lustre/mdt/mdt_idmap.c

   1 /* -*- mode: c; c-basic-offset: 8; indent-tabs-mode: nil; -*-
   2  * vim:expandtab:shiftwidth=8:tabstop=8:
   3  *
   4  * GPL HEADER START
   5  *
   6  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License version 2 only,
  10  * as published by the Free Software Foundation.
  11  *
  12  * This program is distributed in the hope that it will be useful, but
  13  * WITHOUT ANY WARRANTY; without even the implied warranty of
  14  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
  15  * General Public License version 2 for more details (a copy is included
  16  * in the LICENSE file that accompanied this code).
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * version 2 along with this program; If not, see
  20  * http://www.sun.com/software/products/lustre/docs/GPLv2.pdf
  21  *
  22  * Please contact Sun Microsystems, Inc., 4150 Network Circle, Santa Clara,
  23  * CA 95054 USA or visit www.sun.com if you need additional information or
  24  * have any questions.
  25  *
  26  * GPL HEADER END
  27  */
  28 /*
  29  * Copyright  2008 Sun Microsystems, Inc. All rights reserved
  30  * Use is subject to license terms.
  31  */
  32 /*
  33  * This file is part of Lustre, http://www.lustre.org/
  34  * Lustre is a trademark of Sun Microsystems, Inc.
  35  *
  36  * lustre/mdt/mdt_idmap.c
  37  *
  38  * Author: Lai Siyao <lsy@clusterfs.com>
  39  * Author: Fan Yong <fanyong@clusterfs.com>
  40  */
  41
  42 #ifndef EXPORT_SYMTAB
  43 #define EXPORT_SYMTAB
  44 #endif
  45 #define DEBUG_SUBSYSTEM S_MDS
  46
  47 #ifndef AUTOCONF_INCLUDED
  48 #include <linux/config.h>
  49 #endif
  50 #include <linux/module.h>
  51 #include <linux/kernel.h>
  52 #include <linux/mm.h>
  53 #include <linux/kmod.h>
  54 #include <linux/string.h>
  55 #include <linux/stat.h>
  56 #include <linux/errno.h>
  57 #include <linux/version.h>
  58 #include <linux/unistd.h>
  59 #include <asm/system.h>
  60 #include <asm/uaccess.h>
  61 #include <linux/fs.h>
  62 #include <linux/stat.h>
  63 #include <asm/uaccess.h>
  64 #include <linux/slab.h>
  65
  66 #include <libcfs/libcfs.h>
  67 #include <obd.h>
  68 #include <obd_class.h>
  69 #include <obd_support.h>
  70 #include <lustre_net.h>
  71 #include <lustre_import.h>
  72 #include <lustre_dlm.h>
  73 #include <lustre_sec.h>
  74 #include <lustre_lib.h>
  75 #include <lustre_ucache.h>
  76
  77 #include "mdt_internal.h"
  78
  79 #define mdt_init_sec_none(reply, exp)                                   \
  80 do {                                                                    \
  81         reply->ocd_connect_flags &= ~(OBD_CONNECT_RMT_CLIENT |          \
  82                                       OBD_CONNECT_RMT_CLIENT_FORCE |    \
  83                                       OBD_CONNECT_MDS_CAPA |            \
  84                                       OBD_CONNECT_OSS_CAPA);            \
  85         spin_lock(&exp->exp_lock);                                      \
  86         exp->exp_connect_flags = reply->ocd_connect_flags;              \
  87         spin_unlock(&exp->exp_lock);                                    \
  88 } while (0)
  89
  90 int mdt_init_sec_level(struct mdt_thread_info *info)
  91 {
  92         struct mdt_device *mdt = info->mti_mdt;
  93         struct ptlrpc_request *req = mdt_info_req(info);
  94         char *client = libcfs_nid2str(req->rq_peer.nid);
  95         struct obd_export *exp = req->rq_export;
  96         struct obd_device *obd = exp->exp_obd;
  97         struct obd_connect_data *data, *reply;
  98         int rc = 0, remote;
  99         ENTRY;
 100
 101         data = req_capsule_client_get(info->mti_pill, &RMF_CONNECT_DATA);
 102         reply = req_capsule_server_get(info->mti_pill, &RMF_CONNECT_DATA);
 103         if (data == NULL || reply == NULL)
 104                 RETURN(-EFAULT);
 105
 106         /* connection from MDT is always trusted */
 107         if (req->rq_auth_usr_mdt) {
 108                 mdt_init_sec_none(reply, exp);
 109                 RETURN(0);
