Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 1 | /* |
| 2 | * linux/fs/posix_acl.c |
| 3 | * |
| 4 | * Copyright (C) 2002 by Andreas Gruenbacher <a.gruenbacher@computer.org> |
| 5 | * |
| 6 | * Fixes from William Schumacher incorporated on 15 March 2001. |
| 7 | * (Reported by Charles Bertsch, <CBertsch@microtest.com>). |
| 8 | */ |
| 9 | |
| 10 | /* |
| 11 | * This file contains generic functions for manipulating |
| 12 | * POSIX 1003.1e draft standard 17 ACLs. |
| 13 | */ |
| 14 | |
| 15 | #include <linux/kernel.h> |
| 16 | #include <linux/slab.h> |
Arun Sharma | 6006349 | 2011-07-26 16:09:06 -0700 | [diff] [blame] | 17 | #include <linux/atomic.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 18 | #include <linux/fs.h> |
| 19 | #include <linux/sched.h> |
| 20 | #include <linux/posix_acl.h> |
Paul Gortmaker | 630d9c4 | 2011-11-16 23:57:37 -0500 | [diff] [blame] | 21 | #include <linux/export.h> |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 22 | |
| 23 | #include <linux/errno.h> |
| 24 | |
Chuck Lever | f61f6da | 2011-01-21 03:05:38 +0000 | [diff] [blame] | 25 | EXPORT_SYMBOL(posix_acl_init); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 26 | EXPORT_SYMBOL(posix_acl_alloc); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 27 | EXPORT_SYMBOL(posix_acl_valid); |
| 28 | EXPORT_SYMBOL(posix_acl_equiv_mode); |
| 29 | EXPORT_SYMBOL(posix_acl_from_mode); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 30 | |
| 31 | /* |
Chuck Lever | f61f6da | 2011-01-21 03:05:38 +0000 | [diff] [blame] | 32 | * Init a fresh posix_acl |
| 33 | */ |
| 34 | void |
| 35 | posix_acl_init(struct posix_acl *acl, int count) |
| 36 | { |
| 37 | atomic_set(&acl->a_refcount, 1); |
| 38 | acl->a_count = count; |
| 39 | } |
| 40 | |
| 41 | /* |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 42 | * Allocate a new ACL with the specified number of entries. |
| 43 | */ |
| 44 | struct posix_acl * |
Al Viro | dd0fc66 | 2005-10-07 07:46:04 +0100 | [diff] [blame] | 45 | posix_acl_alloc(int count, gfp_t flags) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 46 | { |
| 47 | const size_t size = sizeof(struct posix_acl) + |
| 48 | count * sizeof(struct posix_acl_entry); |
| 49 | struct posix_acl *acl = kmalloc(size, flags); |
Chuck Lever | f61f6da | 2011-01-21 03:05:38 +0000 | [diff] [blame] | 50 | if (acl) |
| 51 | posix_acl_init(acl, count); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 52 | return acl; |
| 53 | } |
| 54 | |
| 55 | /* |
| 56 | * Clone an ACL. |
| 57 | */ |
Al Viro | edde854 | 2011-07-23 03:27:37 -0400 | [diff] [blame] | 58 | static struct posix_acl * |
Al Viro | dd0fc66 | 2005-10-07 07:46:04 +0100 | [diff] [blame] | 59 | posix_acl_clone(const struct posix_acl *acl, gfp_t flags) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 60 | { |
| 61 | struct posix_acl *clone = NULL; |
| 62 | |
| 63 | if (acl) { |
| 64 | int size = sizeof(struct posix_acl) + acl->a_count * |
| 65 | sizeof(struct posix_acl_entry); |
Alexey Dobriyan | 52978be | 2006-09-30 23:27:21 -0700 | [diff] [blame] | 66 | clone = kmemdup(acl, size, flags); |
| 67 | if (clone) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 68 | atomic_set(&clone->a_refcount, 1); |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 69 | } |
