From: Anna Schumaker <Anna.Schumaker@netapp.com>
To: Andreas Gruenbacher <andreas.gruenbacher@gmail.com>,
<linux-kernel@vger.kernel.org>
Cc: <linux-fsdevel@vger.kernel.org>, <linux-nfs@vger.kernel.org>,
<linux-api@vger.kernel.org>, <samba-technical@lists.samba.org>,
<linux-security-module@vger.kernel.org>,
Andreas Gruenbacher <agruenba@redhat.com>
Subject: Re: [PATCH v5 39/39] nfs: Add support for the v4.1 dacl attribute
Date: Wed, 22 Jul 2015 11:57:56 -0400 [thread overview]
Message-ID: <55AFBD84.5040904@Netapp.com> (raw)
In-Reply-To: <1437570209-29832-40-git-send-email-andreas.gruenbacher@gmail.com>
Hi Andreas,
On 07/22/2015 09:03 AM, Andreas Gruenbacher wrote:
> From: Andreas Gruenbacher <agruenba@redhat.com>
>
> The dacl attribute includes Automatic Inheritance flags not supported by the
> acl attribute. it is only supported in NFS version 4.1 and higher. On systems
> where NFS version 4.0 is still the default, an additional mount option is
> needed:
>
> mount -t nfs4 -o minorversion=1 [...]
Discussions around deprecating or removing the minorversion= argument have come up recently. The preferred way of mounting NFS v4.1 these days is with: "-o vers=4.1". Can you update your patch description so we don't confuse people? :)
Thanks,
Anna
>
> Signed-off-by: Andreas Gruenbacher <agruenba@redhat.com>
> ---
> fs/nfs/nfs4proc.c | 2 +-
> fs/nfs/nfs4xdr.c | 55 ++++++++++++++++++++++++++++++++++++++++++-------
> include/linux/nfs_xdr.h | 2 +-
> 3 files changed, 50 insertions(+), 9 deletions(-)
>
> diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
> index 5ba49c3..39f5548 100644
> --- a/fs/nfs/nfs4proc.c
> +++ b/fs/nfs/nfs4proc.c
> @@ -4469,7 +4469,7 @@ static struct richacl *__nfs4_get_acl_uncached(struct inode *inode)
> struct nfs_server *server = NFS_SERVER(inode);
> struct page *pages[DIV_ROUND_UP(NFS4ACL_SIZE_MAX, PAGE_SIZE)] = {};
> struct nfs_getaclargs args = {
> - .fh = NFS_FH(inode),
> + .inode = inode,
> .acl_pages = pages,
> .acl_len = ARRAY_SIZE(pages) * PAGE_SIZE,
> };
> diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
> index 85270df..06f5759 100644
> --- a/fs/nfs/nfs4xdr.c
> +++ b/fs/nfs/nfs4xdr.c
> @@ -1649,9 +1649,16 @@ encode_setacl(struct xdr_stream *xdr, struct nfs_setaclargs *arg, struct compoun
> encode_nfs4_stateid(xdr, &zero_stateid);
>
> /* Encode attribute bitmap. */
> - p = reserve_space(xdr, 2*4);
> - *p++ = cpu_to_be32(1);
> - *p = cpu_to_be32(FATTR4_WORD0_ACL);
> + if (arg->server->attr_bitmask[1] & FATTR4_WORD1_DACL) {
> + p = reserve_space(xdr, 3*4);
> + *p++ = cpu_to_be32(2);
> + *p++ = 0;
> + *p = cpu_to_be32(FATTR4_WORD1_DACL);
> + } else {
> + p = reserve_space(xdr, 2*4);
> + *p++ = cpu_to_be32(1);
> + *p = cpu_to_be32(FATTR4_WORD0_ACL);
> + }
>
> attrlen_offset = xdr->buf->len;
> xdr_reserve_space(xdr, 4); /* to be backfilled later */
> @@ -2486,9 +2493,12 @@ static void nfs4_xdr_enc_getacl(struct rpc_rqst *req, struct xdr_stream *xdr,
>
> encode_compound_hdr(xdr, req, &hdr);
> encode_sequence(xdr, &args->seq_args, &hdr);
> - encode_putfh(xdr, args->fh, &hdr);
> + encode_putfh(xdr, NFS_FH(args->inode), &hdr);
> replen = hdr.replen + op_decode_hdr_maxsz + 1;
> - encode_getattr_two(xdr, FATTR4_WORD0_ACL, FATTR4_WORD1_MODE, &hdr);
> + if (NFS_SERVER(args->inode)->attr_bitmask[1] & FATTR4_WORD1_DACL)
