4 * UID and GID to name mapping for clients.
6 * Copyright (c) 2002 The Regents of the University of Michigan.
9 * Marius Aamodt Eriksen <marius@umich.edu>
11 * Redistribution and use in source and binary forms, with or without
12 * modification, are permitted provided that the following conditions
15 * 1. Redistributions of source code must retain the above copyright
16 * notice, this list of conditions and the following disclaimer.
17 * 2. Redistributions in binary form must reproduce the above copyright
18 * notice, this list of conditions and the following disclaimer in the
19 * documentation and/or other materials provided with the distribution.
20 * 3. Neither the name of the University nor the names of its
21 * contributors may be used to endorse or promote products derived
22 * from this software without specific prior written permission.
24 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
25 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
26 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
27 * DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
29 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
30 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
31 * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
32 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
33 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
34 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36 #include <linux/types.h>
37 #include <linux/parser.h>
39 #include <linux/nfs_idmap.h>
40 #include <net/net_namespace.h>
41 #include <linux/sunrpc/rpc_pipe_fs.h>
42 #include <linux/nfs_fs.h>
43 #include <linux/nfs_fs_sb.h>
44 #include <linux/key.h>
45 #include <linux/keyctl.h>
46 #include <linux/key-type.h>
47 #include <keys/user-type.h>
48 #include <linux/module.h>
52 #include "nfs4trace.h"
54 #define NFS_UINT_MAXLEN 11
56 static const struct cred
*id_resolver_cache
;
57 static struct key_type key_type_id_resolver_legacy
;
59 struct idmap_legacy_upcalldata
{
60 struct rpc_pipe_msg pipe_msg
;
61 struct idmap_msg idmap_msg
;
62 struct key_construction
*key_cons
;
67 struct rpc_pipe_dir_object idmap_pdo
;
68 struct rpc_pipe
*idmap_pipe
;
69 struct idmap_legacy_upcalldata
*idmap_upcall_data
;
70 struct mutex idmap_mutex
;
74 * nfs_fattr_init_names - initialise the nfs_fattr owner_name/group_name fields
75 * @fattr: fully initialised struct nfs_fattr
76 * @owner_name: owner name string cache
77 * @group_name: group name string cache
79 void nfs_fattr_init_names(struct nfs_fattr
*fattr
,
80 struct nfs4_string
*owner_name
,
81 struct nfs4_string
*group_name
)
83 fattr
->owner_name
= owner_name
;
84 fattr
->group_name
= group_name
;
87 static void nfs_fattr_free_owner_name(struct nfs_fattr
*fattr
)
89 fattr
->valid
&= ~NFS_ATTR_FATTR_OWNER_NAME
;
90 kfree(fattr
->owner_name
->data
);
93 static void nfs_fattr_free_group_name(struct nfs_fattr
*fattr
)
95 fattr
->valid
&= ~NFS_ATTR_FATTR_GROUP_NAME
;
96 kfree(fattr
->group_name
->data
);
99 static bool nfs_fattr_map_owner_name(struct nfs_server
*server
, struct nfs_fattr
*fattr
)
101 struct nfs4_string
*owner
= fattr
->owner_name
;
104 if (!(fattr
->valid
& NFS_ATTR_FATTR_OWNER_NAME
))
106 if (nfs_map_name_to_uid(server
, owner
->data
, owner
->len
, &uid
) == 0) {
108 fattr
->valid
|= NFS_ATTR_FATTR_OWNER
;
113 static bool nfs_fattr_map_group_name(struct nfs_server
*server
, struct nfs_fattr
*fattr
)
115 struct nfs4_string
*group
= fattr
->group_name
;
118 if (!(fattr
->valid
& NFS_ATTR_FATTR_GROUP_NAME
))
120 if (nfs_map_group_to_gid(server
, group
->data
, group
->len
, &gid
) == 0) {
122 fattr
->valid
|= NFS_ATTR_FATTR_GROUP
;
128 * nfs_fattr_free_names - free up the NFSv4 owner and group strings
129 * @fattr: a fully initialised nfs_fattr structure
131 void nfs_fattr_free_names(struct nfs_fattr
*fattr
)
133 if (fattr
->valid
& NFS_ATTR_FATTR_OWNER_NAME
)
134 nfs_fattr_free_owner_name(fattr
);
135 if (fattr
->valid
& NFS_ATTR_FATTR_GROUP_NAME
)
136 nfs_fattr_free_group_name(fattr
);
140 * nfs_fattr_map_and_free_names - map owner/group strings into uid/gid and free
141 * @server: pointer to the filesystem nfs_server structure
142 * @fattr: a fully initialised nfs_fattr structure
144 * This helper maps the cached NFSv4 owner/group strings in fattr into
145 * their numeric uid/gid equivalents, and then frees the cached strings.
147 void nfs_fattr_map_and_free_names(struct nfs_server
*server
, struct nfs_fattr
*fattr
)
149 if (nfs_fattr_map_owner_name(server
, fattr
))
150 nfs_fattr_free_owner_name(fattr
);
151 if (nfs_fattr_map_group_name(server
, fattr
))
152 nfs_fattr_free_group_name(fattr
);
155 static int nfs_map_string_to_numeric(const char *name
, size_t namelen
, __u32
*res
)
160 if (memchr(name
, '@', namelen
) != NULL
|| namelen
>= sizeof(buf
))
162 memcpy(buf
, name
, namelen
);
164 if (kstrtoul(buf
, 0, &val
) != 0)
170 static int nfs_map_numeric_to_string(__u32 id
, char *buf
, size_t buflen
)
172 return snprintf(buf
, buflen
, "%u", id
);
175 static struct key_type key_type_id_resolver
= {
176 .name
= "id_resolver",
177 .preparse
= user_preparse
,
178 .free_preparse
= user_free_preparse
,
179 .instantiate
= generic_key_instantiate
,
180 .revoke
= user_revoke
,
181 .destroy
= user_destroy
,
182 .describe
= user_describe
,
186 static int nfs_idmap_init_keyring(void)
192 printk(KERN_NOTICE
"NFS: Registering the %s key type\n",
193 key_type_id_resolver
.name
);
195 cred
= prepare_kernel_cred(NULL
);
199 keyring
= keyring_alloc(".id_resolver",
200 GLOBAL_ROOT_UID
, GLOBAL_ROOT_GID
, cred
,
201 (KEY_POS_ALL
& ~KEY_POS_SETATTR
) |
202 KEY_USR_VIEW
| KEY_USR_READ
,
203 KEY_ALLOC_NOT_IN_QUOTA
, NULL
);
204 if (IS_ERR(keyring
)) {
205 ret
= PTR_ERR(keyring
);
206 goto failed_put_cred
;
209 ret
= register_key_type(&key_type_id_resolver
);
213 ret
= register_key_type(&key_type_id_resolver_legacy
);
215 goto failed_reg_legacy
;
217 set_bit(KEY_FLAG_ROOT_CAN_CLEAR
, &keyring
->flags
);
218 cred
->thread_keyring
= keyring
;
219 cred
->jit_keyring
= KEY_REQKEY_DEFL_THREAD_KEYRING
;
220 id_resolver_cache
= cred
;
224 unregister_key_type(&key_type_id_resolver
);
232 static void nfs_idmap_quit_keyring(void)
234 key_revoke(id_resolver_cache
->thread_keyring
);
235 unregister_key_type(&key_type_id_resolver
);
236 unregister_key_type(&key_type_id_resolver_legacy
);
237 put_cred(id_resolver_cache
);
241 * Assemble the description to pass to request_key()
242 * This function will allocate a new string and update dest to point
243 * at it. The caller is responsible for freeing dest.
245 * On error 0 is returned. Otherwise, the length of dest is returned.
