Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | /* |
Christoph Hellwig | 5c8ebd5 | 2013-12-20 05:16:37 -0800 | [diff] [blame] | 2 | * Copyright (C) 2002,2003 by Andreas Gruenbacher <a.gruenbacher@computer.org> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 3 | * |
Christoph Hellwig | 5c8ebd5 | 2013-12-20 05:16:37 -0800 | [diff] [blame] | 4 | * Fixes from William Schumacher incorporated on 15 March 2001. |
| 5 | * (Reported by Charles Bertsch, <CBertsch@microtest.com>). |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 6 | */ |
| 7 | |
| 8 | /* |
| 9 | * This file contains generic functions for manipulating |
| 10 | * POSIX 1003.1e draft standard 17 ACLs. |
| 11 | */ |
| 12 | |
| 13 | #include <linux/kernel.h> |
| 14 | #include <linux/slab.h> |
Arun Sharma | 60063497 | 2011-07-26 16:09:06 -0700 | [diff] [blame] | 15 | #include <linux/atomic.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 16 | #include <linux/fs.h> |
| 17 | #include <linux/sched.h> |
| 18 | #include <linux/posix_acl.h> |
Christoph Hellwig | 5c8ebd5 | 2013-12-20 05:16:37 -0800 | [diff] [blame] | 19 | #include <linux/posix_acl_xattr.h> |
Christoph Hellwig | 2aeccbe | 2013-12-20 05:16:40 -0800 | [diff] [blame] | 20 | #include <linux/xattr.h> |
Paul Gortmaker | 630d9c4 | 2011-11-16 23:57:37 -0500 | [diff] [blame] | 21 | #include <linux/export.h> |
Christoph Hellwig | 5c8ebd5 | 2013-12-20 05:16:37 -0800 | [diff] [blame] | 22 | #include <linux/user_namespace.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 23 | |
Andrew Morton | 0afaa12 | 2014-01-21 15:48:42 -0800 | [diff] [blame] | 24 | struct posix_acl **acl_by_type(struct inode *inode, int type) |
| 25 | { |
| 26 | switch (type) { |
| 27 | case ACL_TYPE_ACCESS: |
| 28 | return &inode->i_acl; |
| 29 | case ACL_TYPE_DEFAULT: |
| 30 | return &inode->i_default_acl; |
| 31 | default: |
| 32 | BUG(); |
| 33 | } |
| 34 | } |
| 35 | EXPORT_SYMBOL(acl_by_type); |
| 36 | |
| 37 | struct posix_acl *get_cached_acl(struct inode *inode, int type) |
| 38 | { |
| 39 | struct posix_acl **p = acl_by_type(inode, type); |
Andreas Gruenbacher | b8a7a3a | 2016-03-24 14:38:37 +0100 | [diff] [blame^] | 40 | struct posix_acl *acl; |
| 41 | |
| 42 | for (;;) { |
| 43 | rcu_read_lock(); |
| 44 | acl = rcu_dereference(*p); |
| 45 | if (!acl || is_uncached_acl(acl) || |
| 46 | atomic_inc_not_zero(&acl->a_refcount)) |
| 47 | break; |
| 48 | rcu_read_unlock(); |
| 49 | cpu_relax(); |
Andrew Morton | 0afaa12 | 2014-01-21 15:48:42 -0800 | [diff] [blame] | 50 | } |
Andreas Gruenbacher | b8a7a3a | 2016-03-24 14:38:37 +0100 | [diff] [blame^] | 51 | rcu_read_unlock(); |
Andrew Morton | 0afaa12 | 2014-01-21 15:48:42 -0800 | [diff] [blame] | 52 | return acl; |
| 53 | } |
| 54 | EXPORT_SYMBOL(get_cached_acl); |
| 55 | |
| 56 | struct posix_acl *get_cached_acl_rcu(struct inode *inode, int type) |
| 57 | { |
| 58 | return rcu_dereference(*acl_by_type(inode, type)); |
| 59 | } |
| 60 | EXPORT_SYMBOL(get_cached_acl_rcu); |
| 61 | |
| 62 | void set_cached_acl(struct inode *inode, int type, struct posix_acl *acl) |
| 63 | { |
| 64 | struct posix_acl **p = acl_by_type(inode, type); |
| 65 | struct posix_acl *old; |
Andreas Gruenbacher | b8a7a3a | 2016-03-24 14:38:37 +0100 | [diff] [blame^] | 66 | |
| 67 | old = xchg(p, posix_acl_dup(acl)); |
| 68 | if (!is_uncached_acl(old)) |
Andrew Morton | 0afaa12 | 2014-01-21 15:48:42 -0800 | [diff] [blame] | 69 | posix_acl_release(old); |
| 70 | } |
| 71 | EXPORT_SYMBOL(set_cached_acl); |
| 72 | |
Andreas Gruenbacher | b8a7a3a | 2016-03-24 14:38:37 +0100 | [diff] [blame^] | 73 | static void __forget_cached_acl(struct posix_acl **p) |
| 74 | { |
| 75 | struct posix_acl *old; |
| 76 | |
| 77 | old = xchg(p, ACL_NOT_CACHED); |
| 78 | if (!is_uncached_acl(old)) |
| 79 | posix_acl_release(old); |
| 80 | } |
| 81 | |
Andrew Morton | 0afaa12 | 2014-01-21 15:48:42 -0800 | [diff] [blame] | 82 | void forget_cached_acl(struct inode *inode, int type) |
| 83 | { |
Andreas Gruenbacher | b8a7a3a | 2016-03-24 14:38:37 +0100 | [diff] [blame^] | 84 | __forget_cached_acl(acl_by_type(inode, type)); |
Andrew Morton | 0afaa12 | 2014-01-21 15:48:42 -0800 | [diff] [blame] | 85 | } |
| 86 | EXPORT_SYMBOL(forget_cached_acl); |
| 87 | |
| 88 | void forget_all_cached_acls(struct inode *inode) |
| 89 | { |
Andreas Gruenbacher | b8a7a3a | 2016-03-24 14:38:37 +0100 | [diff] [blame^] | 90 | __forget_cached_acl(&inode->i_acl); |
| 91 | __forget_cached_acl(&inode->i_default_acl); |
Andrew Morton | 0afaa12 | 2014-01-21 15:48:42 -0800 | [diff] [blame] | 92 | } |
| 93 | EXPORT_SYMBOL(forget_all_cached_acls); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 94 | |
Christoph Hellwig | 2982baa | 2013-12-20 05:16:38 -0800 | [diff] [blame] | 95 | struct posix_acl *get_acl(struct inode *inode, int type) |
| 96 | { |
Andreas Gruenbacher | b8a7a3a | 2016-03-24 14:38:37 +0100 | [diff] [blame^] | 97 | void *sentinel; |
| 98 | struct posix_acl **p; |
