1 /* 2 * linux/fs/ext2/acl.c 3 * 4 * Copyright (C) 2001-2003 Andreas Gruenbacher, <agruen@suse.de> 5 */ 6 7 #include <linux/capability.h> 8 #include <linux/init.h> 9 #include <linux/sched.h> 10 #include <linux/slab.h> 11 #include <linux/fs.h> 12 #include "ext2.h" 13 #include "xattr.h" 14 #include "acl.h" 15 16 /* 17 * Convert from filesystem to in-memory representation. 18 */ 19 static struct posix_acl * 20 ext2_acl_from_disk(const void *value, size_t size) 21 { 22 const char *end = (char *)value + size; 23 int n, count; 24 struct posix_acl *acl; 25 26 if (!value) 27 return NULL; 28 if (size < sizeof(ext2_acl_header)) 29 return ERR_PTR(-EINVAL); 30 if (((ext2_acl_header *)value)->a_version != 31 cpu_to_le32(EXT2_ACL_VERSION)) 32 return ERR_PTR(-EINVAL); 33 value = (char *)value + sizeof(ext2_acl_header); 34 count = ext2_acl_count(size); 35 if (count < 0) 36 return ERR_PTR(-EINVAL); 37 if (count == 0) 38 return NULL; 39 acl = posix_acl_alloc(count, GFP_KERNEL); 40 if (!acl) 41 return ERR_PTR(-ENOMEM); 42 for (n=0; n < count; n++) { 43 ext2_acl_entry *entry = 44 (ext2_acl_entry *)value; 45 if ((char *)value + sizeof(ext2_acl_entry_short) > end) 46 goto fail; 47 acl->a_entries[n].e_tag = le16_to_cpu(entry->e_tag); 48 acl->a_entries[n].e_perm = le16_to_cpu(entry->e_perm); 49 switch(acl->a_entries[n].e_tag) { 50 case ACL_USER_OBJ: 51 case ACL_GROUP_OBJ: 52 case ACL_MASK: 53 case ACL_OTHER: 54 value = (char *)value + 55 sizeof(ext2_acl_entry_short); 56 acl->a_entries[n].e_id = ACL_UNDEFINED_ID; 57 break; 58 59 case ACL_USER: 60 case ACL_GROUP: 61 value = (char *)value + sizeof(ext2_acl_entry); 62 if ((char *)value > end) 63 goto fail; 64 acl->a_entries[n].e_id = 65 le32_to_cpu(entry->e_id); 66 break; 67 68 default: 69 goto fail; 70 } 71 } 72 if (value != end) 73 goto fail; 74 return acl; 75 76 fail: 77 posix_acl_release(acl); 78 return ERR_PTR(-EINVAL); 79 } 80 81 /* 82 * Convert from in-memory to filesystem representation. 83 */ 84 static void * 85 ext2_acl_to_disk(const struct posix_acl *acl, size_t *size) 86 { 87 ext2_acl_header *ext_acl; 88 char *e; 89 size_t n; 90 91 *size = ext2_acl_size(acl->a_count); 92 ext_acl = kmalloc(sizeof(ext2_acl_header) + acl->a_count * 93 sizeof(ext2_acl_entry), GFP_KERNEL); 94 if (!ext_acl) 95 return ERR_PTR(-ENOMEM); 96 ext_acl->a_version = cpu_to_le32(EXT2_ACL_VERSION); 97 e = (char *)ext_acl + sizeof(ext2_acl_header); 98 for (n=0; n < acl->a_count; n++) { 99 ext2_acl_entry *entry = (ext2_acl_entry *)e; 100 entry->e_tag = cpu_to_le16(acl->a_entries[n].e_tag); 101 entry->e_perm = cpu_to_le16(acl->a_entries[n].e_perm); 102 switch(acl->a_entries[n].e_tag) { 103 case ACL_USER: 104 case ACL_GROUP: 105 entry->e_id = 106 cpu_to_le32(acl->a_entries[n].e_id); 107 e += sizeof(ext2_acl_entry); 108 break; 109 110 case ACL_USER_OBJ: 111 case ACL_GROUP_OBJ: 112 case ACL_MASK: 113 case ACL_OTHER: 114 e += sizeof(ext2_acl_entry_short); 115 break; 116 117 default: 118 goto fail; 119 } 120 } 121 return (char *)ext_acl; 122 123 fail: 124 kfree(ext_acl); 125 return ERR_PTR(-EINVAL); 126 } 127 128 /* 129 * inode->i_mutex: don't care 130 */ 131 static struct posix_acl * 132 ext2_get_acl(struct inode *inode, int type) 133 { 134 int name_index; 135 char *value = NULL; 136 struct posix_acl *acl; 137 int retval; 138 139 if (!test_opt(inode->i_sb, POSIX_ACL)) 140 return NULL; 141 142 acl = get_cached_acl(inode, type); 143 if (acl != ACL_NOT_CACHED) 144 return acl; 145 146 switch (type) { 147 case ACL_TYPE_ACCESS: 148 name_index = EXT2_XATTR_INDEX_POSIX_ACL_ACCESS; 149 break; 150 case ACL_TYPE_DEFAULT: 151 name_index = EXT2_XATTR_INDEX_POSIX_ACL_DEFAULT; 152 break; 153 default: 154 BUG(); 