From: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
To: sfrench@us.ibm.com, ffilz@us.ibm.com, agruen@suse.de,
adilger@sun.com, sandeen@redhat.com, tytso@mit.edu,
staubach@redhat.com, bfields@citi.umich.edu, jlayton@redhat.com
Cc: aneesh.kumar@linux.vnet.ibm.com, linux-fsdevel@vger.kernel.org,
nfsv4@linux-nfs.org, linux-ext4@vger.kernel.org
Subject: [PATCH 07/23] vfs: Add Posix acl to rich acl mapping helpers
Date: Mon, 1 Feb 2010 11:04:49 +0530 [thread overview]
Message-ID: <1265002505-8387-8-git-send-email-aneesh.kumar@linux.vnet.ibm.com> (raw)
In-Reply-To: <1265002505-8387-1-git-send-email-aneesh.kumar@linux.vnet.ibm.com>
This patch add helpers that can be used by the file system to map
posix acls to rich acl format. This enables the file system to
return rich acl mapping the posix acls stored on disk when the
file system is enabled with rich acl format.
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
---
fs/Makefile | 2 +-
fs/richacl_base.c | 2 +-
fs/richacl_posix.c | 223 +++++++++++++++++++++++++++++++++++++++++++++++
include/linux/richacl.h | 3 +
4 files changed, 228 insertions(+), 2 deletions(-)
create mode 100644 fs/richacl_posix.c
diff --git a/fs/Makefile b/fs/Makefile
index 0a046a1..a5f3ee3 100644
--- a/fs/Makefile
+++ b/fs/Makefile
@@ -53,7 +53,7 @@ obj-$(CONFIG_GENERIC_ACL) += generic_acl.o
obj-$(CONFIG_FS_RICHACL) += richacl.o
richacl-y := richacl_base.o richacl_xattr.o \
- richacl_compat.o
+ richacl_compat.o richacl_posix.o
obj-y += quota/
diff --git a/fs/richacl_base.c b/fs/richacl_base.c
index e75f713..a176399 100644
--- a/fs/richacl_base.c
+++ b/fs/richacl_base.c
@@ -114,7 +114,7 @@ richacl_masks_to_mode(const struct richacl *acl)
}
EXPORT_SYMBOL_GPL(richacl_masks_to_mode);
-static unsigned int
+unsigned int
richacl_mode_to_mask(mode_t mode)
{
unsigned int mask = ACE4_POSIX_ALWAYS_ALLOWED;
diff --git a/fs/richacl_posix.c b/fs/richacl_posix.c
new file mode 100644
index 0000000..07db970
--- /dev/null
+++ b/fs/richacl_posix.c
@@ -0,0 +1,223 @@
+/*
+ * Copyright IBM Corporation, 2009
+ * Author Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of version 2.1 of the GNU Lesser General Public License
+ * as published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it would be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ *
+ */
+
+
+#include <linux/fs.h>
+#include <linux/richacl.h>
+#include <linux/posix_acl.h>
+
+static void posix_to_richacl(struct posix_acl *pacl, int type,
+ mode_t mode, struct richacl *acl)
+{
+ int eflags;
+ struct richace *ace;
+ unsigned short deny;
+ struct posix_acl_entry *pa, *pe, *acl_other = NULL;
+
+ if (type == ACL_TYPE_DEFAULT)
+ eflags = ACE4_FILE_INHERIT_ACE |
+ ACE4_DIRECTORY_INHERIT_ACE | ACE4_INHERIT_ONLY_ACE;
+ else
+ eflags = 0;
+
+ BUG_ON(pacl->a_count < 3);
+ /* Go to the last saved entry */
+ ace = acl->a_entries + acl->a_count;
