]>
Commit | Line | Data |
---|---|---|
1da177e4 | 1 | /* |
7b718769 NS |
2 | * Copyright (c) 2001-2002,2005 Silicon Graphics, Inc. |
3 | * All Rights Reserved. | |
1da177e4 | 4 | * |
7b718769 NS |
5 | * This program is free software; you can redistribute it and/or |
6 | * modify it under the terms of the GNU General Public License as | |
1da177e4 LT |
7 | * published by the Free Software Foundation. |
8 | * | |
7b718769 NS |
9 | * This program is distributed in the hope that it would be useful, |
10 | * but WITHOUT ANY WARRANTY; without even the implied warranty of | |
11 | * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | |
12 | * GNU General Public License for more details. | |
1da177e4 | 13 | * |
7b718769 NS |
14 | * You should have received a copy of the GNU General Public License |
15 | * along with this program; if not, write the Free Software Foundation, | |
16 | * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA | |
1da177e4 | 17 | */ |
1da177e4 | 18 | #include "xfs.h" |
a844f451 NS |
19 | #include "xfs_fs.h" |
20 | #include "xfs_types.h" | |
21 | #include "xfs_bit.h" | |
1da177e4 | 22 | #include "xfs_inum.h" |
a844f451 | 23 | #include "xfs_ag.h" |
1da177e4 | 24 | #include "xfs_dir2.h" |
1da177e4 | 25 | #include "xfs_bmap_btree.h" |
a844f451 | 26 | #include "xfs_alloc_btree.h" |
1da177e4 | 27 | #include "xfs_ialloc_btree.h" |
1da177e4 | 28 | #include "xfs_dir2_sf.h" |
a844f451 | 29 | #include "xfs_attr_sf.h" |
1da177e4 LT |
30 | #include "xfs_dinode.h" |
31 | #include "xfs_inode.h" | |
a844f451 | 32 | #include "xfs_btree.h" |
1da177e4 | 33 | #include "xfs_acl.h" |
1da177e4 | 34 | #include "xfs_attr.h" |
739bfb2a | 35 | #include "xfs_vnodeops.h" |
1da177e4 | 36 | |
16f7e0fe | 37 | #include <linux/capability.h> |
1da177e4 LT |
38 | #include <linux/posix_acl_xattr.h> |
39 | ||
67fcaa73 | 40 | STATIC int xfs_acl_setmode(bhv_vnode_t *, xfs_acl_t *, int *); |
1da177e4 LT |
41 | STATIC void xfs_acl_filter_mode(mode_t, xfs_acl_t *); |
42 | STATIC void xfs_acl_get_endian(xfs_acl_t *); | |
43 | STATIC int xfs_acl_access(uid_t, gid_t, xfs_acl_t *, mode_t, cred_t *); | |
44 | STATIC int xfs_acl_invalid(xfs_acl_t *); | |
45 | STATIC void xfs_acl_sync_mode(mode_t, xfs_acl_t *); | |
67fcaa73 NS |
46 | STATIC void xfs_acl_get_attr(bhv_vnode_t *, xfs_acl_t *, int, int, int *); |
47 | STATIC void xfs_acl_set_attr(bhv_vnode_t *, xfs_acl_t *, int, int *); | |
48 | STATIC int xfs_acl_allow_set(bhv_vnode_t *, int); | |
1da177e4 LT |
49 | |
50 | kmem_zone_t *xfs_acl_zone; | |
51 | ||
52 | ||
53 | /* | |
54 | * Test for existence of access ACL attribute as efficiently as possible. | |
55 | */ | |
56 | int | |
57 | xfs_acl_vhasacl_access( | |
67fcaa73 | 58 | bhv_vnode_t *vp) |
1da177e4 LT |
59 | { |
60 | int error; | |
61 | ||
62 | xfs_acl_get_attr(vp, NULL, _ACL_TYPE_ACCESS, ATTR_KERNOVAL, &error); | |
63 | return (error == 0); | |
64 | } | |
65 | ||
66 | /* | |
67 | * Test for existence of default ACL attribute as efficiently as possible. | |
68 | */ | |
69 | int | |
70 | xfs_acl_vhasacl_default( | |
67fcaa73 | 71 | bhv_vnode_t *vp) |
1da177e4 LT |
72 | { |
73 | int error; | |
74 | ||
0432dab2 | 75 | if (!VN_ISDIR(vp)) |
1da177e4 LT |
76 | return 0; |
77 | xfs_acl_get_attr(vp, NULL, _ACL_TYPE_DEFAULT, ATTR_KERNOVAL, &error); | |
78 | return (error == 0); | |
79 | } | |
80 | ||
81 | /* | |
82 | * Convert from extended attribute representation to in-memory for XFS. | |
83 | */ | |
84 | STATIC int | |
85 | posix_acl_xattr_to_xfs( | |
86 | posix_acl_xattr_header *src, | |
87 | size_t size, | |
88 | xfs_acl_t *dest) | |
89 | { | |
90 | posix_acl_xattr_entry *src_entry; | |
91 | xfs_acl_entry_t *dest_entry; | |
92 | int n; | |
93 | ||
94 | if (!src || !dest) | |
95 | return EINVAL; | |
96 | ||
97 | if (size < sizeof(posix_acl_xattr_header)) | |
98 | return EINVAL; | |
99 | ||
100 | if (src->a_version != cpu_to_le32(POSIX_ACL_XATTR_VERSION)) | |
