| Message ID | 1441448856-13478-25-git-send-email-agruenba@redhat.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Sat, Sep 05, 2015 at 12:27:19PM +0200, Andreas Gruenbacher wrote: > Change the acl so that everyone@ is granted the permissions set in the > other mask. > > Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com> > --- > fs/richacl_compat.c | 35 +++++++++++++++++++++++++++++++++++ > 1 file changed, 35 insertions(+) > > diff --git a/fs/richacl_compat.c b/fs/richacl_compat.c > index 14a1b4b..30bdc95 100644 > --- a/fs/richacl_compat.c > +++ b/fs/richacl_compat.c > @@ -459,3 +459,38 @@ richacl_set_owner_permissions(struct richacl_alloc *alloc) > } > return 0; > } > + > +/** > + * richacl_set_other_permissions - set the other permissions to the other mask > + * > + * Change the acl so that everyone@ is granted the permissions set in the other > + * mask. This leaves at most one efective everyone@ allow entry at the end of > + * the acl. > + */ > +static int > +richacl_set_other_permissions(struct richacl_alloc *alloc) > +{ > + struct richacl *acl = alloc->acl; > + unsigned int x = RICHACE_POSIX_ALWAYS_ALLOWED; > + unsigned int other_mask = acl->a_other_mask & ~x; > + struct richace *ace = acl->a_entries + acl->a_count - 1; > + > + if (!(other_mask && > + (acl->a_flags & RICHACL_WRITE_THROUGH) && > + (acl->a_flags & RICHACL_MASKED))) > + return 0; By the way, I think this is only called after checking MASKED--so the MASKED check here could be a WARN_ON, or could just be dropped. Ditto for the following patch. --b. > + > + if (acl->a_count == 0 || > + !richace_is_everyone(ace) || > + richace_is_inherit_only(ace)) { > + ace++; > + if (richacl_insert_entry(alloc, &ace)) > + return -1; > + ace->e_type = RICHACE_ACCESS_ALLOWED_ACE_TYPE; > + ace->e_flags = RICHACE_SPECIAL_WHO; > + ace->e_mask = other_mask; > + ace->e_id.special = RICHACE_EVERYONE_SPECIAL_ID; > + } else > + richace_change_mask(alloc, &ace, other_mask); > + return 0; > +} > -- > 2.4.3 > > -- > To unsubscribe from this list: send the line "unsubscribe linux-nfs" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html -- To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
2015-09-23 16:03 GMT+02:00 J. Bruce Fields <bfields@fieldses.org>: > On Sat, Sep 05, 2015 at 12:27:19PM +0200, Andreas Gruenbacher wrote: >> +static int >> +richacl_set_other_permissions(struct richacl_alloc *alloc) >> +{ >> + struct richacl *acl = alloc->acl; >> + unsigned int x = RICHACE_POSIX_ALWAYS_ALLOWED; >> + unsigned int other_mask = acl->a_other_mask & ~x; >> + struct richace *ace = acl->a_entries + acl->a_count - 1; >> + >> + if (!(other_mask && >> + (acl->a_flags & RICHACL_WRITE_THROUGH) && >> + (acl->a_flags & RICHACL_MASKED))) >> + return 0; > > By the way, I think this is only called after checking MASKED--so the > MASKED check here could be a WARN_ON, or could just be dropped. Ditto > for the following patch. Hmm, yes. I'll drop that. Thanks, Andreas -- To unsubscribe from this list: send the line "unsubscribe linux-nfs" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/fs/richacl_compat.c b/fs/richacl_compat.c index 14a1b4b..30bdc95 100644 --- a/fs/richacl_compat.c +++ b/fs/richacl_compat.c @@ -459,3 +459,38 @@ richacl_set_owner_permissions(struct richacl_alloc *alloc) } return 0; } + +/** + * richacl_set_other_permissions - set the other permissions to the other mask + * + * Change the acl so that everyone@ is granted the permissions set in the other + * mask. This leaves at most one efective everyone@ allow entry at the end of + * the acl. + */ +static int +richacl_set_other_permissions(struct richacl_alloc *alloc) +{ + struct richacl *acl = alloc->acl; + unsigned int x = RICHACE_POSIX_ALWAYS_ALLOWED; + unsigned int other_mask = acl->a_other_mask & ~x; + struct richace *ace = acl->a_entries + acl->a_count - 1; + + if (!(other_mask && + (acl->a_flags & RICHACL_WRITE_THROUGH) && + (acl->a_flags & RICHACL_MASKED))) + return 0; + + if (acl->a_count == 0 || + !richace_is_everyone(ace) || + richace_is_inherit_only(ace)) { + ace++; + if (richacl_insert_entry(alloc, &ace)) + return -1; + ace->e_type = RICHACE_ACCESS_ALLOWED_ACE_TYPE; + ace->e_flags = RICHACE_SPECIAL_WHO; + ace->e_mask = other_mask; + ace->e_id.special = RICHACE_EVERYONE_SPECIAL_ID; + } else + richace_change_mask(alloc, &ace, other_mask); + return 0; +}
Change the acl so that everyone@ is granted the permissions set in the other mask. Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com> --- fs/richacl_compat.c | 35 +++++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+)