~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/fs/ext2/acl.c

Version: ~ [ linux-5.13-rc1 ] ~ [ linux-5.12.2 ] ~ [ linux-5.11.19 ] ~ [ linux-5.10.35 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.117 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.190 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.232 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.268 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.268 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.18.140 ] ~ [ linux-3.16.85 ] ~ [ linux-3.14.79 ] ~ [ linux-3.12.74 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.5 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2  * linux/fs/ext2/acl.c
  3  *
  4  * Copyright (C) 2001-2003 Andreas Gruenbacher, <agruen@suse.de>
  5  */
  6 
  7 #include <linux/init.h>
  8 #include <linux/sched.h>
  9 #include <linux/slab.h>
 10 #include <linux/fs.h>
 11 #include "ext2.h"
 12 #include "xattr.h"
 13 #include "acl.h"
 14 
 15 /*
 16  * Convert from filesystem to in-memory representation.
 17  */
 18 static struct posix_acl *
 19 ext2_acl_from_disk(const void *value, size_t size)
 20 {
 21         const char *end = (char *)value + size;
 22         int n, count;
 23         struct posix_acl *acl;
 24 
 25         if (!value)
 26                 return NULL;
 27         if (size < sizeof(ext2_acl_header))
 28                  return ERR_PTR(-EINVAL);
 29         if (((ext2_acl_header *)value)->a_version !=
 30             cpu_to_le32(EXT2_ACL_VERSION))
 31                 return ERR_PTR(-EINVAL);
 32         value = (char *)value + sizeof(ext2_acl_header);
 33         count = ext2_acl_count(size);
 34         if (count < 0)
 35                 return ERR_PTR(-EINVAL);
 36         if (count == 0)
 37                 return NULL;
 38         acl = posix_acl_alloc(count, GFP_KERNEL);
 39         if (!acl)
 40                 return ERR_PTR(-ENOMEM);
 41         for (n=0; n < count; n++) {
 42                 ext2_acl_entry *entry =
 43                         (ext2_acl_entry *)value;
 44                 if ((char *)value + sizeof(ext2_acl_entry_short) > end)
 45                         goto fail;
 46                 acl->a_entries[n].e_tag  = le16_to_cpu(entry->e_tag);
 47                 acl->a_entries[n].e_perm = le16_to_cpu(entry->e_perm);
 48                 switch(acl->a_entries[n].e_tag) {
 49                         case ACL_USER_OBJ:
 50                         case ACL_GROUP_OBJ:
 51                         case ACL_MASK:
 52                         case ACL_OTHER:
 53                                 value = (char *)value +
 54                                         sizeof(ext2_acl_entry_short);
 55                                 acl->a_entries[n].e_id = ACL_UNDEFINED_ID;
 56                                 break;
 57 
 58                         case ACL_USER:
 59                         case ACL_GROUP:
 60                                 value = (char *)value + sizeof(ext2_acl_entry);
 61                                 if ((char *)value > end)
 62                                         goto fail;
 63                                 acl->a_entries[n].e_id =
 64                                         le32_to_cpu(entry->e_id);
 65                                 break;
 66 
 67                         default:
 68                                 goto fail;
 69                 }
 70         }
 71         if (value != end)
 72                 goto fail;
 73         return acl;
 74 
 75 fail:
 76         posix_acl_release(acl);
 77         return ERR_PTR(-EINVAL);
 78 }
 79 
 80 /*
 81  * Convert from in-memory to filesystem representation.