+ FOREACH_ACL_ENTRY(pa, pacl, pe) {
+ switch (pa->e_tag) {
+ case ACL_USER_OBJ:
+ {
+ /* Everything that is not granted we deny */
+ deny = ~pa->e_perm ;
+ if (deny & 0x7) {
+ ace->e_type = ACE4_ACCESS_DENIED_ACE_TYPE;
+ ace->e_flags = eflags;
+ ace->e_mask = richacl_mode_to_mask(deny);
+ richace_set_who(ace, richace_owner_who);
+ acl->a_count++;
+ ace++;
+ }
+ /* Add allow entry */
+ ace->e_type = ACE4_ACCESS_ALLOWED_ACE_TYPE;
+ ace->e_flags = eflags;
+ ace->e_mask = richacl_mode_to_mask(pa->e_perm);
+ ace->e_mask |= ACE4_WRITE_ATTRIBUTES | ACE4_WRITE_ACL;
+ richace_set_who(ace, richace_owner_who);
+ acl->a_count++;
+ ace++;
+ break;
+ }
+ case ACL_USER:
+ {
+ /* Everything that is not granted we deny */
+ deny = ~pa->e_perm ;
+ if (deny & 0x7) {
+ ace->e_type = ACE4_ACCESS_DENIED_ACE_TYPE;
+ ace->e_flags = eflags;
+ ace->e_mask = richacl_mode_to_mask(deny);
+ ace->u.e_id = pa->e_id;
+ acl->a_count++;
+ ace++;
+ }
+ /* Add allow entry */
+ ace->e_type = ACE4_ACCESS_ALLOWED_ACE_TYPE;
+ ace->e_flags = eflags;
+ ace->e_mask = richacl_mode_to_mask(pa->e_perm);
+ ace->u.e_id = pa->e_id;
+ acl->a_count++;
+ ace++;
+ break;
+
+ }
+ case ACL_GROUP_OBJ:
+ {
+ /*
+ * In the case of group we apply allow first
+ * since a person can be in different group
+ */
+ ace->e_type = ACE4_ACCESS_ALLOWED_ACE_TYPE;
+ ace->e_flags = eflags;
+ ace->e_mask = richacl_mode_to_mask(pa->e_perm);
+ richace_set_who(ace, richace_group_who);
+ acl->a_count++;
+ ace++;
+ break;
+
+ }
+ case ACL_GROUP:
+ {
+ /* Add allow entries only */
+ ace->e_type = ACE4_ACCESS_ALLOWED_ACE_TYPE;
+ ace->e_flags = eflags | ACE4_IDENTIFIER_GROUP;
+ ace->e_mask = richacl_mode_to_mask(pa->e_perm);
+ ace->u.e_id = pa->e_id;
+ acl->a_count++;
+ ace++;
+ break;
+
+ }
+ case ACL_MASK:
+ {
+ /*
+ * We can ignore ACL_MASK values. We derive the
+ * respective values from the inode mode values
+ */
+ break;
+ }
+ case ACL_OTHER:
+ {
+ /*
+ * We should precess ACL_OTHER only after getting all
+ * user and group pa and then adding there respective
+ * deny entries
+ */
+ acl_other = pa;
+ break;
+
+ }
+ }
+ }
+ /*
+ * Now add the deny entries for ACL_GROUP and ACL_GROUP_OBJ entries
+ */
+ FOREACH_ACL_ENTRY(pa, pacl, pe) {
+ switch (pa->e_tag) {
+ case ACL_USER_OBJ:
+ case ACL_USER:
+ case ACL_MASK:
+ case ACL_OTHER:
+ break;
+ case ACL_GROUP_OBJ:
+ {
+ /* Everything that is not granted we deny */
+ deny = ~pa->e_perm ;
+ if (deny & 0x7) {
+ ace->e_type = ACE4_ACCESS_DENIED_ACE_TYPE;
+ ace->e_flags = eflags;
+ ace->e_mask = richacl_mode_to_mask(deny);
+ richace_set_who(ace, richace_group_who);
+ acl->a_count++;
+ ace++;
+ }
+ break;
+ }
+ case ACL_GROUP:
+ {
+ /* Everything that is not granted we deny */
+ deny = ~pa->e_perm ;
+ if (deny & 0x7) {
+ ace->e_type = ACE4_ACCESS_DENIED_ACE_TYPE;
+ ace->e_flags = eflags | ACE4_IDENTIFIER_GROUP;
