2 * Common NFSv4 ACL handling code.
4 * Copyright (c) 2002, 2003 The Regents of the University of Michigan.
7 * Marius Aamodt Eriksen <marius@umich.edu>
8 * Jeff Sedlak <jsedlak@umich.edu>
9 * J. Bruce Fields <bfields@umich.edu>
11 * Redistribution and use in source and binary forms, with or without
12 * modification, are permitted provided that the following conditions
15 * 1. Redistributions of source code must retain the above copyright
16 * notice, this list of conditions and the following disclaimer.
17 * 2. Redistributions in binary form must reproduce the above copyright
18 * notice, this list of conditions and the following disclaimer in the
19 * documentation and/or other materials provided with the distribution.
20 * 3. Neither the name of the University nor the names of its
21 * contributors may be used to endorse or promote products derived
22 * from this software without specific prior written permission.
24 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
25 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
26 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
27 * DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
29 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
30 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
31 * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
32 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
33 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
34 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
37 #include <linux/slab.h>
38 #include <linux/nfs_fs.h>
44 #define NFS4_ACL_TYPE_DEFAULT 0x01
45 #define NFS4_ACL_DIR 0x02
46 #define NFS4_ACL_OWNER 0x04
48 /* mode bit translations: */
49 #define NFS4_READ_MODE (NFS4_ACE_READ_DATA)
50 #define NFS4_WRITE_MODE (NFS4_ACE_WRITE_DATA | NFS4_ACE_APPEND_DATA)
51 #define NFS4_EXECUTE_MODE NFS4_ACE_EXECUTE
52 #define NFS4_ANYONE_MODE (NFS4_ACE_READ_ATTRIBUTES | NFS4_ACE_READ_ACL | NFS4_ACE_SYNCHRONIZE)
53 #define NFS4_OWNER_MODE (NFS4_ACE_WRITE_ATTRIBUTES | NFS4_ACE_WRITE_ACL)
55 /* flags used to simulate posix default ACLs */
56 #define NFS4_INHERITANCE_FLAGS (NFS4_ACE_FILE_INHERIT_ACE \
57 | NFS4_ACE_DIRECTORY_INHERIT_ACE)
59 #define NFS4_SUPPORTED_FLAGS (NFS4_INHERITANCE_FLAGS \
60 | NFS4_ACE_INHERIT_ONLY_ACE \
61 | NFS4_ACE_IDENTIFIER_GROUP)
64 mask_from_posix(unsigned short perm
, unsigned int flags
)
66 int mask
= NFS4_ANYONE_MODE
;
68 if (flags
& NFS4_ACL_OWNER
)
69 mask
|= NFS4_OWNER_MODE
;
71 mask
|= NFS4_READ_MODE
;
73 mask
|= NFS4_WRITE_MODE
;
74 if ((perm
& ACL_WRITE
) && (flags
& NFS4_ACL_DIR
))
75 mask
|= NFS4_ACE_DELETE_CHILD
;
76 if (perm
& ACL_EXECUTE
)
77 mask
|= NFS4_EXECUTE_MODE
;
82 deny_mask_from_posix(unsigned short perm
, u32 flags
)
87 mask
|= NFS4_READ_MODE
;
89 mask
|= NFS4_WRITE_MODE
;
90 if ((perm
& ACL_WRITE
) && (flags
& NFS4_ACL_DIR
))
91 mask
|= NFS4_ACE_DELETE_CHILD
;
92 if (perm
& ACL_EXECUTE
)
93 mask
|= NFS4_EXECUTE_MODE
;
97 /* XXX: modify functions to return NFS errors; they're only ever
