| Message ID | 1467294433-3222-10-git-send-email-agruenba@redhat.com (mailing list archive) |
|---|---|
| State | Not Applicable, archived |
| Headers | show |
On Thu, 2016-06-30 at 15:47 +0200, Andreas Gruenbacher wrote: > A richacl roughly grants a requested access if the NFSv4 acl in the > richacl grants the requested permissions according to the NFSv4 > permission check algorithm and the file mask that applies to the process > includes the requested permissions. > > Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com> > Reviewed-by: J. Bruce Fields <bfields@fieldses.org> > --- > fs/richacl.c | 128 ++++++++++++++++++++++++++++++++++++++++++++++++ > include/linux/richacl.h | 1 + > 2 files changed, 129 insertions(+) > > diff --git a/fs/richacl.c b/fs/richacl.c > index 056228f..cb0ef3f 100644 > --- a/fs/richacl.c > +++ b/fs/richacl.c > @@ -338,3 +338,131 @@ restart: > acl->a_flags &= ~(RICHACL_WRITE_THROUGH | RICHACL_MASKED); > } > EXPORT_SYMBOL_GPL(richacl_compute_max_masks); > + > +/** > + * richacl_permission - richacl permission check algorithm > + * @inode: inode to check > + * @acl: rich acl of the inode > + * @want: requested access (MAY_* flags) > + * > + * Checks if the current process is granted @mask flags in @acl. > + */ nit: there is no @mask parm here. Do you mean @want ? > +int > +richacl_permission(struct inode *inode, const struct richacl *acl, > + int want) > +{ > + const struct richace *ace; > + unsigned int mask = richacl_want_to_mask(want); > + unsigned int requested = mask, denied = 0; > + int in_owning_group = in_group_p(inode->i_gid); > + int in_owner_or_group_class = in_owning_group; > + > + /* > + * A process is > + * - in the owner file class if it owns the file, > + * - in the group file class if it is in the file's owning group or > + * it matches any of the user or group entries, and > + * - in the other file class otherwise. > + * The file class is only relevant for determining which file mask to > + * apply, which only happens for masked acls. > + */ > + if (acl->a_flags & RICHACL_MASKED) { > + if ((acl->a_flags & RICHACL_WRITE_THROUGH) && > + uid_eq(current_fsuid(), inode->i_uid)) { > + denied = requested & ~acl->a_owner_mask; > + goto out; > + } > + } else { > + /* > + * When the acl is not masked, there is no need to determine if > + * the process is in the group class and we can break out > + * earlier of the loop below. > + */ > + in_owner_or_group_class = 1; > + } > + > + /* > + * Check if the acl grants the requested access and determine which > + * file class the process is in. > + */ > + richacl_for_each_entry(ace, acl) { > + unsigned int ace_mask = ace->e_mask; > + > + if (richace_is_inherit_only(ace)) > + continue; > + if (richace_is_owner(ace)) { > + if (!uid_eq(current_fsuid(), inode->i_uid)) > + continue; > + goto entry_matches_owner; > + } else if (richace_is_group(ace)) { > + if (!in_owning_group) > + continue; > + } else if (richace_is_unix_user(ace)) { > + if (!uid_eq(current_fsuid(), ace->e_id.uid)) > + continue; > + if (uid_eq(current_fsuid(), inode->i_uid)) > + goto entry_matches_owner; > + } else if (richace_is_unix_group(ace)) { > + if (!in_group_p(ace->e_id.gid)) > + continue; > + } else > + goto entry_matches_everyone; > + > + /* > + * Apply the group file mask to entries other than owner@ and > + * everyone@ or user entries matching the owner. This ensures > + * that we grant the same permissions as the acl computed by > + * richacl_apply_masks(). > + * > + * Without this restriction, the following richacl would grant > + * rw access to processes which are both the owner and in the > + * owning group, but not to other users in the owning group, > + * which could not be represented without masks: > + * > + * owner:rw::mask > + * group@:rw::allow > + */ > + if ((acl->a_flags & RICHACL_MASKED) && richace_is_allow(ace)) > + ace_mask &= acl->a_group_mask; > + > +entry_matches_owner: > + /* The process is in the owner or group file class. */ > + in_owner_or_group_class = 1; > + > +entry_matches_everyone: > + /* Check which mask flags the ACE allows or denies. */ > + if (richace_is_deny(ace)) > + denied |= ace_mask & mask; > + mask &= ~ace_mask; > + > + /* > + * Keep going until we know which file class > + * the process is in. > + */ > + if (!mask && in_owner_or_group_class) > + break; > + } > + denied |= mask; > + > + if (acl->a_flags & RICHACL_MASKED) { > + /* > + * The file class a process is in determines which file mask > + * applies. Check if that file mask also grants the requested > + * access. > + */ > + if (uid_eq(current_fsuid(), inode->i_uid)) > + denied |= requested & ~acl->a_owner_mask; > + else if (in_owner_or_group_class) > + denied |= requested & ~acl->a_group_mask; > + else { > + if (acl->a_flags & RICHACL_WRITE_THROUGH) > + denied = requested & ~acl->a_other_mask; > + else > + denied |= requested & ~acl->a_other_mask; > + } > + } > + > +out: > + return denied ? -EACCES : 0; > +} > +EXPORT_SYMBOL_GPL(richacl_permission); > diff --git a/include/linux/richacl.h b/include/linux/richacl.h > index 3559b2c..be9fb65 100644 > --- a/include/linux/richacl.h > +++ b/include/linux/richacl.h > @@ -179,5 +179,6 @@ extern int richacl_masks_to_mode(const struct richacl *); > extern unsigned int richacl_mode_to_mask(umode_t); > extern unsigned int richacl_want_to_mask(unsigned int); > extern void richacl_compute_max_masks(struct richacl *); > +extern int richacl_permission(struct inode *, const struct richacl *, int); > > #endif /* __RICHACL_H */ Reviewed-by: Jeff Layton <jlayton@redhat.com>
On Tue, Jul 5, 2016 at 4:59 PM, Jeff Layton <jlayton@redhat.com> wrote: > On Thu, 2016-06-30 at 15:47 +0200, Andreas Gruenbacher wrote: >> A richacl roughly grants a requested access if the NFSv4 acl in the >> richacl grants the requested permissions according to the NFSv4 >> permission check algorithm and the file mask that applies to the process >> includes the requested permissions. >> >> Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com> >> Reviewed-by: J. Bruce Fields <bfields@fieldses.org> >> --- >> fs/richacl.c | 128 ++++++++++++++++++++++++++++++++++++++++++++++++ >> include/linux/richacl.h | 1 + >> 2 files changed, 129 insertions(+) >> >> diff --git a/fs/richacl.c b/fs/richacl.c >> index 056228f..cb0ef3f 100644 >> --- a/fs/richacl.c >> +++ b/fs/richacl.c >> @@ -338,3 +338,131 @@ restart: >> acl->a_flags &= ~(RICHACL_WRITE_THROUGH | RICHACL_MASKED); >> } >> EXPORT_SYMBOL_GPL(richacl_compute_max_masks); >> + >> +/** >> + * richacl_permission - richacl permission check algorithm >> + * @inode: inode to check >> + * @acl: rich acl of the inode >> + * @want: requested access (MAY_* flags) >> + * >> + * Checks if the current process is granted @mask flags in @acl. >> + */ > > nit: there is no @mask parm here. Do you mean @want ? Yes, thanks. >> +int >> +richacl_permission(struct inode *inode, const struct richacl *acl, >> + int want) >> +{ >> + const struct richace *ace; >> + unsigned int mask = richacl_want_to_mask(want); >> + unsigned int requested = mask, denied = 0; >> + int in_owning_group = in_group_p(inode->i_gid); >> + int in_owner_or_group_class = in_owning_group; >> + >> + /* >> + * A process is >> + * - in the owner file class if it owns the file, >> + * - in the group file class if it is in the file's owning group or >> + * it matches any of the user or group entries, and >> + * - in the other file class otherwise. >> + * The file class is only relevant for determining which file mask to >> + * apply, which only happens for masked acls. >> + */ >> + if (acl->a_flags & RICHACL_MASKED) { >> + if ((acl->a_flags & RICHACL_WRITE_THROUGH) && >> + uid_eq(current_fsuid(), inode->i_uid)) { >> + denied = requested & ~acl->a_owner_mask; >> + goto out; >> + } >> + } else { >> + /* >> + * When the acl is not masked, there