Commit 9c46a6df authored by Linus Torvalds's avatar Linus Torvalds

Merge tag 'nfsd-4.7-2' of git://linux-nfs.org/~bfields/linux

Pull nfsd bugfixes from Bruce Fields:
 "Fix missing server-side permission checks on setting NFS ACLs"

* tag 'nfsd-4.7-2' of git://linux-nfs.org/~bfields/linux:
  nfsd: check permissions when setting ACLs
  posix_acl: Add set_posix_acl
parents 7f1a00b6 99965378
...@@ -104,22 +104,21 @@ static __be32 nfsacld_proc_setacl(struct svc_rqst * rqstp, ...@@ -104,22 +104,21 @@ static __be32 nfsacld_proc_setacl(struct svc_rqst * rqstp,
goto out; goto out;
inode = d_inode(fh->fh_dentry); inode = d_inode(fh->fh_dentry);
if (!IS_POSIXACL(inode) || !inode->i_op->set_acl) {
error = -EOPNOTSUPP;
goto out_errno;
}
error = fh_want_write(fh); error = fh_want_write(fh);
if (error) if (error)
goto out_errno; goto out_errno;
error = inode->i_op->set_acl(inode, argp->acl_access, ACL_TYPE_ACCESS); fh_lock(fh);
error = set_posix_acl(inode, ACL_TYPE_ACCESS, argp->acl_access);
if (error) if (error)
goto out_drop_write; goto out_drop_lock;
error = inode->i_op->set_acl(inode, argp->acl_default, error = set_posix_acl(inode, ACL_TYPE_DEFAULT, argp->acl_default);
ACL_TYPE_DEFAULT);
if (error) if (error)
goto out_drop_write; goto out_drop_lock;
fh_unlock(fh);
fh_drop_write(fh); fh_drop_write(fh);
...@@ -131,7 +130,8 @@ static __be32 nfsacld_proc_setacl(struct svc_rqst * rqstp, ...@@ -131,7 +130,8 @@ static __be32 nfsacld_proc_setacl(struct svc_rqst * rqstp,
posix_acl_release(argp->acl_access); posix_acl_release(argp->acl_access);
posix_acl_release(argp->acl_default); posix_acl_release(argp->acl_default);
return nfserr; return nfserr;
out_drop_write: out_drop_lock:
fh_unlock(fh);
fh_drop_write(fh); fh_drop_write(fh);
out_errno: out_errno:
nfserr = nfserrno(error); nfserr = nfserrno(error);
......
...@@ -95,22 +95,20 @@ static __be32 nfsd3_proc_setacl(struct svc_rqst * rqstp, ...@@ -95,22 +95,20 @@ static __be32 nfsd3_proc_setacl(struct svc_rqst * rqstp,
goto out; goto out;
inode = d_inode(fh->fh_dentry); inode = d_inode(fh->fh_dentry);
if (!IS_POSIXACL(inode) || !inode->i_op->set_acl) {
error = -EOPNOTSUPP;
goto out_errno;
}
error = fh_want_write(fh); error = fh_want_write(fh);
if (error) if (error)
goto out_errno; goto out_errno;
error = inode->i_op->set_acl(inode, argp->acl_access, ACL_TYPE_ACCESS); fh_lock(fh);
error = set_posix_acl(inode, ACL_TYPE_ACCESS, argp->acl_access);
if (error) if (error)
goto out_drop_write; goto out_drop_lock;
error = inode->i_op->set_acl(inode, argp->acl_default, error = set_posix_acl(inode, ACL_TYPE_DEFAULT, argp->acl_default);
ACL_TYPE_DEFAULT);
out_drop_write: out_drop_lock:
fh_unlock(fh);
fh_drop_write(fh); fh_drop_write(fh);
out_errno: out_errno:
nfserr = nfserrno(error); nfserr = nfserrno(error);
......
...@@ -770,9 +770,6 @@ nfsd4_set_nfs4_acl(struct svc_rqst *rqstp, struct svc_fh *fhp, ...@@ -770,9 +770,6 @@ nfsd4_set_nfs4_acl(struct svc_rqst *rqstp, struct svc_fh *fhp,