| 70 | return clone; |
| 71 | } |
| 72 | |
| 73 | /* |
| 74 | * Check if an acl is valid. Returns 0 if it is, or -E... otherwise. |
| 75 | */ |
| 76 | int |
| 77 | posix_acl_valid(const struct posix_acl *acl) |
| 78 | { |
| 79 | const struct posix_acl_entry *pa, *pe; |
| 80 | int state = ACL_USER_OBJ; |
| 81 | unsigned int id = 0; /* keep gcc happy */ |
| 82 | int needs_mask = 0; |
| 83 | |
| 84 | FOREACH_ACL_ENTRY(pa, acl, pe) { |
| 85 | if (pa->e_perm & ~(ACL_READ|ACL_WRITE|ACL_EXECUTE)) |
| 86 | return -EINVAL; |
| 87 | switch (pa->e_tag) { |
| 88 | case ACL_USER_OBJ: |
| 89 | if (state == ACL_USER_OBJ) { |
| 90 | id = 0; |
| 91 | state = ACL_USER; |
| 92 | break; |
| 93 | } |
| 94 | return -EINVAL; |
| 95 | |
| 96 | case ACL_USER: |
| 97 | if (state != ACL_USER) |
| 98 | return -EINVAL; |
| 99 | if (pa->e_id == ACL_UNDEFINED_ID || |
| 100 | pa->e_id < id) |
| 101 | return -EINVAL; |
| 102 | id = pa->e_id + 1; |
| 103 | needs_mask = 1; |
| 104 | break; |
| 105 | |
| 106 | case ACL_GROUP_OBJ: |
| 107 | if (state == ACL_USER) { |
| 108 | id = 0; |
| 109 | state = ACL_GROUP; |
| 110 | break; |
| 111 | } |
| 112 | return -EINVAL; |
| 113 | |
| 114 | case ACL_GROUP: |
| 115 | if (state != ACL_GROUP) |
| 116 | return -EINVAL; |
| 117 | if (pa->e_id == ACL_UNDEFINED_ID || |
| 118 | pa->e_id < id) |
| 119 | return -EINVAL; |
| 120 | id = pa->e_id + 1; |
| 121 | needs_mask = 1; |
| 122 | break; |
| 123 | |
| 124 | case ACL_MASK: |
| 125 | if (state != ACL_GROUP) |
| 126 | return -EINVAL; |
| 127 | state = ACL_OTHER; |
| 128 | break; |
| 129 | |
| 130 | case ACL_OTHER: |
| 131 | if (state == ACL_OTHER || |
| 132 | (state == ACL_GROUP && !needs_mask)) { |
| 133 | state = 0; |
| 134 | break; |
| 135 | } |
| 136 | return -EINVAL; |
| 137 | |
| 138 | default: |
| 139 | return -EINVAL; |
| 140 | } |
| 141 | } |
| 142 | if (state == 0) |
| 143 | return 0; |
| 144 | return -EINVAL; |
| 145 | } |
| 146 | |
| 147 | /* |
| 148 | * Returns 0 if the acl can be exactly represented in the traditional |
| 149 | * file mode permission bits, or else 1. Returns -E... on error. |
| 150 | */ |
| 151 | int |
Al Viro | d695212 | 2011-07-23 18:56:36 -0400 | [diff] [blame] | 152 | posix_acl_equiv_mode(const struct posix_acl *acl, umode_t *mode_p) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 153 | { |
| 154 | const struct posix_acl_entry *pa, *pe; |
Al Viro | d695212 | 2011-07-23 18:56:36 -0400 | [diff] [blame] | 155 | umode_t mode = 0; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 156 | int not_equiv = 0; |
| 157 | |
Christoph Hellwig | eb4a6ab | 2014-05-04 13:03:32 +0200 | [diff] [blame] | 158 | /* |
| 159 | * A null ACL can always be presented as mode bits. |
| 160 | */ |
| 161 | if (!acl) |
| 162 | return 0; |
| 163 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 164 | FOREACH_ACL_ENTRY(pa, acl, pe) { |
| 165 | switch (pa->e_tag) { |
| 166 | case ACL_USER_OBJ: |
| 167 | mode |= (pa->e_perm & S_IRWXO) << 6; |
| 168 | break; |
| 169 | case ACL_GROUP_OBJ: |
| 170 | mode |= (pa->e_perm & S_IRWXO) << 3; |
| 171 | break; |
| 172 | case ACL_OTHER: |
| 173 | mode |= pa->e_perm & S_IRWXO; |
| 174 | break; |
| 175 | case ACL_MASK: |
| 176 | mode = (mode & ~S_IRWXG) | |
