From: "Myklebust, Trond" <Trond.Myklebust@netapp.com>
To: Steve Dickson <SteveD@redhat.com>
Cc: "David P. Quigley" <dpquigl@tycho.nsa.gov>,
Linux NFS list <linux-nfs@vger.kernel.org>,
Linux FS devel list <linux-fsdevel@vger.kernel.org>,
Linux Security List <linux-security-module@vger.kernel.org>,
SELinux List <selinux@tycho.nsa.gov>
Subject: Re: [PATCH 07/13] NFSv4: Introduce new label structure
Date: Mon, 20 May 2013 19:12:38 +0000 [thread overview]
Message-ID: <1369077151.6115.22.camel@leira.trondhjem.org> (raw)
In-Reply-To: <1368719808-14584-8-git-send-email-SteveD@redhat.com>
On Thu, 2013-05-16 at 11:56 -0400, Steve Dickson wrote:
> From: David Quigley <dpquigl@davequigley.com>
>
> In order to mimic the way that NFSv4 ACLs are implemented we have created a
> structure to be used to pass label data up and down the call chain. This patch
> adds the new structure and new members to the required NFSv4 call structures.
>
> Signed-off-by: Matthew N. Dodd <Matthew.Dodd@sparta.com>
> Signed-off-by: Miguel Rodel Felipe <Rodel_FM@dsi.a-star.edu.sg>
> Signed-off-by: Phua Eu Gene <PHUA_Eu_Gene@dsi.a-star.edu.sg>
> Signed-off-by: Khin Mi Mi Aung <Mi_Mi_AUNG@dsi.a-star.edu.sg>
> ---
> fs/nfs/inode.c | 28 ++++++++++++++++++++++++++++
> include/linux/nfs4.h | 7 +++++++
> include/linux/nfs_fs.h | 18 ++++++++++++++++++
> include/linux/nfs_xdr.h | 21 +++++++++++++++++++++
> include/uapi/linux/nfs4.h | 2 +-
> 5 files changed, 75 insertions(+), 1 deletion(-)
>
> diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
> index c1c7a9d..07fcf0b 100644
> --- a/fs/nfs/inode.c
> +++ b/fs/nfs/inode.c
> @@ -257,6 +257,34 @@ nfs_init_locked(struct inode *inode, void *opaque)
> return 0;
> }
>
> +#ifdef CONFIG_NFS_V4_SECURITY_LABEL
> +struct nfs4_label *nfs4_label_alloc(struct nfs_server *server, gfp_t flags)
> +{
> + struct nfs4_label *label = NULL;
> + int minor_version = server->nfs_client->cl_minorversion;
> +
> + if (minor_version < 2)
> + return label;
> +
> + if (!(server->caps & NFS_CAP_SECURITY_LABEL))
> + return label;
> +
> + label = kzalloc(sizeof(struct nfs4_label), flags);
> + if (label == NULL)
> + return ERR_PTR(-ENOMEM);
> +
> + label->label = kzalloc(NFS4_MAXLABELLEN, flags);
> + if (label->label == NULL) {
> + kfree(label);
> + return ERR_PTR(-ENOMEM);
> + }
> + label->len = NFS4_MAXLABELLEN;
> +
> + return label;
> +}
> +EXPORT_SYMBOL_GPL(nfs4_label_alloc);
> +#endif
> +
> /*
> * This is our front-end to iget that looks up inodes by file handle
> * instead of inode number.
> diff --git a/include/linux/nfs4.h b/include/linux/nfs4.h
> index 4204600..e3698cd 100644
> --- a/include/linux/nfs4.h
> +++ b/include/linux/nfs4.h
> @@ -32,6 +32,13 @@ struct nfs4_acl {
> struct nfs4_ace aces[0];
> };
>
> +struct nfs4_label {
> + uint32_t lfs;
> + uint32_t pi;
> + u32 len;
> + char *label;
> +};
> +
> typedef struct { char data[NFS4_VERIFIER_SIZE]; } nfs4_verifier;
>
> struct nfs_stateid4 {
> diff --git a/include/linux/nfs_fs.h b/include/linux/nfs_fs.h
> index fc01d5c..39b2404 100644
> --- a/include/linux/nfs_fs.h
> +++ b/include/linux/nfs_fs.h
> @@ -497,6 +497,24 @@ extern int nfs_mountpoint_expiry_timeout;
> extern void nfs_release_automount_timer(void);
>
> /*
> + * linux/fs/nfs/nfs4proc.c
> + */
> +#ifdef CONFIG_NFS_V4_SECURITY_LABEL
> +extern struct nfs4_label *nfs4_label_alloc(struct nfs_server *server, gfp_t flags);
> +static inline void nfs4_label_free(struct nfs4_label *label)
> +{
> + if (label) {
> + kfree(label->label);
> + kfree(label);
> + }
> + return;
> +}
> +#else
> +static inline struct nfs4_label *nfs4_label_alloc(struct nfs_server *server, gfp_t flags) { return NULL; }
> +static inline void nfs4_label_free(void *label) {}
> +#endif
> +
> +/*
> * linux/fs/nfs/unlink.c
> */
> extern void nfs_complete_unlink(struct dentry *dentry, struct inode *);
> diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
> index bfdf6e0..2c13d43 100644
> --- a/include/linux/nfs_xdr.h
> +++ b/include/linux/nfs_xdr.h
> @@ -349,6 +349,7 @@ struct nfs_openargs {
> const u32 * open_bitmap;
> __u32 claim;
> enum createmode4 createmode;
> + const struct nfs4_label *label;
> };
>
> struct nfs_openres {
> @@ -358,6 +359,7 @@ struct nfs_openres {
> struct nfs4_change_info cinfo;
> __u32 rflags;
> struct nfs_fattr * f_attr;
> + struct nfs4_label *f_label;
> struct nfs_seqid * seqid;
> const struct nfs_server *server;
> fmode_t delegation_type;
> @@ -402,6 +404,7 @@ struct nfs_closeres {
> struct nfs4_sequence_res seq_res;
> nfs4_stateid stateid;
> struct nfs_fattr * fattr;
> + struct nfs4_label *label;
> struct nfs_seqid * seqid;
> const struct nfs_server *server;
> };
> @@ -475,6 +478,7 @@ struct nfs4_delegreturnargs {
> struct nfs4_delegreturnres {
> struct nfs4_sequence_res seq_res;
> struct nfs_fattr * fattr;
> + struct nfs4_label *label;
> const struct nfs_server *server;
> };
>
> @@ -496,6 +500,7 @@ struct nfs_readargs {
> struct nfs_readres {
> struct nfs4_sequence_res seq_res;
> struct nfs_fattr * fattr;
> + struct nfs4_label *label;
> __u32 count;
> int eof;
> };
> @@ -565,6 +570,7 @@ struct nfs_removeres {
> struct nfs4_sequence_res seq_res;
> const struct nfs_server *server;
> struct nfs_fattr *dir_attr;
> + struct nfs4_label *dir_label;
> struct nfs4_change_info cinfo;
> };
>
> @@ -577,6 +583,8 @@ struct nfs_renameargs {
> const struct nfs_fh *new_dir;
> const struct qstr *old_name;
> const struct qstr *new_name;
> + const struct nfs4_label *old_label;
> + const struct nfs4_label *new_label;