 110         }
 111
 112         /* no GSS support case */
 113         if (!req->rq_auth_gss) {
 114                 if (mdt->mdt_sec_level > LUSTRE_SEC_NONE) {
 115                         CWARN("client %s -> target %s does not user GSS, "
 116                               "can not run under security level %d.\n",
 117                               client, obd->obd_name, mdt->mdt_sec_level);
 118                         RETURN(-EACCES);
 119                 } else {
 120                         mdt_init_sec_none(reply, exp);
 121                         RETURN(0);
 122                 }
 123         }
 124
 125         /* old version case */
 126         if (unlikely(!(data->ocd_connect_flags & OBD_CONNECT_RMT_CLIENT) ||
 127                      !(data->ocd_connect_flags & OBD_CONNECT_MDS_CAPA) ||
 128                      !(data->ocd_connect_flags & OBD_CONNECT_OSS_CAPA))) {
 129                 if (mdt->mdt_sec_level > LUSTRE_SEC_NONE) {
 130                         CWARN("client %s -> target %s uses old version, "
 131                               "can not run under security level %d.\n",
 132                               client, obd->obd_name, mdt->mdt_sec_level);
 133                         RETURN(-EACCES);
 134                 } else {
 135                         CWARN("client %s -> target %s uses old version, "
 136                               "run under security level %d.\n",
 137                               client, obd->obd_name, mdt->mdt_sec_level);
 138                         mdt_init_sec_none(reply, exp);
 139                         RETURN(0);
 140                 }
 141         }
 142
 143         remote = data->ocd_connect_flags & OBD_CONNECT_RMT_CLIENT_FORCE;
 144         if (remote) {
 145                 if (!req->rq_auth_remote)
 146                         CDEBUG(D_SEC, "client (local realm) %s -> target %s "
 147                                "asked to be remote.\n", client, obd->obd_name);
 148         } else if (req->rq_auth_remote) {
 149                 remote = 1;
 150                 CDEBUG(D_SEC, "client (remote realm) %s -> target %s is set "
 151                        "as remote by default.\n", client, obd->obd_name);
 152         }
 153
 154         if (remote) {
 155                 if (!mdt->mdt_opts.mo_oss_capa) {
 156                         CDEBUG(D_SEC, "client %s -> target %s is set as remote,"
 157                                " but OSS capabilities are not enabled: %d.\n",
 158                                client, obd->obd_name, mdt->mdt_opts.mo_oss_capa);
 159                         RETURN(-EACCES);
 160                 }
 161         } else {
 162                 if (req->rq_auth_uid == INVALID_UID) {
 163                         CDEBUG(D_SEC, "client %s -> target %s: user is not "
 164                                "authenticated!\n", client, obd->obd_name);
 165                         RETURN(-EACCES);
 166                 }
 167         }
 168
 169         switch (mdt->mdt_sec_level) {
 170         case LUSTRE_SEC_NONE:
 171                 if (!remote) {
 172                         mdt_init_sec_none(reply, exp);
 173                         break;
 174                 } else {
 175                         CDEBUG(D_SEC, "client %s -> target %s is set as remote, "
 176                                "can not run under security level %d.\n",
 177                                client, obd->obd_name, mdt->mdt_sec_level);
 178                         RETURN(-EACCES);
 179                 }
 180         case LUSTRE_SEC_REMOTE:
 181                 if (!remote)
 182                         mdt_init_sec_none(reply, exp);
 183                 break;
 184         case LUSTRE_SEC_ALL:
 185                 if (!remote) {
 186                         reply->ocd_connect_flags &= ~(OBD_CONNECT_RMT_CLIENT |
 187                                                       OBD_CONNECT_RMT_CLIENT_FORCE);
 188                         if (!mdt->mdt_opts.mo_mds_capa)
 189                                 reply->ocd_connect_flags &= ~OBD_CONNECT_MDS_CAPA;