Christoph Hellwig | 2982baa | 2013-12-20 05:16:38 -0800 | [diff] [blame] | 99 | struct posix_acl *acl; |
| 100 | |
Andreas Gruenbacher | b8a7a3a | 2016-03-24 14:38:37 +0100 | [diff] [blame^] | 101 | /* |
| 102 | * The sentinel is used to detect when another operation like |
| 103 | * set_cached_acl() or forget_cached_acl() races with get_acl(). |
| 104 | * It is guaranteed that is_uncached_acl(sentinel) is true. |
| 105 | */ |
| 106 | |
Christoph Hellwig | 2982baa | 2013-12-20 05:16:38 -0800 | [diff] [blame] | 107 | acl = get_cached_acl(inode, type); |
Andreas Gruenbacher | b8a7a3a | 2016-03-24 14:38:37 +0100 | [diff] [blame^] | 108 | if (!is_uncached_acl(acl)) |
Christoph Hellwig | 2982baa | 2013-12-20 05:16:38 -0800 | [diff] [blame] | 109 | return acl; |
| 110 | |
| 111 | if (!IS_POSIXACL(inode)) |
| 112 | return NULL; |
| 113 | |
Andreas Gruenbacher | b8a7a3a | 2016-03-24 14:38:37 +0100 | [diff] [blame^] | 114 | sentinel = uncached_acl_sentinel(current); |
| 115 | p = acl_by_type(inode, type); |
| 116 | |
Christoph Hellwig | 2982baa | 2013-12-20 05:16:38 -0800 | [diff] [blame] | 117 | /* |
Andreas Gruenbacher | b8a7a3a | 2016-03-24 14:38:37 +0100 | [diff] [blame^] | 118 | * If the ACL isn't being read yet, set our sentinel. Otherwise, the |
| 119 | * current value of the ACL will not be ACL_NOT_CACHED and so our own |
| 120 | * sentinel will not be set; another task will update the cache. We |
| 121 | * could wait for that other task to complete its job, but it's easier |
| 122 | * to just call ->get_acl to fetch the ACL ourself. (This is going to |
| 123 | * be an unlikely race.) |
| 124 | */ |
| 125 | if (cmpxchg(p, ACL_NOT_CACHED, sentinel) != ACL_NOT_CACHED) |
| 126 | /* fall through */ ; |
| 127 | |
| 128 | /* |
| 129 | * Normally, the ACL returned by ->get_acl will be cached. |
| 130 | * A filesystem can prevent that by calling |
| 131 | * forget_cached_acl(inode, type) in ->get_acl. |
Christoph Hellwig | 2982baa | 2013-12-20 05:16:38 -0800 | [diff] [blame] | 132 | * |
| 133 | * If the filesystem doesn't have a get_acl() function at all, we'll |
| 134 | * just create the negative cache entry. |
| 135 | */ |
| 136 | if (!inode->i_op->get_acl) { |
| 137 | set_cached_acl(inode, type, NULL); |
| 138 | return NULL; |
| 139 | } |
Andreas Gruenbacher | b8a7a3a | 2016-03-24 14:38:37 +0100 | [diff] [blame^] | 140 | acl = inode->i_op->get_acl(inode, type); |
| 141 | |
| 142 | if (IS_ERR(acl)) { |
| 143 | /* |
| 144 | * Remove our sentinel so that we don't block future attempts |
| 145 | * to cache the ACL. |
| 146 | */ |
| 147 | cmpxchg(p, sentinel, ACL_NOT_CACHED); |
| 148 | return acl; |
| 149 | } |
| 150 | |
| 151 | /* |
| 152 | * Cache the result, but only if our sentinel is still in place. |
| 153 | */ |
| 154 | posix_acl_dup(acl); |
| 155 | if (unlikely(cmpxchg(p, sentinel, acl) != sentinel)) |
| 156 | posix_acl_release(acl); |
| 157 | return acl; |
Christoph Hellwig | 2982baa | 2013-12-20 05:16:38 -0800 | [diff] [blame] | 158 | } |
| 159 | EXPORT_SYMBOL(get_acl); |
| 160 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 161 | /* |
Chuck Lever | f61f6da | 2011-01-21 03:05:38 +0000 | [diff] [blame] | 162 | * Init a fresh posix_acl |
| 163 | */ |
| 164 | void |
| 165 | posix_acl_init(struct posix_acl *acl, int count) |
| 166 | { |
| 167 | atomic_set(&acl->a_refcount, 1); |
| 168 | acl->a_count = count; |
| 169 | } |
Andrew Morton | 0afaa12 | 2014-01-21 15:48:42 -0800 | [diff] [blame] | 170 | EXPORT_SYMBOL(posix_acl_init); |
Chuck Lever | f61f6da | 2011-01-21 03:05:38 +0000 | [diff] [blame] | 171 | |
| 172 | /* |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 173 | * Allocate a new ACL with the specified number of entries. |
| 174 | */ |
| 175 | struct posix_acl * |
Al Viro | dd0fc66 | 2005-10-07 07:46:04 +0100 | [diff] [blame] | 176 | posix_acl_alloc(int count, gfp_t flags) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 177 | { |
| 178 | const size_t size = sizeof(struct posix_acl) + |
| 179 | count * sizeof(struct posix_acl_entry); |
| 180 | struct posix_acl *acl = kmalloc(size, flags); |
Chuck Lever | f61f6da | 2011-01-21 03:05:38 +0000 | [diff] [blame] | 181 | if (acl) |
| 182 | posix_acl_init(acl, count); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 183 | return acl; |
| 184 | } |
Andrew Morton | 0afaa12 | 2014-01-21 15:48:42 -0800 | [diff] [blame] | 185 | EXPORT_SYMBOL(posix_acl_alloc); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 186 | |
| 187 | /* |
| 188 | * Clone an ACL. |
| 189 | */ |
Al Viro | edde854 | 2011-07-23 03:27:37 -0400 | [diff] [blame] | 190 | static struct posix_acl * |
Al Viro | dd0fc66 | 2005-10-07 07:46:04 +0100 | [diff] [blame] | 191 | posix_acl_clone(const struct posix_acl *acl, gfp_t flags) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 192 | { |
| 193 | struct posix_acl *clone = NULL; |
| 194 | |
| 195 | if (acl) { |
| 196 | int size = sizeof(struct posix_acl) + acl->a_count * |
| 197 | sizeof(struct posix_acl_entry); |
Alexey Dobriyan | 52978be | 2006-09-30 23:27:21 -0700 | [diff] [blame] | 198 | clone = kmemdup(acl, size, flags); |
| 199 | if (clone) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 200 | atomic_set(&clone->a_refcount, 1); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 201 | } |
| 202 | return clone; |
| 203 | } |
| 204 | |
| 205 | /* |
| 206 | * Check if an acl is valid. Returns 0 if it is, or -E... otherwise. |
| 207 | */ |
| 208 | int |
| 209 | posix_acl_valid(const struct posix_acl *acl) |
| 210 | { |
| 211 | const struct posix_acl_entry *pa, *pe; |
| 212 | int state = ACL_USER_OBJ; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 213 | int needs_mask = 0; |
| 214 | |
| 215 | FOREACH_ACL_ENTRY(pa, acl, pe) { |
| 216 | if (pa->e_perm & ~(ACL_READ|ACL_WRITE|ACL_EXECUTE)) |
| 217 | return -EINVAL; |
| 218 | switch (pa->e_tag) { |
| 219 | case ACL_USER_OBJ: |
| 220 | if (state == ACL_USER_OBJ) { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 221 | state = ACL_USER; |
| 222 | break; |
| 223 | } |
| 224 | return -EINVAL; |
| 225 | |
| 226 | case ACL_USER: |
| 227 | if (state != ACL_USER) |
| 228 | return -EINVAL; |
Eric W. Biederman | 2f6f065 | 2012-02-07 18:52:57 -0800 | [diff] [blame] | 229 | if (!uid_valid(pa->e_uid)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 230 | return -EINVAL; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 231 | needs_mask = 1; |
| 232 | break; |
| 233 | |
| 234 | case ACL_GROUP_OBJ: |
| 235 | if (state == ACL_USER) { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 236 | state = ACL_GROUP; |
| 237 | break; |
| 238 | } |
| 239 | return -EINVAL; |
| 240 | |
| 241 | case ACL_GROUP: |
| 242 | if (state != ACL_GROUP) |
| 243 | return -EINVAL; |
Eric W. Biederman | 2f6f065 | 2012-02-07 18:52:57 -0800 | [diff] [blame] | 244 | if (!gid_valid(pa->e_gid)) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 245 | return -EINVAL; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 246 | needs_mask = 1; |
| 247 | break; |
| 248 | |
| 249 | case ACL_MASK: |
| 250 | if (state != ACL_GROUP) |
| 251 | return -EINVAL; |
| 252 | state = ACL_OTHER; |
| 253 | break; |
| 254 | |
| 255 | case ACL_OTHER: |
| 256 | if (state == ACL_OTHER || |
| 257 | (state == ACL_GROUP && !needs_mask)) { |
| 258 | state = 0; |
| 259 | break; |
| 260 | } |
| 261 | return -EINVAL; |
| 262 | |
| 263 | default: |
| 264 | return -EINVAL; |
| 265 | } |
| 266 | } |
| 267 | if (state == 0) |
| 268 | return 0; |
| 269 | return -EINVAL; |
| 270 | } |
Andrew Morton | 0afaa12 | 2014-01-21 15:48:42 -0800 | [diff] [blame] | 271 | EXPORT_SYMBOL(posix_acl_valid); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 272 | |
| 273 | /* |
| 274 | * Returns 0 if the acl can be exactly represented in the traditional |
| 275 | * file mode permission bits, or else 1. Returns -E... on error. |
| 276 | */ |
| 277 | int |
Al Viro | d695212 | 2011-07-23 18:56:36 -0400 | [diff] [blame] | 278 | posix_acl_equiv_mode(const struct posix_acl *acl, umode_t *mode_p) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 279 | { |
| 280 | const struct posix_acl_entry *pa, *pe; |
Al Viro | d695212 | 2011-07-23 18:56:36 -0400 | [diff] [blame] | 281 | umode_t mode = 0; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 282 | int not_equiv = 0; |
| 283 | |
Christoph Hellwig | 50c6e28 | 2014-05-04 13:03:32 +0200 | [diff] [blame] | 284 | /* |
| 285 | * A null ACL can always be presented as mode bits. |
| 286 | */ |
| 287 | if (!acl) |
| 288 | return 0; |
| 289 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 290 | FOREACH_ACL_ENTRY(pa, acl, pe) { |
| 291 | switch (pa->e_tag) { |
| 292 | case ACL_USER_OBJ: |
| 293 | mode |= (pa->e_perm & S_IRWXO) << 6; |
| 294 | break; |
| 295 | case ACL_GROUP_OBJ: |
| 296 | mode |= (pa->e_perm & S_IRWXO) << 3; |
| 297 | break; |
| 298 | case ACL_OTHER: |
| 299 | mode |= pa->e_perm & S_IRWXO; |
| 300 | break; |
| 301 | case ACL_MASK: |
| 302 | mode = (mode & ~S_IRWXG) | |
| 303 | ((pa->e_perm & S_IRWXO) << 3); |
| 304 | not_equiv = 1; |
| 305 | break; |
| 306 | case ACL_USER: |
| 307 | case ACL_GROUP: |
| 308 | not_equiv = 1; |
| 309 | break; |
| 310 | default: |
| 311 | return -EINVAL; |
| 312 | } |
| 313 | } |
| 314 | if (mode_p) |
| 315 | *mode_p = (*mode_p & ~S_IRWXUGO) | mode; |
| 316 | return not_equiv; |
| 317 | } |
Andrew Morton | 0afaa12 | 2014-01-21 15:48:42 -0800 | [diff] [blame] | 318 | EXPORT_SYMBOL(posix_acl_equiv_mode); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 319 | |
| 320 | /* |
| 321 | * Create an ACL representing the file mode permission bits of an inode. |
| 322 | */ |
| 323 | struct posix_acl * |
Al Viro | 3a5fba1 | 2011-07-23 19:01:48 -0400 | [diff] [blame] | 324 | posix_acl_from_mode(umode_t mode, gfp_t flags) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 325 | { |
| 326 | struct posix_acl *acl = posix_acl_alloc(3, flags); |
| 327 | if (!acl) |
| 328 | return ERR_PTR(-ENOMEM); |
| 329 | |
| 330 | acl->a_entries[0].e_tag = ACL_USER_OBJ; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 331 | acl->a_entries[0].e_perm = (mode & S_IRWXU) >> 6; |
| 332 | |
| 333 | acl->a_entries[1].e_tag = ACL_GROUP_OBJ; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 334 | acl->a_entries[1].e_perm = (mode & S_IRWXG) >> 3; |
| 335 | |
| 336 | acl->a_entries[2].e_tag = ACL_OTHER; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 337 | acl->a_entries[2].e_perm = (mode & S_IRWXO); |
| 338 | return acl; |
| 339 | } |
Andrew Morton | 0afaa12 | 2014-01-21 15:48:42 -0800 | [diff] [blame] | 340 | EXPORT_SYMBOL(posix_acl_from_mode); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 341 | |
| 342 | /* |
| 343 | * Return 0 if current is granted want access to the inode |
| 344 | * by the acl. Returns -E... otherwise. |
| 345 | */ |
| 346 | int |
| 347 | posix_acl_permission(struct inode *inode, const struct posix_acl *acl, int want) |
| 348 | { |
| 349 | const struct posix_acl_entry *pa, *pe, *mask_obj; |
| 350 | int found = 0; |
| 351 | |
Andreas Gruenbacher | d124b60 | 2011-10-23 23:13:32 +0530 | [diff] [blame] | 352 | want &= MAY_READ | MAY_WRITE | MAY_EXEC | MAY_NOT_BLOCK; |
| 353 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 354 | FOREACH_ACL_ENTRY(pa, acl, pe) { |
| 355 | switch(pa->e_tag) { |
| 356 | case ACL_USER_OBJ: |
| 357 | /* (May have been checked already) */ |
Eric W. Biederman | 2f6f065 | 2012-02-07 18:52:57 -0800 | [diff] [blame] | 358 | if (uid_eq(inode->i_uid, current_fsuid())) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 359 | goto check_perm; |
| 360 | break; |
| 361 | case ACL_USER: |
Eric W. Biederman | 2f6f065 | 2012-02-07 18:52:57 -0800 | [diff] [blame] | 362 | if (uid_eq(pa->e_uid, current_fsuid())) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 363 | goto mask; |
| 364 | break; |
| 365 | case ACL_GROUP_OBJ: |
| 366 | if (in_group_p(inode->i_gid)) { |
| 367 | found = 1; |
| 368 | if ((pa->e_perm & want) == want) |
| 369 | goto mask; |
| 370 | } |
| 371 | break; |
| 372 | case ACL_GROUP: |
Eric W. Biederman | 2f6f065 | 2012-02-07 18:52:57 -0800 | [diff] [blame] | 373 | if (in_group_p(pa->e_gid)) { |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 374 | found = 1; |
| 375 | if ((pa->e_perm & want) == want) |
| 376 | goto mask; |
| 377 | } |
| 378 | break; |
| 379 | case ACL_MASK: |
| 380 | break; |
| 381 | case ACL_OTHER: |
| 382 | if (found) |
| 383 | return -EACCES; |
| 384 | else |
| 385 | goto check_perm; |
| 386 | default: |
| 387 | return -EIO; |
| 388 | } |
| 389 | } |
| 390 | return -EIO; |
| 391 | |
| 392 | mask: |
| 393 | for (mask_obj = pa+1; mask_obj != pe; mask_obj++) { |
| 394 | if (mask_obj->e_tag == ACL_MASK) { |
| 395 | if ((pa->e_perm & mask_obj->e_perm & want) == want) |
| 396 | return 0; |
| 397 | return -EACCES; |
| 398 | } |
| 399 | } |
| 400 | |
| 401 | check_perm: |
| 402 | if ((pa->e_perm & want) == want) |
| 403 | return 0; |
| 404 | return -EACCES; |
| 405 | } |
| 406 | |
| 407 | /* |
| 408 | * Modify acl when creating a new inode. The caller must ensure the acl is |
| 409 | * only referenced once. |
| 410 | * |
| 411 | * mode_p initially must contain the mode parameter to the open() / creat() |
| 412 | * system calls. All permissions that are not granted by the acl are removed. |
| 413 | * The permissions in the acl are changed to reflect the mode_p parameter. |
| 414 | */ |
Al Viro | d3fb612 | 2011-07-23 18:37:50 -0400 | [diff] [blame] | 415 | static int posix_acl_create_masq(struct posix_acl *acl, umode_t *mode_p) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 416 | { |
| 417 | struct posix_acl_entry *pa, *pe; |
| 418 | struct posix_acl_entry *group_obj = NULL, *mask_obj = NULL; |
Al Viro | d3fb612 | 2011-07-23 18:37:50 -0400 | [diff] [blame] | 419 | umode_t mode = *mode_p; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 420 | int not_equiv = 0; |
| 421 | |
| 422 | /* assert(atomic_read(acl->a_refcount) == 1); */ |
| 423 | |
| 424 | FOREACH_ACL_ENTRY(pa, acl, pe) { |
| 425 | switch(pa->e_tag) { |
| 426 | case ACL_USER_OBJ: |
| 427 | pa->e_perm &= (mode >> 6) | ~S_IRWXO; |
| 428 | mode &= (pa->e_perm << 6) | ~S_IRWXU; |
| 429 | break; |
| 430 | |
| 431 | case ACL_USER: |
| 432 | case ACL_GROUP: |
| 433 | not_equiv = 1; |
| 434 | break; |
| 435 | |
| 436 | case ACL_GROUP_OBJ: |
| 437 | group_obj = pa; |
| 438 | break; |
| 439 | |
| 440 | case ACL_OTHER: |
| 441 | pa->e_perm &= mode | ~S_IRWXO; |
| 442 | mode &= pa->e_perm | ~S_IRWXO; |
| 443 | break; |
| 444 | |
| 445 | case ACL_MASK: |
| 446 | mask_obj = pa; |
| 447 | not_equiv = 1; |
| 448 | break; |
| 449 | |
| 450 | default: |
| 451 | return -EIO; |
| 452 | } |
| 453 | } |
| 454 | |
| 455 | if (mask_obj) { |
| 456 | mask_obj->e_perm &= (mode >> 3) | ~S_IRWXO; |
| 457 | mode &= (mask_obj->e_perm << 3) | ~S_IRWXG; |
| 458 | } else { |
| 459 | if (!group_obj) |