| 177 | ((pa->e_perm & S_IRWXO) << 3); |
| 178 | not_equiv = 1; |
| 179 | break; |
| 180 | case ACL_USER: |
| 181 | case ACL_GROUP: |
| 182 | not_equiv = 1; |
| 183 | break; |
| 184 | default: |
| 185 | return -EINVAL; |
| 186 | } |
| 187 | } |
| 188 | if (mode_p) |
| 189 | *mode_p = (*mode_p & ~S_IRWXUGO) | mode; |
| 190 | return not_equiv; |
| 191 | } |
| 192 | |
| 193 | /* |
| 194 | * Create an ACL representing the file mode permission bits of an inode. |
| 195 | */ |
| 196 | struct posix_acl * |
Al Viro | 3a5fba1 | 2011-07-23 19:01:48 -0400 | [diff] [blame] | 197 | posix_acl_from_mode(umode_t mode, gfp_t flags) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 198 | { |
| 199 | struct posix_acl *acl = posix_acl_alloc(3, flags); |
| 200 | if (!acl) |
| 201 | return ERR_PTR(-ENOMEM); |
| 202 | |
| 203 | acl->a_entries[0].e_tag = ACL_USER_OBJ; |
| 204 | acl->a_entries[0].e_id = ACL_UNDEFINED_ID; |
| 205 | acl->a_entries[0].e_perm = (mode & S_IRWXU) >> 6; |
| 206 | |
| 207 | acl->a_entries[1].e_tag = ACL_GROUP_OBJ; |
| 208 | acl->a_entries[1].e_id = ACL_UNDEFINED_ID; |
| 209 | acl->a_entries[1].e_perm = (mode & S_IRWXG) >> 3; |
| 210 | |
| 211 | acl->a_entries[2].e_tag = ACL_OTHER; |
| 212 | acl->a_entries[2].e_id = ACL_UNDEFINED_ID; |
| 213 | acl->a_entries[2].e_perm = (mode & S_IRWXO); |
| 214 | return acl; |
| 215 | } |
| 216 | |
| 217 | /* |
| 218 | * Return 0 if current is granted want access to the inode |
| 219 | * by the acl. Returns -E... otherwise. |
| 220 | */ |
| 221 | int |
| 222 | posix_acl_permission(struct inode *inode, const struct posix_acl *acl, int want) |
| 223 | { |
| 224 | const struct posix_acl_entry *pa, *pe, *mask_obj; |
| 225 | int found = 0; |
| 226 | |
Andreas Gruenbacher | d124b60 | 2011-10-23 23:13:32 +0530 | [diff] [blame] | 227 | want &= MAY_READ | MAY_WRITE | MAY_EXEC | MAY_NOT_BLOCK; |
| 228 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 229 | FOREACH_ACL_ENTRY(pa, acl, pe) { |
| 230 | switch(pa->e_tag) { |
| 231 | case ACL_USER_OBJ: |
| 232 | /* (May have been checked already) */ |
David Howells | da9592e | 2008-11-14 10:39:05 +1100 | [diff] [blame] | 233 | if (inode->i_uid == current_fsuid()) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 234 | goto check_perm; |
| 235 | break; |
| 236 | case ACL_USER: |
David Howells | da9592e | 2008-11-14 10:39:05 +1100 | [diff] [blame] | 237 | if (pa->e_id == current_fsuid()) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 238 | goto mask; |
| 239 | break; |
| 240 | case ACL_GROUP_OBJ: |
| 241 | if (in_group_p(inode->i_gid)) { |
| 242 | found = 1; |
| 243 | if ((pa->e_perm & want) == want) |
| 244 | goto mask; |
| 245 | } |
| 246 | break; |
| 247 | case ACL_GROUP: |
| 248 | if (in_group_p(pa->e_id)) { |
| 249 | found = 1; |
| 250 | if ((pa->e_perm & want) == want) |
| 251 | goto mask; |
| 252 | } |
| 253 | break; |
| 254 | case ACL_MASK: |
| 255 | break; |
| 256 | case ACL_OTHER: |
| 257 | if (found) |
| 258 | return -EACCES; |
| 259 | else |
| 260 | goto check_perm; |
| 261 | default: |
| 262 | return -EIO; |
| 263 | } |
| 264 | } |
| 265 | return -EIO; |
| 266 | |
| 267 | mask: |
| 268 | for (mask_obj = pa+1; mask_obj != pe; mask_obj++) { |
| 269 | if (mask_obj->e_tag == ACL_MASK) { |
