Land b_head_quota onto HEAD (20081116_0105)

[fs/lustre-release.git] / lustre / mdt / mdt_lib.c

diff --git a/lustre/mdt/mdt_lib.c b/lustre/mdt/mdt_lib.c
index c2abdf1..d3bbed9 100644 (file)
--- a/lustre/mdt/mdt_lib.c
+++ b/lustre/mdt/mdt_lib.c
@@ -92,12 +92,12 @@ static int new_init_ucred(struct mdt_thread_info *info, ucred_init_type_t type,
                           void *buf)
 {
         struct ptlrpc_request   *req = mdt_info_req(info);
-        struct mdt_export_data  *med = mdt_req2med(req);
         struct mdt_device       *mdt = info->mti_mdt;
         struct ptlrpc_user_desc *pud = req->rq_user_desc;
         struct md_ucred         *ucred = mdt_ucred(info);
         lnet_nid_t               peernid = req->rq_peer.nid;
         __u32                    perm = 0;
+        __u32                    remote = exp_connect_rmtclient(info->mti_exp);
         int                      setuid;
         int                      setgid;
         int                      rc = 0;
@@ -123,7 +123,7 @@ static int new_init_ucred(struct mdt_thread_info *info, ucred_init_type_t type,
         }
 
         /* sanity check: we expect the uid which client claimed is true */
-        if (med->med_rmtclient) {
+        if (remote) {
                 if (req->rq_auth_mapped_uid == INVALID_UID) {
                         CDEBUG(D_SEC, "remote user not mapped, deny access!\n");
                         RETURN(-EACCES);
@@ -153,7 +153,7 @@ static int new_init_ucred(struct mdt_thread_info *info, ucred_init_type_t type,
         }
 
         if (is_identity_get_disabled(mdt->mdt_identity_cache)) {
-                if (med->med_rmtclient) {
+                if (remote) {
                         CDEBUG(D_SEC, "remote client must run with identity_get "
                                "enabled!\n");
                         RETURN(-EACCES);
@@ -169,7 +169,7 @@ static int new_init_ucred(struct mdt_thread_info *info, ucred_init_type_t type,
                                             pud->pud_uid);
                 if (IS_ERR(identity)) {
                         if (unlikely(PTR_ERR(identity) == -EREMCHG &&
-                                     !med->med_rmtclient)) {
+                                     !remote)) {
                                 ucred->mu_identity = NULL;
                                 perm = CFS_SETUID_PERM | CFS_SETGID_PERM |
                                        CFS_SETGRP_PERM;
@@ -181,8 +181,7 @@ static int new_init_ucred(struct mdt_thread_info *info, ucred_init_type_t type,
                 } else {
                         ucred->mu_identity = identity;
                         perm = mdt_identity_get_perm(ucred->mu_identity,
-                                                     med->med_rmtclient,
-                                                     peernid);
+                                                     remote, peernid);
                 }
         }
 
@@ -211,7 +210,7 @@ static int new_init_ucred(struct mdt_thread_info *info, ucred_init_type_t type,
         /*
          * NB: remote client not allowed to setgroups anyway.
          */
-        if (!med->med_rmtclient && perm & CFS_SETGRP_PERM) {
+        if (!remote && perm & CFS_SETGRP_PERM) {
                 if (pud->pud_ngroups) {
                         /* setgroups for local client */
                         ucred->mu_ginfo = groups_alloc(pud->pud_ngroups);
@@ -241,11 +240,14 @@ static int new_init_ucred(struct mdt_thread_info *info, ucred_init_type_t type,
         /* XXX: need to process root_squash here. */
         mdt_root_squash(info);
 
-        /* remove fs privilege for non-root user */
+        /* remove fs privilege for non-root user. */
         if (ucred->mu_fsuid)
                 ucred->mu_cap = pud->pud_cap & ~CFS_CAP_FS_MASK;
         else
                 ucred->mu_cap = pud->pud_cap;
+        if (remote && !(perm & CFS_RMTOWN_PERM))
+                ucred->mu_cap &= ~(CFS_CAP_SYS_RESOURCE_MASK |
+                                   CFS_CAP_CHOWN_MASK);
         ucred->mu_valid = UCRED_NEW;
 
         EXIT;
@@ -269,13 +271,13 @@ out:
 int mdt_check_ucred(struct mdt_thread_info *info)
 {
         struct ptlrpc_request   *req = mdt_info_req(info);
-        struct mdt_export_data  *med = mdt_req2med(req);
         struct mdt_device       *mdt = info->mti_mdt;
         struct ptlrpc_user_desc *pud = req->rq_user_desc;
         struct md_ucred         *ucred = mdt_ucred(info);
         struct md_identity      *identity = NULL;
         lnet_nid_t               peernid = req->rq_peer.nid;
         __u32                    perm = 0;
+        __u32                    remote = exp_connect_rmtclient(info->mti_exp);
         int                      setuid;
         int                      setgid;
         int                      rc = 0;
@@ -290,7 +292,7 @@ int mdt_check_ucred(struct mdt_thread_info *info)
 
         /* sanity check: if we use strong authentication, we expect the
          * uid which client claimed is true */
-        if (med->med_rmtclient) {
+        if (remote) {
                 if (req->rq_auth_mapped_uid == INVALID_UID) {
                         CDEBUG(D_SEC, "remote user not mapped, deny access!\n");
                         RETURN(-EACCES);
@@ -320,7 +322,7 @@ int mdt_check_ucred(struct mdt_thread_info *info)
         }
 
         if (is_identity_get_disabled(mdt->mdt_identity_cache)) {
-                if (med->med_rmtclient) {
+                if (remote) {
                         CDEBUG(D_SEC, "remote client must run with identity_get "
                                "enabled!\n");
                         RETURN(-EACCES);
@@ -331,7 +333,7 @@ int mdt_check_ucred(struct mdt_thread_info *info)
         identity = mdt_identity_get(mdt->mdt_identity_cache, pud->pud_uid);
         if (IS_ERR(identity)) {
                 if (unlikely(PTR_ERR(identity) == -EREMCHG &&
-                             !med->med_rmtclient)) {
+                             !remote)) {
                         RETURN(0);
                 } else {
                         CDEBUG(D_SEC, "Deny access without identity: uid %u\n",
@@ -340,7 +342,7 @@ int mdt_check_ucred(struct mdt_thread_info *info)
                }
         }
 
-        perm = mdt_identity_get_perm(identity, med->med_rmtclient, peernid);
+        perm = mdt_identity_get_perm(identity, remote, peernid);
         /* find out the setuid/setgid attempt */
         setuid = (pud->pud_uid != pud->pud_fsuid);
         setgid = (pud->pud_gid != pud->pud_fsgid ||
@@ -404,7 +406,7 @@ static int old_init_ucred(struct mdt_thread_info *info,
         /* XXX: need to process root_squash here. */
         mdt_root_squash(info);
 
-        /* remove fs privilege for non-root user */
+        /* remove fs privilege for non-root user. */
         if (uc->mu_fsuid)
                 uc->mu_cap = body->capability & ~CFS_CAP_FS_MASK;
         else
@@ -444,7 +446,7 @@ static int old_init_ucred_reint(struct mdt_thread_info *info)
         /* XXX: need to process root_squash here. */
         mdt_root_squash(info);
 
-        /* remove fs privilege for non-root user */
+        /* remove fs privilege for non-root user. */
         if (uc->mu_fsuid)
                 uc->mu_cap &= ~CFS_CAP_FS_MASK;
         uc->mu_valid = UCRED_OLD;
@@ -571,6 +573,7 @@ int mdt_handle_last_unlink(struct mdt_thread_info *info, struct mdt_object *mo,
 {
         struct mdt_body       *repbody;
         const struct lu_attr *la = &ma->ma_attr;
+        int rc;
         ENTRY;
 
         repbody = req_capsule_server_get(info->mti_pill, &RMF_MDT_BODY);
@@ -605,6 +608,21 @@ int mdt_handle_last_unlink(struct mdt_thread_info *info, struct mdt_object *mo,
                 repbody->valid |= OBD_MD_FLCOOKIE;
         }
 
+        if (info->mti_mdt->mdt_opts.mo_oss_capa &&
+            info->mti_exp->exp_connect_flags & OBD_CONNECT_OSS_CAPA &&
+            repbody->valid & OBD_MD_FLEASIZE) {
+                struct lustre_capa *capa;
+
+                capa = req_capsule_server_get(info->mti_pill, &RMF_CAPA2);
+                LASSERT(capa);
+                capa->lc_opc = CAPA_OPC_OSS_DESTROY;
+                rc = mo_capa_get(info->mti_env, mdt_object_child(mo), capa, 0);
+                if (rc)
+                        RETURN(rc);
+
+                repbody->valid |= OBD_MD_FLOSSCAPA;
+        }
+
         RETURN(0);
 }