| 460 | return -EIO; |
| 461 | group_obj->e_perm &= (mode >> 3) | ~S_IRWXO; |
| 462 | mode &= (group_obj->e_perm << 3) | ~S_IRWXG; |
| 463 | } |
| 464 | |
| 465 | *mode_p = (*mode_p & ~S_IRWXUGO) | mode; |
| 466 | return not_equiv; |
| 467 | } |
| 468 | |
| 469 | /* |
| 470 | * Modify the ACL for the chmod syscall. |
| 471 | */ |
Christoph Hellwig | 5bf3258 | 2013-12-20 05:16:41 -0800 | [diff] [blame] | 472 | static int __posix_acl_chmod_masq(struct posix_acl *acl, umode_t mode) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 473 | { |
| 474 | struct posix_acl_entry *group_obj = NULL, *mask_obj = NULL; |
| 475 | struct posix_acl_entry *pa, *pe; |
| 476 | |
| 477 | /* assert(atomic_read(acl->a_refcount) == 1); */ |
| 478 | |
| 479 | FOREACH_ACL_ENTRY(pa, acl, pe) { |
| 480 | switch(pa->e_tag) { |
| 481 | case ACL_USER_OBJ: |
| 482 | pa->e_perm = (mode & S_IRWXU) >> 6; |
| 483 | break; |
| 484 | |
| 485 | case ACL_USER: |
| 486 | case ACL_GROUP: |
| 487 | break; |
| 488 | |
| 489 | case ACL_GROUP_OBJ: |
| 490 | group_obj = pa; |
| 491 | break; |
| 492 | |
| 493 | case ACL_MASK: |
| 494 | mask_obj = pa; |
| 495 | break; |
| 496 | |
| 497 | case ACL_OTHER: |
| 498 | pa->e_perm = (mode & S_IRWXO); |
| 499 | break; |
| 500 | |
| 501 | default: |
| 502 | return -EIO; |
| 503 | } |
| 504 | } |
| 505 | |
| 506 | if (mask_obj) { |
| 507 | mask_obj->e_perm = (mode & S_IRWXG) >> 3; |
| 508 | } else { |
| 509 | if (!group_obj) |
| 510 | return -EIO; |
| 511 | group_obj->e_perm = (mode & S_IRWXG) >> 3; |
| 512 | } |
| 513 | |
| 514 | return 0; |
| 515 | } |
Al Viro | bc26ab5 | 2011-07-23 00:18:02 -0400 | [diff] [blame] | 516 | |
| 517 | int |
Christoph Hellwig | 37bc153 | 2013-12-20 05:16:42 -0800 | [diff] [blame] | 518 | __posix_acl_create(struct posix_acl **acl, gfp_t gfp, umode_t *mode_p) |
Al Viro | 826cae2 | 2011-07-23 03:10:32 -0400 | [diff] [blame] | 519 | { |
| 520 | struct posix_acl *clone = posix_acl_clone(*acl, gfp); |
| 521 | int err = -ENOMEM; |
| 522 | if (clone) { |
| 523 | err = posix_acl_create_masq(clone, mode_p); |
| 524 | if (err < 0) { |
| 525 | posix_acl_release(clone); |
| 526 | clone = NULL; |
| 527 | } |
| 528 | } |
| 529 | posix_acl_release(*acl); |
| 530 | *acl = clone; |
| 531 | return err; |
| 532 | } |
Christoph Hellwig | 37bc153 | 2013-12-20 05:16:42 -0800 | [diff] [blame] | 533 | EXPORT_SYMBOL(__posix_acl_create); |
Al Viro | 826cae2 | 2011-07-23 03:10:32 -0400 | [diff] [blame] | 534 | |
| 535 | int |
Christoph Hellwig | 5bf3258 | 2013-12-20 05:16:41 -0800 | [diff] [blame] | 536 | __posix_acl_chmod(struct posix_acl **acl, gfp_t gfp, umode_t mode) |
Al Viro | bc26ab5 | 2011-07-23 00:18:02 -0400 | [diff] [blame] | 537 | { |
| 538 | struct posix_acl *clone = posix_acl_clone(*acl, gfp); |
| 539 | int err = -ENOMEM; |
| 540 | if (clone) { |
Christoph Hellwig | 5bf3258 | 2013-12-20 05:16:41 -0800 | [diff] [blame] | 541 | err = __posix_acl_chmod_masq(clone, mode); |
Al Viro | bc26ab5 | 2011-07-23 00:18:02 -0400 | [diff] [blame] | 542 | if (err) { |
| 543 | posix_acl_release(clone); |
| 544 | clone = NULL; |
| 545 | } |
| 546 | } |
| 547 | posix_acl_release(*acl); |
| 548 | *acl = clone; |
| 549 | return err; |
| 550 | } |
Christoph Hellwig | 5bf3258 | 2013-12-20 05:16:41 -0800 | [diff] [blame] | 551 | EXPORT_SYMBOL(__posix_acl_chmod); |
| 552 | |
| 553 | int |
Christoph Hellwig | 37bc153 | 2013-12-20 05:16:42 -0800 | [diff] [blame] | 554 | posix_acl_chmod(struct inode *inode, umode_t mode) |
Christoph Hellwig | 5bf3258 | 2013-12-20 05:16:41 -0800 | [diff] [blame] | 555 | { |
| 556 | struct posix_acl *acl; |
| 557 | int ret = 0; |
| 558 | |
| 559 | if (!IS_POSIXACL(inode)) |
| 560 | return 0; |
| 561 | if (!inode->i_op->set_acl) |
| 562 | return -EOPNOTSUPP; |
| 563 | |
| 564 | acl = get_acl(inode, ACL_TYPE_ACCESS); |
Trond Myklebust | 789b663 | 2014-01-31 14:25:19 -0500 | [diff] [blame] | 565 | if (IS_ERR_OR_NULL(acl)) { |
| 566 | if (acl == ERR_PTR(-EOPNOTSUPP)) |
| 567 | return 0; |
Christoph Hellwig | 5bf3258 | 2013-12-20 05:16:41 -0800 | [diff] [blame] | 568 | return PTR_ERR(acl); |
Trond Myklebust | 789b663 | 2014-01-31 14:25:19 -0500 | [diff] [blame] | 569 | } |
Christoph Hellwig | 5bf3258 | 2013-12-20 05:16:41 -0800 | [diff] [blame] | 570 | |
Christoph Hellwig | 37bc153 | 2013-12-20 05:16:42 -0800 | [diff] [blame] | 571 | ret = __posix_acl_chmod(&acl, GFP_KERNEL, mode); |
Christoph Hellwig | 5bf3258 | 2013-12-20 05:16:41 -0800 | [diff] [blame] | 572 | if (ret) |
| 573 | return ret; |
| 574 | ret = inode->i_op->set_acl(inode, acl, ACL_TYPE_ACCESS); |
| 575 | posix_acl_release(acl); |
| 576 | return ret; |
| 577 | } |
Al Viro | bc26ab5 | 2011-07-23 00:18:02 -0400 | [diff] [blame] | 578 | EXPORT_SYMBOL(posix_acl_chmod); |
Christoph Hellwig | 5c8ebd5 | 2013-12-20 05:16:37 -0800 | [diff] [blame] | 579 | |
Christoph Hellwig | 37bc153 | 2013-12-20 05:16:42 -0800 | [diff] [blame] | 580 | int |
