1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * acl.c 4 * 5 * Copyright (C) 2004, 2008 Oracle. All rights reserved. 6 * 7 * CREDITS: 8 * Lots of code in this file is copy from linux/fs/ext3/acl.c. 9 * Copyright (C) 2001-2003 Andreas Gruenbacher, <agruen@suse.de> 10 */ 11 12 #include <linux/init.h> 13 #include <linux/module.h> 14 #include <linux/slab.h> 15 #include <linux/string.h> 16 #include <linux/fs_struct.h> 17 18 #include <cluster/masklog.h> 19 20 #include "ocfs2.h" 21 #include "alloc.h" 22 #include "dlmglue.h" 23 #include "file.h" 24 #include "inode.h" 25 #include "journal.h" 26 #include "ocfs2_fs.h" 27 28 #include "xattr.h" 29 #include "acl.h" 30 31 /* 32 * Convert from xattr value to acl struct. 33 */ 34 static struct posix_acl *ocfs2_acl_from_xattr(const void *value, size_t size) 35 { 36 int n, count; 37 struct posix_acl *acl; 38 39 if (!value) 40 return NULL; 41 if (size < sizeof(struct posix_acl_entry)) 42 return ERR_PTR(-EINVAL); 43 44 count = size / sizeof(struct posix_acl_entry); 45 46 acl = posix_acl_alloc(count, GFP_NOFS); 47 if (!acl) 48 return ERR_PTR(-ENOMEM); 49 for (n = 0; n < count; n++) { 50 struct ocfs2_acl_entry *entry = 51 (struct ocfs2_acl_entry *)value; 52 53 acl->a_entries[n].e_tag = le16_to_cpu(entry->e_tag); 54 acl->a_entries[n].e_perm = le16_to_cpu(entry->e_perm); 55 switch(acl->a_entries[n].e_tag) { 56 case ACL_USER: 57 acl->a_entries[n].e_uid = 58 make_kuid(&init_user_ns, 59 le32_to_cpu(entry->e_id)); 60 break; 61 case ACL_GROUP: 62 acl->a_entries[n].e_gid = 63 make_kgid(&init_user_ns, 64 le32_to_cpu(entry->e_id)); 65 break; 66 default: 67 break; 68 } 69 value += sizeof(struct posix_acl_entry); 70 71 } 72 return acl; 73 } 74 75 /* 76 * Convert acl struct to xattr value. 77 */ 78 static void *ocfs2_acl_to_xattr(const struct posix_acl *acl, size_t *size) 79 { 80 struct ocfs2_acl_entry *entry = NULL; 81 char *ocfs2_acl; 82 size_t n; 83 84 *size = acl->a_count * sizeof(struct posix_acl_entry); 85 86 ocfs2_acl = kmalloc(*size, GFP_NOFS); 87 if (!ocfs2_acl) 88 return ERR_PTR(-ENOMEM); 89 90 entry = (struct ocfs2_acl_entry *)ocfs2_acl; 91 for (n = 0; n < acl->a_count; n++, entry++) { 92 entry->e_tag = cpu_to_le16(acl->a_entries[n].e_tag); 93 entry->e_perm = cpu_to_le16(acl->a_entries[n].e_perm); 94 switch(acl->a_entries[n].e_tag) { 95 case ACL_USER: 96 entry->e_id = cpu_to_le32( 97 from_kuid(&init_user_ns, 98 acl->a_entries[n].e_uid)); 99 break; 100 case ACL_GROUP: 101 entry->e_id = cpu_to_le32( 102 from_kgid(&init_user_ns, 103 acl->a_entries[n].e_gid)); 104 break; 105 default: 106 entry->e_id = cpu_to_le32(ACL_UNDEFINED_ID); 107 break; 108 } 109 } 110 return ocfs2_acl; 111 } 112 113 static struct posix_acl *ocfs2_get_acl_nolock(struct inode *inode, int type, 114 struct buffer_head *di_bh) 115 { 116 int name_index; 117 char *value = NULL; 118 struct posix_acl *acl; 