+ ace->e_mask = richacl_mode_to_mask(deny);
+ ace->u.e_id = pa->e_id;
+ acl->a_count++;
+ ace++;
+ }
+ break;
+ }
+ }
+ }
+ /* Now handle ACL_OTHER entry */
+ if (acl_other) {
+ ace->e_type = ACE4_ACCESS_ALLOWED_ACE_TYPE;
+ ace->e_flags = eflags;
+ ace->e_mask = richacl_mode_to_mask(acl_other->e_perm);
+ richace_set_who(ace, richace_everyone_who);
+ acl->a_count++;
+ ace++;
+ }
+
+ /* set acl mask values */
+ acl->a_owner_mask = richacl_mode_to_mask(mode >> 6);
+ acl->a_group_mask = richacl_mode_to_mask(mode >> 3);
+ acl->a_other_mask = richacl_mode_to_mask(mode);
+
+ return;
+}
+
+struct richacl *map_posix_to_richacl(struct inode *inode,
+ struct posix_acl *pacl,
+ struct posix_acl *dpacl)
+{
+
+ struct richacl *acl;
+ int size = 0;
+
+ if (pacl) {
+ if (posix_acl_valid(pacl) < 0)
+ return ERR_PTR(-EINVAL);
+ size += 2*pacl->a_count;
+ }
+
+ if (dpacl) {
+ if (posix_acl_valid(dpacl) < 0)
+ return ERR_PTR(-EINVAL);
+ size += 2*dpacl->a_count;
+ }
+
+ /* Allocate the worst case one deny, allow pair each */
+ acl = richacl_alloc(size);
+ if (acl == NULL)
+ return ERR_PTR(-ENOMEM);
+
+ /* We will count actual number of entries when we map */
+ acl->a_count = 0;
+ if (pacl)
+ posix_to_richacl(pacl, ACL_TYPE_ACCESS , inode->i_mode, acl);
+
+ if (dpacl)
+ posix_to_richacl(dpacl, ACL_TYPE_DEFAULT, inode->i_mode, acl);
+
+ return acl;
+}
diff --git a/include/linux/richacl.h b/include/linux/richacl.h
index f9089dc..b08fdf1 100644
--- a/include/linux/richacl.h
+++ b/include/linux/richacl.h
@@ -228,8 +228,11 @@ extern int richace_is_same_who(const struct richace *, const struct richace *);
extern int richace_set_who(struct richace *ace, const char *who);
extern struct richacl *richacl_inherit(const struct richacl *, mode_t);
extern int richacl_masks_to_mode(const struct richacl *);
+extern unsigned int richacl_mode_to_mask(mode_t mode);
extern struct richacl *richacl_chmod(struct richacl *, mode_t);
extern int richacl_apply_masks(struct richacl **acl);
extern int richacl_write_through(struct richacl **acl);
+extern struct richacl *map_posix_to_richacl(struct inode *, struct posix_acl *,
+ struct posix_acl *);
#endif /* __RICHACL_H */
--
1.7.0.rc0.48.gdace5
next prev parent reply other threads:[~2010-02-01 5:34 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-02-01 5:34 [RFC PATCH] New ACL format for better NFSv4 acl interoperability Aneesh Kumar K.V
2010-02-01 5:34 ` [PATCH 01/23] vfs: VFS hooks for per-filesystem permission models Aneesh Kumar K.V
2010-02-01 5:34 ` [PATCH 02/23] vfs: Check for create permission during rename Aneesh Kumar K.V
2010-02-01 5:34 ` [PATCH 03/23] vfs: rich ACL in-memory representation and manipulation Aneesh Kumar K.V
2010-02-01 7:28 ` Brad Boyer
2010-02-01 18:02 ` Aneesh Kumar K. V
2010-02-01 23:06 ` J. Bruce Fields
2010-02-01 23:21 ` J. Bruce Fields
