1 /* 2 * linux/fs/ext2/acl.c 3 * 4 * Copyright (C) 2001-2003 Andreas Gruenbacher, <agruen@suse.de> 5 */ 6 7 #include <linux/capability.h> 8 #include <linux/init.h> 9 #include <linux/sched.h> 10 #include <linux/slab.h> 11 #include <linux/fs.h> 12 #include "ext2.h" 13 #include "xattr.h" 14 #include "acl.h" 15 16 /* 17 * Convert from filesystem to in-memory representation. 18 */ 19 static struct posix_acl * 20 ext2_acl_from_disk(const void *value, size_t size) 21 { 22 const char *end = (char *)value + size; 23 int n, count; 24 struct posix_acl *acl; 25 26 if (!value) 27 return NULL; 28 if (size < sizeof(ext2_acl_header)) 29 return ERR_PTR(-EINVAL); 30 if (((ext2_acl_header *)value)->a_version != 31 cpu_to_le32(EXT2_ACL_VERSION)) 32 return ERR_PTR(-EINVAL); 33 value = (char *)value + sizeof(ext2_acl_header); 34 count = ext2_acl_count(size); 35 if (count < 0) 36 return ERR_PTR(-EINVAL); 37 if (count == 0) 38 return NULL; 39 acl = posix_acl_alloc(count, GFP_KERNEL); 40 if (!acl) 41 return ERR_PTR(-ENOMEM); 42 for (n=0; n < count; n++) { 43 ext2_acl_entry *entry = 44 (ext2_acl_entry *)value; 45 if ((char *)value + sizeof(ext2_acl_entry_short) > end) 46 goto fail; 47 acl->a_entries[n].e_tag = le16_to_cpu(entry->e_tag); 48 acl->a_entries[n].e_perm = le16_to_cpu(entry->e_perm); 49 switch(acl->a_entries[n].e_tag) { 50 case ACL_USER_OBJ: 51 case ACL_GROUP_OBJ: 52 case ACL_MASK: 53 case ACL_OTHER: 54 value = (char *)value + 55 sizeof(ext2_acl_entry_short); 56 acl->a_entries[n].e_id = ACL_UNDEFINED_ID; 57 break; 58 59 case ACL_USER: 60 case ACL_GROUP: 61 value = (char *)value + sizeof(ext2_acl_entry); 62 if ((char *)value > end) 63 goto fail; 64 acl->a_entries[n].e_id = 65 le32_to_cpu(entry->e_id); 66 break; 67 68 default: 69 goto fail; 70 } 71 } 72 if (value != end) 73 goto fail; 74 return acl; 75 76 fail: 77 posix_acl_release(acl); 78 return ERR_PTR(-EINVAL); 79 } 80 81 /* 82 * Convert from in-memory to filesystem representation. 83 */ 84 static void * 85 ext2_acl_to_disk(const struct posix_acl *acl, size_t *size) 86 { 87 ext2_acl_header *ext_acl; 88 char *e; 89 size_t n; 90 91 *size = ext2_acl_size(acl->a_count); 92 ext_acl = kmalloc(sizeof(ext2_acl_header) + acl->a_count * 93 sizeof(ext2_acl_entry), GFP_KERNEL); 94 if (!ext_acl) 95 return ERR_PTR(-ENOMEM); 96 ext_acl->a_version = cpu_to_le32(EXT2_ACL_VERSION); 97 e = (char *)ext_acl + sizeof(ext2_acl_header); 98 for (n=0; n < acl->a_count; n++) { 99 ext2_acl_entry *entry = (ext2_acl_entry *)e; 100 entry->e_tag = cpu_to_le16(acl->a_entries[n].e_tag); 101 entry->e_perm = cpu_to_le16(acl->a_entries[n].e_perm); 102 switch(acl->a_entries[n].e_tag) { 103 case ACL_USER: 104 case ACL_GROUP: 105 entry->e_id = 106 cpu_to_le32(acl->a_entries[n].e_id); 107 e += sizeof(ext2_acl_entry); 108 break; 109 110 case ACL_USER_OBJ: 111 case ACL_GROUP_OBJ: 112 case ACL_MASK: 113 case ACL_OTHER: 114 e += sizeof(ext2_acl_entry_short); 115 break; 116 117 default: 118 goto fail; 119 } 120 } 121 return (char *)ext_acl; 122 123 fail: 124 kfree(ext_acl); 125 return ERR_PTR(-EINVAL); 126 } 127 128 /* 129 * inode->i_mutex: don't care 130 */ 131 static struct posix_acl * 132 ext2_get_acl(struct inode *inode, int type) 133 { 134 int name_index; 135 char *value = NULL; 136 struct posix_acl *acl; 137 int retval; 138 139 if (!test_opt(inode->i_sb, POSIX_ACL)) 140 return NULL; 141 142 acl = get_cached_acl(inode, type); 143 if (acl != ACL_NOT_CACHED) 144 return acl; 145 146 switch (type) { 147 case ACL_TYPE_ACCESS: 148 name_index = EXT2_XATTR_INDEX_POSIX_ACL_ACCESS; 149 break; 150 case ACL_TYPE_DEFAULT: 151 name_index = EXT2_XATTR_INDEX_POSIX_ACL_DEFAULT; 152 break; 153 default: 154 BUG(); 155 } 156 retval = ext2_xattr_get(inode, name_index, "", NULL, 0); 157 if (retval > 0) { 158 value = kmalloc(retval, GFP_KERNEL); 159 if (!value) 160 return ERR_PTR(-ENOMEM); 161 retval = ext2_xattr_get(inode, name_index, "", value, retval); 162 } 163 if (retval > 0) 164 acl = ext2_acl_from_disk(value, retval); 165 else if (retval == -ENODATA || retval == -ENOSYS) 166 acl = NULL; 167 else 168 acl = ERR_PTR(retval); 169 kfree(value); 170 171 if (!IS_ERR(acl)) 172 set_cached_acl(inode, type, acl); 173 174 return acl; 175 } 176 177 /* 178 * inode->i_mutex: down 179 */ 180 static int 181 ext2_set_acl(struct inode *inode, int type, struct posix_acl *acl) 182 { 183 int name_index; 184 void *value = NULL; 185 size_t size = 0; 186 int error; 187 188 if (S_ISLNK(inode->i_mode)) 189 return -EOPNOTSUPP; 190 if (!test_opt(inode->i_sb, POSIX_ACL)) 191 return 0; 192 193 switch(type) { 194 case ACL_TYPE_ACCESS: 195 name_index = EXT2_XATTR_INDEX_POSIX_ACL_ACCESS; 196 if (acl) { 197 mode_t mode = inode->i_mode; 198 error = posix_acl_equiv_mode(acl, &mode); 199 if (error < 0) 200 return error; 201 else { 202 inode->i_mode = mode; 203 inode->i_ctime = CURRENT_TIME_SEC; 204 mark_inode_dirty(inode); 205 if (error == 0) 206 acl = NULL; 207 } 208 } 209 break; 210 211 case ACL_TYPE_DEFAULT: 212 name_index = EXT2_XATTR_INDEX_POSIX_ACL_DEFAULT; 213 if (!S_ISDIR(inode->i_mode)) 214 return acl ? -EACCES : 0; 215 break; 216 217 default: 218 return -EINVAL; 219 } 220 if (acl) { 221 value = ext2_acl_to_disk(acl, &size); 222 if (IS_ERR(value)) 223 return (int)PTR_ERR(value); 224 } 225 226 error = ext2_xattr_set(inode, name_index, "", value, size, 0); 227 228 kfree(value); 229 if (!error) 230 set_cached_acl(inode, type, acl); 231 return error; 232 } 233 234 int 235 ext2_check_acl(struct inode *inode, int mask) 236 { 237 struct posix_acl *acl = ext2_get_acl(inode, ACL_TYPE_ACCESS); 238 239 if (IS_ERR(acl)) 240 return PTR_ERR(acl); 241 if (acl) { 242 int error = posix_acl_permission(inode, acl, mask); 243 posix_acl_release(acl); 244 return error; 245 } 246 247 return -EAGAIN; 248 } 249 250 /* 251 * Initialize the ACLs of a new inode. Called from ext2_new_inode. 252 * 253 * dir->i_mutex: down 254 * inode->i_mutex: up (access to inode is still exclusive) 255 */ 256 int 257 ext2_init_acl(struct inode *inode, struct inode *dir) 258 { 259 struct posix_acl *acl = NULL; 260 int error = 0; 261 262 if (!S_ISLNK(inode->i_mode)) { 263 if (test_opt(dir->i_sb, POSIX_ACL)) { 264 acl = ext2_get_acl(dir, ACL_TYPE_DEFAULT); 265 if (IS_ERR(acl)) 266 return PTR_ERR(acl); 267 } 268 if (!acl) 269 inode->i_mode &= ~current_umask(); 270 } 271 if (test_opt(inode->i_sb, POSIX_ACL) && acl) { 272 struct posix_acl *clone; 273 mode_t mode; 274 275 if (S_ISDIR(inode->i_mode)) { 276 error = ext2_set_acl(inode, ACL_TYPE_DEFAULT, acl); 277 if (error) 278 goto cleanup; 279 } 280 clone = posix_acl_clone(acl, GFP_KERNEL); 281 error = -ENOMEM; 282 if (!clone) 283 goto cleanup; 284 mode = inode->i_mode; 285 error = posix_acl_create_masq(clone, &mode); 286 if (error >= 0) { 287 inode->i_mode = mode; 288 if (error > 0) { 289 /* This is an extended ACL */ 290 error = ext2_set_acl(inode, 291 ACL_TYPE_ACCESS, clone); 292 } 293 } 294 posix_acl_release(clone); 295 } 296 cleanup: 297 posix_acl_release(acl); 298 return error; 299 } 300 301 /* 302 * Does chmod for an inode that may have an Access Control List. The 303 * inode->i_mode field must be updated to the desired value by the caller 304 * before calling this function. 305 * Returns 0 on success, or a negative error number. 306 * 307 * We change the ACL rather than storing some ACL entries in the file 308 * mode permission bits (which would be more efficient), because that 309 * would break once additional permissions (like ACL_APPEND, ACL_DELETE 310 * for directories) are added. There are no more bits available in the 311 * file mode. 312 * 313 * inode->i_mutex: down 314 */ 315 int 316 ext2_acl_chmod(struct inode *inode) 317 { 318 struct posix_acl *acl, *clone; 319 int error; 320 321 if (!test_opt(inode->i_sb, POSIX_ACL)) 322 return 0; 323 if (S_ISLNK(inode->i_mode)) 324 return -EOPNOTSUPP; 325 acl = ext2_get_acl(inode, ACL_TYPE_ACCESS); 326 if (IS_ERR(acl) || !acl) 327 return PTR_ERR(acl); 328 clone = posix_acl_clone(acl, GFP_KERNEL); 329 posix_acl_release(acl); 330 if (!clone) 331 return -ENOMEM; 332 error = posix_acl_chmod_masq(clone, inode->i_mode); 333 if (!error) 334 error = ext2_set_acl(inode, ACL_TYPE_ACCESS, clone); 335 posix_acl_release(clone); 336 return error; 337 } 338 339 /* 340 * Extended attribut handlers 341 */ 342 static size_t 343 ext2_xattr_list_acl_access(struct dentry *dentry, char *list, size_t list_size, 344 const char *name, size_t name_len, int type) 345 { 346 const size_t size = sizeof(POSIX_ACL_XATTR_ACCESS); 347 348 if (!test_opt(dentry->d_sb, POSIX_ACL)) 349 return 0; 350 if (list && size <= list_size) 351 memcpy(list, POSIX_ACL_XATTR_ACCESS, size); 352 return size; 353 } 354 355 static size_t 356 ext2_xattr_list_acl_default(struct dentry *dentry, char *list, size_t list_size, 357 const char *name, size_t name_len, int type) 358 { 359 const size_t size = sizeof(POSIX_ACL_XATTR_DEFAULT); 360 361 if (!test_opt(dentry->d_sb, POSIX_ACL)) 362 return 0; 363 if (list && size <= list_size) 364 memcpy(list, POSIX_ACL_XATTR_DEFAULT, size); 365 return size; 366 } 367 368 static int 369 ext2_xattr_get_acl(struct dentry *dentry, const char *name, void *buffer, 370 size_t size, int type) 371 { 372 struct posix_acl *acl; 373 int error; 374 375 if (strcmp(name, "") != 0) 376 return -EINVAL; 377 if (!test_opt(dentry->d_sb, POSIX_ACL)) 378 return -EOPNOTSUPP; 379 380 acl = ext2_get_acl(dentry->d_inode, type); 381 if (IS_ERR(acl)) 382 return PTR_ERR(acl); 383 if (acl == NULL) 384 return -ENODATA; 385 error = posix_acl_to_xattr(acl, buffer, size); 386 posix_acl_release(acl); 387 388 return error; 389 } 390 391 static int 392 ext2_xattr_set_acl(struct dentry *dentry, const char *name, const void *value, 393 size_t size, int flags, int type) 394 { 395 struct posix_acl *acl; 396 int error; 397 398 if (strcmp(name, "") != 0) 399 return -EINVAL; 400 if (!test_opt(dentry->d_sb, POSIX_ACL)) 401 return -EOPNOTSUPP; 402 if (!is_owner_or_cap(dentry->d_inode)) 403 return -EPERM; 404 405 if (value) { 406 acl = posix_acl_from_xattr(value, size); 407 if (IS_ERR(acl)) 408 return PTR_ERR(acl); 409 else if (acl) { 410 error = posix_acl_valid(acl); 411 if (error) 412 goto release_and_out; 413 } 414 } else 415 acl = NULL; 416 417 error = ext2_set_acl(dentry->d_inode, type, acl); 418 419 release_and_out: 420 posix_acl_release(acl); 421 return error; 422 } 423 424 const struct xattr_handler ext2_xattr_acl_access_handler = { 425 .prefix = POSIX_ACL_XATTR_ACCESS, 426 .flags = ACL_TYPE_ACCESS, 427 .list = ext2_xattr_list_acl_access, 428 .get = ext2_xattr_get_acl, 429 .set = ext2_xattr_set_acl, 430 }; 431 432 const struct xattr_handler ext2_xattr_acl_default_handler = { 433 .prefix = POSIX_ACL_XATTR_DEFAULT, 434 .flags = ACL_TYPE_DEFAULT, 435 .list = ext2_xattr_list_acl_default, 436 .get = ext2_xattr_get_acl, 437 .set = ext2_xattr_set_acl, 438 }; 439