| 270 | if ((pa->e_perm & mask_obj->e_perm & want) == want) |
| 271 | return 0; |
| 272 | return -EACCES; |
| 273 | } |
| 274 | } |
| 275 | |
| 276 | check_perm: |
| 277 | if ((pa->e_perm & want) == want) |
| 278 | return 0; |
| 279 | return -EACCES; |
| 280 | } |
| 281 | |
| 282 | /* |
| 283 | * Modify acl when creating a new inode. The caller must ensure the acl is |
| 284 | * only referenced once. |
| 285 | * |
| 286 | * mode_p initially must contain the mode parameter to the open() / creat() |
| 287 | * system calls. All permissions that are not granted by the acl are removed. |
| 288 | * The permissions in the acl are changed to reflect the mode_p parameter. |
| 289 | */ |
Al Viro | d3fb612 | 2011-07-23 18:37:50 -0400 | [diff] [blame] | 290 | static int posix_acl_create_masq(struct posix_acl *acl, umode_t *mode_p) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 291 | { |
| 292 | struct posix_acl_entry *pa, *pe; |
| 293 | struct posix_acl_entry *group_obj = NULL, *mask_obj = NULL; |
Al Viro | d3fb612 | 2011-07-23 18:37:50 -0400 | [diff] [blame] | 294 | umode_t mode = *mode_p; |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 295 | int not_equiv = 0; |
| 296 | |
| 297 | /* assert(atomic_read(acl->a_refcount) == 1); */ |
| 298 | |
| 299 | FOREACH_ACL_ENTRY(pa, acl, pe) { |
| 300 | switch(pa->e_tag) { |
| 301 | case ACL_USER_OBJ: |
| 302 | pa->e_perm &= (mode >> 6) | ~S_IRWXO; |
| 303 | mode &= (pa->e_perm << 6) | ~S_IRWXU; |
| 304 | break; |
| 305 | |
| 306 | case ACL_USER: |
| 307 | case ACL_GROUP: |
| 308 | not_equiv = 1; |
| 309 | break; |
| 310 | |
| 311 | case ACL_GROUP_OBJ: |
| 312 | group_obj = pa; |
| 313 | break; |
| 314 | |
| 315 | case ACL_OTHER: |
| 316 | pa->e_perm &= mode | ~S_IRWXO; |
| 317 | mode &= pa->e_perm | ~S_IRWXO; |
| 318 | break; |
| 319 | |
| 320 | case ACL_MASK: |
| 321 | mask_obj = pa; |
| 322 | not_equiv = 1; |
| 323 | break; |
| 324 | |
| 325 | default: |
| 326 | return -EIO; |
| 327 | } |
| 328 | } |
| 329 | |
| 330 | if (mask_obj) { |
| 331 | mask_obj->e_perm &= (mode >> 3) | ~S_IRWXO; |
| 332 | mode &= (mask_obj->e_perm << 3) | ~S_IRWXG; |
| 333 | } else { |
| 334 | if (!group_obj) |
| 335 | return -EIO; |
| 336 | group_obj->e_perm &= (mode >> 3) | ~S_IRWXO; |
| 337 | mode &= (group_obj->e_perm << 3) | ~S_IRWXG; |
| 338 | } |
| 339 | |
| 340 | *mode_p = (*mode_p & ~S_IRWXUGO) | mode; |
| 341 | return not_equiv; |
| 342 | } |
| 343 | |
Jan Kara | 9451fcb | 2016-09-19 17:39:09 +0200 | [diff] [blame] | 344 | /** |
| 345 | * posix_acl_update_mode - update mode in set_acl |
| 346 | * |
| 347 | * Update the file mode when setting an ACL: compute the new file permission |
| 348 | * bits based on the ACL. In addition, if the ACL is equivalent to the new |
| 349 | * file mode, set *acl to NULL to indicate that no ACL should be set. |
| 350 | * |
| 351 | * As with chmod, clear the setgit bit if the caller is not in the owning group |
| 352 | * or capable of CAP_FSETID (see inode_change_ok). |
| 353 | * |
| 354 | * Called from set_acl inode operations. |
| 355 | */ |
| 356 | int posix_acl_update_mode(struct inode *inode, umode_t *mode_p, |
| 357 | struct posix_acl **acl) |
| 358 | { |
| 359 | umode_t mode = inode->i_mode; |
| 360 | int error; |
| 361 | |