247 static ssize_t
nfs_idmap_get_desc(const char *name
, size_t namelen
,
248 const char *type
, size_t typelen
, char **desc
)
251 size_t desclen
= typelen
+ namelen
+ 2;
253 *desc
= kmalloc(desclen
, GFP_KERNEL
);
258 memcpy(cp
, type
, typelen
);
262 memcpy(cp
, name
, namelen
);
268 static struct key
*nfs_idmap_request_key(const char *name
, size_t namelen
,
269 const char *type
, struct idmap
*idmap
)
275 ret
= nfs_idmap_get_desc(name
, namelen
, type
, strlen(type
), &desc
);
279 rkey
= request_key(&key_type_id_resolver
, desc
, "");
281 mutex_lock(&idmap
->idmap_mutex
);
282 rkey
= request_key_with_auxdata(&key_type_id_resolver_legacy
,
284 mutex_unlock(&idmap
->idmap_mutex
);
287 set_bit(KEY_FLAG_ROOT_CAN_INVAL
, &rkey
->flags
);
293 static ssize_t
nfs_idmap_get_key(const char *name
, size_t namelen
,
294 const char *type
, void *data
,
295 size_t data_size
, struct idmap
*idmap
)
297 const struct cred
*saved_cred
;
299 struct user_key_payload
*payload
;
302 saved_cred
= override_creds(id_resolver_cache
);
303 rkey
= nfs_idmap_request_key(name
, namelen
, type
, idmap
);
304 revert_creds(saved_cred
);
312 rkey
->perm
|= KEY_USR_VIEW
;
314 ret
= key_validate(rkey
);
318 payload
= rcu_dereference(rkey
->payload
.rcudata
);
319 if (IS_ERR_OR_NULL(payload
)) {
320 ret
= PTR_ERR(payload
);
324 ret
= payload
->datalen
;
325 if (ret
> 0 && ret
<= data_size
)
326 memcpy(data
, payload
->data
, ret
);
338 static ssize_t
nfs_idmap_lookup_name(__u32 id
, const char *type
, char *buf
,
339 size_t buflen
, struct idmap
*idmap
)
341 char id_str
[NFS_UINT_MAXLEN
];
345 id_len
= snprintf(id_str
, sizeof(id_str
), "%u", id
);
346 ret
= nfs_idmap_get_key(id_str
, id_len
, type
, buf
, buflen
, idmap
);
353 static int nfs_idmap_lookup_id(const char *name
, size_t namelen
, const char *type
,
354 __u32
*id
, struct idmap
*idmap
)
356 char id_str
[NFS_UINT_MAXLEN
];
361 data_size
= nfs_idmap_get_key(name
, namelen
, type
, id_str
, NFS_UINT_MAXLEN
, idmap
);
362 if (data_size
<= 0) {
365 ret
= kstrtol(id_str
, 10, &id_long
);
366 *id
= (__u32
)id_long
;
371 /* idmap classic begins here */
374 Opt_find_uid
, Opt_find_gid
, Opt_find_user
, Opt_find_group
, Opt_find_err
377 static const match_table_t nfs_idmap_tokens
= {
378 { Opt_find_uid
, "uid:%s" },
379 { Opt_find_gid
, "gid:%s" },
380 { Opt_find_user
, "user:%s" },
381 { Opt_find_group
, "group:%s" },
382 { Opt_find_err
, NULL
}
385 static int nfs_idmap_legacy_upcall(struct key_construction
*, const char *, void *);
386 static ssize_t
idmap_pipe_downcall(struct file
*, const char __user
*,
388 static void idmap_release_pipe(struct inode
*);
389 static void idmap_pipe_destroy_msg(struct rpc_pipe_msg
*);
391 static const struct rpc_pipe_ops idmap_upcall_ops
= {
392 .upcall
= rpc_pipe_generic_upcall
,
393 .downcall
= idmap_pipe_downcall
,
394 .release_pipe
= idmap_release_pipe
,
395 .destroy_msg
= idmap_pipe_destroy_msg
,
398 static struct key_type key_type_id_resolver_legacy
= {
400 .preparse
= user_preparse
,
401 .free_preparse
= user_free_preparse
,
402 .instantiate
= generic_key_instantiate
,
403 .revoke
= user_revoke
,
404 .destroy
= user_destroy
,
405 .describe
= user_describe
,
407 .request_key
= nfs_idmap_legacy_upcall
,
410 static void nfs_idmap_pipe_destroy(struct dentry
*dir
,
411 struct rpc_pipe_dir_object
*pdo
)
413 struct idmap
*idmap
= pdo
->pdo_data
;
414 struct rpc_pipe
*pipe
= idmap
->idmap_pipe
;
417 rpc_unlink(pipe
->dentry
);
422 static int nfs_idmap_pipe_create(struct dentry
*dir
,
423 struct rpc_pipe_dir_object
*pdo
)
425 struct idmap
*idmap
= pdo
->pdo_data
;
426 struct rpc_pipe
*pipe
= idmap
->idmap_pipe
;
427 struct dentry
*dentry
;
429 dentry
= rpc_mkpipe_dentry(dir
, "idmap", idmap
, pipe
);
431 return PTR_ERR(dentry
);
432 pipe
->dentry
= dentry
;
436 static const struct rpc_pipe_dir_object_ops nfs_idmap_pipe_dir_object_ops
= {
437 .create
= nfs_idmap_pipe_create
,
438 .destroy
= nfs_idmap_pipe_destroy
,
442 nfs_idmap_new(struct nfs_client
*clp
)
445 struct rpc_pipe
*pipe
;
448 idmap
= kzalloc(sizeof(*idmap
), GFP_KERNEL
);
452 rpc_init_pipe_dir_object(&idmap
->idmap_pdo
,
453 &nfs_idmap_pipe_dir_object_ops
,
456 pipe
= rpc_mkpipe_data(&idmap_upcall_ops
, 0);
458 error
= PTR_ERR(pipe
);
461 idmap
->idmap_pipe
= pipe
;
462 mutex_init(&idmap
->idmap_mutex
);
464 error
= rpc_add_pipe_dir_object(clp
->cl_net
,
465 &clp
->cl_rpcclient
->cl_pipedir_objects
,
468 goto err_destroy_pipe
;
470 clp
->cl_idmap
= idmap
;
473 rpc_destroy_pipe_data(idmap
->idmap_pipe
);
480 nfs_idmap_delete(struct nfs_client
*clp
)
482 struct idmap
*idmap
= clp
->cl_idmap
;
486 clp
->cl_idmap
= NULL
;
487 rpc_remove_pipe_dir_object(clp
->cl_net
,
488 &clp
->cl_rpcclient
->cl_pipedir_objects
,
490 rpc_destroy_pipe_data(idmap
->idmap_pipe
);
494 int nfs_idmap_init(void)
497 ret
= nfs_idmap_init_keyring();
504 void nfs_idmap_quit(void)
506 nfs_idmap_quit_keyring();
509 static int nfs_idmap_prepare_message(char *desc
, struct idmap
*idmap
,
510 struct idmap_msg
*im
,
511 struct rpc_pipe_msg
*msg
)
516 im
->im_type
= IDMAP_TYPE_GROUP
;
517 token
= match_token(desc
, nfs_idmap_tokens
, &substr
);
521 im
->im_type
= IDMAP_TYPE_USER
;
523 im
->im_conv
= IDMAP_CONV_NAMETOID
;
524 ret
= match_strlcpy(im
->im_name
, &substr
, IDMAP_NAMESZ
);
528 im
->im_type
= IDMAP_TYPE_USER
;
530 im
->im_conv
= IDMAP_CONV_IDTONAME
;
531 ret
= match_int(&substr
, &im
->im_id
);
540 msg
->len
= sizeof(struct idmap_msg
);
547 nfs_idmap_prepare_pipe_upcall(struct idmap
*idmap
,
548 struct idmap_legacy_upcalldata
*data
)
550 if (idmap
->idmap_upcall_data
!= NULL
) {
554 idmap
->idmap_upcall_data
= data
;
559 nfs_idmap_complete_pipe_upcall_locked(struct idmap
*idmap
, int ret
)
561 struct key_construction
*cons
= idmap
->idmap_upcall_data
->key_cons
;
563 kfree(idmap
->idmap_upcall_data
);
564 idmap
->idmap_upcall_data
= NULL
;
565 complete_request_key(cons
, ret
);
569 nfs_idmap_abort_pipe_upcall(struct idmap
*idmap
, int ret
)
571 if (idmap
->idmap_upcall_data
!= NULL
)
572 nfs_idmap_complete_pipe_upcall_locked(idmap
, ret
);
575 static int nfs_idmap_legacy_upcall(struct key_construction
*cons
,
579 struct idmap_legacy_upcalldata
*data
;
580 struct rpc_pipe_msg
*msg
;
581 struct idmap_msg
*im
;
582 struct idmap
*idmap
= (struct idmap
*)aux
;
583 struct key
*key
= cons
->key
;
586 /* msg and im are freed in idmap_pipe_destroy_msg */
587 data
= kzalloc(sizeof(*data
), GFP_KERNEL
);
591 msg
= &data
->pipe_msg
;
592 im
= &data
->idmap_msg
;
594 data
->key_cons
= cons
;
596 ret
= nfs_idmap_prepare_message(key
->description
, idmap
, im
, msg
);
601 if (!nfs_idmap_prepare_pipe_upcall(idmap
, data
))
604 ret
= rpc_queue_upcall(idmap
->idmap_pipe
, msg
);
606 nfs_idmap_abort_pipe_upcall(idmap
, ret
);
612 complete_request_key(cons
, ret
);
616 static int nfs_idmap_instantiate(struct key
*key
, struct key
*authkey
, char *data
, size_t datalen
)
618 return key_instantiate_and_link(key
, data
, datalen
,
619 id_resolver_cache
->thread_keyring
,
623 static int nfs_idmap_read_and_verify_message(struct idmap_msg
*im
,
624 struct idmap_msg
*upcall
,
625 struct key
*key
, struct key
*authkey
)
627 char id_str
[NFS_UINT_MAXLEN
];
632 if (upcall
->im_type
!= im
->im_type
|| upcall
->im_conv
!= im
->im_conv
)
634 switch (im
->im_conv
) {
635 case IDMAP_CONV_NAMETOID
:
636 if (strcmp(upcall
->im_name
, im
->im_name
) != 0)
638 /* Note: here we store the NUL terminator too */
639 len
= sprintf(id_str
, "%d", im
->im_id
) + 1;
640 ret
= nfs_idmap_instantiate(key
, authkey
, id_str
, len
);
642 case IDMAP_CONV_IDTONAME
:
643 if (upcall
->im_id
!= im
->im_id
)
645 len
= strlen(im
->im_name
);
646 ret
= nfs_idmap_instantiate(key
, authkey
, im
->im_name
, len
);
656 idmap_pipe_downcall(struct file
*filp
, const char __user
*src
, size_t mlen
)
658 struct rpc_inode
*rpci
= RPC_I(file_inode(filp
));
659 struct idmap
*idmap
= (struct idmap
*)rpci
->private;
660 struct key_construction
*cons
;
665 /* If instantiation is successful, anyone waiting for key construction
666 * will have been woken up and someone else may now have used
667 * idmap_key_cons - so after this point we may no longer touch it.
669 if (idmap
->idmap_upcall_data
== NULL
)
672 cons
= idmap
->idmap_upcall_data
->key_cons
;
674 if (mlen
!= sizeof(im
)) {
679 if (copy_from_user(&im
, src
, mlen
) != 0) {
684 if (!(im
.im_status
& IDMAP_STATUS_SUCCESS
)) {
689 namelen_in
= strnlen(im
.im_name
, IDMAP_NAMESZ
);
690 if (namelen_in
== 0 || namelen_in
== IDMAP_NAMESZ
) {
695 ret
= nfs_idmap_read_and_verify_message(&im
,
696 &idmap
->idmap_upcall_data
->idmap_msg
,
697 cons
->key
, cons
->authkey
);
699 key_set_timeout(cons
->key
, nfs_idmap_cache_timeout
);
704 nfs_idmap_complete_pipe_upcall_locked(idmap
, ret
);
710 idmap_pipe_destroy_msg(struct rpc_pipe_msg
*msg
)
712 struct idmap_legacy_upcalldata
*data
= container_of(msg
,
713 struct idmap_legacy_upcalldata
,
715 struct idmap
*idmap
= data
->idmap
;
718 nfs_idmap_abort_pipe_upcall(idmap
, msg
->errno
);
722 idmap_release_pipe(struct inode
*inode
)
724 struct rpc_inode
*rpci
= RPC_I(inode
);
725 struct idmap
*idmap
= (struct idmap
*)rpci
->private;
727 nfs_idmap_abort_pipe_upcall(idmap
, -EPIPE
);
730 int nfs_map_name_to_uid(const struct nfs_server
*server
, const char *name
, size_t namelen
, kuid_t
*uid
)
732 struct idmap
*idmap
= server
->nfs_client
->cl_idmap
;
736 if (!nfs_map_string_to_numeric(name
, namelen
, &id
))
737 ret
= nfs_idmap_lookup_id(name
, namelen
, "uid", &id
, idmap
);
739 *uid
= make_kuid(&init_user_ns
, id
);
740 if (!uid_valid(*uid
))
743 trace_nfs4_map_name_to_uid(name
, namelen
, id
, ret
);
747 int nfs_map_group_to_gid(const struct nfs_server
*server
, const char *name
, size_t namelen
, kgid_t
*gid
)
749 struct idmap
*idmap
= server
->nfs_client
->cl_idmap
;
753 if (!nfs_map_string_to_numeric(name
, namelen
, &id
))
754 ret
= nfs_idmap_lookup_id(name
, namelen
, "gid", &id
, idmap
);
756 *gid
= make_kgid(&init_user_ns
, id
);
757 if (!gid_valid(*gid
))
760 trace_nfs4_map_group_to_gid(name
, namelen
, id
, ret
);
764 int nfs_map_uid_to_name(const struct nfs_server
*server
, kuid_t uid
, char *buf
, size_t buflen
)
766 struct idmap
*idmap
= server
->nfs_client
->cl_idmap
;
770 id
= from_kuid(&init_user_ns
, uid
);
771 if (!(server
->caps
& NFS_CAP_UIDGID_NOMAP
))
772 ret
= nfs_idmap_lookup_name(id
, "user", buf
, buflen
, idmap
);
774 ret
= nfs_map_numeric_to_string(id
, buf
, buflen
);
775 trace_nfs4_map_uid_to_name(buf
, ret
, id
, ret
);
778 int nfs_map_gid_to_group(const struct nfs_server
*server
, kgid_t gid
, char *buf
, size_t buflen
)
780 struct idmap
*idmap
= server
->nfs_client
->cl_idmap
;
784 id
= from_kgid(&init_user_ns
, gid
);
785 if (!(server
->caps
& NFS_CAP_UIDGID_NOMAP
))
786 ret
= nfs_idmap_lookup_name(id
, "group", buf
, buflen
, idmap
);
788 ret
= nfs_map_numeric_to_string(id
, buf
, buflen
);
789 trace_nfs4_map_gid_to_group(buf
, ret
, id
, ret
);