projects/linux·blob master · refs

1303 lines · 31.4 KiB

1// SPDX-License-Identifier: GPL-2.0-only
2/*
3 * Copyright (C) 2002,2003 by Andreas Gruenbacher <[email protected]>
4 *
5 * Fixes from William Schumacher incorporated on 15 March 2001.
6 * (Reported by Charles Bertsch, <[email protected]>).
7 */
8
9/*
10 * This file contains generic functions for manipulating
11 * POSIX 1003.1e draft standard 17 ACLs.
12 */
13
14#include <linux/kernel.h>
15#include <linux/slab.h>
16#include <linux/atomic.h>
17#include <linux/fs.h>
18#include <linux/sched.h>
19#include <linux/cred.h>
20#include <linux/posix_acl.h>
21#include <linux/posix_acl_xattr.h>
22#include <linux/xattr.h>
23#include <linux/export.h>
24#include <linux/user_namespace.h>
25#include <linux/namei.h>
26#include <linux/mnt_idmapping.h>
27#include <linux/iversion.h>
28#include <linux/security.h>
29#include <linux/fsnotify.h>
30#include <linux/filelock.h>
31
32#include "internal.h"
33
34static struct posix_acl **acl_by_type(struct inode *inode, int type)
35{
36 switch (type) {
37 case ACL_TYPE_ACCESS:
38 return &inode->i_acl;
39 case ACL_TYPE_DEFAULT:
40 return &inode->i_default_acl;
41 default:
42 BUG();
43 }
44}
45
46struct posix_acl *get_cached_acl(struct inode *inode, int type)
47{
48 struct posix_acl **p = acl_by_type(inode, type);
49 struct posix_acl *acl;
50
51 for (;;) {
52 rcu_read_lock();
53 acl = rcu_dereference(*p);
54 if (!acl || is_uncached_acl(acl) ||
55 refcount_inc_not_zero(&acl->a_refcount))
56 break;
57 rcu_read_unlock();
58 cpu_relax();
59 }
60 rcu_read_unlock();
61 return acl;
62}
63EXPORT_SYMBOL(get_cached_acl);
64
65struct posix_acl *get_cached_acl_rcu(struct inode *inode, int type)
66{
67 struct posix_acl *acl = rcu_dereference(*acl_by_type(inode, type));
68
69 if (acl == ACL_DONT_CACHE) {
70 struct posix_acl *ret;
71
72 ret = inode->i_op->get_inode_acl(inode, type, LOOKUP_RCU);
73 if (!IS_ERR(ret))
74 acl = ret;
75 }
76
77 return acl;
78}
79EXPORT_SYMBOL(get_cached_acl_rcu);
80
81void set_cached_acl(struct inode *inode, int type, struct posix_acl *acl)
82{
83 struct posix_acl **p = acl_by_type(inode, type);
84 struct posix_acl *old;
85
86 old = xchg(p, posix_acl_dup(acl));
87 if (!is_uncached_acl(old))
88 posix_acl_release(old);
89}
90EXPORT_SYMBOL(set_cached_acl);
91
92static void __forget_cached_acl(struct posix_acl **p)
93{
94 struct posix_acl *old;
95
96 /*
97 * ACL_DONT_CACHE is expected to be a "const" value and xchg it with
98 * ACL_NOT_CACHED would enable acl caching for the inode -
99 * clearly not what the caller has intended.
100 */
101 if (READ_ONCE(*p) == ACL_DONT_CACHE)
102 return;
103 old = xchg(p, ACL_NOT_CACHED);
104 if (!is_uncached_acl(old))
105 posix_acl_release(old);
106}
107
108void forget_cached_acl(struct inode *inode, int type)
109{
110 __forget_cached_acl(acl_by_type(inode, type));
111}
112EXPORT_SYMBOL(forget_cached_acl);
113
114void forget_all_cached_acls(struct inode *inode)
115{
116 __forget_cached_acl(&inode->i_acl);
117 __forget_cached_acl(&inode->i_default_acl);
118}
119EXPORT_SYMBOL(forget_all_cached_acls);
120
121static struct posix_acl *__get_acl(const struct mnt_idmap *idmap,
122 struct dentry *dentry, struct inode *inode,
123 int type)
124{
125 struct posix_acl *sentinel;
126 struct posix_acl **p;
127 struct posix_acl *acl;
128
129 /*
130 * The sentinel is used to detect when another operation like
131 * set_cached_acl() or forget_cached_acl() races with get_inode_acl().
132 * It is guaranteed that is_uncached_acl(sentinel) is true.
133 */
134
135 acl = get_cached_acl(inode, type);
136 if (!is_uncached_acl(acl))
137 return acl;
138
139 if (!IS_POSIXACL(inode))
140 return NULL;
141
142 sentinel = uncached_acl_sentinel(current);
143 p = acl_by_type(inode, type);
144
145 /*
146 * If the ACL isn't being read yet, set our sentinel. Otherwise, the
147 * current value of the ACL will not be ACL_NOT_CACHED and so our own
148 * sentinel will not be set; another task will update the cache. We
149 * could wait for that other task to complete its job, but it's easier
150 * to just call ->get_inode_acl to fetch the ACL ourself. (This is
151 * going to be an unlikely race.)
152 */
153 cmpxchg(p, ACL_NOT_CACHED, sentinel);
154
155 /*
156 * Normally, the ACL returned by ->get{_inode}_acl will be cached.
157 * A filesystem can prevent that by calling
158 * forget_cached_acl(inode, type) in ->get{_inode}_acl.
159 *
160 * If the filesystem doesn't have a get{_inode}_ acl() function at all,
161 * we'll just create the negative cache entry.
