1 /* 2 * linux/fs/ext2/acl.c 3 * 4 * Copyright (C) 2001-2003 Andreas Gruenbacher, <agruen@suse.de> 5 */ 6 7 #include <linux/capability.h> 8 #include <linux/init.h> 9 #include <linux/sched.h> 10 #include <linux/slab.h> 11 #include <linux/fs.h> 12 #include "ext2.h" 13 #include "xattr.h" 14 #include "acl.h" 15 16 /* 17 * Convert from filesystem to in-memory representation. 18 */ 19 static struct posix_acl * 20 ext2_acl_from_disk(const void *value, size_t size) 21 { 22 const char *end = (char *)value + size; 23 int n, count; 24 struct posix_acl *acl; 25 26 if (!value) 27 return NULL; 28 if (size < sizeof(ext2_acl_header)) 29 return ERR_PTR(-EINVAL); 30 if (((ext2_acl_header *)value)->a_version != 31 cpu_to_le32(EXT2_ACL_VERSION)) 32 return ERR_PTR(-EINVAL); 33 value = (char *)value + sizeof(ext2_acl_header); 34 count = ext2_acl_count(size); 35 if (count < 0) 36 return ERR_PTR(-EINVAL); 37 if (count == 0) 38 return NULL; 39 acl = posix_acl_alloc(count, GFP_KERNEL); 40 if (!acl) 41 return ERR_PTR(-ENOMEM); 42 for (n=0; n < count; n++) { 43 ext2_acl_entry *entry = 44 (ext2_acl_entry *)value; 45 if ((char *)value + sizeof(ext2_acl_entry_short) > end) 46 goto fail; 47 acl->a_entries[n].e_tag = le16_to_cpu(entry->e_tag); 48 acl->a_entries[n].e_perm = le16_to_cpu(entry->e_perm); 49 switch(acl->a_entries[n].e_tag) { 50 case ACL_USER_OBJ: 51 case ACL_GROUP_OBJ: 52 case ACL_MASK: 53 case ACL_OTHER: 54 value = (char *)value + 55 sizeof(ext2_acl_entry_short); 56 acl->a_entries[n].e_id = ACL_UNDEFINED_ID; 57 break; 58 59 case ACL_USER: 60 case ACL_GROUP: 61 value = (char *)value + sizeof(ext2_acl_entry); 62 if ((char *)value > end) 63 goto fail; 64 acl->a_entries[n].e_id = 65 le32_to_cpu(entry->e_id); 66 break; 67 68 default: 69 goto fail; 70 } 71 } 72 if (value != end) 73 goto fail; 74 return acl; 75 76 fail: 77 posix_acl_release(acl); 78 return ERR_PTR(-EINVAL); 79 } 80 81 /* 82 * Convert from in-memory to filesystem representation. 83 */ 84 static void * 85 ext2_acl_to_disk(const struct posix_acl *acl, size_t *size) 86 { 87 ext2_acl_header *ext_acl; 88 char *e; 89 size_t n; 90 91 *size = ext2_acl_size(acl->a_count); 92 ext_acl = kmalloc(sizeof(ext2_acl_header) + acl->a_count * 93 sizeof(ext2_acl_entry), GFP_KERNEL); 94 if (!ext_acl) 95 return ERR_PTR(-ENOMEM); 96 ext_acl->a_version = cpu_to_le32(EXT2_ACL_VERSION); 97 e = (char *)ext_acl + sizeof(ext2_acl_header); 98 for (n=0; n < acl->a_count; n++) { 99 ext2_acl_entry *entry = (ext2_acl_entry *)e; 100 entry->e_tag = cpu_to_le16(acl->a_entries[n].e_tag); 101 entry->e_perm = cpu_to_le16(acl->a_entries[n].e_perm); 102 switch(acl->a_entries[n].e_tag) { 103 case ACL_USER: 104 case ACL_GROUP: 105 entry->e_id = 106 cpu_to_le32(acl->a_entries[n].e_id); 107 e += sizeof(ext2_acl_entry); 108 break; 109 110 case ACL_USER_OBJ: 111 case ACL_GROUP_OBJ: 112 case ACL_MASK: 113 case ACL_OTHER: 114 e += sizeof(ext2_acl_entry_short); 115 break; 116 117 default: 118 goto fail; 119 } 120 } 121 return (char *)ext_acl; 122 123 fail: 124 kfree(ext_acl); 125 return ERR_PTR(-EINVAL); 126 } 127 128 /* 129 * inode->i_mutex: don't care 130 */ 131 static struct posix_acl * 132 ext2_get_acl(struct inode *inode, int type) 133 { 134 int name_index; 135 char *value = NULL; 136 struct posix_acl *acl; 137 int retval; 138 139 if (!test_opt(inode->i_sb, POSIX_ACL)) 140 return NULL; 141 142 acl = get_cached_acl(inode, type); 143 if (acl != ACL_NOT_CACHED) 144 return acl; 145 146 switch (type) { 147 case ACL_TYPE_ACCESS: 148 name_index = EXT2_XATTR_INDEX_POSIX_ACL_ACCESS; 149 break; 150 case ACL_TYPE_DEFAULT: 151 name_index = EXT2_XATTR_INDEX_POSIX_ACL_DEFAULT; 152 break; 153 default: 154 BUG(); 155 } 156 retval = ext2_xattr_get(inode, name_index, "", NULL, 0); 157 if (retval > 0) { 158 value = kmalloc(retval, GFP_KERNEL); 159 if (!value) 160 return ERR_PTR(-ENOMEM); 161 retval = ext2_xattr_get(inode, name_index, "", value, retval); 162 } 163 if (retval > 0) 164 acl = ext2_acl_from_disk(value, retval); 165 else if (retval == -ENODATA || retval == -ENOSYS) 166 acl = NULL; 167 else 168 acl = ERR_PTR(retval); 169 kfree(value); 170 171 if (!IS_ERR(acl)) 172 set_cached_acl(inode, type, acl); 173 174 return acl; 175 } 176 177 /* 178 * inode->i_mutex: down 179 */ 180 static int 181 ext2_set_acl(struct inode *inode, int type, struct posix_acl *acl) 182 { 183 int name_index; 184 void *value = NULL; 185 size_t size = 0; 186 int error; 187 188 if (S_ISLNK(inode->i_mode)) 189 return -EOPNOTSUPP; 190 if (!test_opt(inode->i_sb, POSIX_ACL)) 191 return 0; 192 193 switch(type) { 194 case ACL_TYPE_ACCESS: 195 name_index = EXT2_XATTR_INDEX_POSIX_ACL_ACCESS; 196 if (acl) { 197 mode_t mode = inode->i_mode; 198 error = posix_acl_equiv_mode(acl, &mode); 199 if (error < 0) 200 return error; 201 else { 202 inode->i_mode = mode; 203 mark_inode_dirty(inode); 204 if (error == 0) 205 acl = NULL; 206 } 207 } 208 break; 209 210 case ACL_TYPE_DEFAULT: 211 name_index = EXT2_XATTR_INDEX_POSIX_ACL_DEFAULT; 212 if (!S_ISDIR(inode->i_mode)) 213 return acl ? -EACCES : 0; 214 break; 215 216 default: 217 return -EINVAL; 218 } 219 if (acl) { 220 value = ext2_acl_to_disk(acl, &size); 221 if (IS_ERR(value)) 222 return (int)PTR_ERR(value); 223 } 224 225 error = ext2_xattr_set(inode, name_index, "", value, size, 0); 226 227 kfree(value); 228 if (!error) 229 set_cached_acl(inode, type, acl); 230 return error; 231 } 232 233 int 234 ext2_check_acl(struct inode *inode, int mask) 235 { 236 struct posix_acl *acl = ext2_get_acl(inode, ACL_TYPE_ACCESS); 237 238 if (IS_ERR(acl)) 239 return PTR_ERR(acl); 240 if (acl) { 241 int error = posix_acl_permission(inode, acl, mask); 242 posix_acl_release(acl); 243 return error; 244 } 245 246 return -EAGAIN; 247 } 248 249 /* 250 * Initialize the ACLs of a new inode. Called from ext2_new_inode. 251 * 252 * dir->i_mutex: down 253 * inode->i_mutex: up (access to inode is still exclusive) 254 */ 255 int 256 ext2_init_acl(struct inode *inode, struct inode *dir) 257 { 258 struct posix_acl *acl = NULL; 259 int error = 0; 260 261 if (!S_ISLNK(inode->i_mode)) { 262 if (test_opt(dir->i_sb, POSIX_ACL)) { 263 acl = ext2_get_acl(dir, ACL_TYPE_DEFAULT); 264 if (IS_ERR(acl)) 265 return PTR_ERR(acl); 266 } 267 if (!acl) 268 inode->i_mode &= ~current_umask(); 269 } 270 if (test_opt(inode->i_sb, POSIX_ACL) && acl) { 271 struct posix_acl *clone; 272 mode_t mode; 273 274 if (S_ISDIR(inode->i_mode)) { 275 error = ext2_set_acl(inode, ACL_TYPE_DEFAULT, acl); 276 if (error) 277 goto cleanup; 278 } 279 clone = posix_acl_clone(acl, GFP_KERNEL); 280 error = -ENOMEM; 281 if (!clone) 282 goto cleanup; 283 mode = inode->i_mode; 284 error = posix_acl_create_masq(clone, &mode); 285 if (error >= 0) { 286 inode->i_mode = mode; 287 if (error > 0) { 288 /* This is an extended ACL */ 289 error = ext2_set_acl(inode, 290 ACL_TYPE_ACCESS, clone); 291 } 292 } 293 posix_acl_release(clone); 294 } 295 cleanup: 296 posix_acl_release(acl); 297 return error; 298 } 299 300 /* 301 * Does chmod for an inode that may have an Access Control List. The 302 * inode->i_mode field must be updated to the desired value by the caller 303 * before calling this function. 304 * Returns 0 on success, or a negative error number. 