mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-12 13:55:32 +00:00
e65ce2a50c
The posix acl permission checking helpers determine whether a caller is privileged over an inode according to the acls associated with the inode. Add helpers that make it possible to handle acls on idmapped mounts. The vfs and the filesystems targeted by this first iteration make use of posix_acl_fix_xattr_from_user() and posix_acl_fix_xattr_to_user() to translate basic posix access and default permissions such as the ACL_USER and ACL_GROUP type according to the initial user namespace (or the superblock's user namespace) to and from the caller's current user namespace. Adapt these two helpers to handle idmapped mounts whereby we either map from or into the mount's user namespace depending on in which direction we're translating. Similarly, cap_convert_nscap() is used by the vfs to translate user namespace and non-user namespace aware filesystem capabilities from the superblock's user namespace to the caller's user namespace. Enable it to handle idmapped mounts by accounting for the mount's user namespace. In addition the fileystems targeted in the first iteration of this patch series make use of the posix_acl_chmod() and, posix_acl_update_mode() helpers. Both helpers perform permission checks on the target inode. Let them handle idmapped mounts. These two helpers are called when posix acls are set by the respective filesystems to handle this case we extend the ->set() method to take an additional user namespace argument to pass the mount's user namespace down. Link: https://lore.kernel.org/r/20210121131959.646623-9-christian.brauner@ubuntu.com Cc: Christoph Hellwig <hch@lst.de> Cc: David Howells <dhowells@redhat.com> Cc: Al Viro <viro@zeniv.linux.org.uk> Cc: linux-fsdevel@vger.kernel.org Reviewed-by: Christoph Hellwig <hch@lst.de> Signed-off-by: Christian Brauner <christian.brauner@ubuntu.com>
118 lines
3.6 KiB
C
118 lines
3.6 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
/*
|
|
File: linux/xattr.h
|
|
|
|
Extended attributes handling.
|
|
|
|
Copyright (C) 2001 by Andreas Gruenbacher <a.gruenbacher@computer.org>
|
|
Copyright (c) 2001-2002 Silicon Graphics, Inc. All Rights Reserved.
|
|
Copyright (c) 2004 Red Hat, Inc., James Morris <jmorris@redhat.com>
|
|
*/
|
|
#ifndef _LINUX_XATTR_H
|
|
#define _LINUX_XATTR_H
|
|
|
|
|
|
#include <linux/slab.h>
|
|
#include <linux/types.h>
|
|
#include <linux/spinlock.h>
|
|
#include <linux/mm.h>
|
|
#include <uapi/linux/xattr.h>
|
|
|
|
struct inode;
|
|
struct dentry;
|
|
|
|
/*
|
|
* struct xattr_handler: When @name is set, match attributes with exactly that
|
|
* name. When @prefix is set instead, match attributes with that prefix and
|
|
* with a non-empty suffix.
|
|
*/
|
|
struct xattr_handler {
|
|
const char *name;
|
|
const char *prefix;
|
|
int flags; /* fs private flags */
|
|
bool (*list)(struct dentry *dentry);
|
|
int (*get)(const struct xattr_handler *, struct dentry *dentry,
|
|
struct inode *inode, const char *name, void *buffer,
|
|
size_t size);
|
|
int (*set)(const struct xattr_handler *,
|
|
struct user_namespace *mnt_userns, struct dentry *dentry,
|
|
struct inode *inode, const char *name, const void *buffer,
|
|
size_t size, int flags);
|
|
};
|
|
|
|
const char *xattr_full_name(const struct xattr_handler *, const char *);
|
|
|
|
struct xattr {
|
|
const char *name;
|
|
void *value;
|
|
size_t value_len;
|
|
};
|
|
|
|
ssize_t __vfs_getxattr(struct dentry *, struct inode *, const char *, void *, size_t);
|
|
ssize_t vfs_getxattr(struct dentry *, const char *, void *, size_t);
|
|
ssize_t vfs_listxattr(struct dentry *d, char *list, size_t size);
|
|
int __vfs_setxattr(struct dentry *, struct inode *, const char *, const void *, size_t, int);
|
|
int __vfs_setxattr_noperm(struct dentry *, const char *, const void *, size_t, int);
|
|
int __vfs_setxattr_locked(struct dentry *, const char *, const void *, size_t, int, struct inode **);
|
|
int vfs_setxattr(struct dentry *, const char *, const void *, size_t, int);
|
|
int __vfs_removexattr(struct dentry *, const char *);
|
|
int __vfs_removexattr_locked(struct dentry *, const char *, struct inode **);
|
|
int vfs_removexattr(struct dentry *, const char *);
|
|
|
|
ssize_t generic_listxattr(struct dentry *dentry, char *buffer, size_t buffer_size);
|
|
ssize_t vfs_getxattr_alloc(struct dentry *dentry, const char *name,
|
|
char **xattr_value, size_t size, gfp_t flags);
|
|
|
|
int xattr_supported_namespace(struct inode *inode, const char *prefix);
|
|
|
|
static inline const char *xattr_prefix(const struct xattr_handler *handler)
|
|
{
|
|
return handler->prefix ?: handler->name;
|
|
}
|
|
|
|
struct simple_xattrs {
|
|
struct list_head head;
|
|
spinlock_t lock;
|
|
};
|
|
|
|
struct simple_xattr {
|
|
struct list_head list;
|
|
char *name;
|
|
size_t size;
|
|
char value[];
|
|
};
|
|
|
|
/*
|
|
* initialize the simple_xattrs structure
|
|
*/
|
|
static inline void simple_xattrs_init(struct simple_xattrs *xattrs)
|
|
{
|
|
INIT_LIST_HEAD(&xattrs->head);
|
|
spin_lock_init(&xattrs->lock);
|
|
}
|
|
|
|
/*
|
|
* free all the xattrs
|
|
*/
|
|
static inline void simple_xattrs_free(struct simple_xattrs *xattrs)
|
|
{
|
|
struct simple_xattr *xattr, *node;
|
|
|
|
list_for_each_entry_safe(xattr, node, &xattrs->head, list) {
|
|
kfree(xattr->name);
|
|
kvfree(xattr);
|
|
}
|
|
}
|
|
|
|
struct simple_xattr *simple_xattr_alloc(const void *value, size_t size);
|
|
int simple_xattr_get(struct simple_xattrs *xattrs, const char *name,
|
|
void *buffer, size_t size);
|
|
int simple_xattr_set(struct simple_xattrs *xattrs, const char *name,
|
|
const void *value, size_t size, int flags,
|
|
ssize_t *removed_size);
|
|
ssize_t simple_xattr_list(struct inode *inode, struct simple_xattrs *xattrs, char *buffer,
|
|
size_t size);
|
|
void simple_xattr_list_add(struct simple_xattrs *xattrs,
|
|
struct simple_xattr *new_xattr);
|
|
|
|
#endif /* _LINUX_XATTR_H */
|