162 */
163 if (dentry && inode->i_op->get_acl) {
164 acl = inode->i_op->get_acl(idmap, dentry, type);
165 } else if (inode->i_op->get_inode_acl) {
166 acl = inode->i_op->get_inode_acl(inode, type, false);
167 } else {
168 set_cached_acl(inode, type, NULL);
169 return NULL;
170 }
171 if (IS_ERR(acl)) {
172 /*
173 * Remove our sentinel so that we don't block future attempts
174 * to cache the ACL.
175 */
176 cmpxchg(p, sentinel, ACL_NOT_CACHED);
177 return acl;
178 }
179
180 /*
181 * Cache the result, but only if our sentinel is still in place.
182 */
183 posix_acl_dup(acl);
184 if (unlikely(!try_cmpxchg(p, &sentinel, acl)))
185 posix_acl_release(acl);
186 return acl;
187}
188
189struct posix_acl *get_inode_acl(struct inode *inode, int type)
190{
191 return __get_acl(&nop_mnt_idmap, NULL, inode, type);
192}
193EXPORT_SYMBOL(get_inode_acl);
194
195/*
196 * Init a fresh posix_acl
197 */
198void
199posix_acl_init(struct posix_acl *acl, int count)
200{
201 refcount_set(&acl->a_refcount, 1);
202 acl->a_count = count;
203}
204EXPORT_SYMBOL(posix_acl_init);
205
206/*
207 * Allocate a new ACL with the specified number of entries.
208 */
209struct posix_acl *
210posix_acl_alloc(unsigned int count, gfp_t flags)
211{
212 struct posix_acl *acl;
213
214 acl = kmalloc_flex(*acl, a_entries, count, flags);
215 if (acl)
216 posix_acl_init(acl, count);
217 return acl;
218}
219EXPORT_SYMBOL(posix_acl_alloc);
220
221/*
222 * Clone an ACL.
223 */
224struct posix_acl *
225posix_acl_clone(const struct posix_acl *acl, gfp_t flags)
226{
227 struct posix_acl *clone = NULL;
228
229 if (acl) {
230 clone = kmemdup(acl, struct_size(acl, a_entries, acl->a_count),
231 flags);
232 if (clone)
233 refcount_set(&clone->a_refcount, 1);
234 }
235 return clone;
236}
237EXPORT_SYMBOL_GPL(posix_acl_clone);
238
239/*
240 * Check if an acl is valid. Returns 0 if it is, or -E... otherwise.
241 */
242int
243posix_acl_valid(struct user_namespace *user_ns, const struct posix_acl *acl)
244{
245 const struct posix_acl_entry *pa, *pe;
246 int state = ACL_USER_OBJ;
247 int needs_mask = 0;
248
249 FOREACH_ACL_ENTRY(pa, acl, pe) {
250 if (pa->e_perm & ~(ACL_READ|ACL_WRITE|ACL_EXECUTE))
251 return -EINVAL;
252 switch (pa->e_tag) {
253 case ACL_USER_OBJ:
254 if (state == ACL_USER_OBJ) {
255 state = ACL_USER;
256 break;
257 }
258 return -EINVAL;
259
260 case ACL_USER:
261 if (state != ACL_USER)
262 return -EINVAL;
263 if (!kuid_has_mapping(user_ns, pa->e_uid))
264 return -EINVAL;
265 needs_mask = 1;
266 break;
267
268 case ACL_GROUP_OBJ:
269 if (state == ACL_USER) {
270 state = ACL_GROUP;
271 break;
272 }
273 return -EINVAL;
274
275 case ACL_GROUP:
276 if (state != ACL_GROUP)
277 return -EINVAL;
278 if (!kgid_has_mapping(user_ns, pa->e_gid))
279 return -EINVAL;
280 needs_mask = 1;
281 break;
282
283 case ACL_MASK:
284 if (state != ACL_GROUP)
285 return -EINVAL;
286 state = ACL_OTHER;
287 break;
288
289 case ACL_OTHER:
290 if (state == ACL_OTHER ||
291 (state == ACL_GROUP && !needs_mask)) {
292 state = 0;
293 break;
294 }
295 return -EINVAL;
296
297 default:
298 return -EINVAL;
299 }
300 }
301 if (state == 0)
302 return 0;
303 return -EINVAL;
304}
305EXPORT_SYMBOL(posix_acl_valid);
306
307/*
308 * Returns 0 if the acl can be exactly represented in the traditional
309 * file mode permission bits, or else 1. Returns -E... on error.
310 */
311int
312posix_acl_equiv_mode(const struct posix_acl *acl, umode_t *mode_p)
313{
314 const struct posix_acl_entry *pa, *pe;
315 umode_t mode = 0;
316 int not_equiv = 0;
317
318 /*
319 * A null ACL can always be presented as mode bits.
320 */
321 if (!acl)
322 return 0;
323
324 FOREACH_ACL_ENTRY(pa, acl, pe) {
325 switch (pa->e_tag) {
326 case ACL_USER_OBJ:
327 mode |= (pa->e_perm & S_IRWXO) << 6;
328 break;
329 case ACL_GROUP_OBJ:
330 mode |= (pa->e_perm & S_IRWXO) << 3;
331 break;
332 case ACL_OTHER:
333 mode |= pa->e_perm & S_IRWXO;
334 break;
335 case ACL_MASK:
336 mode = (mode & ~S_IRWXG) |
337 ((pa->e_perm & S_IRWXO) << 3);
338 not_equiv = 1;
339 break;
340 case ACL_USER:
341 case ACL_GROUP:
342 not_equiv = 1;
343 break;
344 default:
345 return -EINVAL;
346 }
347 }
348 if (mode_p)
349 *mode_p = (*mode_p & ~S_IRWXUGO) | mode;
350 return not_equiv;
351}
352EXPORT_SYMBOL(posix_acl_equiv_mode);
353
354/*
355 * Create an ACL representing the file mode permission bits of an inode.
