1 // SPDX-License-Identifier: GPL-2.0-only 2 /* -*- mode: c; c-basic-offset: 8; -*- 3 * vim: noexpandtab sw=8 ts=8 sts=0: 4 * 5 * acl.c 6 * 7 * Copyright (C) 2004, 2008 Oracle. All rights reserved. 8 * 9 * CREDITS: 10 * Lots of code in this file is copy from linux/fs/ext3/acl.c. 11 * Copyright (C) 2001-2003 Andreas Gruenbacher, <agruen@suse.de> 12 */ 13 14 #include <linux/init.h> 15 #include <linux/module.h> 16 #include <linux/slab.h> 17 #include <linux/string.h> 18 19 #include <cluster/masklog.h> 20 21 #include "ocfs2.h" 22 #include "alloc.h" 23 #include "dlmglue.h" 24 #include "file.h" 25 #include "inode.h" 26 #include "journal.h" 27 #include "ocfs2_fs.h" 28 29 #include "xattr.h" 30 #include "acl.h" 31 32 /* 33 * Convert from xattr value to acl struct. 34 */ 35 static struct posix_acl *ocfs2_acl_from_xattr(const void *value, size_t size) 36 { 37 int n, count; 38 struct posix_acl *acl; 39 40 if (!value) 41 return NULL; 42 if (size < sizeof(struct posix_acl_entry)) 43 return ERR_PTR(-EINVAL); 44 45 count = size / sizeof(struct posix_acl_entry); 46 47 acl = posix_acl_alloc(count, GFP_NOFS); 48 if (!acl) 49 return ERR_PTR(-ENOMEM); 50 for (n = 0; n < count; n++) { 51 struct ocfs2_acl_entry *entry = 52 (struct ocfs2_acl_entry *)value; 53 54 acl->a_entries[n].e_tag = le16_to_cpu(entry->e_tag); 55 acl->a_entries[n].e_perm = le16_to_cpu(entry->e_perm); 56 switch(acl->a_entries[n].e_tag) { 57 case ACL_USER: 58 acl->a_entries[n].e_uid = 59 make_kuid(&init_user_ns, 60 le32_to_cpu(entry->e_id)); 61 break; 62 case ACL_GROUP: 63 acl->a_entries[n].e_gid = 64 make_kgid(&init_user_ns, 65 le32_to_cpu(entry->e_id)); 66 break; 67 default: 68 break; 69 } 70 value += sizeof(struct posix_acl_entry); 71 72 } 73 return acl; 74 } 75 76 /* 77 * Convert acl struct to xattr value. 78 */ 79 static void *ocfs2_acl_to_xattr(const struct posix_acl *acl, size_t *size) 80 { 81 struct ocfs2_acl_entry *entry = NULL; 82 char *ocfs2_acl; 83 size_t n; 84 85 *size = acl->a_count * sizeof(struct posix_acl_entry); 86 87 ocfs2_acl = kmalloc(*size, GFP_NOFS); 88 if (!ocfs2_acl) 89 return ERR_PTR(-ENOMEM); 90 91 entry = (struct ocfs2_acl_entry *)ocfs2_acl; 92 for (n = 0; n < acl->a_count; n++, entry++) { 93 entry->e_tag = cpu_to_le16(acl->a_entries[n].e_tag); 94 entry->e_perm = cpu_to_le16(acl->a_entries[n].e_perm); 95 switch(acl->a_entries[n].e_tag) { 96 case ACL_USER: 97 entry->e_id = cpu_to_le32( 98 from_kuid(&init_user_ns, 99 acl->a_entries[n].e_uid)); 100 break; 101 case ACL_GROUP: 102 entry->e_id = cpu_to_le32( 103 from_kgid(&init_user_ns, 104 acl->a_entries[n].e_gid)); 105 break; 106 default: 107 entry->e_id = cpu_to_le32(ACL_UNDEFINED_ID); 108 break; 109 } 110 } 111 return ocfs2_acl; 112 } 113 114 static struct posix_acl *ocfs2_get_acl_nolock(struct inode *inode, 115 int type, 116 struct buffer_head *di_bh) 117 { 118 int name_index; 119 char *value = NULL; 120 struct posix_acl *acl; 121 int retval; 122 123 switch (type) { 124 case ACL_TYPE_ACCESS: 125 name_index = OCFS2_XATTR_INDEX_POSIX_ACL_ACCESS; 126 break; 127 case ACL_TYPE_DEFAULT: 128 name_index = OCFS2_XATTR_INDEX_POSIX_ACL_DEFAULT; 129 break; 130 default: 131 return ERR_PTR(-EINVAL); 132 } 133 134 retval = ocfs2_xattr_get_nolock(inode, di_bh, name_index, "", NULL, 0); 135 if (retval > 0) { 136 value = kmalloc(retval, GFP_NOFS); 137 if (!value) 138 return ERR_PTR(-ENOMEM); 139 retval = ocfs2_xattr_get_nolock(inode, di_bh, name_index, 140 "", value, retval); 141 } 142 143 if (retval > 0) 144 acl = ocfs2_acl_from_xattr(value, retval); 145 else if (retval == -ENODATA || retval == 0) 146 acl = NULL; 147 else 148 acl = ERR_PTR(retval); 149 150 kfree(value); 151 152 return acl; 153 } 154 155 /* 156 * Helper function to set i_mode in memory and disk. Some call paths 157 * will not have di_bh or a journal handle to pass, in which case it 158 * will create it's own. 159 */ 160 static int ocfs2_acl_set_mode(struct inode *inode, struct buffer_head *di_bh, 161 handle_t *handle, umode_t new_mode) 162 { 163 int ret, commit_handle = 0; 164 struct ocfs2_dinode *di; 165 166 if (di_bh == NULL) { 167 ret = ocfs2_read_inode_block(inode, &di_bh); 168 if (ret) { 169 mlog_errno(ret); 170 goto out; 171 } 172 } else 173 get_bh(di_bh); 174 175 if (handle == NULL) { 176 handle = ocfs2_start_trans(OCFS2_SB(inode->i_sb), 177 OCFS2_INODE_UPDATE_CREDITS); 178 if (IS_ERR(handle)) { 179 ret = PTR_ERR(handle); 180 mlog_errno(ret); 181 goto out_brelse; 182 } 183 184 commit_handle = 1; 185 } 186 187 di = (struct ocfs2_dinode *)di_bh->b_data; 188 ret = ocfs2_journal_access_di(handle, INODE_CACHE(inode), di_bh, 189 OCFS2_JOURNAL_ACCESS_WRITE); 190 if (ret) { 191 mlog_errno(ret); 192 goto out_commit; 193 } 194 195 inode->i_mode = new_mode; 196 inode->i_ctime = current_time(inode); 197 di->i_mode = cpu_to_le16(inode->i_mode); 198 di->i_ctime = cpu_to_le64(inode->i_ctime.tv_sec); 199 di->i_ctime_nsec = cpu_to_le32(inode->i_ctime.tv_nsec); 200 ocfs2_update_inode_fsync_trans(handle, inode, 0); 201 202 ocfs2_journal_dirty(handle, di_bh); 203 204 out_commit: 205 if (commit_handle) 206 ocfs2_commit_trans(OCFS2_SB(inode->i_sb), handle); 207 out_brelse: 208 brelse(di_bh); 209 out: 210 return ret; 211 } 212 213 /* 214 * Set the access or default ACL of an inode. 215 */ 216 static int ocfs2_set_acl(handle_t *handle, 217 struct inode *inode, 218 struct buffer_head *di_bh, 219 int type, 220 struct posix_acl *acl, 221 struct ocfs2_alloc_context *meta_ac, 222 struct ocfs2_alloc_context *data_ac) 223 { 224 int name_index; 225 void *value = NULL; 226 size_t size = 0; 227 int ret; 228 229 if (S_ISLNK(inode->i_mode)) 230 return -EOPNOTSUPP; 231 232 switch (type) { 233 case ACL_TYPE_ACCESS: 234 name_index = OCFS2_XATTR_INDEX_POSIX_ACL_ACCESS; 235 break; 236 case ACL_TYPE_DEFAULT: 237 name_index = OCFS2_XATTR_INDEX_POSIX_ACL_DEFAULT; 238 if (!S_ISDIR(inode->i_mode)) 239 return acl ? -EACCES : 0; 240 break; 241 default: 242 return -EINVAL; 243 } 244 245 if (acl) { 246 value = ocfs2_acl_to_xattr(acl, &size); 247 if (IS_ERR(value)) 248 return (int)PTR_ERR(value); 249 } 250 251 if (handle) 252 ret = ocfs2_xattr_set_handle(handle, inode, di_bh, name_index, 253 "", value, size, 0, 254 meta_ac, data_ac); 255 else 256 ret = ocfs2_xattr_set(inode, name_index, "", value, size, 0); 257 258 kfree(value); 259 260 return ret; 261 } 262 263 int ocfs2_iop_set_acl(struct inode *inode, struct posix_acl *acl, int type) 264 { 265 struct buffer_head *bh = NULL; 266 int status, had_lock; 267 struct ocfs2_lock_holder oh; 268 269 had_lock = ocfs2_inode_lock_tracker(inode, &bh, 1, &oh); 270 if (had_lock < 0) 271 return had_lock; 272 if (type == ACL_TYPE_ACCESS && acl) { 273 umode_t mode; 274 275 status = posix_acl_update_mode(inode, &mode, &acl); 276 if (status) 277 goto unlock; 278 279 status = ocfs2_acl_set_mode(inode, bh, NULL, mode); 280 if (status) 281 goto unlock; 282 } 283 status = ocfs2_set_acl(NULL, inode, bh, type, acl, NULL, NULL); 284 unlock: 285 ocfs2_inode_unlock_tracker(inode, 1, &oh, had_lock); 286 brelse(bh); 287 return status; 288 } 289 290 struct posix_acl *ocfs2_iop_get_acl(struct inode *inode, int type) 291 { 292 struct ocfs2_super *osb; 293 struct buffer_head *di_bh = NULL; 294 struct posix_acl *acl; 295 int had_lock; 296 struct ocfs2_lock_holder oh; 297 298 osb = OCFS2_SB(inode->i_sb); 299 if (!(osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL)) 300 return NULL; 301 302 had_lock = ocfs2_inode_lock_tracker(inode, &di_bh, 0, &oh); 303 if (had_lock < 0) 304 return ERR_PTR(had_lock); 305 306 down_read(&OCFS2_I(inode)->ip_xattr_sem); 307 acl = ocfs2_get_acl_nolock(inode, type, di_bh); 308 up_read(&OCFS2_I(inode)->ip_xattr_sem); 309 310 ocfs2_inode_unlock_tracker(inode, 0, &oh, had_lock); 311 brelse(di_bh); 312 return acl; 313 } 314 315 int ocfs2_acl_chmod(struct inode *inode, struct buffer_head *bh) 316 { 317 struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); 318 struct posix_acl *acl; 319 int ret; 320 321 if (S_ISLNK(inode->i_mode)) 322 return -EOPNOTSUPP; 323 324 if (!(osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL)) 325 return 0; 326 327 down_read(&OCFS2_I(inode)->ip_xattr_sem); 328 acl = ocfs2_get_acl_nolock(inode, ACL_TYPE_ACCESS, bh); 329 up_read(&OCFS2_I(inode)->ip_xattr_sem); 330 if (IS_ERR(acl) || !acl) 331 return PTR_ERR(acl); 332 ret = __posix_acl_chmod(&acl, GFP_KERNEL, inode->i_mode); 333 if (ret) 334 return ret; 335 ret = ocfs2_set_acl(NULL, inode, NULL, ACL_TYPE_ACCESS, 336 acl, NULL, NULL); 337 posix_acl_release(acl); 338 return ret; 339 } 340 341 /* 342 * Initialize the ACLs of a new inode. If parent directory has default ACL, 343 * then clone to new inode. Called from ocfs2_mknod. 344 */ 345 int ocfs2_init_acl(handle_t *handle, 346 struct inode *inode, 347 struct inode *dir, 348 struct buffer_head *di_bh, 349 struct buffer_head *dir_bh, 350 struct ocfs2_alloc_context *meta_ac, 351 struct ocfs2_alloc_context *data_ac) 352 { 353 struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); 354 struct posix_acl *acl = NULL; 355 int ret = 0, ret2; 356 umode_t mode; 357 358 if (!S_ISLNK(inode->i_mode)) { 359 if (osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL) { 360 down_read(&OCFS2_I(dir)->ip_xattr_sem); 361 acl = ocfs2_get_acl_nolock(dir, ACL_TYPE_DEFAULT, 362 dir_bh); 363 up_read(&OCFS2_I(dir)->ip_xattr_sem); 364 if (IS_ERR(acl)) 365 return PTR_ERR(acl); 366 } 367 if (!acl) { 368 mode = inode->i_mode & ~current_umask(); 369 ret = ocfs2_acl_set_mode(inode, di_bh, handle, mode); 370 if (ret) { 371 mlog_errno(ret); 372 goto cleanup; 373 } 374 } 375 } 376 if ((osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL) && acl) { 377 if (S_ISDIR(inode->i_mode)) { 378 ret = ocfs2_set_acl(handle, inode, di_bh, 379 ACL_TYPE_DEFAULT, acl, 380 meta_ac, data_ac); 381 if (ret) 382 goto cleanup; 383 } 384 mode = inode->i_mode; 385 ret = __posix_acl_create(&acl, GFP_NOFS, &mode); 386 if (ret < 0) 387 return ret; 388 389 ret2 = ocfs2_acl_set_mode(inode, di_bh, handle, mode); 390 if (ret2) { 391 mlog_errno(ret2); 392 ret = ret2; 393 goto cleanup; 394 } 395 if (ret > 0) { 396 ret = ocfs2_set_acl(handle, inode, 397 di_bh, ACL_TYPE_ACCESS, 398 acl, meta_ac, data_ac); 399 } 400 } 401 cleanup: 402 posix_acl_release(acl); 403 return ret; 404 } 405