]>
Commit | Line | Data |
---|---|---|
b3b94faa DT |
1 | /* |
2 | * Copyright (C) Sistina Software, Inc. 1997-2003 All rights reserved. | |
3a8a9a10 | 3 | * Copyright (C) 2004-2006 Red Hat, Inc. All rights reserved. |
b3b94faa DT |
4 | * |
5 | * This copyrighted material is made available to anyone wishing to use, | |
6 | * modify, copy, or redistribute it subject to the terms and conditions | |
e9fc2aa0 | 7 | * of the GNU General Public License version 2. |
b3b94faa DT |
8 | */ |
9 | ||
10 | #include <linux/sched.h> | |
11 | #include <linux/slab.h> | |
12 | #include <linux/spinlock.h> | |
13 | #include <linux/completion.h> | |
14 | #include <linux/buffer_head.h> | |
15 | #include <linux/posix_acl.h> | |
16 | #include <linux/posix_acl_xattr.h> | |
5c676f6d | 17 | #include <linux/gfs2_ondisk.h> |
b3b94faa DT |
18 | |
19 | #include "gfs2.h" | |
5c676f6d | 20 | #include "incore.h" |
b3b94faa DT |
21 | #include "acl.h" |
22 | #include "eaops.h" | |
23 | #include "eattr.h" | |
24 | #include "glock.h" | |
25 | #include "inode.h" | |
26 | #include "meta_io.h" | |
27 | #include "trans.h" | |
5c676f6d | 28 | #include "util.h" |
b3b94faa DT |
29 | |
30 | #define ACL_ACCESS 1 | |
31 | #define ACL_DEFAULT 0 | |
32 | ||
33 | int gfs2_acl_validate_set(struct gfs2_inode *ip, int access, | |
34 | struct gfs2_ea_request *er, | |
35 | int *remove, mode_t *mode) | |
36 | { | |
37 | struct posix_acl *acl; | |
38 | int error; | |
39 | ||
40 | error = gfs2_acl_validate_remove(ip, access); | |
41 | if (error) | |
42 | return error; | |
43 | ||
44 | if (!er->er_data) | |
45 | return -EINVAL; | |
46 | ||
47 | acl = posix_acl_from_xattr(er->er_data, er->er_data_len); | |
48 | if (IS_ERR(acl)) | |
49 | return PTR_ERR(acl); | |
50 | if (!acl) { | |
51 | *remove = 1; | |
52 | return 0; | |
53 | } | |
54 | ||
55 | error = posix_acl_valid(acl); | |
56 | if (error) | |
57 | goto out; | |
58 | ||
59 | if (access) { | |
60 | error = posix_acl_equiv_mode(acl, mode); | |
61 | if (!error) | |
62 | *remove = 1; | |
63 | else if (error > 0) | |
64 | error = 0; | |
65 | } | |
66 | ||
a91ea69f | 67 | out: |
b3b94faa | 68 | posix_acl_release(acl); |
b3b94faa DT |
69 | return error; |
70 | } | |
71 | ||
72 | int gfs2_acl_validate_remove(struct gfs2_inode *ip, int access) | |
73 | { | |
feaa7bba | 74 | if (!GFS2_SB(&ip->i_inode)->sd_args.ar_posix_acl) |
b3b94faa | 75 | return -EOPNOTSUPP; |
3bd858ab | 76 | if (!is_owner_or_cap(&ip->i_inode)) |
b3b94faa | 77 | return -EPERM; |
b60623c2 | 78 | if (S_ISLNK(ip->i_inode.i_mode)) |
b3b94faa | 79 | return -EOPNOTSUPP; |
b60623c2 | 80 | if (!access && !S_ISDIR(ip->i_inode.i_mode)) |
b3b94faa DT |
81 | return -EACCES; |
82 | ||
83 | return 0; | |
84 | } | |
85 | ||
86 | static int acl_get(struct gfs2_inode *ip, int access, struct posix_acl **acl, | |
87 | struct gfs2_ea_location *el, char **data, unsigned int *len) | |
88 | { | |
89 | struct gfs2_ea_request er; | |
90 | struct gfs2_ea_location el_this; | |
91 | int error; | |
92 | ||
3767ac21 | 93 | if (!ip->i_eattr) |
b3b94faa DT |
94 | return 0; |
95 | ||
96 | memset(&er, 0, sizeof(struct gfs2_ea_request)); | |