356 */
357struct posix_acl *
358posix_acl_from_mode(umode_t mode, gfp_t flags)
359{
360 struct posix_acl *acl = posix_acl_alloc(3, flags);
361 if (!acl)
362 return ERR_PTR(-ENOMEM);
363
364 acl->a_entries[0].e_tag = ACL_USER_OBJ;
365 acl->a_entries[0].e_perm = (mode & S_IRWXU) >> 6;
366
367 acl->a_entries[1].e_tag = ACL_GROUP_OBJ;
368 acl->a_entries[1].e_perm = (mode & S_IRWXG) >> 3;
369
370 acl->a_entries[2].e_tag = ACL_OTHER;
371 acl->a_entries[2].e_perm = (mode & S_IRWXO);
372 return acl;
373}
374EXPORT_SYMBOL(posix_acl_from_mode);
375
376/*
377 * Return 0 if current is granted want access to the inode
378 * by the acl. Returns -E... otherwise.
379 */
380int
381posix_acl_permission(const struct mnt_idmap *idmap, struct inode *inode,
382 const struct posix_acl *acl, int want)
383{
384 const struct posix_acl_entry *pa, *pe, *mask_obj;
385 struct user_namespace *fs_userns = i_user_ns(inode);
386 int found = 0;
387 vfsuid_t vfsuid;
388 vfsgid_t vfsgid;
389
390 want &= MAY_READ | MAY_WRITE | MAY_EXEC;
391
392 FOREACH_ACL_ENTRY(pa, acl, pe) {
393 switch(pa->e_tag) {
394 case ACL_USER_OBJ:
395 /* (May have been checked already) */
396 vfsuid = i_uid_into_vfsuid(idmap, inode);
397 if (vfsuid_eq_kuid(vfsuid, current_fsuid()))
398 goto check_perm;
399 break;
400 case ACL_USER:
401 vfsuid = make_vfsuid(idmap, fs_userns,
402 pa->e_uid);
403 if (vfsuid_eq_kuid(vfsuid, current_fsuid()))
404 goto mask;
405 break;
406 case ACL_GROUP_OBJ:
407 vfsgid = i_gid_into_vfsgid(idmap, inode);
408 if (vfsgid_in_group_p(vfsgid)) {
409 found = 1;
410 if ((pa->e_perm & want) == want)
411 goto mask;
412 }
413 break;
414 case ACL_GROUP:
415 vfsgid = make_vfsgid(idmap, fs_userns,
416 pa->e_gid);
417 if (vfsgid_in_group_p(vfsgid)) {
418 found = 1;
419 if ((pa->e_perm & want) == want)
420 goto mask;
421 }
422 break;
423 case ACL_MASK:
424 break;
425 case ACL_OTHER:
426 if (found)
427 return -EACCES;
428 else
429 goto check_perm;
430 default:
431 return -EIO;
432 }
433 }
434 return -EIO;
435
436mask:
437 for (mask_obj = pa+1; mask_obj != pe; mask_obj++) {
438 if (mask_obj->e_tag == ACL_MASK) {
439 if ((pa->e_perm & mask_obj->e_perm & want) == want)
440 return 0;
441 return -EACCES;
442 }
443 }
444
445check_perm:
446 if ((pa->e_perm & want) == want)
447 return 0;
448 return -EACCES;
449}
450
451/*
452 * Modify acl when creating a new inode. The caller must ensure the acl is
453 * only referenced once.
454 *
455 * mode_p initially must contain the mode parameter to the open() / creat()
456 * system calls. All permissions that are not granted by the acl are removed.
457 * The permissions in the acl are changed to reflect the mode_p parameter.
458 */
459static int posix_acl_create_masq(struct posix_acl *acl, umode_t *mode_p)
460{
461 struct posix_acl_entry *pa, *pe;
462 struct posix_acl_entry *group_obj = NULL, *mask_obj = NULL;
463 umode_t mode = *mode_p;
464 int not_equiv = 0;
465
466 /* assert(atomic_read(acl->a_refcount) == 1); */
467
468 FOREACH_ACL_ENTRY(pa, acl, pe) {
469 switch(pa->e_tag) {
470 case ACL_USER_OBJ:
471 pa->e_perm &= (mode >> 6) | ~S_IRWXO;
472 mode &= (pa->e_perm << 6) | ~S_IRWXU;
473 break;
474
475 case ACL_USER:
476 case ACL_GROUP:
477 not_equiv = 1;
478 break;
479
480 case ACL_GROUP_OBJ:
481 group_obj = pa;
482 break;
483
484 case ACL_OTHER:
485 pa->e_perm &= mode | ~S_IRWXO;
486 mode &= pa->e_perm | ~S_IRWXO;
487 break;
488
489 case ACL_MASK:
490 mask_obj = pa;
491 not_equiv = 1;
492 break;
493
494 default:
495 return -EIO;
496 }
497 }
498
499 if (mask_obj) {
500 mask_obj->e_perm &= (mode >> 3) | ~S_IRWXO;
501 mode &= (mask_obj->e_perm << 3) | ~S_IRWXG;
502 } else {
503 if (!group_obj)
504 return -EIO;
505 group_obj->e_perm &= (mode >> 3) | ~S_IRWXO;
506 mode &= (group_obj->e_perm << 3) | ~S_IRWXG;
507 }
508
509 *mode_p = (*mode_p & ~S_IRWXUGO) | mode;
510 return not_equiv;
511}
512
513/*
514 * Modify the ACL for the chmod syscall.
