2 * Copyright (c) 2001-2002 Silicon Graphics, Inc. All Rights Reserved.
4 * This program is free software; you can redistribute it and/or modify it
5 * under the terms of version 2 of the GNU General Public License as
6 * published by the Free Software Foundation.
8 * This program is distributed in the hope that it would be useful, but
9 * WITHOUT ANY WARRANTY; without even the implied warranty of
10 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
12 * Further, this software is distributed without any warranty that it is
13 * free of the rightful claim of any third person regarding infringement
14 * or the like. Any license provided herein, whether implied or
15 * otherwise, applies only to this software file. Patent licenses, if
16 * any, provided herein do not apply to combinations of this program with
17 * other software, or any other product whatsoever.
19 * You should have received a copy of the GNU General Public License along
20 * with this program; if not, write the Free Software Foundation, Inc., 59
21 * Temple Place - Suite 330, Boston MA 02111-1307, USA.
23 * Contact information: Silicon Graphics, Inc., 1600 Amphitheatre Pkwy,
24 * Mountain View, CA 94043, or:
28 * For further information regarding this notice, see:
30 * http://oss.sgi.com/projects/GenInfo/SGIGPLNoticeExplan/
34 #include "xfs_types.h"
40 #include "xfs_bmap_btree.h"
41 #include "xfs_alloc_btree.h"
42 #include "xfs_ialloc_btree.h"
43 #include "xfs_dir_sf.h"
44 #include "xfs_dir2_sf.h"
45 #include "xfs_attr_sf.h"
46 #include "xfs_dinode.h"
47 #include "xfs_inode.h"
48 #include "xfs_btree.h"
53 #include <linux/posix_acl_xattr.h>
55 STATIC
int xfs_acl_setmode(vnode_t
*, xfs_acl_t
*, int *);
56 STATIC
void xfs_acl_filter_mode(mode_t
, xfs_acl_t
*);
57 STATIC
void xfs_acl_get_endian(xfs_acl_t
*);
58 STATIC
int xfs_acl_access(uid_t
, gid_t
, xfs_acl_t
*, mode_t
, cred_t
*);
59 STATIC
int xfs_acl_invalid(xfs_acl_t
*);
60 STATIC
void xfs_acl_sync_mode(mode_t
, xfs_acl_t
*);
61 STATIC
void xfs_acl_get_attr(vnode_t
*, xfs_acl_t
*, int, int, int *);
62 STATIC
void xfs_acl_set_attr(vnode_t
*, xfs_acl_t
*, int, int *);
63 STATIC
int xfs_acl_allow_set(vnode_t
*, int);
65 kmem_zone_t
*xfs_acl_zone
;
69 * Test for existence of access ACL attribute as efficiently as possible.
72 xfs_acl_vhasacl_access(
77 xfs_acl_get_attr(vp
, NULL
, _ACL_TYPE_ACCESS
, ATTR_KERNOVAL
, &error
);
82 * Test for existence of default ACL attribute as efficiently as possible.
85 xfs_acl_vhasacl_default(
92 xfs_acl_get_attr(vp
, NULL
, _ACL_TYPE_DEFAULT
, ATTR_KERNOVAL
, &error
);
97 * Convert from extended attribute representation to in-memory for XFS.
100 posix_acl_xattr_to_xfs(
101 posix_acl_xattr_header
*src
,
105 posix_acl_xattr_entry
*src_entry
;
106 xfs_acl_entry_t
*dest_entry
;
112 if (size
< sizeof(posix_acl_xattr_header
))
115 if (src
->a_version
!= cpu_to_le32(POSIX_ACL_XATTR_VERSION
))
118 memset(dest
, 0, sizeof(xfs_acl_t
));
119 dest
->acl_cnt
= posix_acl_xattr_count(size
);
120 if (dest
->acl_cnt
< 0 || dest
->acl_cnt
> XFS_ACL_MAX_ENTRIES
)
124 * acl_set_file(3) may request that we set default ACLs with
125 * zero length -- defend (gracefully) against that here.
