fs/afs/security.c

   1 /* AFS security handling
   2  *
   3  * Copyright (C) 2007 Red Hat, Inc. All Rights Reserved.
   4  * Written by David Howells (dhowells@redhat.com)
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public License
   8  * as published by the Free Software Foundation; either version
   9  * 2 of the License, or (at your option) any later version.
  10  */
  11
  12 #include <linux/init.h>
  13 #include <linux/slab.h>
  14 #include <linux/fs.h>
  15 #include <linux/ctype.h>
  16 #include <keys/rxrpc-type.h>
  17 #include "internal.h"
  18
  19 /*
  20  * get a key
  21  */
  22 struct key *afs_request_key(struct afs_cell *cell)
  23 {
  24         struct key *key;
  25
  26         _enter("{%x}", key_serial(cell->anonymous_key));
  27
  28         _debug("key %s", cell->anonymous_key->description);
  29         key = request_key(&key_type_rxrpc, cell->anonymous_key->description,
  30                           NULL);
  31         if (IS_ERR(key)) {
  32                 if (PTR_ERR(key) != -ENOKEY) {
  33                         _leave(" = %ld", PTR_ERR(key));
  34                         return key;
  35                 }
  36
  37                 /* act as anonymous user */
  38                 _leave(" = {%x} [anon]", key_serial(cell->anonymous_key));
  39                 return key_get(cell->anonymous_key);
  40         } else {
  41                 /* act as authorised user */
  42                 _leave(" = {%x} [auth]", key_serial(key));
  43                 return key;
  44         }
  45 }
  46
  47 /*
  48  * dispose of a permits list
  49  */
  50 void afs_zap_permits(struct rcu_head *rcu)
  51 {
  52         struct afs_permits *permits =
  53                 container_of(rcu, struct afs_permits, rcu);
  54         int loop;
  55
  56         _enter("{%d}", permits->count);
  57
  58         for (loop = permits->count - 1; loop >= 0; loop--)
  59                 key_put(permits->permits[loop].key);
  60         kfree(permits);
  61 }
  62
  63 /*
  64  * dispose of a permits list in which all the key pointers have been copied
  65  */
  66 static void afs_dispose_of_permits(struct rcu_head *rcu)
  67 {
  68         struct afs_permits *permits =
  69                 container_of(rcu, struct afs_permits, rcu);
  70
  71         _enter("{%d}", permits->count);
  72
  73         kfree(permits);
  74 }
  75
  76 /*
  77  * get the authorising vnode - this is the specified inode itself if it's a
  78  * directory or it's the parent directory if the specified inode is a file or
  79  * symlink
  80  * - the caller must release the ref on the inode
  81  */
  82 static struct afs_vnode *afs_get_auth_inode(struct afs_vnode *vnode,
  83                                             struct key *key)
  84 {
  85         struct afs_vnode *auth_vnode;
  86         struct inode *auth_inode;
  87
  88         _enter("");
  89
  90         if (S_ISDIR(vnode->vfs_inode.i_mode)) {
  91                 auth_inode = igrab(&vnode->vfs_inode);
  92                 ASSERT(auth_inode != NULL);
  93         } else {
  94                 auth_inode = afs_iget(vnode->vfs_inode.i_sb, key,
  95                                       &vnode->status.parent, NULL, NULL);
  96                 if (IS_ERR(auth_inode))
  97                         return ERR_PTR(PTR_ERR(auth_inode));
  98         }
  99
 100         auth_vnode = AFS_FS_I(auth_inode);
 101         _leave(" = {%x}", auth_vnode->fid.vnode);
 102         return auth_vnode;
 103 }
 104
 105 /*
 106  * clear the permit cache on a directory vnode
 107  */
 108 void afs_clear_permits(struct afs_vnode *vnode)
 109 {
 110         struct afs_permits *permits;
 111
 112         _enter("{%x:%u}", vnode->fid.vid, vnode->fid.vnode);
 113
 114         mutex_lock(&vnode->permits_lock);
 115         permits = vnode->permits;
 116         rcu_assign_pointer(vnode->permits, NULL);
 117         mutex_unlock(&vnode->permits_lock);
 118
 119         if (permits)
 120                 call_rcu(&permits->rcu, afs_zap_permits);
 121         _leave("");
 122 }
 123
 124 /*
 125  * add the result obtained for a vnode to its or its parent directory's cache
 126  * for the key used to access it
 127  */
 128 void afs_cache_permit(struct afs_vnode *vnode, struct key *key, long acl_order)
 129 {
 130         struct afs_permits *permits, *xpermits;
 131         struct afs_permit *permit;
 132         struct afs_vnode *auth_vnode;
 133         int count, loop;
 134
 135         _enter("{%x:%u},%x,%lx",
 136                vnode->fid.vid, vnode->fid.vnode, key_serial(key), acl_order);
 137
 138         auth_vnode = afs_get_auth_inode(vnode, key);
 139         if (IS_ERR(auth_vnode)) {
 140                 _leave(" [get error %ld]", PTR_ERR(auth_vnode));
 141                 return;
 142         }
 143
 144         mutex_lock(&auth_vnode->permits_lock);
 145
 146         /* guard against a rename being detected whilst we waited for the
 147          * lock */
 148         if (memcmp(&auth_vnode->fid, &vnode->status.parent,
 149                    sizeof(struct afs_fid)) != 0) {
 150                 _debug("renamed");
 151                 goto out_unlock;
 152         }
 153
 154         /* have to be careful as the directory's callback may be broken between
 155          * us receiving the status we're trying to cache and us getting the
 156          * lock to update the cache for the status */
 157         if (auth_vnode->acl_order - acl_order > 0) {
 158                 _debug("ACL changed?");
 159                 goto out_unlock;
 160         }
 161
 162         /* always update the anonymous mask */
 163         _debug("anon access %x", vnode->status.anon_access);
 164         auth_vnode->status.anon_access = vnode->status.anon_access;
 165         if (key == vnode->volume->cell->anonymous_key)
 166                 goto out_unlock;
 167
 168         xpermits = auth_vnode->permits;
 169         count = 0;
 170         if (xpermits) {
 171                 /* see if the permit is already in the list
 172                  * - if it is then we just amend the list
 173                  */
 174                 count = xpermits->count;
 175                 permit = xpermits->permits;
 176                 for (loop = count; loop > 0; loop--) {
 177                         if (permit->key == key) {
 178                                 permit->access_mask =
 179                                         vnode->status.caller_access;
 180                                 goto out_unlock;
 181                         }
 182                         permit++;
 183                 }
 184         }
 185
 186         permits = kmalloc(sizeof(*permits) + sizeof(*permit) * (count + 1),
 187                           GFP_NOFS);
 188         if (!permits)
 189                 goto out_unlock;
 190
 191         memcpy(permits->permits, xpermits->permits,
 192                count * sizeof(struct afs_permit));
 193
 194         _debug("key %x access %x",
 195                key_serial(key), vnode->status.caller_access);
 196         permits->permits[count].access_mask = vnode->status.caller_access;
 197         permits->permits[count].key = key_get(key);
 198         permits->count = count + 1;
 199
 200         rcu_assign_pointer(auth_vnode->permits, permits);
 201         if (xpermits)
 202                 call_rcu(&xpermits->rcu, afs_dispose_of_permits);
 203
 204 out_unlock:
 205         mutex_unlock(&auth_vnode->permits_lock);
 206         iput(&auth_vnode->vfs_inode);
 207         _leave("");
 208 }
 209
 210 /*
 211  * check with the fileserver to see if the directory or parent directory is
 212  * permitted to be accessed with this authorisation, and if so, what access it
 213  * is granted
 214  */
 215 static int afs_check_permit(struct afs_vnode *vnode, struct key *key,
 216                             afs_access_t *_access)
 217 {
 218         struct afs_permits *permits;
 219         struct afs_permit *permit;
 220         struct afs_vnode *auth_vnode;
 221         bool valid;
 222         int loop, ret;
 223
 224         _enter("{%x:%u},%x",
 225                vnode->fid.vid, vnode->fid.vnode, key_serial(key));
 226
 227         auth_vnode = afs_get_auth_inode(vnode, key);
 228         if (IS_ERR(auth_vnode)) {
 229                 *_access = 0;
 230                 _leave(" = %ld", PTR_ERR(auth_vnode));
 231                 return PTR_ERR(auth_vnode);
 232         }
 233
 234         ASSERT(S_ISDIR(auth_vnode->vfs_inode.i_mode));
 235
 236         /* check the permits to see if we've got one yet */
 237         if (key == auth_vnode->volume->cell->anonymous_key) {
 238                 _debug("anon");
 239                 *_access = auth_vnode->status.anon_access;
 240                 valid = true;
 241         } else {
 242                 valid = false;
 243                 rcu_read_lock();
 244                 permits = rcu_dereference(auth_vnode->permits);
 245                 if (permits) {
 246                         permit = permits->permits;
 247                         for (loop = permits->count; loop > 0; loop--) {
 248                                 if (permit->key == key) {
 249                                         _debug("found in cache");
 250                                         *_access = permit->access_mask;
 251                                         valid = true;
 252                                         break;
 253                                 }
 254                                 permit++;
 255                         }
 256                 }
 257                 rcu_read_unlock();
 258         }
 259
 260         if (!valid) {
 261                 /* check the status on the file we're actually interested in
 262                  * (the post-processing will cache the result on auth_vnode) */
 263                 _debug("no valid permit");
 264
 265                 set_bit(AFS_VNODE_CB_BROKEN, &vnode->flags);
 266                 ret = afs_vnode_fetch_status(vnode, auth_vnode, key);
 267                 if (ret < 0) {
 268                         iput(&auth_vnode->vfs_inode);
 269                         *_access = 0;
 270                         _leave(" = %d", ret);
 271                         return ret;
 272                 }
 273                 *_access = vnode->status.caller_access;
 274         }
 275
 276         iput(&auth_vnode->vfs_inode);
 277         _leave(" = 0 [access %x]", *_access);
 278         return 0;
 279 }
 280
 281 /*
 282  * check the permissions on an AFS file
 283  * - AFS ACLs are attached to directories only, and a file is controlled by its
 284  *   parent directory's ACL
 285  */
 286 int afs_permission(struct inode *inode, int mask, struct nameidata *nd)
 287 {
 288         struct afs_vnode *vnode = AFS_FS_I(inode);
 289         afs_access_t access;
 290         struct key *key;
 291         int ret;
 292
 293         _enter("{{%x:%u},%lx},%x,",
 294                vnode->fid.vid, vnode->fid.vnode, vnode->flags, mask);
 295
 296         key = afs_request_key(vnode->volume->cell);
 297         if (IS_ERR(key)) {
 298                 _leave(" = %ld [key]", PTR_ERR(key));
 299                 return PTR_ERR(key);
 300         }
 301
 302         /* if the promise has expired, we need to check the server again */
 303         if (!vnode->cb_promised) {
 304                 _debug("not promised");
 305                 ret = afs_vnode_fetch_status(vnode, NULL, key);
 306                 if (ret < 0)
 307                         goto error;
 308                 _debug("new promise [fl=%lx]", vnode->flags);
 309         }
 310
 311         /* check the permits to see if we've got one yet */
 312         ret = afs_check_permit(vnode, key, &access);
 313         if (ret < 0)
 314                 goto error;
 315
 316         /* interpret the access mask */
 317         _debug("REQ %x ACC %x on %s",
 318                mask, access, S_ISDIR(inode->i_mode) ? "dir" : "file");
 319
 320         if (S_ISDIR(inode->i_mode)) {
 321                 if (mask & MAY_EXEC) {
 322                         if (!(access & AFS_ACE_LOOKUP))
 323                                 goto permission_denied;
 324                 } else if (mask & MAY_READ) {
 325                         if (!(access & AFS_ACE_READ))
 326                                 goto permission_denied;
 327                 } else if (mask & MAY_WRITE) {
 328                         if (!(access & (AFS_ACE_DELETE | /* rmdir, unlink, rename from */
 329                                         AFS_ACE_INSERT | /* create, mkdir, symlink, rename to */
 330                                         AFS_ACE_WRITE))) /* chmod */
 331                                 goto permission_denied;
 332                 } else {
 333                         BUG();
 334                 }
 335         } else {
 336                 if (!(access & AFS_ACE_LOOKUP))
 337                         goto permission_denied;
 338                 if (mask & (MAY_EXEC | MAY_READ)) {
 339                         if (!(access & AFS_ACE_READ))
 340                                 goto permission_denied;
 341                 } else if (mask & MAY_WRITE) {
 342                         if (!(access & AFS_ACE_WRITE))
 343                                 goto permission_denied;
 344                 }
 345         }
 346
 347         key_put(key);
 348         ret = generic_permission(inode, mask, NULL);
 349         _leave(" = %d", ret);
 350         return ret;
 351
 352 permission_denied:
 353         ret = -EACCES;
 354 error:
 355         key_put(key);
 356         _leave(" = %d", ret);
 357         return ret;
 358 }