98 * used by nfs code, after all.... */
100 /* We only map from NFSv4 to POSIX ACLs when setting ACLs, when we err on the
101 * side of being more restrictive, so the mode bit mapping below is
102 * pessimistic. An optimistic version would be needed to handle DENY's,
103 * but we espect to coalesce all ALLOWs and DENYs before mapping to mode
107 low_mode_from_nfs4(u32 perm
, unsigned short *mode
, unsigned int flags
)
109 u32 write_mode
= NFS4_WRITE_MODE
;
111 if (flags
& NFS4_ACL_DIR
)
112 write_mode
|= NFS4_ACE_DELETE_CHILD
;
114 if ((perm
& NFS4_READ_MODE
) == NFS4_READ_MODE
)
116 if ((perm
& write_mode
) == write_mode
)
118 if ((perm
& NFS4_EXECUTE_MODE
) == NFS4_EXECUTE_MODE
)
119 *mode
|= ACL_EXECUTE
;
122 static short ace2type(struct nfs4_ace
*);
123 static void _posix_to_nfsv4_one(struct posix_acl
*, struct nfs4_acl
*,
127 nfsd4_get_nfs4_acl(struct svc_rqst
*rqstp
, struct dentry
*dentry
,
128 struct nfs4_acl
**acl
)
130 struct inode
*inode
= d_inode(dentry
);
132 struct posix_acl
*pacl
= NULL
, *dpacl
= NULL
;
133 unsigned int flags
= 0;
136 pacl
= get_acl(inode
, ACL_TYPE_ACCESS
);
138 pacl
= posix_acl_from_mode(inode
->i_mode
, GFP_KERNEL
);
141 return PTR_ERR(pacl
);
143 /* allocate for worst case: one (deny, allow) pair each: */
144 size
+= 2 * pacl
->a_count
;
146 if (S_ISDIR(inode
->i_mode
)) {
147 flags
= NFS4_ACL_DIR
;
148 dpacl
= get_acl(inode
, ACL_TYPE_DEFAULT
);
150 error
= PTR_ERR(dpacl
);
155 size
+= 2 * dpacl
->a_count
;
158 *acl
= kmalloc(nfs4_acl_bytes(size
), GFP_KERNEL
);
165 _posix_to_nfsv4_one(pacl
, *acl
, flags
& ~NFS4_ACL_TYPE_DEFAULT
);
168 _posix_to_nfsv4_one(dpacl
, *acl
, flags
| NFS4_ACL_TYPE_DEFAULT
);
171 posix_acl_release(dpacl
);
173 posix_acl_release(pacl
);
177 struct posix_acl_summary
{
178 unsigned short owner
;
179 unsigned short users
;
180 unsigned short group
;
181 unsigned short groups
;
182 unsigned short other
;
187 summarize_posix_acl(struct posix_acl
*acl
, struct posix_acl_summary
*pas
)
189 struct posix_acl_entry
*pa
, *pe
;
192 * Only pas.users and pas.groups need initialization; previous
193 * posix_acl_valid() calls ensure that the other fields will be
194 * initialized in the following loop. But, just to placate gcc:
196 memset(pas
, 0, sizeof(*pas
));
199 pe
= acl
->a_entries
+ acl
->a_count
;
201 FOREACH_ACL_ENTRY(pa
, acl
, pe
) {
204 pas
->owner
= pa
->e_perm
;
207 pas
->group
= pa
->e_perm
;
210 pas
->users
|= pa
->e_perm
;
213 pas
->groups
|= pa
->e_perm
;
216 pas
->other
= pa
->e_perm
;
219 pas
->mask
= pa
->e_perm
;
223 /* We'll only care about effective permissions: */
224 pas
->users
&= pas
->mask
;
225 pas
->group
&= pas
->mask
;
226 pas
->groups
&= pas
->mask
;
229 /* We assume the acl has been verified with posix_acl_valid. */
231 _posix_to_nfsv4_one(struct posix_acl
*pacl
, struct nfs4_acl
*acl
,
234 struct posix_acl_entry
*pa
, *group_owner_entry
;
235 struct nfs4_ace
*ace
;
236 struct posix_acl_summary pas
;
238 int eflag
= ((flags
& NFS4_ACL_TYPE_DEFAULT
) ?
