *mnt_userns,
> +                        struct posix_acl *acl)
>  {
>         struct user_namespace *fs_userns = i_user_ns(realinode);
>
> @@ -495,7 +497,7 @@ static void ovl_idmap_posix_acl(struct inode *realinode,
>   *
>   * This is obviously only relevant when idmapped layers are used.
>   */
> -struct posix_acl *ovl_get_acl(struct inode *inode, int type, bool rcu)
> +struct posix_acl *ovl_get_inode_acl(struct inode *inode, int type, bool rcu)
>  {
>         struct inode *realinode = ovl_inode_real(inode);
>         struct posix_acl *acl, *clone;
> @@ -547,6 +549,53 @@ struct posix_acl *ovl_get_acl(struct inode *inode, int type, bool rcu)
>         posix_acl_release(acl);
>         return clone;
>  }
> +
> +static struct posix_acl *ovl_get_acl_path(const struct path *path,
> +                                         const char *acl_name)
> +{
> +       struct posix_acl *real_acl, *clone;
> +       struct user_namespace *mnt_userns;
> +
> +       mnt_userns = mnt_user_ns(path->mnt);
> +
> +       real_acl = vfs_get_acl(mnt_userns, path->dentry, acl_name);
> +       if (IS_ERR(real_acl))
> +               return real_acl;
> +       if (!real_acl)
> +               return NULL;

if (IS_ERR_OR_NULL(real_acl))
    return real_acl;

> +
> +       if (!is_idmapped_mnt(path->mnt))
> +               return real_acl;
> +
> +       /*
> +        * We cannot alter the ACLs returned from the relevant layer as that
> +        * would alter the cached values filesystem wide for the lower
> +        * filesystem. Instead we can clone the ACLs and then apply the
> +        * relevant idmapping of the layer.
> +        */

Can't vfs_get_acl() return 'const posix_acl *' to enforce that?

Thanks,
Miklos

Re: [PATCH 21/29] ovl: implement get acl method

[Christian Brauner]

On Fri, Sep 23, 2022 at 04:59:42PM +0200, Miklos Szeredi wrote:
> On Thu, 22 Sept 2022 at 17:18, Christian Brauner <brauner@kernel.org> wrote:
> >
> > The current way of setting and getting posix acls through the generic
> > xattr interface is error prone and type unsafe. The vfs needs to
> > interpret and fixup posix acls before storing or reporting it to
> > userspace. Various hacks exist to make this work. The code is hard to
> > understand and difficult to maintain in it's current form. Instead of
> > making this work by hacking posix acls through xattr handlers we are
> > building a dedicated posix acl api around the get and set inode
> > operations. This removes a lot of hackiness and makes the codepaths
> > easier to maintain. A lot of background can be found in [1].
> >
> > In order to build a type safe posix api around get and set acl we need
> > all filesystem to implement get and set acl.
> >
> > Now that we have added get and set acl inode operations that allow easy
> > access to the dentry we give overlayfs it's own get and set acl inode
> > operations.
> >
> > Since overlayfs is a stacking filesystem it will use the newly added
> > posix acl api when retrieving posix acls from the relevant layer.
> >
> > Since overlayfs can also be mounted on top of idmapped layers. If
> > idmapped layers are used overlayfs must take the layer's idmapping into
> > account after it retrieved the posix acls from the relevant layer.
> >
> > Note, until the vfs has been switched to the new posix acl api this
> > patch is a non-functional change.
> >
> > Link: https://lore.kernel.org/all/20220801145520.1532837-1-brauner@kernel.org [1]
> > Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org>
> > ---
> >  fs/overlayfs/dir.c       |  3 +-
> >  fs/overlayfs/inode.c     | 63 ++++++++++++++++++++++++++++++++++++----
> >  fs/overlayfs/overlayfs.h | 10 +++++--
> >  3 files changed, 67 insertions(+), 9 deletions(-)
> >
> > diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
> > index 7bece7010c00..eb49d5d7b56f 100644
> > --- a/fs/overlayfs/dir.c
> > +++ b/fs/overlayfs/dir.c
> > @@ -1311,7 +1311,8 @@ const struct inode_operations ovl_dir_inode_operations = {
> >         .permission     = ovl_permission,
> >         .getattr        = ovl_getattr,
> >         .listxattr      = ovl_listxattr,
> > -       .get_inode_acl  = ovl_get_acl,
> > +       .get_inode_acl  = ovl_get_inode_acl,
> > +       .get_acl        = ovl_get_acl,
> >         .update_time    = ovl_update_time,
> >         .fileattr_get   = ovl_fileattr_get,
> >         .fileattr_set   = ovl_fileattr_set,
> > diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
> > index ecb51c249466..dd11e13cd288 100644
> > --- a/fs/overlayfs/inode.c
> > +++ b/fs/overlayfs/inode.c
> > @@ -14,6 +14,8 @@
> >  #include <linux/fileattr.h>
> >  #include <linux/security.h>
> >  #include <linux/namei.h>
> > +#include <linux/posix_acl.h>
> > +#include <linux/posix_acl_xattr.h>
> >  #include "overlayfs.h"
> >
> >
> > @@ -460,9 +462,9 @@ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size)
> >   * of the POSIX ACLs retrieved from the lower layer to this function to not
> >   * alter the POSIX ACLs for the underlying filesystem.
> >   */
> > -static void ovl_idmap_posix_acl(struct inode *realinode,
> > -                               struct user_namespace *mnt_userns,
> > -                               struct posix_acl *acl)
> > +void ovl_idmap_posix_acl(struct inode *realinode,
> > +                        struct user_namespace *mnt_userns,
> > +                        struct posix_acl *acl)
> >  {
> >         struct user_namespace *fs_userns = i_user_ns(realinode);
> >
> > @@ -495,7 +497,7 @@ static void ovl_idmap_posix_acl(struct inode *realinode,
> >   *
> >   * This is obviously only relevant when idmapped layers are used.
> >   */
> > -struct posix_acl *ovl_get_acl(struct inode *inode, int type, bool rcu)
> > +struct posix_acl *ovl_get_inode_acl(struct inode *inode, int type, bool rcu)
> >  {
> >         struct inode *realinode = ovl_inode_real(inode);
> >         struct posix_acl *acl, *clone;
> > @@ -547,6 +549,53 @@ struct posix_acl *ovl_get_acl(struct inode *inode, int type, bool rcu)
> >         posix_acl_release(acl);
> >         return clone;
> >  }
> > +
> > +static struct posix_acl *ovl_get_acl_path(const struct path *path,
> > +                                         const char *acl_name)
> > +{
> > +       struct posix_acl *real_acl, *clone;
> > +       struct user_namespace *mnt_userns;
> > +
> > +       mnt_userns = mnt_user_ns(path->mnt);
> > +
> > +       real_acl = vfs_get_acl(mnt_userns, path->dentry, acl_name);
> > +       if (IS_ERR(real_acl))
> > +               return real_acl;
> > +       if (!real_acl)
> > +               return NULL;
> 
> if (IS_ERR_OR_NULL(real_acl))
>     return real_acl;