97 | if (access) { | |
98 | er.er_name = GFS2_POSIX_ACL_ACCESS; | |
99 | er.er_name_len = GFS2_POSIX_ACL_ACCESS_LEN; | |
100 | } else { | |
101 | er.er_name = GFS2_POSIX_ACL_DEFAULT; | |
102 | er.er_name_len = GFS2_POSIX_ACL_DEFAULT_LEN; | |
103 | } | |
104 | er.er_type = GFS2_EATYPE_SYS; | |
105 | ||
106 | if (!el) | |
107 | el = &el_this; | |
108 | ||
109 | error = gfs2_ea_find(ip, &er, el); | |
110 | if (error) | |
111 | return error; | |
112 | if (!el->el_ea) | |
113 | return 0; | |
114 | if (!GFS2_EA_DATA_LEN(el->el_ea)) | |
115 | goto out; | |
116 | ||
117 | er.er_data_len = GFS2_EA_DATA_LEN(el->el_ea); | |
16c5f06f | 118 | er.er_data = kmalloc(er.er_data_len, GFP_NOFS); |
b3b94faa DT |
119 | error = -ENOMEM; |
120 | if (!er.er_data) | |
121 | goto out; | |
122 | ||
123 | error = gfs2_ea_get_copy(ip, el, er.er_data); | |
124 | if (error) | |
125 | goto out_kfree; | |
126 | ||
127 | if (acl) { | |
128 | *acl = posix_acl_from_xattr(er.er_data, er.er_data_len); | |
129 | if (IS_ERR(*acl)) | |
130 | error = PTR_ERR(*acl); | |
131 | } | |
132 | ||
a91ea69f | 133 | out_kfree: |
b3b94faa DT |
134 | if (error || !data) |
135 | kfree(er.er_data); | |
136 | else { | |
137 | *data = er.er_data; | |
138 | *len = er.er_data_len; | |
139 | } | |
a91ea69f | 140 | out: |
b3b94faa DT |
141 | if (error || el == &el_this) |
142 | brelse(el->el_bh); | |
b3b94faa DT |
143 | return error; |
144 | } | |
145 | ||
146 | /** | |
77386e1f | 147 | * gfs2_check_acl - Check an ACL to see if we're allowed to do something |
b3b94faa DT |
148 | * @inode: the file we want to do something to |
149 | * @mask: what we want to do | |
150 | * | |
151 | * Returns: errno | |
152 | */ | |
153 | ||
77386e1f | 154 | int gfs2_check_acl(struct inode *inode, int mask) |
b3b94faa DT |
155 | { |
156 | struct posix_acl *acl = NULL; | |
157 | int error; | |
158 | ||
feaa7bba | 159 | error = acl_get(GFS2_I(inode), ACL_ACCESS, &acl, NULL, NULL, NULL); |
b3b94faa DT |
160 | if (error) |
161 | return error; | |
162 | ||
163 | if (acl) { | |
164 | error = posix_acl_permission(inode, acl, mask); | |
165 | posix_acl_release(acl); | |
166 | return error; | |
167 | } | |
168 | ||
169 | return -EAGAIN; | |
170 | } | |
171 | ||
b3b94faa DT |
172 | static int munge_mode(struct gfs2_inode *ip, mode_t mode) |
173 | { | |
feaa7bba | 174 | struct gfs2_sbd *sdp = GFS2_SB(&ip->i_inode); |
b3b94faa DT |
175 | struct buffer_head *dibh; |
176 | int error; | |
177 | ||
178 | error = gfs2_trans_begin(sdp, RES_DINODE, 0); | |
179 | if (error) | |
180 | return error; | |
181 | ||
182 | error = gfs2_meta_inode_buffer(ip, &dibh); | |
183 | if (!error) { | |
184 | gfs2_assert_withdraw(sdp, | |
b60623c2 SW |
185 | (ip->i_inode.i_mode & S_IFMT) == (mode & S_IFMT)); |
186 | ip->i_inode.i_mode = mode; | |
d4e9c4c3 | 187 | gfs2_trans_add_bh(ip->i_gl, dibh, 1); |
539e5d6b | 188 | gfs2_dinode_out(ip, dibh->b_data); |
b3b94faa DT |
189 | brelse(dibh); |
190 | } | |
191 | ||
192 | gfs2_trans_end(sdp); | |
193 | ||
194 | return 0; | |
195 | } | |
196 | ||
197 | int gfs2_acl_create(struct gfs2_inode *dip, struct gfs2_inode *ip) | |
