1 // SPDX-License-Identifier: GPL-2.0-only 2 /* -*- mode: c; c-basic-offset: 8; -*- 3 * vim: noexpandtab sw=8 ts=8 sts=0: 4 * 5 * acl.c 6 * 7 * Copyright (C) 2004, 2008 Oracle. All rights reserved. 8 * 9 * CREDITS: 10 * Lots of code in this file is copy from linux/fs/ext3/acl.c. 11 * Copyright (C) 2001-2003 Andreas Gruenbacher, <agruen@suse.de> 12 */ 13 14 #include <linux/init.h> 15 #include <linux/module.h> 16 #include <linux/slab.h> 17 #include <linux/string.h> 18 19 #include <cluster/masklog.h> 20 21 #include "ocfs2.h" 22 #include "alloc.h" 23 #include "dlmglue.h" 24 #include "file.h" 25 #include "inode.h" 26 #include "journal.h" 27 #include "ocfs2_fs.h" 28 29 #include "xattr.h" 30 #include "acl.h" 31 32 /* 33 * Convert from xattr value to acl struct. 34 */ 35 static struct posix_acl *ocfs2_acl_from_xattr(const void *value, size_t size) 36 { 37 int n, count; 38 struct posix_acl *acl; 39 40 if (!value) 41 return NULL; 42 if (size < sizeof(struct posix_acl_entry)) 43 return ERR_PTR(-EINVAL); 44 45 count = size / sizeof(struct posix_acl_entry); 46 47 acl = posix_acl_alloc(count, GFP_NOFS); 48 if (!acl) 49 return ERR_PTR(-ENOMEM); 50 for (n = 0; n < count; n++) { 51 struct ocfs2_acl_entry *entry = 52 (struct ocfs2_acl_entry *)value; 53 54 acl->a_entries[n].e_tag = le16_to_cpu(entry->e_tag); 55 acl->a_entries[n].e_perm = le16_to_cpu(entry->e_perm); 56 switch(acl->a_entries[n].e_tag) { 57 case ACL_USER: 58 acl->a_entries[n].e_uid = 59 make_kuid(&init_user_ns, 60 le32_to_cpu(entry->e_id)); 61 break; 62 case ACL_GROUP: 63 acl->a_entries[n].e_gid = 64 make_kgid(&init_user_ns, 65 le32_to_cpu(entry->e_id)); 66 break; 67 default: 68 break; 69 } 70 value += sizeof(struct posix_acl_entry); 71 72 } 73 return acl; 74 } 75 76 /* 77 * Convert acl struct to xattr value. 78 */ 79 static void *ocfs2_acl_to_xattr(const struct posix_acl *acl, size_t *size) 80 { 81 struct ocfs2_acl_entry *entry = NULL; 82 char *ocfs2_acl; 83 size_t n; 84 85 *size = acl->a_count * sizeof(struct posix_acl_entry); 86 87 ocfs2_acl = kmalloc(*size, GFP_NOFS); 88 if (!ocfs2_acl) 89 return ERR_PTR(-ENOMEM); 90 91 entry = (struct ocfs2_acl_entry *)ocfs2_acl; 92 for (n = 0; n < acl->a_count; n++, entry++) { 93 entry->e_tag = cpu_to_le16(acl->a_entries[n].e_tag); 94 entry->e_perm = cpu_to_le16(acl->a_entries[n].e_perm); 95 switch(acl->a_entries[n].e_tag) { 96 case ACL_USER: 97 entry->e_id = cpu_to_le32( 98 from_kuid(&init_user_ns, 99 acl->a_entries[n].e_uid)); 100 break; 101 case ACL_GROUP: 102 entry->e_id = cpu_to_le32( 103 from_kgid(&init_user_ns, 104 acl->a_entries[n].e_gid)); 105 break; 106 default: 107 entry->e_id = cpu_to_le32(ACL_UNDEFINED_ID); 108 break; 109 } 110 } 111 return ocfs2_acl; 112 } 113 114 static struct posix_acl *ocfs2_get_acl_nolock(struct inode *inode, 115 int type, 116 struct buffer_head *di_bh) 117 { 118 int name_index; 119 char *value = NULL; 120 struct posix_acl *acl; 121 int retval; 122 123 switch (type) { 124 case ACL_TYPE_ACCESS: 125 name_index = OCFS2_XATTR_INDEX_POSIX_ACL_ACCESS; 126 break; 127 case ACL_TYPE_DEFAULT: 128 name_index = OCFS2_XATTR_INDEX_POSIX_ACL_DEFAULT; 129 break; 130 default: 131 return ERR_PTR(-EINVAL); 132 } 133 134 retval = ocfs2_xattr_get_nolock(inode, di_bh, name_index, "", NULL, 0); 135 if (retval > 0) { 136 value = kmalloc(retval, GFP_NOFS); 137 if (!value) 138 return ERR_PTR(-ENOMEM); 139 retval = ocfs2_xattr_get_nolock(inode, di_bh, name_index, 140 "", value, retval); 141 } 142 143 if (retval > 0) 144 acl = ocfs2_acl_from_xattr(value, retval); 145 else if (retval == -ENODATA || retval == 0) 146 acl = NULL; 147 else 148 acl = ERR_PTR(retval); 149 150 kfree(value); 151 152 return acl; 153 } 154 155 /* 156 * Helper function to set i_mode in memory and disk. Some call paths 157 * will not have di_bh or a journal handle to pass, in which case it 158 * will create it's own. 159 */ 160 static int ocfs2_acl_set_mode(struct inode *inode, struct buffer_head *di_bh, 161 handle_t *handle, umode_t new_mode) 162 { 163 int ret, commit_handle = 0; 164 struct ocfs2_dinode *di; 165 166 if (di_bh == NULL) { 167 ret = ocfs2_read_inode_block(inode, &di_bh); 168 if (ret) { 169 mlog_errno(ret); 170 goto out; 171 } 172 } else 173 get_bh(di_bh); 174 175 if (handle == NULL) { 176 handle = ocfs2_start_trans(OCFS2_SB(inode->i_sb), 177 OCFS2_INODE_UPDATE_CREDITS); 178 if (IS_ERR(handle)) { 179 ret = PTR_ERR(handle); 180 mlog_errno(ret); 181 goto out_brelse; 182 } 183 184 commit_handle = 1; 185 } 186 187 di = (struct ocfs2_dinode *)di_bh->b_data; 188 ret = ocfs2_journal_access_di(handle, INODE_CACHE(inode), di_bh, 189 OCFS2_JOURNAL_ACCESS_WRITE); 190 if (ret) { 191 mlog_errno(ret); 192 goto out_commit; 193 } 194 195 inode->i_mode = new_mode; 196 inode->i_ctime = current_time(inode); 197 di->i_mode = cpu_to_le16(inode->i_mode); 198 di->i_ctime = cpu_to_le64(inode->i_ctime.tv_sec); 199 di->i_ctime_nsec = cpu_to_le32(inode->i_ctime.tv_nsec); 200 ocfs2_update_inode_fsync_trans(handle, inode, 0); 201 202 ocfs2_journal_dirty(handle, di_bh); 203 204 out_commit: 205 if (commit_handle) 206 ocfs2_commit_trans(OCFS2_SB(inode->i_sb), handle); 207 out_brelse: 208 brelse(di_bh); 209 out: 210 return ret; 211 } 212 213 /* 214 * Set the access or default ACL of an inode. 215 */ 216 static int ocfs2_set_acl(handle_t *handle, 217 struct inode *inode, 218 struct buffer_head *di_bh, 219 int type, 220 struct posix_acl *acl, 221 struct ocfs2_alloc_context *meta_ac, 222 struct ocfs2_alloc_context *data_ac) 223 { 224 int name_index; 225 void *value = NULL; 226 size_t size = 0; 227 int ret; 228 229 if (S_ISLNK(inode->i_mode)) 230 return -EOPNOTSUPP; 231 232 switch (type) { 233 case ACL_TYPE_ACCESS: 234 name_index = OCFS2_XATTR_INDEX_POSIX_ACL_ACCESS; 235 break; 236 case ACL_TYPE_DEFAULT: 237 name_index = OCFS2_XATTR_INDEX_POSIX_ACL_DEFAULT; 238 if (!S_ISDIR(inode->i_mode)) 239 return acl ? -EACCES : 0; 240 break; 241 default: 242 return -EINVAL; 243 } 244 245 if (acl) { 246 value = ocfs2_acl_to_xattr(acl, &size); 247 if (IS_ERR(value)) 248 return (int)PTR_ERR(value); 249 } 250 251 if (handle) 252 ret = ocfs2_xattr_set_handle(handle, inode, di_bh, name_index, 253 "", value, size, 0, 254 meta_ac, data_ac); 255 else 256 ret = ocfs2_xattr_set(inode, name_index, "", value, size, 0); 257 258 kfree(value); 259 if (!ret) 260 set_cached_acl(inode, type, acl); 261 262 return ret; 263 } 264 265 int ocfs2_iop_set_acl(struct user_namespace *mnt_userns, struct inode *inode, 266 struct posix_acl *acl, int type) 267 { 268 struct buffer_head *bh = NULL; 269 int status, had_lock; 270 struct ocfs2_lock_holder oh; 271 272 had_lock = ocfs2_inode_lock_tracker(inode, &bh, 1, &oh); 273 if (had_lock < 0) 274 return had_lock; 275 if (type == ACL_TYPE_ACCESS && acl) { 276 umode_t mode; 277 278 status = posix_acl_update_mode(&init_user_ns, inode, &mode, 279 &acl); 280 if (status) 281 goto unlock; 282 283 status = ocfs2_acl_set_mode(inode, bh, NULL, mode); 284 if (status) 285 goto unlock; 286 } 287 status = ocfs2_set_acl(NULL, inode, bh, type, acl, NULL, NULL); 288 unlock: 289 ocfs2_inode_unlock_tracker(inode, 1, &oh, had_lock); 290 brelse(bh); 291 return status; 292 } 293 294 struct posix_acl *ocfs2_iop_get_acl(struct inode *inode, int type) 295 { 296 struct ocfs2_super *osb; 297 struct buffer_head *di_bh = NULL; 298 struct posix_acl *acl; 299 int had_lock; 300 struct ocfs2_lock_holder oh; 301 302 osb = OCFS2_SB(inode->i_sb); 303 if (!(osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL)) 304 return NULL; 305 306 had_lock = ocfs2_inode_lock_tracker(inode, &di_bh, 0, &oh); 307 if (had_lock < 0) 308 return ERR_PTR(had_lock); 309 310 down_read(&OCFS2_I(inode)->ip_xattr_sem); 311 acl = ocfs2_get_acl_nolock(inode, type, di_bh); 312 up_read(&OCFS2_I(inode)->ip_xattr_sem); 313 314 ocfs2_inode_unlock_tracker(inode, 0, &oh, had_lock); 315 brelse(di_bh); 316 return acl; 317 } 318 319 int ocfs2_acl_chmod(struct inode *inode, struct buffer_head *bh) 320 { 321 struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); 322 struct posix_acl *acl; 323 int ret; 324 325 if (S_ISLNK(inode->i_mode)) 326 return -EOPNOTSUPP; 327 328 if (!(osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL)) 329 return 0; 330 331 down_read(&OCFS2_I(inode)->ip_xattr_sem); 332 acl = ocfs2_get_acl_nolock(inode, ACL_TYPE_ACCESS, bh); 333 up_read(&OCFS2_I(inode)->ip_xattr_sem); 334 if (IS_ERR_OR_NULL(acl)) 335 return PTR_ERR_OR_ZERO(acl); 336 ret = __posix_acl_chmod(&acl, GFP_KERNEL, inode->i_mode); 337 if (ret) 338 return ret; 339 ret = ocfs2_set_acl(NULL, inode, NULL, ACL_TYPE_ACCESS, 340 acl, NULL, NULL); 341 posix_acl_release(acl); 342 return ret; 343 } 344 345 /* 346 * Initialize the ACLs of a new inode. If parent directory has default ACL, 347 * then clone to new inode. Called from ocfs2_mknod. 348 */ 349 int ocfs2_init_acl(handle_t *handle, 350 struct inode *inode, 351 struct inode *dir, 352 struct buffer_head *di_bh, 353 struct buffer_head *dir_bh, 354 struct ocfs2_alloc_context *meta_ac, 355 struct ocfs2_alloc_context *data_ac) 356 { 357 struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); 358 struct posix_acl *acl = NULL; 359 int ret = 0, ret2; 360 umode_t mode; 361 362 if (!S_ISLNK(inode->i_mode)) { 363 if (osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL) { 364 down_read(&OCFS2_I(dir)->ip_xattr_sem); 365 acl = ocfs2_get_acl_nolock(dir, ACL_TYPE_DEFAULT, 366 dir_bh); 367 up_read(&OCFS2_I(dir)->ip_xattr_sem); 368 if (IS_ERR(acl)) 369 return PTR_ERR(acl); 370 } 371 if (!acl) { 372 mode = inode->i_mode & ~current_umask(); 373 ret = ocfs2_acl_set_mode(inode, di_bh, handle, mode); 374 if (ret) { 375 mlog_errno(ret); 376 goto cleanup; 377 } 378 } 379 } 380 if ((osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL) && acl) { 381 if (S_ISDIR(inode->i_mode)) { 382 ret = ocfs2_set_acl(handle, inode, di_bh, 383 ACL_TYPE_DEFAULT, acl, 384 meta_ac, data_ac); 385 if (ret) 386 goto cleanup; 387 } 388 mode = inode->i_mode; 389 ret = __posix_acl_create(&acl, GFP_NOFS, &mode); 390 if (ret < 0) 391 return ret; 392 393 ret2 = ocfs2_acl_set_mode(inode, di_bh, handle, mode); 394 if (ret2) { 395 mlog_errno(ret2); 396 ret = ret2; 397 goto cleanup; 398 } 399 if (ret > 0) { 400 ret = ocfs2_set_acl(handle, inode, 401 di_bh, ACL_TYPE_ACCESS, 402 acl, meta_ac, data_ac); 403 } 404 } 405 cleanup: 406 posix_acl_release(acl); 407 return ret; 408 } 409