From mboxrd@z Thu Jan 1 00:00:00 1970 From: Al Viro Subject: Re: Can the VFS layer rely on i_uid Date: Mon, 5 Mar 2012 13:26:43 +0000 Message-ID: <20120305132642.GL23916@ZenIV.linux.org.uk> References: <20120305121239.GB9978@shadowen.org> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: linux-fsdevel@vger.kernel.org, Kees Cook To: Andy Whitcroft Return-path: Received: from zeniv.linux.org.uk ([195.92.253.2]:58626 "EHLO ZenIV.linux.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932172Ab2CEN0o (ORCPT ); Mon, 5 Mar 2012 08:26:44 -0500 Content-Disposition: inline In-Reply-To: <20120305121239.GB9978@shadowen.org> Sender: linux-fsdevel-owner@vger.kernel.org List-ID: On Mon, Mar 05, 2012 at 12:12:39PM +0000, Andy Whitcroft wrote: > When an inode does not provide a permissions() op generic permissions > checks are used and these assume that i_mode, i_uid, and i_gid are > all populated, using them directly to perform these checks. When a > permissions() op is provided obviously this code is not used. What is not > so clear to me is whether there is still an assumption or requirement that > these are populated in this case. My gut feeling is that if you have a > permissions() op then there is no obligation to use these fields at all, > indeed it seems entirely reasonable that your permission model not map > sensibly onto such permissions. Not quite... Ideally, yes, we'd want to have ->i_uid used only by fs-specific code and helpers used by that fs (including those that are implicit defaults). And BTW, you proposal to have non-trivial differences in behaviour of code based on whether ->permission() (and ->getattr()) is NULL is an atrocity - this kind of layering violations is wrong and brittle, so please abstain from that. In practice we have enough places where uid/gid is used directly to make setting them practically a requirement - places like /proc// can get away with not doing that, but only because shitloads of syscalls are not allowed on those anyway, permissions or no permissions. In anything general-purpose you really need to set it.