| 581 | posix_acl_create(struct inode *dir, umode_t *mode, |
| 582 | struct posix_acl **default_acl, struct posix_acl **acl) |
| 583 | { |
| 584 | struct posix_acl *p; |
Dan Carpenter | c0c3a71 | 2015-06-19 09:00:55 +1000 | [diff] [blame] | 585 | struct posix_acl *clone; |
Christoph Hellwig | 37bc153 | 2013-12-20 05:16:42 -0800 | [diff] [blame] | 586 | int ret; |
| 587 | |
Dan Carpenter | c0c3a71 | 2015-06-19 09:00:55 +1000 | [diff] [blame] | 588 | *acl = NULL; |
| 589 | *default_acl = NULL; |
| 590 | |
Christoph Hellwig | 37bc153 | 2013-12-20 05:16:42 -0800 | [diff] [blame] | 591 | if (S_ISLNK(*mode) || !IS_POSIXACL(dir)) |
Dan Carpenter | c0c3a71 | 2015-06-19 09:00:55 +1000 | [diff] [blame] | 592 | return 0; |
Christoph Hellwig | 37bc153 | 2013-12-20 05:16:42 -0800 | [diff] [blame] | 593 | |
| 594 | p = get_acl(dir, ACL_TYPE_DEFAULT); |
Dan Carpenter | c0c3a71 | 2015-06-19 09:00:55 +1000 | [diff] [blame] | 595 | if (!p || p == ERR_PTR(-EOPNOTSUPP)) { |
| 596 | *mode &= ~current_umask(); |
| 597 | return 0; |
Christoph Hellwig | 37bc153 | 2013-12-20 05:16:42 -0800 | [diff] [blame] | 598 | } |
Dan Carpenter | c0c3a71 | 2015-06-19 09:00:55 +1000 | [diff] [blame] | 599 | if (IS_ERR(p)) |
| 600 | return PTR_ERR(p); |
Christoph Hellwig | 37bc153 | 2013-12-20 05:16:42 -0800 | [diff] [blame] | 601 | |
Dan Carpenter | c0c3a71 | 2015-06-19 09:00:55 +1000 | [diff] [blame] | 602 | clone = posix_acl_clone(p, GFP_NOFS); |
| 603 | if (!clone) |
Omar Sandoval | fed0b58 | 2015-02-08 21:45:25 -0800 | [diff] [blame] | 604 | goto no_mem; |
Christoph Hellwig | 37bc153 | 2013-12-20 05:16:42 -0800 | [diff] [blame] | 605 | |
Dan Carpenter | c0c3a71 | 2015-06-19 09:00:55 +1000 | [diff] [blame] | 606 | ret = posix_acl_create_masq(clone, mode); |
Omar Sandoval | fed0b58 | 2015-02-08 21:45:25 -0800 | [diff] [blame] | 607 | if (ret < 0) |
| 608 | goto no_mem_clone; |
Christoph Hellwig | 37bc153 | 2013-12-20 05:16:42 -0800 | [diff] [blame] | 609 | |
Dan Carpenter | c0c3a71 | 2015-06-19 09:00:55 +1000 | [diff] [blame] | 610 | if (ret == 0) |
| 611 | posix_acl_release(clone); |
| 612 | else |
| 613 | *acl = clone; |
Christoph Hellwig | 37bc153 | 2013-12-20 05:16:42 -0800 | [diff] [blame] | 614 | |
Dan Carpenter | c0c3a71 | 2015-06-19 09:00:55 +1000 | [diff] [blame] | 615 | if (!S_ISDIR(*mode)) |
Christoph Hellwig | 37bc153 | 2013-12-20 05:16:42 -0800 | [diff] [blame] | 616 | posix_acl_release(p); |
Dan Carpenter | c0c3a71 | 2015-06-19 09:00:55 +1000 | [diff] [blame] | 617 | else |
Christoph Hellwig | 37bc153 | 2013-12-20 05:16:42 -0800 | [diff] [blame] | 618 | *default_acl = p; |
Christoph Hellwig | 37bc153 | 2013-12-20 05:16:42 -0800 | [diff] [blame] | 619 | |
Christoph Hellwig | 37bc153 | 2013-12-20 05:16:42 -0800 | [diff] [blame] | 620 | return 0; |
Omar Sandoval | fed0b58 | 2015-02-08 21:45:25 -0800 | [diff] [blame] | 621 | |
| 622 | no_mem_clone: |
Dan Carpenter | c0c3a71 | 2015-06-19 09:00:55 +1000 | [diff] [blame] | 623 | posix_acl_release(clone); |
Omar Sandoval | fed0b58 | 2015-02-08 21:45:25 -0800 | [diff] [blame] | 624 | no_mem: |
| 625 | posix_acl_release(p); |
| 626 | return -ENOMEM; |
Christoph Hellwig | 37bc153 | 2013-12-20 05:16:42 -0800 | [diff] [blame] | 627 | } |
| 628 | EXPORT_SYMBOL_GPL(posix_acl_create); |
| 629 | |
Christoph Hellwig | 5c8ebd5 | 2013-12-20 05:16:37 -0800 | [diff] [blame] | 630 | /* |
| 631 | * Fix up the uids and gids in posix acl extended attributes in place. |
| 632 | */ |
| 633 | static void posix_acl_fix_xattr_userns( |
| 634 | struct user_namespace *to, struct user_namespace *from, |
| 635 | void *value, size_t size) |
| 636 | { |
| 637 | posix_acl_xattr_header *header = (posix_acl_xattr_header *)value; |
| 638 | posix_acl_xattr_entry *entry = (posix_acl_xattr_entry *)(header+1), *end; |
| 639 | int count; |
| 640 | kuid_t uid; |
| 641 | kgid_t gid; |
| 642 | |
| 643 | if (!value) |
| 644 | return; |
| 645 | if (size < sizeof(posix_acl_xattr_header)) |
| 646 | return; |
| 647 | if (header->a_version != cpu_to_le32(POSIX_ACL_XATTR_VERSION)) |
| 648 | return; |
| 649 | |
| 650 | count = posix_acl_xattr_count(size); |
| 651 | if (count < 0) |
| 652 | return; |
| 653 | if (count == 0) |
| 654 | return; |
| 655 | |
| 656 | for (end = entry + count; entry != end; entry++) { |
| 657 | switch(le16_to_cpu(entry->e_tag)) { |
| 658 | case ACL_USER: |
| 659 | uid = make_kuid(from, le32_to_cpu(entry->e_id)); |
| 660 | entry->e_id = cpu_to_le32(from_kuid(to, uid)); |
| 661 | break; |
| 662 | case ACL_GROUP: |
| 663 | gid = make_kgid(from, le32_to_cpu(entry->e_id)); |
| 664 | entry->e_id = cpu_to_le32(from_kgid(to, gid)); |
| 665 | break; |
| 666 | default: |
| 667 | break; |
| 668 | } |
| 669 | } |
| 670 | } |
| 671 | |
| 672 | void posix_acl_fix_xattr_from_user(void *value, size_t size) |
| 673 | { |
| 674 | struct user_namespace *user_ns = current_user_ns(); |
| 675 | if (user_ns == &init_user_ns) |
| 676 | return; |
| 677 | posix_acl_fix_xattr_userns(&init_user_ns, user_ns, value, size); |