 190                         if (!mdt->mdt_opts.mo_oss_capa)
 191                                 reply->ocd_connect_flags &= ~OBD_CONNECT_OSS_CAPA;
 192
 193                         spin_lock(&exp->exp_lock);
 194                         exp->exp_connect_flags = reply->ocd_connect_flags;
 195                         spin_unlock(&exp->exp_lock);
 196                 }
 197                 break;
 198         default:
 199                 RETURN(-EINVAL);
 200         }
 201
 202         RETURN(rc);
 203 }
 204
 205 int mdt_init_idmap(struct mdt_thread_info *info)
 206 {
 207         struct ptlrpc_request *req = mdt_info_req(info);
 208         struct mdt_export_data *med = mdt_req2med(req);
 209         struct obd_export *exp = req->rq_export;
 210         char *client = libcfs_nid2str(req->rq_peer.nid);
 211         struct obd_device *obd = exp->exp_obd;
 212         int rc = 0;
 213         ENTRY;
 214
 215         if (exp_connect_rmtclient(exp)) {
 216                 down(&med->med_idmap_sem);
 217                 if (!med->med_idmap)
 218                         med->med_idmap = lustre_idmap_init();
 219                 up(&med->med_idmap_sem);
 220
 221                 if (IS_ERR(med->med_idmap)) {
 222                         long err = PTR_ERR(med->med_idmap);
 223
 224                         med->med_idmap = NULL;
 225                         CERROR("client %s -> target %s "
 226                                "failed to init idmap [%ld]!\n",
 227                                client, obd->obd_name, err);
 228                         RETURN(err);
 229                 } else if (!med->med_idmap) {
 230                         CERROR("client %s -> target %s "
 231                                "failed to init(2) idmap!\n",
 232                                client, obd->obd_name);
 233                         RETURN(-ENOMEM);
 234                 }
 235
 236                 CDEBUG(D_SEC, "client %s -> target %s is remote.\n",
 237                        client, obd->obd_name);
 238                 /* NB, MDS_CONNECT establish root idmap too! */
 239                 rc = mdt_handle_idmap(info);
 240         }
 241         RETURN(rc);
 242 }
 243
 244 void mdt_cleanup_idmap(struct mdt_export_data *med)
 245 {
 246         down(&med->med_idmap_sem);
 247         if (med->med_idmap != NULL) {
 248                 lustre_idmap_fini(med->med_idmap);
 249                 med->med_idmap = NULL;
 250         }
 251         up(&med->med_idmap_sem);
 252 }
 253
 254 static inline void mdt_revoke_export_locks(struct obd_export *exp)
 255 {
 256         /* don't revoke locks during recovery */
 257         if (exp->exp_obd->obd_recovering)
 258                 return;
 259
 260         ldlm_revoke_export_locks(exp);
 261 }
 262
 263 int mdt_handle_idmap(struct mdt_thread_info *info)
 264 {
 265         struct ptlrpc_request *req = mdt_info_req(info);
 266         struct mdt_device *mdt = info->mti_mdt;
 267         struct mdt_export_data *med;
 268         struct ptlrpc_user_desc *pud = req->rq_user_desc;
 269         struct md_identity *identity;
 270         __u32 opc;
 271         int rc = 0;
 272         ENTRY;
 273
 274         if (!req->rq_export)
 275                 RETURN(0);
 276
 277         med = mdt_req2med(req);
 278         if (!exp_connect_rmtclient(info->mti_exp))
 279                 RETURN(0);
 280
 281         opc = lustre_msg_get_opc(req->rq_reqmsg);
 282         /* Bypass other opc */
 283         if ((opc != SEC_CTX_INIT) && (opc != SEC_CTX_INIT_CONT) &&
 284             (opc != SEC_CTX_FINI) && (opc != MDS_CONNECT))
 285                 RETURN(0);
 286
 287         LASSERT(med->med_idmap);
 288
 289         if (unlikely(!pud)) {
 290                 CDEBUG(D_SEC, "remote client must run with rq_user_desc "
 291                        "present\n");
 292                 RETURN(-EACCES);
 293         }
 294
 295         if (req->rq_auth_mapped_uid == INVALID_UID) {
 296                 CDEBUG(D_SEC, "invalid authorized mapped uid, please check "
 297                        "/etc/lustre/idmap.conf!\n");
 298                 RETURN(-EACCES);
 299         }
 300
 301         if (is_identity_get_disabled(mdt->mdt_identity_cache)) {
 302                 CDEBUG(D_SEC, "remote client must run with identity_get "
 303                        "enabled!\n");
 304                 RETURN(-EACCES);
 305         }
 306
 307         identity = mdt_identity_get(mdt->mdt_identity_cache,
 308                                     req->rq_auth_mapped_uid);
 309         if (IS_ERR(identity)) {
 310                 CDEBUG(D_SEC, "can't get mdt identity(%u), no mapping added\n",
 311                        req->rq_auth_mapped_uid);
 312                 RETURN(-EACCES);
 313         }
 314
 315         switch (opc) {
 316                 case SEC_CTX_INIT:
 317                 case SEC_CTX_INIT_CONT:
 318                 case MDS_CONNECT:
 319                         rc = lustre_idmap_add(med->med_idmap,
 320                                               pud->pud_uid, identity->mi_uid,
 321                                               pud->pud_gid, identity->mi_gid);
 322                         break;
 323                 case SEC_CTX_FINI:
 324                         rc = lustre_idmap_del(med->med_idmap,
 325                                               pud->pud_uid, identity->mi_uid,
 326                                               pud->pud_gid, identity->mi_gid);
 327                         break;
 328         }
 329
 330         mdt_identity_put(mdt->mdt_identity_cache, identity);
 331
 332         if (rc)
 333                 RETURN(rc);
 334
 335         switch (opc) {
 336                 case SEC_CTX_INIT:
 337                 case SEC_CTX_INIT_CONT:
 338                 case SEC_CTX_FINI:
 339                         mdt_revoke_export_locks(req->rq_export);
 340                         break;
 341         }
 342
 343         RETURN(0);
 344 }
 345
 346 int ptlrpc_user_desc_do_idmap(struct ptlrpc_request *req,
 347                               struct ptlrpc_user_desc *pud)
 348 {
 349         struct mdt_export_data    *med = mdt_req2med(req);
 350         struct lustre_idmap_table *idmap = med->med_idmap;
 351         uid_t uid, fsuid;
 352         gid_t gid, fsgid;
 353
 354         /* Only remote client need desc_to_idmap. */
 355         if (!exp_connect_rmtclient(req->rq_export))
 356                 return 0;
 357
 358         uid = lustre_idmap_lookup_uid(NULL, idmap, 0, pud->pud_uid);
 359         if (uid == CFS_IDMAP_NOTFOUND) {
 360                 CDEBUG(D_SEC, "no mapping for uid %u\n", pud->pud_uid);
 361                 return -EACCES;
 362         }
 363
 364         if (pud->pud_uid == pud->pud_fsuid) {
 365                 fsuid = uid;
 366         } else {
 367                 fsuid = lustre_idmap_lookup_uid(NULL, idmap, 0, pud->pud_fsuid);
 368                 if (fsuid == CFS_IDMAP_NOTFOUND) {
 369                         CDEBUG(D_SEC, "no mapping for fsuid %u\n",
 370                                pud->pud_fsuid);
 371                         return -EACCES;
 372                 }
 373         }
 374
 375         gid = lustre_idmap_lookup_gid(NULL, idmap, 0, pud->pud_gid);
 376         if (gid == CFS_IDMAP_NOTFOUND) {
 377                 CDEBUG(D_SEC, "no mapping for gid %u\n", pud->pud_gid);
 378                 return -EACCES;
 379         }
 380
 381         if (pud->pud_gid == pud->pud_fsgid) {
 382                 fsgid = gid;
 383         } else {
 384                 fsgid = lustre_idmap_lookup_gid(NULL, idmap, 0, pud->pud_fsgid);
 385                 if (fsgid == CFS_IDMAP_NOTFOUND) {
 386                         CDEBUG(D_SEC, "no mapping for fsgid %u\n",
 387                                pud->pud_fsgid);
 388                         return -EACCES;
 389                 }
 390         }
 391
 392         pud->pud_uid = uid;
 393         pud->pud_gid = gid;
 394         pud->pud_fsuid = fsuid;
 395         pud->pud_fsgid = fsgid;
 396
 397         return 0;
 398 }
 399
 400 /*
 401  * Reverse mapping
 402  */
 403 void mdt_body_reverse_idmap(struct mdt_thread_info *info, struct mdt_body *body)
 404 {
 405         struct ptlrpc_request     *req = mdt_info_req(info);
 406         struct md_ucred           *uc = mdt_ucred(info);
 407         struct mdt_export_data    *med = mdt_req2med(req);
 408         struct lustre_idmap_table *idmap = med->med_idmap;
 409
 410         if (!exp_connect_rmtclient(info->mti_exp))
 411                 return;
 412
 413         if (body->valid & OBD_MD_FLUID) {
 414                 uid_t uid = lustre_idmap_lookup_uid(uc, idmap, 1, body->uid);
 415
 416                 if (uid == CFS_IDMAP_NOTFOUND) {
 417                         uid = NOBODY_UID;
 418                         if (body->valid & OBD_MD_FLMODE)
 419                                 body->mode = (body->mode & ~S_IRWXU) |
 420                                              ((body->mode & S_IRWXO) << 6);
 421                 }
 422
 423                 body->uid = uid;
 424         }
 425
 426         if (body->valid & OBD_MD_FLGID) {
 427                 gid_t gid = lustre_idmap_lookup_gid(uc, idmap, 1, body->gid);
 428
 429                 if (gid == CFS_IDMAP_NOTFOUND) {
 430                         gid = NOBODY_GID;
 431                         if (body->valid & OBD_MD_FLMODE)
 432                                 body->mode = (body->mode & ~S_IRWXG) |
 433                                              ((body->mode & S_IRWXO) << 3);
 434                 }
 435
 436                 body->gid = gid;
 437         }
 438 }
 439
 440 /* Do not ignore root_squash for non-setattr case. */
 441 int mdt_fix_attr_ucred(struct mdt_thread_info *info, __u32 op)
 442 {
 443         struct ptlrpc_request     *req = mdt_info_req(info);
 444         struct md_ucred           *uc = mdt_ucred(info);
 445         struct lu_attr            *attr = &info->mti_attr.ma_attr;
 446         struct mdt_export_data    *med = mdt_req2med(req);
 447         struct lustre_idmap_table *idmap = med->med_idmap;
 448
 449         if ((uc->mu_valid != UCRED_OLD) && (uc->mu_valid != UCRED_NEW))
 450                 return -EINVAL;
 451
 452         if (op != REINT_SETATTR) {
 453                 if ((attr->la_valid & LA_UID) && (attr->la_uid != -1))
 454                         attr->la_uid = uc->mu_fsuid;
 455                 /* for S_ISGID, inherit gid from his parent, such work will be
 456                  * done in cmm/mdd layer, here set all cases as uc->mu_fsgid. */
 457                 if ((attr->la_valid & LA_GID) && (attr->la_gid != -1))
 458                         attr->la_gid = uc->mu_fsgid;
 459         } else if (exp_connect_rmtclient(info->mti_exp)) {
 460                 /* NB: -1 case will be handled by mdt_fix_attr() later. */
 461                 if ((attr->la_valid & LA_UID) && (attr->la_uid != -1)) {
 462                         uid_t uid = lustre_idmap_lookup_uid(uc, idmap, 0,
 463                                                             attr->la_uid);
 464
 465                         if (uid == CFS_IDMAP_NOTFOUND) {
 466                                 CDEBUG(D_SEC, "Deny chown to uid %u\n",
 467                                        attr->la_uid);
 468                                 return -EPERM;
 469                         }
 470
 471                         attr->la_uid = uid;
 472                 }
 473                 if ((attr->la_valid & LA_GID) && (attr->la_gid != -1)) {
 474                         gid_t gid = lustre_idmap_lookup_gid(uc, idmap, 0,
 475                                                             attr->la_gid);
 476
 477                         if (gid == CFS_IDMAP_NOTFOUND) {
 478                                 CDEBUG(D_SEC, "Deny chown to gid %u\n",
 479                                        attr->la_gid);
 480                                 return -EPERM;
 481                         }
 482
 483                         attr->la_gid = gid;
 484                 }
 485         }
 486
 487         return 0;
 488 }