> + encode_getattr_two(xdr, 0, FATTR4_WORD1_MODE | FATTR4_WORD1_DACL, &hdr);
> + else
> + encode_getattr_two(xdr, FATTR4_WORD0_ACL, FATTR4_WORD1_MODE, &hdr);
>
> xdr_inline_pages(&req->rq_rcv_buf, replen << 2,
> args->acl_pages, 0, args->acl_len);
> @@ -5376,14 +5386,28 @@ static int decode_getacl(struct xdr_stream *xdr, struct rpc_rqst *req,
>
> if (unlikely(bitmap[0] & (FATTR4_WORD0_ACL - 1U)))
> return -EIO;
> - if (likely(bitmap[0] & FATTR4_WORD0_ACL)) {
> +
> + if (bitmap[0] & FATTR4_WORD0_ACL) {
> + struct richace *ace;
> +
> + if (bitmap[1] & FATTR4_WORD1_DACL)
> + return -EIO;
> +
> acl = decode_acl_entries(xdr, res->server);
> status = PTR_ERR(acl);
> if (IS_ERR(acl))
> goto out;
> +
> + status = -EIO;
> + richacl_for_each_entry(ace, acl) {
> + if (ace->e_flags & RICHACE_INHERITED_ACE)
> + goto out;
> + }
> bitmap[0] &= ~FATTR4_WORD0_ACL;
> - } else
> + } else if (!(bitmap[1] & FATTR4_WORD1_DACL)) {
> status = -EOPNOTSUPP;
> + goto out;
> + }
>
> status = -EIO;
> if (unlikely(bitmap[0]))
> @@ -5391,6 +5415,23 @@ static int decode_getacl(struct xdr_stream *xdr, struct rpc_rqst *req,
>
> if ((status = decode_attr_mode(xdr, bitmap, &res->mode)) < 0)
> goto out;
> + if (bitmap[1] & FATTR4_WORD1_DACL) {
> + unsigned int flags;
> + __be32 *p;
> +
> + p = xdr_inline_decode(xdr, 4);
> + status = -EIO;
> + if (unlikely(!p))
> + goto out;
> + flags = be32_to_cpup(p);
> +
> + acl = decode_acl_entries(xdr, res->server);
> + status = PTR_ERR(acl);
> + if (IS_ERR(acl))
> + goto out;
> + acl->a_flags = flags;
> + bitmap[1] &= ~FATTR4_WORD1_DACL;
> + }
> status = 0;
>
> out:
> diff --git a/include/linux/nfs_xdr.h b/include/linux/nfs_xdr.h
> index f1c8f93..abe0b66 100644
> --- a/include/linux/nfs_xdr.h
> +++ b/include/linux/nfs_xdr.h
> @@ -695,7 +695,7 @@ struct nfs_setaclres {
>
> struct nfs_getaclargs {
> struct nfs4_sequence_args seq_args;
> - struct nfs_fh * fh;
> + struct inode * inode;
> size_t acl_len;
> struct page ** acl_pages;
> };
>
next prev parent reply other threads:[~2015-07-22 15:58 UTC|newest]
Thread overview: 42+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-07-22 13:02 [PATCH v5 00/39] Richacls Andreas Gruenbacher
2015-07-22 13:02 ` [PATCH v5 01/39] vfs: Add IS_ACL() and IS_RICHACL() tests Andreas Gruenbacher
2015-07-22 13:02 ` [PATCH v5 02/39] vfs: Add MAY_CREATE_FILE and MAY_CREATE_DIR permission flags Andreas Gruenbacher
2015-07-22 13:02 ` [PATCH v5 03/39] vfs: Add MAY_DELETE_SELF and MAY_DELETE_CHILD " Andreas Gruenbacher
2015-07-22 13:02 ` [PATCH v5 04/39] vfs: Make the inode passed to inode_change_ok non-const Andreas Gruenbacher
2015-07-22 13:02 ` [PATCH v5 05/39] vfs: Add permission flags for setting file attributes Andreas Gruenbacher
2015-07-22 13:02 ` [PATCH v5 06/39] richacl: In-memory representation and helper functions Andreas Gruenbacher
2015-07-22 13:02 ` [PATCH v5 07/39] richacl: Permission mapping functions Andreas Gruenbacher
2015-07-22 13:02 ` [PATCH v5 08/39] richacl: Compute maximum file masks from an acl Andreas Gruenbacher
2015-07-22 13:02 ` [PATCH v5 09/39] richacl: Update the file masks in chmod() Andreas Gruenbacher
2015-07-22 13:03 ` [PATCH v5 10/39] richacl: Permission check algorithm Andreas Gruenbacher
2015-07-22 13:03 ` [PATCH v5 11/39] vfs: Cache base_acl objects in inodes Andreas Gruenbacher
2015-07-22 13:03 ` [PATCH v5 12/39] vfs: Cache richacl in struct inode Andreas Gruenbacher
2015-07-22 13:03 ` [PATCH v5 13/39] richacl: Check if an acl is equivalent to a file mode Andreas Gruenbacher
2015-07-22 13:03 ` [PATCH v5 14/39] richacl: Create-time inheritance Andreas Gruenbacher
2015-07-22 13:03 ` [PATCH v5 15/39] richacl: Automatic Inheritance Andreas Gruenbacher
2015-07-22 13:03 ` [PATCH v5 16/39] richacl: xattr mapping functions Andreas Gruenbacher
2015-07-22 13:03 ` [PATCH v5 17/39] vfs: Add richacl permission checking Andreas Gruenbacher
2015-07-22 13:03 ` [PATCH v5 18/39] ext4: Add richacl support Andreas Gruenbacher
2015-07-22 13:03 ` [PATCH v5 19/39] ext4: Add richacl feature flag Andreas Gruenbacher
2015-07-22 13:03 ` [PATCH v5 20/39] richacl: acl editing helper functions Andreas Gruenbacher
2015-07-22 13:03 ` [PATCH v5 21/39] richacl: Move everyone@ aces down the acl Andreas Gruenbacher
2015-07-22 13:03 ` [PATCH v5 22/39] richacl: Propagate everyone@ permissions to other aces Andreas Gruenbacher
2015-07-22 13:03 ` [PATCH v5 23/39] richacl: Set the owner permissions to the owner mask Andreas Gruenbacher
2015-07-22 13:03 ` [PATCH v5 24/39] richacl: Set the other permissions to the other mask Andreas Gruenbacher
2015-07-22 13:03 ` [PATCH v5 25/39] richacl: Isolate the owner and group classes Andreas Gruenbacher
2015-07-22 13:03 ` [PATCH v5 26/39] richacl: Apply the file masks to a richacl Andreas Gruenbacher
2015-07-22 13:03 ` [PATCH v5 27/39] richacl: Create richacl from mode values Andreas Gruenbacher
2015-07-22 13:03 ` [PATCH v5 28/39] nfsd: Keep list of acls to dispose of in compoundargs Andreas Gruenbacher
2015-07-22 13:03 ` [PATCH v5 29/39] nfsd: Use richacls as internal acl representation Andreas Gruenbacher
2015-07-22 13:03 ` [PATCH v5 30/39] nfsd: Add richacl support Andreas Gruenbacher
2015-07-22 13:03 ` [PATCH v5 31/39] nfsd: Add support for the v4.1 dacl attribute Andreas Gruenbacher
2015-07-22 13:03 ` [PATCH v5 32/39] richacl: Add support for unmapped identifiers Andreas Gruenbacher
2015-07-22 13:03 ` [PATCH v5 33/39] ext4: Don't allow unmapped identifiers in richacls Andreas Gruenbacher
2015-07-22 13:03 ` [PATCH v5 34/39] sunrpc: Allow to demand-allocate pages to encode into Andreas Gruenbacher
2015-07-22 13:03 ` [PATCH v5 35/39] sunrpc: Add xdr_init_encode_pages Andreas Gruenbacher
2015-07-22 13:03 ` [PATCH v5 36/39] nfs: Fix GETATTR bitmap verification Andreas Gruenbacher
2015-07-22 13:03 ` [PATCH v5 37/39] nfs: Remove unused xdr page offsets in getacl/setacl arguments Andreas Gruenbacher
2015-07-22 13:03 ` [PATCH v5 38/39] nfs: Add richacl support Andreas Gruenbacher
2015-07-22 13:03 ` [PATCH v5 39/39] nfs: Add support for the v4.1 dacl attribute Andreas Gruenbacher
2015-07-22 15:57 ` Anna Schumaker [this message]
2015-07-22 16:08 ` Andreas Grünbacher
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=55AFBD84.5040904@Netapp.com \
--to=anna.schumaker@netapp.com \
--cc=agruenba@redhat.com \
--cc=andreas.gruenbacher@gmail.com \
--cc=linux-api@vger.kernel.org \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-nfs@vger.kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=samba-technical@lists.samba.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox