Whamcloud - gitweb
LU-9193 security: return security context for metadata ops 73/34573/6
authorBruno Faccini <bruno.faccini@intel.com>
Wed, 26 Apr 2017 10:35:28 +0000 (12:35 +0200)
committerOleg Drokin <green@whamcloud.com>
Sun, 21 Apr 2019 06:11:53 +0000 (06:11 +0000)
commit7aa5ae2673f70ef851fb903b280a0fc9a47c476b
treea7a455f13d8e8f289db49e83fc222a1d9cbbc249
parent5456b1bdbf94bdb1769000d4ca5a8131528ddf5d
LU-9193 security: return security context for metadata ops

Security layer needs to fetch security context of files/dirs
upon metadata ops like lookup, getattr, open, truncate, and
layout, for its own purpose and control checks.
Retrieving the security context consists in a getxattr operation
at the file system level. The fact that the requested metadata
operation and the getxattr are not atomic can create a window
for a dead-lock situation where, based on some access patterns,
all MDT service threads can become stuck waiting for lookup lock
to be released and thus unable to serve getxattr for security context.
Another problem is that sending an additional getxattr request for
every metadata op hurts performance.

This patch introduces a way to get atomicity by having
the MDT return security context upon granted lock reply,
sparing the client an additional getxattr request.

Lustre-change: https://review.whamcloud.com/26831
Lustre-commit: fca35f74f9ec5c5ed77e774f3e3209d9df057a01

Signed-off-by: Bruno Faccini <bruno.faccini@intel.com>
Signed-off-by: Sebastien Buisson <sbuisson@ddn.com>
Signed-off-by: Sebastien Piechurski <sebastien.piechurski@atos.net>
Change-Id: Iaaf4d93f8d3bf31b5a2c23e7db36b3cb3feb31ba
Reviewed-by: Andreas Dilger <adilger@whamcloud.com>
Reviewed-by: Oleg Drokin <green@whamcloud.com>
Reviewed-on: https://review.whamcloud.com/34573
Tested-by: Jenkins
Tested-by: Maloo <maloo@whamcloud.com>
15 files changed:
lustre/autoconf/lustre-core.m4
lustre/include/obd.h
lustre/include/uapi/linux/lustre/lustre_idl.h
lustre/llite/llite_internal.h
lustre/llite/namei.c
lustre/llite/xattr_security.c
lustre/lmv/lmv_intent.c
lustre/mdc/mdc_locks.c
lustre/mdc/mdc_request.c
lustre/mdt/mdt_handler.c
lustre/mdt/mdt_internal.h
lustre/mdt/mdt_lib.c
lustre/mdt/mdt_open.c
lustre/ptlrpc/layout.c
lustre/tests/sanity-selinux.sh