Commit | Line | Data |
---|---|---|
b3b94faa DT |
1 | /* |
2 | * Copyright (C) Sistina Software, Inc. 1997-2003 All rights reserved. | |
3a8a9a10 | 3 | * Copyright (C) 2004-2006 Red Hat, Inc. All rights reserved. |
b3b94faa DT |
4 | * |
5 | * This copyrighted material is made available to anyone wishing to use, | |
6 | * modify, copy, or redistribute it subject to the terms and conditions | |
7 | * of the GNU General Public License v.2. | |
8 | */ | |
9 | ||
10 | #include <linux/sched.h> | |
11 | #include <linux/slab.h> | |
12 | #include <linux/spinlock.h> | |
13 | #include <linux/completion.h> | |
14 | #include <linux/buffer_head.h> | |
15 | #include <linux/posix_acl.h> | |
16 | #include <linux/posix_acl_xattr.h> | |
5c676f6d | 17 | #include <linux/gfs2_ondisk.h> |
b3b94faa DT |
18 | |
19 | #include "gfs2.h" | |
5c676f6d SW |
20 | #include "lm_interface.h" |
21 | #include "incore.h" | |
b3b94faa DT |
22 | #include "acl.h" |
23 | #include "eaops.h" | |
24 | #include "eattr.h" | |
25 | #include "glock.h" | |
26 | #include "inode.h" | |
27 | #include "meta_io.h" | |
28 | #include "trans.h" | |
5c676f6d | 29 | #include "util.h" |
b3b94faa DT |
30 | |
31 | #define ACL_ACCESS 1 | |
32 | #define ACL_DEFAULT 0 | |
33 | ||
34 | int gfs2_acl_validate_set(struct gfs2_inode *ip, int access, | |
35 | struct gfs2_ea_request *er, | |
36 | int *remove, mode_t *mode) | |
37 | { | |
38 | struct posix_acl *acl; | |
39 | int error; | |
40 | ||
41 | error = gfs2_acl_validate_remove(ip, access); | |
42 | if (error) | |
43 | return error; | |
44 | ||
45 | if (!er->er_data) | |
46 | return -EINVAL; | |
47 | ||
48 | acl = posix_acl_from_xattr(er->er_data, er->er_data_len); | |
49 | if (IS_ERR(acl)) | |
50 | return PTR_ERR(acl); | |
51 | if (!acl) { | |
52 | *remove = 1; | |
53 | return 0; | |
54 | } | |
55 | ||
56 | error = posix_acl_valid(acl); | |
57 | if (error) | |
58 | goto out; | |
59 | ||
60 | if (access) { | |
61 | error = posix_acl_equiv_mode(acl, mode); | |
62 | if (!error) | |
63 | *remove = 1; | |
64 | else if (error > 0) | |
65 | error = 0; | |
66 | } | |
67 | ||
68 | out: | |
69 | posix_acl_release(acl); | |
70 | ||
71 | return error; | |
72 | } | |
73 | ||
74 | int gfs2_acl_validate_remove(struct gfs2_inode *ip, int access) | |
75 | { | |
feaa7bba | 76 | if (!GFS2_SB(&ip->i_inode)->sd_args.ar_posix_acl) |
b3b94faa DT |
77 | return -EOPNOTSUPP; |
78 | if (current->fsuid != ip->i_di.di_uid && !capable(CAP_FOWNER)) | |
79 | return -EPERM; | |
80 | if (S_ISLNK(ip->i_di.di_mode)) | |
81 | return -EOPNOTSUPP; | |
82 | if (!access && !S_ISDIR(ip->i_di.di_mode)) | |
83 | return -EACCES; | |
84 | ||
85 | return 0; | |
86 | } | |
87 | ||
88 | static int acl_get(struct gfs2_inode *ip, int access, struct posix_acl **acl, | |
89 | struct gfs2_ea_location *el, char **data, unsigned int *len) | |
90 | { | |
91 | struct gfs2_ea_request er; | |
92 | struct gfs2_ea_location el_this; | |
93 | int error; | |
94 | ||
95 | if (!ip->i_di.di_eattr) | |
96 | return 0; | |
97 | ||
98 | memset(&er, 0, sizeof(struct gfs2_ea_request)); | |
99 | if (access) { | |
100 | er.er_name = GFS2_POSIX_ACL_ACCESS; | |