 82  */
 83 static void *
 84 ext2_acl_to_disk(const struct posix_acl *acl, size_t *size)
 85 {
 86         ext2_acl_header *ext_acl;
 87         char *e;
 88         size_t n;
 89 
 90         *size = ext2_acl_size(acl->a_count);
 91         ext_acl = (ext2_acl_header *)kmalloc(sizeof(ext2_acl_header) +
 92                 acl->a_count * sizeof(ext2_acl_entry), GFP_KERNEL);
 93         if (!ext_acl)
 94                 return ERR_PTR(-ENOMEM);
 95         ext_acl->a_version = cpu_to_le32(EXT2_ACL_VERSION);
 96         e = (char *)ext_acl + sizeof(ext2_acl_header);
 97         for (n=0; n < acl->a_count; n++) {
 98                 ext2_acl_entry *entry = (ext2_acl_entry *)e;
 99                 entry->e_tag  = cpu_to_le16(acl->a_entries[n].e_tag);
100                 entry->e_perm = cpu_to_le16(acl->a_entries[n].e_perm);
101                 switch(acl->a_entries[n].e_tag) {
102                         case ACL_USER:
103                         case ACL_GROUP:
104                                 entry->e_id =
105                                         cpu_to_le32(acl->a_entries[n].e_id);
106                                 e += sizeof(ext2_acl_entry);
107                                 break;
108 
109                         case ACL_USER_OBJ:
110                         case ACL_GROUP_OBJ:
111                         case ACL_MASK:
112                         case ACL_OTHER:
113                                 e += sizeof(ext2_acl_entry_short);
114                                 break;
115 
116                         default:
117                                 goto fail;
118                 }
119         }
120         return (char *)ext_acl;
121 
122 fail:
123         kfree(ext_acl);
124         return ERR_PTR(-EINVAL);
125 }
126 
127 static inline struct posix_acl *
128 ext2_iget_acl(struct inode *inode, struct posix_acl **i_acl)
129 {
130         struct posix_acl *acl = EXT2_ACL_NOT_CACHED;
131 
132         spin_lock(&inode->i_lock);
133         if (*i_acl != EXT2_ACL_NOT_CACHED)
134                 acl = posix_acl_dup(*i_acl);
135         spin_unlock(&inode->i_lock);
136 
137         return acl;
138 }
139 
140 static inline void
141 ext2_iset_acl(struct inode *inode, struct posix_acl **i_acl,
142                    struct posix_acl *acl)
143 {
144         spin_lock(&inode->i_lock);
145         if (*i_acl != EXT2_ACL_NOT_CACHED)
146                 posix_acl_release(*i_acl);
147         *i_acl = posix_acl_dup(acl);
148         spin_unlock(&inode->i_lock);
149 }
150 
151 /*
152  * inode->i_sem: don't care
153  */
154 static struct posix_acl *
155 ext2_get_acl(struct inode *inode, int type)
156 {
157         const size_t max_size = ext2_acl_size(EXT2_ACL_MAX_ENTRIES);
158         struct ext2_inode_info *ei = EXT2_I(inode);
159         int name_index;
160         char *value;
161         struct posix_acl *acl;
162         int retval;
163 
164         if (!test_opt(inode->i_sb, POSIX_ACL))
165                 return 0;
166 
167         switch(type) {
168                 case ACL_TYPE_ACCESS:
169                         acl = ext2_iget_acl(inode, &ei->i_acl);
170                         if (acl != EXT2_ACL_NOT_CACHED)
171                                 return acl;
172                         name_index = EXT2_XATTR_INDEX_POSIX_ACL_ACCESS;
173                         break;
174 
175                 case ACL_TYPE_DEFAULT:
176                         acl = ext2_iget_acl(inode, &ei->i_default_acl);
177                         if (acl != EXT2_ACL_NOT_CACHED)
178                                 return acl;
179                         name_index = EXT2_XATTR_INDEX_POSIX_ACL_DEFAULT;
180                         break;
181 
182                 default:
183                         return ERR_PTR(-EINVAL);
184         }
185         value = kmalloc(max_size, GFP_KERNEL);
186         if (!value)
187                 return ERR_PTR(-ENOMEM);
188 
189         retval = ext2_xattr_get(inode, name_index, "", value, max_size);
190         acl = ERR_PTR(retval);
191         if (retval >= 0)
192                 acl = ext2_acl_from_disk(value, retval);
193         else if (retval == -ENODATA || retval == -ENOSYS)
194                 acl = NULL;
195         kfree(value);
196 
197         if (!IS_ERR(acl)) {
198                 switch(type) {
199                         case ACL_TYPE_ACCESS:
200                                 ext2_iset_acl(inode, &ei->i_acl, acl);
201                                 break;
202 
203                         case ACL_TYPE_DEFAULT:
204                                 ext2_iset_acl(inode, &ei->i_default_acl, acl);
205                                 break;
206                 }
207         }
208         return acl;
209 }
210 
211 /*
212  * inode->i_sem: down
213  */
214 static int
215 ext2_set_acl(struct inode *inode, int type, struct posix_acl *acl)
