xref: /openbmc/linux/fs/xfs/xfs_acl.c (revision 643d1f7f)
1 /*
2  * Copyright (c) 2001-2002,2005 Silicon Graphics, Inc.
3  * All Rights Reserved.
4  *
5  * This program is free software; you can redistribute it and/or
6  * modify it under the terms of the GNU General Public License as
7  * published by the Free Software Foundation.
8  *
9  * This program is distributed in the hope that it would be useful,
10  * but WITHOUT ANY WARRANTY; without even the implied warranty of
11  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
12  * GNU General Public License for more details.
13  *
14  * You should have received a copy of the GNU General Public License
15  * along with this program; if not, write the Free Software Foundation,
16  * Inc.,  51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
17  */
18 #include "xfs.h"
19 #include "xfs_fs.h"
20 #include "xfs_types.h"
21 #include "xfs_bit.h"
22 #include "xfs_inum.h"
23 #include "xfs_ag.h"
24 #include "xfs_dir2.h"
25 #include "xfs_bmap_btree.h"
26 #include "xfs_alloc_btree.h"
27 #include "xfs_ialloc_btree.h"
28 #include "xfs_dir2_sf.h"
29 #include "xfs_attr_sf.h"
30 #include "xfs_dinode.h"
31 #include "xfs_inode.h"
32 #include "xfs_btree.h"
33 #include "xfs_acl.h"
34 #include "xfs_attr.h"
35 #include "xfs_vnodeops.h"
36 
37 #include <linux/capability.h>
38 #include <linux/posix_acl_xattr.h>
39 
40 STATIC int	xfs_acl_setmode(bhv_vnode_t *, xfs_acl_t *, int *);
41 STATIC void     xfs_acl_filter_mode(mode_t, xfs_acl_t *);
42 STATIC void	xfs_acl_get_endian(xfs_acl_t *);
43 STATIC int	xfs_acl_access(uid_t, gid_t, xfs_acl_t *, mode_t, cred_t *);
44 STATIC int	xfs_acl_invalid(xfs_acl_t *);
45 STATIC void	xfs_acl_sync_mode(mode_t, xfs_acl_t *);
46 STATIC void	xfs_acl_get_attr(bhv_vnode_t *, xfs_acl_t *, int, int, int *);
47 STATIC void	xfs_acl_set_attr(bhv_vnode_t *, xfs_acl_t *, int, int *);
48 STATIC int	xfs_acl_allow_set(bhv_vnode_t *, int);
49 
50 kmem_zone_t *xfs_acl_zone;
51 
52 
53 /*
54  * Test for existence of access ACL attribute as efficiently as possible.
55  */
56 int
57 xfs_acl_vhasacl_access(
58 	bhv_vnode_t	*vp)
59 {
60 	int		error;
61 
62 	xfs_acl_get_attr(vp, NULL, _ACL_TYPE_ACCESS, ATTR_KERNOVAL, &error);
63 	return (error == 0);
64 }
65 
66 /*
67  * Test for existence of default ACL attribute as efficiently as possible.
68  */
69 int
70 xfs_acl_vhasacl_default(
71 	bhv_vnode_t	*vp)
72 {
73 	int		error;
74 
75 	if (!VN_ISDIR(vp))
76 		return 0;
77 	xfs_acl_get_attr(vp, NULL, _ACL_TYPE_DEFAULT, ATTR_KERNOVAL, &error);
78 	return (error == 0);
79 }
80 
81 /*
82  * Convert from extended attribute representation to in-memory for XFS.
83  */
84 STATIC int
85 posix_acl_xattr_to_xfs(
86 	posix_acl_xattr_header	*src,
87 	size_t			size,
88 	xfs_acl_t		*dest)
89 {
90 	posix_acl_xattr_entry	*src_entry;
91 	xfs_acl_entry_t		*dest_entry;
92 	int			n;
93 
94 	if (!src || !dest)
95 		return EINVAL;
96 
97 	if (size < sizeof(posix_acl_xattr_header))
98 		return EINVAL;
99 
100 	if (src->a_version != cpu_to_le32(POSIX_ACL_XATTR_VERSION))
101 		return EOPNOTSUPP;
102 
103 	memset(dest, 0, sizeof(xfs_acl_t));
104 	dest->acl_cnt = posix_acl_xattr_count(size);
105 	if (dest->acl_cnt < 0 || dest->acl_cnt > XFS_ACL_MAX_ENTRIES)
106 		return EINVAL;
107 
108 	/*
109 	 * acl_set_file(3) may request that we set default ACLs with
110 	 * zero length -- defend (gracefully) against that here.
