LU-3289 gss: Add Shared key and GSS Null functionality

[fs/lustre-release.git] / lustre / mdt / mdt_lib.c

diff --git a/lustre/mdt/mdt_lib.c b/lustre/mdt/mdt_lib.c
index 6d03fee..d6dacde 100644 (file)
--- a/lustre/mdt/mdt_lib.c
+++ b/lustre/mdt/mdt_lib.c
@@ -195,7 +195,8 @@ static int new_init_ucred(struct mdt_thread_info *info, ucred_init_type_t type,
                         RETURN(-EACCES);
                 }
         } else {
-                if (req->rq_auth_uid != pud->pud_uid) {
+               if (!flvr_is_rootonly(req->rq_flvr.sf_rpc) &&
+                   req->rq_auth_uid != pud->pud_uid) {
                         CDEBUG(D_SEC, "local client %s: auth uid %u "
                                "while client claims %u:%u/%u:%u\n",
                                libcfs_nid2str(peernid), req->rq_auth_uid,
@@ -403,7 +404,8 @@ int mdt_check_ucred(struct mdt_thread_info *info)
                         RETURN(-EACCES);
                 }
         } else {
-                if (req->rq_auth_uid != pud->pud_uid) {
+               if (!flvr_is_rootonly(req->rq_flvr.sf_rpc) &&
+                   req->rq_auth_uid != pud->pud_uid) {
                         CDEBUG(D_SEC, "local client %s: auth uid %u "
                                "while client claims %u:%u/%u:%u\n",
                                libcfs_nid2str(peernid), req->rq_auth_uid,
@@ -464,19 +466,19 @@ out:
 }
 
 static int old_init_ucred_common(struct mdt_thread_info *info,
-                                 bool drop_fs_cap)
+                                struct lu_nodemap *nodemap,
+                                bool drop_fs_cap)
 {
        struct lu_ucred         *uc = mdt_ucred(info);
        struct mdt_device       *mdt = info->mti_mdt;
        struct md_identity      *identity = NULL;
-       struct lu_nodemap       *nodemap =
-               info->mti_exp->exp_target_data.ted_nodemap;
 
        if (!is_identity_get_disabled(mdt->mdt_identity_cache)) {
                identity = mdt_identity_get(mdt->mdt_identity_cache,
                                            uc->uc_fsuid);
                if (IS_ERR(identity)) {
-                       if (unlikely(PTR_ERR(identity) == -EREMCHG)) {
+                       if (unlikely(PTR_ERR(identity) == -EREMCHG ||
+                                    uc->uc_cap & CFS_CAP_FS_MASK)) {
                                identity = NULL;
                        } else {
                                CDEBUG(D_SEC, "Deny access without identity: "
@@ -487,12 +489,7 @@ static int old_init_ucred_common(struct mdt_thread_info *info,
        }
        uc->uc_identity = identity;
 
-       if (nodemap == NULL) {
-               CERROR("%s: cli %s/%p nodemap not set.\n",
-                     mdt2obd_dev(mdt)->obd_name,
-                     info->mti_exp->exp_client_uuid.uuid, info->mti_exp);
-               RETURN(-EACCES);
-       } else if (uc->uc_o_uid == nodemap->nm_squash_uid) {
+       if (nodemap && uc->uc_o_uid == nodemap->nm_squash_uid) {
                uc->uc_fsuid = nodemap->nm_squash_uid;
                uc->uc_fsgid = nodemap->nm_squash_gid;
                uc->uc_cap = 0;
@@ -504,7 +501,7 @@ static int old_init_ucred_common(struct mdt_thread_info *info,
        mdt_root_squash(info, mdt_info_req(info)->rq_peer.nid);
 
        /* remove fs privilege for non-root user. */
-       if (uc->uc_fsuid)
+       if (uc->uc_fsuid && drop_fs_cap)
                uc->uc_cap &= ~CFS_CAP_FS_MASK;
        uc->uc_valid = UCRED_OLD;
        ucred_set_jobid(info, uc);
@@ -515,12 +512,15 @@ static int old_init_ucred_common(struct mdt_thread_info *info,
 static int old_init_ucred(struct mdt_thread_info *info,
                          struct mdt_body *body, bool drop_fs_cap)
 {
-       struct lu_ucred         *uc = mdt_ucred(info);
-       struct lu_nodemap       *nodemap =
-               info->mti_exp->exp_target_data.ted_nodemap;
-       int                      rc;
+       struct lu_ucred *uc = mdt_ucred(info);
+       struct lu_nodemap *nodemap;
+       int rc;
        ENTRY;
 
