2 * Copyright (c) 2001-2002,2005 Silicon Graphics, Inc.
5 * This program is free software; you can redistribute it and/or
6 * modify it under the terms of the GNU General Public License as
7 * published by the Free Software Foundation.
9 * This program is distributed in the hope that it would be useful,
10 * but WITHOUT ANY WARRANTY; without even the implied warranty of
11 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
12 * GNU General Public License for more details.
14 * You should have received a copy of the GNU General Public License
15 * along with this program; if not, write the Free Software Foundation,
16 * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA
20 #include "xfs_types.h"
25 #include "xfs_bmap_btree.h"
26 #include "xfs_alloc_btree.h"
27 #include "xfs_ialloc_btree.h"
28 #include "xfs_dir2_sf.h"
29 #include "xfs_attr_sf.h"
30 #include "xfs_dinode.h"
31 #include "xfs_inode.h"
32 #include "xfs_btree.h"
35 #include "xfs_vnodeops.h"
37 #include <linux/capability.h>
38 #include <linux/posix_acl_xattr.h>
40 STATIC
int xfs_acl_setmode(struct inode
*, xfs_acl_t
*, int *);
41 STATIC
void xfs_acl_filter_mode(mode_t
, xfs_acl_t
*);
42 STATIC
void xfs_acl_get_endian(xfs_acl_t
*);
43 STATIC
int xfs_acl_access(uid_t
, gid_t
, xfs_acl_t
*, mode_t
, cred_t
*);
44 STATIC
int xfs_acl_invalid(xfs_acl_t
*);
45 STATIC
void xfs_acl_sync_mode(mode_t
, xfs_acl_t
*);
46 STATIC
void xfs_acl_get_attr(struct inode
*, xfs_acl_t
*, int, int, int *);
47 STATIC
void xfs_acl_set_attr(struct inode
*, xfs_acl_t
*, int, int *);
48 STATIC
int xfs_acl_allow_set(struct inode
*, int);
50 kmem_zone_t
*xfs_acl_zone
;
57 xfs_decode_acl(const char *name
)
59 if (strcmp(name
, "posix_acl_access") == 0)
60 return _ACL_TYPE_ACCESS
;
61 else if (strcmp(name
, "posix_acl_default") == 0)
62 return _ACL_TYPE_DEFAULT
;
67 * Test for existence of access ACL attribute as efficiently as possible.
70 xfs_acl_vhasacl_access(
75 xfs_acl_get_attr(vp
, NULL
, _ACL_TYPE_ACCESS
, ATTR_KERNOVAL
, &error
);
80 * Test for existence of default ACL attribute as efficiently as possible.
83 xfs_acl_vhasacl_default(
88 if (!S_ISDIR(vp
->i_mode
))
90 xfs_acl_get_attr(vp
, NULL
, _ACL_TYPE_DEFAULT
, ATTR_KERNOVAL
, &error
);
95 * Convert from extended attribute representation to in-memory for XFS.
98 posix_acl_xattr_to_xfs(
99 posix_acl_xattr_header
*src
,
103 posix_acl_xattr_entry
*src_entry
;
104 xfs_acl_entry_t
*dest_entry
;
110 if (size
< sizeof(posix_acl_xattr_header
))
113 if (src
->a_version
!= cpu_to_le32(POSIX_ACL_XATTR_VERSION
))
116 memset(dest
, 0, sizeof(xfs_acl_t
));
117 dest
->acl_cnt
= posix_acl_xattr_count(size
);
118 if (dest
->acl_cnt
< 0 || dest
->acl_cnt
> XFS_ACL_MAX_ENTRIES
)
122 * acl_set_file(3) may request that we set default ACLs with
123 * zero length -- defend (gracefully) against that here.