Thanks.

> 
> > +
> > +       if (!is_idmapped_mnt(path->mnt))
> > +               return real_acl;
> > +
> > +       /*
> > +        * We cannot alter the ACLs returned from the relevant layer as that
> > +        * would alter the cached values filesystem wide for the lower
> > +        * filesystem. Instead we can clone the ACLs and then apply the
> > +        * relevant idmapping of the layer.
> > +        */
> 
> Can't vfs_get_acl() return 'const posix_acl *' to enforce that?

The problem is that struct posix_acl is reference counted and often has
to be passed to functions such as posix_acl_release() or
posix_acl_dup().

Re: [PATCH 22/29] ovl: implement set acl method

[Miklos Szeredi]

On Thu, 22 Sept 2022 at 17:18, Christian Brauner <brauner@kernel.org> wrote:
>
> The current way of setting and getting posix acls through the generic
> xattr interface is error prone and type unsafe. The vfs needs to
> interpret and fixup posix acls before storing or reporting it to
> userspace. Various hacks exist to make this work. The code is hard to
> understand and difficult to maintain in it's current form. Instead of
> making this work by hacking posix acls through xattr handlers we are
> building a dedicated posix acl api around the get and set inode
> operations. This removes a lot of hackiness and makes the codepaths
> easier to maintain. A lot of background can be found in [1].
>
> In order to build a type safe posix api around get and set acl we need
> all filesystem to implement get and set acl.
>
> Now that we have added get and set acl inode operations that allow easy
> access to the dentry we give overlayfs it's own get and set acl inode
> operations.
>
> The set acl inode operation is duplicates most of the ovl posix acl
> xattr handler. The main difference being that the set acl inode
> operation relies on the new posix acl api. Once the vfs has been
> switched over the custom posix acl xattr handler will be removed
> completely.
>
> Note, until the vfs has been switched to the new posix acl api this
> patch is a non-functional change.
>
> Link: https://lore.kernel.org/all/20220801145520.1532837-1-brauner@kernel.org [1]
> Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org>
> ---
>  fs/overlayfs/dir.c       |  1 +
>  fs/overlayfs/inode.c     | 81 ++++++++++++++++++++++++++++++++++++++++
>  fs/overlayfs/overlayfs.h | 17 +++++++++
>  3 files changed, 99 insertions(+)
>
> diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
> index eb49d5d7b56f..0e817ebce92c 100644
> --- a/fs/overlayfs/dir.c
> +++ b/fs/overlayfs/dir.c
> @@ -1313,6 +1313,7 @@ const struct inode_operations ovl_dir_inode_operations = {
>         .listxattr      = ovl_listxattr,
>         .get_inode_acl  = ovl_get_inode_acl,
>         .get_acl        = ovl_get_acl,
> +       .set_acl        = ovl_set_acl,
>         .update_time    = ovl_update_time,
>         .fileattr_get   = ovl_fileattr_get,
>         .fileattr_set   = ovl_fileattr_set,
> diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
> index dd11e13cd288..b0a19f9deaf1 100644
> --- a/fs/overlayfs/inode.c
> +++ b/fs/overlayfs/inode.c
> @@ -596,6 +596,85 @@ struct posix_acl *ovl_get_acl(struct user_namespace *mnt_userns,
>         revert_creds(old_cred);
>         return acl;
>  }
> +
> +int ovl_set_acl(struct user_namespace *mnt_userns, struct dentry *dentry,
> +               struct posix_acl *acl, int type)
> +{
> +       int err;
> +       struct ovl_fs *ofs = OVL_FS(dentry->d_sb);
> +       struct inode *inode = d_inode(dentry);
> +       struct dentry *upperdentry = ovl_dentry_upper(dentry);
> +       struct dentry *realdentry = upperdentry ?: ovl_dentry_lower(dentry);
> +       struct dentry *workdir = ovl_workdir(dentry);
> +       struct inode *realinode = ovl_inode_real(inode);
> +       struct path realpath;
> +       const struct cred *old_cred;
> +       const char *acl_name;
> +
> +       if (!IS_POSIXACL(d_inode(workdir)))
> +               return -EOPNOTSUPP;
> +       if (!realinode->i_op->set_acl)
> +               return -EOPNOTSUPP;
> +       if (type == ACL_TYPE_DEFAULT && !S_ISDIR(inode->i_mode))
> +               return acl ? -EACCES : 0;
> +       if (!inode_owner_or_capable(&init_user_ns, inode))
> +               return -EPERM;
> +
> +       /*
> +        * Check if sgid bit needs to be cleared (actual setacl operation will
> +        * be done with mounter's capabilities and so that won't do it for us).
> +        */
> +       if (unlikely(inode->i_mode & S_ISGID) && type == ACL_TYPE_ACCESS &&
> +           !in_group_p(inode->i_gid) &&
> +           !capable_wrt_inode_uidgid(&init_user_ns, inode, CAP_FSETID)) {
> +               struct iattr iattr = { .ia_valid = ATTR_KILL_SGID };
> +
> +               err = ovl_setattr(&init_user_ns, dentry, &iattr);
> +               if (err)
> +                       return err;
> +       }
> +

I'd split this function up here (same as was done in the original
xattr based one).

> +       err = ovl_want_write(dentry);
> +       if (err)
> +               goto out;
> +
> +       acl_name = posix_acl_xattr_name(type);

My bad, but this really deserves a comment:  /* If ACL is to be
removed from a lower file, check if it exists in the first place
before copying it up */

> +       if (!acl && !upperdentry) {
> +               struct posix_acl *real_acl;
> +
> +               ovl_path_lower(dentry, &realpath);
> +               old_cred = ovl_override_creds(dentry->d_sb);
> +               real_acl = vfs_get_acl(mnt_user_ns(realpath.mnt), realdentry,
> +                                      posix_acl_xattr_name(type));
> +               revert_creds(old_cred);
> +               posix_acl_release(real_acl);
> +               if (IS_ERR(real_acl))
> +                       goto out_drop_write;
> +       }
> +
> +       if (!upperdentry) {
> +               err = ovl_copy_up(dentry);
> +               if (err)
> +                       goto out_drop_write;
> +
> +               realdentry = ovl_dentry_upper(dentry);
> +       }
> +
> +       old_cred = ovl_override_creds(dentry->d_sb);
> +       if (acl)
> +               err = ovl_do_set_acl(ofs, realdentry, acl_name, acl);
> +       else
> +               err = ovl_do_remove_acl(ofs, realdentry, acl_name);
> +       revert_creds(old_cred);
> +
> +       /* copy c/mtime */
> +       ovl_copyattr(inode);
> +
> +out_drop_write:
> +       ovl_drop_write(dentry);
> +out:
> +       return err;
> +}
>  #endif
>
>  int ovl_update_time(struct inode *inode, struct timespec64 *ts, int flags)
> @@ -772,6 +851,7 @@ static const struct inode_operations ovl_file_inode_operations = {
>         .listxattr      = ovl_listxattr,
>         .get_inode_acl  = ovl_get_inode_acl,
>         .get_acl        = ovl_get_acl,
> +       .set_acl        = ovl_set_acl,
>         .update_time    = ovl_update_time,
>         .fiemap         = ovl_fiemap,
>         .fileattr_get   = ovl_fileattr_get,
> @@ -793,6 +873,7 @@ static const struct inode_operations ovl_special_inode_operations = {
>         .listxattr      = ovl_listxattr,
>         .get_inode_acl  = ovl_get_inode_acl,
>         .get_acl        = ovl_get_acl,
> +       .set_acl        = ovl_set_acl,
>         .update_time    = ovl_update_time,
>  };
>
> diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
> index 68a3030332e9..b2645baeba2f 100644
> --- a/fs/overlayfs/overlayfs.h
> +++ b/fs/overlayfs/overlayfs.h
> @@ -8,6 +8,8 @@
>  #include <linux/uuid.h>
>  #include <linux/fs.h>
>  #include <linux/namei.h>
> +#include <linux/posix_acl.h>
> +#include <linux/posix_acl_xattr.h>
>  #include "ovl_entry.h"
>
>  #undef pr_fmt
> @@ -278,6 +280,18 @@ static inline int ovl_removexattr(struct ovl_fs *ofs, struct dentry *dentry,
>         return ovl_do_removexattr(ofs, dentry, ovl_xattr(ofs, ox));
>  }
>
> +static inline int ovl_do_set_acl(struct ovl_fs *ofs, struct dentry *dentry,
> +                                const char *acl_name, struct posix_acl *acl)
> +{
> +       return vfs_set_acl(ovl_upper_mnt_userns(ofs), dentry, acl_name, acl);
> +}
> +
> +static inline int ovl_do_remove_acl(struct ovl_fs *ofs, struct dentry *dentry,
> +                                   const char *acl_name)
> +{
> +       return vfs_remove_acl(ovl_upper_mnt_userns(ofs), dentry, acl_name);
> +}
> +
>  static inline int ovl_do_rename(struct ovl_fs *ofs, struct inode *olddir,
>                                 struct dentry *olddentry, struct inode *newdir,
>                                 struct dentry *newdentry, unsigned int flags)
> @@ -595,12 +609,15 @@ ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size);
>  struct posix_acl *ovl_get_inode_acl(struct inode *inode, int type, bool rcu);
>  struct posix_acl *ovl_get_acl(struct user_namespace *mnt_userns,
>                               struct dentry *dentry, int type);
> +int ovl_set_acl(struct user_namespace *mnt_userns, struct dentry *dentry,
> +               struct posix_acl *acl, int type);
>  void ovl_idmap_posix_acl(struct inode *realinode,
>                          struct user_namespace *mnt_userns,
>                          struct posix_acl *acl);
>  #else
>  #define ovl_get_inode_acl      NULL
>  #define ovl_get_acl            NULL
> +#define ovl_set_acl            NULL
>  #endif
>
>  int ovl_update_time(struct inode *inode, struct timespec64 *ts, int flags);
> --
> 2.34.1
>