111 	 */
112 	if (!dest->acl_cnt)
113 		return 0;
114 
115 	src_entry = (posix_acl_xattr_entry *)((char *)src + sizeof(*src));
116 	dest_entry = &dest->acl_entry[0];
117 
118 	for (n = 0; n < dest->acl_cnt; n++, src_entry++, dest_entry++) {
119 		dest_entry->ae_perm = le16_to_cpu(src_entry->e_perm);
120 		if (_ACL_PERM_INVALID(dest_entry->ae_perm))
121 			return EINVAL;
122 		dest_entry->ae_tag  = le16_to_cpu(src_entry->e_tag);
123 		switch(dest_entry->ae_tag) {
124 		case ACL_USER:
125 		case ACL_GROUP:
126 			dest_entry->ae_id = le32_to_cpu(src_entry->e_id);
127 			break;
128 		case ACL_USER_OBJ:
129 		case ACL_GROUP_OBJ:
130 		case ACL_MASK:
131 		case ACL_OTHER:
132 			dest_entry->ae_id = ACL_UNDEFINED_ID;
133 			break;
134 		default:
135 			return EINVAL;
136 		}
137 	}
138 	if (xfs_acl_invalid(dest))
139 		return EINVAL;
140 
141 	return 0;
142 }
143 
144 /*
145  * Comparison function called from xfs_sort().
146  * Primary key is ae_tag, secondary key is ae_id.
147  */
148 STATIC int
149 xfs_acl_entry_compare(
150 	const void	*va,
151 	const void	*vb)
152 {
153 	xfs_acl_entry_t	*a = (xfs_acl_entry_t *)va,
154 			*b = (xfs_acl_entry_t *)vb;
155 
156 	if (a->ae_tag == b->ae_tag)
157 		return (a->ae_id - b->ae_id);
158 	return (a->ae_tag - b->ae_tag);
159 }
160 
161 /*
162  * Convert from in-memory XFS to extended attribute representation.
163  */
164 STATIC int
165 posix_acl_xfs_to_xattr(
166 	xfs_acl_t		*src,
167 	posix_acl_xattr_header	*dest,
168 	size_t			size)
169 {
170 	int			n;
171 	size_t			new_size = posix_acl_xattr_size(src->acl_cnt);
172 	posix_acl_xattr_entry	*dest_entry;
173 	xfs_acl_entry_t		*src_entry;
174 
175 	if (size < new_size)
176 		return -ERANGE;
177 
178 	/* Need to sort src XFS ACL by <ae_tag,ae_id> */
179 	xfs_sort(src->acl_entry, src->acl_cnt, sizeof(src->acl_entry[0]),
180 		 xfs_acl_entry_compare);
181 
182 	dest->a_version = cpu_to_le32(POSIX_ACL_XATTR_VERSION);
183 	dest_entry = &dest->a_entries[0];
184 	src_entry = &src->acl_entry[0];
185 	for (n = 0; n < src->acl_cnt; n++, dest_entry++, src_entry++) {
186 		dest_entry->e_perm = cpu_to_le16(src_entry->ae_perm);
187 		if (_ACL_PERM_INVALID(src_entry->ae_perm))
188 			return -EINVAL;
189 		dest_entry->e_tag  = cpu_to_le16(src_entry->ae_tag);
190 		switch (src_entry->ae_tag) {
191 		case ACL_USER:
192 		case ACL_GROUP:
193 			dest_entry->e_id = cpu_to_le32(src_entry->ae_id);
194 				break;
195 		case ACL_USER_OBJ:
196 		case ACL_GROUP_OBJ:
197 		case ACL_MASK:
198 		case ACL_OTHER:
199 			dest_entry->e_id = cpu_to_le32(ACL_UNDEFINED_ID);
200 			break;
201 		default:
202 			return -EINVAL;
203 		}
204 	}
205 	return new_size;