> };
>
> struct nfs_renameres {
> @@ -584,8 +592,10 @@ struct nfs_renameres {
> const struct nfs_server *server;
> struct nfs4_change_info old_cinfo;
> struct nfs_fattr *old_fattr;
> + struct nfs4_label *old_label;
> struct nfs4_change_info new_cinfo;
> struct nfs_fattr *new_fattr;
> + struct nfs4_label *new_label;
> };
>
> /*
> @@ -600,6 +610,7 @@ struct nfs_entry {
> int eof;
> struct nfs_fh * fh;
> struct nfs_fattr * fattr;
> + struct nfs4_label *label;
> unsigned char d_type;
> struct nfs_server * server;
> };
> @@ -632,6 +643,7 @@ struct nfs_setattrargs {
> struct iattr * iap;
> const struct nfs_server * server; /* Needed for name mapping */
> const u32 * bitmask;
> + const struct nfs4_label *label;
> };
>
> struct nfs_setaclargs {
> @@ -667,6 +679,7 @@ struct nfs_getaclres {
> struct nfs_setattrres {
> struct nfs4_sequence_res seq_res;
> struct nfs_fattr * fattr;
> + struct nfs4_label *label;
> const struct nfs_server * server;
> };
>
> @@ -712,6 +725,7 @@ struct nfs3_setaclargs {
> struct nfs_diropok {
> struct nfs_fh * fh;
> struct nfs_fattr * fattr;
> + struct nfs4_label *label;
> };
>
> struct nfs_readlinkargs {
> @@ -842,6 +856,7 @@ struct nfs4_accessres {
> struct nfs4_sequence_res seq_res;
> const struct nfs_server * server;
> struct nfs_fattr * fattr;
> + struct nfs4_label *label;
> u32 supported;
> u32 access;
> };
> @@ -864,6 +879,7 @@ struct nfs4_create_arg {
> const struct iattr * attrs;
> const struct nfs_fh * dir_fh;
> const u32 * bitmask;
> + const struct nfs4_label *label;
> };
>
> struct nfs4_create_res {
> @@ -871,6 +887,7 @@ struct nfs4_create_res {
> const struct nfs_server * server;
> struct nfs_fh * fh;
> struct nfs_fattr * fattr;
> + struct nfs4_label *label;
> struct nfs4_change_info dir_cinfo;
> };
>
> @@ -895,6 +912,7 @@ struct nfs4_getattr_res {
> struct nfs4_sequence_res seq_res;
> const struct nfs_server * server;
> struct nfs_fattr * fattr;
> + struct nfs4_label *label;
> };
>
> struct nfs4_link_arg {
> @@ -909,8 +927,10 @@ struct nfs4_link_res {
> struct nfs4_sequence_res seq_res;
> const struct nfs_server * server;
> struct nfs_fattr * fattr;
> + struct nfs4_label *label;
> struct nfs4_change_info cinfo;
> struct nfs_fattr * dir_attr;
> + struct nfs4_label *dir_label;
I thought we were getting rid of all these unnecessary dir_labels etc.?
We agreed that we don't need to read labels on link, remove, readlink
etc.
> };
>
>
> @@ -926,6 +946,7 @@ struct nfs4_lookup_res {
> const struct nfs_server * server;
> struct nfs_fattr * fattr;
> struct nfs_fh * fh;
> + struct nfs4_label *label;
> };
>
> struct nfs4_lookup_root_arg {
> diff --git a/include/uapi/linux/nfs4.h b/include/uapi/linux/nfs4.h
> index 788128e..78d25b5 100644
> --- a/include/uapi/linux/nfs4.h
> +++ b/include/uapi/linux/nfs4.h
> @@ -25,7 +25,7 @@
> #define NFS4_MAXNAMLEN NAME_MAX
> #define NFS4_OPAQUE_LIMIT 1024
> #define NFS4_MAX_SESSIONID_LEN 16
> -
> +#define NFS4_MAXLABELLEN 2048
Why does this belong in the uapi?