216 {
217         struct ext2_inode_info *ei = EXT2_I(inode);
218         int name_index;
219         void *value = NULL;
220         size_t size;
221         int error;
222 
223         if (S_ISLNK(inode->i_mode))
224                 return -EOPNOTSUPP;
225         if (!test_opt(inode->i_sb, POSIX_ACL))
226                 return 0;
227 
228         switch(type) {
229                 case ACL_TYPE_ACCESS:
230                         name_index = EXT2_XATTR_INDEX_POSIX_ACL_ACCESS;
231                         if (acl) {
232                                 mode_t mode = inode->i_mode;
233                                 error = posix_acl_equiv_mode(acl, &mode);
234                                 if (error < 0)
235                                         return error;
236                                 else {
237                                         inode->i_mode = mode;
238                                         mark_inode_dirty(inode);
239                                         if (error == 0)
240                                                 acl = NULL;
241                                 }
242                         }
243                         break;
244 
245                 case ACL_TYPE_DEFAULT:
246                         name_index = EXT2_XATTR_INDEX_POSIX_ACL_DEFAULT;
247                         if (!S_ISDIR(inode->i_mode))
248                                 return acl ? -EACCES : 0;
249                         break;
250 
251                 default:
252                         return -EINVAL;
253         }
254         if (acl) {
255                 if (acl->a_count > EXT2_ACL_MAX_ENTRIES)
256                         return -EINVAL;
257                 value = ext2_acl_to_disk(acl, &size);
258                 if (IS_ERR(value))
259                         return (int)PTR_ERR(value);
260         }
261 
262         error = ext2_xattr_set(inode, name_index, "", value, size, 0);
263 
264         if (value)
265                 kfree(value);
266         if (!error) {
267                 switch(type) {
268                         case ACL_TYPE_ACCESS:
269                                 ext2_iset_acl(inode, &ei->i_acl, acl);
270                                 break;
271 
272                         case ACL_TYPE_DEFAULT:
273                                 ext2_iset_acl(inode, &ei->i_default_acl, acl);
274                                 break;
275                 }
276         }
277         return error;
278 }
279 
280 /*
281  * Inode operation permission().
282  *
283  * inode->i_sem: don't care
284  */
285 int
286 ext2_permission(struct inode *inode, int mask, struct nameidata *nd)
287 {
288         int mode = inode->i_mode;
289 
290         /* Nobody gets write access to a read-only fs */
291         if ((mask & MAY_WRITE) && IS_RDONLY(inode) &&
292             (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode)))
293                 return -EROFS;
294         /* Nobody gets write access to an immutable file */
295         if ((mask & MAY_WRITE) && IS_IMMUTABLE(inode))
296             return -EACCES;
297         if (current->fsuid == inode->i_uid) {
298                 mode >>= 6;
299         } else if (test_opt(inode->i_sb, POSIX_ACL)) {
300                 struct posix_acl *acl;
301 
302                 /* The access ACL cannot grant access if the group class
303                    permission bits don't contain all requested permissions. */
304                 if (((mode >> 3) & mask & S_IRWXO) != mask)
305                         goto check_groups;
306                 acl = ext2_get_acl(inode, ACL_TYPE_ACCESS);
307                 if (acl) {
308                         int error = posix_acl_permission(inode, acl, mask);
309                         posix_acl_release(acl);
310                         if (error == -EACCES)
311                                 goto check_capabilities;
312                         return error;
313                 } else
314                         goto check_groups;
315         } else {
316 check_groups:
317                 if (in_group_p(inode->i_gid))
318                         mode >>= 3;
319         }
320         if ((mode & mask & S_IRWXO) == mask)
321                 return 0;
322 
323 check_capabilities:
324         /* Allowed to override Discretionary Access Control? */
325         if ((mask & (MAY_READ|MAY_WRITE)) || (inode->i_mode & S_IXUGO))
326                 if (capable(CAP_DAC_OVERRIDE))
327                         return 0;
328         /* Read and search granted if capable(CAP_DAC_READ_SEARCH) */
329         if (capable(CAP_DAC_READ_SEARCH) && ((mask == MAY_READ) ||
330             (S_ISDIR(inode->i_mode) && !(mask & MAY_WRITE))))
331                 return 0;
332         return -EACCES;
333 }
334 
335 /*
336  * Initialize the ACLs of a new inode. Called from ext2_new_inode.
