From: Andreas Gruenbacher <andreas.gruenbacher@gmail.com> To: Alexander Viro <viro@zeniv.linux.org.uk>, "Theodore Ts'o" <tytso@mit.edu>, Andreas Dilger <adilger.kernel@dilger.ca>, "J. Bruce Fields" <bfields@fieldses.org>, Jeff Layton <jlayton@poochiereds.net>, Trond Myklebust <trond.myklebust@primarydata.com>, Anna Schumaker <anna.schumaker@netapp.com>, Dave Chinner <david@fromorbit.com>, linux-ext4@vger.kernel.org, xfs@oss.sgi.com, linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-nfs@vger.kernel.org, linux-cifs@vger.kernel.org, linux-api@vger.kernel.org Cc: Andreas Gruenbacher <agruenba@redhat.com> Subject: [PATCH v10 37/46] nfsd: Add support for the MAY_CREATE_{FILE, DIR} permissions Date: Mon, 12 Oct 2015 00:58:48 +0200 [thread overview] Message-ID: <1444604337-17651-38-git-send-email-andreas.gruenbacher@gmail.com> (raw) In-Reply-To: <1444604337-17651-1-git-send-email-andreas.gruenbacher@gmail.com> From: Andreas Gruenbacher <agruenba@redhat.com> For local file systems, the vfs performs the necessary permission checks for operations like creating files and directories. NFSd duplicates several of those checks. The vfs checks have been extended to check for additional permissions like MAY_CREATE_FILE and MY_CREATE_DIR; the nfsd checks currently lack those extensions. Ideally, all duplicate checks should be removed; for now, just fix the duplicate checks instead though. Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com> Acked-by: J. Bruce Fields <bfields@redhat.com> --- fs/nfsd/nfs4proc.c | 5 +++-- fs/nfsd/nfsfh.c | 8 ++++---- fs/nfsd/vfs.c | 28 ++++++++++++++++++++-------- fs/nfsd/vfs.h | 17 +++++++++-------- 4 files changed, 36 insertions(+), 22 deletions(-) diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index a053e78..8d476ff 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -599,14 +599,15 @@ static __be32 nfsd4_create(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct nfsd4_create *create) { + int access = create->cr_type == NF4DIR ? + NFSD_MAY_CREATE_DIR : NFSD_MAY_CREATE_FILE; struct svc_fh resfh; __be32 status; dev_t rdev; fh_init(&resfh, NFS4_FHSIZE); - status = fh_verify(rqstp, &cstate->current_fh, S_IFDIR, - NFSD_MAY_CREATE); + status = fh_verify(rqstp, &cstate->current_fh, S_IFDIR, access); if (status) return status; diff --git a/fs/nfsd/nfsfh.c b/fs/nfsd/nfsfh.c index 350041a..7159316 100644 --- a/fs/nfsd/nfsfh.c +++ b/fs/nfsd/nfsfh.c @@ -319,10 +319,10 @@ fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, umode_t type, int access) /* * We still have to do all these permission checks, even when * fh_dentry is already set: - * - fh_verify may be called multiple times with different - * "access" arguments (e.g. nfsd_proc_create calls - * fh_verify(...,NFSD_MAY_EXEC) first, then later (in - * nfsd_create) calls fh_verify(...,NFSD_MAY_CREATE). + * - fh_verify may be called multiple times with different + * "access" arguments (e.g. nfsd_proc_create calls + * fh_verify(...,NFSD_MAY_EXEC) first, then later (in + * nfsd_create) calls fh_verify(...,NFSD_MAY_CREATE_FILE). * - in the NFSv4 case, the filehandle may have been filled * in by fh_compose, and given a dentry, but further * compound operations performed with that filehandle diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c index 45c0497..fb35775 100644 --- a/fs/nfsd/vfs.c +++ b/fs/nfsd/vfs.c @@ -1128,6 +1128,8 @@ nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp, __be32 err; __be32 err2; int host_err; + int access = (type == S_IFDIR) ? + NFSD_MAY_CREATE_DIR : NFSD_MAY_CREATE_FILE; err = nfserr_perm; if (!flen) @@ -1136,7 +1138,7 @@ nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp, if (isdotent(fname, flen)) goto out; - err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE); + err = fh_verify(rqstp, fhp, S_IFDIR, access); if (err) goto out; @@ -1301,7 +1303,7 @@ do_nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp, /* If file doesn't exist, check for permissions to create one */ if (d_really_is_negative(dchild)) { - err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE); + err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE_FILE); if (err) goto out; } @@ -1485,7 +1487,7 @@ nfsd_symlink(struct svc_rqst *rqstp, struct svc_fh *fhp, if (isdotent(fname, flen)) goto out; - err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE); + err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE_FILE); if (err) goto out; @@ -1532,7 +1534,7 @@ nfsd_link(struct svc_rqst *rqstp, struct svc_fh *ffhp, __be32 err; int host_err; - err = fh_verify(rqstp, ffhp, S_IFDIR, NFSD_MAY_CREATE); + err = fh_verify(rqstp, ffhp, S_IFDIR, NFSD_MAY_CREATE_FILE); if (err) goto out; err = fh_verify(rqstp, tfhp, 0, NFSD_MAY_NOP); @@ -1604,11 +1606,12 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen, struct inode *fdir, *tdir; __be32 err; int host_err; + int access; err = fh_verify(rqstp, ffhp, S_IFDIR, NFSD_MAY_REMOVE); if (err) goto out; - err = fh_verify(rqstp, tfhp, S_IFDIR, NFSD_MAY_CREATE); + err = fh_verify(rqstp, tfhp, S_IFDIR, NFSD_MAY_NOP); if (err) goto out; @@ -1647,6 +1650,13 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen, if (odentry == trap) goto out_dput_old; + host_err = 0; + access = S_ISDIR(d_inode(odentry)->i_mode) ? + NFSD_MAY_CREATE_DIR : NFSD_MAY_CREATE_FILE; + err = fh_verify(rqstp, tfhp, S_IFDIR, access); + if (err) + goto out_dput_old; + ndentry = lookup_one_len(tname, tdentry, tlen); host_err = PTR_ERR(ndentry); if (IS_ERR(ndentry)) @@ -1672,7 +1682,8 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen, out_dput_old: dput(odentry); out_nfserr: - err = nfserrno(host_err); + if (host_err) + err = nfserrno(host_err); /* * We cannot rely on fh_unlock on the two filehandles, * as that would do the wrong thing if the two directories @@ -2005,8 +2016,9 @@ nfsd_permission(struct svc_rqst *rqstp, struct svc_export *exp, uid_eq(inode->i_uid, current_fsuid())) return 0; - /* This assumes NFSD_MAY_{READ,WRITE,EXEC} == MAY_{READ,WRITE,EXEC} */ - err = inode_permission(inode, acc & (MAY_READ|MAY_WRITE|MAY_EXEC)); + /* This assumes NFSD_MAY_{READ,WRITE,EXEC} == MAY_{READ,WRITE,EXEC}. */ + err = inode_permission(inode, acc & (MAY_READ|MAY_WRITE|MAY_EXEC| + MAY_CREATE_DIR|MAY_CREATE_FILE)); /* Allow read access to binaries even when mode 111 */ if (err == -EACCES && S_ISREG(inode->i_mode) && diff --git a/fs/nfsd/vfs.h b/fs/nfsd/vfs.h index fee2451..c849ef2 100644 --- a/fs/nfsd/vfs.h +++ b/fs/nfsd/vfs.h @@ -19,18 +19,19 @@ #define NFSD_MAY_TRUNC 0x010 #define NFSD_MAY_LOCK 0x020 #define NFSD_MAY_MASK 0x03f +#define NFSD_MAY_CREATE_FILE 0x103 /* == MAY_{EXEC|WRITE|CREATE_FILE} */ +#define NFSD_MAY_CREATE_DIR 0x203 /* == MAY_{EXEC|WRITE|CREATE_DIR} */ /* extra hints to permission and open routines: */ -#define NFSD_MAY_OWNER_OVERRIDE 0x040 -#define NFSD_MAY_LOCAL_ACCESS 0x080 /* for device special files */ -#define NFSD_MAY_BYPASS_GSS_ON_ROOT 0x100 -#define NFSD_MAY_NOT_BREAK_LEASE 0x200 -#define NFSD_MAY_BYPASS_GSS 0x400 -#define NFSD_MAY_READ_IF_EXEC 0x800 +#define NFSD_MAY_OWNER_OVERRIDE 0x04000 +#define NFSD_MAY_LOCAL_ACCESS 0x08000 /* for device special files */ +#define NFSD_MAY_BYPASS_GSS_ON_ROOT 0x10000 +#define NFSD_MAY_NOT_BREAK_LEASE 0x20000 +#define NFSD_MAY_BYPASS_GSS 0x40000 +#define NFSD_MAY_READ_IF_EXEC 0x80000 -#define NFSD_MAY_64BIT_COOKIE 0x1000 /* 64 bit readdir cookies for >= NFSv3 */ +#define NFSD_MAY_64BIT_COOKIE 0x100000 /* 64 bit readdir cookies for >= NFSv3 */ -#define NFSD_MAY_CREATE (NFSD_MAY_EXEC|NFSD_MAY_WRITE) #define NFSD_MAY_REMOVE (NFSD_MAY_EXEC|NFSD_MAY_WRITE|NFSD_MAY_TRUNC) /* -- 2.5.0 _______________________________________________ xfs mailing list xfs@oss.sgi.com http://oss.sgi.com/mailman/listinfo/xfs
WARNING: multiple messages have this Message-ID (diff)
From: Andreas Gruenbacher <andreas.gruenbacher@gmail.com> To: Alexander Viro <viro@zeniv.linux.org.uk>, "Theodore Ts'o" <tytso@mit.edu>, Andreas Dilger <adilger.kernel@dilger.ca>, "J. Bruce Fields" <bfields@fieldses.org>, Jeff Layton <jlayton@poochiereds.net>, Trond Myklebust <trond.myklebust@primarydata.com>, Anna Schumaker <anna.schumaker@netapp.com>, Dave Chinner <david@fromorbit.com>, linux-ext4@vger.kernel.org, xfs@oss.sgi.com, linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-nfs@vger.kernel.org, linux-cifs@vger.kernel.org, linux-api@vger.kernel.org Cc: Andreas Gruenbacher <agruenba@redhat.com> Subject: [PATCH v10 37/46] nfsd: Add support for the MAY_CREATE_{FILE,DIR} permissions Date: Mon, 12 Oct 2015 00:58:48 +0200 [thread overview] Message-ID: <1444604337-17651-38-git-send-email-andreas.gruenbacher@gmail.com> (raw) In-Reply-To: <1444604337-17651-1-git-send-email-andreas.gruenbacher@gmail.com> From: Andreas Gruenbacher <agruenba@redhat.com> For local file systems, the vfs performs the necessary permission checks for operations like creating files and directories. NFSd duplicates several of those checks. The vfs checks have been extended to check for additional permissions like MAY_CREATE_FILE and MY_CREATE_DIR; the nfsd checks currently lack those extensions. Ideally, all duplicate checks should be removed; for now, just fix the duplicate checks instead though. Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com> Acked-by: J. Bruce Fields <bfields@redhat.com> --- fs/nfsd/nfs4proc.c | 5 +++-- fs/nfsd/nfsfh.c | 8 ++++---- fs/nfsd/vfs.c | 28 ++++++++++++++++++++-------- fs/nfsd/vfs.h | 17 +++++++++-------- 4 files changed, 36 insertions(+), 22 deletions(-) diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index a053e78..8d476ff 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -599,14 +599,15 @@ static __be32 nfsd4_create(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct nfsd4_create *create) { + int access = create->cr_type == NF4DIR ? + NFSD_MAY_CREATE_DIR : NFSD_MAY_CREATE_FILE; struct svc_fh resfh; __be32 status; dev_t rdev; fh_init(&resfh, NFS4_FHSIZE); - status = fh_verify(rqstp, &cstate->current_fh, S_IFDIR, - NFSD_MAY_CREATE); + status = fh_verify(rqstp, &cstate->current_fh, S_IFDIR, access); if (status) return status; diff --git a/fs/nfsd/nfsfh.c b/fs/nfsd/nfsfh.c index 350041a..7159316 100644 --- a/fs/nfsd/nfsfh.c +++ b/fs/nfsd/nfsfh.c @@ -319,10 +319,10 @@ fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, umode_t type, int access) /* * We still have to do all these permission checks, even when * fh_dentry is already set: - * - fh_verify may be called multiple times with different - * "access" arguments (e.g. nfsd_proc_create calls - * fh_verify(...,NFSD_MAY_EXEC) first, then later (in - * nfsd_create) calls fh_verify(...,NFSD_MAY_CREATE). + * - fh_verify may be called multiple times with different + * "access" arguments (e.g. nfsd_proc_create calls + * fh_verify(...,NFSD_MAY_EXEC) first, then later (in + * nfsd_create) calls fh_verify(...,NFSD_MAY_CREATE_FILE). * - in the NFSv4 case, the filehandle may have been filled * in by fh_compose, and given a dentry, but further * compound operations performed with that filehandle diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c index 45c0497..fb35775 100644 --- a/fs/nfsd/vfs.c +++ b/fs/nfsd/vfs.c @@ -1128,6 +1128,8 @@ nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp, __be32 err; __be32 err2; int host_err; + int access = (type == S_IFDIR) ? + NFSD_MAY_CREATE_DIR : NFSD_MAY_CREATE_FILE; err = nfserr_perm; if (!flen) @@ -1136,7 +1138,7 @@ nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp, if (isdotent(fname, flen)) goto