> #define NFS4_ACCESS_READ 0x0001
> #define NFS4_ACCESS_LOOKUP 0x0002
> #define NFS4_ACCESS_MODIFY 0x0004
--
Trond Myklebust
Linux NFS client maintainer
NetApp
Trond.Myklebust@netapp.com
www.netapp.com
next prev parent reply other threads:[~2013-05-20 19:12 UTC|newest]
Thread overview: 39+ messages / expand[flat|nested] mbox.gz Atom feed top
2013-05-16 15:56 Froe e71bf1d708e1294b3bae64d04f03228b3625f2a3 Mon Sep 17 00:00:00 2001 Steve Dickson
2013-05-16 15:56 ` [PATCH 01/13] Security: Add hook to calculate context based on a negative dentry Steve Dickson
2013-05-20 21:14 ` Eric Paris
2013-05-16 15:56 ` [PATCH 02/13] Security: Add Hook to test if the particular xattr is part of a MAC model Steve Dickson
2013-05-20 21:15 ` Eric Paris
2013-05-16 15:56 ` [PATCH 03/13] LSM: Add flags field to security_sb_set_mnt_opts for in kernel mount data Steve Dickson
2013-05-20 21:15 ` Eric Paris
2013-05-16 15:56 ` [PATCH 04/13] SELinux: Add new labeling type native labels Steve Dickson
2013-05-20 21:16 ` Eric Paris
2013-05-16 15:56 ` [PATCH 05/13] NFSv4.2: Added NFS v4.2 support to the NFS client Steve Dickson
2013-05-20 19:06 ` Myklebust, Trond
2013-05-30 20:51 ` Bryan Schumaker
2013-05-31 21:12 ` Steve Dickson
2013-05-16 15:56 ` [PATCH 06/13] NFSv4: Add label recommended attribute and NFSv4 flags Steve Dickson
2013-05-16 15:56 ` [PATCH 07/13] NFSv4: Introduce new label structure Steve Dickson
2013-05-20 19:12 ` Myklebust, Trond [this message]
2013-05-21 18:53 ` Steve Dickson
2013-05-21 18:55 ` Myklebust, Trond
2013-05-16 15:56 ` [PATCH 08/13] NFSv4: Extend fattr bitmaps to support all 3 words Steve Dickson
2013-05-16 15:56 ` [PATCH 09/13] NFS:Add labels to client function prototypes Steve Dickson
2013-05-20 19:24 ` Myklebust, Trond
2013-05-16 15:56 ` [PATCH 10/13] NFS: Add label lifecycle management Steve Dickson
2013-05-16 15:56 ` [PATCH 11/13] NFS: Client implementation of Labeled-NFS Steve Dickson
2013-05-20 19:33 ` Myklebust, Trond
2013-05-20 19:40 ` Myklebust, Trond
2013-05-16 15:56 ` [PATCH 12/13] NFS: Extend NFS xattr handlers to accept the security namespace Steve Dickson
2013-05-16 15:56 ` [PATCH 13/13] Kconfig: Add Kconfig entry for Labeled NFS V4 client Steve Dickson
2013-05-20 20:57 ` Eric Paris
2013-05-20 21:12 ` Myklebust, Trond
2013-05-20 21:14 ` Myklebust, Trond
-- strict thread matches above, loose matches on Subject: below --
2013-05-22 16:50 [PATCH 00/13] lnfs: 3.10-rc2 release Steve Dickson
2013-05-22 16:50 ` [PATCH 07/13] NFSv4: Introduce new label structure Steve Dickson
2013-05-13 19:11 [PATCH 00/13] lnfs: linux-3.10-rc1 release Steve Dickson
2013-05-13 19:11 ` [PATCH 07/13] NFSv4: Introduce new label structure Steve Dickson
2012-12-17 15:42 [PATCH 00/13] NFSv4: Label NFS Patches Steve Dickson
2012-12-17 15:43 ` [PATCH 07/13] NFSv4: Introduce new label structure Steve Dickson
2012-11-12 6:15 Labeled NFS [v5] David Quigley
2012-11-12 6:15 ` [PATCH 07/13] NFSv4: Introduce new label structure David Quigley
2012-11-12 15:13 ` J. Bruce Fields
2012-11-12 15:32 ` David P. Quigley
2012-11-12 16:05 ` J. Bruce Fields
2012-11-12 16:53 ` David P. Quigley
2012-11-12 17:50 ` J. Bruce Fields
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1369077151.6115.22.camel@leira.trondhjem.org \
--to=trond.myklebust@netapp.com \
--cc=SteveD@redhat.com \
--cc=dpquigl@tycho.nsa.gov \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-nfs@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=selinux@tycho.nsa.gov \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).