239 NFS4_INHERITANCE_FLAGS
| NFS4_ACE_INHERIT_ONLY_ACE
: 0);
241 BUG_ON(pacl
->a_count
< 3);
242 summarize_posix_acl(pacl
, &pas
);
244 pa
= pacl
->a_entries
;
245 ace
= acl
->aces
+ acl
->naces
;
247 /* We could deny everything not granted by the owner: */
250 * but it is equivalent (and simpler) to deny only what is not
251 * granted by later entries:
253 deny
&= pas
.users
| pas
.group
| pas
.groups
| pas
.other
;
255 ace
->type
= NFS4_ACE_ACCESS_DENIED_ACE_TYPE
;
257 ace
->access_mask
= deny_mask_from_posix(deny
, flags
);
258 ace
->whotype
= NFS4_ACL_WHO_OWNER
;
263 ace
->type
= NFS4_ACE_ACCESS_ALLOWED_ACE_TYPE
;
265 ace
->access_mask
= mask_from_posix(pa
->e_perm
, flags
| NFS4_ACL_OWNER
);
266 ace
->whotype
= NFS4_ACL_WHO_OWNER
;
271 while (pa
->e_tag
== ACL_USER
) {
272 deny
= ~(pa
->e_perm
& pas
.mask
);
273 deny
&= pas
.groups
| pas
.group
| pas
.other
;
275 ace
->type
= NFS4_ACE_ACCESS_DENIED_ACE_TYPE
;
277 ace
->access_mask
= deny_mask_from_posix(deny
, flags
);
278 ace
->whotype
= NFS4_ACL_WHO_NAMED
;
279 ace
->who_uid
= pa
->e_uid
;
283 ace
->type
= NFS4_ACE_ACCESS_ALLOWED_ACE_TYPE
;
285 ace
->access_mask
= mask_from_posix(pa
->e_perm
& pas
.mask
,
287 ace
->whotype
= NFS4_ACL_WHO_NAMED
;
288 ace
->who_uid
= pa
->e_uid
;
294 /* In the case of groups, we apply allow ACEs first, then deny ACEs,
295 * since a user can be in more than one group. */
299 group_owner_entry
= pa
;
301 ace
->type
= NFS4_ACE_ACCESS_ALLOWED_ACE_TYPE
;
303 ace
->access_mask
= mask_from_posix(pas
.group
, flags
);
304 ace
->whotype
= NFS4_ACL_WHO_GROUP
;
309 while (pa
->e_tag
== ACL_GROUP
) {
310 ace
->type
= NFS4_ACE_ACCESS_ALLOWED_ACE_TYPE
;
311 ace
->flag
= eflag
| NFS4_ACE_IDENTIFIER_GROUP
;
312 ace
->access_mask
= mask_from_posix(pa
->e_perm
& pas
.mask
,
314 ace
->whotype
= NFS4_ACL_WHO_NAMED
;
315 ace
->who_gid
= pa
->e_gid
;
323 pa
= group_owner_entry
;
325 deny
= ~pas
.group
& pas
.other
;
327 ace
->type
= NFS4_ACE_ACCESS_DENIED_ACE_TYPE
;
329 ace
->access_mask
= deny_mask_from_posix(deny
, flags
);
330 ace
->whotype
= NFS4_ACL_WHO_GROUP
;
336 while (pa
->e_tag
== ACL_GROUP
) {
337 deny
= ~(pa
->e_perm
& pas
.mask
);
340 ace
->type
= NFS4_ACE_ACCESS_DENIED_ACE_TYPE
;
341 ace
->flag
= eflag
| NFS4_ACE_IDENTIFIER_GROUP
;
342 ace
->access_mask
= deny_mask_from_posix(deny
, flags
);
343 ace
->whotype
= NFS4_ACL_WHO_NAMED
;
344 ace
->who_gid
= pa
->e_gid
;
351 if (pa
->e_tag
== ACL_MASK
)
353 ace
->type
= NFS4_ACE_ACCESS_ALLOWED_ACE_TYPE
;
355 ace
->access_mask
= mask_from_posix(pa
->e_perm
, flags
);
356 ace
->whotype
= NFS4_ACL_WHO_EVERYONE
;
361 pace_gt(struct posix_acl_entry
*pace1
, struct posix_acl_entry
*pace2
)
363 if (pace1
->e_tag
!= pace2
->e_tag
)
364 return pace1
->e_tag
> pace2
->e_tag
;
365 if (pace1
->e_tag
== ACL_USER
)
366 return uid_gt(pace1
->e_uid
, pace2
->e_uid
);
367 if (pace1
->e_tag
== ACL_GROUP
)
368 return gid_gt(pace1
->e_gid
, pace2
->e_gid
);
373 sort_pacl_range(struct posix_acl
*pacl
, int start
, int end
) {
376 /* We just do a bubble sort; easy to do in place, and we're not
377 * expecting acl's to be long enough to justify anything more. */
380 for (i
= start
; i
< end
; i
++) {
381 if (pace_gt(&pacl
->a_entries
[i
],
382 &pacl
->a_entries
[i
+1])) {
384 swap(pacl
->a_entries
[i
],
385 pacl
->a_entries
[i
+ 1]);
392 sort_pacl(struct posix_acl
*pacl
)
394 /* posix_acl_valid requires that users and groups be in order
398 /* no users or groups */
399 if (!pacl
|| pacl
->a_count
<= 4)
403 while (pacl
->a_entries
[i
].e_tag
== ACL_USER
)
405 sort_pacl_range(pacl
, 1, i
-1);
407 BUG_ON(pacl
->a_entries
[i
].e_tag
!= ACL_GROUP_OBJ
);
409 while (pacl
->a_entries
[j
].e_tag
== ACL_GROUP
)
411 sort_pacl_range(pacl
, i
, j
-1);
416 * While processing the NFSv4 ACE, this maintains bitmasks representing
417 * which permission bits have been allowed and which denied to a given
419 struct posix_ace_state
{
424 struct posix_user_ace_state
{
429 struct posix_ace_state perms
;
432 struct posix_ace_state_array
{
434 struct posix_user_ace_state aces
[];
438 * While processing the NFSv4 ACE, this maintains the partial permissions
439 * calculated so far: */
441 struct posix_acl_state
{
443 struct posix_ace_state owner
;
444 struct posix_ace_state group
;
445 struct posix_ace_state other
;
446 struct posix_ace_state everyone
;
447 struct posix_ace_state mask
; /* Deny unused in this case */
448 struct posix_ace_state_array
*users
;
449 struct posix_ace_state_array
*groups
;
453 init_state(struct posix_acl_state
*state
, int cnt
)
457 memset(state
, 0, sizeof(struct posix_acl_state
));
460 * In the worst case, each individual acl could be for a distinct
461 * named user or group, but we don't no which, so we allocate
462 * enough space for either:
464 alloc
= sizeof(struct posix_ace_state_array
)
465 + cnt
*sizeof(struct posix_user_ace_state
);
466 state
->users
= kzalloc(alloc
, GFP_KERNEL
);
469 state
->groups
= kzalloc(alloc
, GFP_KERNEL
);
470 if (!state
->groups
) {
478 free_state(struct posix_acl_state
*state
) {
480 kfree(state
->groups
);
483 static inline void add_to_mask(struct posix_acl_state
*state
, struct posix_ace_state
*astate
)
485 state
->mask
.allow
|= astate
->allow
;
488 static struct posix_acl
*
489 posix_state_to_acl(struct posix_acl_state
*state
, unsigned int flags
)
491 struct posix_acl_entry
*pace
;
492 struct posix_acl
*pacl
;
497 * ACLs with no ACEs are treated differently in the inheritable
498 * and effective cases: when there are no inheritable ACEs,
499 * calls ->set_acl with a NULL ACL structure.
501 if (state
->empty
&& (flags
& NFS4_ACL_TYPE_DEFAULT
))
505 * When there are no effective ACEs, the following will end
506 * up setting a 3-element effective posix ACL with all
509 if (!state
->users
->n
&& !state
->groups
->n
)
511 else /* Note we also include a MASK ACE in this case: */
512 nace
= 4 + state
->users
->n
+ state
->groups
->n
;
513 pacl
= posix_acl_alloc(nace
, GFP_KERNEL
);
515 return ERR_PTR(-ENOMEM
);
517 pace
= pacl
->a_entries
;
518 pace
->e_tag
= ACL_USER_OBJ
;
519 low_mode_from_nfs4(state
->owner
.allow
, &pace
->e_perm
, flags
);
521 for (i
=0; i
< state
->users
->n
; i
++) {
523 pace
->e_tag
= ACL_USER
;
524 low_mode_from_nfs4(state
->users
->aces
[i
].perms
.allow
,
525 &pace
->e_perm
, flags
);
526 pace
->e_uid
= state
->users
->aces
[i
].uid
;
527 add_to_mask(state
, &state
->users
->aces
[i
].perms
);
531 pace
->e_tag
= ACL_GROUP_OBJ
;
532 low_mode_from_nfs4(state
->group
.allow
, &pace
->e_perm
, flags
);
533 add_to_mask(state
, &state
->group
);
535 for (i
=0; i
< state
->groups
->n
; i
++) {
537 pace
->e_tag
= ACL_GROUP
;
538 low_mode_from_nfs4(state
->groups
->aces
[i
].perms
.allow
,
539 &pace
->e_perm
, flags
);
540 pace
->e_gid
= state
->groups
->aces
[i
].gid
;
541 add_to_mask(state
, &state
->groups
->aces
[i
].perms
);
544 if (state
->users
->n
|| state
->groups
->n
) {
546 pace
->e_tag
= ACL_MASK
;
547 low_mode_from_nfs4(state
->mask
.allow
, &pace
->e_perm
, flags
);
551 pace
->e_tag
= ACL_OTHER
;
552 low_mode_from_nfs4(state
->other
.allow
, &pace
->e_perm
, flags
);
557 static inline void allow_bits(struct posix_ace_state
*astate
, u32 mask
)
559 /* Allow all bits in the mask not already denied: */
560 astate
->allow
|= mask
& ~astate
->deny
;
563 static inline void deny_bits(struct posix_ace_state
*astate
, u32 mask
)
565 /* Deny all bits in the mask not already allowed: */
566 astate
->deny
|= mask
& ~astate
->allow
;
569 static int find_uid(struct posix_acl_state
*state
, kuid_t uid
)
571 struct posix_ace_state_array
*a
= state
->users
;
574 for (i
= 0; i
< a
->n
; i
++)
575 if (uid_eq(a
->aces
[i
].uid
, uid
))
579 a
->aces
[i
].uid
= uid
;
580 a
->aces
[i
].perms
.allow
= state
->everyone
.allow
;
581 a
->aces
[i
].perms
.deny
= state
->everyone
.deny
;
586 static int find_gid(struct posix_acl_state
*state
, kgid_t gid
)
588 struct posix_ace_state_array
*a
= state
->groups
;
591 for (i
= 0; i
< a
->n
; i
++)
592 if (gid_eq(a
->aces
[i
].gid
, gid
))
596 a
->aces
[i
].gid
= gid
;
597 a
->aces
[i
].perms
.allow
= state
->everyone
.allow
;
598 a
->aces
[i
].perms
.deny
= state
->everyone
.deny
;
603 static void deny_bits_array(struct posix_ace_state_array
*a
, u32 mask
)
607 for (i
=0; i
< a
->n
; i
++)
608 deny_bits(&a
->aces
[i
].perms
, mask
);
611 static void allow_bits_array(struct posix_ace_state_array
*a
, u32 mask
)
615 for (i
=0; i
< a
->n
; i
++)
616 allow_bits(&a
->aces
[i
].perms
, mask
);
619 static void process_one_v4_ace(struct posix_acl_state
*state
,
620 struct nfs4_ace
*ace
)
622 u32 mask
= ace
->access_mask
;
627 switch (ace2type(ace
)) {
629 if (ace
->type
== NFS4_ACE_ACCESS_ALLOWED_ACE_TYPE
) {
630 allow_bits(&state
->owner
, mask
);
632 deny_bits(&state
->owner
, mask
);
636 i
= find_uid(state
, ace
->who_uid
);
637 if (ace
->type
== NFS4_ACE_ACCESS_ALLOWED_ACE_TYPE
) {
638 allow_bits(&state
->users
->aces
[i
].perms
, mask
);
640 deny_bits(&state
->users
->aces
[i
].perms
, mask
);
641 mask
= state
->users
->aces
[i
].perms
.deny
;
642 deny_bits(&state
->owner
, mask
);
646 if (ace
->type
== NFS4_ACE_ACCESS_ALLOWED_ACE_TYPE
) {
647 allow_bits(&state
->group
, mask
);
649 deny_bits(&state
->group
, mask
);
650 mask
= state
->group
.deny
;
651 deny_bits(&state
->owner
, mask
);
652 deny_bits(&state
->everyone
, mask
);
653 deny_bits_array(state
->users
, mask
);
654 deny_bits_array(state
->groups
, mask
);
658 i
= find_gid(state
, ace
->who_gid
);
659 if (ace
->type
== NFS4_ACE_ACCESS_ALLOWED_ACE_TYPE
) {
660 allow_bits(&state
->groups
->aces
[i
].perms
, mask
);
662 deny_bits(&state
->groups
->aces
[i
].perms
, mask
);
663 mask
= state
->groups
->aces
[i
].perms
.deny
;
664 deny_bits(&state
->owner
, mask
);
665 deny_bits(&state
->group
, mask
);
666 deny_bits(&state
->everyone
, mask
);
667 deny_bits_array(state
->users
, mask
);
668 deny_bits_array(state
->groups
, mask
);
672 if (ace
->type
== NFS4_ACE_ACCESS_ALLOWED_ACE_TYPE
) {
673 allow_bits(&state
->owner
, mask
);
674 allow_bits(&state
->group
, mask
);
675 allow_bits(&state
->other
, mask
);
676 allow_bits(&state
->everyone
, mask
);
677 allow_bits_array(state
->users
, mask
);
678 allow_bits_array(state
->groups
, mask
);
680 deny_bits(&state
->owner
, mask
);
681 deny_bits(&state
->group
, mask
);
682 deny_bits(&state
->other
, mask
);
683 deny_bits(&state
->everyone
, mask
);
684 deny_bits_array(state
->users
, mask
);
685 deny_bits_array(state
->groups
, mask
);
690 static int nfs4_acl_nfsv4_to_posix(struct nfs4_acl
*acl
,
691 struct posix_acl
**pacl
, struct posix_acl
**dpacl
,
694 struct posix_acl_state effective_acl_state
, default_acl_state
;
695 struct nfs4_ace
*ace
;
698 ret
= init_state(&effective_acl_state
, acl
->naces
);
701 ret
= init_state(&default_acl_state
, acl
->naces
);
705 for (ace
= acl
->aces
; ace
< acl
->aces
+ acl
->naces
; ace
++) {
706 if (ace
->type
!= NFS4_ACE_ACCESS_ALLOWED_ACE_TYPE
&&
707 ace
->type
!= NFS4_ACE_ACCESS_DENIED_ACE_TYPE
)
709 if (ace
->flag
& ~NFS4_SUPPORTED_FLAGS
)
711 if ((ace
->flag
& NFS4_INHERITANCE_FLAGS
) == 0) {
712 process_one_v4_ace(&effective_acl_state
, ace
);
715 if (!(flags
& NFS4_ACL_DIR
))
718 * Note that when only one of FILE_INHERIT or DIRECTORY_INHERIT
719 * is set, we're effectively turning on the other. That's OK,
720 * according to rfc 3530.
722 process_one_v4_ace(&default_acl_state
, ace
);
724 if (!(ace
->flag
& NFS4_ACE_INHERIT_ONLY_ACE
))
725 process_one_v4_ace(&effective_acl_state
, ace
);
727 *pacl
= posix_state_to_acl(&effective_acl_state
, flags
);
729 ret
= PTR_ERR(*pacl
);
733 *dpacl
= posix_state_to_acl(&default_acl_state
,
734 flags
| NFS4_ACL_TYPE_DEFAULT
);
735 if (IS_ERR(*dpacl
)) {
736 ret
= PTR_ERR(*dpacl
);
738 posix_acl_release(*pacl
);
746 free_state(&default_acl_state
);
748 free_state(&effective_acl_state
);
753 nfsd4_set_nfs4_acl(struct svc_rqst
*rqstp
, struct svc_fh
*fhp
,
754 struct nfs4_acl
*acl
)
758 struct dentry
*dentry
;
760 struct posix_acl
*pacl
= NULL
, *dpacl
= NULL
;
761 unsigned int flags
= 0;
764 error
= fh_verify(rqstp
, fhp
, 0, NFSD_MAY_SATTR
);
768 dentry
= fhp
->fh_dentry
;
769 inode
= d_inode(dentry
);
771 if (!inode
->i_op
->set_acl
|| !IS_POSIXACL(inode
))
772 return nfserr_attrnotsupp
;
774 if (S_ISDIR(inode
->i_mode
))
775 flags
= NFS4_ACL_DIR
;
777 host_error
= nfs4_acl_nfsv4_to_posix(acl
, &pacl
, &dpacl
, flags
);
778 if (host_error
== -EINVAL
)
779 return nfserr_attrnotsupp
;
783 host_error
= inode
->i_op
->set_acl(inode
, pacl
, ACL_TYPE_ACCESS
);
787 if (S_ISDIR(inode
->i_mode
)) {
788 host_error
= inode
->i_op
->set_acl(inode
, dpacl
,
793 posix_acl_release(pacl
);
794 posix_acl_release(dpacl
);
796 if (host_error
== -EOPNOTSUPP
)
797 return nfserr_attrnotsupp
;
799 return nfserrno(host_error
);
804 ace2type(struct nfs4_ace
*ace
)
806 switch (ace
->whotype
) {
807 case NFS4_ACL_WHO_NAMED
:
808 return (ace
->flag
& NFS4_ACE_IDENTIFIER_GROUP
?
809 ACL_GROUP
: ACL_USER
);
810 case NFS4_ACL_WHO_OWNER
:
812 case NFS4_ACL_WHO_GROUP
:
813 return ACL_GROUP_OBJ
;
814 case NFS4_ACL_WHO_EVERYONE
:
822 * return the size of the struct nfs4_acl required to represent an acl
823 * with @entries entries.
825 int nfs4_acl_bytes(int entries
)
827 return sizeof(struct nfs4_acl
) + entries
* sizeof(struct nfs4_ace
);
837 .stringlen
= sizeof("OWNER@") - 1,
838 .type
= NFS4_ACL_WHO_OWNER
,
842 .stringlen
= sizeof("GROUP@") - 1,
843 .type
= NFS4_ACL_WHO_GROUP
,
846 .string
= "EVERYONE@",
847 .stringlen
= sizeof("EVERYONE@") - 1,
848 .type
= NFS4_ACL_WHO_EVERYONE
,
853 nfs4_acl_get_whotype(char *p
, u32 len
)
857 for (i
= 0; i
< ARRAY_SIZE(s2t_map
); i
++) {
858 if (s2t_map
[i
].stringlen
== len
&&
859 0 == memcmp(s2t_map
[i
].string
, p
, len
))
860 return s2t_map
[i
].type
;
862 return NFS4_ACL_WHO_NAMED
;
865 __be32
nfs4_acl_write_who(struct xdr_stream
*xdr
, int who
)
870 for (i
= 0; i
< ARRAY_SIZE(s2t_map
); i
++) {
871 if (s2t_map
[i
].type
!= who
)
873 p
= xdr_reserve_space(xdr
, s2t_map
[i
].stringlen
+ 4);
875 return nfserr_resource
;
876 p
= xdr_encode_opaque(p
, s2t_map
[i
].string
,
877 s2t_map
[i
].stringlen
);
881 return nfserr_serverfault
;