515 */
516static int __posix_acl_chmod_masq(struct posix_acl *acl, umode_t mode)
517{
518 struct posix_acl_entry *group_obj = NULL, *mask_obj = NULL;
519 struct posix_acl_entry *pa, *pe;
520
521 /* assert(atomic_read(acl->a_refcount) == 1); */
522
523 FOREACH_ACL_ENTRY(pa, acl, pe) {
524 switch(pa->e_tag) {
525 case ACL_USER_OBJ:
526 pa->e_perm = (mode & S_IRWXU) >> 6;
527 break;
528
529 case ACL_USER:
530 case ACL_GROUP:
531 break;
532
533 case ACL_GROUP_OBJ:
534 group_obj = pa;
535 break;
536
537 case ACL_MASK:
538 mask_obj = pa;
539 break;
540
541 case ACL_OTHER:
542 pa->e_perm = (mode & S_IRWXO);
543 break;
544
545 default:
546 return -EIO;
547 }
548 }
549
550 if (mask_obj) {
551 mask_obj->e_perm = (mode & S_IRWXG) >> 3;
552 } else {
553 if (!group_obj)
554 return -EIO;
555 group_obj->e_perm = (mode & S_IRWXG) >> 3;
556 }
557
558 return 0;
559}
560
561int
562__posix_acl_create(struct posix_acl **acl, gfp_t gfp, umode_t *mode_p)
563{
564 struct posix_acl *clone = posix_acl_clone(*acl, gfp);
565 int err = -ENOMEM;
566 if (clone) {
567 err = posix_acl_create_masq(clone, mode_p);
568 if (err < 0) {
569 posix_acl_release(clone);
570 clone = NULL;
571 }
572 }
573 posix_acl_release(*acl);
574 *acl = clone;
575 return err;
576}
577EXPORT_SYMBOL(__posix_acl_create);
578
579int
580__posix_acl_chmod(struct posix_acl **acl, gfp_t gfp, umode_t mode)
581{
582 struct posix_acl *clone = posix_acl_clone(*acl, gfp);
583 int err = -ENOMEM;
584 if (clone) {
585 err = __posix_acl_chmod_masq(clone, mode);
586 if (err) {
587 posix_acl_release(clone);
588 clone = NULL;
589 }
590 }
591 posix_acl_release(*acl);
592 *acl = clone;
593 return err;
594}
595EXPORT_SYMBOL(__posix_acl_chmod);
596
597/**
598 * posix_acl_chmod - chmod a posix acl
599 *
600 * @idmap: idmap of the mount @inode was found from
601 * @dentry: dentry to check permissions on
602 * @mode: the new mode of @inode
603 *
604 * If the dentry has been found through an idmapped mount the idmap of
605 * the vfsmount must be passed through @idmap. This function will then
606 * take care to map the inode according to @idmap before checking
607 * permissions. On non-idmapped mounts or if permission checking is to be
608 * performed on the raw inode simply pass @nop_mnt_idmap.
609 */
610int
611 posix_acl_chmod(const struct mnt_idmap *idmap, struct dentry *dentry,
612 umode_t mode)
613{
614 struct inode *inode = d_inode(dentry);
615 struct posix_acl *acl;
616 int ret = 0;
617
618 if (!IS_POSIXACL(inode))
619 return 0;
620 if (!inode->i_op->set_acl)
621 return -EOPNOTSUPP;
622
623 acl = get_inode_acl(inode, ACL_TYPE_ACCESS);
624 if (IS_ERR_OR_NULL(acl)) {
625 if (acl == ERR_PTR(-EOPNOTSUPP))
626 return 0;
627 return PTR_ERR(acl);
628 }
629
630 ret = __posix_acl_chmod(&acl, GFP_KERNEL, mode);
631 if (ret)
632 return ret;
633 ret = inode->i_op->set_acl(idmap, dentry, acl, ACL_TYPE_ACCESS);
634 posix_acl_release(acl);
635 return ret;
636}
637EXPORT_SYMBOL(posix_acl_chmod);
638
639int
640posix_acl_create(struct inode *dir, umode_t *mode,
641 struct posix_acl **default_acl, struct posix_acl **acl)
642{
643 struct posix_acl *p;
644 struct posix_acl *clone;
645 int ret;
646
647 *acl = NULL;
648 *default_acl = NULL;
649
650 if (S_ISLNK(*mode) || !IS_POSIXACL(dir))
651 return 0;
652
653 p = get_inode_acl(dir, ACL_TYPE_DEFAULT);
654 if (!p || p == ERR_PTR(-EOPNOTSUPP)) {
655 *mode &= ~current_umask();
656 return 0;
657 }
658 if (IS_ERR(p))
659 return PTR_ERR(p);
660
661 ret = -ENOMEM;
662 clone = posix_acl_clone(p, GFP_NOFS);
663 if (!clone)
664 goto err_release;
665
666 ret = posix_acl_create_masq(clone, mode);
667 if (ret < 0)
668 goto err_release_clone;
669
670 if (ret == 0)
671 posix_acl_release(clone);
672 else
673 *acl = clone;
674
675 if (!S_ISDIR(*mode))
676 posix_acl_release(p);
677 else
678 *default_acl = p;
679
680 return 0;
681
682err_release_clone:
683 posix_acl_release(clone);
684err_release:
685 posix_acl_release(p);
686 return ret;
687}
688EXPORT_SYMBOL_GPL(posix_acl_create);
689
690/**
691 * posix_acl_update_mode - update mode in set_acl
692 * @idmap: idmap of the mount @inode was found from
693 * @inode: target inode
694 * @mode_p: mode (pointer) for update
695 * @acl: acl pointer
696 *
697 * Update the file mode when setting an ACL: compute the new file permission
698 * bits based on the ACL. In addition, if the ACL is equivalent to the new
699 * file mode, set *@acl to NULL to indicate that no ACL should be set.
700 *
701 * As with chmod, clear the setgid bit if the caller is not in the owning group
702 * or capable of CAP_FSETID (see inode_change_ok).
703 *
704 * If the inode has been found through an idmapped mount the idmap of
705 * the vfsmount must be passed through @idmap. This function will then
706 * take care to map the inode according to @idmap before checking
707 * permissions. On non-idmapped mounts or if permission checking is to be
708 * performed on the raw inode simply pass @nop_mnt_idmap.
709 *
710 * Called from set_acl inode operations.
711 */
712int posix_acl_update_mode(const struct mnt_idmap *idmap,
713 struct inode *inode, umode_t *mode_p,
714 struct posix_acl **acl)
715{
716 umode_t mode = inode->i_mode;
717 int error;
718
719 error = posix_acl_equiv_mode(*acl, &mode);
720 if (error < 0)
721 return error;
722 if (error == 0)
723 *acl = NULL;
724 if (!in_group_or_capable(idmap, inode,
725 i_gid_into_vfsgid(idmap, inode)))
726 mode &= ~S_ISGID;
727 *mode_p = mode;
728 return 0;
729}
730EXPORT_SYMBOL(posix_acl_update_mode);
731
732/*
733 * Fix up the uids and gids in posix acl extended attributes in place.
734 */
735static int posix_acl_fix_xattr_common(const void *value, size_t size)
736{
737 const struct posix_acl_xattr_header *header = value;
738 int count;
739
740 if (!header)
741 return -EINVAL;
742 if (size < sizeof(struct posix_acl_xattr_header))
743 return -EINVAL;
744 if (header->a_version != cpu_to_le32(POSIX_ACL_XATTR_VERSION))
745 return -EOPNOTSUPP;
746
747 count = posix_acl_xattr_count(size);
748 if (count < 0)
749 return -EINVAL;
750
751 return count;
752}
753
754/**
755 * posix_acl_from_xattr - convert POSIX ACLs from backing store to VFS format
756 * @userns: the filesystem's idmapping
757 * @value: the uapi representation of POSIX ACLs
758 * @size: the size of @void
759 *
760 * Filesystems that store POSIX ACLs in the unaltered uapi format should use
761 * posix_acl_from_xattr() when reading them from the backing store and
762 * converting them into the struct posix_acl VFS format. The helper is
763 * specifically intended to be called from the acl inode operation.
764 *
765 * The posix_acl_from_xattr() function will map the raw {g,u}id values stored
766 * in ACL_{GROUP,USER} entries into idmapping in @userns.
767 *
768 * Note that posix_acl_from_xattr() does not take idmapped mounts into account.
769 * If it did it calling it from the get acl inode operation would return POSIX
770 * ACLs mapped according to an idmapped mount which would mean that the value
771 * couldn't be cached for the filesystem. Idmapped mounts are taken into
772 * account on the fly during permission checking or right at the VFS -
773 * userspace boundary before reporting them to the user.
774 *
775 * Return: Allocated struct posix_acl on success, NULL for a valid header but
776 * without actual POSIX ACL entries, or ERR_PTR() encoded error code.
777 */
778struct posix_acl *posix_acl_from_xattr(struct user_namespace *userns,
779 const void *value, size_t size)
780{
781 const struct posix_acl_xattr_header *header = value;
782 const struct posix_acl_xattr_entry *entry = (const void *)(header + 1), *end;
783 int count;
784 struct posix_acl *acl;
785 struct posix_acl_entry *acl_e;
786
787 count = posix_acl_fix_xattr_common(value, size);
788 if (count < 0)
789 return ERR_PTR(count);
790 if (count == 0)
791 return NULL;
792
793 acl = posix_acl_alloc(count, GFP_NOFS);
794 if (!acl)
795 return ERR_PTR(-ENOMEM);
796 acl_e = acl->a_entries;
797
798 for (end = entry + count; entry != end; acl_e++, entry++) {
799 acl_e->e_tag = le16_to_cpu(entry->e_tag);
800 acl_e->e_perm = le16_to_cpu(entry->e_perm);
801
802 switch(acl_e->e_tag) {
803 case ACL_USER_OBJ:
804 case ACL_GROUP_OBJ:
805 case ACL_MASK:
806 case ACL_OTHER:
807 break;
808
809 case ACL_USER:
810 acl_e->e_uid = make_kuid(userns,
811 le32_to_cpu(entry->e_id));
812 if (!uid_valid(acl_e->e_uid))
813 goto fail;
814 break;
815 case ACL_GROUP:
816 acl_e->e_gid = make_kgid(userns,
817 le32_to_cpu(entry->e_id));
818 if (!gid_valid(acl_e->e_gid))
819 goto fail;
820 break;
821
822 default:
823 goto fail;
824 }
825 }
826 return acl;
827
828fail:
829 posix_acl_release(acl);
830 return ERR_PTR(-EINVAL);
831}
832EXPORT_SYMBOL (posix_acl_from_xattr);
833
834/*
835 * Convert from in-memory to extended attribute representation.
