X-Git-Url: https://git.whamcloud.com/?p=fs%2Flustre-release.git;a=blobdiff_plain;f=lustre%2Fptlrpc%2Fnodemap_handler.c;h=0443c3b45c822aa62a4cfb91148f496b4e6a7ce0;hp=59b17349259b351e66e55a0829fe4b015070f74f;hb=1f6cb3534e74f0c9462008c8088b5734b64ed41c;hpb=be7efb4ce06996444c08914305a73833a7123eeb

diff --git a/lustre/ptlrpc/nodemap_handler.c b/lustre/ptlrpc/nodemap_handler.c
index 59b1734..0443c3b 100644
--- a/lustre/ptlrpc/nodemap_handler.c
+++ b/lustre/ptlrpc/nodemap_handler.c
@@ -22,13 +22,13 @@
 /*
  * Copyright (C) 2013, Trustees of Indiana University
  *
- * Copyright (c) 2014, Intel Corporation.
+ * Copyright (c) 2017, Intel Corporation.
  *
  * Author: Joshua Walgenbach <jjw@iu.edu>
  */
 #include <linux/module.h>
 #include <linux/sort.h>
-#include <lnet/nidstr.h>
+#include <uapi/linux/lnet/nidstr.h>
 #include <lustre_net.h>
 #include <lustre_acl.h>
 #include <lustre_eacl.h>
@@ -71,9 +71,9 @@ static void nodemap_destroy(struct lu_nodemap *nodemap)
 	nm_member_reclassify_nodemap(nodemap);
 	up_read(&active_config->nmc_range_tree_lock);
 
-	write_lock(&nodemap->nm_idmap_lock);
+	down_write(&nodemap->nm_idmap_lock);
 	idmap_delete_tree(nodemap);
-	write_unlock(&nodemap->nm_idmap_lock);
+	up_write(&nodemap->nm_idmap_lock);
 
 	mutex_unlock(&active_config_lock);
 
@@ -265,7 +265,7 @@ struct lu_nodemap *nodemap_classify_nid(lnet_nid_t nid)
 
 	/* don't use 0@lo, use the first non-lo local NID instead */
 	if (LNET_NETTYP(LNET_NIDNET(nid)) == LOLND) {
-		lnet_process_id_t id;
+		struct lnet_process_id id;
 		int i = 0;
 
 		do {
@@ -448,28 +448,56 @@ EXPORT_SYMBOL(nodemap_del_member);
 /**
  * add an idmap to the proper nodemap trees
  *
- * \param	name		name of nodemap
+ * \param	nodemap		nodemap to add idmap to
  * \param	id_type		NODEMAP_UID or NODEMAP_GID
  * \param	map		array[2] __u32 containing the map values
  *				map[0] is client id
  *				map[1] is the filesystem id
  *
- * \retval	0 on success
+ * \retval	0	on success
+ * \retval	< 0	if error occurs
  */
 int nodemap_add_idmap_helper(struct lu_nodemap *nodemap,
 			     enum nodemap_id_type id_type,
 			     const __u32 map[2])
 {
 	struct lu_idmap		*idmap;
+	struct lu_idmap		*temp;
 	int			rc = 0;
 
 	idmap = idmap_create(map[0], map[1]);
 	if (idmap == NULL)
 		GOTO(out, rc = -ENOMEM);
 
-	write_lock(&nodemap->nm_idmap_lock);
-	idmap_insert(id_type, idmap, nodemap);
-	write_unlock(&nodemap->nm_idmap_lock);
+	down_write(&nodemap->nm_idmap_lock);
+	temp = idmap_insert(id_type, idmap, nodemap);
+	/* If the new id_client or id_fs is matched, the old idmap and its
+	 * index should be deleted according to its id_client before the new
+	 * idmap is added again.
+	 */
+	if (IS_ERR(temp))
+		GOTO(out_insert, rc = PTR_ERR(temp));
+	if (temp) {
+		__u32 del_map[2];
+
+		del_map[0] = temp->id_client;
+		idmap_delete(id_type, temp, nodemap);
+		rc = nodemap_idx_idmap_del(nodemap, id_type, del_map);
+		/* In case there is any corrupted idmap */
+		if (!rc || unlikely(rc == -ENOENT)) {
+			temp = idmap_insert(id_type, idmap, nodemap);
+			if (IS_ERR(temp))
+				rc = PTR_ERR(temp);
+			else if (!temp)
+				rc = 0;
+			else
+				rc = -EPERM;
+		}
+	}
+out_insert:
+	if (rc)
+		OBD_FREE_PTR(idmap);
+	up_write(&nodemap->nm_idmap_lock);
 	nm_member_revoke_locks(nodemap);
 
 out:
@@ -482,6 +510,8 @@ int nodemap_add_idmap(const char *name, enum nodemap_id_type id_type,
 	struct lu_nodemap	*nodemap = NULL;
 	int			 rc;
 
+	ENTRY;
+
 	mutex_lock(&active_config_lock);
 	nodemap = nodemap_lookup(name);
 	if (IS_ERR(nodemap)) {
@@ -500,7 +530,7 @@ int nodemap_add_idmap(const char *name, enum nodemap_id_type id_type,
 	nodemap_putref(nodemap);
 
 out:
-	return rc;
+	RETURN(rc);
 }
 EXPORT_SYMBOL(nodemap_add_idmap);
 
@@ -522,6 +552,8 @@ int nodemap_del_idmap(const char *name, enum nodemap_id_type id_type,
 	struct lu_idmap		*idmap = NULL;
 	int			rc = 0;
 
+	ENTRY;
+
 	mutex_lock(&active_config_lock);
 	nodemap = nodemap_lookup(name);
 	if (IS_ERR(nodemap)) {
@@ -532,7 +564,7 @@ int nodemap_del_idmap(const char *name, enum nodemap_id_type id_type,
 	if (is_default_nodemap(nodemap))
 		GOTO(out_putref, rc = -EINVAL);
 
-	write_lock(&nodemap->nm_idmap_lock);
+	down_write(&nodemap->nm_idmap_lock);
 	idmap = idmap_search(nodemap, NODEMAP_CLIENT_TO_FS, id_type,
 			     map[0]);
 	if (idmap == NULL) {
@@ -541,7 +573,7 @@ int nodemap_del_idmap(const char *name, enum nodemap_id_type id_type,
 		idmap_delete(id_type, idmap, nodemap);
 		rc = nodemap_idx_idmap_del(nodemap, id_type, map);
 	}
-	write_unlock(&nodemap->nm_idmap_lock);
+	up_write(&nodemap->nm_idmap_lock);
 
 out_putref:
 	mutex_unlock(&active_config_lock);
@@ -550,7 +582,7 @@ out_putref:
 	nodemap_putref(nodemap);
 
 out:
-	return rc;
+	RETURN(rc);
 }
 EXPORT_SYMBOL(nodemap_del_idmap);
 
@@ -615,7 +647,7 @@ EXPORT_SYMBOL(nodemap_get_from_exp);
  * is, return 0. Otherwise, return the squash uid or gid.
  *
  * if the nodemap is configured to trusted the ids from the client system, just
- * return the passwd id without mapping.
+ * return the passed id without mapping.
  *
  * if by this point, we haven't returned and the nodemap in question is the
  * default nodemap, return the squash uid or gid.
@@ -638,6 +670,12 @@ __u32 nodemap_map_id(struct lu_nodemap *nodemap,
 	if (unlikely(nodemap == NULL))
 		goto out;
 
+	if (nodemap->nmf_map_uid_only && id_type == NODEMAP_GID)
+		goto out;
+
+	if (nodemap->nmf_map_gid_only && id_type == NODEMAP_UID)
+		goto out;
+
 	if (id == 0) {
 		if (nodemap->nmf_allow_root_access)
 			goto out;
@@ -651,10 +689,10 @@ __u32 nodemap_map_id(struct lu_nodemap *nodemap,
 	if (is_default_nodemap(nodemap))
 		goto squash;
 
-	read_lock(&nodemap->nm_idmap_lock);
+	down_read(&nodemap->nm_idmap_lock);
 	idmap = idmap_search(nodemap, tree_type, id_type, id);
 	if (idmap == NULL) {
-		read_unlock(&nodemap->nm_idmap_lock);
+		up_read(&nodemap->nm_idmap_lock);
 		goto squash;
 	}
 
@@ -662,7 +700,7 @@ __u32 nodemap_map_id(struct lu_nodemap *nodemap,
 		found_id = idmap->id_client;
 	else
 		found_id = idmap->id_fs;
-	read_unlock(&nodemap->nm_idmap_lock);
+	up_read(&nodemap->nm_idmap_lock);
 	RETURN(found_id);
 
 squash:
@@ -690,22 +728,24 @@ ssize_t nodemap_map_acl(struct lu_nodemap *nodemap, void *buf, size_t size,
 			enum nodemap_tree_type tree_type)
 {
 	posix_acl_xattr_header	*header = buf;
-	posix_acl_xattr_entry	*entry = &header->a_entries[0];
+	posix_acl_xattr_entry	*entry = GET_POSIX_ACL_XATTR_ENTRY(header);
 	posix_acl_xattr_entry	*new_entry = entry;
 	posix_acl_xattr_entry	*end;
 	int			 count;
 
+	ENTRY;
+
 	if (!nodemap_active)
-		return size;
+		RETURN(size);
 
 	if (unlikely(nodemap == NULL))
-		return size;
+		RETURN(size);
 
 	count = posix_acl_xattr_count(size);
 	if (count < 0)
-		return -EINVAL;
+		RETURN(-EINVAL);
 	if (count == 0)
-		return 0;
+		RETURN(0);
 
 	for (end = entry + count; entry != end; entry++) {
 		__u16 tag = le16_to_cpu(entry->e_tag);
@@ -735,7 +775,7 @@ ssize_t nodemap_map_acl(struct lu_nodemap *nodemap, void *buf, size_t size,
 		new_entry++;
 	}
 
-	return (void *)new_entry - (void *)header;
+	RETURN((void *)new_entry - (void *)header);
 }
 EXPORT_SYMBOL(nodemap_map_acl);
 
@@ -822,7 +862,7 @@ EXPORT_SYMBOL(nodemap_add_range);
 /**
  * delete a range
  * \param	name		nodemap name
- * \param	range_str	string containing range
+ * \param	nid		nid range
  * \retval	0 on success
  *
  * Delete range from global range tree, and remove it
@@ -850,6 +890,10 @@ int nodemap_del_range(const char *name, const lnet_nid_t nid[2])
 		up_write(&active_config->nmc_range_tree_lock);
 		GOTO(out_putref, rc = -EINVAL);
 	}
+	if (range->rn_nodemap != nodemap) {
+		up_write(&active_config->nmc_range_tree_lock);
+		GOTO(out_putref, rc = -EINVAL);
+	}
 	rc = nodemap_idx_range_del(range);
 	range_delete(&active_config->nmc_range_tree, range);
 	nm_member_reclassify_nodemap(nodemap);
@@ -880,8 +924,20 @@ static int nodemap_set_fileset_helper(struct nodemap_config *config,
 {
 	int rc = 0;
 