101 | return EOPNOTSUPP; | |
102 | ||
103 | memset(dest, 0, sizeof(xfs_acl_t)); | |
104 | dest->acl_cnt = posix_acl_xattr_count(size); | |
105 | if (dest->acl_cnt < 0 || dest->acl_cnt > XFS_ACL_MAX_ENTRIES) | |
106 | return EINVAL; | |
107 | ||
108 | /* | |
109 | * acl_set_file(3) may request that we set default ACLs with | |
110 | * zero length -- defend (gracefully) against that here. | |
111 | */ | |
112 | if (!dest->acl_cnt) | |
113 | return 0; | |
114 | ||
115 | src_entry = (posix_acl_xattr_entry *)((char *)src + sizeof(*src)); | |
116 | dest_entry = &dest->acl_entry[0]; | |
117 | ||
118 | for (n = 0; n < dest->acl_cnt; n++, src_entry++, dest_entry++) { | |
119 | dest_entry->ae_perm = le16_to_cpu(src_entry->e_perm); | |
120 | if (_ACL_PERM_INVALID(dest_entry->ae_perm)) | |
121 | return EINVAL; | |
122 | dest_entry->ae_tag = le16_to_cpu(src_entry->e_tag); | |
123 | switch(dest_entry->ae_tag) { | |
124 | case ACL_USER: | |
125 | case ACL_GROUP: | |
126 | dest_entry->ae_id = le32_to_cpu(src_entry->e_id); | |
127 | break; | |
128 | case ACL_USER_OBJ: | |
129 | case ACL_GROUP_OBJ: | |
130 | case ACL_MASK: | |
131 | case ACL_OTHER: | |
132 | dest_entry->ae_id = ACL_UNDEFINED_ID; | |
133 | break; | |
134 | default: | |
135 | return EINVAL; | |
136 | } | |
137 | } | |
138 | if (xfs_acl_invalid(dest)) | |
139 | return EINVAL; | |
140 | ||
141 | return 0; | |
142 | } | |
143 | ||
144 | /* | |
380b5dc0 | 145 | * Comparison function called from xfs_sort(). |
1da177e4 LT |
146 | * Primary key is ae_tag, secondary key is ae_id. |
147 | */ | |
148 | STATIC int | |
149 | xfs_acl_entry_compare( | |
150 | const void *va, | |
151 | const void *vb) | |
152 | { | |
153 | xfs_acl_entry_t *a = (xfs_acl_entry_t *)va, | |
154 | *b = (xfs_acl_entry_t *)vb; | |
155 | ||
156 | if (a->ae_tag == b->ae_tag) | |
157 | return (a->ae_id - b->ae_id); | |
158 | return (a->ae_tag - b->ae_tag); | |
159 | } | |
160 | ||
161 | /* | |
162 | * Convert from in-memory XFS to extended attribute representation. | |
163 | */ | |
164 | STATIC int | |
165 | posix_acl_xfs_to_xattr( | |
166 | xfs_acl_t *src, | |
167 | posix_acl_xattr_header *dest, | |
168 | size_t size) | |
169 | { | |
170 | int n; | |
171 | size_t new_size = posix_acl_xattr_size(src->acl_cnt); | |
172 | posix_acl_xattr_entry *dest_entry; | |
173 | xfs_acl_entry_t *src_entry; | |
174 | ||
175 | if (size < new_size) | |
176 | return -ERANGE; | |
177 | ||
178 | /* Need to sort src XFS ACL by <ae_tag,ae_id> */ | |
380b5dc0 NS |
179 | xfs_sort(src->acl_entry, src->acl_cnt, sizeof(src->acl_entry[0]), |
180 | xfs_acl_entry_compare); | |
1da177e4 LT |
181 | |
182 | dest->a_version = cpu_to_le32(POSIX_ACL_XATTR_VERSION); | |
183 | dest_entry = &dest->a_entries[0]; | |
184 | src_entry = &src->acl_entry[0]; | |
185 | for (n = 0; n < src->acl_cnt; n++, dest_entry++, src_entry++) { | |
186 | dest_entry->e_perm = cpu_to_le16(src_entry->ae_perm); | |
187 | if (_ACL_PERM_INVALID(src_entry->ae_perm)) | |
188 | return -EINVAL; | |
189 | dest_entry->e_tag = cpu_to_le16(src_entry->ae_tag); | |
190 | switch (src_entry->ae_tag) { | |
191 | case ACL_USER: | |
192 | case ACL_GROUP: | |
193 | dest_entry->e_id = cpu_to_le32(src_entry->ae_id); | |
194 | break; | |
195 | case ACL_USER_OBJ: | |
196 | case ACL_GROUP_OBJ: | |
197 | case ACL_MASK: | |
198 | case ACL_OTHER: | |
199 | dest_entry->e_id = cpu_to_le32(ACL_UNDEFINED_ID); | |
200 | break; | |
201 | default: | |
202 | return -EINVAL; | |
203 | } | |
204 | } | |
205 | return new_size; | |
206 | } | |
207 | ||
208 | int | |
209 | xfs_acl_vget( | |
67fcaa73 | 210 | bhv_vnode_t *vp, |
1da177e4 LT |
211 | void *acl, |
212 | size_t size, | |
213 | int kind) | |
214 | { | |
215 | int error; | |
216 | xfs_acl_t *xfs_acl = NULL; | |
217 | posix_acl_xattr_header *ext_acl = acl; | |
218 | int flags = 0; | |
219 | ||
220 | VN_HOLD(vp); | |
221 | if(size) { | |
222 | if (!(_ACL_ALLOC(xfs_acl))) { | |
