From: "J. Bruce Fields" <bfields@fieldses.org>
To: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
Cc: agruen@kernel.org, akpm@linux-foundation.org,
viro@zeniv.linux.org.uk, dhowells@redhat.com,
linux-fsdevel@vger.kernel.org, linux-nfs@vger.kernel.org,
linux-kernel@vger.kernel.org
Subject: Re: [PATCH -V7 09/26] vfs: Add delete child and delete self permission flags
Date: Wed, 19 Oct 2011 18:09:15 -0400 [thread overview]
Message-ID: <20111019220915.GA1874@fieldses.org> (raw)
In-Reply-To: <1318951981-5508-10-git-send-email-aneesh.kumar@linux.vnet.ibm.com>
On Tue, Oct 18, 2011 at 09:02:44PM +0530, Aneesh Kumar K.V wrote:
> From: Andreas Gruenbacher <agruen@kernel.org>
>
> Normally, deleting a file requires write access to the parent directory.
> Some permission models use a different permission on the parent
> directory to indicate delete access. In addition, a process can have
> per-file delete access even without delete access on the parent
> directory.
>
> Introduce two new inode_permission() mask flags and use them in
> may_delete()
>
> Acked-by: David Howells <dhowells@redhat.com>
> Signed-off-by: Andreas Gruenbacher <agruen@kernel.org>
> Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
> ---
> fs/namei.c | 42 ++++++++++++++++++++++++++++--------------
> include/linux/fs.h | 2 ++
> 2 files changed, 30 insertions(+), 14 deletions(-)
>
> diff --git a/fs/namei.c b/fs/namei.c
> index f6184b8..7bf42e8 100644
> --- a/fs/namei.c
> +++ b/fs/namei.c
> @@ -337,7 +337,7 @@ static inline int do_inode_permission(struct inode *inode, int mask)
> * are used for other things.
> *
> * When checking for MAY_APPEND, MAY_CREATE_FILE, MAY_CREATE_DIR,
> - * MAY_WRITE must also be set in @mask.
> + * MAY_DELETE_CHILD, MAY_DELETE_SELF, MAY_WRITE must also be set in @mask.
> */
> int inode_permission(struct inode *inode, int mask)
> {
> @@ -1853,7 +1853,7 @@ static inline int check_sticky(struct inode *dir, struct inode *inode)
> return 0;
>
> other_userns:
> - return !ns_capable(inode_userns(inode), CAP_FOWNER);
> + return 1;
> }
>
> /*
> @@ -1875,30 +1875,44 @@ other_userns:
> * 10. We don't allow removal of NFS sillyrenamed files; it's handled by
> * nfs_async_unlink().
> */
> -static int may_delete(struct inode *dir,struct dentry *victim,int isdir)
> +static int may_delete(struct inode *dir, struct dentry *victim,
> + int isdir, int replace)
> {
> - int error;
> + struct inode *inode = victim->d_inode;
> + int mask, replace_mask = 0, error, is_sticky;
> +
>
> - if (!victim->d_inode)
> + if (!inode)
> return -ENOENT;
>
> BUG_ON(victim->d_parent->d_inode != dir);
> audit_inode_child(victim, dir);
>
> - error = inode_permission(dir, MAY_WRITE | MAY_EXEC);
> + mask = MAY_WRITE | MAY_EXEC | MAY_DELETE_CHILD;
> + if (replace)
> + replace_mask = S_ISDIR(inode->i_mode) ?
> + MAY_CREATE_DIR : MAY_CREATE_FILE;
> + is_sticky = check_sticky(dir, inode);
> + error = inode_permission(dir, mask | replace_mask);
> + if ((error || is_sticky) && IS_RICHACL(inode) &&
> + (inode_permission(dir, MAY_EXEC | replace_mask) == 0) &&
> + (inode_permission(inode, MAY_DELETE_SELF) == 0))
> + error = 0;
> + else if (!error && is_sticky &&
> + !ns_capable(inode_userns(inode), CAP_FOWNER))
> + error = -EPERM;
Maybe I'm dense, but that big if-else-if is still giving me a headache.
The point is just to delay the ns_capable() check to avoid setting
PF_SUPERPRIV in cases where we weren't before?
How about putting using a helper function for the richacl check, and
calling it from check_sticky instead? That makes the above:
error = inode_permission(dir, mask | replace_mask);
if (error && !richacl_may_delete(dir, inode, replace_mask))
return error;
if (check_sticky(dir, inode, replace_mask))
return -EPERM;
(As in the following--totally untested and possibly wrong.)