130 src_entry
= (posix_acl_xattr_entry
*)((char *)src
+ sizeof(*src
));
131 dest_entry
= &dest
->acl_entry
[0];
133 for (n
= 0; n
< dest
->acl_cnt
; n
++, src_entry
++, dest_entry
++) {
134 dest_entry
->ae_perm
= le16_to_cpu(src_entry
->e_perm
);
135 if (_ACL_PERM_INVALID(dest_entry
->ae_perm
))
137 dest_entry
->ae_tag
= le16_to_cpu(src_entry
->e_tag
);
138 switch(dest_entry
->ae_tag
) {
141 dest_entry
->ae_id
= le32_to_cpu(src_entry
->e_id
);
147 dest_entry
->ae_id
= ACL_UNDEFINED_ID
;
153 if (xfs_acl_invalid(dest
))
160 * Comparison function called from xfs_sort().
161 * Primary key is ae_tag, secondary key is ae_id.
164 xfs_acl_entry_compare(
168 xfs_acl_entry_t
*a
= (xfs_acl_entry_t
*)va
,
169 *b
= (xfs_acl_entry_t
*)vb
;
171 if (a
->ae_tag
== b
->ae_tag
)
172 return (a
->ae_id
- b
->ae_id
);
173 return (a
->ae_tag
- b
->ae_tag
);
177 * Convert from in-memory XFS to extended attribute representation.
180 posix_acl_xfs_to_xattr(
182 posix_acl_xattr_header
*dest
,
186 size_t new_size
= posix_acl_xattr_size(src
->acl_cnt
);
187 posix_acl_xattr_entry
*dest_entry
;
188 xfs_acl_entry_t
*src_entry
;
193 /* Need to sort src XFS ACL by <ae_tag,ae_id> */
194 xfs_sort(src
->acl_entry
, src
->acl_cnt
, sizeof(src
->acl_entry
[0]),
195 xfs_acl_entry_compare
);
197 dest
->a_version
= cpu_to_le32(POSIX_ACL_XATTR_VERSION
);
198 dest_entry
= &dest
->a_entries
[0];
199 src_entry
= &src
->acl_entry
[0];
200 for (n
= 0; n
< src
->acl_cnt
; n
++, dest_entry
++, src_entry
++) {
201 dest_entry
->e_perm
= cpu_to_le16(src_entry
->ae_perm
);
202 if (_ACL_PERM_INVALID(src_entry
->ae_perm
))
204 dest_entry
->e_tag
= cpu_to_le16(src_entry
->ae_tag
);
205 switch (src_entry
->ae_tag
) {
208 dest_entry
->e_id
= cpu_to_le32(src_entry
->ae_id
);
214 dest_entry
->e_id
= cpu_to_le32(ACL_UNDEFINED_ID
);
231 xfs_acl_t
*xfs_acl
= NULL
;
232 posix_acl_xattr_header
*ext_acl
= acl
;
237 if (!(_ACL_ALLOC(xfs_acl
))) {
241 memset(xfs_acl
, 0, sizeof(xfs_acl_t
));
243 flags
= ATTR_KERNOVAL
;
245 xfs_acl_get_attr(vp
, xfs_acl
, kind
, flags
, &error
);
250 error
= -posix_acl_xattr_size(XFS_ACL_MAX_ENTRIES
);
252 if (xfs_acl_invalid(xfs_acl
)) {
256 if (kind
== _ACL_TYPE_ACCESS
) {
259 va
.va_mask
= XFS_AT_MODE
;
260 VOP_GETATTR(vp
, &va
, 0, sys_cred
, error
);
263 xfs_acl_sync_mode(va
.va_mode
, xfs_acl
);
265 error
= -posix_acl_xfs_to_xattr(xfs_acl
, ext_acl
, size
);
282 error
= xfs_acl_allow_set(vp
, kind
);
284 VOP_ATTR_REMOVE(vp
, kind
== _ACL_TYPE_DEFAULT
?