is no need to determine if >> + * the process is in the group class and we can break out >> + * earlier of the loop below. >> + */ >> + in_owner_or_group_class = 1; >> + } >> + >> + /* >> + * Check if the acl grants the requested access and determine which >> + * file class the process is in. >> + */ >> + richacl_for_each_entry(ace, acl) { >> + unsigned int ace_mask = ace->e_mask; >> + >> + if (richace_is_inherit_only(ace)) >> + continue; >> + if (richace_is_owner(ace)) { >> + if (!uid_eq(current_fsuid(), inode->i_uid)) >> + continue; >> + goto entry_matches_owner; >> + } else if (richace_is_group(ace)) { >> + if (!in_owning_group) >> + continue; >> + } else if (richace_is_unix_user(ace)) { >> + if (!uid_eq(current_fsuid(), ace->e_id.uid)) >> + continue; >> + if (uid_eq(current_fsuid(), inode->i_uid)) >> + goto entry_matches_owner; >> + } else if (richace_is_unix_group(ace)) { >> + if (!in_group_p(ace->e_id.gid)) >> + continue; >> + } else >> + goto entry_matches_everyone; >> + >> + /* >> + * Apply the group file mask to entries other than owner@ and >> + * everyone@ or user entries matching the owner. This ensures >> + * that we grant the same permissions as the acl computed by >> + * richacl_apply_masks(). >> + * >> + * Without this restriction, the following richacl would grant >> + * rw access to processes which are both the owner and in the >> + * owning group, but not to other users in the owning group, >> + * which could not be represented without masks: >> + * >> + * owner:rw::mask >> + * group@:rw::allow >> + */ >> + if ((acl->a_flags & RICHACL_MASKED) && richace_is_allow(ace)) >> + ace_mask &= acl->a_group_mask; >> + >> +entry_matches_owner: >> + /* The process is in the owner or group file class. */ >> + in_owner_or_group_class = 1; >> + >> +entry_matches_everyone: >> + /* Check which mask flags the ACE allows or denies. */ >> + if (richace_is_deny(ace)) >> + denied |= ace_mask & mask; >> + mask &= ~ace_mask; >> + >> + /* >> + * Keep going until we know which file class >> + * the process is in. >> + */ >> + if (!mask && in_owner_or_group_class) >> + break; >> + } >> + denied |= mask; >> + >> + if (acl->a_flags & RICHACL_MASKED) { >> + /* >> + * The file class a process is in determines which file mask >> + * applies. Check if that file mask also grants the requested >> + * access. >> + */ >> + if (uid_eq(current_fsuid(), inode->i_uid)) >> + denied |= requested & ~acl->a_owner_mask; >> + else if (in_owner_or_group_class) >> + denied |= requested & ~acl->a_group_mask; >> + else { >> + if (acl->a_flags & RICHACL_WRITE_THROUGH) >> + denied = requested & ~acl->a_other_mask; >> + else >> + denied |= requested & ~acl->a_other_mask; >> + } >> + } >> + >> +out: >> + return denied ? -EACCES : 0; >> +} >> +EXPORT_SYMBOL_GPL(richacl_permission); >> diff --git a/include/linux/richacl.h b/include/linux/richacl.h >> index 3559b2c..be9fb65 100644 >> --- a/include/linux/richacl.h >> +++ b/include/linux/richacl.h >> @@ -179,5 +179,6 @@ extern int richacl_masks_to_mode(const struct richacl *); >> extern unsigned int richacl_mode_to_mask(umode_t); >> extern unsigned int richacl_want_to_mask(unsigned int); >> extern void richacl_compute_max_masks(struct richacl *); >> +extern int richacl_permission(struct inode *, const struct richacl *, int); >> >> #endif /* __RICHACL_H */ > > Reviewed-by: Jeff Layton <jlayton@redhat.com> Thanks, Andreas
diff --git a/fs/richacl.c b/fs/richacl.c index 056228f..cb0ef3f 100644 --- a/fs/richacl.c +++ b/fs/richacl.c @@ -338,3 +338,131 @@ restart: acl->a_flags &= ~(RICHACL_WRITE_THROUGH | RICHACL_MASKED); } EXPORT_SYMBOL_GPL(richacl_compute_max_masks); + +/** + * richacl_permission - richacl permission check algorithm + * @inode: inode to check + * @acl: rich acl of the inode + * @want: requested access (MAY_* flags) + * + * Checks if the current process is granted @mask flags in @acl. + */ +int +richacl_permission(struct inode *inode, const struct richacl *acl, + int want) +{ + const struct richace *ace; + unsigned int mask = richacl_want_to_mask(want); + unsigned int requested = mask, denied = 0; + int in_owning_group = in_group_p(inode->i_gid); + int in_owner_or_group_class = in_owning_group; + + /* + * A process is + * - in the owner file class if it owns the file, + * - in the group file class if it is in the file's owning group or + * it matches any of the user or group entries, and + * - in the other file class otherwise. + * The file class is only relevant for determining which file mask to + * apply, which only happens for masked acls. + */ + if (acl->a_flags & RICHACL_MASKED) { + if ((acl->a_flags & RICHACL_WRITE_THROUGH) && + uid_eq(current_fsuid(), inode->i_uid)) { + denied = requested & ~acl->a_owner_mask; + goto out; + } + } else { + /* + * When the acl is not masked, there is no need to determine if + * the process is in the group class and we can break out + * earlier of the loop below. + */ + in_owner_or_group_class = 1; + } + + /* + * Check if the acl grants the requested access and determine which + * file class the process is in. + */ + richacl_for_each_entry(ace, acl) { + unsigned int ace_mask = ace->e_mask; + + if (richace_is_inherit_only(ace)) + continue; + if (richace_is_owner(ace)) { + if (!uid_eq(current_fsuid(), inode->i_uid)) + continue; + goto entry_matches_owner; + } else if (richace_is_group(ace)) { + if (!in_owning_group) + continue; + } else if (richace_is_unix_user(ace)) { + if (!uid_eq(current_fsuid(), ace->e_id.uid)) + continue; + if (uid_eq(current_fsuid(), inode->i_uid)) + goto entry_matches_owner; + } else if (richace_is_unix_group(ace)) { + if (!in_group_p(ace->e_id.gid)) + continue; + } else + goto entry_matches_everyone; + + /* + * Apply the group file mask to entries other than owner@ and + * everyone@ or user entries matching the owner. This ensures + * that we grant the same permissions as the acl computed by + * richacl_apply_masks(). + * + * Without this restriction, the following richacl would grant + * rw access to processes which are both the owner and in the + * owning group, but not to other users in the owning group, + * which could not be represented without masks: + * + * owner:rw::mask + * group@:rw::allow + */ + if ((acl->a_flags & RICHACL_MASKED) && richace_is_allow(ace)) + ace_mask &= acl->a_group_mask; + +entry_matches_owner: + /* The process is in the owner or group file class. */ + in_owner_or_group_class = 1; + +entry_matches_everyone: + /* Check which mask flags the ACE allows or denies. */ + if (richace_is_deny(ace)) + denied |= ace_mask & mask; + mask &= ~ace_mask; + + /* + * Keep going until we know which file class + * the process is in. + */ + if (!mask && in_owner_or_group_class) + break; + } + denied |= mask; + + if (acl->a_flags & RICHACL_MASKED) { + /* + * The file class a process is in determines which file mask + * applies. Check if that file mask also grants the requested + * access. + */ + if (uid_eq(current_fsuid(), inode->i_uid)) + denied |= requested & ~acl->a_owner_mask; + else if (in_owner_or_group_class) + denied |= requested & ~acl->a_group_mask; + else { + if (acl->a_flags & RICHACL_WRITE_THROUGH) + denied = requested & ~acl->a_other_mask; + else + denied |= requested & ~acl->a_other_mask; + } + } + +out: + return denied ? -EACCES : 0; +} +EXPORT_SYMBOL_GPL(richacl_permission); diff --git a/include/linux/richacl.h b/include/linux/richacl.h index 3559b2c..be9fb65 100644 --- a/include/linux/richacl.h +++ b/include/linux/richacl.h @@ -179,5 +179,6 @@ extern int richacl_masks_to_mode(const struct richacl *); extern unsigned int richacl_mode_to_mask(umode_t); extern unsigned int richacl_want_to_mask(unsigned int); extern void richacl_compute_max_masks(struct richacl *); +extern int richacl_permission(struct inode *, const struct richacl *, int); #endif /* __RICHACL_H */