128 src_entry
= (posix_acl_xattr_entry
*)((char *)src
+ sizeof(*src
));
129 dest_entry
= &dest
->acl_entry
[0];
131 for (n
= 0; n
< dest
->acl_cnt
; n
++, src_entry
++, dest_entry
++) {
132 dest_entry
->ae_perm
= le16_to_cpu(src_entry
->e_perm
);
133 if (_ACL_PERM_INVALID(dest_entry
->ae_perm
))
135 dest_entry
->ae_tag
= le16_to_cpu(src_entry
->e_tag
);
136 switch(dest_entry
->ae_tag
) {
139 dest_entry
->ae_id
= le32_to_cpu(src_entry
->e_id
);
145 dest_entry
->ae_id
= ACL_UNDEFINED_ID
;
151 if (xfs_acl_invalid(dest
))
158 * Comparison function called from xfs_sort().
159 * Primary key is ae_tag, secondary key is ae_id.
162 xfs_acl_entry_compare(
166 xfs_acl_entry_t
*a
= (xfs_acl_entry_t
*)va
,
167 *b
= (xfs_acl_entry_t
*)vb
;
169 if (a
->ae_tag
== b
->ae_tag
)
170 return (a
->ae_id
- b
->ae_id
);
171 return (a
->ae_tag
- b
->ae_tag
);
175 * Convert from in-memory XFS to extended attribute representation.
178 posix_acl_xfs_to_xattr(
180 posix_acl_xattr_header
*dest
,
184 size_t new_size
= posix_acl_xattr_size(src
->acl_cnt
);
185 posix_acl_xattr_entry
*dest_entry
;
186 xfs_acl_entry_t
*src_entry
;
191 /* Need to sort src XFS ACL by <ae_tag,ae_id> */
192 xfs_sort(src
->acl_entry
, src
->acl_cnt
, sizeof(src
->acl_entry
[0]),
193 xfs_acl_entry_compare
);
195 dest
->a_version
= cpu_to_le32(POSIX_ACL_XATTR_VERSION
);
196 dest_entry
= &dest
->a_entries
[0];
197 src_entry
= &src
->acl_entry
[0];
198 for (n
= 0; n
< src
->acl_cnt
; n
++, dest_entry
++, src_entry
++) {
199 dest_entry
->e_perm
= cpu_to_le16(src_entry
->ae_perm
);
200 if (_ACL_PERM_INVALID(src_entry
->ae_perm
))
202 dest_entry
->e_tag
= cpu_to_le16(src_entry
->ae_tag
);
203 switch (src_entry
->ae_tag
) {
206 dest_entry
->e_id
= cpu_to_le32(src_entry
->ae_id
);
212 dest_entry
->e_id
= cpu_to_le32(ACL_UNDEFINED_ID
);
229 xfs_acl_t
*xfs_acl
= NULL
;
230 posix_acl_xattr_header
*ext_acl
= acl
;
234 if (!(_ACL_ALLOC(xfs_acl
))) {
238 memset(xfs_acl
, 0, sizeof(xfs_acl_t
));
240 flags
= ATTR_KERNOVAL
;
242 xfs_acl_get_attr(vp
, xfs_acl
, kind
, flags
, &error
);
247 error
= -posix_acl_xattr_size(XFS_ACL_MAX_ENTRIES
);
249 if (xfs_acl_invalid(xfs_acl
)) {
253 if (kind
== _ACL_TYPE_ACCESS
)
254 xfs_acl_sync_mode(XFS_I(vp
)->i_d
.di_mode
, xfs_acl
);
255 error
= -posix_acl_xfs_to_xattr(xfs_acl
, ext_acl
, size
);
270 error
= xfs_acl_allow_set(vp
, kind
);
272 error
= xfs_attr_remove(XFS_I(vp
),
273 kind
== _ACL_TYPE_DEFAULT
?
274 SGI_ACL_DEFAULT
: SGI_ACL_FILE
,
276 if (error
== ENOATTR
)
277 error
= 0; /* 'scool */
289 posix_acl_xattr_header
*ext_acl
= acl
;
292 int basicperms
= 0; /* more than std unix perms? */
297 if (!(_ACL_ALLOC(xfs_acl
)))
300 error
= posix_acl_xattr_to_xfs(ext_acl
, size
, xfs_acl
);
305 if (!xfs_acl
->acl_cnt
) {
310 error
= xfs_acl_allow_set(vp
, kind
);
312 /* Incoming ACL exists, set file mode based on its value */
313 if (!error
&& kind
== _ACL_TYPE_ACCESS
)
314 error
= xfs_acl_setmode(vp
, xfs_acl
, &basicperms
);
320 * If we have more than std unix permissions, set up the actual attr.
321 * Otherwise, delete any existing attr. This prevents us from
322 * having actual attrs for permissions that can be stored in the
323 * standard permission bits.
326 xfs_acl_set_attr(vp
, xfs_acl
, kind
, &error
);
328 error
= -xfs_acl_vremove(vp
, _ACL_TYPE_ACCESS
);
344 struct xfs_name acl_name
= {SGI_ACL_FILE
, SGI_ACL_FILE_SIZE
};
346 if (!(_ACL_ALLOC(acl
)))
349 /* If the file has no ACL return -1. */
350 rval
= sizeof(xfs_acl_t
);
351 if (xfs_attr_fetch(ip
, &acl_name
, (char *)acl
, &rval
, ATTR_ROOT
)) {
355 xfs_acl_get_endian(acl
);
357 /* If the file has an empty ACL return -1. */
358 if (acl
->acl_cnt
== XFS_ACL_NOT_PRESENT
) {
363 /* Synchronize ACL with mode bits */
364 xfs_acl_sync_mode(ip
->i_d
.di_mode
, acl
);
366 rval
= xfs_acl_access(ip
->i_d
.di_uid
, ip
->i_d
.di_gid
, acl
, mode
, cr
);
376 if (vp
->i_flags
& (S_IMMUTABLE
|S_APPEND
))
378 if (kind
== _ACL_TYPE_DEFAULT
&& !S_ISDIR(vp
->i_mode
))
380 if (vp
->i_sb
->s_flags
& MS_RDONLY
)
382 if (XFS_I(vp
)->i_d
.di_uid
!= current_fsuid() && !capable(CAP_FOWNER
))
388 * Note: cr is only used here for the capability check if the ACL test fails.
389 * It is not used to find out the credentials uid or groups etc, as was
390 * done in IRIX. It is assumed that the uid and groups for the current
391 * thread are taken from "current" instead of the cr parameter.
401 xfs_acl_entry_t matched
;
403 int maskallows
= -1; /* true, but not 1, either */
404 int seen_userobj
= 0;
406 matched
.ae_tag
= 0; /* Invalid type */
409 for (i
= 0; i
< fap
->acl_cnt
; i
++) {
411 * Break out if we've got a user_obj entry or
412 * a user entry and the mask (and have processed USER_OBJ)
414 if (matched
.ae_tag
== ACL_USER_OBJ
)
416 if (matched
.ae_tag
== ACL_USER
) {
417 if (maskallows
!= -1 && seen_userobj
)
419 if (fap
->acl_entry
[i
].ae_tag
!= ACL_MASK
&&
420 fap
->acl_entry
[i
].ae_tag
!= ACL_USER_OBJ
)
423 /* True if this entry allows the requested access */
424 allows
= ((fap
->acl_entry
[i
].ae_perm
& md
) == md
);
426 switch (fap
->acl_entry
[i
].ae_tag
) {
429 if (fuid
!= current_fsuid())
431 matched
.ae_tag
= ACL_USER_OBJ
;
432 matched
.ae_perm
= allows
;
435 if (fap
->acl_entry
[i
].ae_id
!= current_fsuid())
437 matched
.ae_tag
= ACL_USER
;
438 matched
.ae_perm
= allows
;
441 if ((matched
.ae_tag
== ACL_GROUP_OBJ
||
442 matched
.ae_tag
== ACL_GROUP
) && !allows
)
444 if (!in_group_p(fgid
))
446 matched
.ae_tag
= ACL_GROUP_OBJ
;
447 matched
.ae_perm
= allows
;
450 if ((matched
.ae_tag
== ACL_GROUP_OBJ
||
451 matched
.ae_tag
== ACL_GROUP
) && !allows
)
453 if (!in_group_p(fap
->acl_entry
[i
].ae_id
))
455 matched
.ae_tag
= ACL_GROUP
;
456 matched
.ae_perm
= allows
;
462 if (matched
.ae_tag
!= 0)
464 matched
.ae_tag
= ACL_OTHER
;
465 matched
.ae_perm
= allows
;
470 * First possibility is that no matched entry allows access.
471 * The capability to override DAC may exist, so check for it.
473 switch (matched
.ae_tag
) {
482 if (maskallows
&& matched
.ae_perm
)
489 /* EACCES tells generic_permission to check for capability overrides */
494 * ACL validity checker.
495 * This acl validation routine checks each ACL entry read in makes sense.
501 xfs_acl_entry_t
*entry
, *e
;
502 int user
= 0, group
= 0, other
= 0, mask
= 0;
503 int mask_required
= 0;
509 if (aclp
->acl_cnt
> XFS_ACL_MAX_ENTRIES
)
512 for (i
= 0; i
< aclp
->acl_cnt
; i
++) {
513 entry
= &aclp
->acl_entry
[i
];
514 switch (entry
->ae_tag
) {
529 for (j
= i
+ 1; j
< aclp
->acl_cnt
; j
++) {
530 e
= &aclp
->acl_entry
[j
];
531 if (e
->ae_id
== entry
->ae_id
&&
532 e
->ae_tag
== entry
->ae_tag
)
545 if (!user
|| !group
|| !other
|| (mask_required
&& !mask
))
554 * Do ACL endian conversion.
560 xfs_acl_entry_t
*ace
, *end
;
562 INT_SET(aclp
->acl_cnt
, ARCH_CONVERT
, aclp
->acl_cnt
);
563 end
= &aclp
->acl_entry
[0]+aclp
->acl_cnt
;
564 for (ace
= &aclp
->acl_entry
[0]; ace
< end
; ace
++) {
565 INT_SET(ace
->ae_tag
, ARCH_CONVERT
, ace
->ae_tag
);
566 INT_SET(ace
->ae_id
, ARCH_CONVERT
, ace
->ae_id
);
567 INT_SET(ace
->ae_perm
, ARCH_CONVERT
, ace
->ae_perm
);
572 * Get the ACL from the EA and do endian conversion.
582 int len
= sizeof(xfs_acl_t
);
584 ASSERT((flags
& ATTR_KERNOVAL
) ? (aclp
== NULL
) : 1);
586 *error
= xfs_attr_get(XFS_I(vp
),
587 kind
== _ACL_TYPE_ACCESS
?
588 SGI_ACL_FILE
: SGI_ACL_DEFAULT
,
589 (char *)aclp
, &len
, flags
);
590 if (*error
|| (flags
& ATTR_KERNOVAL
))
592 xfs_acl_get_endian(aclp
);
596 * Set the EA with the ACL and do endian conversion.
605 xfs_acl_entry_t
*ace
, *newace
, *end
;
609 if (!(_ACL_ALLOC(newacl
))) {
614 len
= sizeof(xfs_acl_t
) -
615 (sizeof(xfs_acl_entry_t
) * (XFS_ACL_MAX_ENTRIES
- aclp
->acl_cnt
));
616 end
= &aclp
->acl_entry
[0]+aclp
->acl_cnt
;
617 for (ace
= &aclp
->acl_entry
[0], newace
= &newacl
->acl_entry
[0];
620 INT_SET(newace
->ae_tag
, ARCH_CONVERT
, ace
->ae_tag
);
621 INT_SET(newace
->ae_id
, ARCH_CONVERT
, ace
->ae_id
);
622 INT_SET(newace
->ae_perm
, ARCH_CONVERT
, ace
->ae_perm
);
624 INT_SET(newacl
->acl_cnt
, ARCH_CONVERT
, aclp
->acl_cnt
);
625 *error
= xfs_attr_set(XFS_I(vp
),
626 kind
== _ACL_TYPE_ACCESS
?
627 SGI_ACL_FILE
: SGI_ACL_DEFAULT
,
628 (char *)newacl
, len
, ATTR_ROOT
);
635 xfs_acl_t
*access_acl
,
636 xfs_acl_t
*default_acl
)
642 * Get the Access ACL and the mode. If either cannot
643 * be obtained for some reason, invalidate the access ACL.
645 xfs_acl_get_attr(vp
, access_acl
, _ACL_TYPE_ACCESS
, 0, &error
);
647 access_acl
->acl_cnt
= XFS_ACL_NOT_PRESENT
;
648 else /* We have a good ACL and the file mode, synchronize. */
649 xfs_acl_sync_mode(XFS_I(vp
)->i_d
.di_mode
, access_acl
);
653 xfs_acl_get_attr(vp
, default_acl
, _ACL_TYPE_DEFAULT
, 0, &error
);
655 default_acl
->acl_cnt
= XFS_ACL_NOT_PRESENT
;
661 * This function retrieves the parent directory's acl, processes it
662 * and lets the child inherit the acl(s) that it should.
675 * If the parent does not have a default ACL, or it's an
676 * invalid ACL, we're done.
680 if (!pdaclp
|| xfs_acl_invalid(pdaclp
))
684 * Copy the default ACL of the containing directory to
685 * the access ACL of the new file and use the mode that
686 * was passed in to set up the correct initial values for
687 * the u::,g::[m::], and o:: entries. This is what makes
688 * umask() "work" with ACL's.
691 if (!(_ACL_ALLOC(cacl
)))
694 memcpy(cacl
, pdaclp
, sizeof(xfs_acl_t
));
695 xfs_acl_filter_mode(mode
, cacl
);
696 error
= xfs_acl_setmode(vp
, cacl
, &basicperms
);
701 * Set the Default and Access ACL on the file. The mode is already
702 * set on the file, so we don't need to worry about that.
704 * If the new file is a directory, its default ACL is a copy of
705 * the containing directory's default ACL.
707 if (S_ISDIR(vp
->i_mode
))
708 xfs_acl_set_attr(vp
, pdaclp
, _ACL_TYPE_DEFAULT
, &error
);
709 if (!error
&& !basicperms
)
710 xfs_acl_set_attr(vp
, cacl
, _ACL_TYPE_ACCESS
, &error
);
717 * Set up the correct mode on the file based on the supplied ACL. This
718 * makes sure that the mode on the file reflects the state of the
719 * u::,g::[m::], and o:: entries in the ACL. Since the mode is where
720 * the ACL is going to get the permissions for these entries, we must
721 * synchronize the mode whenever we set the ACL on a file.
731 xfs_acl_entry_t
*gap
= NULL
;
736 if (acl
->acl_cnt
== XFS_ACL_NOT_PRESENT
)
740 * Copy the u::, g::, o::, and m:: bits from the ACL into the
741 * mode. The m:: bits take precedence over the g:: bits.
743 iattr
.ia_valid
= ATTR_MODE
;
744 iattr
.ia_mode
= XFS_I(vp
)->i_d
.di_mode
;
745 iattr
.ia_mode
&= ~(S_IRWXU
|S_IRWXG
|S_IRWXO
);
747 for (i
= 0; i
< acl
->acl_cnt
; ++i
) {
748 switch (ap
->ae_tag
) {
750 iattr
.ia_mode
|= ap
->ae_perm
<< 6;
755 case ACL_MASK
: /* more than just standard modes */
757 iattr
.ia_mode
|= ap
->ae_perm
<< 3;
761 iattr
.ia_mode
|= ap
->ae_perm
;
763 default: /* more than just standard modes */
770 /* Set the group bits from ACL_GROUP_OBJ if there's no ACL_MASK */
772 iattr
.ia_mode
|= gap
->ae_perm
<< 3;
774 return xfs_setattr(XFS_I(vp
), &iattr
, 0);
778 * The permissions for the special ACL entries (u::, g::[m::], o::) are
779 * actually stored in the file mode (if there is both a group and a mask,
780 * the group is stored in the ACL entry and the mask is stored on the file).
781 * This allows the mode to remain automatically in sync with the ACL without
782 * the need for a call-back to the ACL system at every point where the mode
783 * could change. This function takes the permissions from the specified mode
784 * and places it in the supplied ACL.
786 * This implementation draws its validity from the fact that, when the ACL
787 * was assigned, the mode was copied from the ACL.
788 * If the mode did not change, therefore, the mode remains exactly what was
789 * taken from the special ACL entries at assignment.
790 * If a subsequent chmod() was done, the POSIX spec says that the change in
791 * mode must cause an update to the ACL seen at user level and used for
792 * access checks. Before and after a mode change, therefore, the file mode
793 * most accurately reflects what the special ACL entries should permit/deny.
795 * CAVEAT: If someone sets the SGI_ACL_FILE attribute directly,
796 * the existing mode bits will override whatever is in the
797 * ACL. Similarly, if there is a pre-existing ACL that was
798 * never in sync with its mode (owing to a bug in 6.5 and
799 * before), it will now magically (or mystically) be
800 * synchronized. This could cause slight astonishment, but
801 * it is better than inconsistent permissions.
803 * The supplied ACL is a template that may contain any combination
804 * of special entries. These are treated as place holders when we fill
805 * out the ACL. This routine does not add or remove special entries, it
806 * simply unites each special entry with its associated set of permissions.
815 xfs_acl_entry_t
*gap
= NULL
;
818 * Set ACL entries. POSIX1003.1eD16 requires that the MASK
819 * be set instead of the GROUP entry, if there is a MASK.
821 for (ap
= acl
->acl_entry
, i
= 0; i
< acl
->acl_cnt
; ap
++, i
++) {
822 switch (ap
->ae_tag
) {
824 ap
->ae_perm
= (mode
>> 6) & 0x7;
831 ap
->ae_perm
= (mode
>> 3) & 0x7;
834 ap
->ae_perm
= mode
& 0x7;
840 /* Set the ACL_GROUP_OBJ if there's no ACL_MASK */
842 gap
->ae_perm
= (mode
>> 3) & 0x7;
846 * When inheriting an Access ACL from a directory Default ACL,
847 * the ACL bits are set to the intersection of the ACL default
848 * permission bits and the file permission bits in mode. If there
849 * are no permission bits on the file then we must not give them
850 * the ACL. This is what what makes umask() work with ACLs.
859 xfs_acl_entry_t
*gap
= NULL
;
862 * Set ACL entries. POSIX1003.1eD16 requires that the MASK
863 * be merged with GROUP entry, if there is a MASK.
865 for (ap
= acl
->acl_entry
, i
= 0; i
< acl
->acl_cnt
; ap
++, i
++) {
866 switch (ap
->ae_tag
) {
868 ap
->ae_perm
&= (mode
>> 6) & 0x7;
875 ap
->ae_perm
&= (mode
>> 3) & 0x7;
878 ap
->ae_perm
&= mode
& 0x7;
884 /* Set the ACL_GROUP_OBJ if there's no ACL_MASK */
886 gap
->ae_perm
&= (mode
>> 3) & 0x7;