119 int retval; 120 121 switch (type) { 122 case ACL_TYPE_ACCESS: 123 name_index = OCFS2_XATTR_INDEX_POSIX_ACL_ACCESS; 124 break; 125 case ACL_TYPE_DEFAULT: 126 name_index = OCFS2_XATTR_INDEX_POSIX_ACL_DEFAULT; 127 break; 128 default: 129 return ERR_PTR(-EINVAL); 130 } 131 132 retval = ocfs2_xattr_get_nolock(inode, di_bh, name_index, "", NULL, 0); 133 if (retval > 0) { 134 value = kmalloc(retval, GFP_NOFS); 135 if (!value) 136 return ERR_PTR(-ENOMEM); 137 retval = ocfs2_xattr_get_nolock(inode, di_bh, name_index, 138 "", value, retval); 139 } 140 141 if (retval > 0) 142 acl = ocfs2_acl_from_xattr(value, retval); 143 else if (retval == -ENODATA || retval == 0) 144 acl = NULL; 145 else 146 acl = ERR_PTR(retval); 147 148 kfree(value); 149 150 return acl; 151 } 152 153 /* 154 * Helper function to set i_mode in memory and disk. Some call paths 155 * will not have di_bh or a journal handle to pass, in which case it 156 * will create it's own. 157 */ 158 static int ocfs2_acl_set_mode(struct inode *inode, struct buffer_head *di_bh, 159 handle_t *handle, umode_t new_mode) 160 { 161 int ret, commit_handle = 0; 162 struct ocfs2_dinode *di; 163 164 if (di_bh == NULL) { 165 ret = ocfs2_read_inode_block(inode, &di_bh); 166 if (ret) { 167 mlog_errno(ret); 168 goto out; 169 } 170 } else 171 get_bh(di_bh); 172 173 if (handle == NULL) { 174 handle = ocfs2_start_trans(OCFS2_SB(inode->i_sb), 175 OCFS2_INODE_UPDATE_CREDITS); 176 if (IS_ERR(handle)) { 177 ret = PTR_ERR(handle); 178 mlog_errno(ret); 179 goto out_brelse; 180 } 181 182 commit_handle = 1; 183 } 184 185 di = (struct ocfs2_dinode *)di_bh->b_data; 186 ret = ocfs2_journal_access_di(handle, INODE_CACHE(inode), di_bh, 187 OCFS2_JOURNAL_ACCESS_WRITE); 188 if (ret) { 189 mlog_errno(ret); 190 goto out_commit; 191 } 192 193 inode->i_mode = new_mode; 194 inode_set_ctime_current(inode); 195 di->i_mode = cpu_to_le16(inode->i_mode); 196 di->i_ctime = cpu_to_le64(inode_get_ctime_sec(inode)); 197 di->i_ctime_nsec = cpu_to_le32(inode_get_ctime_nsec(inode)); 198 ocfs2_update_inode_fsync_trans(handle, inode, 0); 199 200 ocfs2_journal_dirty(handle, di_bh); 201 202 out_commit: 203 if (commit_handle) 204 ocfs2_commit_trans(OCFS2_SB(inode->i_sb), handle); 205 out_brelse: 206 brelse(di_bh); 207 out: 208 return ret; 209 } 210 211 /* 212 * Set the access or default ACL of an inode. 213 */ 214 static int ocfs2_set_acl(handle_t *handle, 215 struct inode *inode, 216 struct buffer_head *di_bh, 217 int type, 218 struct posix_acl *acl, 219 struct ocfs2_alloc_context *meta_ac, 220 struct ocfs2_alloc_context *data_ac) 221 { 222 int name_index; 223 void *value = NULL; 224 size_t size = 0; 225 int ret; 226 227 if (S_ISLNK(inode->i_mode)) 228 return -EOPNOTSUPP; 229 230 switch (type) { 231 case ACL_TYPE_ACCESS: 232 name_index = OCFS2_XATTR_INDEX_POSIX_ACL_ACCESS; 233 break; 234 case ACL_TYPE_DEFAULT: 235 name_index = OCFS2_XATTR_INDEX_POSIX_ACL_DEFAULT; 236 if (!S_ISDIR(inode->i_mode)) 237 return acl ? -EACCES : 0; 238 break; 239 default: 240 return -EINVAL; 241 } 242 243 if (acl) { 244 value = ocfs2_acl_to_xattr(acl, &size); 245 if (IS_ERR(value)) 246 return (int)PTR_ERR(value); 247 } 248 249 if (handle) 250 ret = ocfs2_xattr_set_handle(handle, inode, di_bh, name_index, 251 "", value, size, 0, 252 meta_ac, data_ac); 253 else 254 ret = ocfs2_xattr_set(inode, name_index, "", value, size, 0); 255 256 kfree(value); 257 if (!ret) 258 set_cached_acl(inode, type, acl); 259 260 return ret; 261 } 262 263 int ocfs2_iop_set_acl(struct mnt_idmap *idmap, struct dentry *dentry, 264 struct posix_acl *acl, int type) 265 { 266 struct buffer_head *bh = NULL; 267 int status, had_lock; 268 struct ocfs2_lock_holder oh; 269 struct inode *inode = d_inode(dentry); 270 271 had_lock = ocfs2_inode_lock_tracker(inode, &bh, 1, &oh); 272 if (had_lock < 0) 273 return had_lock; 274 if (type == ACL_TYPE_ACCESS && acl) { 275 umode_t mode; 276 277 status = posix_acl_update_mode(&nop_mnt_idmap, inode, &mode, 278 &acl); 279 if (status) 280 goto unlock; 281 282 status = ocfs2_acl_set_mode(inode, bh, NULL, mode); 283 if (status) 284 goto unlock; 285 } 286 status = ocfs2_set_acl(NULL, inode, bh, type, acl, NULL, NULL); 287 unlock: 288 ocfs2_inode_unlock_tracker(inode, 1, &oh, had_lock); 289 brelse(bh); 290 return status; 291 } 292 293 struct posix_acl *ocfs2_iop_get_acl(struct inode *inode, int type, bool rcu) 294 { 295 struct ocfs2_super *osb; 296 struct buffer_head *di_bh = NULL; 297 struct posix_acl *acl; 298 int had_lock; 299 struct ocfs2_lock_holder oh; 300 301 if (rcu) 302 return ERR_PTR(-ECHILD); 303 304 osb = OCFS2_SB(inode->i_sb); 305 if (!(osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL)) 306 return NULL; 307 308 had_lock = ocfs2_inode_lock_tracker(inode, &di_bh, 0, &oh); 309 if (had_lock < 0) 310 return ERR_PTR(had_lock); 311 312 down_read(&OCFS2_I(inode)->ip_xattr_sem); 313 acl = ocfs2_get_acl_nolock(inode, type, di_bh); 314 up_read(&OCFS2_I(inode)->ip_xattr_sem); 315 316 ocfs2_inode_unlock_tracker(inode, 0, &oh, had_lock); 317 brelse(di_bh); 318 return acl; 319 } 320 321 int ocfs2_acl_chmod(struct inode *inode, struct buffer_head *bh) 322 { 323 struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); 324 struct posix_acl *acl; 325 int ret; 326 327 if (S_ISLNK(inode->i_mode)) 328 return -EOPNOTSUPP; 329 330 if (!(osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL)) 331 return 0; 332 333 down_read(&OCFS2_I(inode)->ip_xattr_sem); 334 acl = ocfs2_get_acl_nolock(inode, ACL_TYPE_ACCESS, bh); 335 up_read(&OCFS2_I(inode)->ip_xattr_sem); 336 if (IS_ERR_OR_NULL(acl)) 337 return PTR_ERR_OR_ZERO(acl); 338 ret = __posix_acl_chmod(&acl, GFP_KERNEL, inode->i_mode); 339 if (ret) 340 return ret; 341 ret = ocfs2_set_acl(NULL, inode, NULL, ACL_TYPE_ACCESS, 342 acl, NULL, NULL); 343 posix_acl_release(acl); 344 return ret; 345 } 346 347 /* 348 * Initialize the ACLs of a new inode. If parent directory has default ACL, 349 * then clone to new inode. Called from ocfs2_mknod. 350 */ 351 void ocfs2_acl_init_release(struct ocfs2_acl_state *state) 352 { 353 posix_acl_release(state->default_acl); 354 posix_acl_release(state->acl); 355 state->default_acl = NULL; 356 state->acl = NULL; 357 } 358 359 int ocfs2_acl_init_prepare(struct inode *inode, struct inode *dir, 360 struct buffer_head *dir_bh, 361 struct ocfs2_acl_state *state) 362 { 363 struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); 364 int ret = 0; 365 366 state->default_acl = NULL; 367 state->acl = NULL; 368 state->mode = inode->i_mode; 369 370 if (S_ISLNK(inode->i_mode)) 371 return 0; 372 373 if (osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL) { 374 down_read(&OCFS2_I(dir)->ip_xattr_sem); 375 state->default_acl = 376 ocfs2_get_acl_nolock(dir, ACL_TYPE_DEFAULT, dir_bh); 377 up_read(&OCFS2_I(dir)->ip_xattr_sem); 378 if (IS_ERR(state->default_acl)) { 379 ret = PTR_ERR(state->default_acl); 380 state->default_acl = NULL; 381 return ret; 382 } 383 if (state->default_acl) { 384 state->acl = posix_acl_dup(state->default_acl); 385 if (!state->acl) { 386 ret = -ENOMEM; 387 goto cleanup; 388 } 389 ret = __posix_acl_create(&state->acl, GFP_NOFS, 390 &state->mode); 391 if (ret < 0) 392 goto cleanup; 393 if (ret == 0) { 394 posix_acl_release(state->acl); 395 state->acl = NULL; 396 } 397 if (!S_ISDIR(inode->i_mode)) { 398 posix_acl_release(state->default_acl); 399 state->default_acl = NULL; 400 } 401 } else { 402 state->mode &= ~current_umask(); 403 } 404 } else { 405 state->mode &= ~current_umask(); 406 } 407 408 return 0; 409 cleanup: 410 ocfs2_acl_init_release(state); 411 return ret; 412 } 413 414 int ocfs2_init_acl(handle_t *handle, struct inode *inode, 415 struct buffer_head *di_bh, 416 struct ocfs2_alloc_context *meta_ac, 417 struct ocfs2_alloc_context *data_ac, 418 struct ocfs2_acl_state *state) 419 { 420 struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); 421 int ret = 0; 422 423 if (S_ISLNK(inode->i_mode)) 424 return 0; 425 426 if (osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL) { 427 if (S_ISDIR(inode->i_mode) && state->default_acl) { 428 ret = ocfs2_set_acl(handle, inode, di_bh, 429 ACL_TYPE_DEFAULT, 430 state->default_acl, meta_ac, 431 data_ac); 432 if (ret) 433 return ret; 434 } 435 } 436 437 ret = ocfs2_acl_set_mode(inode, di_bh, handle, state->mode); 438 if (ret) { 439 mlog_errno(ret); 440 return ret; 441 } 442 443 if (osb->s_mount_opt & OCFS2_MOUNT_POSIX_ACL) { 444 if (state->acl) { 445 ret = ocfs2_set_acl(handle, inode, di_bh, 446 ACL_TYPE_ACCESS, state->acl, 447 meta_ac, data_ac); 448 } 449 } 450 451 return ret; 452 } 453