| 362 | error = posix_acl_equiv_mode(*acl, &mode); |
| 363 | if (error < 0) |
| 364 | return error; |
| 365 | if (error == 0) |
| 366 | *acl = NULL; |
| 367 | if (!in_group_p(inode->i_gid) && |
chrmhoffmann | 4c4af2c | 2017-09-23 09:04:56 +0200 | [diff] [blame] | 368 | !capable(CAP_FSETID)) |
Jan Kara | 9451fcb | 2016-09-19 17:39:09 +0200 | [diff] [blame] | 369 | mode &= ~S_ISGID; |
| 370 | *mode_p = mode; |
| 371 | return 0; |
| 372 | } |
| 373 | EXPORT_SYMBOL(posix_acl_update_mode); |
| 374 | |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 375 | /* |
| 376 | * Modify the ACL for the chmod syscall. |
| 377 | */ |
Al Viro | 86bc704 | 2011-07-23 19:03:11 -0400 | [diff] [blame] | 378 | static int posix_acl_chmod_masq(struct posix_acl *acl, umode_t mode) |
Linus Torvalds | 1da177e | 2005-04-16 15:20:36 -0700 | [diff] [blame] | 379 | { |
| 380 | struct posix_acl_entry *group_obj = NULL, *mask_obj = NULL; |
| 381 | struct posix_acl_entry *pa, *pe; |
| 382 | |
| 383 | /* assert(atomic_read(acl->a_refcount) == 1); */ |
| 384 | |
| 385 | FOREACH_ACL_ENTRY(pa, acl, pe) { |
| 386 | switch(pa->e_tag) { |
| 387 | case ACL_USER_OBJ: |
| 388 | pa->e_perm = (mode & S_IRWXU) >> 6; |
| 389 | break; |
| 390 | |
| 391 | case ACL_USER: |
| 392 | case ACL_GROUP: |
| 393 | break; |
| 394 | |
| 395 | case ACL_GROUP_OBJ: |
| 396 | group_obj = pa; |
| 397 | break; |
| 398 | |
| 399 | case ACL_MASK: |
| 400 | mask_obj = pa; |
| 401 | break; |
| 402 | |
| 403 | case ACL_OTHER: |
| 404 | pa->e_perm = (mode & S_IRWXO); |
| 405 | break; |
| 406 | |
| 407 | default: |
| 408 | return -EIO; |
| 409 | } |
| 410 | } |
| 411 | |
| 412 | if (mask_obj) { |
| 413 | mask_obj->e_perm = (mode & S_IRWXG) >> 3; |
| 414 | } else { |
| 415 | if (!group_obj) |
| 416 | return -EIO; |
| 417 | group_obj->e_perm = (mode & S_IRWXG) >> 3; |
| 418 | } |
| 419 | |
| 420 | return 0; |
| 421 | } |
Al Viro | bc26ab5 | 2011-07-23 00:18:02 -0400 | [diff] [blame] | 422 | |
| 423 | int |
Al Viro | d3fb612 | 2011-07-23 18:37:50 -0400 | [diff] [blame] | 424 | posix_acl_create(struct posix_acl **acl, gfp_t gfp, umode_t *mode_p) |
Al Viro | 826cae2 | 2011-07-23 03:10:32 -0400 | [diff] [blame] | 425 | { |
| 426 | struct posix_acl *clone = posix_acl_clone(*acl, gfp); |
| 427 | int err = -ENOMEM; |
| 428 | if (clone) { |
| 429 | err = posix_acl_create_masq(clone, mode_p); |
| 430 | if (err < 0) { |
| 431 | posix_acl_release(clone); |
| 432 | clone = NULL; |
| 433 | } |
| 434 | } |
| 435 | posix_acl_release(*acl); |
| 436 | *acl = clone; |
| 437 | return err; |
| 438 | } |
| 439 | EXPORT_SYMBOL(posix_acl_create); |
| 440 | |
| 441 | int |
Al Viro | 86bc704 | 2011-07-23 19:03:11 -0400 | [diff] [blame] | 442 | posix_acl_chmod(struct posix_acl **acl, gfp_t gfp, umode_t mode) |
Al Viro | bc26ab5 | 2011-07-23 00:18:02 -0400 | [diff] [blame] | 443 | { |
| 444 | struct posix_acl *clone = posix_acl_clone(*acl, gfp); |
| 445 | int err = -ENOMEM; |
| 446 | if (clone) { |
| 447 | err = posix_acl_chmod_masq(clone, mode); |
| 448 | if (err) { |
| 449 | posix_acl_release(clone); |
| 450 | clone = NULL; |
| 451 | } |
| 452 | } |
| 453 | posix_acl_release(*acl); |
| 454 | *acl = clone; |
| 455 | return err; |
| 456 | } |
| 457 | EXPORT_SYMBOL(posix_acl_chmod); |