206 }
207 
208 int
209 xfs_acl_vget(
210 	bhv_vnode_t	*vp,
211 	void		*acl,
212 	size_t		size,
213 	int		kind)
214 {
215 	int			error;
216 	xfs_acl_t		*xfs_acl = NULL;
217 	posix_acl_xattr_header	*ext_acl = acl;
218 	int			flags = 0;
219 
220 	VN_HOLD(vp);
221 	if(size) {
222 		if (!(_ACL_ALLOC(xfs_acl))) {
223 			error = ENOMEM;
224 			goto out;
225 		}
226 		memset(xfs_acl, 0, sizeof(xfs_acl_t));
227 	} else
228 		flags = ATTR_KERNOVAL;
229 
230 	xfs_acl_get_attr(vp, xfs_acl, kind, flags, &error);
231 	if (error)
232 		goto out;
233 
234 	if (!size) {
235 		error = -posix_acl_xattr_size(XFS_ACL_MAX_ENTRIES);
236 	} else {
237 		if (xfs_acl_invalid(xfs_acl)) {
238 			error = EINVAL;
239 			goto out;
240 		}
241 		if (kind == _ACL_TYPE_ACCESS) {
242 			bhv_vattr_t	va;
243 
244 			va.va_mask = XFS_AT_MODE;
245 			error = xfs_getattr(xfs_vtoi(vp), &va, 0);
246 			if (error)
247 				goto out;
248 			xfs_acl_sync_mode(va.va_mode, xfs_acl);
249 		}
250 		error = -posix_acl_xfs_to_xattr(xfs_acl, ext_acl, size);
251 	}
252 out:
253 	VN_RELE(vp);
254 	if(xfs_acl)
255 		_ACL_FREE(xfs_acl);
256 	return -error;
257 }
258 
259 int
260 xfs_acl_vremove(
261 	bhv_vnode_t	*vp,
262 	int		kind)
263 {
264 	int		error;
265 
266 	VN_HOLD(vp);
267 	error = xfs_acl_allow_set(vp, kind);
268 	if (!error) {
269 		error = xfs_attr_remove(xfs_vtoi(vp),
270 						kind == _ACL_TYPE_DEFAULT?
271 						SGI_ACL_DEFAULT: SGI_ACL_FILE,
272 						ATTR_ROOT);
273 		if (error == ENOATTR)
274 			error = 0;	/* 'scool */
275 	}
276 	VN_RELE(vp);
277 	return -error;
278 }
279 
280 int
281 xfs_acl_vset(
282 	bhv_vnode_t		*vp,
283 	void			*acl,
284 	size_t			size,
285 	int			kind)
286 {
287 	posix_acl_xattr_header	*ext_acl = acl;
288 	xfs_acl_t		*xfs_acl;
289 	int			error;
290 	int			basicperms = 0; /* more than std unix perms? */
291 
292 	if (!acl)
293 		return -EINVAL;
294 
295 	if (!(_ACL_ALLOC(xfs_acl)))
296 		return -ENOMEM;
297 
298 	error = posix_acl_xattr_to_xfs(ext_acl, size, xfs_acl);
299 	if (error) {
300 		_ACL_FREE(xfs_acl);
301 		return -error;
302 	}
303 	if (!xfs_acl->acl_cnt) {
304 		_ACL_FREE(xfs_acl);
305 		return 0;
306 	}
307 
308 	VN_HOLD(vp);
309 	error = xfs_acl_allow_set(vp, kind);
310 	if (error)
311 		goto out;
312 
313 	/* Incoming ACL exists, set file mode based on its value */
314 	if (kind == _ACL_TYPE_ACCESS)
315 		xfs_acl_setmode(vp, xfs_acl, &basicperms);
316 
317 	/*
318 	 * If we have more than std unix permissions, set up the actual attr.
319 	 * Otherwise, delete any existing attr.  This prevents us from
320 	 * having actual attrs for permissions that can be stored in the
321 	 * standard permission bits.