Re: [PATCH 22/29] ovl: implement set acl method

[Christian Brauner]

On Fri, Sep 23, 2022 at 05:18:42PM +0200, Miklos Szeredi wrote:
> On Thu, 22 Sept 2022 at 17:18, Christian Brauner <brauner@kernel.org> wrote:
> >
> > The current way of setting and getting posix acls through the generic
> > xattr interface is error prone and type unsafe. The vfs needs to
> > interpret and fixup posix acls before storing or reporting it to
> > userspace. Various hacks exist to make this work. The code is hard to
> > understand and difficult to maintain in it's current form. Instead of
> > making this work by hacking posix acls through xattr handlers we are
> > building a dedicated posix acl api around the get and set inode
> > operations. This removes a lot of hackiness and makes the codepaths
> > easier to maintain. A lot of background can be found in [1].
> >
> > In order to build a type safe posix api around get and set acl we need
> > all filesystem to implement get and set acl.
> >
> > Now that we have added get and set acl inode operations that allow easy
> > access to the dentry we give overlayfs it's own get and set acl inode
> > operations.
> >
> > The set acl inode operation is duplicates most of the ovl posix acl
> > xattr handler. The main difference being that the set acl inode
> > operation relies on the new posix acl api. Once the vfs has been
> > switched over the custom posix acl xattr handler will be removed
> > completely.
> >
> > Note, until the vfs has been switched to the new posix acl api this
> > patch is a non-functional change.
> >
> > Link: https://lore.kernel.org/all/20220801145520.1532837-1-brauner@kernel.org [1]
> > Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org>
> > ---
> >  fs/overlayfs/dir.c       |  1 +
> >  fs/overlayfs/inode.c     | 81 ++++++++++++++++++++++++++++++++++++++++
> >  fs/overlayfs/overlayfs.h | 17 +++++++++
> >  3 files changed, 99 insertions(+)
> >
> > diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
> > index eb49d5d7b56f..0e817ebce92c 100644
> > --- a/fs/overlayfs/dir.c
> > +++ b/fs/overlayfs/dir.c
> > @@ -1313,6 +1313,7 @@ const struct inode_operations ovl_dir_inode_operations = {
> >         .listxattr      = ovl_listxattr,
> >         .get_inode_acl  = ovl_get_inode_acl,
> >         .get_acl        = ovl_get_acl,
> > +       .set_acl        = ovl_set_acl,
> >         .update_time    = ovl_update_time,
> >         .fileattr_get   = ovl_fileattr_get,
> >         .fileattr_set   = ovl_fileattr_set,
> > diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
> > index dd11e13cd288..b0a19f9deaf1 100644
> > --- a/fs/overlayfs/inode.c
> > +++ b/fs/overlayfs/inode.c
> > @@ -596,6 +596,85 @@ struct posix_acl *ovl_get_acl(struct user_namespace *mnt_userns,
> >         revert_creds(old_cred);
> >         return acl;
> >  }
> > +
> > +int ovl_set_acl(struct user_namespace *mnt_userns, struct dentry *dentry,
> > +               struct posix_acl *acl, int type)
> > +{
> > +       int err;
> > +       struct ovl_fs *ofs = OVL_FS(dentry->d_sb);
> > +       struct inode *inode = d_inode(dentry);
> > +       struct dentry *upperdentry = ovl_dentry_upper(dentry);
> > +       struct dentry *realdentry = upperdentry ?: ovl_dentry_lower(dentry);
> > +       struct dentry *workdir = ovl_workdir(dentry);
> > +       struct inode *realinode = ovl_inode_real(inode);
> > +       struct path realpath;
> > +       const struct cred *old_cred;
> > +       const char *acl_name;
> > +
> > +       if (!IS_POSIXACL(d_inode(workdir)))
> > +               return -EOPNOTSUPP;
> > +       if (!realinode->i_op->set_acl)
> > +               return -EOPNOTSUPP;
> > +       if (type == ACL_TYPE_DEFAULT && !S_ISDIR(inode->i_mode))
> > +               return acl ? -EACCES : 0;
> > +       if (!inode_owner_or_capable(&init_user_ns, inode))
> > +               return -EPERM;
> > +
> > +       /*
> > +        * Check if sgid bit needs to be cleared (actual setacl operation will
> > +        * be done with mounter's capabilities and so that won't do it for us).
> > +        */
> > +       if (unlikely(inode->i_mode & S_ISGID) && type == ACL_TYPE_ACCESS &&
> > +           !in_group_p(inode->i_gid) &&
> > +           !capable_wrt_inode_uidgid(&init_user_ns, inode, CAP_FSETID)) {
> > +               struct iattr iattr = { .ia_valid = ATTR_KILL_SGID };
> > +
> > +               err = ovl_setattr(&init_user_ns, dentry, &iattr);
> > +               if (err)
> > +                       return err;
> > +       }
> > +
> 
> I'd split this function up here (same as was done in the original
> xattr based one).

Ok, will do.

> 
> > +       err = ovl_want_write(dentry);
> > +       if (err)
> > +               goto out;
> > +
> > +       acl_name = posix_acl_xattr_name(type);
> 
> My bad, but this really deserves a comment:  /* If ACL is to be
> removed from a lower file, check if it exists in the first place
> before copying it up */

Ok, will add.

