From patchwork Thu Jun 30 13:47:05 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Andreas Gruenbacher X-Patchwork-Id: 9207747 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id 916726089D for ; Thu, 30 Jun 2016 13:55:03 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 8203728673 for ; Thu, 30 Jun 2016 13:55:03 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id 762582867F; Thu, 30 Jun 2016 13:55:03 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.9 required=2.0 tests=BAYES_00,RCVD_IN_DNSWL_HI autolearn=unavailable version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 18E6228679 for ; Thu, 30 Jun 2016 13:55:03 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752053AbcF3Nye (ORCPT ); Thu, 30 Jun 2016 09:54:34 -0400 Received: from mx1.redhat.com ([209.132.183.28]:46777 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751973AbcF3Ntv (ORCPT ); Thu, 30 Jun 2016 09:49:51 -0400 Received: from int-mx09.intmail.prod.int.phx2.redhat.com (int-mx09.intmail.prod.int.phx2.redhat.com [10.5.11.22]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 4C75660BC; Thu, 30 Jun 2016 13:49:00 +0000 (UTC) Received: from nux.redhat.com (vpn1-5-124.ams2.redhat.com [10.36.5.124]) by int-mx09.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id u5UDlDsp005273; Thu, 30 Jun 2016 09:48:53 -0400 From: Andreas Gruenbacher To: Alexander Viro Cc: Andreas Gruenbacher , Christoph Hellwig , "Theodore Ts'o" , Andreas Dilger , "J. Bruce Fields" , Jeff Layton , Trond Myklebust , Anna Schumaker , Dave Chinner , linux-ext4@vger.kernel.org, xfs@oss.sgi.com, linux-kernel@vger.kernel.org, linux-fsdevel@vger.kernel.org, linux-nfs@vger.kernel.org, linux-cifs@vger.kernel.org, linux-api@vger.kernel.org Subject: [PATCH v23 14/22] richacl: Update the file masks in chmod() Date: Thu, 30 Jun 2016 15:47:05 +0200 Message-Id: <1467294433-3222-15-git-send-email-agruenba@redhat.com> In-Reply-To: <1467294433-3222-1-git-send-email-agruenba@redhat.com> References: <1467294433-3222-1-git-send-email-agruenba@redhat.com> X-Scanned-By: MIMEDefang 2.68 on 10.5.11.22 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.30]); Thu, 30 Jun 2016 13:49:00 +0000 (UTC) Sender: linux-nfs-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-nfs@vger.kernel.org X-Virus-Scanned: ClamAV using ClamSMTP Doing a chmod() sets the file mode, which includes the file permission bits. When a file has a richacl, the permissions that the richacl grants need to be limited to what the new file permission bits allow. This is done by setting the file masks in the richacl to what the file permission bits map to. The richacl access check algorithm takes the file masks into account, which ensures that the richacl cannot grant too many permissions. It is possible to explicitly add permissions to the file masks which go beyond what the file permission bits can grant (like the RICHACE_WRITE_ACL permission). The POSIX.1 standard calls this an alternate file access control mechanism. A subsequent chmod() would ensure that those permissions are disabled again. Signed-off-by: Andreas Gruenbacher Reviewed-by: J. Bruce Fields Acked-by: Jeff Layton --- fs/richacl.c | 71 +++++++++++++++++++++++++++++++++++++++++++++++++ include/linux/richacl.h | 1 + 2 files changed, 72 insertions(+) diff --git a/fs/richacl.c b/fs/richacl.c index b2a03c1..ba110a6 100644 --- a/fs/richacl.c +++ b/fs/richacl.c @@ -547,3 +547,74 @@ out: return denied ? -EACCES : 0; } EXPORT_SYMBOL_GPL(richacl_permission); + +/** + * __richacl_chmod - update the file masks to reflect the new mode + * @acl: access control list + * @mode: new file permission bits including the file type + * + * Return a copy of @acl where the file masks have been replaced by the file + * masks corresponding to the file permission bits in @mode, or returns @acl + * itself if the file masks are already up to date. Takes over a reference + * to @acl. + */ +static struct richacl * +__richacl_chmod(struct richacl *acl, umode_t mode) +{ + unsigned int x = S_ISDIR(mode) ? 0 : RICHACE_DELETE_CHILD; + unsigned int owner_mask, group_mask, other_mask; + struct richacl *clone; + + owner_mask = richacl_mode_to_mask(mode >> 6) & ~x; + group_mask = richacl_mode_to_mask(mode >> 3) & ~x; + other_mask = richacl_mode_to_mask(mode) & ~x; + + if (acl->a_owner_mask == owner_mask && + acl->a_group_mask == group_mask && + acl->a_other_mask == other_mask && + (acl->a_flags & RICHACL_MASKED) && + (acl->a_flags & RICHACL_WRITE_THROUGH)) + return acl; + + clone = richacl_clone(acl, GFP_KERNEL); + richacl_put(acl); + if (!clone) + return ERR_PTR(-ENOMEM); + + clone->a_flags |= (RICHACL_WRITE_THROUGH | RICHACL_MASKED); + clone->a_owner_mask = owner_mask; + clone->a_group_mask = group_mask; + clone->a_other_mask = other_mask; + + return clone; +} + +/** + * richacl_chmod - filesystem chmod helper + * @inode: inode whose file permission bits to change + * @mode: new file permission bits including the file type + * + * Helper for filesystems to use to perform a chmod on the richacl of an inode. + */ +int +richacl_chmod(struct inode *inode, umode_t mode) +{ + struct richacl *acl; + int retval; + + if (S_ISLNK(mode)) + return -EOPNOTSUPP; + if (!inode->i_op->set_richacl) + return -EOPNOTSUPP; + acl = get_richacl(inode); + if (IS_ERR_OR_NULL(acl)) + return PTR_ERR(acl); + acl = __richacl_chmod(acl, mode); + if (IS_ERR(acl)) + return PTR_ERR(acl); + retval = inode->i_op->set_richacl(inode, acl); + richacl_put(acl); + + return retval; +} +EXPORT_SYMBOL(richacl_chmod); diff --git a/include/linux/richacl.h b/include/linux/richacl.h index 3e05c94..db82fab 100644 --- a/include/linux/richacl.h +++ b/include/linux/richacl.h @@ -190,5 +190,6 @@ extern unsigned int richacl_mode_to_mask(umode_t); extern unsigned int richacl_want_to_mask(unsigned int); extern void richacl_compute_max_masks(struct richacl *); extern int richacl_permission(struct inode *, const struct richacl *, int); +extern int richacl_chmod(struct inode *, umode_t); #endif /* __RICHACL_H */