322 	 */
323 	if (!basicperms) {
324 		xfs_acl_set_attr(vp, xfs_acl, kind, &error);
325 	} else {
326 		xfs_acl_vremove(vp, _ACL_TYPE_ACCESS);
327 	}
328 
329 out:
330 	VN_RELE(vp);
331 	_ACL_FREE(xfs_acl);
332 	return -error;
333 }
334 
335 int
336 xfs_acl_iaccess(
337 	xfs_inode_t	*ip,
338 	mode_t		mode,
339 	cred_t		*cr)
340 {
341 	xfs_acl_t	*acl;
342 	int		rval;
343 
344 	if (!(_ACL_ALLOC(acl)))
345 		return -1;
346 
347 	/* If the file has no ACL return -1. */
348 	rval = sizeof(xfs_acl_t);
349 	if (xfs_attr_fetch(ip, SGI_ACL_FILE, SGI_ACL_FILE_SIZE,
350 			(char *)acl, &rval, ATTR_ROOT | ATTR_KERNACCESS, cr)) {
351 		_ACL_FREE(acl);
352 		return -1;
353 	}
354 	xfs_acl_get_endian(acl);
355 
356 	/* If the file has an empty ACL return -1. */
357 	if (acl->acl_cnt == XFS_ACL_NOT_PRESENT) {
358 		_ACL_FREE(acl);
359 		return -1;
360 	}
361 
362 	/* Synchronize ACL with mode bits */
363 	xfs_acl_sync_mode(ip->i_d.di_mode, acl);
364 
365 	rval = xfs_acl_access(ip->i_d.di_uid, ip->i_d.di_gid, acl, mode, cr);
366 	_ACL_FREE(acl);
367 	return rval;
368 }
369 
370 STATIC int
371 xfs_acl_allow_set(
372 	bhv_vnode_t	*vp,
373 	int		kind)
374 {
375 	xfs_inode_t	*ip = xfs_vtoi(vp);
376 	bhv_vattr_t	va;
377 	int		error;
378 
379 	if (vp->i_flags & (S_IMMUTABLE|S_APPEND))
380 		return EPERM;
381 	if (kind == _ACL_TYPE_DEFAULT && !VN_ISDIR(vp))
382 		return ENOTDIR;
383 	if (vp->i_sb->s_flags & MS_RDONLY)
384 		return EROFS;
385 	va.va_mask = XFS_AT_UID;
386 	error = xfs_getattr(ip, &va, 0);
387 	if (error)
388 		return error;
389 	if (va.va_uid != current->fsuid && !capable(CAP_FOWNER))
390 		return EPERM;
391 	return error;
392 }
393 
394 /*
395  * The access control process to determine the access permission:
396  *	if uid == file owner id, use the file owner bits.
397  *	if gid == file owner group id, use the file group bits.
398  *	scan ACL for a matching user or group, and use matched entry
399  *	permission. Use total permissions of all matching group entries,
400  *	until all acl entries are exhausted. The final permission produced
401  *	by matching acl entry or entries needs to be & with group permission.
402  *	if not owner, owning group, or matching entry in ACL, use file
403  *	other bits.
404  */
405 STATIC int
406 xfs_acl_capability_check(
407 	mode_t		mode,
408 	cred_t		*cr)
409 {
410 	if ((mode & ACL_READ) && !capable_cred(cr, CAP_DAC_READ_SEARCH))
411 		return EACCES;
412 	if ((mode & ACL_WRITE) && !capable_cred(cr, CAP_DAC_OVERRIDE))
413 		return EACCES;
414 	if ((mode & ACL_EXECUTE) && !capable_cred(cr, CAP_DAC_OVERRIDE))
415 		return EACCES;
416 
417 	return 0;
418 }
419 
420 /*
421  * Note: cr is only used here for the capability check if the ACL test fails.
422  *       It is not used to find out the credentials uid or groups etc, as was
423  *       done in IRIX. It is assumed that the uid and groups for the current
424  *       thread are taken from "current" instead of the cr parameter.
425  */
426 STATIC int
427 xfs_acl_access(
428 	uid_t		fuid,
429 	gid_t		fgid,
430 	xfs_acl_t	*fap,
431 	mode_t		md,
432 	cred_t		*cr)
433 {
434 	xfs_acl_entry_t	matched;
435 	int		i, allows;
436 	int		maskallows = -1;	/* true, but not 1, either */
437 	int		seen_userobj = 0;
438 
439 	matched.ae_tag = 0;	/* Invalid type */
440 	matched.ae_perm = 0;
441 	md >>= 6;	/* Normalize the bits for comparison */
442 
443 	for (i = 0; i < fap->acl_cnt; i++) {
444 		/*
445 		 * Break out if we've got a user_obj entry or
446 		 * a user entry and the mask (and have processed USER_OBJ)
447 		 */
448 		if (matched.ae_tag == ACL_USER_OBJ)
449 			break;
450 		if (matched.ae_tag == ACL_USER) {
451 			if (maskallows != -1 && seen_userobj)
452 				break;
453 			if (fap->acl_entry[i].ae_tag != ACL_MASK &&
454 			    fap->acl_entry[i].ae_tag != ACL_USER_OBJ)