223 | error = ENOMEM; | |
224 | goto out; | |
225 | } | |
226 | memset(xfs_acl, 0, sizeof(xfs_acl_t)); | |
227 | } else | |
228 | flags = ATTR_KERNOVAL; | |
229 | ||
230 | xfs_acl_get_attr(vp, xfs_acl, kind, flags, &error); | |
231 | if (error) | |
232 | goto out; | |
233 | ||
234 | if (!size) { | |
235 | error = -posix_acl_xattr_size(XFS_ACL_MAX_ENTRIES); | |
236 | } else { | |
237 | if (xfs_acl_invalid(xfs_acl)) { | |
238 | error = EINVAL; | |
239 | goto out; | |
240 | } | |
241 | if (kind == _ACL_TYPE_ACCESS) { | |
8285fb58 | 242 | bhv_vattr_t va; |
1da177e4 LT |
243 | |
244 | va.va_mask = XFS_AT_MODE; | |
739bfb2a | 245 | error = xfs_getattr(xfs_vtoi(vp), &va, 0); |
1da177e4 LT |
246 | if (error) |
247 | goto out; | |
248 | xfs_acl_sync_mode(va.va_mode, xfs_acl); | |
249 | } | |
250 | error = -posix_acl_xfs_to_xattr(xfs_acl, ext_acl, size); | |
251 | } | |
252 | out: | |
253 | VN_RELE(vp); | |
254 | if(xfs_acl) | |
255 | _ACL_FREE(xfs_acl); | |
256 | return -error; | |
257 | } | |
258 | ||
259 | int | |
260 | xfs_acl_vremove( | |
67fcaa73 | 261 | bhv_vnode_t *vp, |
1da177e4 LT |
262 | int kind) |
263 | { | |
264 | int error; | |
265 | ||
266 | VN_HOLD(vp); | |
267 | error = xfs_acl_allow_set(vp, kind); | |
268 | if (!error) { | |
739bfb2a CH |
269 | error = xfs_attr_remove(xfs_vtoi(vp), |
270 | kind == _ACL_TYPE_DEFAULT? | |
67fcaa73 | 271 | SGI_ACL_DEFAULT: SGI_ACL_FILE, |
739bfb2a | 272 | ATTR_ROOT); |
1da177e4 LT |
273 | if (error == ENOATTR) |
274 | error = 0; /* 'scool */ | |
275 | } | |
276 | VN_RELE(vp); | |
277 | return -error; | |
278 | } | |
279 | ||
280 | int | |
281 | xfs_acl_vset( | |
67fcaa73 | 282 | bhv_vnode_t *vp, |
1da177e4 LT |
283 | void *acl, |
284 | size_t size, | |
285 | int kind) | |
286 | { | |
287 | posix_acl_xattr_header *ext_acl = acl; | |
288 | xfs_acl_t *xfs_acl; | |
289 | int error; | |
290 | int basicperms = 0; /* more than std unix perms? */ | |
291 | ||
292 | if (!acl) | |
293 | return -EINVAL; | |
294 | ||
295 | if (!(_ACL_ALLOC(xfs_acl))) | |
296 | return -ENOMEM; | |
297 | ||
298 | error = posix_acl_xattr_to_xfs(ext_acl, size, xfs_acl); | |
299 | if (error) { | |
300 | _ACL_FREE(xfs_acl); | |
301 | return -error; | |
302 | } | |
303 | if (!xfs_acl->acl_cnt) { | |
304 | _ACL_FREE(xfs_acl); | |
305 | return 0; | |
306 | } | |
307 | ||
308 | VN_HOLD(vp); | |
309 | error = xfs_acl_allow_set(vp, kind); | |
310 | if (error) | |
311 | goto out; | |
312 | ||
313 | /* Incoming ACL exists, set file mode based on its value */ | |
314 | if (kind == _ACL_TYPE_ACCESS) | |
315 | xfs_acl_setmode(vp, xfs_acl, &basicperms); | |
316 | ||
317 | /* | |
318 | * If we have more than std unix permissions, set up the actual attr. | |
319 | * Otherwise, delete any existing attr. This prevents us from | |
320 | * having actual attrs for permissions that can be stored in the | |
321 | * standard permission bits. | |
322 | */ | |
323 | if (!basicperms) { | |
324 | xfs_acl_set_attr(vp, xfs_acl, kind, &error); | |
325 | } else { | |
326 | xfs_acl_vremove(vp, _ACL_TYPE_ACCESS); | |
327 | } | |
328 | ||
329 | out: | |
330 | VN_RELE(vp); | |
331 | _ACL_FREE(xfs_acl); | |
332 | return -error; | |
333 | } | |
334 | ||
335 | int | |
336 | xfs_acl_iaccess( | |
337 | xfs_inode_t *ip, | |
338 | mode_t mode, | |
339 | cred_t *cr) | |
340 | { | |
341 | xfs_acl_t *acl; | |
342 | int rval; | |
343 | ||
344 | if (!(_ACL_ALLOC(acl))) | |
345 | return -1; | |
346 | ||
347 | /* If the file has no ACL return -1. */ | |
348 | rval = sizeof(xfs_acl_t); | |
349 | if (xfs_attr_fetch(ip, SGI_ACL_FILE, SGI_ACL_FILE_SIZE, | |
350 | (char *)acl, &rval, ATTR_ROOT | ATTR_KERNACCESS, cr)) { | |
351 | _ACL_FREE(acl); | |
352 | return -1; | |
353 | } | |
354 | xfs_acl_get_endian(acl); | |
355 | ||
356 | /* If the file has an empty ACL return -1. */ | |
357 | if (acl->acl_cnt == XFS_ACL_NOT_PRESENT) { | |
358 | _ACL_FREE(acl); | |
359 | return -1; | |
360 | } | |
361 | ||
362 | /* Synchronize ACL with mode bits */ | |
363 | xfs_acl_sync_mode(ip->i_d.di_mode, acl); | |
364 | ||
365 | rval = xfs_acl_access(ip->i_d.di_uid, ip->i_d.di_gid, acl, mode, cr); | |
366 | _ACL_FREE(acl); | |
367 | return rval; | |
368 | } | |
369 | ||
370 | STATIC int | |
371 | xfs_acl_allow_set( | |
67fcaa73 | 372 | bhv_vnode_t *vp, |
1da177e4 LT |
373 | int kind) |
374 | { | |
2f6f7b3d | 375 | xfs_inode_t *ip = xfs_vtoi(vp); |
8285fb58 | 376 | bhv_vattr_t va; |
1da177e4 LT |
377 | int error; |
378 | ||
0a74cd19 | 379 | if (vp->i_flags & (S_IMMUTABLE|S_APPEND)) |
1da177e4 | 380 | return EPERM; |
0432dab2 | 381 | if (kind == _ACL_TYPE_DEFAULT && !VN_ISDIR(vp)) |
1da177e4 | 382 | return ENOTDIR; |
0a74cd19 | 383 | if (vp->i_sb->s_flags & MS_RDONLY) |
1da177e4 LT |
384 | return EROFS; |
385 | va.va_mask = XFS_AT_UID; | |
2f6f7b3d | 386 | error = xfs_getattr(ip, &va, 0); |
1da177e4 LT |
387 | if (error) |
388 | return error; | |
389 | if (va.va_uid != current->fsuid && !capable(CAP_FOWNER)) | |
390 | return EPERM; | |
391 | return error; | |
392 | } | |
393 | ||
394 | /* | |
395 | * The access control process to determine the access permission: | |
396 | * if uid == file owner id, use the file owner bits. | |
397 | * if gid == file owner group id, use the file group bits. | |
c41564b5 | 398 | * scan ACL for a matching user or group, and use matched entry |
1da177e4 LT |
399 | * permission. Use total permissions of all matching group entries, |
400 | * until all acl entries are exhausted. The final permission produced | |
401 | * by matching acl entry or entries needs to be & with group permission. | |
402 | * if not owner, owning group, or matching entry in ACL, use file | |
403 | * other bits. | |
404 | */ | |
405 | STATIC int | |
406 | xfs_acl_capability_check( | |
407 | mode_t mode, | |
408 | cred_t *cr) | |
409 | { | |
410 | if ((mode & ACL_READ) && !capable_cred(cr, CAP_DAC_READ_SEARCH)) | |
411 | return EACCES; | |
412 | if ((mode & ACL_WRITE) && !capable_cred(cr, CAP_DAC_OVERRIDE)) | |
413 | return EACCES; | |
414 | if ((mode & ACL_EXECUTE) && !capable_cred(cr, CAP_DAC_OVERRIDE)) | |
415 | return EACCES; | |
416 | ||
417 | return 0; | |
418 | } | |
419 | ||
420 | /* | |
421 | * Note: cr is only used here for the capability check if the ACL test fails. | |
422 | * It is not used to find out the credentials uid or groups etc, as was | |
423 | * done in IRIX. It is assumed that the uid and groups for the current | |
424 | * thread are taken from "current" instead of the cr parameter. | |
425 | */ | |
426 | STATIC int | |
427 | xfs_acl_access( | |
428 | uid_t fuid, | |
429 | gid_t fgid, | |
430 | xfs_acl_t *fap, | |
431 | mode_t md, | |
432 | cred_t *cr) | |
433 | { | |
434 | xfs_acl_entry_t matched; | |
435 | int i, allows; | |
436 | int maskallows = -1; /* true, but not 1, either */ | |
437 | int seen_userobj = 0; | |
438 | ||
439 | matched.ae_tag = 0; /* Invalid type */ | |
5bde1ba9 | 440 | matched.ae_perm = 0; |
1da177e4 LT |
441 | md >>= 6; /* Normalize the bits for comparison */ |
442 | ||
443 | for (i = 0; i < fap->acl_cnt; i++) { | |
444 | /* | |
445 | * Break out if we've got a user_obj entry or | |
446 | * a user entry and the mask (and have processed USER_OBJ) | |
447 | */ | |
448 | if (matched.ae_tag == ACL_USER_OBJ) | |
449 | break; | |
450 | if (matched.ae_tag == ACL_USER) { | |
451 | if (maskallows != -1 && seen_userobj) | |
452 | break; | |
453 | if (fap->acl_entry[i].ae_tag != ACL_MASK && | |
454 | fap->acl_entry[i].ae_tag != ACL_USER_OBJ) | |
455 | continue; | |
456 | } | |
457 | /* True if this entry allows the requested access */ | |
458 | allows = ((fap->acl_entry[i].ae_perm & md) == md); | |
459 | ||
460 | switch (fap->acl_entry[i].ae_tag) { | |
461 | case ACL_USER_OBJ: | |
462 | seen_userobj = 1; | |
463 | if (fuid != current->fsuid) | |
464 | continue; | |
465 | matched.ae_tag = ACL_USER_OBJ; | |
466 | matched.ae_perm = allows; | |
467 | break; | |
468 | case ACL_USER: | |
469 | if (fap->acl_entry[i].ae_id != current->fsuid) | |
470 | continue; | |
471 | matched.ae_tag = ACL_USER; | |
472 | matched.ae_perm = allows; | |
473 | break; | |
474 | case ACL_GROUP_OBJ: | |
475 | if ((matched.ae_tag == ACL_GROUP_OBJ || | |
476 | matched.ae_tag == ACL_GROUP) && !allows) | |
477 | continue; | |
478 | if (!in_group_p(fgid)) | |
479 | continue; | |
480 | matched.ae_tag = ACL_GROUP_OBJ; | |
481 | matched.ae_perm = allows; | |
482 | break; | |
483 | case ACL_GROUP: | |
484 | if ((matched.ae_tag == ACL_GROUP_OBJ || | |
485 | matched.ae_tag == ACL_GROUP) && !allows) | |
486 | continue; | |
487 | if (!in_group_p(fap->acl_entry[i].ae_id)) | |
488 | continue; | |
489 | matched.ae_tag = ACL_GROUP; | |
490 | matched.ae_perm = allows; | |
491 | break; | |
492 | case ACL_MASK: | |
493 | maskallows = allows; | |
494 | break; | |
495 | case ACL_OTHER: | |
496 | if (matched.ae_tag != 0) | |
497 | continue; | |
498 | matched.ae_tag = ACL_OTHER; | |
499 | matched.ae_perm = allows; | |
500 | break; | |
501 | } | |
502 | } | |
503 | /* | |
504 | * First possibility is that no matched entry allows access. | |
505 | * The capability to override DAC may exist, so check for it. | |
506 | */ | |
507 | switch (matched.ae_tag) { | |
508 | case ACL_OTHER: | |
509 | case ACL_USER_OBJ: | |
510 | if (matched.ae_perm) | |
511 | return 0; | |
512 | break; | |
513 | case ACL_USER: | |
514 | case ACL_GROUP_OBJ: | |
515 | case ACL_GROUP: | |
516 | if (maskallows && matched.ae_perm) | |
517 | return 0; | |
518 | break; | |
519 | case 0: | |
520 | break; | |
521 | } | |
522 | ||
523 | return xfs_acl_capability_check(md, cr); | |
524 | } | |
525 | ||
526 | /* | |
527 | * ACL validity checker. | |
528 | * This acl validation routine checks each ACL entry read in makes sense. | |
529 | */ | |
530 | STATIC int | |
531 | xfs_acl_invalid( | |
532 | xfs_acl_t *aclp) | |
533 | { | |
534 | xfs_acl_entry_t *entry, *e; | |
535 | int user = 0, group = 0, other = 0, mask = 0; | |
536 | int mask_required = 0; | |
537 | int i, j; | |
538 | ||
539 | if (!aclp) | |
540 | goto acl_invalid; | |
541 | ||
542 | if (aclp->acl_cnt > XFS_ACL_MAX_ENTRIES) | |
543 | goto acl_invalid; | |
544 | ||
545 | for (i = 0; i < aclp->acl_cnt; i++) { | |
546 | entry = &aclp->acl_entry[i]; | |
547 | switch (entry->ae_tag) { | |
548 | case ACL_USER_OBJ: | |
549 | if (user++) | |
550 | goto acl_invalid; | |
551 | break; | |
552 | case ACL_GROUP_OBJ: | |
553 | if (group++) | |
554 | goto acl_invalid; | |
555 | break; | |
556 | case ACL_OTHER: | |
557 | if (other++) | |
558 | goto acl_invalid; | |
559 | break; | |
560 | case ACL_USER: | |
561 | case ACL_GROUP: | |
562 | for (j = i + 1; j < aclp->acl_cnt; j++) { | |
563 | e = &aclp->acl_entry[j]; | |
564 | if (e->ae_id == entry->ae_id && | |
565 | e->ae_tag == entry->ae_tag) | |
566 | goto acl_invalid; | |
567 | } | |
568 | mask_required++; | |
569 | break; | |
570 | case ACL_MASK: | |
571 | if (mask++) | |
572 | goto acl_invalid; | |
573 | break; | |
574 | default: | |
575 | goto acl_invalid; | |
576 | } | |
577 | } | |
578 | if (!user || !group || !other || (mask_required && !mask)) | |
579 | goto acl_invalid; | |
580 | else | |
581 | return 0; | |
582 | acl_invalid: | |
583 | return EINVAL; | |
584 | } | |
585 | ||
586 | /* | |
587 | * Do ACL endian conversion. | |
588 | */ | |
589 | STATIC void | |
590 | xfs_acl_get_endian( | |
591 | xfs_acl_t *aclp) | |
592 | { | |
593 | xfs_acl_entry_t *ace, *end; | |
594 | ||
595 | INT_SET(aclp->acl_cnt, ARCH_CONVERT, aclp->acl_cnt); | |
596 | end = &aclp->acl_entry[0]+aclp->acl_cnt; | |
597 | for (ace = &aclp->acl_entry[0]; ace < end; ace++) { | |
598 | INT_SET(ace->ae_tag, ARCH_CONVERT, ace->ae_tag); | |
599 | INT_SET(ace->ae_id, ARCH_CONVERT, ace->ae_id); | |
600 | INT_SET(ace->ae_perm, ARCH_CONVERT, ace->ae_perm); | |
601 | } | |
602 | } | |
603 | ||
604 | /* | |
605 | * Get the ACL from the EA and do endian conversion. | |
606 | */ | |
607 | STATIC void | |
608 | xfs_acl_get_attr( | |
67fcaa73 | 609 | bhv_vnode_t *vp, |
1da177e4 LT |
610 | xfs_acl_t *aclp, |
611 | int kind, | |
612 | int flags, | |
613 | int *error) | |
614 | { | |
615 | int len = sizeof(xfs_acl_t); | |
616 | ||
617 | ASSERT((flags & ATTR_KERNOVAL) ? (aclp == NULL) : 1); | |
618 | flags |= ATTR_ROOT; | |
739bfb2a CH |
619 | *error = xfs_attr_get(xfs_vtoi(vp), |
620 | kind == _ACL_TYPE_ACCESS ? | |
67fcaa73 NS |
621 | SGI_ACL_FILE : SGI_ACL_DEFAULT, |
622 | (char *)aclp, &len, flags, sys_cred); | |
1da177e4 LT |
623 | if (*error || (flags & ATTR_KERNOVAL)) |
624 | return; | |
625 | xfs_acl_get_endian(aclp); | |
626 | } | |
627 | ||
628 | /* | |
629 | * Set the EA with the ACL and do endian conversion. | |
630 | */ | |
631 | STATIC void | |
632 | xfs_acl_set_attr( | |
67fcaa73 | 633 | bhv_vnode_t *vp, |
1da177e4 LT |
634 | xfs_acl_t *aclp, |
635 | int kind, | |
636 | int *error) | |
637 | { | |
638 | xfs_acl_entry_t *ace, *newace, *end; | |
639 | xfs_acl_t *newacl; | |
640 | int len; | |
641 | ||
642 | if (!(_ACL_ALLOC(newacl))) { | |
643 | *error = ENOMEM; | |
644 | return; | |
645 | } | |
646 | ||
647 | len = sizeof(xfs_acl_t) - | |
648 | (sizeof(xfs_acl_entry_t) * (XFS_ACL_MAX_ENTRIES - aclp->acl_cnt)); | |
649 | end = &aclp->acl_entry[0]+aclp->acl_cnt; | |
650 | for (ace = &aclp->acl_entry[0], newace = &newacl->acl_entry[0]; | |
651 | ace < end; | |
652 | ace++, newace++) { | |
653 | INT_SET(newace->ae_tag, ARCH_CONVERT, ace->ae_tag); | |
654 | INT_SET(newace->ae_id, ARCH_CONVERT, ace->ae_id); | |
655 | INT_SET(newace->ae_perm, ARCH_CONVERT, ace->ae_perm); | |
656 | } | |
657 | INT_SET(newacl->acl_cnt, ARCH_CONVERT, aclp->acl_cnt); | |
739bfb2a CH |
658 | *error = xfs_attr_set(xfs_vtoi(vp), |
659 | kind == _ACL_TYPE_ACCESS ? | |
67fcaa73 | 660 | SGI_ACL_FILE: SGI_ACL_DEFAULT, |
739bfb2a | 661 | (char *)newacl, len, ATTR_ROOT); |
1da177e4 LT |
662 | _ACL_FREE(newacl); |
663 | } | |
664 | ||
665 | int | |
666 | xfs_acl_vtoacl( | |
67fcaa73 | 667 | bhv_vnode_t *vp, |
1da177e4 LT |
668 | xfs_acl_t *access_acl, |
669 | xfs_acl_t *default_acl) | |
670 | { | |
8285fb58 | 671 | bhv_vattr_t va; |
1da177e4 LT |
672 | int error = 0; |
673 | ||
674 | if (access_acl) { | |
675 | /* | |
676 | * Get the Access ACL and the mode. If either cannot | |
677 | * be obtained for some reason, invalidate the access ACL. | |
678 | */ | |
679 | xfs_acl_get_attr(vp, access_acl, _ACL_TYPE_ACCESS, 0, &error); | |
680 | if (!error) { | |
681 | /* Got the ACL, need the mode... */ | |
682 | va.va_mask = XFS_AT_MODE; | |
739bfb2a | 683 | error = xfs_getattr(xfs_vtoi(vp), &va, 0); |
1da177e4 LT |
684 | } |
685 | ||
686 | if (error) | |
687 | access_acl->acl_cnt = XFS_ACL_NOT_PRESENT; | |
688 | else /* We have a good ACL and the file mode, synchronize. */ | |
689 | xfs_acl_sync_mode(va.va_mode, access_acl); | |
690 | } | |
691 | ||
692 | if (default_acl) { | |
693 | xfs_acl_get_attr(vp, default_acl, _ACL_TYPE_DEFAULT, 0, &error); | |
694 | if (error) | |
695 | default_acl->acl_cnt = XFS_ACL_NOT_PRESENT; | |
696 | } | |
697 | return error; | |
698 | } | |
699 | ||
700 | /* | |
701 | * This function retrieves the parent directory's acl, processes it | |
702 | * and lets the child inherit the acl(s) that it should. | |
703 | */ | |
704 | int | |
705 | xfs_acl_inherit( | |
67fcaa73 | 706 | bhv_vnode_t *vp, |
8285fb58 | 707 | bhv_vattr_t *vap, |
1da177e4 LT |
708 | xfs_acl_t *pdaclp) |
709 | { | |
710 | xfs_acl_t *cacl; | |
711 | int error = 0; | |
712 | int basicperms = 0; | |
713 | ||
714 | /* | |
715 | * If the parent does not have a default ACL, or it's an | |
716 | * invalid ACL, we're done. | |
717 | */ | |
718 | if (!vp) | |
719 | return 0; | |
720 | if (!pdaclp || xfs_acl_invalid(pdaclp)) | |
721 | return 0; | |
722 | ||
723 | /* | |