836 */
837void *
838posix_acl_to_xattr(struct user_namespace *user_ns, const struct posix_acl *acl,
839 size_t *sizep, gfp_t gfp)
840{
841 struct posix_acl_xattr_header *ext_acl;
842 struct posix_acl_xattr_entry *ext_entry;
843 size_t size;
844 int n;
845
846 size = posix_acl_xattr_size(acl->a_count);
847 ext_acl = kmalloc(size, gfp);
848 if (!ext_acl)
849 return NULL;
850
851 ext_entry = (void *)(ext_acl + 1);
852 ext_acl->a_version = cpu_to_le32(POSIX_ACL_XATTR_VERSION);
853
854 for (n=0; n < acl->a_count; n++, ext_entry++) {
855 const struct posix_acl_entry *acl_e = &acl->a_entries[n];
856 ext_entry->e_tag = cpu_to_le16(acl_e->e_tag);
857 ext_entry->e_perm = cpu_to_le16(acl_e->e_perm);
858 switch(acl_e->e_tag) {
859 case ACL_USER:
860 ext_entry->e_id =
861 cpu_to_le32(from_kuid(user_ns, acl_e->e_uid));
862 break;
863 case ACL_GROUP:
864 ext_entry->e_id =
865 cpu_to_le32(from_kgid(user_ns, acl_e->e_gid));
866 break;
867 default:
868 ext_entry->e_id = cpu_to_le32(ACL_UNDEFINED_ID);
869 break;
870 }
871 }
872 *sizep = size;
873 return ext_acl;
874}
875EXPORT_SYMBOL (posix_acl_to_xattr);
876
877/**
878 * vfs_posix_acl_to_xattr - convert from kernel to userspace representation
879 * @idmap: idmap of the mount
880 * @inode: inode the posix acls are set on
881 * @acl: the posix acls as represented by the vfs
882 * @buffer: the buffer into which to convert @acl
883 * @size: size of @buffer
884 *
885 * This converts @acl from the VFS representation in the filesystem idmapping
886 * to the uapi form reportable to userspace. And mount and caller idmappings
887 * are handled appropriately.
888 *
889 * Return: On success, the size of the stored uapi posix acls, on error a
890 * negative errno.
891 */
892static ssize_t vfs_posix_acl_to_xattr(const struct mnt_idmap *idmap,
893 struct inode *inode,
894 const struct posix_acl *acl, void *buffer,
895 size_t size)
896
897{
898 struct posix_acl_xattr_header *ext_acl = buffer;
899 struct posix_acl_xattr_entry *ext_entry;
900 struct user_namespace *fs_userns, *caller_userns;
901 ssize_t real_size, n;
902 vfsuid_t vfsuid;
903 vfsgid_t vfsgid;
904
905 real_size = posix_acl_xattr_size(acl->a_count);
906 if (!buffer)
907 return real_size;
908 if (real_size > size)
909 return -ERANGE;
910
911 ext_entry = (void *)(ext_acl + 1);
912 ext_acl->a_version = cpu_to_le32(POSIX_ACL_XATTR_VERSION);
913
914 fs_userns = i_user_ns(inode);
915 caller_userns = current_user_ns();
916 for (n=0; n < acl->a_count; n++, ext_entry++) {
917 const struct posix_acl_entry *acl_e = &acl->a_entries[n];
918 ext_entry->e_tag = cpu_to_le16(acl_e->e_tag);
919 ext_entry->e_perm = cpu_to_le16(acl_e->e_perm);
920 switch(acl_e->e_tag) {
921 case ACL_USER:
922 vfsuid = make_vfsuid(idmap, fs_userns, acl_e->e_uid);
923 ext_entry->e_id = cpu_to_le32(from_kuid(
924 caller_userns, vfsuid_into_kuid(vfsuid)));
925 break;
926 case ACL_GROUP:
927 vfsgid = make_vfsgid(idmap, fs_userns, acl_e->e_gid);
928 ext_entry->e_id = cpu_to_le32(from_kgid(
929 caller_userns, vfsgid_into_kgid(vfsgid)));
930 break;
931 default:
932 ext_entry->e_id = cpu_to_le32(ACL_UNDEFINED_ID);
933 break;
934 }
935 }
936 return real_size;
937}
938
939int
940set_posix_acl(const struct mnt_idmap *idmap, struct dentry *dentry,
941 int type, struct posix_acl *acl)
942{
943 struct inode *inode = d_inode(dentry);
944
945 if (!IS_POSIXACL(inode))
946 return -EOPNOTSUPP;
947 if (!inode->i_op->set_acl)
948 return -EOPNOTSUPP;
949
950 if (type == ACL_TYPE_DEFAULT && !S_ISDIR(inode->i_mode))
951 return acl ? -EACCES : 0;
952 if (!inode_owner_or_capable(idmap, inode))
953 return -EPERM;
954
955 if (acl) {
956 int ret = posix_acl_valid(inode->i_sb->s_user_ns, acl);
957 if (ret)
958 return ret;
959 }
960 return inode->i_op->set_acl(idmap, dentry, acl, type);
961}
962EXPORT_SYMBOL(set_posix_acl);
963
964int posix_acl_listxattr(struct inode *inode, char **buffer,
965 ssize_t *remaining_size)
966{
967 int err;
968
969 if (!IS_POSIXACL(inode))
970 return 0;
971
972 if (inode->i_acl) {
973 err = xattr_list_one(buffer, remaining_size,
974 XATTR_NAME_POSIX_ACL_ACCESS);
975 if (err)
976 return err;
977 }
978
979 if (inode->i_default_acl) {
980 err = xattr_list_one(buffer, remaining_size,
981 XATTR_NAME_POSIX_ACL_DEFAULT);
982 if (err)
983 return err;
984 }
985
986 return 0;
987}
988
989static bool
990posix_acl_xattr_list(struct dentry *dentry)
991{
992 return IS_POSIXACL(d_backing_inode(dentry));
993}
994
995/*
996 * nop_posix_acl_access - legacy xattr handler for access POSIX ACLs
997 *
998 * This is the legacy POSIX ACL access xattr handler. It is used by some
999 * filesystems to implement their ->listxattr() inode operation. New code
1000 * should never use them.
