/*
* Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
* Use is subject to license terms.
+ *
+ * Copyright (c) 2012, 2013, Intel Corporation.
*/
/*
* This file is part of Lustre, http://www.lustre.org/
#include <lustre_ver.h>
#include <lprocfs_status.h>
#include <lustre_mds.h>
-
+#include <lustre_idmap.h>
#include "mdd_internal.h"
#ifdef CONFIG_FS_POSIX_ACL
/*
- * Get default acl EA only.
- * Hold read_lock for mdd_obj.
- */
-int mdd_def_acl_get(const struct lu_env *env, struct mdd_object *mdd_obj,
- struct md_attr *ma)
-{
- struct lu_buf *buf;
- int rc;
- ENTRY;
-
- if (ma->ma_valid & MA_ACL_DEF)
- RETURN(0);
-
- buf = mdd_buf_get(env, ma->ma_acl, ma->ma_acl_size);
- rc = mdo_xattr_get(env, mdd_obj, buf, XATTR_NAME_ACL_DEFAULT,
- BYPASS_CAPA);
- if (rc > 0) {
- ma->ma_acl_size = rc;
- ma->ma_valid |= MA_ACL_DEF;
- rc = 0;
- } else if ((rc == -EOPNOTSUPP) || (rc == -ENODATA)) {
- rc = 0;
- }
- RETURN(rc);
-}
-
-/*
* Hold write_lock for o.
*/
int mdd_acl_chmod(const struct lu_env *env, struct mdd_object *o, __u32 mode,
mdd_object_capa(env, obj));
/* security-replated changes may require sync */
- handle->th_sync |= !!mdd->mdd_sync_permission;
+ if (S_ISDIR(mdd_object_type(obj)))
+ handle->th_sync |= !!mdd->mdd_sync_permission;
unlock:
mdd_write_unlock(env, obj);
stop:
RETURN(rc);
}
-/*
- * Hold write_lock for obj.
- */
-int __mdd_acl_init(const struct lu_env *env, struct mdd_object *obj,
- struct lu_buf *buf, __u32 *mode, struct thandle *handle)
+/**
+ * Fix mode and ACL according to the default ACL(buf)
+ * \retval = 0 ACL does not need to be reset.
+ * \retval = 1 ACL needs to be reset.
+ * \retval < 0 error.
+ **/
+int __mdd_fix_mode_acl(const struct lu_env *env, struct lu_buf *buf,
+ __u32 *mode)
{
- posix_acl_xattr_header *head;
- posix_acl_xattr_entry *entry;
- int entry_count;
- __u32 old = *mode;
- int rc, rc2;
-
- ENTRY;
+ posix_acl_xattr_header *head;
+ posix_acl_xattr_entry *entry;
+ int entry_count;
+ int rc;
- head = (posix_acl_xattr_header *)(buf->lb_buf);
- entry = head->a_entries;
- entry_count = (buf->lb_len - sizeof(head->a_version)) /
- sizeof(posix_acl_xattr_entry);
- if (entry_count <= 0)
- RETURN(0);
+ ENTRY;
- if (S_ISDIR(*mode)) {
- rc = mdo_xattr_set(env, obj, buf, XATTR_NAME_ACL_DEFAULT, 0,
- handle, BYPASS_CAPA);
- if (rc)
- RETURN(rc);
- }
+ head = (posix_acl_xattr_header *)(buf->lb_buf);
+ entry = head->a_entries;
+ entry_count = (buf->lb_len - sizeof(head->a_version)) /
+ sizeof(posix_acl_xattr_entry);
+ if (entry_count <= 0)
+ RETURN(0);
- rc = lustre_posix_acl_create_masq(entry, mode, entry_count);
- if (rc < 0)
- RETURN(rc);
-
- /* part of ACL went into i_mode */
- if (*mode != old) {
- struct mdd_thread_info *info = mdd_env_info(env);
- struct lu_attr *pattr = &info->mti_pattr;
-
- /* mode was initialized within object creation,
- * so we need explict ->attr_set() to update it */
- pattr->la_valid = LA_MODE;
- pattr->la_mode = *mode;
- rc2 = mdo_attr_set(env, obj, pattr, handle, BYPASS_CAPA);
- if (rc2 < 0)
- rc = rc2;
- }
+ rc = lustre_posix_acl_create_masq(entry, mode, entry_count);
- if (rc > 0)
- rc = mdo_xattr_set(env, obj, buf, XATTR_NAME_ACL_ACCESS, 0,
- handle, BYPASS_CAPA);
RETURN(rc);
}
+
#endif
/*
struct lu_attr *la, int mask)
{
#ifdef CONFIG_FS_POSIX_ACL
- struct md_ucred *uc = md_ucred(env);
+ struct lu_ucred *uc = lu_ucred_assert(env);
posix_acl_xattr_header *head;
posix_acl_xattr_entry *entry;
struct lu_buf *buf;
int __mdd_permission_internal(const struct lu_env *env, struct mdd_object *obj,
struct lu_attr *la, int mask, int role)
{
- struct md_ucred *uc = md_ucred(env);
+ struct lu_ucred *uc = lu_ucred(env);
__u32 mode;
int rc;
ENTRY;
if (mask == 0)
RETURN(0);
- /* These means unnecessary for permission check */
- if ((uc == NULL) || (uc->mu_valid == UCRED_INIT))
- RETURN(0);
+ /* These means unnecessary for permission check */
+ if ((uc == NULL) || (uc->uc_valid == UCRED_INIT))
+ RETURN(0);
- /* Invalid user credit */
- if (uc->mu_valid == UCRED_INVALID)
- RETURN(-EACCES);
+ /* Invalid user credit */
+ if (uc->uc_valid == UCRED_INVALID)
+ RETURN(-EACCES);
/*
* Nobody gets write access to an immutable file.