285 SGI_ACL_DEFAULT
: SGI_ACL_FILE
,
286 ATTR_ROOT
, sys_cred
, error
);
287 if (error
== ENOATTR
)
288 error
= 0; /* 'scool */
301 posix_acl_xattr_header
*ext_acl
= acl
;
304 int basicperms
= 0; /* more than std unix perms? */
309 if (!(_ACL_ALLOC(xfs_acl
)))
312 error
= posix_acl_xattr_to_xfs(ext_acl
, size
, xfs_acl
);
317 if (!xfs_acl
->acl_cnt
) {
323 error
= xfs_acl_allow_set(vp
, kind
);
327 /* Incoming ACL exists, set file mode based on its value */
328 if (kind
== _ACL_TYPE_ACCESS
)
329 xfs_acl_setmode(vp
, xfs_acl
, &basicperms
);
332 * If we have more than std unix permissions, set up the actual attr.
333 * Otherwise, delete any existing attr. This prevents us from
334 * having actual attrs for permissions that can be stored in the
335 * standard permission bits.
338 xfs_acl_set_attr(vp
, xfs_acl
, kind
, &error
);
340 xfs_acl_vremove(vp
, _ACL_TYPE_ACCESS
);
358 if (!(_ACL_ALLOC(acl
)))
361 /* If the file has no ACL return -1. */
362 rval
= sizeof(xfs_acl_t
);
363 if (xfs_attr_fetch(ip
, SGI_ACL_FILE
, SGI_ACL_FILE_SIZE
,
364 (char *)acl
, &rval
, ATTR_ROOT
| ATTR_KERNACCESS
, cr
)) {
368 xfs_acl_get_endian(acl
);
370 /* If the file has an empty ACL return -1. */
371 if (acl
->acl_cnt
== XFS_ACL_NOT_PRESENT
) {
376 /* Synchronize ACL with mode bits */
377 xfs_acl_sync_mode(ip
->i_d
.di_mode
, acl
);
379 rval
= xfs_acl_access(ip
->i_d
.di_uid
, ip
->i_d
.di_gid
, acl
, mode
, cr
);
392 if (vp
->v_inode
.i_flags
& (S_IMMUTABLE
|S_APPEND
))
394 if (kind
== _ACL_TYPE_DEFAULT
&& !VN_ISDIR(vp
))
396 if (vp
->v_vfsp
->vfs_flag
& VFS_RDONLY
)
398 va
.va_mask
= XFS_AT_UID
;
399 VOP_GETATTR(vp
, &va
, 0, NULL
, error
);
402 if (va
.va_uid
!= current
->fsuid
&& !capable(CAP_FOWNER
))
408 * The access control process to determine the access permission:
409 * if uid == file owner id, use the file owner bits.
410 * if gid == file owner group id, use the file group bits.
411 * scan ACL for a maching user or group, and use matched entry
412 * permission. Use total permissions of all matching group entries,
413 * until all acl entries are exhausted. The final permission produced
414 * by matching acl entry or entries needs to be & with group permission.
415 * if not owner, owning group, or matching entry in ACL, use file
419 xfs_acl_capability_check(
423 if ((mode
& ACL_READ
) && !capable_cred(cr
, CAP_DAC_READ_SEARCH
))
425 if ((mode
& ACL_WRITE
) && !capable_cred(cr
, CAP_DAC_OVERRIDE
))
427 if ((mode
& ACL_EXECUTE
) && !capable_cred(cr
, CAP_DAC_OVERRIDE
))
434 * Note: cr is only used here for the capability check if the ACL test fails.
435 * It is not used to find out the credentials uid or groups etc, as was
436 * done in IRIX. It is assumed that the uid and groups for the current
437 * thread are taken from "current" instead of the cr parameter.
447 xfs_acl_entry_t matched
;
449 int maskallows
= -1; /* true, but not 1, either */
450 int seen_userobj
= 0;
452 matched
.ae_tag
= 0; /* Invalid type */
453 md
>>= 6; /* Normalize the bits for comparison */
455 for (i
= 0; i
< fap
->acl_cnt
; i
++) {
457 * Break out if we've got a user_obj entry or
458 * a user entry and the mask (and have processed USER_OBJ)
460 if (matched
.ae_tag
== ACL_USER_OBJ
)
462 if (matched
.ae_tag
== ACL_USER
) {
463 if (maskallows
!= -1 && seen_userobj
)
465 if (fap
->acl_entry
[i
].ae_tag
!= ACL_MASK
&&
466 fap
->acl_entry
[i
].ae_tag
!= ACL_USER_OBJ
)
469 /* True if this entry allows the requested access */
470 allows
= ((fap
->acl_entry
[i
].ae_perm
& md
) == md
);
472 switch (fap
->acl_entry
[i
].ae_tag
) {
475 if (fuid
!= current
->fsuid
)
477 matched
.ae_tag
= ACL_USER_OBJ
;
478 matched
.ae_perm
= allows
;
481 if (fap
->acl_entry
[i
].ae_id
!= current
->fsuid
)
483 matched
.ae_tag
= ACL_USER
;
484 matched
.ae_perm
= allows
;
487 if ((matched
.ae_tag
== ACL_GROUP_OBJ
||
488 matched
.ae_tag
== ACL_GROUP
) && !allows
)
490 if (!in_group_p(fgid
))
492 matched
.ae_tag
= ACL_GROUP_OBJ
;
493 matched
.ae_perm
= allows
;
496 if ((matched
.ae_tag
== ACL_GROUP_OBJ
||
497 matched
.ae_tag
== ACL_GROUP
) && !allows
)
499 if (!in_group_p(fap
->acl_entry
[i
].ae_id
))
501 matched
.ae_tag
= ACL_GROUP
;
502 matched
.ae_perm
= allows
;
508 if (matched
.ae_tag
!= 0)
510 matched
.ae_tag
= ACL_OTHER
;
511 matched
.ae_perm
= allows
;
516 * First possibility is that no matched entry allows access.
517 * The capability to override DAC may exist, so check for it.
519 switch (matched
.ae_tag
) {
528 if (maskallows
&& matched
.ae_perm
)
535 return xfs_acl_capability_check(md
, cr
);
539 * ACL validity checker.
540 * This acl validation routine checks each ACL entry read in makes sense.
546 xfs_acl_entry_t
*entry
, *e
;
547 int user
= 0, group
= 0, other
= 0, mask
= 0;
548 int mask_required
= 0;
554 if (aclp
->acl_cnt
> XFS_ACL_MAX_ENTRIES
)
557 for (i
= 0; i
< aclp
->acl_cnt
; i
++) {
558 entry
= &aclp
->acl_entry
[i
];
559 switch (entry
->ae_tag
) {
574 for (j
= i
+ 1; j
< aclp
->acl_cnt
; j
++) {
575 e
= &aclp
->acl_entry
[j
];
576 if (e
->ae_id
== entry
->ae_id
&&
577 e
->ae_tag
== entry
->ae_tag
)
590 if (!user
|| !group
|| !other
|| (mask_required
&& !mask
))
599 * Do ACL endian conversion.
605 xfs_acl_entry_t
*ace
, *end
;
607 INT_SET(aclp
->acl_cnt
, ARCH_CONVERT
, aclp
->acl_cnt
);
608 end
= &aclp
->acl_entry
[0]+aclp
->acl_cnt
;
609 for (ace
= &aclp
->acl_entry
[0]; ace
< end
; ace
++) {
610 INT_SET(ace
->ae_tag
, ARCH_CONVERT
, ace
->ae_tag
);
611 INT_SET(ace
->ae_id
, ARCH_CONVERT
, ace
->ae_id
);
612 INT_SET(ace
->ae_perm
, ARCH_CONVERT
, ace
->ae_perm
);
617 * Get the ACL from the EA and do endian conversion.
627 int len
= sizeof(xfs_acl_t
);
629 ASSERT((flags
& ATTR_KERNOVAL
) ? (aclp
== NULL
) : 1);
632 kind
== _ACL_TYPE_ACCESS
? SGI_ACL_FILE
: SGI_ACL_DEFAULT
,
633 (char *)aclp
, &len
, flags
, sys_cred
, *error
);
634 if (*error
|| (flags
& ATTR_KERNOVAL
))
636 xfs_acl_get_endian(aclp
);
640 * Set the EA with the ACL and do endian conversion.
649 xfs_acl_entry_t
*ace
, *newace
, *end
;
653 if (!(_ACL_ALLOC(newacl
))) {
658 len
= sizeof(xfs_acl_t
) -
659 (sizeof(xfs_acl_entry_t
) * (XFS_ACL_MAX_ENTRIES
- aclp
->acl_cnt
));
660 end
= &aclp
->acl_entry
[0]+aclp
->acl_cnt
;
661 for (ace
= &aclp
->acl_entry
[0], newace
= &newacl
->acl_entry
[0];
664 INT_SET(newace
->ae_tag
, ARCH_CONVERT
, ace
->ae_tag
);
665 INT_SET(newace
->ae_id
, ARCH_CONVERT
, ace
->ae_id
);
666 INT_SET(newace
->ae_perm
, ARCH_CONVERT
, ace
->ae_perm
);
668 INT_SET(newacl
->acl_cnt
, ARCH_CONVERT
, aclp
->acl_cnt
);
670 kind
== _ACL_TYPE_ACCESS
? SGI_ACL_FILE
: SGI_ACL_DEFAULT
,
671 (char *)newacl
, len
, ATTR_ROOT
, sys_cred
, *error
);
678 xfs_acl_t
*access_acl
,
679 xfs_acl_t
*default_acl
)
686 * Get the Access ACL and the mode. If either cannot
687 * be obtained for some reason, invalidate the access ACL.
689 xfs_acl_get_attr(vp
, access_acl
, _ACL_TYPE_ACCESS
, 0, &error
);
691 /* Got the ACL, need the mode... */
692 va
.va_mask
= XFS_AT_MODE
;
693 VOP_GETATTR(vp
, &va
, 0, sys_cred
, error
);
697 access_acl
->acl_cnt
= XFS_ACL_NOT_PRESENT
;
698 else /* We have a good ACL and the file mode, synchronize. */
699 xfs_acl_sync_mode(va
.va_mode
, access_acl
);
703 xfs_acl_get_attr(vp
, default_acl
, _ACL_TYPE_DEFAULT
, 0, &error
);
705 default_acl
->acl_cnt
= XFS_ACL_NOT_PRESENT
;
711 * This function retrieves the parent directory's acl, processes it
712 * and lets the child inherit the acl(s) that it should.
725 * If the parent does not have a default ACL, or it's an
726 * invalid ACL, we're done.
730 if (!pdaclp
|| xfs_acl_invalid(pdaclp
))
734 * Copy the default ACL of the containing directory to
735 * the access ACL of the new file and use the mode that
736 * was passed in to set up the correct initial values for
737 * the u::,g::[m::], and o:: entries. This is what makes
738 * umask() "work" with ACL's.
741 if (!(_ACL_ALLOC(cacl
)))
744 memcpy(cacl
, pdaclp
, sizeof(xfs_acl_t
));
745 xfs_acl_filter_mode(vap
->va_mode
, cacl
);
746 xfs_acl_setmode(vp
, cacl
, &basicperms
);
749 * Set the Default and Access ACL on the file. The mode is already
750 * set on the file, so we don't need to worry about that.
752 * If the new file is a directory, its default ACL is a copy of
753 * the containing directory's default ACL.
756 xfs_acl_set_attr(vp
, pdaclp
, _ACL_TYPE_DEFAULT
, &error
);
757 if (!error
&& !basicperms
)
758 xfs_acl_set_attr(vp
, cacl
, _ACL_TYPE_ACCESS
, &error
);
764 * Set up the correct mode on the file based on the supplied ACL. This
765 * makes sure that the mode on the file reflects the state of the
766 * u::,g::[m::], and o:: entries in the ACL. Since the mode is where
767 * the ACL is going to get the permissions for these entries, we must
768 * synchronize the mode whenever we set the ACL on a file.
778 xfs_acl_entry_t
*gap
= NULL
;
779 int i
, error
, nomask
= 1;
783 if (acl
->acl_cnt
== XFS_ACL_NOT_PRESENT
)
787 * Copy the u::, g::, o::, and m:: bits from the ACL into the
788 * mode. The m:: bits take precedence over the g:: bits.
790 va
.va_mask
= XFS_AT_MODE
;
791 VOP_GETATTR(vp
, &va
, 0, sys_cred
, error
);
795 va
.va_mask
= XFS_AT_MODE
;
796 va
.va_mode
&= ~(S_IRWXU
|S_IRWXG
|S_IRWXO
);
798 for (i
= 0; i
< acl
->acl_cnt
; ++i
) {
799 switch (ap
->ae_tag
) {
801 va
.va_mode
|= ap
->ae_perm
<< 6;
806 case ACL_MASK
: /* more than just standard modes */
808 va
.va_mode
|= ap
->ae_perm
<< 3;
812 va
.va_mode
|= ap
->ae_perm
;
814 default: /* more than just standard modes */
821 /* Set the group bits from ACL_GROUP_OBJ if there's no ACL_MASK */
823 va
.va_mode
|= gap
->ae_perm
<< 3;
825 VOP_SETATTR(vp
, &va
, 0, sys_cred
, error
);
830 * The permissions for the special ACL entries (u::, g::[m::], o::) are
831 * actually stored in the file mode (if there is both a group and a mask,
832 * the group is stored in the ACL entry and the mask is stored on the file).
833 * This allows the mode to remain automatically in sync with the ACL without
834 * the need for a call-back to the ACL system at every point where the mode
835 * could change. This function takes the permissions from the specified mode
836 * and places it in the supplied ACL.
838 * This implementation draws its validity from the fact that, when the ACL
839 * was assigned, the mode was copied from the ACL.
840 * If the mode did not change, therefore, the mode remains exactly what was
841 * taken from the special ACL entries at assignment.
842 * If a subsequent chmod() was done, the POSIX spec says that the change in
843 * mode must cause an update to the ACL seen at user level and used for
844 * access checks. Before and after a mode change, therefore, the file mode
845 * most accurately reflects what the special ACL entries should permit/deny.
847 * CAVEAT: If someone sets the SGI_ACL_FILE attribute directly,
848 * the existing mode bits will override whatever is in the
849 * ACL. Similarly, if there is a pre-existing ACL that was
850 * never in sync with its mode (owing to a bug in 6.5 and
851 * before), it will now magically (or mystically) be
852 * synchronized. This could cause slight astonishment, but
853 * it is better than inconsistent permissions.
855 * The supplied ACL is a template that may contain any combination
856 * of special entries. These are treated as place holders when we fill
857 * out the ACL. This routine does not add or remove special entries, it
858 * simply unites each special entry with its associated set of permissions.
867 xfs_acl_entry_t
*gap
= NULL
;
870 * Set ACL entries. POSIX1003.1eD16 requires that the MASK
871 * be set instead of the GROUP entry, if there is a MASK.
873 for (ap
= acl
->acl_entry
, i
= 0; i
< acl
->acl_cnt
; ap
++, i
++) {
874 switch (ap
->ae_tag
) {
876 ap
->ae_perm
= (mode
>> 6) & 0x7;
883 ap
->ae_perm
= (mode
>> 3) & 0x7;
886 ap
->ae_perm
= mode
& 0x7;
892 /* Set the ACL_GROUP_OBJ if there's no ACL_MASK */
894 gap
->ae_perm
= (mode
>> 3) & 0x7;
898 * When inheriting an Access ACL from a directory Default ACL,
899 * the ACL bits are set to the intersection of the ACL default
900 * permission bits and the file permission bits in mode. If there
901 * are no permission bits on the file then we must not give them
902 * the ACL. This is what what makes umask() work with ACLs.
911 xfs_acl_entry_t
*gap
= NULL
;
914 * Set ACL entries. POSIX1003.1eD16 requires that the MASK
915 * be merged with GROUP entry, if there is a MASK.
917 for (ap
= acl
->acl_entry
, i
= 0; i
< acl
->acl_cnt
; ap
++, i
++) {
918 switch (ap
->ae_tag
) {
920 ap
->ae_perm
&= (mode
>> 6) & 0x7;
927 ap
->ae_perm
&= (mode
>> 3) & 0x7;
930 ap
->ae_perm
&= mode
& 0x7;
936 /* Set the ACL_GROUP_OBJ if there's no ACL_MASK */
938 gap
->ae_perm
&= (mode
>> 3) & 0x7;