Re: [PATCH 23/29] ovl: use posix acl api

[Miklos Szeredi]

On Thu, 22 Sept 2022 at 17:18, Christian Brauner <brauner@kernel.org> wrote:
>
> Now that posix acls have a proper api us it to copy them.
>
> All filesystems that can serve as lower or upper layers for overlayfs
> have gained support for the new posix acl api in previous patches.
> So switch all internal overlayfs codepaths for copying posix acls to the
> new posix acl api.
>
> Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org>
> ---
>  fs/overlayfs/copy_up.c   |  9 +++++++++
>  fs/overlayfs/dir.c       | 20 ++-----------------
>  fs/overlayfs/inode.c     |  4 ++--
>  fs/overlayfs/overlayfs.h |  9 +++++++++
>  fs/overlayfs/super.c     |  6 ++----
>  fs/overlayfs/util.c      | 42 ++++++++++++++++++++++++++++++++++++++++
>  fs/xattr.c               |  6 ------
>  include/linux/xattr.h    |  6 ++++++
>  8 files changed, 72 insertions(+), 30 deletions(-)
>
> diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
> index fdde6c56cc3d..93e575021ca1 100644
> --- a/fs/overlayfs/copy_up.c
> +++ b/fs/overlayfs/copy_up.c
> @@ -93,6 +93,15 @@ int ovl_copy_xattr(struct super_block *sb, struct path *oldpath, struct dentry *
>                         error = 0;
>                         continue; /* Discard */
>                 }
> +
> +               if (is_posix_acl_xattr(name)) {
> +                       error = ovl_copy_acl(OVL_FS(sb), oldpath, new, name);
> +                       if (!error)
> +                               continue;
> +                       /* POSIX ACLs must be copied. */
> +                       break;
> +               }
> +
>  retry:
>                 size = ovl_do_getxattr(oldpath, name, value, value_size);
>                 if (size == -ERANGE)
> diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
> index 0e817ebce92c..cbb569d5d234 100644
> --- a/fs/overlayfs/dir.c
> +++ b/fs/overlayfs/dir.c
> @@ -435,28 +435,12 @@ static struct dentry *ovl_clear_empty(struct dentry *dentry,
>  }
>
>  static int ovl_set_upper_acl(struct ovl_fs *ofs, struct dentry *upperdentry,
> -                            const char *name, const struct posix_acl *acl)
> +                            const char *acl_name, struct posix_acl *acl)
>  {
> -       void *buffer;
> -       size_t size;
> -       int err;
> -
>         if (!IS_ENABLED(CONFIG_FS_POSIX_ACL) || !acl)
>                 return 0;
>
> -       size = posix_acl_xattr_size(acl->a_count);
> -       buffer = kmalloc(size, GFP_KERNEL);
> -       if (!buffer)
> -               return -ENOMEM;
> -
> -       err = posix_acl_to_xattr(&init_user_ns, acl, buffer, size);
> -       if (err < 0)
> -               goto out_free;
> -
> -       err = ovl_do_setxattr(ofs, upperdentry, name, buffer, size, XATTR_CREATE);
> -out_free:
> -       kfree(buffer);
> -       return err;
> +       return ovl_do_set_acl(ofs, upperdentry, acl_name, acl);
>  }
>
>  static int ovl_create_over_whiteout(struct dentry *dentry, struct inode *inode,
> diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
> index b0a19f9deaf1..c6cb62daa8c2 100644
> --- a/fs/overlayfs/inode.c
> +++ b/fs/overlayfs/inode.c
> @@ -550,8 +550,8 @@ struct posix_acl *ovl_get_inode_acl(struct inode *inode, int type, bool rcu)
>         return clone;
>  }
>
> -static struct posix_acl *ovl_get_acl_path(const struct path *path,
> -                                         const char *acl_name)
> +struct posix_acl *ovl_get_acl_path(const struct path *path,
> +                                  const char *acl_name)
>  {
>         struct posix_acl *real_acl, *clone;
>         struct user_namespace *mnt_userns;
> diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
> index b2645baeba2f..3528e5631cb2 100644
> --- a/fs/overlayfs/overlayfs.h
> +++ b/fs/overlayfs/overlayfs.h
> @@ -436,6 +436,8 @@ static inline bool ovl_check_origin_xattr(struct ovl_fs *ofs,
>  int ovl_check_setxattr(struct ovl_fs *ofs, struct dentry *upperdentry,
>                        enum ovl_xattr ox, const void *value, size_t size,
>                        int xerr);
> +int ovl_copy_acl(struct ovl_fs *ofs, const struct path *path,
> +                struct dentry *dentry, const char *acl_name);
>  int ovl_set_impure(struct dentry *dentry, struct dentry *upperdentry);
>  bool ovl_inuse_trylock(struct dentry *dentry);
>  void ovl_inuse_unlock(struct dentry *dentry);
> @@ -614,10 +616,17 @@ int ovl_set_acl(struct user_namespace *mnt_userns, struct dentry *dentry,
>  void ovl_idmap_posix_acl(struct inode *realinode,
>                          struct user_namespace *mnt_userns,
>                          struct posix_acl *acl);
> +struct posix_acl *ovl_get_acl_path(const struct path *path,
> +                                  const char *acl_name);
>  #else
>  #define ovl_get_inode_acl      NULL
>  #define ovl_get_acl            NULL
>  #define ovl_set_acl            NULL
> +static inline struct posix_acl *ovl_get_acl_path(const struct path *path,
> +                                                const char *acl_name)
> +{
> +       return NULL;
> +}
>  #endif
>
>  int ovl_update_time(struct inode *inode, struct timespec64 *ts, int flags);
> diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
> index 5da771b218d1..8a13319db1d3 100644
> --- a/fs/overlayfs/super.c
> +++ b/fs/overlayfs/super.c
> @@ -812,13 +812,11 @@ static struct dentry *ovl_workdir_create(struct ovl_fs *ofs,
>                  * allowed as upper are limited to "normal" ones, where checking
>                  * for the above two errors is sufficient.
>                  */
> -               err = ovl_do_removexattr(ofs, work,
> -                                        XATTR_NAME_POSIX_ACL_DEFAULT);
> +               err = ovl_do_remove_acl(ofs, work, XATTR_NAME_POSIX_ACL_DEFAULT);
>                 if (err && err != -ENODATA && err != -EOPNOTSUPP)
>                         goto out_dput;
>
> -               err = ovl_do_removexattr(ofs, work,
> -                                        XATTR_NAME_POSIX_ACL_ACCESS);
> +               err = ovl_do_remove_acl(ofs, work, XATTR_NAME_POSIX_ACL_ACCESS);
>                 if (err && err != -ENODATA && err != -EOPNOTSUPP)
>                         goto out_dput;
>
> diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c
> index 87f811c089e4..0246babce4d2 100644
> --- a/fs/overlayfs/util.c
> +++ b/fs/overlayfs/util.c
> @@ -1117,3 +1117,45 @@ void ovl_copyattr(struct inode *inode)
>         inode->i_ctime = realinode->i_ctime;
>         i_size_write(inode, i_size_read(realinode));
>  }
> +
> +int ovl_copy_acl(struct ovl_fs *ofs, const struct path *path,
> +                struct dentry *dentry, const char *acl_name)