1001 */
1002const struct xattr_handler nop_posix_acl_access = {
1003 .name = XATTR_NAME_POSIX_ACL_ACCESS,
1004 .list = posix_acl_xattr_list,
1005};
1006EXPORT_SYMBOL_GPL(nop_posix_acl_access);
1007
1008/*
1009 * nop_posix_acl_default - legacy xattr handler for default POSIX ACLs
1010 *
1011 * This is the legacy POSIX ACL default xattr handler. It is used by some
1012 * filesystems to implement their ->listxattr() inode operation. New code
1013 * should never use them.
1014 */
1015const struct xattr_handler nop_posix_acl_default = {
1016 .name = XATTR_NAME_POSIX_ACL_DEFAULT,
1017 .list = posix_acl_xattr_list,
1018};
1019EXPORT_SYMBOL_GPL(nop_posix_acl_default);
1020
1021int simple_set_acl(const struct mnt_idmap *idmap, struct dentry *dentry,
1022 struct posix_acl *acl, int type)
1023{
1024 int error;
1025 struct inode *inode = d_inode(dentry);
1026
1027 if (type == ACL_TYPE_ACCESS) {
1028 error = posix_acl_update_mode(idmap, inode,
1029 &inode->i_mode, &acl);
1030 if (error)
1031 return error;
1032 }
1033
1034 inode_set_ctime_current(inode);
1035 if (IS_I_VERSION(inode))
1036 inode_inc_iversion(inode);
1037 set_cached_acl(inode, type, acl);
1038 return 0;
1039}
1040
1041int simple_acl_create(struct inode *dir, struct inode *inode)
1042{
1043 struct posix_acl *default_acl, *acl;
1044 int error;
1045
1046 error = posix_acl_create(dir, &inode->i_mode, &default_acl, &acl);
1047 if (error)
1048 return error;
1049
1050 set_cached_acl(inode, ACL_TYPE_DEFAULT, default_acl);
1051 set_cached_acl(inode, ACL_TYPE_ACCESS, acl);
1052
1053 if (default_acl)
1054 posix_acl_release(default_acl);
1055 if (acl)
1056 posix_acl_release(acl);
1057 return 0;
1058}
1059
1060static int vfs_set_acl_idmapped_mnt(const struct mnt_idmap *idmap,
1061 struct user_namespace *fs_userns,
1062 struct posix_acl *acl)
1063{
1064 for (int n = 0; n < acl->a_count; n++) {
1065 struct posix_acl_entry *acl_e = &acl->a_entries[n];
1066
1067 switch (acl_e->e_tag) {
1068 case ACL_USER:
1069 acl_e->e_uid = from_vfsuid(idmap, fs_userns,
1070 VFSUIDT_INIT(acl_e->e_uid));
1071 break;
1072 case ACL_GROUP:
1073 acl_e->e_gid = from_vfsgid(idmap, fs_userns,
1074 VFSGIDT_INIT(acl_e->e_gid));
1075 break;
1076 }
1077 }
1078
1079 return 0;
1080}
1081
1082/**
1083 * vfs_set_acl - set posix acls
1084 * @idmap: idmap of the mount
1085 * @dentry: the dentry based on which to set the posix acls
1086 * @acl_name: the name of the posix acl
1087 * @kacl: the posix acls in the appropriate VFS format
1088 *
1089 * This function sets @kacl. The caller must all posix_acl_release() on @kacl
1090 * afterwards.
1091 *
1092 * Return: On success 0, on error negative errno.
1093 */
1094int vfs_set_acl(const struct mnt_idmap *idmap, struct dentry *dentry,
1095 const char *acl_name, struct posix_acl *kacl)
1096{
1097 int acl_type;
1098 int error;
1099 struct inode *inode = d_inode(dentry);
1100 struct delegated_inode delegated_inode = { };
1101
1102 acl_type = posix_acl_type(acl_name);
1103 if (acl_type < 0)
1104 return -EINVAL;
1105
1106 if (kacl) {
1107 /*
1108 * If we're on an idmapped mount translate from mount specific
1109 * vfs{g,u}id_t into global filesystem k{g,u}id_t.
1110 * Afterwards we can cache the POSIX ACLs filesystem wide and -
1111 * if this is a filesystem with a backing store - ultimately
1112 * translate them to backing store values.
1113 */
1114 error = vfs_set_acl_idmapped_mnt(idmap, i_user_ns(inode), kacl);
1115 if (error)
1116 return error;
1117 }
1118
1119retry_deleg:
1120 inode_lock(inode);
1121
1122 /*
1123 * We only care about restrictions the inode struct itself places upon
1124 * us otherwise POSIX ACLs aren't subject to any VFS restrictions.
