[PATCH] add a vfs_permission helper
Most permission() calls have a struct nameidata * available. This helper
takes that as an argument and thus makes sure we pass it down for lookup
intents and prepares for per-mount read-only support where we need a struct
vfsmount for checking whether a file is writeable.
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Andrew Morton <akpm@osdl.org>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
diff --git a/fs/exec.c b/fs/exec.c
index 5a4e3ac..7bbb781 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -135,7 +135,7 @@
if (!S_ISREG(nd.dentry->d_inode->i_mode))
goto exit;
- error = permission(nd.dentry->d_inode, MAY_READ | MAY_EXEC, &nd);
+ error = vfs_permission(&nd, MAY_READ | MAY_EXEC);
if (error)
goto exit;
@@ -495,7 +495,7 @@
file = ERR_PTR(-EACCES);
if (!(nd.mnt->mnt_flags & MNT_NOEXEC) &&
S_ISREG(inode->i_mode)) {
- int err = permission(inode, MAY_EXEC, &nd);
+ int err = vfs_permission(&nd, MAY_EXEC);
if (!err && !(inode->i_mode & 0111))
err = -EACCES;
file = ERR_PTR(err);
diff --git a/fs/inotify.c b/fs/inotify.c
index 9fbaebf..bf7ce1d 100644
--- a/fs/inotify.c
+++ b/fs/inotify.c
@@ -372,7 +372,7 @@
if (error)
return error;
/* you can only watch an inode if you have read permissions on it */
- error = permission(nd->dentry->d_inode, MAY_READ, NULL);
+ error = vfs_permission(nd, MAY_READ);
if (error)
path_release(nd);
return error;
diff --git a/fs/namei.c b/fs/namei.c
index b3f8a19..25e4ab4 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -256,6 +256,21 @@
return security_inode_permission(inode, mask, nd);
}
+/**
+ * vfs_permission - check for access rights to a given path
+ * @nd: lookup result that describes the path
+ * @mask: right to check for (%MAY_READ, %MAY_WRITE, %MAY_EXEC)
+ *
+ * Used to check for read/write/execute permissions on a path.
+ * We use "fsuid" for this, letting us set arbitrary permissions
+ * for filesystem access without changing the "normal" uids which
+ * are used for other things.
+ */
+int vfs_permission(struct nameidata *nd, int mask)
+{
+ return permission(nd->dentry->d_inode, mask, nd);
+}
+
/*
* get_write_access() gets write permission for a file.
* put_write_access() releases this write permission.
@@ -765,9 +780,8 @@
nd->flags |= LOOKUP_CONTINUE;
err = exec_permission_lite(inode, nd);
- if (err == -EAGAIN) {
- err = permission(inode, MAY_EXEC, nd);
- }
+ if (err == -EAGAIN)
+ err = vfs_permission(nd, MAY_EXEC);
if (err)
break;
@@ -1407,7 +1421,7 @@
if (S_ISDIR(inode->i_mode) && (flag & FMODE_WRITE))
return -EISDIR;
- error = permission(inode, acc_mode, nd);
+ error = vfs_permission(nd, acc_mode);
if (error)
return error;
@@ -2536,6 +2550,7 @@
EXPORT_SYMBOL(path_release);
EXPORT_SYMBOL(path_walk);
EXPORT_SYMBOL(permission);
+EXPORT_SYMBOL(vfs_permission);
EXPORT_SYMBOL(unlock_rename);
EXPORT_SYMBOL(vfs_create);
EXPORT_SYMBOL(vfs_follow_link);
diff --git a/fs/namespace.c b/fs/namespace.c
index caa9187..2019899f 100644
--- a/fs/namespace.c
+++ b/fs/namespace.c
@@ -637,7 +637,7 @@
if (current->uid != nd->dentry->d_inode->i_uid)
return -EPERM;
}
- if (permission(nd->dentry->d_inode, MAY_WRITE, nd))
+ if (vfs_permission(nd, MAY_WRITE))
return -EPERM;
return 0;
#endif
diff --git a/fs/open.c b/fs/open.c
index 6e81367..baffc08 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -240,7 +240,7 @@
if (!S_ISREG(inode->i_mode))
goto dput_and_out;
- error = permission(inode,MAY_WRITE,&nd);
+ error = vfs_permission(&nd, MAY_WRITE);
if (error)
goto dput_and_out;
@@ -394,7 +394,7 @@
goto dput_and_out;
if (current->fsuid != inode->i_uid &&
- (error = permission(inode,MAY_WRITE,&nd)) != 0)
+ (error = vfs_permission(&nd, MAY_WRITE)) != 0)
goto dput_and_out;
}
down(&inode->i_sem);
@@ -447,7 +447,7 @@
goto dput_and_out;
if (current->fsuid != inode->i_uid &&
- (error = permission(inode,MAY_WRITE,&nd)) != 0)
+ (error = vfs_permission(&nd, MAY_WRITE)) != 0)
goto dput_and_out;
}
down(&inode->i_sem);
@@ -506,7 +506,7 @@
res = __user_walk(filename, LOOKUP_FOLLOW|LOOKUP_ACCESS, &nd);
if (!res) {
- res = permission(nd.dentry->d_inode, mode, &nd);
+ res = vfs_permission(&nd, mode);
/* SuS v2 requires we report a read only fs too */
if(!res && (mode & S_IWOTH) && IS_RDONLY(nd.dentry->d_inode)
&& !special_file(nd.dentry->d_inode->i_mode))
@@ -530,7 +530,7 @@
if (error)
goto out;
- error = permission(nd.dentry->d_inode,MAY_EXEC,&nd);
+ error = vfs_permission(&nd, MAY_EXEC);
if (error)
goto dput_and_out;
@@ -581,7 +581,7 @@
if (error)
goto out;
- error = permission(nd.dentry->d_inode,MAY_EXEC,&nd);
+ error = vfs_permission(&nd, MAY_EXEC);
if (error)
goto dput_and_out;