305 * 306 * We change the ACL rather than storing some ACL entries in the file 307 * mode permission bits (which would be more efficient), because that 308 * would break once additional permissions (like ACL_APPEND, ACL_DELETE 309 * for directories) are added. There are no more bits available in the 310 * file mode. 311 * 312 * inode->i_mutex: down 313 */ 314 int 315 ext2_acl_chmod(struct inode *inode) 316 { 317 struct posix_acl *acl, *clone; 318 int error; 319 320 if (!test_opt(inode->i_sb, POSIX_ACL)) 321 return 0; 322 if (S_ISLNK(inode->i_mode)) 323 return -EOPNOTSUPP; 324 acl = ext2_get_acl(inode, ACL_TYPE_ACCESS); 325 if (IS_ERR(acl) || !acl) 326 return PTR_ERR(acl); 327 clone = posix_acl_clone(acl, GFP_KERNEL); 328 posix_acl_release(acl); 329 if (!clone) 330 return -ENOMEM; 331 error = posix_acl_chmod_masq(clone, inode->i_mode); 332 if (!error) 333 error = ext2_set_acl(inode, ACL_TYPE_ACCESS, clone); 334 posix_acl_release(clone); 335 return error; 336 } 337 338 /* 339 * Extended attribut handlers 340 */ 341 static size_t 342 ext2_xattr_list_acl_access(struct dentry *dentry, char *list, size_t list_size, 343 const char *name, size_t name_len, int type) 344 { 345 const size_t size = sizeof(POSIX_ACL_XATTR_ACCESS); 346 347 if (!test_opt(dentry->d_sb, POSIX_ACL)) 348 return 0; 349 if (list && size <= list_size) 350 memcpy(list, POSIX_ACL_XATTR_ACCESS, size); 351 return size; 352 } 353 354 static size_t 355 ext2_xattr_list_acl_default(struct dentry *dentry, char *list, size_t list_size, 356 const char *name, size_t name_len, int type) 357 { 358 const size_t size = sizeof(POSIX_ACL_XATTR_DEFAULT); 359 360 if (!test_opt(dentry->d_sb, POSIX_ACL)) 361 return 0; 362 if (list && size <= list_size) 363 memcpy(list, POSIX_ACL_XATTR_DEFAULT, size); 364 return size; 365 } 366 367 static int 368 ext2_xattr_get_acl(struct dentry *dentry, const char *name, void *buffer, 369 size_t size, int type) 370 { 371 struct posix_acl *acl; 372 int error; 373 374 if (strcmp(name, "") != 0) 375 return -EINVAL; 376 if (!test_opt(dentry->d_sb, POSIX_ACL)) 377 return -EOPNOTSUPP; 378 379 acl = ext2_get_acl(dentry->d_inode, type); 380 if (IS_ERR(acl)) 381 return PTR_ERR(acl); 382 if (acl == NULL) 383 return -ENODATA; 384 error = posix_acl_to_xattr(acl, buffer, size); 385 posix_acl_release(acl); 386 387 return error; 388 } 389 390 static int 391 ext2_xattr_set_acl(struct dentry *dentry, const char *name, const void *value, 392 size_t size, int flags, int type) 393 { 394 struct posix_acl *acl; 395 int error; 396 397 if (strcmp(name, "") != 0) 398 return -EINVAL; 399 if (!test_opt(dentry->d_sb, POSIX_ACL)) 400 return -EOPNOTSUPP; 401 if (!is_owner_or_cap(dentry->d_inode)) 402 return -EPERM; 403 404 if (value) { 405 acl = posix_acl_from_xattr(value, size); 406 if (IS_ERR(acl)) 407 return PTR_ERR(acl); 408 else if (acl) { 409 error = posix_acl_valid(acl); 410 if (error) 411 goto release_and_out; 412 } 413 } else 414 acl = NULL; 415 416 error = ext2_set_acl(dentry->d_inode, type, acl); 417 418 release_and_out: 419 posix_acl_release(acl); 420 return error; 421 } 422 423 struct xattr_handler ext2_xattr_acl_access_handler = { 424 .prefix = POSIX_ACL_XATTR_ACCESS, 425 .flags = ACL_TYPE_ACCESS, 426 .list = ext2_xattr_list_acl_access, 427 .get = ext2_xattr_get_acl, 428 .set = ext2_xattr_set_acl, 429 }; 430 431 struct xattr_handler ext2_xattr_acl_default_handler = { 432 .prefix = POSIX_ACL_XATTR_DEFAULT, 433 .flags = ACL_TYPE_DEFAULT, 434 .list = ext2_xattr_list_acl_default, 435 .get = ext2_xattr_get_acl, 436 .set = ext2_xattr_set_acl, 437 }; 438