724 | * Copy the default ACL of the containing directory to | |
725 | * the access ACL of the new file and use the mode that | |
726 | * was passed in to set up the correct initial values for | |
727 | * the u::,g::[m::], and o:: entries. This is what makes | |
728 | * umask() "work" with ACL's. | |
729 | */ | |
730 | ||
731 | if (!(_ACL_ALLOC(cacl))) | |
732 | return ENOMEM; | |
733 | ||
734 | memcpy(cacl, pdaclp, sizeof(xfs_acl_t)); | |
735 | xfs_acl_filter_mode(vap->va_mode, cacl); | |
736 | xfs_acl_setmode(vp, cacl, &basicperms); | |
737 | ||
738 | /* | |
739 | * Set the Default and Access ACL on the file. The mode is already | |
740 | * set on the file, so we don't need to worry about that. | |
741 | * | |
742 | * If the new file is a directory, its default ACL is a copy of | |
743 | * the containing directory's default ACL. | |
744 | */ | |
0432dab2 | 745 | if (VN_ISDIR(vp)) |
1da177e4 LT |
746 | xfs_acl_set_attr(vp, pdaclp, _ACL_TYPE_DEFAULT, &error); |
747 | if (!error && !basicperms) | |
748 | xfs_acl_set_attr(vp, cacl, _ACL_TYPE_ACCESS, &error); | |
749 | _ACL_FREE(cacl); | |
750 | return error; | |
751 | } | |
752 | ||
753 | /* | |
754 | * Set up the correct mode on the file based on the supplied ACL. This | |
755 | * makes sure that the mode on the file reflects the state of the | |
756 | * u::,g::[m::], and o:: entries in the ACL. Since the mode is where | |
757 | * the ACL is going to get the permissions for these entries, we must | |
758 | * synchronize the mode whenever we set the ACL on a file. | |
759 | */ | |
760 | STATIC int | |
761 | xfs_acl_setmode( | |
67fcaa73 | 762 | bhv_vnode_t *vp, |
1da177e4 LT |
763 | xfs_acl_t *acl, |
764 | int *basicperms) | |
765 | { | |
8285fb58 | 766 | bhv_vattr_t va; |
1da177e4 LT |
767 | xfs_acl_entry_t *ap; |
768 | xfs_acl_entry_t *gap = NULL; | |
769 | int i, error, nomask = 1; | |
770 | ||
771 | *basicperms = 1; | |
772 | ||
773 | if (acl->acl_cnt == XFS_ACL_NOT_PRESENT) | |
774 | return 0; | |
775 | ||
776 | /* | |
777 | * Copy the u::, g::, o::, and m:: bits from the ACL into the | |
778 | * mode. The m:: bits take precedence over the g:: bits. | |
779 | */ | |
780 | va.va_mask = XFS_AT_MODE; | |
739bfb2a | 781 | error = xfs_getattr(xfs_vtoi(vp), &va, 0); |
1da177e4 LT |
782 | if (error) |
783 | return error; | |
784 | ||
785 | va.va_mask = XFS_AT_MODE; | |
786 | va.va_mode &= ~(S_IRWXU|S_IRWXG|S_IRWXO); | |
787 | ap = acl->acl_entry; | |
788 | for (i = 0; i < acl->acl_cnt; ++i) { | |
789 | switch (ap->ae_tag) { | |
790 | case ACL_USER_OBJ: | |
791 | va.va_mode |= ap->ae_perm << 6; | |
792 | break; | |
793 | case ACL_GROUP_OBJ: | |
794 | gap = ap; | |
795 | break; | |
796 | case ACL_MASK: /* more than just standard modes */ | |
797 | nomask = 0; | |
798 | va.va_mode |= ap->ae_perm << 3; | |
799 | *basicperms = 0; | |
800 | break; | |
801 | case ACL_OTHER: | |
802 | va.va_mode |= ap->ae_perm; | |
803 | break; | |
804 | default: /* more than just standard modes */ | |
805 | *basicperms = 0; | |
806 | break; | |
807 | } | |
808 | ap++; | |
809 | } | |
810 | ||
811 | /* Set the group bits from ACL_GROUP_OBJ if there's no ACL_MASK */ | |
812 | if (gap && nomask) | |
813 | va.va_mode |= gap->ae_perm << 3; | |
814 | ||
739bfb2a | 815 | return xfs_setattr(xfs_vtoi(vp), &va, 0, sys_cred); |
1da177e4 LT |
816 | } |
817 | ||
818 | /* | |
819 | * The permissions for the special ACL entries (u::, g::[m::], o::) are | |
820 | * actually stored in the file mode (if there is both a group and a mask, | |
821 | * the group is stored in the ACL entry and the mask is stored on the file). | |
822 | * This allows the mode to remain automatically in sync with the ACL without | |
823 | * the need for a call-back to the ACL system at every point where the mode | |
824 | * could change. This function takes the permissions from the specified mode | |
825 | * and places it in the supplied ACL. | |
826 | * | |
