1 /* -*- mode: c; c-basic-offset: 8; indent-tabs-mode: nil; -*-
2 * vim:expandtab:shiftwidth=8:tabstop=8:
6 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License version 2 only,
10 * as published by the Free Software Foundation.
12 * This program is distributed in the hope that it will be useful, but
13 * WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
15 * General Public License version 2 for more details (a copy is included
16 * in the LICENSE file that accompanied this code).
18 * You should have received a copy of the GNU General Public License
19 * version 2 along with this program; If not, see
20 * http://www.sun.com/software/products/lustre/docs/GPLv2.pdf
22 * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa Clara,
23 * CA 95054 USA or visit www.sun.com if you need additional information or
29 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
30 * Use is subject to license terms.
33 * This file is part of Lustre, http://www.lustre.org/
34 * Lustre is a trademark of Sun Microsystems, Inc.
36 * lustre/mdt/mdt_identity.c
38 * Author: Lai Siyao <lsy@clusterfs.com>
39 * Author: Fan Yong <fanyong@clusterfs.com>
45 #define DEBUG_SUBSYSTEM S_MDS
47 #ifndef AUTOCONF_INCLUDED
48 #include <linux/config.h>
50 #include <linux/module.h>
51 #include <linux/kernel.h>
53 #include <linux/kmod.h>
54 #include <linux/string.h>
55 #include <linux/stat.h>
56 #include <linux/errno.h>
57 #include <linux/version.h>
58 #include <linux/unistd.h>
59 #include <asm/system.h>
60 #include <asm/uaccess.h>
62 #include <linux/stat.h>
63 #include <asm/uaccess.h>
64 #include <linux/slab.h>
66 #include <libcfs/libcfs.h>
68 #include <obd_class.h>
69 #include <obd_support.h>
70 #include <lustre_net.h>
71 #include <lustre_import.h>
72 #include <lustre_dlm.h>
73 #include <lustre_lib.h>
74 #include <lustre_ucache.h>
76 #include "mdt_internal.h"
78 static void mdt_identity_entry_init(struct upcall_cache_entry *entry,
81 entry->u.identity.mi_uc_entry = entry;
84 static void mdt_identity_entry_free(struct upcall_cache *cache,
85 struct upcall_cache_entry *entry)
87 struct md_identity *identity = &entry->u.identity;
89 if (identity->mi_ginfo) {
90 cfs_put_group_info(identity->mi_ginfo);
91 identity->mi_ginfo = NULL;
94 if (identity->mi_nperms) {
95 LASSERT(identity->mi_perms);
96 OBD_FREE(identity->mi_perms,
97 identity->mi_nperms * sizeof(struct md_perm));
98 identity->mi_nperms = 0;
102 static int mdt_identity_do_upcall(struct upcall_cache *cache,
103 struct upcall_cache_entry *entry)
105 char *upcall, keystr[16];
107 [0] = cache->uc_upcall,
108 [1] = cache->uc_name,
114 [1] = "PATH=/sbin:/usr/sbin",
117 struct timeval start, end;
121 /* There is race condition:
122 * "uc_upcall" was changed just after "is_identity_get_disabled" check.
124 size = strlen(cache->uc_upcall) + 1;
125 OBD_ALLOC(upcall, size);
126 if (unlikely(!upcall))
129 cfs_read_lock(&cache->uc_upcall_rwlock);
130 memcpy(upcall, cache->uc_upcall, size - 1);
131 cfs_read_unlock(&cache->uc_upcall_rwlock);
132 upcall[size - 1] = 0;
133 if (unlikely(!strcmp(upcall, "NONE"))) {
134 CERROR("no upcall set\n");
135 GOTO(out, rc = -EREMCHG);
140 snprintf(keystr, sizeof(keystr), LPU64, entry->ue_key);
142 CDEBUG(D_INFO, "The upcall is: '%s'\n", cache->uc_upcall);
144 cfs_gettimeofday(&start);
145 rc = USERMODEHELPER(argv[0], argv, envp);
146 cfs_gettimeofday(&end);
148 CERROR("%s: error invoking upcall %s %s %s: rc %d; "
149 "check /proc/fs/lustre/mdt/%s/identity_upcall, "
151 cache->uc_name, argv[0], argv[1], argv[2], rc,
152 cache->uc_name, cfs_timeval_sub(&end, &start, NULL));
154 CDEBUG(D_HA, "%s: invoked upcall %s %s %s, time %ldus\n",
155 cache->uc_name, argv[0], argv[1], argv[2],
156 cfs_timeval_sub(&end, &start, NULL));
161 OBD_FREE(upcall, size);
165 static int mdt_identity_parse_downcall(struct upcall_cache *cache,
166 struct upcall_cache_entry *entry,
169 struct md_identity *identity = &entry->u.identity;
170 struct identity_downcall_data *data = args;
171 cfs_group_info_t *ginfo;
172 struct md_perm *perms = NULL;
177 if (data->idd_ngroups > NGROUPS_MAX)
180 ginfo = cfs_groups_alloc(data->idd_ngroups);
182 CERROR("failed to alloc %d groups\n", data->idd_ngroups);
186 lustre_groups_from_list(ginfo, data->idd_groups);
187 lustre_groups_sort(ginfo);
189 if (data->idd_nperms) {
190 size = data->idd_nperms * sizeof(*perms);
191 OBD_ALLOC(perms, size);
193 CERROR("failed to alloc %d permissions\n",
195 cfs_put_group_info(ginfo);
199 for (i = 0; i < data->idd_nperms; i++) {
200 perms[i].mp_nid = data->idd_perms[i].pdd_nid;
201 perms[i].mp_perm = data->idd_perms[i].pdd_perm;
205 identity->mi_uid = data->idd_uid;
206 identity->mi_gid = data->idd_gid;
207 identity->mi_ginfo = ginfo;
208 identity->mi_nperms = data->idd_nperms;
209 identity->mi_perms = perms;
211 CDEBUG(D_OTHER, "parse mdt identity@%p: %d:%d, ngroups %u, nperms %u\n",
212 identity, identity->mi_uid, identity->mi_gid,
213 identity->mi_ginfo->ngroups, identity->mi_nperms);
218 struct md_identity *mdt_identity_get(struct upcall_cache *cache, __u32 uid)
220 struct upcall_cache_entry *entry;
223 return ERR_PTR(-ENOENT);
225 entry = upcall_cache_get_entry(cache, (__u64)uid, NULL);
227 return ERR_PTR(PTR_ERR(entry));
228 else if (unlikely(!entry))
229 return ERR_PTR(-ENOENT);
231 return &entry->u.identity;
234 void mdt_identity_put(struct upcall_cache *cache, struct md_identity *identity)
240 upcall_cache_put_entry(cache, identity->mi_uc_entry);
243 struct upcall_cache_ops mdt_identity_upcall_cache_ops = {
244 .init_entry = mdt_identity_entry_init,
245 .free_entry = mdt_identity_entry_free,
246 .do_upcall = mdt_identity_do_upcall,
247 .parse_downcall = mdt_identity_parse_downcall,
250 void mdt_flush_identity(struct upcall_cache *cache, int uid)
253 upcall_cache_flush_idle(cache);
255 upcall_cache_flush_one(cache, (__u64)uid, NULL);
259 * If there is LNET_NID_ANY in perm[i].mp_nid,
260 * it must be perm[0].mp_nid, and act as default perm.
262 __u32 mdt_identity_get_perm(struct md_identity *identity,
263 __u32 is_rmtclient, lnet_nid_t nid)
265 struct md_perm *perm;
269 LASSERT(is_rmtclient == 0);
270 return CFS_SETGRP_PERM;
273 perm = identity->mi_perms;
274 /* check exactly matched nid first */
275 for (i = identity->mi_nperms - 1; i > 0; i--) {
276 if (perm[i].mp_nid != nid)
278 return perm[i].mp_perm;
281 /* check LNET_NID_ANY then */
282 if ((identity->mi_nperms > 0) &&
283 ((perm[0].mp_nid == nid) || (perm[0].mp_nid == LNET_NID_ANY)))
284 return perm[0].mp_perm;
286 /* return default last */
287 return is_rmtclient ? 0 : CFS_SETGRP_PERM;
290 int mdt_pack_remote_perm(struct mdt_thread_info *info, struct mdt_object *o,
293 struct md_ucred *uc = mdt_ucred(info);
294 struct md_object *next = mdt_object_child(o);
295 struct mdt_remote_perm *perm = buf;
299 /* remote client request always pack ptlrpc_user_desc! */
302 if (!exp_connect_rmtclient(info->mti_exp))
305 if ((uc->mu_valid != UCRED_OLD) && (uc->mu_valid != UCRED_NEW))
308 perm->rp_uid = uc->mu_o_uid;
309 perm->rp_gid = uc->mu_o_gid;
310 perm->rp_fsuid = uc->mu_o_fsuid;
311 perm->rp_fsgid = uc->mu_o_fsgid;
313 perm->rp_access_perm = 0;
314 if (mo_permission(info->mti_env, NULL, next, NULL, MAY_READ) == 0)
315 perm->rp_access_perm |= MAY_READ;
316 if (mo_permission(info->mti_env, NULL, next, NULL, MAY_WRITE) == 0)
317 perm->rp_access_perm |= MAY_WRITE;
318 if (mo_permission(info->mti_env, NULL, next, NULL, MAY_EXEC) == 0)
319 perm->rp_access_perm |= MAY_EXEC;