LU-6698 kernel: kernel update RHEL 6.6 [2.6.32-504.23.4.el6]

[fs/lustre-release.git] / lustre / mdd / mdd_permission.c

diff --git a/lustre/mdd/mdd_permission.c b/lustre/mdd/mdd_permission.c
index 0bbd5e0..f082d41 100644 (file)
--- a/lustre/mdd/mdd_permission.c
+++ b/lustre/mdd/mdd_permission.c
@@ -27,7 +27,7 @@
  * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
  * Use is subject to license terms.
  *
- * Copyright (c) 2012, 2013, Intel Corporation.
+ * Copyright (c) 2012, 2014, Intel Corporation.
  */
 /*
  * This file is part of Lustre, http://www.lustre.org/
@@ -69,7 +69,7 @@ int mdd_acl_chmod(const struct lu_env *env, struct mdd_object *o, __u32 mode,
        buf = mdd_buf_get(env, mdd_env_info(env)->mti_xattr_buf,
                          sizeof(mdd_env_info(env)->mti_xattr_buf));
 
-       rc = mdo_xattr_get(env, o, buf, XATTR_NAME_ACL_ACCESS, BYPASS_CAPA);
+       rc = mdo_xattr_get(env, o, buf, XATTR_NAME_ACL_ACCESS);
        if ((rc == -EOPNOTSUPP) || (rc == -ENODATA))
                RETURN(0);
        else if (rc <= 0)
@@ -88,7 +88,7 @@ int mdd_acl_chmod(const struct lu_env *env, struct mdd_object *o, __u32 mode,
                RETURN(rc);
 
        rc = mdo_xattr_set(env, o, buf, XATTR_NAME_ACL_ACCESS,
-                          0, handle, BYPASS_CAPA);
+                          0, handle);
        RETURN(rc);
 }
 
@@ -148,16 +148,14 @@ int mdd_acl_set(const struct lu_env *env, struct mdd_object *obj,
        /* whether ACL can be represented by i_mode only */
        if (not_equiv)
                rc = mdo_xattr_set(env, obj, buf, XATTR_NAME_ACL_ACCESS, fl,
-                               handle, mdd_object_capa(env, obj));
+                                  handle);
        else
-               rc = mdo_xattr_del(env, obj, XATTR_NAME_ACL_ACCESS, handle,
-                               mdd_object_capa(env, obj));
+               rc = mdo_xattr_del(env, obj, XATTR_NAME_ACL_ACCESS, handle);
        if (rc)
                GOTO(unlock, rc);
 
        if (mode_change)
-               rc = mdo_attr_set(env, obj, la, handle,
-                               mdd_object_capa(env, obj));
+               rc = mdo_attr_set(env, obj, la, handle);
 
        /* security-replated changes may require sync */
        if (S_ISDIR(mdd_object_type(obj)))
@@ -217,8 +215,7 @@ static int mdd_check_acl(const struct lu_env *env, struct mdd_object *obj,
 
        buf = mdd_buf_get(env, mdd_env_info(env)->mti_xattr_buf,
                          sizeof(mdd_env_info(env)->mti_xattr_buf));
-       rc = mdo_xattr_get(env, obj, buf, XATTR_NAME_ACL_ACCESS,
-                          mdd_object_capa(env, obj));
+       rc = mdo_xattr_get(env, obj, buf, XATTR_NAME_ACL_ACCESS);
        if (rc <= 0)
                RETURN(rc ? : -EACCES);
 
@@ -241,15 +238,15 @@ static int mdd_check_acl(const struct lu_env *env, struct mdd_object *obj,
 }
 
 int __mdd_permission_internal(const struct lu_env *env, struct mdd_object *obj,
-                               const struct lu_attr *la, int mask, int role)
+                             const struct lu_attr *la, int mask, int role)
 {
        struct lu_ucred *uc = lu_ucred(env);
-        __u32 mode;
-        int rc;
-        ENTRY;
+       __u32 mode;
+       int rc;
+       ENTRY;
 
-        if (mask == 0)
-                RETURN(0);
+       if (mask == 0)
+               RETURN(0);
 
        /* These means unnecessary for permission check */
        if ((uc == NULL) || (uc->uc_valid == UCRED_INIT))
@@ -259,15 +256,15 @@ int __mdd_permission_internal(const struct lu_env *env, struct mdd_object *obj,
        if (uc->uc_valid == UCRED_INVALID)
                RETURN(-EACCES);
 
-        /*
-         * Nobody gets write access to an immutable file.
-         */
-        if ((mask & MAY_WRITE) && mdd_is_immutable(obj))
-                RETURN(-EACCES);
+       /*
+        * Nobody gets write access to an immutable file.
+        */
+       if (mask & MAY_WRITE && la->la_flags & LUSTRE_IMMUTABLE_FL)
+               RETURN(-EACCES);
 
        LASSERT(la != NULL);
 
-        mode = la->la_mode;
+       mode = la->la_mode;
        if (uc->uc_fsuid == la->la_uid) {
                mode >>= 6;
         } else {
@@ -301,6 +298,9 @@ check_capabilities:
                if (md_capable(uc, CFS_CAP_DAC_READ_SEARCH))
                        RETURN(0);
 
+       CDEBUG(D_SEC, "permission denied, mode %x, fsuid %u, uid %u\n",
+              la->la_mode, uc->uc_fsuid, la->la_uid);
+
        RETURN(-EACCES);
 }
 
@@ -326,13 +326,13 @@ int mdd_permission(const struct lu_env *env,
        if (pobj != NULL) {
                mdd_pobj = md2mdd_obj(pobj);
                pattr = MDD_ENV_VAR(env, pattr);
-               rc = mdd_la_get(env, mdd_pobj, pattr, BYPASS_CAPA);
+               rc = mdd_la_get(env, mdd_pobj, pattr);
                if (rc)
                        RETURN(rc);
        }
 
        mdd_cobj = md2mdd_obj(cobj);
-       rc = mdd_la_get(env, mdd_cobj, cattr, BYPASS_CAPA);
+       rc = mdd_la_get(env, mdd_cobj, cattr);
        if (rc)
                RETURN(rc);
 
@@ -396,23 +396,3 @@ int mdd_permission(const struct lu_env *env,
 
         RETURN(rc);
 }
-
-int mdd_capa_get(const struct lu_env *env, struct md_object *obj,
-                 struct lustre_capa *capa, int renewal)
-{
-        struct mdd_object *mdd_obj = md2mdd_obj(obj);
-        struct obd_capa *oc;
-        int rc = 0;
-        ENTRY;
-
-        oc = mdo_capa_get(env, mdd_obj, renewal ? capa : NULL,
-                          capa->lc_opc);
-        if (IS_ERR(oc)) {
-                rc = PTR_ERR(oc);
-        } else if (likely(oc != NULL)) {
-                capa_cpy(capa, oc);
-                capa_put(oc);
-        }
-
-        RETURN(rc);
-}