out; - err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE); + err = fh_verify(rqstp, fhp, S_IFDIR, access); if (err) goto out; @@ -1301,7 +1303,7 @@ do_nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp, /* If file doesn't exist, check for permissions to create one */ if (d_really_is_negative(dchild)) { - err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE); + err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE_FILE); if (err) goto out; } @@ -1485,7 +1487,7 @@ nfsd_symlink(struct svc_rqst *rqstp, struct svc_fh *fhp, if (isdotent(fname, flen)) goto out; - err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE); + err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE_FILE); if (err) goto out; @@ -1532,7 +1534,7 @@ nfsd_link(struct svc_rqst *rqstp, struct svc_fh *ffhp, __be32 err; int host_err; - err = fh_verify(rqstp, ffhp, S_IFDIR, NFSD_MAY_CREATE); + err = fh_verify(rqstp, ffhp, S_IFDIR, NFSD_MAY_CREATE_FILE); if (err) goto out; err = fh_verify(rqstp, tfhp, 0, NFSD_MAY_NOP); @@ -1604,11 +1606,12 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen, struct inode *fdir, *tdir; __be32 err; int host_err; + int access; err = fh_verify(rqstp, ffhp, S_IFDIR, NFSD_MAY_REMOVE); if (err) goto out; - err = fh_verify(rqstp, tfhp, S_IFDIR, NFSD_MAY_CREATE); + err = fh_verify(rqstp, tfhp, S_IFDIR, NFSD_MAY_NOP); if (err) goto out; @@ -1647,6 +1650,13 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen, if (odentry == trap) goto out_dput_old; + host_err = 0; + access = S_ISDIR(d_inode(odentry)->i_mode) ? + NFSD_MAY_CREATE_DIR : NFSD_MAY_CREATE_FILE; + err = fh_verify(rqstp, tfhp, S_IFDIR, access); + if (err) + goto out_dput_old; + ndentry = lookup_one_len(tname, tdentry, tlen); host_err = PTR_ERR(ndentry); if (IS_ERR(ndentry)) @@ -1672,7 +1682,8 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen, out_dput_old: dput(odentry); out_nfserr: - err = nfserrno(host_err); + if (host_err) + err = nfserrno(host_err); /* * We cannot rely on fh_unlock on the two filehandles, * as that would do the wrong thing if the two directories @@ -2005,8 +2016,9 @@ nfsd_permission(struct svc_rqst *rqstp, struct svc_export *exp, uid_eq(inode->i_uid, current_fsuid())) return 0; - /* This assumes NFSD_MAY_{READ,WRITE,EXEC} == MAY_{READ,WRITE,EXEC} */ - err = inode_permission(inode, acc & (MAY_READ|MAY_WRITE|MAY_EXEC)); + /* This assumes NFSD_MAY_{READ,WRITE,EXEC} == MAY_{READ,WRITE,EXEC}. */ + err = inode_permission(inode, acc & (MAY_READ|MAY_WRITE|MAY_EXEC| + MAY_CREATE_DIR|MAY_CREATE_FILE)); /* Allow read access to binaries even when mode 111 */ if (err == -EACCES && S_ISREG(inode->i_mode) && diff --git a/fs/nfsd/vfs.h b/fs/nfsd/vfs.h index fee2451..c849ef2 100644 --- a/fs/nfsd/vfs.h +++ b/fs/nfsd/vfs.h @@ -19,18 +19,19 @@ #define NFSD_MAY_TRUNC 0x010 #define NFSD_MAY_LOCK 0x020 #define NFSD_MAY_MASK 0x03f +#define NFSD_MAY_CREATE_FILE 0x103 /* == MAY_{EXEC|WRITE|CREATE_FILE} */ +#define NFSD_MAY_CREATE_DIR 0x203 /* == MAY_{EXEC|WRITE|CREATE_DIR} */ /* extra hints to permission and open routines: */ -#define NFSD_MAY_OWNER_OVERRIDE 0x040 -#define NFSD_MAY_LOCAL_ACCESS 0x080 /* for device special files */ -#define NFSD_MAY_BYPASS_GSS_ON_ROOT 0x100 -#define NFSD_MAY_NOT_BREAK_LEASE 0x200 -#define NFSD_MAY_BYPASS_GSS 0x400 -#define NFSD_MAY_READ_IF_EXEC 0x800 +#define NFSD_MAY_OWNER_OVERRIDE 0x04000 +#define NFSD_MAY_LOCAL_ACCESS 0x08000 /* for device special files */ +#define NFSD_MAY_BYPASS_GSS_ON_ROOT 0x10000 +#define NFSD_MAY_NOT_BREAK_LEASE 0x20000 +#define NFSD_MAY_BYPASS_GSS 0x40000 +#define NFSD_MAY_READ_IF_EXEC 0x80000 -#define NFSD_MAY_64BIT_COOKIE 0x1000 /* 64 bit readdir cookies for >= NFSv3 */ +#define NFSD_MAY_64BIT_COOKIE 0x100000 /* 64 bit readdir cookies for >= NFSv3 */ -#define NFSD_MAY_CREATE (NFSD_MAY_EXEC|NFSD_MAY_WRITE) #define NFSD_MAY_REMOVE (NFSD_MAY_EXEC|NFSD_MAY_WRITE|NFSD_MAY_TRUNC) /* -- 2.5.0
next prev parent reply other threads:[~2015-10-11 22:58 UTC|newest] Thread overview: 126+ messages / expand[flat|nested] mbox.gz Atom feed top 2015-10-11 22:58 [PATCH v10 00/46] Richacls Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 01/46] vfs: Add IS_ACL() and IS_RICHACL() tests Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 02/46] vfs: Add MAY_CREATE_FILE and MAY_CREATE_DIR permission flags Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 03/46] vfs: Add MAY_DELETE_SELF and MAY_DELETE_CHILD " Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 04/46] vfs: Make the inode passed to inode_change_ok non-const Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 05/46] vfs: Add permission flags for setting file attributes Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 06/46] richacl: In-memory representation and helper functions Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 07/46] richacl: Permission mapping functions Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 08/46] richacl: Compute maximum file masks from an acl Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 09/46] richacl: Permission check algorithm Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher [not found] ` <1444604337-17651-1-git-send-email-andreas.gruenbacher-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> 2015-10-11 22:58 ` [PATCH v10 10/46] vfs: Cache base_acl objects in inodes Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 11/46] vfs: Add get_richacl and set_richacl inode operations Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 12/46] vfs: Cache richacl in struct inode Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 13/46] richacl: Update the file masks in chmod() Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 14/46] richacl: Check if an acl is equivalent to a file mode Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 15/46] richacl: Create-time inheritance Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 16/46] richacl: Automatic Inheritance Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 17/46] richacl: xattr mapping functions Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 18/46] richacl: Add richacl xattr handler Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 19/46] vfs: Add richacl permission checking Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 20/46] ext4: Add richacl support Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 21/46] ext4: Add richacl feature flag Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 22/46] xfs: Fix error path in xfs_get_acl Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 23/46] xfs: Make xfs_set_mode non-static Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 23:37 ` Dave Chinner 2015-10-11 23:37 ` Dave Chinner 2015-10-11 22:58 ` [PATCH v10 24/46] xfs: Add richacl support Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher [not found] ` <1444604337-17651-25-git-send-email-andreas.gruenbacher-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> 2015-10-12 0:10 ` Dave Chinner 2015-10-12 0:10 ` Dave Chinner 2015-10-12 0:10 ` Dave Chinner 2015-10-12 1:51 ` Andreas Grünbacher 2015-10-12 1:51 ` Andreas Grünbacher 2015-10-12 1:51 ` Andreas Grünbacher [not found] ` <CAHpGcMKeJHDegs2cYKaJdX4Tw43Jp30Nv_2WoSNZfBzGJKu=BQ-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org> 2015-10-12 4:05 ` Dave Chinner 2015-10-12 4:05 ` Dave Chinner 2015-10-12 4:05 ` Dave Chinner 2015-10-12 5:57 ` Andreas Gruenbacher 2015-10-12 5:57 ` Andreas Gruenbacher 2015-10-12 5:57 ` Andreas Gruenbacher [not found] ` <CAHc6FU55eOK4gWH1bhKvoujQ1zkT+we0xcfPUOeWrF_X0XHXZg-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org> 2015-10-13 19:21 ` Austin S Hemmelgarn 2015-10-13 19:21 ` Austin S Hemmelgarn 2015-10-13 19:21 ` Austin S Hemmelgarn 2015-10-13 13:39 ` Andreas Gruenbacher 2015-10-13 13:39 ` Andreas Gruenbacher 2015-10-13 13:39 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 25/46] richacl: acl editing helper functions Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 26/46] richacl: Move everyone@ aces down the acl Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 27/46] richacl: Propagate everyone@ permissions to other aces Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 28/46] richacl: Set the owner permissions to the owner mask Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 29/46] richacl: Set the other permissions to the other mask Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 30/46] richacl: Isolate the owner and group classes Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 31/46] richacl: Apply the file masks to a richacl Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 32/46] richacl: Create richacl from mode values Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 33/46] nfsd: Keep list of acls to dispose of in compoundargs Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 34/46] nfsd: Use richacls as internal acl representation Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 35/46] nfsd: Add richacl support Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 36/46] nfsd: Add support for the v4.1 dacl attribute Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher [this message] 2015-10-11 22:58 ` [PATCH v10 37/46] nfsd: Add support for the MAY_CREATE_{FILE,DIR} permissions Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 38/46] richacl: Add support for unmapped identifiers Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-12 0:22 ` Dave Chinner 2015-10-12 0:22 ` Dave Chinner 2015-10-12 1:53 ` Andreas Grünbacher 2015-10-12 1:53 ` Andreas Grünbacher 2015-10-12 1:53 ` Andreas Grünbacher 2015-10-11 22:58 ` [PATCH v10 39/46] ext4: Don't allow unmapped identifiers in richacls Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 40/46] sunrpc: Allow to demand-allocate pages to encode into Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 41/46] sunrpc: Add xdr_init_encode_pages Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 42/46] nfs: Fix GETATTR bitmap verification Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 43/46] nfs: Remove unused xdr page offsets in getacl/setacl arguments Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 44/46] nfs: Add richacl support Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher [not found] ` <1444604337-17651-45-git-send-email-andreas.gruenbacher-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org> 2015-10-12 14:39 ` Anna Schumaker 2015-10-12 14:39 ` Anna Schumaker 2015-10-12 14:39 ` Anna Schumaker 2015-10-12 14:39 ` Anna Schumaker 2015-10-12 19:49 ` Andreas Gruenbacher 2015-10-12 19:49 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 45/46] nfs: Add support for the v4.1 dacl attribute Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher 2015-10-11 22:58 ` [PATCH v10 46/46] richacl: uapi header split Andreas Gruenbacher 2015-10-11 22:58 ` Andreas Gruenbacher
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=1444604337-17651-38-git-send-email-andreas.gruenbacher@gmail.com \ --to=andreas.gruenbacher@gmail.com \ --cc=adilger.kernel@dilger.ca \ --cc=agruenba@redhat.com \ --cc=anna.schumaker@netapp.com \ --cc=bfields@fieldses.org \ --cc=david@fromorbit.com \ --cc=jlayton@poochiereds.net \ --cc=linux-api@vger.kernel.org \ --cc=linux-cifs@vger.kernel.org \ --cc=linux-ext4@vger.kernel.org \ --cc=linux-fsdevel@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-nfs@vger.kernel.org \ --cc=trond.myklebust@primarydata.com \ --cc=tytso@mit.edu \ --cc=viro@zeniv.linux.org.uk \ --cc=xfs@oss.sgi.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.