From: "Aneesh Kumar K.V" <aneesh.kumar@linux.vnet.ibm.com>
To: Dave Chinner <david@fromorbit.com>
Cc: agruen@kernel.org, bfields@fieldses.org,
akpm@linux-foundation.org, viro@zeniv.linux.org.uk,
dhowells@redhat.com, linux-fsdevel@vger.kernel.org,
linux-nfs@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH -V1 09/22] vfs: Make acl_permission_check() work for richacls
Date: Thu, 01 May 2014 21:09:23 +0530 [thread overview]
Message-ID: <87fvktbj9w.fsf@linux.vnet.ibm.com> (raw)
In-Reply-To: <20140429002013.GR15995@dastard>
Dave Chinner <david@fromorbit.com> writes:
> On Sun, Apr 27, 2014 at 09:44:40PM +0530, Aneesh Kumar K.V wrote:
>> From: Andreas Gruenbacher <agruen@kernel.org>
>>
>> Signed-off-by: Andreas Gruenbacher <agruen@kernel.org>
>> Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
>> ---
>> fs/namei.c | 13 +++++++++++++
>> 1 file changed, 13 insertions(+)
>>
>> diff --git a/fs/namei.c b/fs/namei.c
>> index 26b9a8212837..06474553c08d 100644
>> --- a/fs/namei.c
>> +++ b/fs/namei.c
>> @@ -284,6 +284,19 @@ static int acl_permission_check(struct inode *inode, int mask)
>> {
>> unsigned int mode = inode->i_mode;
>>
>> + if (IS_RICHACL(inode)) {
>> + int error = check_acl(inode, mask);
>> + if (error != -EAGAIN)
>> + return error;
>> + if (mask & (MAY_DELETE_SELF | MAY_TAKE_OWNERSHIP |
>> + MAY_CHMOD | MAY_SET_TIMES)) {
>> + /*
>> + * The file permission bit cannot grant these
>> + * permissions.
>> + */
>> + return -EACCES;
>> + }
>> + }
>> if (likely(uid_eq(current_fsuid(), inode->i_uid)))
>> mode >>= 6;
>> else {
>
> why does this take priority over a simple uid match? Some comments
> explaining this for people unfamiliar with richacls would be nice.
> Not to mention the commit message should also explain the change...
>
Richacl can have further limitation on file owner. Will add more
comments around the function.
-aneesh
next prev parent reply other threads:[~2014-05-01 15:39 UTC|newest]
Thread overview: 49+ messages / expand[flat|nested] mbox.gz Atom feed top
2014-04-27 16:14 [PATCH -V1 00/22] New ACL format for better NFSv4 acl interoperability Aneesh Kumar K.V
2014-04-27 16:14 ` [PATCH -V1 01/22] vfs: Add generic IS_ACL() test for acl support Aneesh Kumar K.V
2014-04-27 16:14 ` [PATCH -V1 02/22] vfs: Add IS_RICHACL() test for richacl support Aneesh Kumar K.V
2014-04-27 16:14 ` [PATCH -V1 03/22] vfs: Optimize out IS_RICHACL() if CONFIG_FS_RICHACL is not defined Aneesh Kumar K.V
2014-04-27 16:14 ` [PATCH -V1 04/22] vfs: check for directory early Aneesh Kumar K.V
2014-04-27 16:14 ` [PATCH -V1 05/22] vfs: Add new file and directory create permission flags Aneesh Kumar K.V
2014-04-28 11:23 ` Jeff Layton
2014-04-29 0:04 ` Dave Chinner
2014-05-01 15:16 ` Aneesh Kumar K.V
2014-04-27 16:14 ` [PATCH -V1 06/22] vfs: Add delete child and delete self " Aneesh Kumar K.V
2014-04-29 0:07 ` Dave Chinner
2014-05-01 15:18 ` Aneesh Kumar K.V
2014-04-27 16:14 ` [PATCH -V1 07/22] vfs: Make the inode passed to inode_change_ok non-const Aneesh Kumar K.V
2014-04-27 16:14 ` [PATCH -V1 08/22] vfs: Add permission flags for setting file attributes Aneesh Kumar K.V
2014-04-29 0:17 ` Dave Chinner
2014-05-01 15:20 ` Aneesh Kumar K.V
2014-04-27 16:14 ` [PATCH -V1 09/22] vfs: Make acl_permission_check() work for richacls Aneesh Kumar K.V
2014-04-29 0:20 ` Dave Chinner
2014-05-01 15:39 ` Aneesh Kumar K.V [this message]
2014-04-27 16:14 ` [PATCH -V1 10/22] richacl: In-memory representation and helper functions Aneesh Kumar K.V
2014-04-29 0:24 ` Dave Chinner
2014-05-01 15:42 ` Aneesh Kumar K.V
2014-05-06 9:35 ` Kinglong Mee
2014-04-27 16:14 ` [PATCH -V1 11/22] richacl: Permission mapping functions Aneesh Kumar K.V
2014-04-27 16:14 ` [PATCH -V1 12/22] richacl: Compute maximum file masks from an acl Aneesh Kumar K.V
2014-04-27 16:14 ` [PATCH -V1 13/22] richacl: Update the file masks in chmod() Aneesh Kumar K.V
2014-04-27 16:14 ` [PATCH -V1 14/22] richacl: Permission check algorithm Aneesh Kumar K.V
2014-04-27 16:14 ` [PATCH -V1 15/22] richacl: Create-time inheritance Aneesh Kumar K.V
2014-04-27 16:14 ` [PATCH -V1 16/22] richacl: Check if an acl is equivalent to a file mode Aneesh Kumar K.V
2014-04-27 16:14 ` [PATCH -V1 17/22] richacl: Automatic Inheritance Aneesh Kumar K.V
2014-04-27 16:14 ` [PATCH -V1 18/22] richacl: xattr mapping functions Aneesh Kumar K.V
2014-04-27 16:14 ` [PATCH -V1 19/22] vfs: Cache richacl in struct inode Aneesh Kumar K.V
2014-04-29 0:52 ` Dave Chinner
2014-04-29 12:16 ` Matthew Wilcox
2014-05-01 15:45 ` Aneesh Kumar K.V
2014-04-27 16:14 ` [PATCH -V1 20/22] vfs: Add richacl permission check Aneesh Kumar K.V
2014-04-27 16:14 ` [PATCH -V1 21/22] ext4: Implement rich acl for ext4 Aneesh Kumar K.V
2014-04-27 16:14 ` [PATCH -V1 22/22] ext4: Add Ext4 compat richacl feature flag Aneesh Kumar K.V
2014-04-28 21:31 ` Andreas Dilger
2014-05-01 15:48 ` Aneesh Kumar K.V
2014-05-01 17:52 ` Andreas Dilger
2014-04-27 22:20 ` [PATCH -V1 00/22] New ACL format for better NFSv4 acl interoperability Dave Chinner
2014-04-28 5:24 ` Aneesh Kumar K.V
2014-04-28 23:58 ` Dave Chinner
2014-05-01 15:49 ` Aneesh Kumar K.V
2014-04-28 4:39 ` Christoph Hellwig
2014-04-28 5:54 ` Aneesh Kumar K.V
2014-04-28 9:03 ` Christoph Hellwig
2014-05-06 20:15 ` J. Bruce Fields
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=87fvktbj9w.fsf@linux.vnet.ibm.com \
--to=aneesh.kumar@linux.vnet.ibm.com \
--cc=agruen@kernel.org \
--cc=akpm@linux-foundation.org \
--cc=bfields@fieldses.org \
--cc=david@fromorbit.com \
--cc=dhowells@redhat.com \
--cc=linux-fsdevel@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-nfs@vger.kernel.org \
--cc=viro@zeniv.linux.org.uk \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).