}
mode = la->la_mode;
- if (uc->mu_fsuid == la->la_uid) {
- mode >>= 6;
+ if (uc->uc_fsuid == la->la_uid) {
+ mode >>= 6;
} else {
if (mode & S_IRWXG) {
if (role != -1)
RETURN(0);
check_capabilities:
- if (!(mask & MAY_EXEC) ||
- (la->la_mode & S_IXUGO) || S_ISDIR(la->la_mode))
- if (mdd_capable(uc, CFS_CAP_DAC_OVERRIDE))
- RETURN(0);
+ if (!(mask & MAY_EXEC) ||
+ (la->la_mode & S_IXUGO) || S_ISDIR(la->la_mode))
+ if (md_capable(uc, CFS_CAP_DAC_OVERRIDE))
+ RETURN(0);
- if ((mask == MAY_READ) ||
- (S_ISDIR(la->la_mode) && !(mask & MAY_WRITE)))
- if (mdd_capable(uc, CFS_CAP_DAC_READ_SEARCH))
- RETURN(0);
+ if ((mask == MAY_READ) ||
+ (S_ISDIR(la->la_mode) && !(mask & MAY_WRITE)))
+ if (md_capable(uc, CFS_CAP_DAC_READ_SEARCH))
+ RETURN(0);
- RETURN(-EACCES);
+ RETURN(-EACCES);
}
int mdd_permission(const struct lu_env *env,
struct md_attr *ma, int mask)
{
struct mdd_object *mdd_pobj, *mdd_cobj;
- struct md_ucred *uc = NULL;
+ struct lu_ucred *uc = NULL;
struct lu_attr *la = &mdd_env_info(env)->mti_cattr;
int check_create, check_link;
int check_unlink;
}
if (!rc && (check_vtx_part || check_vtx_full)) {
- uc = md_ucred(env);
+ uc = lu_ucred_assert(env);
if (likely(!la)) {
la = &mdd_env_info(env)->mti_la;
rc = mdd_la_get(env, mdd_cobj, la, BYPASS_CAPA);
RETURN(rc);
}
- if (!(la->la_mode & S_ISVTX) || (la->la_uid == uc->mu_fsuid) ||
- (check_vtx_full && (ma->ma_attr.la_valid & LA_UID) &&
- (ma->ma_attr.la_uid == uc->mu_fsuid))) {
- ma->ma_attr_flags |= MDS_VTX_BYPASS;
+ if (!(la->la_mode & S_ISVTX) || (la->la_uid == uc->uc_fsuid) ||
+ (check_vtx_full && (ma->ma_attr.la_valid & LA_UID) &&
+ (ma->ma_attr.la_uid == uc->uc_fsuid))) {
+ ma->ma_attr_flags |= MDS_VTX_BYPASS;
} else {
ma->ma_attr_flags &= ~MDS_VTX_BYPASS;
if (check_vtx_full)
if (unlikely(!rc && check_rgetfacl)) {
if (likely(!uc))
- uc = md_ucred(env);
+ uc = lu_ucred_assert(env);
- if (la->la_uid != uc->mu_fsuid &&
- !mdd_capable(uc, CFS_CAP_FOWNER))
- rc = -EPERM;
+ if (la->la_uid != uc->uc_fsuid &&
+ !md_capable(uc, CFS_CAP_FOWNER))
+ rc = -EPERM;
}
RETURN(rc);