Also: the comment before may_delete() needs updating.
--b.
commit 7fe4b12ba6b914167ed1f1bc617af04eecbce7d1
Author: Andreas Gruenbacher <agruen@kernel.org>
Date: Tue Oct 18 15:17:50 2011 +0530
vfs: Add delete child and delete self permission flags
Normally, deleting a file requires write access to the parent directory.
Some permission models use a different permission on the parent
directory to indicate delete access. In addition, a process can have
per-file delete access even without delete access on the parent
directory.
Introduce two new inode_permission() mask flags and use them in
may_delete()
Acked-by: David Howells <dhowells@redhat.com>
Signed-off-by: Andreas Gruenbacher <agruen@kernel.org>
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
diff --git a/fs/namei.c b/fs/namei.c
index f6184b8..f0cccd9 100644
--- a/fs/namei.c
+++ b/fs/namei.c
@@ -337,7 +337,7 @@ static inline int do_inode_permission(struct inode *inode, int mask)
* are used for other things.
*
* When checking for MAY_APPEND, MAY_CREATE_FILE, MAY_CREATE_DIR,
- * MAY_WRITE must also be set in @mask.
+ * MAY_DELETE_CHILD, MAY_DELETE_SELF, MAY_WRITE must also be set in @mask.
*/
int inode_permission(struct inode *inode, int mask)
{
@@ -1835,11 +1835,18 @@ static int user_path_parent(int dfd, const char __user *path,
return error;
}
+static bool richacl_may_delete(struct inode *dir, struct inode *inode, int replace_mask)
+{
+ return IS_RICHACL(inode)
+ && (inode_permission(dir, MAY_EXEC | replace_mask) == 0)
+ && (inode_permission(inode, MAY_DELETE_SELF) == 0);
+}
+
/*
* It's inline, so penalty for filesystems that don't use sticky bit is
* minimal.
*/
-static inline int check_sticky(struct inode *dir, struct inode *inode)
+static inline int check_sticky(struct inode *dir, struct inode *inode, int replace_mask)
{
uid_t fsuid = current_fsuid();
@@ -1851,7 +1858,8 @@ static inline int check_sticky(struct inode *dir, struct inode *inode)
return 0;
if (dir->i_uid == fsuid)
return 0;
-
+ if (richacl_may_delete(dir, inode, replace_mask))
+ return 0;
other_userns:
return !ns_capable(inode_userns(inode), CAP_FOWNER);
}
@@ -1875,30 +1883,38 @@ other_userns:
* 10. We don't allow removal of NFS sillyrenamed files; it's handled by
* nfs_async_unlink().
*/
-static int may_delete(struct inode *dir,struct dentry *victim,int isdir)
+static int may_delete(struct inode *dir, struct dentry *victim,
+ int isdir, int replace)
{
- int error;
+ struct inode *inode = victim->d_inode;
+ int mask, replace_mask = 0, error;
+
- if (!victim->d_inode)
+ if (!inode)
return -ENOENT;
BUG_ON(victim->d_parent->d_inode != dir);
audit_inode_child(victim, dir);
- error = inode_permission(dir, MAY_WRITE | MAY_EXEC);
- if (error)
+ mask = MAY_WRITE | MAY_EXEC | MAY_DELETE_CHILD;
+ if (replace)
+ replace_mask = S_ISDIR(inode->i_mode) ?