155 } 156 retval = ext2_xattr_get(inode, name_index, "", NULL, 0); 157 if (retval > 0) { 158 value = kmalloc(retval, GFP_KERNEL); 159 if (!value) 160 return ERR_PTR(-ENOMEM); 161 retval = ext2_xattr_get(inode, name_index, "", value, retval); 162 } 163 if (retval > 0) 164 acl = ext2_acl_from_disk(value, retval); 165 else if (retval == -ENODATA || retval == -ENOSYS) 166 acl = NULL; 167 else 168 acl = ERR_PTR(retval); 169 kfree(value); 170 171 if (!IS_ERR(acl)) 172 set_cached_acl(inode, type, acl); 173 174 return acl; 175 } 176 177 /* 178 * inode->i_mutex: down 179 */ 180 static int 181 ext2_set_acl(struct inode *inode, int type, struct posix_acl *acl) 182 { 183 int name_index; 184 void *value = NULL; 185 size_t size = 0; 186 int error; 187 188 if (S_ISLNK(inode->i_mode)) 189 return -EOPNOTSUPP; 190 if (!test_opt(inode->i_sb, POSIX_ACL)) 191 return 0; 192 193 switch(type) { 194 case ACL_TYPE_ACCESS: 195 name_index = EXT2_XATTR_INDEX_POSIX_ACL_ACCESS; 196 if (acl) { 197 mode_t mode = inode->i_mode; 198 error = posix_acl_equiv_mode(acl, &mode); 199 if (error < 0) 200 return error; 201 else { 202 inode->i_mode = mode; 203 inode->i_ctime = CURRENT_TIME_SEC; 204 mark_inode_dirty(inode); 205 if (error == 0) 206 acl = NULL; 207 } 208 } 209 break; 210 211 case ACL_TYPE_DEFAULT: 212 name_index = EXT2_XATTR_INDEX_POSIX_ACL_DEFAULT; 213 if (!S_ISDIR(inode->i_mode)) 214 return acl ? -EACCES : 0; 215 break; 216 217 default: 218 return -EINVAL; 219 } 220 if (acl) { 221 value = ext2_acl_to_disk(acl, &size); 222 if (IS_ERR(value)) 223 return (int)PTR_ERR(value); 224 } 225 226 error = ext2_xattr_set(inode, name_index, "", value, size, 0); 227 228 kfree(value); 229 if (!error) 230 set_cached_acl(inode, type, acl); 231 return error; 232 } 233 234 int 235 ext2_check_acl(struct inode *inode, int mask, unsigned int flags) 236 { 237 struct posix_acl *acl; 238 239 if (flags & IPERM_FLAG_RCU) { 240 if (!negative_cached_acl(inode, ACL_TYPE_ACCESS)) 241 return -ECHILD; 242 return -EAGAIN; 243 } 244 245 acl = ext2_get_acl(inode, ACL_TYPE_ACCESS); 246 if (IS_ERR(acl)) 247 return PTR_ERR(acl); 248 if (acl) { 249 int error = posix_acl_permission(inode, acl, mask); 250 posix_acl_release(acl); 251 return error; 252 } 253 254 return -EAGAIN; 255 } 256 257 /* 258 * Initialize the ACLs of a new inode. Called from ext2_new_inode. 259 * 260 * dir->i_mutex: down 261 * inode->i_mutex: up (access to inode is still exclusive) 262 */ 263 int 264 ext2_init_acl(struct inode *inode, struct inode *dir) 265 { 266 struct posix_acl *acl = NULL; 267 int error = 0; 268 269 if (!S_ISLNK(inode->i_mode)) { 270 if (test_opt(dir->i_sb, POSIX_ACL)) { 271 acl = ext2_get_acl(dir, ACL_TYPE_DEFAULT); 272 if (IS_ERR(acl)) 273 return PTR_ERR(acl); 274 } 275 if (!acl) 276 inode->i_mode &= ~current_umask(); 277 } 278 if (test_opt(inode->i_sb, POSIX_ACL) && acl) { 279 struct posix_acl *clone; 280 mode_t mode; 281 282 if (S_ISDIR(inode->i_mode)) { 283 error = ext2_set_acl(inode, ACL_TYPE_DEFAULT, acl); 284 if (error) 285 goto cleanup; 286 } 287 clone = posix_acl_clone(acl, GFP_KERNEL); 288 error = -ENOMEM; 289 if (!clone) 290 goto cleanup; 291 mode = inode->i_mode; 292 error = posix_acl_create_masq(clone, &mode); 293 if (error >= 0) { 294 inode->i_mode = mode; 295 if (error > 0) { 296 /* This is an extended ACL */ 297 error = ext2_set_acl(inode, 298 ACL_TYPE_ACCESS, clone); 299 } 300 } 301 posix_acl_release(clone); 302 } 303 cleanup: 304 posix_acl_release(acl); 305 return error; 306 } 307 308 /* 309 * Does chmod for an inode that may have an Access Control List. The 310 * inode->i_mode field must be updated to the desired value by the caller 311 * before calling this function. 312 * Returns 0 on success, or a negative error number. 313 * 314 * We change the ACL rather than storing some ACL entries in the file 315 * mode permission bits (which would be more efficient), because that 316 * would break once additional permissions (like ACL_APPEND, ACL_DELETE 317 * for directories) are added. There are no more bits available in the 318 * file mode. 319 * 320 * inode->i_mutex: down 321 */ 322 int 323 ext2_acl_chmod(struct inode *inode) 324 { 325 struct posix_acl *acl, *clone; 326 int error; 327 328 if (!test_opt(inode->i_sb, POSIX_ACL)) 329 return 0; 330 if (S_ISLNK(inode->i_mode)) 331 return -EOPNOTSUPP; 332 acl = ext2_get_acl(inode, ACL_TYPE_ACCESS); 333 if (IS_ERR(acl) || !acl) 334 return PTR_ERR(acl); 335 clone = posix_acl_clone(acl, GFP_KERNEL); 336 posix_acl_release(acl); 337 if (!clone) 338 return -ENOMEM; 339 error = posix_acl_chmod_masq(clone, inode->i_mode); 340 if (!error) 341 error = ext2_set_acl(inode, ACL_TYPE_ACCESS, clone); 342 posix_acl_release(clone); 343 return error; 344 } 345 346 /* 347 * Extended attribut handlers 348 */ 349 static size_t 350 ext2_xattr_list_acl_access(struct dentry *dentry, char *list, size_t list_size, 351 const char *name, size_t name_len, int type) 352 { 353 const size_t size = sizeof(POSIX_ACL_XATTR_ACCESS); 354 355 if (!test_opt(dentry->d_sb, POSIX_ACL)) 356 return 0; 357 if (list && size <= list_size) 358 memcpy(list, POSIX_ACL_XATTR_ACCESS, size); 359 return size; 360 } 361 362 static size_t 363 ext2_xattr_list_acl_default(struct dentry *dentry, char *list, size_t list_size, 364 const char *name, size_t name_len, int type) 365 { 366 const size_t size = sizeof(POSIX_ACL_XATTR_DEFAULT); 367 368 if (!test_opt(dentry->d_sb, POSIX_ACL)) 369 return 0; 370 if (list && size <= list_size) 371 memcpy(list, POSIX_ACL_XATTR_DEFAULT, size); 372 return size; 373 } 374 375 static int 376 ext2_xattr_get_acl(struct dentry *dentry, const char *name, void *buffer, 377 size_t size, int type) 378 { 379 struct posix_acl *acl; 380 int error; 381 382 if (strcmp(name, "") != 0) 383 return -EINVAL; 384 if (!test_opt(dentry->d_sb, POSIX_ACL)) 385 return -EOPNOTSUPP; 386 387 acl = ext2_get_acl(dentry->d_inode, type); 388 if (IS_ERR(acl)) 389 return PTR_ERR(acl); 390 if (acl == NULL) 391 return -ENODATA; 392 error = posix_acl_to_xattr(acl, buffer, size); 393 posix_acl_release(acl); 394 395 return error; 396 } 397 398 static int 399 ext2_xattr_set_acl(struct dentry *dentry, const char *name, const void *value, 400 size_t size, int flags, int type) 401 { 402 struct posix_acl *acl; 403 int error; 404 405 if (strcmp(name, "") != 0) 406 return -EINVAL; 407 if (!test_opt(dentry->d_sb, POSIX_ACL)) 408 return -EOPNOTSUPP; 409 if (!inode_owner_or_capable(dentry->d_inode)) 410 return -EPERM; 411 412 if (value) { 413 acl = posix_acl_from_xattr(value, size); 414 if (IS_ERR(acl)) 415 return PTR_ERR(acl); 416 else if (acl) { 417 error = posix_acl_valid(acl); 418 if (error) 419 goto release_and_out; 420 } 421 } else 422 acl = NULL; 423 424 error = ext2_set_acl(dentry->d_inode, type, acl); 425 426 release_and_out: 427 posix_acl_release(acl); 428 return error; 429 } 430 431 const struct xattr_handler ext2_xattr_acl_access_handler = { 432 .prefix = POSIX_ACL_XATTR_ACCESS, 433 .flags = ACL_TYPE_ACCESS, 434 .list = ext2_xattr_list_acl_access, 435 .get = ext2_xattr_get_acl, 436 .set = ext2_xattr_set_acl, 437 }; 438 439 const struct xattr_handler ext2_xattr_acl_default_handler = { 440 .prefix = POSIX_ACL_XATTR_DEFAULT, 441 .flags = ACL_TYPE_DEFAULT, 442 .list = ext2_xattr_list_acl_default, 443 .get = ext2_xattr_get_acl, 444 .set = ext2_xattr_set_acl, 445 }; 446