The only caller is in copy_up.c, why move to util.c?


> +{
> +       int err;
> +       struct posix_acl *real_acl = NULL;
> +
> +       real_acl = ovl_get_acl_path(path, acl_name);
> +       if (!real_acl)
> +               return 0;

This looks subtle.  The acl is converted back and forth between
various mnt_userns representations, and I don't quite follow why this
should result in the same thing as if the raw xattr was copied.
Will it?  Can this be made less subtle?

> +
> +       if (IS_ERR(real_acl)) {
> +               err = PTR_ERR(real_acl);
> +               if (err == -ENODATA || err == -EOPNOTSUPP)
> +                       return 0;
> +               return err;
> +       }
> +
> +       /*
> +        * If we didn't have to create a copy already because @path was on an
> +        * idmapped mount we need to do so if the upper layer is so we don't
> +        * alter the POSIX ACLs of the filesystem we retrieved them from.
> +        */

I think we are better off copying  ovl_get_acl_path() and cloning
unconditionally.

> +       if (!is_idmapped_mnt(path->mnt) && is_idmapped_mnt(ovl_upper_mnt(ofs))) {
> +               struct posix_acl *clone;
> +
> +               clone = posix_acl_clone(real_acl, GFP_KERNEL);
> +               if (!clone) {
> +                       err = -ENOMEM;
> +                       goto out;
> +               }
> +               /* release original acl */
> +               posix_acl_release(real_acl);
> +               real_acl = clone;
> +       }
> +
> +       err = ovl_do_set_acl(ofs, dentry, acl_name, real_acl);
> +out:
> +       /* release original or cloned acl */
> +       posix_acl_release(real_acl);
> +       return err;
> +}
> diff --git a/fs/xattr.c b/fs/xattr.c
> index e16d7bde4935..0b9a84921c4d 100644
> --- a/fs/xattr.c
> +++ b/fs/xattr.c
> @@ -281,12 +281,6 @@ __vfs_setxattr_locked(struct user_namespace *mnt_userns, struct dentry *dentry,
>  }
>  EXPORT_SYMBOL_GPL(__vfs_setxattr_locked);
>
> -static inline bool is_posix_acl_xattr(const char *name)
> -{
> -       return (strcmp(name, XATTR_NAME_POSIX_ACL_ACCESS) == 0) ||
> -              (strcmp(name, XATTR_NAME_POSIX_ACL_DEFAULT) == 0);
> -}
> -
>  int
>  vfs_setxattr(struct user_namespace *mnt_userns, struct dentry *dentry,
>              const char *name, const void *value, size_t size, int flags)
> diff --git a/include/linux/xattr.h b/include/linux/xattr.h
> index 8267e547e631..d44d59177026 100644
> --- a/include/linux/xattr.h
> +++ b/include/linux/xattr.h
> @@ -22,6 +22,12 @@
>  struct inode;
>  struct dentry;
>
> +static inline bool is_posix_acl_xattr(const char *name)
> +{
> +       return (strcmp(name, XATTR_NAME_POSIX_ACL_ACCESS) == 0) ||
> +              (strcmp(name, XATTR_NAME_POSIX_ACL_DEFAULT) == 0);
> +}
> +
>  /*
>   * struct xattr_handler: When @name is set, match attributes with exactly that
>   * name.  When @prefix is set instead, match attributes with that prefix and
> --
> 2.34.1
>

Re: [PATCH 23/29] ovl: use posix acl api

[Christian Brauner]