101 | er.er_name_len = GFS2_POSIX_ACL_ACCESS_LEN; | |
102 | } else { | |
103 | er.er_name = GFS2_POSIX_ACL_DEFAULT; | |
104 | er.er_name_len = GFS2_POSIX_ACL_DEFAULT_LEN; | |
105 | } | |
106 | er.er_type = GFS2_EATYPE_SYS; | |
107 | ||
108 | if (!el) | |
109 | el = &el_this; | |
110 | ||
111 | error = gfs2_ea_find(ip, &er, el); | |
112 | if (error) | |
113 | return error; | |
114 | if (!el->el_ea) | |
115 | return 0; | |
116 | if (!GFS2_EA_DATA_LEN(el->el_ea)) | |
117 | goto out; | |
118 | ||
119 | er.er_data_len = GFS2_EA_DATA_LEN(el->el_ea); | |
120 | er.er_data = kmalloc(er.er_data_len, GFP_KERNEL); | |
121 | error = -ENOMEM; | |
122 | if (!er.er_data) | |
123 | goto out; | |
124 | ||
125 | error = gfs2_ea_get_copy(ip, el, er.er_data); | |
126 | if (error) | |
127 | goto out_kfree; | |
128 | ||
129 | if (acl) { | |
130 | *acl = posix_acl_from_xattr(er.er_data, er.er_data_len); | |
131 | if (IS_ERR(*acl)) | |
132 | error = PTR_ERR(*acl); | |
133 | } | |
134 | ||
135 | out_kfree: | |
136 | if (error || !data) | |
137 | kfree(er.er_data); | |
138 | else { | |
139 | *data = er.er_data; | |
140 | *len = er.er_data_len; | |
141 | } | |
142 | ||
143 | out: | |
144 | if (error || el == &el_this) | |
145 | brelse(el->el_bh); | |
146 | ||
147 | return error; | |
148 | } | |
149 | ||
150 | /** | |
151 | * gfs2_check_acl_locked - Check an ACL to see if we're allowed to do something | |
152 | * @inode: the file we want to do something to | |
153 | * @mask: what we want to do | |
154 | * | |
155 | * Returns: errno | |
156 | */ | |
157 | ||
158 | int gfs2_check_acl_locked(struct inode *inode, int mask) | |
159 | { | |
160 | struct posix_acl *acl = NULL; | |
161 | int error; | |
162 | ||
feaa7bba | 163 | error = acl_get(GFS2_I(inode), ACL_ACCESS, &acl, NULL, NULL, NULL); |
b3b94faa DT |
164 | if (error) |
165 | return error; | |
166 | ||
167 | if (acl) { | |
168 | error = posix_acl_permission(inode, acl, mask); | |
169 | posix_acl_release(acl); | |
170 | return error; | |
171 | } | |
172 | ||
173 | return -EAGAIN; | |
174 | } | |
175 | ||
176 | int gfs2_check_acl(struct inode *inode, int mask) | |
177 | { | |
feaa7bba | 178 | struct gfs2_inode *ip = GFS2_I(inode); |
b3b94faa DT |
179 | struct gfs2_holder i_gh; |
180 | int error; | |
181 | ||
182 | error = gfs2_glock_nq_init(ip->i_gl, | |
183 | LM_ST_SHARED, LM_FLAG_ANY, | |
184 | &i_gh); | |
185 | if (!error) { | |
186 | error = gfs2_check_acl_locked(inode, mask); | |
187 | gfs2_glock_dq_uninit(&i_gh); | |
188 | } | |
189 | ||
190 | return error; | |
191 | } | |
192 | ||
193 | static int munge_mode(struct gfs2_inode *ip, mode_t mode) | |
194 | { | |
feaa7bba | 195 | struct gfs2_sbd *sdp = GFS2_SB(&ip->i_inode); |
b3b94faa DT |
196 | struct buffer_head *dibh; |
197 | int error; | |
198 | ||
199 | error = gfs2_trans_begin(sdp, RES_DINODE, 0); | |
200 | if (error) | |
201 | return error; | |
202 | ||
203 | error = gfs2_meta_inode_buffer(ip, &dibh); | |
204 | if (!error) { | |
205 | gfs2_assert_withdraw(sdp, | |
206 | (ip->i_di.di_mode & S_IFMT) == (mode & S_IFMT)); | |
207 | ip->i_di.di_mode = mode; | |
d4e9c4c3 | 208 | gfs2_trans_add_bh(ip->i_gl, dibh, 1); |