-	/* we allow fileset = "" which means clear fileset info */
-	if (fileset == NULL || (fileset[0] != 0 && fileset[0] != '/'))
+	/* Allow 'fileset=clear' in addition to 'fileset=""' to clear fileset
+	 * because either command 'lctl set_param -P *.*.fileset=""' or
+	 * 'lctl nodemap_set_fileset --fileset ""' can only work correctly
+	 * on MGS, while on other servers, both commands will invoke upcall
+	 * "/usr/sbin/lctl set_param nodemap.default.fileset=" by function
+	 * process_param2_config(), which will cause "no value" error and
+	 * won't clear fileset.
+	 * 'fileset=""' is still kept for compatibility reason.
+	 */
+	if (fileset == NULL)
+		rc = -EINVAL;
+	else if (fileset[0] == '\0' || strcmp(fileset, "clear") == 0)
+		nodemap->nm_fileset[0] = '\0';
+	else if (fileset[0] != '/')
 		rc = -EINVAL;
 	else if (strlcpy(nodemap->nm_fileset, fileset,
 			 sizeof(nodemap->nm_fileset)) >=
@@ -903,11 +959,7 @@ int nodemap_set_fileset(const char *name, const char *fileset)
 		GOTO(out, rc = PTR_ERR(nodemap));
 	}
 
-	if (is_default_nodemap(nodemap))
-		rc = -EINVAL;
-	else
-		rc = nodemap_set_fileset_helper(active_config, nodemap,
-						fileset);
+	rc = nodemap_set_fileset_helper(active_config, nodemap, fileset);
 	mutex_unlock(&active_config_lock);
 
 	nodemap_putref(nodemap);
@@ -925,19 +977,124 @@ EXPORT_SYMBOL(nodemap_set_fileset);
  */
 char *nodemap_get_fileset(const struct lu_nodemap *nodemap)
 {
-	if (!nodemap_active || is_default_nodemap(nodemap))
+	if (!nodemap_active)
 		return NULL;
-	else
-		return (char *)nodemap->nm_fileset;
+
+	return (char *)nodemap->nm_fileset;
 }
 EXPORT_SYMBOL(nodemap_get_fileset);
 