| 678 | } |
| 679 | |
| 680 | void posix_acl_fix_xattr_to_user(void *value, size_t size) |
| 681 | { |
| 682 | struct user_namespace *user_ns = current_user_ns(); |
| 683 | if (user_ns == &init_user_ns) |
| 684 | return; |
| 685 | posix_acl_fix_xattr_userns(user_ns, &init_user_ns, value, size); |
| 686 | } |
| 687 | |
| 688 | /* |
| 689 | * Convert from extended attribute to in-memory representation. |
| 690 | */ |
| 691 | struct posix_acl * |
| 692 | posix_acl_from_xattr(struct user_namespace *user_ns, |
| 693 | const void *value, size_t size) |
| 694 | { |
| 695 | posix_acl_xattr_header *header = (posix_acl_xattr_header *)value; |
| 696 | posix_acl_xattr_entry *entry = (posix_acl_xattr_entry *)(header+1), *end; |
| 697 | int count; |
| 698 | struct posix_acl *acl; |
| 699 | struct posix_acl_entry *acl_e; |
| 700 | |
| 701 | if (!value) |
| 702 | return NULL; |
| 703 | if (size < sizeof(posix_acl_xattr_header)) |
| 704 | return ERR_PTR(-EINVAL); |
| 705 | if (header->a_version != cpu_to_le32(POSIX_ACL_XATTR_VERSION)) |
| 706 | return ERR_PTR(-EOPNOTSUPP); |
| 707 | |
| 708 | count = posix_acl_xattr_count(size); |
| 709 | if (count < 0) |
| 710 | return ERR_PTR(-EINVAL); |
| 711 | if (count == 0) |
| 712 | return NULL; |
| 713 | |
| 714 | acl = posix_acl_alloc(count, GFP_NOFS); |
| 715 | if (!acl) |
| 716 | return ERR_PTR(-ENOMEM); |
| 717 | acl_e = acl->a_entries; |
| 718 | |
| 719 | for (end = entry + count; entry != end; acl_e++, entry++) { |
| 720 | acl_e->e_tag = le16_to_cpu(entry->e_tag); |
| 721 | acl_e->e_perm = le16_to_cpu(entry->e_perm); |
| 722 | |
| 723 | switch(acl_e->e_tag) { |
| 724 | case ACL_USER_OBJ: |
| 725 | case ACL_GROUP_OBJ: |
| 726 | case ACL_MASK: |
| 727 | case ACL_OTHER: |
| 728 | break; |
| 729 | |
| 730 | case ACL_USER: |
| 731 | acl_e->e_uid = |
| 732 | make_kuid(user_ns, |
| 733 | le32_to_cpu(entry->e_id)); |
| 734 | if (!uid_valid(acl_e->e_uid)) |
| 735 | goto fail; |
| 736 | break; |
| 737 | case ACL_GROUP: |
| 738 | acl_e->e_gid = |
| 739 | make_kgid(user_ns, |
| 740 | le32_to_cpu(entry->e_id)); |
| 741 | if (!gid_valid(acl_e->e_gid)) |
| 742 | goto fail; |
| 743 | break; |
| 744 | |
| 745 | default: |
| 746 | goto fail; |
| 747 | } |
| 748 | } |
| 749 | return acl; |
| 750 | |
| 751 | fail: |
| 752 | posix_acl_release(acl); |
| 753 | return ERR_PTR(-EINVAL); |
| 754 | } |
| 755 | EXPORT_SYMBOL (posix_acl_from_xattr); |
| 756 | |
| 757 | /* |
| 758 | * Convert from in-memory to extended attribute representation. |
| 759 | */ |
| 760 | int |
| 761 | posix_acl_to_xattr(struct user_namespace *user_ns, const struct posix_acl *acl, |
| 762 | void *buffer, size_t size) |
| 763 | { |
| 764 | posix_acl_xattr_header *ext_acl = (posix_acl_xattr_header *)buffer; |
Dan Carpenter | 47ba973 | 2014-02-14 12:05:49 +0300 | [diff] [blame] | 765 | posix_acl_xattr_entry *ext_entry; |
Christoph Hellwig | 5c8ebd5 | 2013-12-20 05:16:37 -0800 | [diff] [blame] | 766 | int real_size, n; |
| 767 | |
| 768 | real_size = posix_acl_xattr_size(acl->a_count); |
| 769 | if (!buffer) |
| 770 | return real_size; |
| 771 | if (real_size > size) |
| 772 | return -ERANGE; |
Dan Carpenter | 47ba973 | 2014-02-14 12:05:49 +0300 | [diff] [blame] | 773 | |
| 774 | ext_entry = ext_acl->a_entries; |
Christoph Hellwig | 5c8ebd5 | 2013-12-20 05:16:37 -0800 | [diff] [blame] | 775 | ext_acl->a_version = cpu_to_le32(POSIX_ACL_XATTR_VERSION); |
| 776 | |
| 777 | for (n=0; n < acl->a_count; n++, ext_entry++) { |
| 778 | const struct posix_acl_entry *acl_e = &acl->a_entries[n]; |
| 779 | ext_entry->e_tag = cpu_to_le16(acl_e->e_tag); |
| 780 | ext_entry->e_perm = cpu_to_le16(acl_e->e_perm); |
| 781 | switch(acl_e->e_tag) { |
| 782 | case ACL_USER: |
| 783 | ext_entry->e_id = |
| 784 | cpu_to_le32(from_kuid(user_ns, acl_e->e_uid)); |
| 785 | break; |
| 786 | case ACL_GROUP: |
| 787 | ext_entry->e_id = |
| 788 | cpu_to_le32(from_kgid(user_ns, acl_e->e_gid)); |
| 789 | break; |
| 790 | default: |
| 791 | ext_entry->e_id = cpu_to_le32(ACL_UNDEFINED_ID); |
| 792 | break; |
| 793 | } |
| 794 | } |
| 795 | return real_size; |
| 796 | } |
| 797 | EXPORT_SYMBOL (posix_acl_to_xattr); |
Christoph Hellwig | 2aeccbe | 2013-12-20 05:16:40 -0800 | [diff] [blame] | 798 | |
| 799 | static int |
Andreas Gruenbacher | d9a82a0 | 2015-10-04 19:18:51 +0200 | [diff] [blame] | 800 | posix_acl_xattr_get(const struct xattr_handler *handler, |
| 801 | struct dentry *dentry, const char *name, |
| 802 | void *value, size_t size) |
Christoph Hellwig | 2aeccbe | 2013-12-20 05:16:40 -0800 | [diff] [blame] | 803 | { |
| 804 | struct posix_acl *acl; |
| 805 | int error; |
| 806 | |
David Howells | bb668734 | 2015-03-17 22:26:21 +0000 | [diff] [blame] | 807 | if (!IS_POSIXACL(d_backing_inode(dentry))) |
Christoph Hellwig | 2aeccbe | 2013-12-20 05:16:40 -0800 | [diff] [blame] | 808 | return -EOPNOTSUPP; |
David Howells | e36cb0b | 2015-01-29 12:02:35 +0000 | [diff] [blame] | 809 | if (d_is_symlink(dentry)) |