2010-02-01 5:34 ` [PATCH 04/23] richacl: Add write retention and retention hold access mask Aneesh Kumar K.V
2010-02-01 5:34 ` [PATCH 05/23] ext4: Implement rich acl for ext4 Aneesh Kumar K.V
2010-02-01 5:34 ` [PATCH 06/23] vfs: Implement those parts of Automatic Inheritance (AI) which are safe under POSIX Aneesh Kumar K.V
2010-02-01 5:34 ` Aneesh Kumar K.V [this message]
2010-02-01 23:18 ` [PATCH 07/23] vfs: Add Posix acl to rich acl mapping helpers J. Bruce Fields
2010-02-02 5:22 ` Aneesh Kumar K. V
2010-02-01 5:34 ` [PATCH 08/23] vfs: Add a flag to denote posix mapped richacl Aneesh Kumar K.V
2010-02-01 23:18 ` J. Bruce Fields
2010-02-02 5:33 ` Aneesh Kumar K. V
2010-02-02 15:18 ` J. Bruce Fields
2010-02-01 5:34 ` [PATCH 09/23] ext4: Add posix acl to rich acl mapping Aneesh Kumar K.V
2010-02-01 5:34 ` [PATCH 10/23] richacl: Add separate file and dir acl masks Aneesh Kumar K.V
2010-02-01 5:34 ` [PATCH 11/23] richacl: Move the xattr representation to little-endian format Aneesh Kumar K.V
2010-02-01 23:34 ` J. Bruce Fields
2010-02-02 5:35 ` Aneesh Kumar K. V
2010-02-01 5:34 ` [PATCH 12/23] richacl: Use directory specific mask values for operation on directories Aneesh Kumar K.V
2010-02-01 5:34 ` [PATCH 13/23] richacl: Follow nfs4 acl delete definition Aneesh Kumar K.V
2010-02-01 5:34 ` [PATCH 14/23] richacl: Disable automatic inheritance with posix mapped acls Aneesh Kumar K.V
2010-02-01 5:34 ` [PATCH 15/23] richacl: Delete posix acl if present on richacl set Aneesh Kumar K.V
2010-02-01 5:34 ` [PATCH 16/23] ext4: Update richacl incompat flag value Aneesh Kumar K.V
2010-02-01 23:41 ` J. Bruce Fields
2010-02-01 5:34 ` [PATCH 17/23] vfs: Add new MS_ACL and MS_RICHACL flag Aneesh Kumar K.V
2010-02-01 5:35 ` [PATCH 18/23] richacl: Add helper function for creating richacl from mode values Aneesh Kumar K.V
2010-02-01 5:35 ` [PATCH 19/23] fs: Use the correct MS_*ACL flags in file system code Aneesh Kumar K.V
2010-02-01 5:35 ` [PATCH 20/23] nfsd: Apply NFSv4acl to posix acl mapping only if MS_POSIXACL is set Aneesh Kumar K.V
2010-02-01 5:35 ` [PATCH 21/23] richacl: Add helpers for NFSv4 acl to richacl conversion Aneesh Kumar K.V
2010-02-01 5:35 ` [PATCH 22/23] nfsd: Add support for reading rich acl from file system Aneesh Kumar K.V
2010-02-01 5:35 ` [PATCH 23/23] nfsd: Add support for saving richacl Aneesh Kumar K.V
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1265002505-8387-8-git-send-email-aneesh.kumar@linux.vnet.ibm.com \
--to=aneesh.kumar@linux.vnet.ibm.com \
--cc=adilger@sun.com \
--cc=agruen@suse.de \
--cc=bfields@citi.umich.edu \
--cc=ffilz@us.ibm.com \
--cc=jlayton@redhat.com \
--cc=linux-ext4@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=nfsv4@linux-nfs.org \
--cc=sandeen@redhat.com \
--cc=sfrench@us.ibm.com \
--cc=staubach@redhat.com \
--cc=tytso@mit.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).