+static int nodemap_validate_sepol(const char *sepol)
+{
+	char buf[LUSTRE_NODEMAP_SEPOL_LENGTH + 1];
+	char *p = (char *)sepol;
+	char *q = buf;
+	char polname[NAME_MAX + 1] = "";
+	char hash[SELINUX_POLICY_HASH_LEN + 1] = "";
+	unsigned char mode;
+	unsigned short ver;
+
+	CLASSERT(sizeof(buf) == sizeof(((struct lu_nodemap *)0)->nm_sepol));
+
+	if (sepol == NULL)
+		return -EINVAL;
+
+	/* we allow sepol = "" which means clear SELinux policy info */
+	if (sepol[0] == '\0')
+		return 0;
+
+	/* make a copy of sepol, by replacing ':' with space
+	 * so that we can use sscanf over the string
+	 */
+	while (p-sepol < sizeof(buf)) {
+		if (*p == ':')
+			*q = ' ';
+		else
+			*q = *p;
+		if (*p == '\0')
+			break;
+		p++;
+		q++;
+	}
+	if (p-sepol == sizeof(buf))
+		return -ENAMETOOLONG;
+
+	if (sscanf(buf, "%1hhu %s %hu %s", &mode, polname, &ver, hash) != 4)
+		return -EINVAL;
+
+	if (mode != 0 && mode != 1)
+		return -EINVAL;
+
+	return 0;
+}
+
+/**
+ * set SELinux policy on nodemap
+ * \param	name		nodemap to set SELinux policy info on
+ * \param	sepol		string containing SELinux policy info
+ * \retval	0 on success
+ *
+ * set SELinux policy info on the named nodemap
+ */
+int nodemap_set_sepol(const char *name, const char *sepol)
+{
+	struct lu_nodemap	*nodemap = NULL;
+	int			 rc;
+
+	rc = nodemap_validate_sepol(sepol);
+	if (rc < 0)
+		GOTO(out, rc);
+
+	mutex_lock(&active_config_lock);
+	nodemap = nodemap_lookup(name);
+	if (IS_ERR(nodemap)) {
+		mutex_unlock(&active_config_lock);
+		GOTO(out, rc = PTR_ERR(nodemap));
+	}
+
+	if (is_default_nodemap(nodemap)) {
+		/* We do not want nodes in the default nodemap to have
+		 * SELinux restrictions. Sec admin should create dedicated
+		 * nodemap entries for this.
+		 */
+		GOTO(out_putref, rc = -EINVAL);
+	}
+
+	/* truncation cannot happen, as string length was checked in
+	 * nodemap_validate_sepol()
+	 */
+	strlcpy(nodemap->nm_sepol, sepol, sizeof(nodemap->nm_sepol));
+
+out_putref:
+	mutex_unlock(&active_config_lock);
+	nodemap_putref(nodemap);
+out:
+	return rc;
+}
+EXPORT_SYMBOL(nodemap_set_sepol);
+
+/**
+ * get SELinux policy info defined on nodemap
+ * \param	nodemap		nodemap to get SELinux policy info from
+ * \retval	SELinux policy info, or NULL if not defined or not activated
+ *
+ * get the SELinux policy info defined on the nodemap
+ */
+const char *nodemap_get_sepol(const struct lu_nodemap *nodemap)
+{
+	if (is_default_nodemap(nodemap))
+		return NULL;
+	else
+		return (char *)nodemap->nm_sepol;
+}
+EXPORT_SYMBOL(nodemap_get_sepol);
+
 /**
  * Nodemap constructor
  *
  * Creates an lu_nodemap structure and assigns sane default
  * member values. If this is the default nodemap, the defaults
- * are the most restictive in xterms of mapping behavior. Otherwise
+ * are the most restrictive in terms of mapping behavior. Otherwise
  * the default flags should be inherited from the default nodemap.
  * The adds nodemap to nodemap_hash.
  *
@@ -958,6 +1115,7 @@ struct lu_nodemap *nodemap_create(const char *name,
 	struct lu_nodemap	*default_nodemap;
 	struct cfs_hash		*hash = config->nmc_nodemap_hash;
 	int			 rc = 0;
+	ENTRY;
 
 	default_nodemap = config->nmc_default_nodemap;
 
@@ -994,7 +1152,7 @@ struct lu_nodemap *nodemap_create(const char *name,
 	INIT_LIST_HEAD(&nodemap->nm_member_list);
 
 	mutex_init(&nodemap->nm_member_list_lock);
-	rwlock_init(&nodemap->nm_idmap_lock);
+	init_rwsem(&nodemap->nm_idmap_lock);
 	nodemap->nm_fs_to_client_uidmap = RB_ROOT;
 	nodemap->nm_client_to_fs_uidmap = RB_ROOT;
 	nodemap->nm_fs_to_client_gidmap = RB_ROOT;
@@ -1012,9 +1170,14 @@ struct lu_nodemap *nodemap_create(const char *name,
 		nodemap->nmf_trust_client_ids = 0;
 		nodemap->nmf_allow_root_access = 0;
 		nodemap->nmf_deny_unknown = 0;
+		nodemap->nmf_map_uid_only = 0;
+		nodemap->nmf_map_gid_only = 0;
+		nodemap->nmf_enable_audit = 1;
 
 		nodemap->nm_squash_uid = NODEMAP_NOBODY_UID;
 		nodemap->nm_squash_gid = NODEMAP_NOBODY_GID;
+		nodemap->nm_fileset[0] = '\0';
+		nodemap->nm_sepol[0] = '\0';
 		if (!is_default)
 			CWARN("adding nodemap '%s' to config without"
 			      " default nodemap\n", nodemap->nm_name);
@@ -1025,17 +1188,24 @@ struct lu_nodemap *nodemap_create(const char *name,
 				default_nodemap->nmf_allow_root_access;
 		nodemap->nmf_deny_unknown =
 				default_nodemap->nmf_deny_unknown;
+		nodemap->nmf_map_uid_only =
+				default_nodemap->nmf_map_uid_only;
+		nodemap->nmf_map_gid_only =
+				default_nodemap->nmf_map_gid_only;
+		nodemap->nmf_enable_audit =
+			default_nodemap->nmf_enable_audit;
 
