From patchwork Sun Sep 27 22:09:23 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andreas Gruenbacher X-Patchwork-Id: 7274211 Return-Path: X-Original-To: patchwork-linux-nfs@patchwork.kernel.org Delivered-To: patchwork-parsemail@patchwork2.web.kernel.org Received: from mail.kernel.org (mail.kernel.org [198.145.29.136]) by patchwork2.web.kernel.org (Postfix) with ESMTP id A1A64BEEA4 for ; Sun, 27 Sep 2015 22:21:35 +0000 (UTC) Received: from mail.kernel.org (localhost [127.0.0.1]) by mail.kernel.org (Postfix) with ESMTP id 8D29720562 for ; Sun, 27 Sep 2015 22:21:34 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 53BCF2056D for ; Sun, 27 Sep 2015 22:21:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1756588AbbI0WMv (ORCPT ); Sun, 27 Sep 2015 18:12:51 -0400 Received: from mx1.redhat.com ([209.132.183.28]:53536 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753290AbbI0WMt (ORCPT ); Sun, 27 Sep 2015 18:12:49 -0400 Received: from int-mx13.intmail.prod.int.phx2.redhat.com (int-mx13.intmail.prod.int.phx2.redhat.com [10.5.11.26]) by mx1.redhat.com (Postfix) with ESMTPS id 58B84AC1A1; Sun, 27 Sep 2015 22:12:49 +0000 (UTC) Received: from nuc.home.com (vpn1-4-81.ams2.redhat.com [10.36.4.81]) by int-mx13.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id t8RM9ce2030610; Sun, 27 Sep 2015 18:12:44 -0400 From: Andreas Gruenbacher To: Alexander Viro , "Theodore Ts'o" , Andreas Dilger , "J. Bruce Fields" , Jeff Layton , Trond Myklebust , Anna Schumaker , linux-ext4@vger.kernel.org, linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-nfs@vger.kernel.org, linux-api@vger.kernel.org Subject: [PATCH v8 32/41] nfsd: Add support for the MAY_CREATE_{FILE, DIR} permissions Date: Mon, 28 Sep 2015 00:09:23 +0200 Message-Id: <1443391772-10171-33-git-send-email-agruenba@redhat.com> In-Reply-To: <1443391772-10171-1-git-send-email-agruenba@redhat.com> References: <1443391772-10171-1-git-send-email-agruenba@redhat.com> X-Scanned-By: MIMEDefang 2.68 on 10.5.11.26 Sender: linux-nfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org X-Spam-Status: No, score=-6.9 required=5.0 tests=BAYES_00, RCVD_IN_DNSWL_HI, T_RP_MATCHES_RCVD, UNPARSEABLE_RELAY autolearn=unavailable version=3.3.1 X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on mail.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP For local file systems, the vfs performs the necessary permission checks for operations like creating files and directories. NFSd duplicates several of those checks. The vfs checks have been extended to check for additional permissions like MAY_CREATE_FILE and MY_CREATE_DIR; the nfsd checks currently lack those extensions. Ideally, all duplicate checks should be removed; for now, just fix the duplicate checks instead though. Signed-off-by: Andreas Gruenbacher Acked-by: J. Bruce Fields --- fs/nfsd/nfs4proc.c | 5 +++-- fs/nfsd/nfsfh.c | 8 ++++---- fs/nfsd/vfs.c | 28 ++++++++++++++++++++-------- fs/nfsd/vfs.h | 17 +++++++++-------- 4 files changed, 36 insertions(+), 22 deletions(-) diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c index a053e78..8d476ff 100644 --- a/fs/nfsd/nfs4proc.c +++ b/fs/nfsd/nfs4proc.c @@ -599,14 +599,15 @@ static __be32 nfsd4_create(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, struct nfsd4_create *create) { + int access = create->cr_type == NF4DIR ? + NFSD_MAY_CREATE_DIR : NFSD_MAY_CREATE_FILE; struct svc_fh resfh; __be32 status; dev_t rdev; fh_init(&resfh, NFS4_FHSIZE); - status = fh_verify(rqstp, &cstate->current_fh, S_IFDIR, - NFSD_MAY_CREATE); + status = fh_verify(rqstp, &cstate->current_fh, S_IFDIR, access); if (status) return status; diff --git a/fs/nfsd/nfsfh.c b/fs/nfsd/nfsfh.c index 350041a..7159316 100644 --- a/fs/nfsd/nfsfh.c +++ b/fs/nfsd/nfsfh.c @@ -319,10 +319,10 @@ fh_verify(struct svc_rqst *rqstp, struct svc_fh *fhp, umode_t type, int access) /* * We still have to do all these permission checks, even when * fh_dentry is already set: - * - fh_verify may be called multiple times with different - * "access" arguments (e.g. nfsd_proc_create calls - * fh_verify(...,NFSD_MAY_EXEC) first, then later (in - * nfsd_create) calls fh_verify(...,NFSD_MAY_CREATE). + * - fh_verify may be called multiple times with different + * "access" arguments (e.g. nfsd_proc_create calls + * fh_verify(...,NFSD_MAY_EXEC) first, then later (in + * nfsd_create) calls fh_verify(...,NFSD_MAY_CREATE_FILE). * - in the NFSv4 case, the filehandle may have been filled * in by fh_compose, and given a dentry, but further * compound operations performed with that filehandle diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c index 45c0497..fb35775 100644 --- a/fs/nfsd/vfs.c +++ b/fs/nfsd/vfs.c @@ -1128,6 +1128,8 @@ nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp, __be32 err; __be32 err2; int host_err; + int access = (type == S_IFDIR) ? + NFSD_MAY_CREATE_DIR : NFSD_MAY_CREATE_FILE; err = nfserr_perm; if (!flen) @@ -1136,7 +1138,7 @@ nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp, if (isdotent(fname, flen)) goto out; - err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE); + err = fh_verify(rqstp, fhp, S_IFDIR, access); if (err) goto out; @@ -1301,7 +1303,7 @@ do_nfsd_create(struct svc_rqst *rqstp, struct svc_fh *fhp, /* If file doesn't exist, check for permissions to create one */ if (d_really_is_negative(dchild)) { - err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE); + err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE_FILE); if (err) goto out; } @@ -1485,7 +1487,7 @@ nfsd_symlink(struct svc_rqst *rqstp, struct svc_fh *fhp, if (isdotent(fname, flen)) goto out; - err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE); + err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE_FILE); if (err) goto out; @@ -1532,7 +1534,7 @@ nfsd_link(struct svc_rqst *rqstp, struct svc_fh *ffhp, __be32 err; int host_err; - err = fh_verify(rqstp, ffhp, S_IFDIR, NFSD_MAY_CREATE); + err = fh_verify(rqstp, ffhp, S_IFDIR, NFSD_MAY_CREATE_FILE); if (err) goto out; err = fh_verify(rqstp, tfhp, 0, NFSD_MAY_NOP); @@ -1604,11 +1606,12 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen, struct inode *fdir, *tdir; __be32 err; int host_err; + int access; err = fh_verify(rqstp, ffhp, S_IFDIR, NFSD_MAY_REMOVE); if (err) goto out; - err = fh_verify(rqstp, tfhp, S_IFDIR, NFSD_MAY_CREATE); + err = fh_verify(rqstp, tfhp, S_IFDIR, NFSD_MAY_NOP); if (err) goto out; @@ -1647,6 +1650,13 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen, if (odentry == trap) goto out_dput_old; + host_err = 0; + access = S_ISDIR(d_inode(odentry)->i_mode) ? + NFSD_MAY_CREATE_DIR : NFSD_MAY_CREATE_FILE; + err = fh_verify(rqstp, tfhp, S_IFDIR, access); + if (err) + goto out_dput_old; + ndentry = lookup_one_len(tname, tdentry, tlen); host_err = PTR_ERR(ndentry); if (IS_ERR(ndentry)) @@ -1672,7 +1682,8 @@ nfsd_rename(struct svc_rqst *rqstp, struct svc_fh *ffhp, char *fname, int flen, out_dput_old: dput(odentry); out_nfserr: - err = nfserrno(host_err); + if (host_err) + err = nfserrno(host_err); /* * We cannot rely on fh_unlock on the two filehandles, * as that would do the wrong thing if the two directories @@ -2005,8 +2016,9 @@ nfsd_permission(struct svc_rqst *rqstp, struct svc_export *exp, uid_eq(inode->i_uid, current_fsuid())) return 0; - /* This assumes NFSD_MAY_{READ,WRITE,EXEC} == MAY_{READ,WRITE,EXEC} */ - err = inode_permission(inode, acc & (MAY_READ|MAY_WRITE|MAY_EXEC)); + /* This assumes NFSD_MAY_{READ,WRITE,EXEC} == MAY_{READ,WRITE,EXEC}. */ + err = inode_permission(inode, acc & (MAY_READ|MAY_WRITE|MAY_EXEC| + MAY_CREATE_DIR|MAY_CREATE_FILE)); /* Allow read access to binaries even when mode 111 */ if (err == -EACCES && S_ISREG(inode->i_mode) && diff --git a/fs/nfsd/vfs.h b/fs/nfsd/vfs.h index fee2451..c849ef2 100644 --- a/fs/nfsd/vfs.h +++ b/fs/nfsd/vfs.h @@ -19,18 +19,19 @@ #define NFSD_MAY_TRUNC 0x010 #define NFSD_MAY_LOCK 0x020 #define NFSD_MAY_MASK 0x03f +#define NFSD_MAY_CREATE_FILE 0x103 /* == MAY_{EXEC|WRITE|CREATE_FILE} */ +#define NFSD_MAY_CREATE_DIR 0x203 /* == MAY_{EXEC|WRITE|CREATE_DIR} */ /* extra hints to permission and open routines: */ -#define NFSD_MAY_OWNER_OVERRIDE 0x040 -#define NFSD_MAY_LOCAL_ACCESS 0x080 /* for device special files */ -#define NFSD_MAY_BYPASS_GSS_ON_ROOT 0x100 -#define NFSD_MAY_NOT_BREAK_LEASE 0x200 -#define NFSD_MAY_BYPASS_GSS 0x400 -#define NFSD_MAY_READ_IF_EXEC 0x800 +#define NFSD_MAY_OWNER_OVERRIDE 0x04000 +#define NFSD_MAY_LOCAL_ACCESS 0x08000 /* for device special files */ +#define NFSD_MAY_BYPASS_GSS_ON_ROOT 0x10000 +#define NFSD_MAY_NOT_BREAK_LEASE 0x20000 +#define NFSD_MAY_BYPASS_GSS 0x40000 +#define NFSD_MAY_READ_IF_EXEC 0x80000 -#define NFSD_MAY_64BIT_COOKIE 0x1000 /* 64 bit readdir cookies for >= NFSv3 */ +#define NFSD_MAY_64BIT_COOKIE 0x100000 /* 64 bit readdir cookies for >= NFSv3 */ -#define NFSD_MAY_CREATE (NFSD_MAY_EXEC|NFSD_MAY_WRITE) #define NFSD_MAY_REMOVE (NFSD_MAY_EXEC|NFSD_MAY_WRITE|NFSD_MAY_TRUNC) /*