1 /* 2 * Copyright (C) Sistina Software, Inc. 1997-2003 All rights reserved. 3 * Copyright (C) 2004-2006 Red Hat, Inc. All rights reserved. 4 * 5 * This copyrighted material is made available to anyone wishing to use, 6 * modify, copy, or redistribute it subject to the terms and conditions 7 * of the GNU General Public License version 2. 8 */ 9 10 #include <linux/sched.h> 11 #include <linux/slab.h> 12 #include <linux/spinlock.h> 13 #include <linux/completion.h> 14 #include <linux/buffer_head.h> 15 #include <linux/posix_acl.h> 16 #include <linux/posix_acl_xattr.h> 17 #include <linux/gfs2_ondisk.h> 18 #include <linux/lm_interface.h> 19 20 #include "gfs2.h" 21 #include "incore.h" 22 #include "acl.h" 23 #include "eaops.h" 24 #include "eattr.h" 25 #include "glock.h" 26 #include "inode.h" 27 #include "meta_io.h" 28 #include "trans.h" 29 #include "util.h" 30 31 #define ACL_ACCESS 1 32 #define ACL_DEFAULT 0 33 34 int gfs2_acl_validate_set(struct gfs2_inode *ip, int access, 35 struct gfs2_ea_request *er, 36 int *remove, mode_t *mode) 37 { 38 struct posix_acl *acl; 39 int error; 40 41 error = gfs2_acl_validate_remove(ip, access); 42 if (error) 43 return error; 44 45 if (!er->er_data) 46 return -EINVAL; 47 48 acl = posix_acl_from_xattr(er->er_data, er->er_data_len); 49 if (IS_ERR(acl)) 50 return PTR_ERR(acl); 51 if (!acl) { 52 *remove = 1; 53 return 0; 54 } 55 56 error = posix_acl_valid(acl); 57 if (error) 58 goto out; 59 60 if (access) { 61 error = posix_acl_equiv_mode(acl, mode); 62 if (!error) 63 *remove = 1; 64 else if (error > 0) 65 error = 0; 66 } 67 68 out: 69 posix_acl_release(acl); 70 return error; 71 } 72 73 int gfs2_acl_validate_remove(struct gfs2_inode *ip, int access) 74 { 75 if (!GFS2_SB(&ip->i_inode)->sd_args.ar_posix_acl) 76 return -EOPNOTSUPP; 77 if (current->fsuid != ip->i_di.di_uid && !capable(CAP_FOWNER)) 78 return -EPERM; 79 if (S_ISLNK(ip->i_di.di_mode)) 80 return -EOPNOTSUPP; 81 if (!access && !S_ISDIR(ip->i_di.di_mode)) 82 return -EACCES; 83 84 return 0; 85 } 86 87 static int acl_get(struct gfs2_inode *ip, int access, struct posix_acl **acl, 88 struct gfs2_ea_location *el, char **data, unsigned int *len) 89 { 90 struct gfs2_ea_request er; 91 struct gfs2_ea_location el_this; 92 int error; 93 94 if (!ip->i_di.di_eattr) 95 return 0; 96 97 memset(&er, 0, sizeof(struct gfs2_ea_request)); 98 if (access) { 99 er.er_name = GFS2_POSIX_ACL_ACCESS; 100 er.er_name_len = GFS2_POSIX_ACL_ACCESS_LEN; 101 } else { 102 er.er_name = GFS2_POSIX_ACL_DEFAULT; 103 er.er_name_len = GFS2_POSIX_ACL_DEFAULT_LEN; 104 } 105 er.er_type = GFS2_EATYPE_SYS; 106 107 if (!el) 108 el = &el_this; 109 110 error = gfs2_ea_find(ip, &er, el); 111 if (error) 112 return error; 113 if (!el->el_ea) 114 return 0; 115 if (!GFS2_EA_DATA_LEN(el->el_ea)) 116 goto out; 117 118 er.er_data_len = GFS2_EA_DATA_LEN(el->el_ea); 119 er.er_data = kmalloc(er.er_data_len, GFP_KERNEL); 120 error = -ENOMEM; 121 if (!er.er_data) 122 goto out; 123 124 error = gfs2_ea_get_copy(ip, el, er.er_data); 125 if (error) 126 goto out_kfree; 127 128 if (acl) { 129 *acl = posix_acl_from_xattr(er.er_data, er.er_data_len); 130 if (IS_ERR(*acl)) 131 error = PTR_ERR(*acl); 132 } 133 134 out_kfree: 135 if (error || !data) 136 kfree(er.er_data); 137 else { 138 *data = er.er_data; 139 *len = er.er_data_len; 140 } 141 out: 142 if (error || el == &el_this) 143 brelse(el->el_bh); 144 return error; 145 } 146 147 /** 148 * gfs2_check_acl_locked - Check an ACL to see if we're allowed to do something 149 * @inode: the file we want to do something to 150 * @mask: what we want to do 151 * 152 * Returns: errno 153 */ 154 155 int gfs2_check_acl_locked(struct inode *inode, int mask) 156 { 157 struct posix_acl *acl = NULL; 158 int error; 159 160 error = acl_get(GFS2_I(inode), ACL_ACCESS, &acl, NULL, NULL, NULL); 161 if (error) 162 return error; 163 164 if (acl) { 165 error = posix_acl_permission(inode, acl, mask); 166 posix_acl_release(acl); 167 return error; 168 } 169 170 return -EAGAIN; 171 } 172 173 int gfs2_check_acl(struct inode *inode, int mask) 174 { 175 struct gfs2_inode *ip = GFS2_I(inode); 176 struct gfs2_holder i_gh; 177 int error; 178 179 error = gfs2_glock_nq_init(ip->i_gl, LM_ST_SHARED, LM_FLAG_ANY, &i_gh); 180 if (!error) { 181 error = gfs2_check_acl_locked(inode, mask); 182 gfs2_glock_dq_uninit(&i_gh); 183 } 184 185 return error; 186 } 187 188 static int munge_mode(struct gfs2_inode *ip, mode_t mode) 189 { 190 struct gfs2_sbd *sdp = GFS2_SB(&ip->i_inode); 191 struct buffer_head *dibh; 192 int error; 193 194 error = gfs2_trans_begin(sdp, RES_DINODE, 0); 195 if (error) 196 return error; 197 198 error = gfs2_meta_inode_buffer(ip, &dibh); 199 if (!error) { 200 gfs2_assert_withdraw(sdp, 201 (ip->i_di.di_mode & S_IFMT) == (mode & S_IFMT)); 202 ip->i_di.di_mode = mode; 203 gfs2_trans_add_bh(ip->i_gl, dibh, 1); 204 gfs2_dinode_out(&ip->i_di, dibh->b_data); 205 brelse(dibh); 206 } 207 208 gfs2_trans_end(sdp); 209 210 return 0; 211 } 212 213 int gfs2_acl_create(struct gfs2_inode *dip, struct gfs2_inode *ip) 214 { 215 struct gfs2_sbd *sdp = GFS2_SB(&dip->i_inode); 216 struct posix_acl *acl = NULL, *clone; 217 struct gfs2_ea_request er; 218 mode_t mode = ip->i_di.di_mode; 219 int error; 220 221 if (!sdp->sd_args.ar_posix_acl) 222 return 0; 223 if (S_ISLNK(ip->i_di.di_mode)) 224 return 0; 225 226 memset(&er, 0, sizeof(struct gfs2_ea_request)); 227 er.er_type = GFS2_EATYPE_SYS; 228 229 error = acl_get(dip, ACL_DEFAULT, &acl, NULL, 230 &er.er_data, &er.er_data_len); 231 if (error) 232 return error; 233 if (!acl) { 234 mode &= ~current->fs->umask; 235 if (mode != ip->i_di.di_mode) 236 error = munge_mode(ip, mode); 237 return error; 238 } 239 240 clone = posix_acl_clone(acl, GFP_KERNEL); 241 error = -ENOMEM; 242 if (!clone) 243 goto out; 244 posix_acl_release(acl); 245 acl = clone; 246 247 if (S_ISDIR(ip->i_di.di_mode)) { 248 er.er_name = GFS2_POSIX_ACL_DEFAULT; 249 er.er_name_len = GFS2_POSIX_ACL_DEFAULT_LEN; 250 error = gfs2_system_eaops.eo_set(ip, &er); 251 if (error) 252 goto out; 253 } 254 255 error = posix_acl_create_masq(acl, &mode); 256 if (error < 0) 257 goto out; 258 if (error > 0) { 259 er.er_name = GFS2_POSIX_ACL_ACCESS; 260 er.er_name_len = GFS2_POSIX_ACL_ACCESS_LEN; 261 posix_acl_to_xattr(acl, er.er_data, er.er_data_len); 262 er.er_mode = mode; 263 er.er_flags = GFS2_ERF_MODE; 264 error = gfs2_system_eaops.eo_set(ip, &er); 265 if (error) 266 goto out; 267 } else 268 munge_mode(ip, mode); 269 270 out: 271 posix_acl_release(acl); 272 kfree(er.er_data); 273 return error; 274 } 275 276 int gfs2_acl_chmod(struct gfs2_inode *ip, struct iattr *attr) 277 { 278 struct posix_acl *acl = NULL, *clone; 279 struct gfs2_ea_location el; 280 char *data; 281 unsigned int len; 282 int error; 283 284 error = acl_get(ip, ACL_ACCESS, &acl, &el, &data, &len); 285 if (error) 286 return error; 287 if (!acl) 288 return gfs2_setattr_simple(ip, attr); 289 290 clone = posix_acl_clone(acl, GFP_KERNEL); 291 error = -ENOMEM; 292 if (!clone) 293 goto out; 294 posix_acl_release(acl); 295 acl = clone; 296 297 error = posix_acl_chmod_masq(acl, attr->ia_mode); 298 if (!error) { 299 posix_acl_to_xattr(acl, data, len); 300 error = gfs2_ea_acl_chmod(ip, &el, attr, data); 301 } 302 303 out: 304 posix_acl_release(acl); 305 brelse(el.el_bh); 306 kfree(data); 307 return error; 308 } 309 310