337  *
338  * dir->i_sem: down
339  * inode->i_sem: up (access to inode is still exclusive)
340  */
341 int
342 ext2_init_acl(struct inode *inode, struct inode *dir)
343 {
344         struct posix_acl *acl = NULL;
345         int error = 0;
346 
347         if (!S_ISLNK(inode->i_mode)) {
348                 if (test_opt(dir->i_sb, POSIX_ACL)) {
349                         acl = ext2_get_acl(dir, ACL_TYPE_DEFAULT);
350                         if (IS_ERR(acl))
351                                 return PTR_ERR(acl);
352                 }
353                 if (!acl)
354                         inode->i_mode &= ~current->fs->umask;
355         }
356         if (test_opt(inode->i_sb, POSIX_ACL) && acl) {
357                struct posix_acl *clone;
358                mode_t mode;
359 
360                 if (S_ISDIR(inode->i_mode)) {
361                         error = ext2_set_acl(inode, ACL_TYPE_DEFAULT, acl);
362                         if (error)
363                                 goto cleanup;
364                 }
365                 clone = posix_acl_clone(acl, GFP_KERNEL);
366                 error = -ENOMEM;
367                 if (!clone)
368                         goto cleanup;
369                 mode = inode->i_mode;
370                 error = posix_acl_create_masq(clone, &mode);
371                 if (error >= 0) {
372                         inode->i_mode = mode;
373                         if (error > 0) {
374                                 /* This is an extended ACL */
375                                 error = ext2_set_acl(inode,
376                                                      ACL_TYPE_ACCESS, clone);
377                         }
378                 }
379                 posix_acl_release(clone);
380         }
381 cleanup:
382        posix_acl_release(acl);
383        return error;
384 }
385 
386 /*
387  * Does chmod for an inode that may have an Access Control List. The
388  * inode->i_mode field must be updated to the desired value by the caller
389  * before calling this function.
390  * Returns 0 on success, or a negative error number.
391  *
392  * We change the ACL rather than storing some ACL entries in the file
393  * mode permission bits (which would be more efficient), because that
394  * would break once additional permissions (like  ACL_APPEND, ACL_DELETE
395  * for directories) are added. There are no more bits available in the
396  * file mode.
397  *
398  * inode->i_sem: down
399  */
400 int
401 ext2_acl_chmod(struct inode *inode)
402 {
403         struct posix_acl *acl, *clone;
404         int error;
405 
406         if (!test_opt(inode->i_sb, POSIX_ACL))
407                 return 0;
408         if (S_ISLNK(inode->i_mode))
409                 return -EOPNOTSUPP;
410         acl = ext2_get_acl(inode, ACL_TYPE_ACCESS);
411         if (IS_ERR(acl) || !acl)
412                 return PTR_ERR(acl);
413         clone = posix_acl_clone(acl, GFP_KERNEL);
414         posix_acl_release(acl);
415         if (!clone)
416                 return -ENOMEM;
417         error = posix_acl_chmod_masq(clone, inode->i_mode);
418         if (!error)
419                 error = ext2_set_acl(inode, ACL_TYPE_ACCESS, clone);
420         posix_acl_release(clone);
421         return error;
422 }
423 
424 /*
425  * Extended attribut handlers
426  */
427 static size_t
428 ext2_xattr_list_acl_access(char *list, struct inode *inode,
429                            const char *name, int name_len)
430 {
431         const size_t size = sizeof(XATTR_NAME_ACL_ACCESS);
432 
433         if (!test_opt(inode->i_sb, POSIX_ACL))
434                 return 0;
435         if (list)
436                 memcpy(list, XATTR_NAME_ACL_ACCESS, size);
437         return size;
438 }
439 
440 static size_t
441 ext2_xattr_list_acl_default(char *list, struct inode *inode,
442                             const char *name, int name_len)
443 {
444         const size_t size = sizeof(XATTR_NAME_ACL_DEFAULT);
445 
446         if (!test_opt(inode->i_sb, POSIX_ACL))
447                 return 0;
448         if (list)
449                 memcpy(list, XATTR_NAME_ACL_DEFAULT, size);
450         return size;
451 }
452 
453 static int
454 ext2_xattr_get_acl(struct inode *inode, int type, void *buffer, size_t size)
