fs/gfs2/acl.c

   1 /*
   2  * Copyright (C) Sistina Software, Inc.  1997-2003 All rights reserved.
   3  * Copyright (C) 2004-2005 Red Hat, Inc.  All rights reserved.
   4  *
   5  * This copyrighted material is made available to anyone wishing to use,
   6  * modify, copy, or redistribute it subject to the terms and conditions
   7  * of the GNU General Public License v.2.
   8  */
   9
  10 #include <linux/sched.h>
  11 #include <linux/slab.h>
  12 #include <linux/spinlock.h>
  13 #include <linux/completion.h>
  14 #include <linux/buffer_head.h>
  15 #include <linux/posix_acl.h>
  16 #include <linux/posix_acl_xattr.h>
  17 #include <asm/semaphore.h>
  18 #include <linux/gfs2_ondisk.h>
  19
  20 #include "gfs2.h"
  21 #include "lm_interface.h"
  22 #include "incore.h"
  23 #include "acl.h"
  24 #include "eaops.h"
  25 #include "eattr.h"
  26 #include "glock.h"
  27 #include "inode.h"
  28 #include "meta_io.h"
  29 #include "trans.h"
  30 #include "util.h"
  31
  32 #define ACL_ACCESS 1
  33 #define ACL_DEFAULT 0
  34
  35 int gfs2_acl_validate_set(struct gfs2_inode *ip, int access,
  36                       struct gfs2_ea_request *er,
  37                       int *remove, mode_t *mode)
  38 {
  39         struct posix_acl *acl;
  40         int error;
  41
  42         error = gfs2_acl_validate_remove(ip, access);
  43         if (error)
  44                 return error;
  45
  46         if (!er->er_data)
  47                 return -EINVAL;
  48
  49         acl = posix_acl_from_xattr(er->er_data, er->er_data_len);
  50         if (IS_ERR(acl))
  51                 return PTR_ERR(acl);
  52         if (!acl) {
  53                 *remove = 1;
  54                 return 0;
  55         }
  56
  57         error = posix_acl_valid(acl);
  58         if (error)
  59                 goto out;
  60
  61         if (access) {
  62                 error = posix_acl_equiv_mode(acl, mode);
  63                 if (!error)
  64                         *remove = 1;
  65                 else if (error > 0)
  66                         error = 0;
  67         }
  68
  69  out:
  70         posix_acl_release(acl);
  71
  72         return error;
  73 }
  74
  75 int gfs2_acl_validate_remove(struct gfs2_inode *ip, int access)
  76 {
  77         if (!ip->i_sbd->sd_args.ar_posix_acl)
  78                 return -EOPNOTSUPP;
  79         if (current->fsuid != ip->i_di.di_uid && !capable(CAP_FOWNER))
  80                 return -EPERM;
  81         if (S_ISLNK(ip->i_di.di_mode))
  82                 return -EOPNOTSUPP;
  83         if (!access && !S_ISDIR(ip->i_di.di_mode))
  84                 return -EACCES;
  85
  86         return 0;
  87 }
  88
  89 static int acl_get(struct gfs2_inode *ip, int access, struct posix_acl **acl,
  90                    struct gfs2_ea_location *el, char **data, unsigned int *len)
  91 {
  92         struct gfs2_ea_request er;
  93         struct gfs2_ea_location el_this;
  94         int error;
  95
  96         if (!ip->i_di.di_eattr)
  97                 return 0;
  98
  99         memset(&er, 0, sizeof(struct gfs2_ea_request));
 100         if (access) {
 101                 er.er_name = GFS2_POSIX_ACL_ACCESS;
 102                 er.er_name_len = GFS2_POSIX_ACL_ACCESS_LEN;
 103         } else {
 104                 er.er_name = GFS2_POSIX_ACL_DEFAULT;
 105                 er.er_name_len = GFS2_POSIX_ACL_DEFAULT_LEN;
 106         }
 107         er.er_type = GFS2_EATYPE_SYS;
 108
 109         if (!el)
 110                 el = &el_this;
 111
 112         error = gfs2_ea_find(ip, &er, el);
 113         if (error)
 114                 return error;
 115         if (!el->el_ea)
 116                 return 0;
 117         if (!GFS2_EA_DATA_LEN(el->el_ea))
 118                 goto out;
 119
 120         er.er_data_len = GFS2_EA_DATA_LEN(el->el_ea);
 121         er.er_data = kmalloc(er.er_data_len, GFP_KERNEL);
 122         error = -ENOMEM;
 123         if (!er.er_data)
 124                 goto out;
 125
 126         error = gfs2_ea_get_copy(ip, el, er.er_data);
 127         if (error)
 128                 goto out_kfree;
 129
 130         if (acl) {
 131                 *acl = posix_acl_from_xattr(er.er_data, er.er_data_len);
 132                 if (IS_ERR(*acl))
 133                         error = PTR_ERR(*acl);
 134         }
 135
 136  out_kfree:
 137         if (error || !data)
 138                 kfree(er.er_data);
 139         else {
 140                 *data = er.er_data;
 141                 *len = er.er_data_len;
 142         }
 143
 144  out:
 145         if (error || el == &el_this)
 146                 brelse(el->el_bh);
 147
 148         return error;
 149 }
 150
 151 /**
 152  * gfs2_check_acl_locked - Check an ACL to see if we're allowed to do something
 153  * @inode: the file we want to do something to
 154  * @mask: what we want to do
 155  *
 156  * Returns: errno
 157  */
 158
 159 int gfs2_check_acl_locked(struct inode *inode, int mask)
 160 {
 161         struct posix_acl *acl = NULL;
 162         int error;
 163
 164         error = acl_get(inode->u.generic_ip, ACL_ACCESS, &acl, NULL, NULL, NULL);
 165         if (error)
 166                 return error;
 167
 168         if (acl) {
 169                 error = posix_acl_permission(inode, acl, mask);
 170                 posix_acl_release(acl);
 171                 return error;
 172         }
 173
 174         return -EAGAIN;
 175 }
 176
 177 int gfs2_check_acl(struct inode *inode, int mask)
 178 {
 179         struct gfs2_inode *ip = inode->u.generic_ip;
 180         struct gfs2_holder i_gh;
 181         int error;
 182
 183         error = gfs2_glock_nq_init(ip->i_gl,
 184                                    LM_ST_SHARED, LM_FLAG_ANY,
 185                                    &i_gh);
 186         if (!error) {
 187                 error = gfs2_check_acl_locked(inode, mask);
 188                 gfs2_glock_dq_uninit(&i_gh);
 189         }
 190
 191         return error;
 192 }
 193
 194 static int munge_mode(struct gfs2_inode *ip, mode_t mode)
 195 {
 196         struct gfs2_sbd *sdp = ip->i_sbd;
 197         struct buffer_head *dibh;
 198         int error;
 199
 200         error = gfs2_trans_begin(sdp, RES_DINODE, 0);
 201         if (error)
 202                 return error;
 203
 204         error = gfs2_meta_inode_buffer(ip, &dibh);
 205         if (!error) {
 206                 gfs2_assert_withdraw(sdp,
 207                                 (ip->i_di.di_mode & S_IFMT) == (mode & S_IFMT));
 208                 ip->i_di.di_mode = mode;
 209                 gfs2_trans_add_bh(ip->i_gl, dibh, 1);
 210                 gfs2_dinode_out(&ip->i_di, dibh->b_data);
 211                 brelse(dibh);
 212         }
 213
 214         gfs2_trans_end(sdp);
 215
 216         return 0;
 217 }
 218
 219 int gfs2_acl_create(struct gfs2_inode *dip, struct gfs2_inode *ip)
 220 {
 221         struct gfs2_sbd *sdp = dip->i_sbd;
 222         struct posix_acl *acl = NULL, *clone;
 223         struct gfs2_ea_request er;
 224         mode_t mode = ip->i_di.di_mode;
 225         int error;
 226
 227         if (!sdp->sd_args.ar_posix_acl)
 228                 return 0;
 229         if (S_ISLNK(ip->i_di.di_mode))
 230                 return 0;
 231
 232         memset(&er, 0, sizeof(struct gfs2_ea_request));
 233         er.er_type = GFS2_EATYPE_SYS;
 234
 235         error = acl_get(dip, ACL_DEFAULT, &acl, NULL,
 236                         &er.er_data, &er.er_data_len);
 237         if (error)
 238                 return error;
 239         if (!acl) {
 240                 mode &= ~current->fs->umask;
 241                 if (mode != ip->i_di.di_mode)
 242                         error = munge_mode(ip, mode);
 243                 return error;
 244         }
 245
 246         clone = posix_acl_clone(acl, GFP_KERNEL);
 247         error = -ENOMEM;
 248         if (!clone)
 249                 goto out;
 250         posix_acl_release(acl);
 251         acl = clone;
 252
 253         if (S_ISDIR(ip->i_di.di_mode)) {
 254                 er.er_name = GFS2_POSIX_ACL_DEFAULT;
 255                 er.er_name_len = GFS2_POSIX_ACL_DEFAULT_LEN;
 256                 error = gfs2_system_eaops.eo_set(ip, &er);
 257                 if (error)
 258                         goto out;
 259         }
 260
 261         error = posix_acl_create_masq(acl, &mode);
 262         if (error < 0)
 263                 goto out;
 264         if (error > 0) {
 265                 er.er_name = GFS2_POSIX_ACL_ACCESS;
 266                 er.er_name_len = GFS2_POSIX_ACL_ACCESS_LEN;
 267                 posix_acl_to_xattr(acl, er.er_data, er.er_data_len);
 268                 er.er_mode = mode;
 269                 er.er_flags = GFS2_ERF_MODE;
 270                 error = gfs2_system_eaops.eo_set(ip, &er);
 271                 if (error)
 272                         goto out;
 273         } else
 274                 munge_mode(ip, mode);
 275
 276  out:
 277         posix_acl_release(acl);
 278         kfree(er.er_data);
 279         return error;
 280 }
 281
 282 int gfs2_acl_chmod(struct gfs2_inode *ip, struct iattr *attr)
 283 {
 284         struct posix_acl *acl = NULL, *clone;
 285         struct gfs2_ea_location el;
 286         char *data;
 287         unsigned int len;
 288         int error;
 289
 290         error = acl_get(ip, ACL_ACCESS, &acl, &el, &data, &len);
 291         if (error)
 292                 return error;
 293         if (!acl)
 294                 return gfs2_setattr_simple(ip, attr);
 295
 296         clone = posix_acl_clone(acl, GFP_KERNEL);
 297         error = -ENOMEM;
 298         if (!clone)
 299                 goto out;
 300         posix_acl_release(acl);
 301         acl = clone;
 302
 303         error = posix_acl_chmod_masq(acl, attr->ia_mode);
 304         if (!error) {
 305                 posix_acl_to_xattr(acl, data, len);
 306                 error = gfs2_ea_acl_chmod(ip, &el, attr, data);
 307         }
 308
 309  out:
 310         posix_acl_release(acl);
 311         brelse(el.el_bh);
 312         kfree(data);
 313
 314         return error;
 315 }
 316