dentry = fhp->fh_dentry; dentry = fhp->fh_dentry;
inode = d_inode(dentry); inode = d_inode(dentry);
if (!inode->i_op->set_acl || !IS_POSIXACL(inode))
return nfserr_attrnotsupp;
if (S_ISDIR(inode->i_mode)) if (S_ISDIR(inode->i_mode))
flags = NFS4_ACL_DIR; flags = NFS4_ACL_DIR;
...@@ -782,16 +779,19 @@ nfsd4_set_nfs4_acl(struct svc_rqst *rqstp, struct svc_fh *fhp, ...@@ -782,16 +779,19 @@ nfsd4_set_nfs4_acl(struct svc_rqst *rqstp, struct svc_fh *fhp,
if (host_error < 0) if (host_error < 0)
goto out_nfserr; goto out_nfserr;
host_error = inode->i_op->set_acl(inode, pacl, ACL_TYPE_ACCESS); fh_lock(fhp);
host_error = set_posix_acl(inode, ACL_TYPE_ACCESS, pacl);
if (host_error < 0) if (host_error < 0)
goto out_release; goto out_drop_lock;
if (S_ISDIR(inode->i_mode)) { if (S_ISDIR(inode->i_mode)) {
host_error = inode->i_op->set_acl(inode, dpacl, host_error = set_posix_acl(inode, ACL_TYPE_DEFAULT, dpacl);
ACL_TYPE_DEFAULT);
} }
out_release: out_drop_lock:
fh_unlock(fhp);
posix_acl_release(pacl); posix_acl_release(pacl);
posix_acl_release(dpacl); posix_acl_release(dpacl);
out_nfserr: out_nfserr:
......
...@@ -820,39 +820,43 @@ posix_acl_xattr_get(const struct xattr_handler *handler, ...@@ -820,39 +820,43 @@ posix_acl_xattr_get(const struct xattr_handler *handler,
return error; return error;
} }
static int int
posix_acl_xattr_set(const struct xattr_handler *handler, set_posix_acl(struct inode *inode, int type, struct posix_acl *acl)
struct dentry *unused, struct inode *inode,
const char *name, const void *value,
size_t size, int flags)
{ {
struct posix_acl *acl = NULL;
int ret;
if (!IS_POSIXACL(inode)) if (!IS_POSIXACL(inode))
return -EOPNOTSUPP; return -EOPNOTSUPP;
if (!inode->i_op->set_acl) if (!inode->i_op->set_acl)
return -EOPNOTSUPP; return -EOPNOTSUPP;
if (handler->flags == ACL_TYPE_DEFAULT && !S_ISDIR(inode->i_mode)) if (type == ACL_TYPE_DEFAULT && !S_ISDIR(inode->i_mode))
return value ? -EACCES : 0; return acl ? -EACCES : 0;
if (!inode_owner_or_capable(inode)) if (!inode_owner_or_capable(inode))
return -EPERM; return -EPERM;
if (acl) {
int ret = posix_acl_valid(acl);
if (ret)
return ret;
}
return inode->i_op->set_acl(inode, acl, type);
}
EXPORT_SYMBOL(set_posix_acl);
static int
posix_acl_xattr_set(const struct xattr_handler *handler,
struct dentry *unused, struct inode *inode,
const char *name, const void *value,
size_t size, int flags)
{
struct posix_acl *acl = NULL;
int ret;
if (value) { if (value) {
acl = posix_acl_from_xattr(&init_user_ns, value, size); acl = posix_acl_from_xattr(&init_user_ns, value, size);
if (IS_ERR(acl)) if (IS_ERR(acl))
return PTR_ERR(acl); return PTR_ERR(acl);
if (acl) {
ret = posix_acl_valid(acl);
if (ret)
goto out;
}
} }
ret = set_posix_acl(inode, handler->flags, acl);
ret = inode->i_op->set_acl(inode, acl, handler->flags);
out:
posix_acl_release(acl); posix_acl_release(acl);
return ret; return ret;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment