1 // SPDX-License-Identifier: GPL-2.0-only 2 /* -*- mode: c; c-basic-offset: 8; -*- 3 * vim: noexpandtab sw=8 ts=8 sts=0: 4 * 5 * acl.c 6 * 7 * Copyright (C) 2004, 2008 Oracle. All rights reserved. 8 * 9 * CREDITS: 10 * Lots of code in this file is copy from linux/fs/ext3/acl.c. 11 * Copyright (C) 2001-2003 Andreas Gruenbacher, <agruen@suse.de> 12 */ 13 14 #include <linux/init.h> 15 #include <linux/module.h> 16 #include <linux/slab.h> 17 #include <linux/string.h> 18 19 #include <cluster/masklog.h> 20 21 #include "ocfs2.h" 22 #include "alloc.h" 23 #include "dlmglue.h" 24 #include "file.h" 25 #include "inode.h" 26 #include "journal.h" 27 #include "ocfs2_fs.h" 28 29 #include "xattr.h" 30 #include "acl.h" 31 32 /* 33 * Convert from xattr value to acl struct. 34 */ 35 static struct posix_acl *ocfs2_acl_from_xattr(const void *value, size_t size) 36 { 37 int n, count; 38 struct posix_acl *acl; 39 40 if (!value) 41 return NULL; 42 if (size < sizeof(struct posix_acl_entry)) 43 return ERR_PTR(-EINVAL); 44 45 count = size / sizeof(struct posix_acl_entry); 46 47 acl = posix_acl_alloc(count, GFP_NOFS); 48 if (!acl) 49 return ERR_PTR(-ENOMEM); 50 for (n = 0; n < count; n++) { 51 struct ocfs2_acl_entry *entry = 52 (struct ocfs2_acl_entry *)value; 53 54 acl->a_entries[n].e_tag = le16_to_cpu(entry->e_tag); 55 acl->a_entries[n].e_perm = le16_to_cpu(entry->e_perm); 56 switch(acl->a_entries[n].e_tag) { 57 case ACL_USER: 58 acl->a_entries[n].e_uid = 59 make_kuid(&init_user_ns, 60 le32_to_cpu(entry->e_id)); 61 break; 62 case ACL_GROUP: 63 acl->a_entries[n].e_gid = 64 make_kgid(&init_user_ns, 65 le32_to_cpu(entry->e_id)); 66 break; 67 default: 68 break; 69 } 70 value += sizeof(struct posix_acl_entry); 71 72 } 73 return acl; 74 } 75 76 /* 77 * Convert acl struct to xattr value. 78 */ 79 static void *ocfs2_acl_to_xattr(const struct posix_acl *acl, size_t *size) 80 { 81 struct ocfs2_acl_entry *entry = NULL; 82 char *ocfs2_acl; 83 size_t n; 84 85 *size = acl->a_count * sizeof(struct posix_acl_entry); 86 87 ocfs2_acl = kmalloc(*size, GFP_NOFS); 88 if (!ocfs2_acl) 89 return ERR_PTR(-ENOMEM); 90 91 entry = (struct ocfs2_acl_entry *)ocfs2_acl; 92 for (n = 0; n < acl->a_count; n++, entry++) { 93 entry->e_tag = cpu_to_le16(acl->a_entries[n].e_tag); 94 entry->e_perm = cpu_to_le16(acl->a_entries[n].e_perm); 95 switch(acl->a_entries[n].e_tag) { 96 case ACL_USER: 97 entry->e_id = cpu_to_le32( 98 from_kuid(&init_user_ns, 99 acl->a_entries[n].e_uid)); 100 break; 101 case ACL_GROUP: 102 entry->e_id = cpu_to_le32( 103 from_kgid(&init_user_ns, 104 acl->a_entries[n].e_gid)); 105 break; 106 default: 107 entry->e_id = cpu_to_le32(ACL_UNDEFINED_ID); 108 break; 109 } 110 } 111 return ocfs2_acl; 112 } 113 114 static struct posix_acl *ocfs2_get_acl_nolock(struct inode *inode, 115 int type, 116 struct buffer_head *di_bh) 117 { 118 int name_index; 119 char *value = NULL; 120 struct posix_acl *acl; 121 int retval; 122 123 switch (type) { 124 case ACL_TYPE_ACCESS: 125 name_index = OCFS2_XATTR_INDEX_POSIX_ACL_ACCESS; 126 break; 127 case ACL_TYPE_DEFAULT: 128 name_index = OCFS2_XATTR_INDEX_POSIX_ACL_DEFAULT; 129 break; 130 default: 131 return ERR_PTR(-EINVAL); 132 } 133 134 retval = ocfs2_xattr_get_nolock(inode, di_bh, name_index, "", NULL, 0); 135 if (retval > 0) { 136 value = kmalloc(retval, GFP_NOFS); 137 if (!value) 138 return ERR_PTR(-ENOMEM); 139 retval = ocfs2_xattr_get_nolock(inode, di_bh, name_index, 140 "", value, retval); 141 } 142 143 if (retval > 0) 144 acl = ocfs2_acl_from_xattr(value, retval); 145 else if (retval == -ENODATA || retval == 0) 146 acl = NULL; 147 else 148 acl = ERR_PTR(retval); 149 150 kfree(value); 151 152 return acl; 153 } 154 155 /* 156 * Helper function to set i_mode in memory and disk. Some call paths 157 * will not have di_bh or a journal handle to pass, in which case it 158 * will create it's own. 159 */ 160 static int ocfs2_acl_set_mode(struct inode *inode, struct buffer_head *di_bh, 161 handle_t *handle, umode_t new_mode) 162 { 163 int ret, commit_handle = 0; 164 struct ocfs2_dinode *di; 165 166 if (di_bh == NULL) { 167 ret = ocfs2_read_inode_block(inode, &di_bh); 168 if (ret) { 169 mlog_errno(ret); 170 goto out; 171 } 172 } else 173 get_bh(di_bh); 174 175 if (handle == NULL) { 176 handle = ocfs2_start_trans(OCFS2_SB(inode->i_sb), 177 OCFS2_INODE_UPDATE_CREDITS); 178 if (IS_ERR(handle)) { 179 ret = PTR_ERR(handle); 180 mlog_errno(ret); 181 goto out_brelse; 182 } 183 184 commit_handle = 1; 185 } 186 187 di = (struct ocfs2_dinode *)di_bh->b_data; 188 ret = ocfs2_journal_access_di(handle, INODE_CACHE(inode), di_bh, 189 OCFS2_JOURNAL_ACCESS_WRITE); 190 if (ret) { 191 mlog_errno(ret); 192 goto out_commit; 193 } 194 195 inode->i_mode = new_mode; 196 inode->i_ctime = current_time(inode); 197 di->i_mode = cpu_to_le16(inode->i_mode); 198 di->i_ctime = cpu_to_le64(inode->i_ctime.tv_sec); 199 di->i_ctime_nsec = cpu_to_le32(inode->i_ctime.tv_nsec); 200 ocfs2_update_inode_fsync_trans(handle, inode, 0); 201 202 ocfs2_journal_dirty(handle, di_bh); 203 204 out_commit: 205 if (commit_handle) 206 ocfs2_commit_trans(OCFS2_SB(inode->i_sb), handle); 207 out_brelse: 208 brelse(di_bh); 209 out: 210 return ret; 211 } 212 213 /* 214 * Set the access or default ACL of an inode. 215 */ 216 static int ocfs2_set_acl(handle_t *handle, 217 struct inode *inode, 218 struct buffer_head *di_bh, 219 int type, 220 struct posix_acl *acl, 221 struct ocfs2_alloc_context *meta_ac, 222 struct ocfs2_alloc_context *data_ac) 223 { 224 int name_index; 225 void *value = NULL; 226 size_t size = 0; 227 int ret; 228 229 if (S_ISLNK(inode->i_mode)) 230 return -EOPNOTSUPP; 231 232 switch (type) { 233 case ACL_TYPE_ACCESS: 234 name_index = OCFS2_XATTR_INDEX_POSIX_ACL_ACCESS; 235 break; 236 case ACL_TYPE_DEFAULT: 237 name_index = OCFS2_XATTR_INDEX_POSIX_ACL_DEFAULT; 238 if (!S_ISDIR(inode->i_mode)) 239 return acl ? -EACCES : 0; 240 break; 241 default: 242 return -EINVAL; 243 } 244 245 if (acl) { 246 value = ocfs2_acl_to_xattr(acl, &size); 247 if (IS_ERR(value)) 248 return (int)PTR_ERR(value); 249 } 250 251 if (handle) 252 ret = ocfs2_xattr_set_handle(handle, inode, di_bh, name_index, 253 "", value, size, 0, 254 meta_ac, data_ac); 255 else 256 ret = ocfs2_xattr_set(inode, name_index, "", value, size, 0); 257 258 kfree(value); 259 if (!ret) 260 set_cached_acl(inode, type, acl); 261 262 return ret; 263 } 264 265 int ocfs2_iop_set_acl(struct inode *inode, struct posix_acl *acl, int type) 266 { 267 struct buffer_head *bh = NULL; 268 int status, had_lock; 269 struct ocfs2_lock_holder oh; 270 271 had_lock = ocfs2_inode_lock_tracker(inode, &bh, 1, &oh); 272 if (had_lock < 0) 273 return had_lock; 274 if (type == ACL_TYPE_ACCESS && acl) { 275 umode_t mode; 276 277 status = posix_acl_update_mode(inode, &mode, &acl); 278 if (status) 279 goto unlock; 280 281 status = ocfs2_acl_set_mode(inode, bh, NULL, mode); 282 if (status) 283 goto unlock; 284 } 285 status = ocfs2_set_acl(NULL, inode, bh, type, acl, NULL, NULL); 286 unlock: 287 ocfs2_inode_unlock_tracker(inode, 1, &oh, had_lock); 288 brelse(bh); 289 return status; 290 } 291 292 struct posix_acl *ocfs2_iop_get_acl(struct inode *inode, int type) 293 { 294 struct ocfs2_super *osb; 295 struct buffer_head *di_bh = NULL; 296 struct posix_acl *acl; 297 int had_lock; 298 struct ocfs2_lock_holder oh; 299 300 osb = OCFS2_SB(inode->i_sb); 301 if (!(osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL)) 302 return NULL; 303 304 had_lock = ocfs2_inode_lock_tracker(inode, &di_bh, 0, &oh); 305 if (had_lock < 0) 306 return ERR_PTR(had_lock); 307 308 down_read(&OCFS2_I(inode)->ip_xattr_sem); 309 acl = ocfs2_get_acl_nolock(inode, type, di_bh); 310 up_read(&OCFS2_I(inode)->ip_xattr_sem); 311 312 ocfs2_inode_unlock_tracker(inode, 0, &oh, had_lock); 313 brelse(di_bh); 314 return acl; 315 } 316 317 int ocfs2_acl_chmod(struct inode *inode, struct buffer_head *bh) 318 { 319 struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); 320 struct posix_acl *acl; 321 int ret; 322 323 if (S_ISLNK(inode->i_mode)) 324 return -EOPNOTSUPP; 325 326 if (!(osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL)) 327 return 0; 328 329 down_read(&OCFS2_I(inode)->ip_xattr_sem); 330 acl = ocfs2_get_acl_nolock(inode, ACL_TYPE_ACCESS, bh); 331 up_read(&OCFS2_I(inode)->ip_xattr_sem); 332 if (IS_ERR_OR_NULL(acl)) 333 return PTR_ERR_OR_ZERO(acl); 334 ret = __posix_acl_chmod(&acl, GFP_KERNEL, inode->i_mode); 335 if (ret) 336 return ret; 337 ret = ocfs2_set_acl(NULL, inode, NULL, ACL_TYPE_ACCESS, 338 acl, NULL, NULL); 339 posix_acl_release(acl); 340 return ret; 341 } 342 343 /* 344 * Initialize the ACLs of a new inode. If parent directory has default ACL, 345 * then clone to new inode. Called from ocfs2_mknod. 346 */ 347 int ocfs2_init_acl(handle_t *handle, 348 struct inode *inode, 349 struct inode *dir, 350 struct buffer_head *di_bh, 351 struct buffer_head *dir_bh, 352 struct ocfs2_alloc_context *meta_ac, 353 struct ocfs2_alloc_context *data_ac) 354 { 355 struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); 356 struct posix_acl *acl = NULL; 357 int ret = 0, ret2; 358 umode_t mode; 359 360 if (!S_ISLNK(inode->i_mode)) { 361 if (osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL) { 362 down_read(&OCFS2_I(dir)->ip_xattr_sem); 363 acl = ocfs2_get_acl_nolock(dir, ACL_TYPE_DEFAULT, 364 dir_bh); 365 up_read(&OCFS2_I(dir)->ip_xattr_sem); 366 if (IS_ERR(acl)) 367 return PTR_ERR(acl); 368 } 369 if (!acl) { 370 mode = inode->i_mode & ~current_umask(); 371 ret = ocfs2_acl_set_mode(inode, di_bh, handle, mode); 372 if (ret) { 373 mlog_errno(ret); 374 goto cleanup; 375 } 376 } 377 } 378 if ((osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL) && acl) { 379 if (S_ISDIR(inode->i_mode)) { 380 ret = ocfs2_set_acl(handle, inode, di_bh, 381 ACL_TYPE_DEFAULT, acl, 382 meta_ac, data_ac); 383 if (ret) 384 goto cleanup; 385 } 386 mode = inode->i_mode; 387 ret = __posix_acl_create(&acl, GFP_NOFS, &mode); 388 if (ret < 0) 389 return ret; 390 391 ret2 = ocfs2_acl_set_mode(inode, di_bh, handle, mode); 392 if (ret2) { 393 mlog_errno(ret2); 394 ret = ret2; 395 goto cleanup; 396 } 397 if (ret > 0) { 398 ret = ocfs2_set_acl(handle, inode, 399 di_bh, ACL_TYPE_ACCESS, 400 acl, meta_ac, data_ac); 401 } 402 } 403 cleanup: 404 posix_acl_release(acl); 405 return ret; 406 } 407