827 | * This implementation draws its validity from the fact that, when the ACL | |
828 | * was assigned, the mode was copied from the ACL. | |
829 | * If the mode did not change, therefore, the mode remains exactly what was | |
830 | * taken from the special ACL entries at assignment. | |
831 | * If a subsequent chmod() was done, the POSIX spec says that the change in | |
832 | * mode must cause an update to the ACL seen at user level and used for | |
833 | * access checks. Before and after a mode change, therefore, the file mode | |
834 | * most accurately reflects what the special ACL entries should permit/deny. | |
835 | * | |
836 | * CAVEAT: If someone sets the SGI_ACL_FILE attribute directly, | |
837 | * the existing mode bits will override whatever is in the | |
838 | * ACL. Similarly, if there is a pre-existing ACL that was | |
839 | * never in sync with its mode (owing to a bug in 6.5 and | |
840 | * before), it will now magically (or mystically) be | |
841 | * synchronized. This could cause slight astonishment, but | |
842 | * it is better than inconsistent permissions. | |
843 | * | |
844 | * The supplied ACL is a template that may contain any combination | |
845 | * of special entries. These are treated as place holders when we fill | |
846 | * out the ACL. This routine does not add or remove special entries, it | |
847 | * simply unites each special entry with its associated set of permissions. | |
848 | */ | |
849 | STATIC void | |
850 | xfs_acl_sync_mode( | |
851 | mode_t mode, | |
852 | xfs_acl_t *acl) | |
853 | { | |
854 | int i, nomask = 1; | |
855 | xfs_acl_entry_t *ap; | |
856 | xfs_acl_entry_t *gap = NULL; | |
857 | ||
858 | /* | |
859 | * Set ACL entries. POSIX1003.1eD16 requires that the MASK | |
860 | * be set instead of the GROUP entry, if there is a MASK. | |
861 | */ | |
862 | for (ap = acl->acl_entry, i = 0; i < acl->acl_cnt; ap++, i++) { | |
863 | switch (ap->ae_tag) { | |
864 | case ACL_USER_OBJ: | |
865 | ap->ae_perm = (mode >> 6) & 0x7; | |
866 | break; | |
867 | case ACL_GROUP_OBJ: | |
868 | gap = ap; | |
869 | break; | |
870 | case ACL_MASK: | |
871 | nomask = 0; | |
872 | ap->ae_perm = (mode >> 3) & 0x7; | |
873 | break; | |
874 | case ACL_OTHER: | |
875 | ap->ae_perm = mode & 0x7; | |
876 | break; | |
877 | default: | |
878 | break; | |
879 | } | |
880 | } | |
881 | /* Set the ACL_GROUP_OBJ if there's no ACL_MASK */ | |
882 | if (gap && nomask) | |
883 | gap->ae_perm = (mode >> 3) & 0x7; | |
884 | } | |
885 | ||
886 | /* | |
887 | * When inheriting an Access ACL from a directory Default ACL, | |
888 | * the ACL bits are set to the intersection of the ACL default | |
889 | * permission bits and the file permission bits in mode. If there | |
890 | * are no permission bits on the file then we must not give them | |
891 | * the ACL. This is what what makes umask() work with ACLs. | |
892 | */ | |
893 | STATIC void | |
894 | xfs_acl_filter_mode( | |
895 | mode_t mode, | |
896 | xfs_acl_t *acl) | |
897 | { | |
898 | int i, nomask = 1; | |
899 | xfs_acl_entry_t *ap; | |
900 | xfs_acl_entry_t *gap = NULL; | |
901 | ||
902 | /* | |
903 | * Set ACL entries. POSIX1003.1eD16 requires that the MASK | |
904 | * be merged with GROUP entry, if there is a MASK. | |
905 | */ | |
906 | for (ap = acl->acl_entry, i = 0; i < acl->acl_cnt; ap++, i++) { | |
907 | switch (ap->ae_tag) { | |
908 | case ACL_USER_OBJ: | |
909 | ap->ae_perm &= (mode >> 6) & 0x7; | |
910 | break; | |
911 | case ACL_GROUP_OBJ: | |
912 | gap = ap; | |
913 | break; | |
914 | case ACL_MASK: | |
915 | nomask = 0; | |
916 | ap->ae_perm &= (mode >> 3) & 0x7; | |
917 | break; | |
918 | case ACL_OTHER: | |
919 | ap->ae_perm &= mode & 0x7; | |
920 | break; | |
921 | default: | |
922 | break; | |
923 | } | |
924 | } | |
925 | /* Set the ACL_GROUP_OBJ if there's no ACL_MASK */ | |
926 | if (gap && nomask) | |
927 | gap->ae_perm &= (mode >> 3) & 0x7; | |
928 | } |