198 | { | |
feaa7bba | 199 | struct gfs2_sbd *sdp = GFS2_SB(&dip->i_inode); |
b3b94faa DT |
200 | struct posix_acl *acl = NULL, *clone; |
201 | struct gfs2_ea_request er; | |
b60623c2 | 202 | mode_t mode = ip->i_inode.i_mode; |
b3b94faa DT |
203 | int error; |
204 | ||
205 | if (!sdp->sd_args.ar_posix_acl) | |
206 | return 0; | |
b60623c2 | 207 | if (S_ISLNK(ip->i_inode.i_mode)) |
b3b94faa DT |
208 | return 0; |
209 | ||
210 | memset(&er, 0, sizeof(struct gfs2_ea_request)); | |
211 | er.er_type = GFS2_EATYPE_SYS; | |
212 | ||
213 | error = acl_get(dip, ACL_DEFAULT, &acl, NULL, | |
214 | &er.er_data, &er.er_data_len); | |
215 | if (error) | |
216 | return error; | |
217 | if (!acl) { | |
ce3b0f8d | 218 | mode &= ~current_umask(); |
b60623c2 | 219 | if (mode != ip->i_inode.i_mode) |
b3b94faa DT |
220 | error = munge_mode(ip, mode); |
221 | return error; | |
222 | } | |
223 | ||
16c5f06f | 224 | clone = posix_acl_clone(acl, GFP_NOFS); |
b3b94faa DT |
225 | error = -ENOMEM; |
226 | if (!clone) | |
227 | goto out; | |
228 | posix_acl_release(acl); | |
229 | acl = clone; | |
230 | ||
b60623c2 | 231 | if (S_ISDIR(ip->i_inode.i_mode)) { |
b3b94faa DT |
232 | er.er_name = GFS2_POSIX_ACL_DEFAULT; |
233 | er.er_name_len = GFS2_POSIX_ACL_DEFAULT_LEN; | |
234 | error = gfs2_system_eaops.eo_set(ip, &er); | |
235 | if (error) | |
236 | goto out; | |
237 | } | |
238 | ||
239 | error = posix_acl_create_masq(acl, &mode); | |
240 | if (error < 0) | |
241 | goto out; | |
242 | if (error > 0) { | |
243 | er.er_name = GFS2_POSIX_ACL_ACCESS; | |
244 | er.er_name_len = GFS2_POSIX_ACL_ACCESS_LEN; | |
245 | posix_acl_to_xattr(acl, er.er_data, er.er_data_len); | |
246 | er.er_mode = mode; | |
247 | er.er_flags = GFS2_ERF_MODE; | |
248 | error = gfs2_system_eaops.eo_set(ip, &er); | |
249 | if (error) | |
250 | goto out; | |
251 | } else | |
252 | munge_mode(ip, mode); | |
253 | ||
a91ea69f | 254 | out: |
b3b94faa DT |
255 | posix_acl_release(acl); |
256 | kfree(er.er_data); | |
257 | return error; | |
258 | } | |
259 | ||
260 | int gfs2_acl_chmod(struct gfs2_inode *ip, struct iattr *attr) | |
261 | { | |
262 | struct posix_acl *acl = NULL, *clone; | |
263 | struct gfs2_ea_location el; | |
264 | char *data; | |
265 | unsigned int len; | |
266 | int error; | |
267 | ||
268 | error = acl_get(ip, ACL_ACCESS, &acl, &el, &data, &len); | |
269 | if (error) | |
270 | return error; | |
271 | if (!acl) | |
272 | return gfs2_setattr_simple(ip, attr); | |
273 | ||
16c5f06f | 274 | clone = posix_acl_clone(acl, GFP_NOFS); |
b3b94faa DT |
275 | error = -ENOMEM; |
276 | if (!clone) | |
277 | goto out; | |
278 | posix_acl_release(acl); | |
279 | acl = clone; | |
280 | ||
281 | error = posix_acl_chmod_masq(acl, attr->ia_mode); | |
282 | if (!error) { | |
283 | posix_acl_to_xattr(acl, data, len); | |
284 | error = gfs2_ea_acl_chmod(ip, &el, attr, data); | |
285 | } | |
286 | ||
a91ea69f | 287 | out: |
b3b94faa DT |
288 | posix_acl_release(acl); |
289 | brelse(el.el_bh); | |
290 | kfree(data); | |
b3b94faa DT |
291 | return error; |
292 | } | |
293 |