455 				continue;
456 		}
457 		/* True if this entry allows the requested access */
458 		allows = ((fap->acl_entry[i].ae_perm & md) == md);
459 
460 		switch (fap->acl_entry[i].ae_tag) {
461 		case ACL_USER_OBJ:
462 			seen_userobj = 1;
463 			if (fuid != current->fsuid)
464 				continue;
465 			matched.ae_tag = ACL_USER_OBJ;
466 			matched.ae_perm = allows;
467 			break;
468 		case ACL_USER:
469 			if (fap->acl_entry[i].ae_id != current->fsuid)
470 				continue;
471 			matched.ae_tag = ACL_USER;
472 			matched.ae_perm = allows;
473 			break;
474 		case ACL_GROUP_OBJ:
475 			if ((matched.ae_tag == ACL_GROUP_OBJ ||
476 			    matched.ae_tag == ACL_GROUP) && !allows)
477 				continue;
478 			if (!in_group_p(fgid))
479 				continue;
480 			matched.ae_tag = ACL_GROUP_OBJ;
481 			matched.ae_perm = allows;
482 			break;
483 		case ACL_GROUP:
484 			if ((matched.ae_tag == ACL_GROUP_OBJ ||
485 			    matched.ae_tag == ACL_GROUP) && !allows)
486 				continue;
487 			if (!in_group_p(fap->acl_entry[i].ae_id))
488 				continue;
489 			matched.ae_tag = ACL_GROUP;
490 			matched.ae_perm = allows;
491 			break;
492 		case ACL_MASK:
493 			maskallows = allows;
494 			break;
495 		case ACL_OTHER:
496 			if (matched.ae_tag != 0)
497 				continue;
498 			matched.ae_tag = ACL_OTHER;
499 			matched.ae_perm = allows;
500 			break;
501 		}
502 	}
503 	/*
504 	 * First possibility is that no matched entry allows access.
505 	 * The capability to override DAC may exist, so check for it.
506 	 */
507 	switch (matched.ae_tag) {
508 	case ACL_OTHER:
509 	case ACL_USER_OBJ:
510 		if (matched.ae_perm)
511 			return 0;
512 		break;
513 	case ACL_USER:
514 	case ACL_GROUP_OBJ:
515 	case ACL_GROUP:
516 		if (maskallows && matched.ae_perm)
517 			return 0;
518 		break;
519 	case 0:
520 		break;
521 	}
522 
523 	return xfs_acl_capability_check(md, cr);
524 }
525 
526 /*
527  * ACL validity checker.
528  *   This acl validation routine checks each ACL entry read in makes sense.
529  */
530 STATIC int
531 xfs_acl_invalid(
532 	xfs_acl_t	*aclp)
533 {
534 	xfs_acl_entry_t	*entry, *e;
535 	int		user = 0, group = 0, other = 0, mask = 0;
536 	int		mask_required = 0;
537 	int		i, j;
538 
539 	if (!aclp)
540 		goto acl_invalid;
541 
542 	if (aclp->acl_cnt > XFS_ACL_MAX_ENTRIES)
543 		goto acl_invalid;
544 
545 	for (i = 0; i < aclp->acl_cnt; i++) {
546 		entry = &aclp->acl_entry[i];
547 		switch (entry->ae_tag) {
548 		case ACL_USER_OBJ:
549 			if (user++)
550 				goto acl_invalid;
551 			break;
552 		case ACL_GROUP_OBJ:
553 			if (group++)
554 				goto acl_invalid;
555 			break;
556 		case ACL_OTHER:
557 			if (other++)
558 				goto acl_invalid;
559 			break;
560 		case ACL_USER:
561 		case ACL_GROUP:
562 			for (j = i + 1; j < aclp->acl_cnt; j++) {
563 				e = &aclp->acl_entry[j];
564 				if (e->ae_id == entry->ae_id &&
565 				    e->ae_tag == entry->ae_tag)
566 					goto acl_invalid;
567 			}
568 			mask_required++;
569 			break;
570 		case ACL_MASK:
571 			if (mask++)
572 				goto acl_invalid;
573 			break;
574 		default:
575 			goto acl_invalid;
576 		}
577 	}
578 	if (!user || !group || !other || (mask_required && !mask))
579 		goto acl_invalid;
580 	else
581 		return 0;
582 acl_invalid:
583 	return EINVAL;
584 }
585 
586 /*
587  * Do ACL endian conversion.
588  */
589 STATIC void
590 xfs_acl_get_endian(
591 	xfs_acl_t	*aclp)
592 {
593 	xfs_acl_entry_t	*ace, *end;
594 
595 	INT_SET(aclp->acl_cnt, ARCH_CONVERT, aclp->acl_cnt);
596 	end = &aclp->acl_entry[0]+aclp->acl_cnt;
597 	for (ace = &aclp->acl_entry[0]; ace < end; ace++) {
598 		INT_SET(ace->ae_tag, ARCH_CONVERT, ace->ae_tag);
599 		INT_SET(ace->ae_id, ARCH_CONVERT, ace->ae_id);
600 		INT_SET(ace->ae_perm, ARCH_CONVERT, ace->ae_perm);
601 	}
602 }
603 
604 /*
605  * Get the ACL from the EA and do endian conversion.
606  */
607 STATIC void
608 xfs_acl_get_attr(
609 	bhv_vnode_t	*vp,
610 	xfs_acl_t	*aclp,
611 	int		kind,
612 	int		flags,
613 	int		*error)
614 {
615 	int		len = sizeof(xfs_acl_t);
616 
617 	ASSERT((flags & ATTR_KERNOVAL) ? (aclp == NULL) : 1);
618 	flags |= ATTR_ROOT;
619 	*error = xfs_attr_get(xfs_vtoi(vp),
620 					kind == _ACL_TYPE_ACCESS ?
621 					SGI_ACL_FILE : SGI_ACL_DEFAULT,
622 					(char *)aclp, &len, flags, sys_cred);
623 	if (*error || (flags & ATTR_KERNOVAL))
624 		return;
625 	xfs_acl_get_endian(aclp);
626 }
627 
628 /*
629  * Set the EA with the ACL and do endian conversion.
630  */
631 STATIC void
632 xfs_acl_set_attr(
633 	bhv_vnode_t	*vp,
634 	xfs_acl_t	*aclp,
635 	int		kind,
636 	int		*error)
637 {
638 	xfs_acl_entry_t	*ace, *newace, *end;
639 	xfs_acl_t	*newacl;
640 	int		len;
641 
642 	if (!(_ACL_ALLOC(newacl))) {
643 		*error = ENOMEM;
644 		return;
645 	}
646 
647 	len = sizeof(xfs_acl_t) -
648 	      (sizeof(xfs_acl_entry_t) * (XFS_ACL_MAX_ENTRIES - aclp->acl_cnt));
649 	end = &aclp->acl_entry[0]+aclp->acl_cnt;
650 	for (ace = &aclp->acl_entry[0], newace = &newacl->acl_entry[0];
651 	     ace < end;
652 	     ace++, newace++) {
653 		INT_SET(newace->ae_tag, ARCH_CONVERT, ace->ae_tag);
654 		INT_SET(newace->ae_id, ARCH_CONVERT, ace->ae_id);
655 		INT_SET(newace->ae_perm, ARCH_CONVERT, ace->ae_perm);
656 	}
657 	INT_SET(newacl->acl_cnt, ARCH_CONVERT, aclp->acl_cnt);
658 	*error = xfs_attr_set(xfs_vtoi(vp),
659 				kind == _ACL_TYPE_ACCESS ?
660 				SGI_ACL_FILE: SGI_ACL_DEFAULT,
661 				(char *)newacl, len, ATTR_ROOT);
662 	_ACL_FREE(newacl);
663 }
664 
665 int
666 xfs_acl_vtoacl(
667 	bhv_vnode_t	*vp,
668 	xfs_acl_t	*access_acl,
669 	xfs_acl_t	*default_acl)
670 {
671 	bhv_vattr_t	va;
672 	int		error = 0;
673 
674 	if (access_acl) {
675 		/*
676 		 * Get the Access ACL and the mode.  If either cannot
677 		 * be obtained for some reason, invalidate the access ACL.
678 		 */
679 		xfs_acl_get_attr(vp, access_acl, _ACL_TYPE_ACCESS, 0, &error);
680 		if (!error) {
681 			/* Got the ACL, need the mode... */
682 			va.va_mask = XFS_AT_MODE;
683 			error = xfs_getattr(xfs_vtoi(vp), &va, 0);
684 		}
685 
686 		if (error)
687 			access_acl->acl_cnt = XFS_ACL_NOT_PRESENT;
688 		else /* We have a good ACL and the file mode, synchronize. */
689 			xfs_acl_sync_mode(va.va_mode, access_acl);
690 	}
691 
692 	if (default_acl) {
693 		xfs_acl_get_attr(vp, default_acl, _ACL_TYPE_DEFAULT, 0, &error);
694 		if (error)
695 			default_acl->acl_cnt = XFS_ACL_NOT_PRESENT;
696 	}
697 	return error;
698 }
699 
700 /*
701  * This function retrieves the parent directory's acl, processes it
702  * and lets the child inherit the acl(s) that it should.
703  */
704 int
705 xfs_acl_inherit(
706 	bhv_vnode_t	*vp,
707 	mode_t		mode,
708 	xfs_acl_t	*pdaclp)
709 {
710 	xfs_acl_t	*cacl;
711 	int		error = 0;
712 	int		basicperms = 0;
713 
714 	/*
715 	 * If the parent does not have a default ACL, or it's an
716 	 * invalid ACL, we're done.
717 	 */
718 	if (!vp)
719 		return 0;
720 	if (!pdaclp || xfs_acl_invalid(pdaclp))
721 		return 0;
722 
723 	/*
724 	 * Copy the default ACL of the containing directory to
725 	 * the access ACL of the new file and use the mode that
726 	 * was passed in to set up the correct initial values for
727 	 * the u::,g::[m::], and o:: entries.  This is what makes
728 	 * umask() "work" with ACL's.
729 	 */
730 
731 	if (!(_ACL_ALLOC(cacl)))
732 		return ENOMEM;
733 
734 	memcpy(cacl, pdaclp, sizeof(xfs_acl_t));
735 	xfs_acl_filter_mode(mode, cacl);
736 	xfs_acl_setmode(vp, cacl, &basicperms);
737 
738 	/*
739 	 * Set the Default and Access ACL on the file.  The mode is already
740 	 * set on the file, so we don't need to worry about that.
741 	 *
742 	 * If the new file is a directory, its default ACL is a copy of
743 	 * the containing directory's default ACL.
744 	 */
745 	if (VN_ISDIR(vp))
746 		xfs_acl_set_attr(vp, pdaclp, _ACL_TYPE_DEFAULT, &error);
747 	if (!error && !basicperms)
748 		xfs_acl_set_attr(vp, cacl, _ACL_TYPE_ACCESS, &error);
749 	_ACL_FREE(cacl);
750 	return error;
751 }
752 
753 /*
754  * Set up the correct mode on the file based on the supplied ACL.  This
755  * makes sure that the mode on the file reflects the state of the
756  * u::,g::[m::], and o:: entries in the ACL.  Since the mode is where
757  * the ACL is going to get the permissions for these entries, we must
758  * synchronize the mode whenever we set the ACL on a file.
759  */
760 STATIC int
761 xfs_acl_setmode(
762 	bhv_vnode_t	*vp,
763 	xfs_acl_t	*acl,
764 	int		*basicperms)
765 {
766 	bhv_vattr_t	va;
767 	xfs_acl_entry_t	*ap;
768 	xfs_acl_entry_t	*gap = NULL;
769 	int		i, error, nomask = 1;
770 
771 	*basicperms = 1;
772 
773 	if (acl->acl_cnt == XFS_ACL_NOT_PRESENT)
774 		return 0;
775 
776 	/*
777 	 * Copy the u::, g::, o::, and m:: bits from the ACL into the
778 	 * mode.  The m:: bits take precedence over the g:: bits.
779 	 */
780 	va.va_mask = XFS_AT_MODE;
781 	error = xfs_getattr(xfs_vtoi(vp), &va, 0);
782 	if (error)
783 		return error;
784 
785 	va.va_mask = XFS_AT_MODE;
786 	va.va_mode &= ~(S_IRWXU|S_IRWXG|S_IRWXO);
787 	ap = acl->acl_entry;
788 	for (i = 0; i < acl->acl_cnt; ++i) {
789 		switch (ap->ae_tag) {
790 		case ACL_USER_OBJ:
791 			va.va_mode |= ap->ae_perm << 6;
792 			break;
793 		case ACL_GROUP_OBJ:
794 			gap = ap;
795 			break;
796 		case ACL_MASK:	/* more than just standard modes */
797 			nomask = 0;
798 			va.va_mode |= ap->ae_perm << 3;
799 			*basicperms = 0;
800 			break;
801 		case ACL_OTHER:
802 			va.va_mode |= ap->ae_perm;
803 			break;
804 		default:	/* more than just standard modes */
805 			*basicperms = 0;
806 			break;
807 		}
808 		ap++;
809 	}
810 
811 	/* Set the group bits from ACL_GROUP_OBJ if there's no ACL_MASK */
812 	if (gap && nomask)
813 		va.va_mode |= gap->ae_perm << 3;
814 
815 	return xfs_setattr(xfs_vtoi(vp), &va, 0, sys_cred);
816 }
817 
818 /*
819  * The permissions for the special ACL entries (u::, g::[m::], o::) are
820  * actually stored in the file mode (if there is both a group and a mask,
821  * the group is stored in the ACL entry and the mask is stored on the file).