Christoph Hellwig | 2aeccbe | 2013-12-20 05:16:40 -0800 | [diff] [blame] | 810 | return -EOPNOTSUPP; |
| 811 | |
Andreas Gruenbacher | d9a82a0 | 2015-10-04 19:18:51 +0200 | [diff] [blame] | 812 | acl = get_acl(d_backing_inode(dentry), handler->flags); |
Christoph Hellwig | 2aeccbe | 2013-12-20 05:16:40 -0800 | [diff] [blame] | 813 | if (IS_ERR(acl)) |
| 814 | return PTR_ERR(acl); |
| 815 | if (acl == NULL) |
| 816 | return -ENODATA; |
| 817 | |
| 818 | error = posix_acl_to_xattr(&init_user_ns, acl, value, size); |
| 819 | posix_acl_release(acl); |
| 820 | |
| 821 | return error; |
| 822 | } |
| 823 | |
| 824 | static int |
Andreas Gruenbacher | d9a82a0 | 2015-10-04 19:18:51 +0200 | [diff] [blame] | 825 | posix_acl_xattr_set(const struct xattr_handler *handler, |
| 826 | struct dentry *dentry, const char *name, |
| 827 | const void *value, size_t size, int flags) |
Christoph Hellwig | 2aeccbe | 2013-12-20 05:16:40 -0800 | [diff] [blame] | 828 | { |
David Howells | bb668734 | 2015-03-17 22:26:21 +0000 | [diff] [blame] | 829 | struct inode *inode = d_backing_inode(dentry); |
Christoph Hellwig | 2aeccbe | 2013-12-20 05:16:40 -0800 | [diff] [blame] | 830 | struct posix_acl *acl = NULL; |
| 831 | int ret; |
| 832 | |
| 833 | if (!IS_POSIXACL(inode)) |
| 834 | return -EOPNOTSUPP; |
| 835 | if (!inode->i_op->set_acl) |
| 836 | return -EOPNOTSUPP; |
| 837 | |
Andreas Gruenbacher | d9a82a0 | 2015-10-04 19:18:51 +0200 | [diff] [blame] | 838 | if (handler->flags == ACL_TYPE_DEFAULT && !S_ISDIR(inode->i_mode)) |
Christoph Hellwig | 2aeccbe | 2013-12-20 05:16:40 -0800 | [diff] [blame] | 839 | return value ? -EACCES : 0; |
| 840 | if (!inode_owner_or_capable(inode)) |
| 841 | return -EPERM; |
| 842 | |
| 843 | if (value) { |
| 844 | acl = posix_acl_from_xattr(&init_user_ns, value, size); |
| 845 | if (IS_ERR(acl)) |
| 846 | return PTR_ERR(acl); |
| 847 | |
| 848 | if (acl) { |
| 849 | ret = posix_acl_valid(acl); |
| 850 | if (ret) |
| 851 | goto out; |
| 852 | } |
| 853 | } |
| 854 | |
Andreas Gruenbacher | d9a82a0 | 2015-10-04 19:18:51 +0200 | [diff] [blame] | 855 | ret = inode->i_op->set_acl(inode, acl, handler->flags); |
Christoph Hellwig | 2aeccbe | 2013-12-20 05:16:40 -0800 | [diff] [blame] | 856 | out: |
| 857 | posix_acl_release(acl); |
| 858 | return ret; |
| 859 | } |
| 860 | |
Andreas Gruenbacher | 764a5c6 | 2015-12-02 14:44:43 +0100 | [diff] [blame] | 861 | static bool |
| 862 | posix_acl_xattr_list(struct dentry *dentry) |
Christoph Hellwig | 2aeccbe | 2013-12-20 05:16:40 -0800 | [diff] [blame] | 863 | { |
Andreas Gruenbacher | 764a5c6 | 2015-12-02 14:44:43 +0100 | [diff] [blame] | 864 | return IS_POSIXACL(d_backing_inode(dentry)); |
Christoph Hellwig | 2aeccbe | 2013-12-20 05:16:40 -0800 | [diff] [blame] | 865 | } |
| 866 | |
| 867 | const struct xattr_handler posix_acl_access_xattr_handler = { |
Andreas Gruenbacher | 98e9cb5 | 2015-12-02 14:44:36 +0100 | [diff] [blame] | 868 | .name = XATTR_NAME_POSIX_ACL_ACCESS, |
Christoph Hellwig | 2aeccbe | 2013-12-20 05:16:40 -0800 | [diff] [blame] | 869 | .flags = ACL_TYPE_ACCESS, |
| 870 | .list = posix_acl_xattr_list, |
| 871 | .get = posix_acl_xattr_get, |
| 872 | .set = posix_acl_xattr_set, |
| 873 | }; |
| 874 | EXPORT_SYMBOL_GPL(posix_acl_access_xattr_handler); |
| 875 | |
| 876 | const struct xattr_handler posix_acl_default_xattr_handler = { |
Andreas Gruenbacher | 98e9cb5 | 2015-12-02 14:44:36 +0100 | [diff] [blame] | 877 | .name = XATTR_NAME_POSIX_ACL_DEFAULT, |
Christoph Hellwig | 2aeccbe | 2013-12-20 05:16:40 -0800 | [diff] [blame] | 878 | .flags = ACL_TYPE_DEFAULT, |
| 879 | .list = posix_acl_xattr_list, |
| 880 | .get = posix_acl_xattr_get, |
| 881 | .set = posix_acl_xattr_set, |
| 882 | }; |
| 883 | EXPORT_SYMBOL_GPL(posix_acl_default_xattr_handler); |
Christoph Hellwig | feda821 | 2013-12-20 05:16:54 -0800 | [diff] [blame] | 884 | |
| 885 | int simple_set_acl(struct inode *inode, struct posix_acl *acl, int type) |
| 886 | { |
| 887 | int error; |
| 888 | |
| 889 | if (type == ACL_TYPE_ACCESS) { |
| 890 | error = posix_acl_equiv_mode(acl, &inode->i_mode); |
| 891 | if (error < 0) |
| 892 | return 0; |
| 893 | if (error == 0) |
| 894 | acl = NULL; |
| 895 | } |
| 896 | |
| 897 | inode->i_ctime = CURRENT_TIME; |
| 898 | set_cached_acl(inode, type, acl); |
| 899 | return 0; |
| 900 | } |
| 901 | |
| 902 | int simple_acl_create(struct inode *dir, struct inode *inode) |
| 903 | { |
| 904 | struct posix_acl *default_acl, *acl; |
| 905 | int error; |
| 906 | |
| 907 | error = posix_acl_create(dir, &inode->i_mode, &default_acl, &acl); |
| 908 | if (error) |
| 909 | return error; |
| 910 | |
| 911 | set_cached_acl(inode, ACL_TYPE_DEFAULT, default_acl); |
| 912 | set_cached_acl(inode, ACL_TYPE_ACCESS, acl); |
| 913 | |
| 914 | if (default_acl) |
| 915 | posix_acl_release(default_acl); |
| 916 | if (acl) |
| 917 | posix_acl_release(acl); |
| 918 | return 0; |
| 919 | } |