b3b94faa DT |
209 | gfs2_dinode_out(&ip->i_di, dibh->b_data); |
210 | brelse(dibh); | |
211 | } | |
212 | ||
213 | gfs2_trans_end(sdp); | |
214 | ||
215 | return 0; | |
216 | } | |
217 | ||
218 | int gfs2_acl_create(struct gfs2_inode *dip, struct gfs2_inode *ip) | |
219 | { | |
feaa7bba | 220 | struct gfs2_sbd *sdp = GFS2_SB(&dip->i_inode); |
b3b94faa DT |
221 | struct posix_acl *acl = NULL, *clone; |
222 | struct gfs2_ea_request er; | |
223 | mode_t mode = ip->i_di.di_mode; | |
224 | int error; | |
225 | ||
226 | if (!sdp->sd_args.ar_posix_acl) | |
227 | return 0; | |
228 | if (S_ISLNK(ip->i_di.di_mode)) | |
229 | return 0; | |
230 | ||
231 | memset(&er, 0, sizeof(struct gfs2_ea_request)); | |
232 | er.er_type = GFS2_EATYPE_SYS; | |
233 | ||
234 | error = acl_get(dip, ACL_DEFAULT, &acl, NULL, | |
235 | &er.er_data, &er.er_data_len); | |
236 | if (error) | |
237 | return error; | |
238 | if (!acl) { | |
239 | mode &= ~current->fs->umask; | |
240 | if (mode != ip->i_di.di_mode) | |
241 | error = munge_mode(ip, mode); | |
242 | return error; | |
243 | } | |
244 | ||
245 | clone = posix_acl_clone(acl, GFP_KERNEL); | |
246 | error = -ENOMEM; | |
247 | if (!clone) | |
248 | goto out; | |
249 | posix_acl_release(acl); | |
250 | acl = clone; | |
251 | ||
252 | if (S_ISDIR(ip->i_di.di_mode)) { | |
253 | er.er_name = GFS2_POSIX_ACL_DEFAULT; | |
254 | er.er_name_len = GFS2_POSIX_ACL_DEFAULT_LEN; | |
255 | error = gfs2_system_eaops.eo_set(ip, &er); | |
256 | if (error) | |
257 | goto out; | |
258 | } | |
259 | ||
260 | error = posix_acl_create_masq(acl, &mode); | |
261 | if (error < 0) | |
262 | goto out; | |
263 | if (error > 0) { | |
264 | er.er_name = GFS2_POSIX_ACL_ACCESS; | |
265 | er.er_name_len = GFS2_POSIX_ACL_ACCESS_LEN; | |
266 | posix_acl_to_xattr(acl, er.er_data, er.er_data_len); | |
267 | er.er_mode = mode; | |
268 | er.er_flags = GFS2_ERF_MODE; | |
269 | error = gfs2_system_eaops.eo_set(ip, &er); | |
270 | if (error) | |
271 | goto out; | |
272 | } else | |
273 | munge_mode(ip, mode); | |
274 | ||
275 | out: | |
276 | posix_acl_release(acl); | |
277 | kfree(er.er_data); | |
278 | return error; | |
279 | } | |
280 | ||
281 | int gfs2_acl_chmod(struct gfs2_inode *ip, struct iattr *attr) | |
282 | { | |
283 | struct posix_acl *acl = NULL, *clone; | |
284 | struct gfs2_ea_location el; | |
285 | char *data; | |
286 | unsigned int len; | |
287 | int error; | |
288 | ||
289 | error = acl_get(ip, ACL_ACCESS, &acl, &el, &data, &len); | |
290 | if (error) | |
291 | return error; | |
292 | if (!acl) | |
293 | return gfs2_setattr_simple(ip, attr); | |
294 | ||
295 | clone = posix_acl_clone(acl, GFP_KERNEL); | |
296 | error = -ENOMEM; | |
297 | if (!clone) | |
298 | goto out; | |
299 | posix_acl_release(acl); | |
300 | acl = clone; | |
301 | ||
302 | error = posix_acl_chmod_masq(acl, attr->ia_mode); | |
303 | if (!error) { | |
304 | posix_acl_to_xattr(acl, data, len); | |
305 | error = gfs2_ea_acl_chmod(ip, &el, attr, data); | |
306 | } | |
307 | ||
308 | out: | |
309 | posix_acl_release(acl); | |
310 | brelse(el.el_bh); | |
311 | kfree(data); | |
312 | ||
313 | return error; | |
314 | } | |
315 |