On Fri, Sep 23, 2022 at 05:38:34PM +0200, Miklos Szeredi wrote:
> On Thu, 22 Sept 2022 at 17:18, Christian Brauner <brauner@kernel.org> wrote:
> >
> > Now that posix acls have a proper api us it to copy them.
> >
> > All filesystems that can serve as lower or upper layers for overlayfs
> > have gained support for the new posix acl api in previous patches.
> > So switch all internal overlayfs codepaths for copying posix acls to the
> > new posix acl api.
> >
> > Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org>
> > ---
> >  fs/overlayfs/copy_up.c   |  9 +++++++++
> >  fs/overlayfs/dir.c       | 20 ++-----------------
> >  fs/overlayfs/inode.c     |  4 ++--
> >  fs/overlayfs/overlayfs.h |  9 +++++++++
> >  fs/overlayfs/super.c     |  6 ++----
> >  fs/overlayfs/util.c      | 42 ++++++++++++++++++++++++++++++++++++++++
> >  fs/xattr.c               |  6 ------
> >  include/linux/xattr.h    |  6 ++++++
> >  8 files changed, 72 insertions(+), 30 deletions(-)
> >
> > diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
> > index fdde6c56cc3d..93e575021ca1 100644
> > --- a/fs/overlayfs/copy_up.c
> > +++ b/fs/overlayfs/copy_up.c
> > @@ -93,6 +93,15 @@ int ovl_copy_xattr(struct super_block *sb, struct path *oldpath, struct dentry *
> >                         error = 0;
> >                         continue; /* Discard */
> >                 }
> > +
> > +               if (is_posix_acl_xattr(name)) {
> > +                       error = ovl_copy_acl(OVL_FS(sb), oldpath, new, name);
> > +                       if (!error)
> > +                               continue;
> > +                       /* POSIX ACLs must be copied. */
> > +                       break;
> > +               }
> > +
> >  retry:
> >                 size = ovl_do_getxattr(oldpath, name, value, value_size);
> >                 if (size == -ERANGE)
> > diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
> > index 0e817ebce92c..cbb569d5d234 100644
> > --- a/fs/overlayfs/dir.c
> > +++ b/fs/overlayfs/dir.c
> > @@ -435,28 +435,12 @@ static struct dentry *ovl_clear_empty(struct dentry *dentry,
> >  }
> >
> >  static int ovl_set_upper_acl(struct ovl_fs *ofs, struct dentry *upperdentry,
> > -                            const char *name, const struct posix_acl *acl)
> > +                            const char *acl_name, struct posix_acl *acl)
> >  {
> > -       void *buffer;
> > -       size_t size;
> > -       int err;
> > -
> >         if (!IS_ENABLED(CONFIG_FS_POSIX_ACL) || !acl)
> >                 return 0;
> >
> > -       size = posix_acl_xattr_size(acl->a_count);
> > -       buffer = kmalloc(size, GFP_KERNEL);
> > -       if (!buffer)
> > -               return -ENOMEM;
> > -
> > -       err = posix_acl_to_xattr(&init_user_ns, acl, buffer, size);
> > -       if (err < 0)
> > -               goto out_free;
> > -
> > -       err = ovl_do_setxattr(ofs, upperdentry, name, buffer, size, XATTR_CREATE);
> > -out_free:
> > -       kfree(buffer);
> > -       return err;
> > +       return ovl_do_set_acl(ofs, upperdentry, acl_name, acl);
> >  }
> >
> >  static int ovl_create_over_whiteout(struct dentry *dentry, struct inode *inode,
> > diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
> > index b0a19f9deaf1..c6cb62daa8c2 100644
> > --- a/fs/overlayfs/inode.c
> > +++ b/fs/overlayfs/inode.c
> > @@ -550,8 +550,8 @@ struct posix_acl *ovl_get_inode_acl(struct inode *inode, int type, bool rcu)
> >         return clone;
> >  }
> >
> > -static struct posix_acl *ovl_get_acl_path(const struct path *path,
> > -                                         const char *acl_name)
> > +struct posix_acl *ovl_get_acl_path(const struct path *path,
> > +                                  const char *acl_name)
> >  {
> >         struct posix_acl *real_acl, *clone;
> >         struct user_namespace *mnt_userns;
> > diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
> > index b2645baeba2f..3528e5631cb2 100644
> > --- a/fs/overlayfs/overlayfs.h
> > +++ b/fs/overlayfs/overlayfs.h
> > @@ -436,6 +436,8 @@ static inline bool ovl_check_origin_xattr(struct ovl_fs *ofs,
> >  int ovl_check_setxattr(struct ovl_fs *ofs, struct dentry *upperdentry,
> >                        enum ovl_xattr ox, const void *value, size_t size,
> >                        int xerr);
> > +int ovl_copy_acl(struct ovl_fs *ofs, const struct path *path,
> > +                struct dentry *dentry, const char *acl_name);
> >  int ovl_set_impure(struct dentry *dentry, struct dentry *upperdentry);
> >  bool ovl_inuse_trylock(struct dentry *dentry);
> >  void ovl_inuse_unlock(struct dentry *dentry);
> > @@ -614,10 +616,17 @@ int ovl_set_acl(struct user_namespace *mnt_userns, struct dentry *dentry,
> >  void ovl_idmap_posix_acl(struct inode *realinode,
> >                          struct user_namespace *mnt_userns,
> >                          struct posix_acl *acl);
> > +struct posix_acl *ovl_get_acl_path(const struct path *path,
> > +                                  const char *acl_name);
> >  #else
> >  #define ovl_get_inode_acl      NULL
> >  #define ovl_get_acl            NULL
> >  #define ovl_set_acl            NULL
> > +static inline struct posix_acl *ovl_get_acl_path(const struct path *path,
> > +                                                const char *acl_name)
> > +{
> > +       return NULL;
> > +}
> >  #endif
> >
> >  int ovl_update_time(struct inode *inode, struct timespec64 *ts, int flags);
> > diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
> > index 5da771b218d1..8a13319db1d3 100644
> > --- a/fs/overlayfs/super.c
> > +++ b/fs/overlayfs/super.c
> > @@ -812,13 +812,11 @@ static struct dentry *ovl_workdir_create(struct ovl_fs *ofs,
> >                  * allowed as upper are limited to "normal" ones, where checking
> >                  * for the above two errors is sufficient.
> >                  */
> > -               err = ovl_do_removexattr(ofs, work,
> > -                                        XATTR_NAME_POSIX_ACL_DEFAULT);
> > +               err = ovl_do_remove_acl(ofs, work, XATTR_NAME_POSIX_ACL_DEFAULT);
> >                 if (err && err != -ENODATA && err != -EOPNOTSUPP)
> >                         goto out_dput;
> >
> > -               err = ovl_do_removexattr(ofs, work,
> > -                                        XATTR_NAME_POSIX_ACL_ACCESS);
> > +               err = ovl_do_remove_acl(ofs, work, XATTR_NAME_POSIX_ACL_ACCESS);
> >                 if (err && err != -ENODATA && err != -EOPNOTSUPP)
> >                         goto out_dput;
> >
> > diff --git a/fs/overlayfs/util.c b/fs/overlayfs/util.c
> > index 87f811c089e4..0246babce4d2 100644
> > --- a/fs/overlayfs/util.c
> > +++ b/fs/overlayfs/util.c
> > @@ -1117,3 +1117,45 @@ void ovl_copyattr(struct inode *inode)
> >         inode->i_ctime = realinode->i_ctime;
> >         i_size_write(inode, i_size_read(realinode));
> >  }
> > +
> > +int ovl_copy_acl(struct ovl_fs *ofs, const struct path *path,
> > +                struct dentry *dentry, const char *acl_name)
> 
> The only caller is in copy_up.c, why move to util.c?