822  * This allows the mode to remain automatically in sync with the ACL without
823  * the need for a call-back to the ACL system at every point where the mode
824  * could change.  This function takes the permissions from the specified mode
825  * and places it in the supplied ACL.
826  *
827  * This implementation draws its validity from the fact that, when the ACL
828  * was assigned, the mode was copied from the ACL.
829  * If the mode did not change, therefore, the mode remains exactly what was
830  * taken from the special ACL entries at assignment.
831  * If a subsequent chmod() was done, the POSIX spec says that the change in
832  * mode must cause an update to the ACL seen at user level and used for
833  * access checks.  Before and after a mode change, therefore, the file mode
834  * most accurately reflects what the special ACL entries should permit/deny.
835  *
836  * CAVEAT: If someone sets the SGI_ACL_FILE attribute directly,
837  *         the existing mode bits will override whatever is in the
838  *         ACL. Similarly, if there is a pre-existing ACL that was
839  *         never in sync with its mode (owing to a bug in 6.5 and
840  *         before), it will now magically (or mystically) be
841  *         synchronized.  This could cause slight astonishment, but
842  *         it is better than inconsistent permissions.
843  *
844  * The supplied ACL is a template that may contain any combination
845  * of special entries.  These are treated as place holders when we fill
846  * out the ACL.  This routine does not add or remove special entries, it
847  * simply unites each special entry with its associated set of permissions.
848  */
849 STATIC void
850 xfs_acl_sync_mode(
851 	mode_t		mode,
852 	xfs_acl_t	*acl)
853 {
854 	int		i, nomask = 1;
855 	xfs_acl_entry_t	*ap;
856 	xfs_acl_entry_t	*gap = NULL;
857 
858 	/*
859 	 * Set ACL entries. POSIX1003.1eD16 requires that the MASK
860 	 * be set instead of the GROUP entry, if there is a MASK.
861 	 */
862 	for (ap = acl->acl_entry, i = 0; i < acl->acl_cnt; ap++, i++) {
863 		switch (ap->ae_tag) {
864 		case ACL_USER_OBJ:
865 			ap->ae_perm = (mode >> 6) & 0x7;
866 			break;
867 		case ACL_GROUP_OBJ:
868 			gap = ap;
869 			break;
870 		case ACL_MASK:
871 			nomask = 0;
872 			ap->ae_perm = (mode >> 3) & 0x7;
873 			break;
874 		case ACL_OTHER:
875 			ap->ae_perm = mode & 0x7;
876 			break;
877 		default:
878 			break;
879 		}
880 	}
881 	/* Set the ACL_GROUP_OBJ if there's no ACL_MASK */
882 	if (gap && nomask)
883 		gap->ae_perm = (mode >> 3) & 0x7;
884 }
885 
886 /*
887  * When inheriting an Access ACL from a directory Default ACL,
888  * the ACL bits are set to the intersection of the ACL default
889  * permission bits and the file permission bits in mode. If there
890  * are no permission bits on the file then we must not give them
891  * the ACL. This is what what makes umask() work with ACLs.
892  */
893 STATIC void
894 xfs_acl_filter_mode(
895 	mode_t		mode,
896 	xfs_acl_t	*acl)
897 {
898 	int		i, nomask = 1;
899 	xfs_acl_entry_t	*ap;
900 	xfs_acl_entry_t	*gap = NULL;
901 
902 	/*
903 	 * Set ACL entries. POSIX1003.1eD16 requires that the MASK
904 	 * be merged with GROUP entry, if there is a MASK.
905 	 */
906 	for (ap = acl->acl_entry, i = 0; i < acl->acl_cnt; ap++, i++) {
907 		switch (ap->ae_tag) {
908 		case ACL_USER_OBJ:
909 			ap->ae_perm &= (mode >> 6) & 0x7;
910 			break;
911 		case ACL_GROUP_OBJ:
912 			gap = ap;
913 			break;
914 		case ACL_MASK:
915 			nomask = 0;
916 			ap->ae_perm &= (mode >> 3) & 0x7;
917 			break;
918 		case ACL_OTHER:
919 			ap->ae_perm &= mode & 0x7;
920 			break;
921 		default:
922 			break;
923 		}
924 	}
925 	/* Set the ACL_GROUP_OBJ if there's no ACL_MASK */
926 	if (gap && nomask)
927 		gap->ae_perm &= (mode >> 3) & 0x7;
928 }
929