 		nodemap->nm_squash_uid = default_nodemap->nm_squash_uid;
 		nodemap->nm_squash_gid = default_nodemap->nm_squash_gid;
-		nodemap->nm_fileset[0] = 0;
+		nodemap->nm_fileset[0] = '\0';
+		nodemap->nm_sepol[0] = '\0';
 	}
 
-	return nodemap;
+	RETURN(nodemap);
 
 out:
 	CERROR("cannot add nodemap: '%s': rc = %d\n", name, rc);
-	return ERR_PTR(rc);
+	RETURN(ERR_PTR(rc));
 }
 
 /**
@@ -1123,6 +1293,42 @@ out:
 }
 EXPORT_SYMBOL(nodemap_set_trust_client_ids);
 
+int nodemap_set_mapping_mode(const char *name, enum nodemap_mapping_modes mode)
+{
+	struct lu_nodemap	*nodemap = NULL;
+	int			rc = 0;
+
+	mutex_lock(&active_config_lock);
+	nodemap = nodemap_lookup(name);
+	mutex_unlock(&active_config_lock);
+	if (IS_ERR(nodemap))
+		GOTO(out, rc = PTR_ERR(nodemap));
+
+	switch (mode) {
+	case NODEMAP_MAP_BOTH:
+		nodemap->nmf_map_uid_only = 0;
+		nodemap->nmf_map_gid_only = 0;
+		break;
+	case NODEMAP_MAP_UID_ONLY:
+		nodemap->nmf_map_uid_only = 1;
+		nodemap->nmf_map_gid_only = 0;
+		break;
+	case NODEMAP_MAP_GID_ONLY:
+		nodemap->nmf_map_uid_only = 0;
+		nodemap->nmf_map_gid_only = 1;
+		break;
+	default:
+		CWARN("cannot set unknown mapping mode, mode = %d\n", mode);
+	}
+	rc = nodemap_idx_nodemap_update(nodemap);
+
+	nm_member_revoke_locks(nodemap);
+	nodemap_putref(nodemap);
+out:
+	return rc;
+}
+EXPORT_SYMBOL(nodemap_set_mapping_mode);
+
 /**
  * Update the squash_uid for a nodemap.
  *
@@ -1202,6 +1408,35 @@ bool nodemap_can_setquota(const struct lu_nodemap *nodemap)
 EXPORT_SYMBOL(nodemap_can_setquota);
 
 /**
+ * Set the nmf_enable_audit flag to true or false.
+ * \param	name		nodemap name
+ * \param	audit_mode	if true, allow audit
+ * \retval	0 on success
+ *
+ */
+int nodemap_set_audit_mode(const char *name, bool enable_audit)
+{
+	struct lu_nodemap	*nodemap = NULL;
+	int			rc = 0;
+
+	mutex_lock(&active_config_lock);
+	nodemap = nodemap_lookup(name);
+	mutex_unlock(&active_config_lock);
+	if (IS_ERR(nodemap))
+		GOTO(out, rc = PTR_ERR(nodemap));
+
+	nodemap->nmf_enable_audit = enable_audit;
+	rc = nodemap_idx_nodemap_update(nodemap);
+
+	nm_member_revoke_locks(nodemap);
+	nodemap_putref(nodemap);
+out:
+	return rc;
+}
+EXPORT_SYMBOL(nodemap_set_audit_mode);
+
+
+/**
  * Add a nodemap
  *
  * \param	name		name of nodemap