Ok, I'll leave this in util.c

> 
> 
> > +{
> > +       int err;
> > +       struct posix_acl *real_acl = NULL;
> > +
> > +       real_acl = ovl_get_acl_path(path, acl_name);
> > +       if (!real_acl)
> > +               return 0;
> 
> This looks subtle.  The acl is converted back and forth between
> various mnt_userns representations, and I don't quite follow why this
> should result in the same thing as if the raw xattr was copied.
> Will it?  Can this be made less subtle?

It's basically just like when you copy a file betweed idmapped mounts:

mount -o X-mount.idmap=<mapping1> --bind /source /source-idmapped
mount -o X-mount.idmap=<mapping2> --bind /target /target-idmapped

cp /source-idmapped/file1 /target-idmapped

where you need to take the source and target idmappings into account.

So basically like what ovl_set_attr() is doing just for acls. But I
think your proposal below will make this way less subtle.

> 
> > +
> > +       if (IS_ERR(real_acl)) {
> > +               err = PTR_ERR(real_acl);
> > +               if (err == -ENODATA || err == -EOPNOTSUPP)
> > +                       return 0;
> > +               return err;
> > +       }
> > +
> > +       /*
> > +        * If we didn't have to create a copy already because @path was on an
> > +        * idmapped mount we need to do so if the upper layer is so we don't
> > +        * alter the POSIX ACLs of the filesystem we retrieved them from.
> > +        */
> 
> I think we are better off copying  ovl_get_acl_path() and cloning
> unconditionally.

Ok, sure.

Re: [PATCH 23/29] ovl: use posix acl api

[Miklos Szeredi]

On Fri, 23 Sept 2022 at 17:47, Christian Brauner <brauner@kernel.org> wrote:
>
> On Fri, Sep 23, 2022 at 05:38:34PM +0200, Miklos Szeredi wrote:

> It's basically just like when you copy a file betweed idmapped mounts:
>
> mount -o X-mount.idmap=<mapping1> --bind /source /source-idmapped
> mount -o X-mount.idmap=<mapping2> --bind /target /target-idmapped
>
> cp /source-idmapped/file1 /target-idmapped
>
> where you need to take the source and target idmappings into account.
>
> So basically like what ovl_set_attr() is doing just for acls. But I

But then before this patch the copy-up behavior was incorrect, right?

In that case this needs to be advertised as a bug fix, rather than a cleanup.

Thanks,
Miklos

Re: [PATCH 23/29] ovl: use posix acl api

[Christian Brauner]

On Fri, Sep 23, 2022 at 05:57:04PM +0200, Miklos Szeredi wrote:
> On Fri, 23 Sept 2022 at 17:47, Christian Brauner <brauner@kernel.org> wrote:
> >
> > On Fri, Sep 23, 2022 at 05:38:34PM +0200, Miklos Szeredi wrote:
> 
> > It's basically just like when you copy a file betweed idmapped mounts:
> >
> > mount -o X-mount.idmap=<mapping1> --bind /source /source-idmapped
> > mount -o X-mount.idmap=<mapping2> --bind /target /target-idmapped
> >
> > cp /source-idmapped/file1 /target-idmapped
> >
> > where you need to take the source and target idmappings into account.
> >
> > So basically like what ovl_set_attr() is doing just for acls. But I
> 
> But then before this patch the copy-up behavior was incorrect, right?
> 
> In that case this needs to be advertised as a bug fix, rather than a cleanup.

No, it was correct. The testsuite I added would've yelled loudly if that
were buggy.

It's just that this was done in vfs_getxattr() before. But that is
rather hacky and is one of the things we're getting rid off. If
vfs_get_acl() did that it would return mount not filesystem values which
isn't correct for the general case.