1125 */
1126 error = may_write_xattr(idmap, inode);
1127 if (error)
1128 goto out_inode_unlock;
1129
1130 error = security_inode_set_acl(idmap, dentry, acl_name, kacl);
1131 if (error)
1132 goto out_inode_unlock;
1133
1134 error = try_break_deleg(inode, 0, &delegated_inode);
1135 if (error)
1136 goto out_inode_unlock;
1137
1138 if (likely(!is_bad_inode(inode)))
1139 error = set_posix_acl(idmap, dentry, acl_type, kacl);
1140 else
1141 error = -EIO;
1142 if (!error) {
1143 fsnotify_xattr(dentry);
1144 security_inode_post_set_acl(dentry, acl_name, kacl);
1145 }
1146
1147out_inode_unlock:
1148 inode_unlock(inode);
1149
1150 if (is_delegated(&delegated_inode)) {
1151 error = break_deleg_wait(&delegated_inode);
1152 if (!error)
1153 goto retry_deleg;
1154 }
1155
1156 return error;
1157}
1158EXPORT_SYMBOL_GPL(vfs_set_acl);
1159
1160/**
1161 * vfs_get_acl - get posix acls
1162 * @idmap: idmap of the mount
1163 * @dentry: the dentry based on which to retrieve the posix acls
1164 * @acl_name: the name of the posix acl
1165 *
1166 * This function retrieves @kacl from the filesystem. The caller must all
1167 * posix_acl_release() on @kacl.
1168 *
1169 * Return: On success POSIX ACLs in VFS format, on error negative errno.
1170 */
1171struct posix_acl *vfs_get_acl(const struct mnt_idmap *idmap,
1172 struct dentry *dentry, const char *acl_name)
1173{
1174 struct inode *inode = d_inode(dentry);
1175 struct posix_acl *acl;
1176 int acl_type, error;
1177
1178 acl_type = posix_acl_type(acl_name);
1179 if (acl_type < 0)
1180 return ERR_PTR(-EINVAL);
1181
1182 /*
1183 * The VFS has no restrictions on reading POSIX ACLs so calling
1184 * something like xattr_permission() isn't needed. Only LSMs get a say.
1185 */
1186 error = security_inode_get_acl(idmap, dentry, acl_name);
1187 if (error)
1188 return ERR_PTR(error);
1189
1190 if (!IS_POSIXACL(inode))
1191 return ERR_PTR(-EOPNOTSUPP);
1192 if (S_ISLNK(inode->i_mode))
1193 return ERR_PTR(-EOPNOTSUPP);
1194
1195 acl = __get_acl(idmap, dentry, inode, acl_type);
1196 if (IS_ERR(acl))
1197 return acl;
1198 if (!acl)
1199 return ERR_PTR(-ENODATA);
1200
1201 return acl;
1202}
1203EXPORT_SYMBOL_GPL(vfs_get_acl);
1204
1205/**
1206 * vfs_remove_acl - remove posix acls
1207 * @idmap: idmap of the mount
1208 * @dentry: the dentry based on which to retrieve the posix acls
1209 * @acl_name: the name of the posix acl
1210 *
1211 * This function removes posix acls.
1212 *
1213 * Return: On success 0, on error negative errno.
1214 */
1215int vfs_remove_acl(const struct mnt_idmap *idmap, struct dentry *dentry,
1216 const char *acl_name)
1217{
1218 int acl_type;
1219 int error;
1220 struct inode *inode = d_inode(dentry);
1221 struct delegated_inode delegated_inode = { };
1222
1223 acl_type = posix_acl_type(acl_name);
1224 if (acl_type < 0)
1225 return -EINVAL;
1226
1227retry_deleg:
1228 inode_lock(inode);
1229
1230 /*
1231 * We only care about restrictions the inode struct itself places upon
1232 * us otherwise POSIX ACLs aren't subject to any VFS restrictions.
1233 */
1234 error = may_write_xattr(idmap, inode);
1235 if (error)
1236 goto out_inode_unlock;
1237
1238 error = security_inode_remove_acl(idmap, dentry, acl_name);
1239 if (error)
1240 goto out_inode_unlock;
1241
1242 error = try_break_deleg(inode, 0, &delegated_inode);
1243 if (error)
1244 goto out_inode_unlock;
1245
1246 if (likely(!is_bad_inode(inode)))
1247 error = set_posix_acl(idmap, dentry, acl_type, NULL);
1248 else
1249 error = -EIO;
1250 if (!error) {
1251 fsnotify_xattr(dentry);
1252 security_inode_post_remove_acl(idmap, dentry, acl_name);
1253 }
1254
1255out_inode_unlock:
1256 inode_unlock(inode);
1257
1258 if (is_delegated(&delegated_inode)) {
1259 error = break_deleg_wait(&delegated_inode);
1260 if (!error)
1261 goto retry_deleg;
1262 }
1263
1264 return error;
1265}
1266EXPORT_SYMBOL_GPL(vfs_remove_acl);
1267
1268int do_set_acl(const struct mnt_idmap *idmap, struct dentry *dentry,
1269 const char *acl_name, const void *kvalue, size_t size)
1270{
1271 int error;
1272 struct posix_acl *acl = NULL;
1273
1274 if (size) {
1275 /*
1276 * Note that posix_acl_from_xattr() uses GFP_NOFS when it
1277 * probably doesn't need to here.
1278 */
1279 acl = posix_acl_from_xattr(current_user_ns(), kvalue, size);
1280 if (IS_ERR(acl))
1281 return PTR_ERR(acl);
1282 }
1283
1284 error = vfs_set_acl(idmap, dentry, acl_name, acl);
1285 posix_acl_release(acl);
1286 return error;
1287}
1288
1289ssize_t do_get_acl(const struct mnt_idmap *idmap, struct dentry *dentry,
1290 const char *acl_name, void *kvalue, size_t size)
1291{
1292 ssize_t error;
1293 struct posix_acl *acl;
1294
1295 acl = vfs_get_acl(idmap, dentry, acl_name);
1296 if (IS_ERR(acl))
1297 return PTR_ERR(acl);
1298
1299 error = vfs_posix_acl_to_xattr(idmap, d_inode(dentry),
1300 acl, kvalue, size);
1301 posix_acl_release(acl);
1302 return error;
1303}