+ MAY_CREATE_DIR : MAY_CREATE_FILE;
+ error = inode_permission(dir, mask | replace_mask);
+ if (error && !richacl_may_delete(dir, inode, replace_mask))
return error;
+ if (check_sticky(dir, inode, replace_mask))
+ return -EPERM;
if (IS_APPEND(dir))
return -EPERM;
- if (check_sticky(dir, victim->d_inode)||IS_APPEND(victim->d_inode)||
- IS_IMMUTABLE(victim->d_inode) || IS_SWAPFILE(victim->d_inode))
+ if (IS_APPEND(inode) || IS_IMMUTABLE(inode) || IS_SWAPFILE(inode))
return -EPERM;
if (isdir) {
- if (!S_ISDIR(victim->d_inode->i_mode))
+ if (!S_ISDIR(inode->i_mode))
return -ENOTDIR;
if (IS_ROOT(victim))
return -EBUSY;
- } else if (S_ISDIR(victim->d_inode->i_mode))
+ } else if (S_ISDIR(inode->i_mode))
return -EISDIR;
if (IS_DEADDIR(dir))
return -ENOENT;
@@ -2605,7 +2621,7 @@ void dentry_unhash(struct dentry *dentry)
int vfs_rmdir(struct inode *dir, struct dentry *dentry)
{
- int error = may_delete(dir, dentry, 1);
+ int error = may_delete(dir, dentry, 1, 0);
if (error)
return error;
@@ -2700,7 +2716,7 @@ SYSCALL_DEFINE1(rmdir, const char __user *, pathname)
int vfs_unlink(struct inode *dir, struct dentry *dentry)
{
- int error = may_delete(dir, dentry, 0);
+ int error = may_delete(dir, dentry, 0, 0);
if (error)
return error;
@@ -3096,14 +3112,14 @@ int vfs_rename(struct inode *old_dir, struct dentry *old_dentry,
if (old_dentry->d_inode == new_dentry->d_inode)
return 0;
- error = may_delete(old_dir, old_dentry, is_dir);
+ error = may_delete(old_dir, old_dentry, is_dir, 0);
if (error)
return error;
if (!new_dentry->d_inode)
error = may_create(new_dir, new_dentry, is_dir);
else
- error = may_delete(new_dir, new_dentry, is_dir);
+ error = may_delete(new_dir, new_dentry, is_dir, 1);
if (error)
return error;
diff --git a/include/linux/fs.h b/include/linux/fs.h
index 60361c6..ccece40 100644
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -69,6 +69,8 @@ struct inodes_stat_t {
#define MAY_NOT_BLOCK 0x00000080
#define MAY_CREATE_FILE 0x00000100
#define MAY_CREATE_DIR 0x00000200
+#define MAY_DELETE_CHILD 0x00000400
+#define MAY_DELETE_SELF 0x00000800
/*
* flags in file.f_mode. Note that FMODE_READ and FMODE_WRITE must correspond
next prev parent reply other threads:[~2011-10-19 22:09 UTC|newest]
Thread overview: 66+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-10-18 15:32 [PATCH -V7 00/26] New ACL format for better NFSv4 acl interoperability Aneesh Kumar K.V
2011-10-18 15:32 ` [PATCH -V7 01/26] vfs: Indicate that the permission functions take all the MAY_* flags Aneesh Kumar K.V
2011-10-18 15:32 ` Aneesh Kumar K.V
2011-10-18 15:32 ` [PATCH -V7 02/26] vfs: Add hex format for MAY_* flag values Aneesh Kumar K.V
2011-10-18 15:32 ` [PATCH -V7 03/26] vfs: Pass all mask flags down to iop->check_acl Aneesh Kumar K.V
2011-10-18 15:32 ` [PATCH -V7 04/26] vfs: Add a comment to inode_permission() Aneesh Kumar K.V
2011-10-18 15:32 ` [PATCH -V7 05/26] vfs: Add generic IS_ACL() test for acl support Aneesh Kumar K.V
2011-10-18 15:32 ` [PATCH -V7 06/26] vfs: Add IS_RICHACL() test for richacl support Aneesh Kumar K.V
2011-10-18 15:32 ` [PATCH -V7 07/26] vfs: Optimize out IS_RICHACL() if CONFIG_FS_RICHACL is not defined Aneesh Kumar K.V
2011-10-18 15:32 ` [PATCH -V7 08/26] vfs: Add new file and directory create permission flags Aneesh Kumar K.V
2011-10-19 16:42 ` J. Bruce Fields
2011-10-20 5:20 ` Aneesh Kumar K.V
2011-10-20 5:20 ` Aneesh Kumar K.V