455 {
456         struct posix_acl *acl;
457         int error;
458 
459         if (!test_opt(inode->i_sb, POSIX_ACL))
460                 return -EOPNOTSUPP;
461 
462         acl = ext2_get_acl(inode, type);
463         if (IS_ERR(acl))
464                 return PTR_ERR(acl);
465         if (acl == NULL)
466                 return -ENODATA;
467         error = posix_acl_to_xattr(acl, buffer, size);
468         posix_acl_release(acl);
469 
470         return error;
471 }
472 
473 static int
474 ext2_xattr_get_acl_access(struct inode *inode, const char *name,
475                           void *buffer, size_t size)
476 {
477         if (strcmp(name, "") != 0)
478                 return -EINVAL;
479         return ext2_xattr_get_acl(inode, ACL_TYPE_ACCESS, buffer, size);
480 }
481 
482 static int
483 ext2_xattr_get_acl_default(struct inode *inode, const char *name,
484                            void *buffer, size_t size)
485 {
486         if (strcmp(name, "") != 0)
487                 return -EINVAL;
488         return ext2_xattr_get_acl(inode, ACL_TYPE_DEFAULT, buffer, size);
489 }
490 
491 static int
492 ext2_xattr_set_acl(struct inode *inode, int type, const void *value,
493                    size_t size)
494 {
495         struct posix_acl *acl;
496         int error;
497 
498         if (!test_opt(inode->i_sb, POSIX_ACL))
499                 return -EOPNOTSUPP;
500         if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
501                 return -EPERM;
502 
503         if (value) {
504                 acl = posix_acl_from_xattr(value, size);
505                 if (IS_ERR(acl))
506                         return PTR_ERR(acl);
507                 else if (acl) {
508                         error = posix_acl_valid(acl);
509                         if (error)
510                                 goto release_and_out;
511                 }
512         } else
513                 acl = NULL;
514 
515         error = ext2_set_acl(inode, type, acl);
516 
517 release_and_out:
518         posix_acl_release(acl);
519         return error;
520 }
521 
522 static int
523 ext2_xattr_set_acl_access(struct inode *inode, const char *name,
524                           const void *value, size_t size, int flags)
525 {
526         if (strcmp(name, "") != 0)
527                 return -EINVAL;
528         return ext2_xattr_set_acl(inode, ACL_TYPE_ACCESS, value, size);
529 }
530 
531 static int
532 ext2_xattr_set_acl_default(struct inode *inode, const char *name,
533                            const void *value, size_t size, int flags)
534 {
535         if (strcmp(name, "") != 0)
536                 return -EINVAL;
537         return ext2_xattr_set_acl(inode, ACL_TYPE_DEFAULT, value, size);
538 }
539 
540 struct ext2_xattr_handler ext2_xattr_acl_access_handler = {
541         .prefix = XATTR_NAME_ACL_ACCESS,
542         .list   = ext2_xattr_list_acl_access,
543         .get    = ext2_xattr_get_acl_access,
544         .set    = ext2_xattr_set_acl_access,
545 };
546 
547 struct ext2_xattr_handler ext2_xattr_acl_default_handler = {
548         .prefix = XATTR_NAME_ACL_DEFAULT,
549         .list   = ext2_xattr_list_acl_default,
550         .get    = ext2_xattr_get_acl_default,
551         .set    = ext2_xattr_set_acl_default,
552 };
553 
554 void
555 exit_ext2_acl(void)
556 {
557         ext2_xattr_unregister(EXT2_XATTR_INDEX_POSIX_ACL_ACCESS,
558                               &ext2_xattr_acl_access_handler);
559         ext2_xattr_unregister(EXT2_XATTR_INDEX_POSIX_ACL_DEFAULT,
560                               &ext2_xattr_acl_default_handler);
561 }
562 
563 int __init
564 init_ext2_acl(void)
565 {
566         int error;
567 
568         error = ext2_xattr_register(EXT2_XATTR_INDEX_POSIX_ACL_ACCESS,
569                                     &ext2_xattr_acl_access_handler);
570         if (error)
571                 goto fail;
572         error = ext2_xattr_register(EXT2_XATTR_INDEX_POSIX_ACL_DEFAULT,
573                                     &ext2_xattr_acl_default_handler);
574         if (error)
575                 goto fail;
576         return 0;
577 
578 fail:
579         exit_ext2_acl();
580         return error;
581 }
582 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp