1 /* -*- mode: c; c-basic-offset: 8; -*- 2 * vim: noexpandtab sw=8 ts=8 sts=0: 3 * 4 * acl.c 5 * 6 * Copyright (C) 2004, 2008 Oracle. All rights reserved. 7 * 8 * CREDITS: 9 * Lots of code in this file is copy from linux/fs/ext3/acl.c. 10 * Copyright (C) 2001-2003 Andreas Gruenbacher, <agruen@suse.de> 11 * 12 * This program is free software; you can redistribute it and/or 13 * modify it under the terms of the GNU General Public 14 * License version 2 as published by the Free Software Foundation. 15 * 16 * This program is distributed in the hope that it will be useful, 17 * but WITHOUT ANY WARRANTY; without even the implied warranty of 18 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU 19 * General Public License for more details. 20 */ 21 22 #include <linux/init.h> 23 #include <linux/module.h> 24 #include <linux/slab.h> 25 #include <linux/string.h> 26 27 #include <cluster/masklog.h> 28 29 #include "ocfs2.h" 30 #include "alloc.h" 31 #include "dlmglue.h" 32 #include "file.h" 33 #include "inode.h" 34 #include "journal.h" 35 #include "ocfs2_fs.h" 36 37 #include "xattr.h" 38 #include "acl.h" 39 40 /* 41 * Convert from xattr value to acl struct. 42 */ 43 static struct posix_acl *ocfs2_acl_from_xattr(const void *value, size_t size) 44 { 45 int n, count; 46 struct posix_acl *acl; 47 48 if (!value) 49 return NULL; 50 if (size < sizeof(struct posix_acl_entry)) 51 return ERR_PTR(-EINVAL); 52 53 count = size / sizeof(struct posix_acl_entry); 54 if (count < 0) 55 return ERR_PTR(-EINVAL); 56 if (count == 0) 57 return NULL; 58 59 acl = posix_acl_alloc(count, GFP_NOFS); 60 if (!acl) 61 return ERR_PTR(-ENOMEM); 62 for (n = 0; n < count; n++) { 63 struct ocfs2_acl_entry *entry = 64 (struct ocfs2_acl_entry *)value; 65 66 acl->a_entries[n].e_tag = le16_to_cpu(entry->e_tag); 67 acl->a_entries[n].e_perm = le16_to_cpu(entry->e_perm); 68 switch(acl->a_entries[n].e_tag) { 69 case ACL_USER: 70 acl->a_entries[n].e_uid = 71 make_kuid(&init_user_ns, 72 le32_to_cpu(entry->e_id)); 73 break; 74 case ACL_GROUP: 75 acl->a_entries[n].e_gid = 76 make_kgid(&init_user_ns, 77 le32_to_cpu(entry->e_id)); 78 break; 79 default: 80 break; 81 } 82 value += sizeof(struct posix_acl_entry); 83 84 } 85 return acl; 86 } 87 88 /* 89 * Convert acl struct to xattr value. 90 */ 91 static void *ocfs2_acl_to_xattr(const struct posix_acl *acl, size_t *size) 92 { 93 struct ocfs2_acl_entry *entry = NULL; 94 char *ocfs2_acl; 95 size_t n; 96 97 *size = acl->a_count * sizeof(struct posix_acl_entry); 98 99 ocfs2_acl = kmalloc(*size, GFP_NOFS); 100 if (!ocfs2_acl) 101 return ERR_PTR(-ENOMEM); 102 103 entry = (struct ocfs2_acl_entry *)ocfs2_acl; 104 for (n = 0; n < acl->a_count; n++, entry++) { 105 entry->e_tag = cpu_to_le16(acl->a_entries[n].e_tag); 106 entry->e_perm = cpu_to_le16(acl->a_entries[n].e_perm); 107 switch(acl->a_entries[n].e_tag) { 108 case ACL_USER: 109 entry->e_id = cpu_to_le32( 110 from_kuid(&init_user_ns, 111 acl->a_entries[n].e_uid)); 112 break; 113 case ACL_GROUP: 114 entry->e_id = cpu_to_le32( 115 from_kgid(&init_user_ns, 116 acl->a_entries[n].e_gid)); 117 break; 118 default: 119 entry->e_id = cpu_to_le32(ACL_UNDEFINED_ID); 120 break; 121 } 122 } 123 return ocfs2_acl; 124 } 125 126 static struct posix_acl *ocfs2_get_acl_nolock(struct inode *inode, 127 int type, 128 struct buffer_head *di_bh) 129 { 130 int name_index; 131 char *value = NULL; 132 struct posix_acl *acl; 133 int retval; 134 135 switch (type) { 136 case ACL_TYPE_ACCESS: 137 name_index = OCFS2_XATTR_INDEX_POSIX_ACL_ACCESS; 138 break; 139 case ACL_TYPE_DEFAULT: 140 name_index = OCFS2_XATTR_INDEX_POSIX_ACL_DEFAULT; 141 break; 142 default: 143 return ERR_PTR(-EINVAL); 144 } 145 146 retval = ocfs2_xattr_get_nolock(inode, di_bh, name_index, "", NULL, 0); 147 if (retval > 0) { 148 value = kmalloc(retval, GFP_NOFS); 149 if (!value) 150 return ERR_PTR(-ENOMEM); 151 retval = ocfs2_xattr_get_nolock(inode, di_bh, name_index, 152 "", value, retval); 153 } 154 155 if (retval > 0) 156 acl = ocfs2_acl_from_xattr(value, retval); 157 else if (retval == -ENODATA || retval == 0) 158 acl = NULL; 159 else 160 acl = ERR_PTR(retval); 161 162 kfree(value); 163 164 return acl; 165 } 166 167 168 /* 169 * Get posix acl. 170 */ 171 static struct posix_acl *ocfs2_get_acl(struct inode *inode, int type) 172 { 173 struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); 174 struct buffer_head *di_bh = NULL; 175 struct posix_acl *acl; 176 int ret; 177 178 if (!(osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL)) 179 return NULL; 180 181 ret = ocfs2_inode_lock(inode, &di_bh, 0); 182 if (ret < 0) { 183 mlog_errno(ret); 184 acl = ERR_PTR(ret); 185 return acl; 186 } 187 188 acl = ocfs2_get_acl_nolock(inode, type, di_bh); 189 190 ocfs2_inode_unlock(inode, 0); 191 192 brelse(di_bh); 193 194 return acl; 195 } 196 197 /* 198 * Helper function to set i_mode in memory and disk. Some call paths 199 * will not have di_bh or a journal handle to pass, in which case it 200 * will create it's own. 201 */ 202 static int ocfs2_acl_set_mode(struct inode *inode, struct buffer_head *di_bh, 203 handle_t *handle, umode_t new_mode) 204 { 205 int ret, commit_handle = 0; 206 struct ocfs2_dinode *di; 207 208 if (di_bh == NULL) { 209 ret = ocfs2_read_inode_block(inode, &di_bh); 210 if (ret) { 211 mlog_errno(ret); 212 goto out; 213 } 214 } else 215 get_bh(di_bh); 216 217 if (handle == NULL) { 218 handle = ocfs2_start_trans(OCFS2_SB(inode->i_sb), 219 OCFS2_INODE_UPDATE_CREDITS); 220 if (IS_ERR(handle)) { 221 ret = PTR_ERR(handle); 222 mlog_errno(ret); 223 goto out_brelse; 224 } 225 226 commit_handle = 1; 227 } 228 229 di = (struct ocfs2_dinode *)di_bh->b_data; 230 ret = ocfs2_journal_access_di(handle, INODE_CACHE(inode), di_bh, 231 OCFS2_JOURNAL_ACCESS_WRITE); 232 if (ret) { 233 mlog_errno(ret); 234 goto out_commit; 235 } 236 237 inode->i_mode = new_mode; 238 inode->i_ctime = CURRENT_TIME; 239 di->i_mode = cpu_to_le16(inode->i_mode); 240 di->i_ctime = cpu_to_le64(inode->i_ctime.tv_sec); 241 di->i_ctime_nsec = cpu_to_le32(inode->i_ctime.tv_nsec); 242 243 ocfs2_journal_dirty(handle, di_bh); 244 245 out_commit: 246 if (commit_handle) 247 ocfs2_commit_trans(OCFS2_SB(inode->i_sb), handle); 248 out_brelse: 249 brelse(di_bh); 250 out: 251 return ret; 252 } 253 254 /* 255 * Set the access or default ACL of an inode. 256 */ 257 static int ocfs2_set_acl(handle_t *handle, 258 struct inode *inode, 259 struct buffer_head *di_bh, 260 int type, 261 struct posix_acl *acl, 262 struct ocfs2_alloc_context *meta_ac, 263 struct ocfs2_alloc_context *data_ac) 264 { 265 int name_index; 266 void *value = NULL; 267 size_t size = 0; 268 int ret; 269 270 if (S_ISLNK(inode->i_mode)) 271 return -EOPNOTSUPP; 272 273 switch (type) { 274 case ACL_TYPE_ACCESS: 275 name_index = OCFS2_XATTR_INDEX_POSIX_ACL_ACCESS; 276 if (acl) { 277 umode_t mode = inode->i_mode; 278 ret = posix_acl_equiv_mode(acl, &mode); 279 if (ret < 0) 280 return ret; 281 else { 282 if (ret == 0) 283 acl = NULL; 284 285 ret = ocfs2_acl_set_mode(inode, di_bh, 286 handle, mode); 287 if (ret) 288 return ret; 289 290 } 291 } 292 break; 293 case ACL_TYPE_DEFAULT: 294 name_index = OCFS2_XATTR_INDEX_POSIX_ACL_DEFAULT; 295 if (!S_ISDIR(inode->i_mode)) 296 return acl ? -EACCES : 0; 297 break; 298 default: 299 return -EINVAL; 300 } 301 302 if (acl) { 303 value = ocfs2_acl_to_xattr(acl, &size); 304 if (IS_ERR(value)) 305 return (int)PTR_ERR(value); 306 } 307 308 if (handle) 309 ret = ocfs2_xattr_set_handle(handle, inode, di_bh, name_index, 310 "", value, size, 0, 311 meta_ac, data_ac); 312 else 313 ret = ocfs2_xattr_set(inode, name_index, "", value, size, 0); 314 315 kfree(value); 316 317 return ret; 318 } 319 320 struct posix_acl *ocfs2_iop_get_acl(struct inode *inode, int type) 321 { 322 struct ocfs2_super *osb; 323 struct buffer_head *di_bh = NULL; 324 struct posix_acl *acl; 325 int ret = -EAGAIN; 326 327 osb = OCFS2_SB(inode->i_sb); 328 if (!(osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL)) 329 return NULL; 330 331 ret = ocfs2_read_inode_block(inode, &di_bh); 332 if (ret < 0) 333 return ERR_PTR(ret); 334 335 acl = ocfs2_get_acl_nolock(inode, type, di_bh); 336 337 brelse(di_bh); 338 339 return acl; 340 } 341 342 int ocfs2_acl_chmod(struct inode *inode) 343 { 344 struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); 345 struct posix_acl *acl; 346 int ret; 347 348 if (S_ISLNK(inode->i_mode)) 349 return -EOPNOTSUPP; 350 351 if (!(osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL)) 352 return 0; 353 354 acl = ocfs2_get_acl(inode, ACL_TYPE_ACCESS); 355 if (IS_ERR(acl) || !acl) 356 return PTR_ERR(acl); 357 ret = posix_acl_chmod(&acl, GFP_KERNEL, inode->i_mode); 358 if (ret) 359 return ret; 360 ret = ocfs2_set_acl(NULL, inode, NULL, ACL_TYPE_ACCESS, 361 acl, NULL, NULL); 362 posix_acl_release(acl); 363 return ret; 364 } 365 366 /* 367 * Initialize the ACLs of a new inode. If parent directory has default ACL, 368 * then clone to new inode. Called from ocfs2_mknod. 369 */ 370 int ocfs2_init_acl(handle_t *handle, 371 struct inode *inode, 372 struct inode *dir, 373 struct buffer_head *di_bh, 374 struct buffer_head *dir_bh, 375 struct ocfs2_alloc_context *meta_ac, 376 struct ocfs2_alloc_context *data_ac) 377 { 378 struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); 379 struct posix_acl *acl = NULL; 380 int ret = 0, ret2; 381 umode_t mode; 382 383 if (!S_ISLNK(inode->i_mode)) { 384 if (osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL) { 385 acl = ocfs2_get_acl_nolock(dir, ACL_TYPE_DEFAULT, 386 dir_bh); 387 if (IS_ERR(acl)) 388 return PTR_ERR(acl); 389 } 390 if (!acl) { 391 mode = inode->i_mode & ~current_umask(); 392 ret = ocfs2_acl_set_mode(inode, di_bh, handle, mode); 393 if (ret) { 394 mlog_errno(ret); 395 goto cleanup; 396 } 397 } 398 } 399 if ((osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL) && acl) { 400 if (S_ISDIR(inode->i_mode)) { 401 ret = ocfs2_set_acl(handle, inode, di_bh, 402 ACL_TYPE_DEFAULT, acl, 403 meta_ac, data_ac); 404 if (ret) 405 goto cleanup; 406 } 407 mode = inode->i_mode; 408 ret = posix_acl_create(&acl, GFP_NOFS, &mode); 409 if (ret < 0) 410 return ret; 411 412 ret2 = ocfs2_acl_set_mode(inode, di_bh, handle, mode); 413 if (ret2) { 414 mlog_errno(ret2); 415 ret = ret2; 416 goto cleanup; 417 } 418 if (ret > 0) { 419 ret = ocfs2_set_acl(handle, inode, 420 di_bh, ACL_TYPE_ACCESS, 421 acl, meta_ac, data_ac); 422 } 423 } 424 cleanup: 425 posix_acl_release(acl); 426 return ret; 427 } 428 429 static size_t ocfs2_xattr_list_acl_access(struct dentry *dentry, 430 char *list, 431 size_t list_len, 432 const char *name, 433 size_t name_len, 434 int type) 435 { 436 struct ocfs2_super *osb = OCFS2_SB(dentry->d_sb); 437 const size_t size = sizeof(POSIX_ACL_XATTR_ACCESS); 438 439 if (!(osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL)) 440 return 0; 441 442 if (list && size <= list_len) 443 memcpy(list, POSIX_ACL_XATTR_ACCESS, size); 444 return size; 445 } 446 447 static size_t ocfs2_xattr_list_acl_default(struct dentry *dentry, 448 char *list, 449 size_t list_len, 450 const char *name, 451 size_t name_len, 452 int type) 453 { 454 struct ocfs2_super *osb = OCFS2_SB(dentry->d_sb); 455 const size_t size = sizeof(POSIX_ACL_XATTR_DEFAULT); 456 457 if (!(osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL)) 458 return 0; 459 460 if (list && size <= list_len) 461 memcpy(list, POSIX_ACL_XATTR_DEFAULT, size); 462 return size; 463 } 464 465 static int ocfs2_xattr_get_acl(struct dentry *dentry, const char *name, 466 void *buffer, size_t size, int type) 467 { 468 struct ocfs2_super *osb = OCFS2_SB(dentry->d_sb); 469 struct posix_acl *acl; 470 int ret; 471 472 if (strcmp(name, "") != 0) 473 return -EINVAL; 474 if (!(osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL)) 475 return -EOPNOTSUPP; 476 477 acl = ocfs2_get_acl(dentry->d_inode, type); 478 if (IS_ERR(acl)) 479 return PTR_ERR(acl); 480 if (acl == NULL) 481 return -ENODATA; 482 ret = posix_acl_to_xattr(&init_user_ns, acl, buffer, size); 483 posix_acl_release(acl); 484 485 return ret; 486 } 487 488 static int ocfs2_xattr_set_acl(struct dentry *dentry, const char *name, 489 const void *value, size_t size, int flags, int type) 490 { 491 struct inode *inode = dentry->d_inode; 492 struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); 493 struct posix_acl *acl; 494 int ret = 0; 495 496 if (strcmp(name, "") != 0) 497 return -EINVAL; 498 if (!(osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL)) 499 return -EOPNOTSUPP; 500 501 if (!inode_owner_or_capable(inode)) 502 return -EPERM; 503 504 if (value) { 505 acl = posix_acl_from_xattr(&init_user_ns, value, size); 506 if (IS_ERR(acl)) 507 return PTR_ERR(acl); 508 else if (acl) { 509 ret = posix_acl_valid(acl); 510 if (ret) 511 goto cleanup; 512 } 513 } else 514 acl = NULL; 515 516 ret = ocfs2_set_acl(NULL, inode, NULL, type, acl, NULL, NULL); 517 518 cleanup: 519 posix_acl_release(acl); 520 return ret; 521 } 522 523 const struct xattr_handler ocfs2_xattr_acl_access_handler = { 524 .prefix = POSIX_ACL_XATTR_ACCESS, 525 .flags = ACL_TYPE_ACCESS, 526 .list = ocfs2_xattr_list_acl_access, 527 .get = ocfs2_xattr_get_acl, 528 .set = ocfs2_xattr_set_acl, 529 }; 530 531 const struct xattr_handler ocfs2_xattr_acl_default_handler = { 532 .prefix = POSIX_ACL_XATTR_DEFAULT, 533 .flags = ACL_TYPE_DEFAULT, 534 .list = ocfs2_xattr_list_acl_default, 535 .get = ocfs2_xattr_get_acl, 536 .set = ocfs2_xattr_set_acl, 537 }; 538