2011-10-18 15:32 ` [PATCH -V7 09/26] vfs: Add delete child and delete self " Aneesh Kumar K.V
2011-10-19 22:09 ` J. Bruce Fields [this message]
2011-10-20 7:35 ` Aneesh Kumar K.V
2011-10-20 7:35 ` Aneesh Kumar K.V
2011-10-20 8:11 ` J. Bruce Fields
2011-10-18 15:32 ` [PATCH -V7 10/26] vfs: Make the inode passed to inode_change_ok non-const Aneesh Kumar K.V
2011-10-18 15:32 ` Aneesh Kumar K.V
2011-10-18 15:32 ` [PATCH -V7 11/26] vfs: Add permission flags for setting file attributes Aneesh Kumar K.V
2011-10-18 15:32 ` Aneesh Kumar K.V
2011-10-18 15:32 ` [PATCH -V7 12/26] vfs: Make acl_permission_check() work for richacls Aneesh Kumar K.V
2011-10-18 15:32 ` [PATCH -V7 13/26] richacl: In-memory representation and helper functions Aneesh Kumar K.V
2011-10-18 15:32 ` [PATCH -V7 14/26] richacl: Permission mapping functions Aneesh Kumar K.V
2011-10-18 15:32 ` [PATCH -V7 15/26] richacl: Compute maximum file masks from an acl Aneesh Kumar K.V
2011-10-18 15:32 ` [PATCH -V7 16/26] richacl: Update the file masks in chmod() Aneesh Kumar K.V
2011-10-18 15:32 ` Aneesh Kumar K.V
2011-10-18 15:32 ` [PATCH -V7 17/26] richacl: Permission check algorithm Aneesh Kumar K.V
2011-10-18 15:32 ` [PATCH -V7 18/26] richacl: Create-time inheritance Aneesh Kumar K.V
2011-10-18 15:32 ` [PATCH -V7 19/26] richacl: Check if an acl is equivalent to a file mode Aneesh Kumar K.V
2011-10-18 15:32 ` [PATCH -V7 20/26] richacl: Automatic Inheritance Aneesh Kumar K.V
2011-10-18 15:32 ` [PATCH -V7 21/26] richacl: xattr mapping functions Aneesh Kumar K.V
2011-10-18 15:32 ` Aneesh Kumar K.V
2011-10-19 22:20 ` J. Bruce Fields
2011-10-20 8:30 ` Aneesh Kumar K.V
2011-10-20 9:14 ` J. Bruce Fields
2011-10-20 9:19 ` Christoph Hellwig
2011-10-20 10:25 ` J. Bruce Fields
2011-10-20 10:25 ` J. Bruce Fields
2011-10-20 23:46 ` Andreas Gruenbacher
2011-10-20 23:46 ` Andreas Gruenbacher
2011-10-21 0:45 ` J. Bruce Fields
2011-10-21 9:40 ` Aneesh Kumar K.V
2011-10-21 9:40 ` Aneesh Kumar K.V
2011-10-21 10:52 ` Andreas Gruenbacher
2011-10-21 13:12 ` Aneesh Kumar K.V
2011-10-21 23:58 ` Andreas Gruenbacher
2011-10-20 11:02 ` Aneesh Kumar K.V
2011-10-20 11:02 ` Aneesh Kumar K.V
2011-10-20 17:49 ` J. Bruce Fields
2011-10-20 17:49 ` J. Bruce Fields
2011-10-20 19:49 ` Andreas Dilger
2011-11-19 9:35 ` Eric W. Biederman
2011-11-19 9:28 ` Eric W. Biederman
2011-11-21 13:35 ` J. Bruce Fields
2011-10-18 15:32 ` [PATCH -V7 22/26] vfs: Cache richacl in struct inode Aneesh Kumar K.V
2011-10-18 15:32 ` [PATCH -V7 23/26] vfs: Add richacl permission check Aneesh Kumar K.V
2011-10-18 15:32 ` [PATCH -V7 24/26] ext4: Use IS_POSIXACL() to check for POSIX ACL support Aneesh Kumar K.V
2011-10-18 15:33 ` [PATCH -V7 25/26] ext4: Implement rich acl for ext4 Aneesh Kumar K.V
2011-10-18 18:41 ` Andreas Dilger
2011-10-19 5:43 ` Aneesh Kumar K.V
2011-10-18 15:33 ` [PATCH -V7 26/26] ext4: Add Ext4 compat richacl feature flag Aneesh Kumar K.V
2011-10-18 16:17 ` [PATCH -V7 00/26] New ACL format for better NFSv4 acl interoperability Shea Levy
2011-10-19 5:54 ` Aneesh Kumar K.V
2011-10-19 22:21 ` J. Bruce Fields
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20111019220915.GA1874@fieldses.org \
--to=bfields@fieldses.org \
--cc=agruen@kernel.org \
--cc=akpm@linux-foundation.org \
--cc=aneesh.kumar@linux.vnet.ibm.com \
--cc=dhowells@redhat.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-nfs@vger.kernel.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.