+       nodemap = nodemap_get_from_exp(info->mti_exp);
+       if (IS_ERR(nodemap))
+               RETURN(PTR_ERR(nodemap));
+
        body->mbo_uid = nodemap_map_id(nodemap, NODEMAP_UID,
                                       NODEMAP_CLIENT_TO_FS, body->mbo_uid);
        body->mbo_gid = nodemap_map_id(nodemap, NODEMAP_GID,
@@ -541,19 +541,23 @@ static int old_init_ucred(struct mdt_thread_info *info,
        uc->uc_ginfo = NULL;
        uc->uc_cap = body->mbo_capability;
 
-       rc = old_init_ucred_common(info, drop_fs_cap);
+       rc = old_init_ucred_common(info, nodemap, drop_fs_cap);
+       nodemap_putref(nodemap);
 
        RETURN(rc);
 }
 
 static int old_init_ucred_reint(struct mdt_thread_info *info)
 {
-       struct lu_ucred         *uc = mdt_ucred(info);
-       struct lu_nodemap       *nodemap =
-               info->mti_exp->exp_target_data.ted_nodemap;
-       int                      rc;
+       struct lu_ucred *uc = mdt_ucred(info);
+       struct lu_nodemap *nodemap;
+       int rc;
        ENTRY;
 
+       nodemap = nodemap_get_from_exp(info->mti_exp);
+       if (IS_ERR(nodemap))
+               RETURN(PTR_ERR(nodemap));
+
        LASSERT(uc != NULL);
 
        uc->uc_fsuid = nodemap_map_id(nodemap, NODEMAP_UID,
@@ -566,7 +570,8 @@ static int old_init_ucred_reint(struct mdt_thread_info *info)
        uc->uc_o_gid = uc->uc_o_fsgid = uc->uc_gid = uc->uc_fsgid;
        uc->uc_ginfo = NULL;
 
-       rc = old_init_ucred_common(info, true); /* drop_fs_cap = true */
+       rc = old_init_ucred_common(info, nodemap, true); /* drop_fs_cap=true */
+       nodemap_putref(nodemap);
 
        RETURN(rc);
 }
@@ -911,8 +916,7 @@ static int mdt_setattr_unpack_rec(struct mdt_thread_info *info)
        struct req_capsule      *pill = info->mti_pill;
        struct mdt_reint_record *rr = &info->mti_rr;
        struct mdt_rec_setattr  *rec;
-       struct lu_nodemap       *nodemap =
-               info->mti_exp->exp_target_data.ted_nodemap;
+       struct lu_nodemap       *nodemap;
         ENTRY;
 
         CLASSERT(sizeof(struct mdt_rec_setattr)== sizeof(struct mdt_rec_reint));
@@ -931,10 +935,17 @@ static int mdt_setattr_unpack_rec(struct mdt_thread_info *info)
        la->la_valid = mdt_attr_valid_xlate(rec->sa_valid, rr, ma);
        la->la_mode  = rec->sa_mode;
        la->la_flags = rec->sa_attr_flags;
+
+       nodemap = nodemap_get_from_exp(info->mti_exp);
+       if (IS_ERR(nodemap))
+               RETURN(PTR_ERR(nodemap));
+
        la->la_uid   = nodemap_map_id(nodemap, NODEMAP_UID,
                                      NODEMAP_CLIENT_TO_FS, rec->sa_uid);
        la->la_gid   = nodemap_map_id(nodemap, NODEMAP_GID,
                                      NODEMAP_CLIENT_TO_FS, rec->sa_gid);
+       nodemap_putref(nodemap);
+
        la->la_size  = rec->sa_size;
        la->la_blocks = rec->sa_blocks;
        la->la_ctime = rec->sa_ctime;