Fix missing server-side permission checks on setting NFS ACLs.
-----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIcBAABAgAGBQJXba7TAAoJECebzXlCjuG+j+gP/18y6ot02Y5R2pI/O8nqoY3I WeBNOo1yD77wQ1SopiIbPL/ChxOh/OVlUzo9ikNtwm5l6Op8mLMxPYaDjaIpA5Nt FC/pAHibdTJA4ZjzenRhnEEFYbOQh0GssF/qMG30ySGPhx0eoonXi5/qYvjFyTBF BuDrpC4YHSNvqCZ/r0aD2bw79Skw8cBPdj+SUfK2r37WyuQ4Kade9NCmDYwSNxSx 6cru5ztRQSE8Ni0le3U2wTlYhq8xrpP0bRdIzc/9EipdKVdsvfukonjnT+dwtDks 72fwDoALAZq0iiIur7LKaUjkaZcKzHwe6LVsZEoiJ5aeI2a2FodLwoyXl4SntAR7 027YEqe7Pc+KHGUYACVuNuCcJkEK5B3zRBBSNoskhkPaK/lJ7BMSXNNhIt248YE3 HAl1vuf4PakCgh7qIsiUHB1EVs6FCcG8aKH1TmumvPD2udwabiYcKqd8soNu5ZWu ALi1vtD/8B1LEI8TacP5NIt8Pdr1AQ0kVDFWlZSiK3oE11DrHLiUgfvl2y7cokMa xzcNnoyEppaWNFJzYzQes8XO7Ti/DLJoCB8JnxMaWT1BfVhpEAs1LNl4AIHij5fO /PKNs4OusntvOmEvgKtxZpvqXaElgvXz7LMgzM2bmMGMVY+mq0+lpDbzAK91ijk0 di8+ivIMayA60P5xV4dJ =TZ/R -----END PGP SIGNATURE----- Merge tag 'nfsd-4.7-2' of git://linux-nfs.org/~bfields/linux Pull nfsd bugfixes from Bruce Fields: "Fix missing server-side permission checks on setting NFS ACLs" * tag 'nfsd-4.7-2' of git://linux-nfs.org/~bfields/linux: nfsd: check permissions when setting ACLs posix_acl: Add set_posix_acl
This commit is contained in:
commit
9c46a6df3b
|
@ -104,22 +104,21 @@ static __be32 nfsacld_proc_setacl(struct svc_rqst * rqstp,
|
|||
goto out;
|
||||
|
||||
inode = d_inode(fh->fh_dentry);
|
||||
if (!IS_POSIXACL(inode) || !inode->i_op->set_acl) {
|
||||
error = -EOPNOTSUPP;
|
||||
goto out_errno;
|
||||
}
|
||||
|
||||
error = fh_want_write(fh);
|
||||
if (error)
|
||||
goto out_errno;
|
||||
|
||||
error = inode->i_op->set_acl(inode, argp->acl_access, ACL_TYPE_ACCESS);
|
||||
fh_lock(fh);
|
||||
|
||||
error = set_posix_acl(inode, ACL_TYPE_ACCESS, argp->acl_access);
|
||||
if (error)
|
||||
goto out_drop_write;
|
||||
error = inode->i_op->set_acl(inode, argp->acl_default,
|
||||
ACL_TYPE_DEFAULT);
|
||||
goto out_drop_lock;
|
||||
error = set_posix_acl(inode, ACL_TYPE_DEFAULT, argp->acl_default);
|
||||
if (error)
|
||||
goto out_drop_write;
|
||||
goto out_drop_lock;
|
||||
|
||||
fh_unlock(fh);
|
||||
|
||||
fh_drop_write(fh);
|
||||
|
||||
|
@ -131,7 +130,8 @@ out:
|
|||
posix_acl_release(argp->acl_access);
|
||||
posix_acl_release(argp->acl_default);
|
||||
return nfserr;
|
||||
out_drop_write:
|
||||
out_drop_lock:
|
||||
fh_unlock(fh);
|
||||
fh_drop_write(fh);
|
||||
out_errno:
|
||||
nfserr = nfserrno(error);
|
||||
|
|
|
@ -95,22 +95,20 @@ static __be32 nfsd3_proc_setacl(struct svc_rqst * rqstp,
|
|||
goto out;
|
||||
|
||||
inode = d_inode(fh->fh_dentry);
|
||||
if (!IS_POSIXACL(inode) || !inode->i_op->set_acl) {
|
||||
error = -EOPNOTSUPP;
|
||||
goto out_errno;
|
||||
}
|
||||
|
||||
error = fh_want_write(fh);
|
||||
if (error)
|
||||
goto out_errno;
|
||||
|
||||
error = inode->i_op->set_acl(inode, argp->acl_access, ACL_TYPE_ACCESS);
|
||||
if (error)
|
||||
goto out_drop_write;
|
||||
error = inode->i_op->set_acl(inode, argp->acl_default,
|
||||
ACL_TYPE_DEFAULT);
|
||||
fh_lock(fh);
|
||||
|
||||
out_drop_write:
|
||||
error = set_posix_acl(inode, ACL_TYPE_ACCESS, argp->acl_access);
|
||||
if (error)
|
||||
goto out_drop_lock;
|
||||
error = set_posix_acl(inode, ACL_TYPE_DEFAULT, argp->acl_default);
|
||||
|
||||
out_drop_lock:
|
||||
fh_unlock(fh);
|
||||
fh_drop_write(fh);
|
||||
out_errno:
|
||||
nfserr = nfserrno(error);
|
||||
|
|
|
@ -770,9 +770,6 @@ nfsd4_set_nfs4_acl(struct svc_rqst *rqstp, struct svc_fh *fhp,
|
|||
dentry = fhp->fh_dentry;
|
||||
inode = d_inode(dentry);
|
||||
|
||||
if (!inode->i_op->set_acl || !IS_POSIXACL(inode))
|
||||
return nfserr_attrnotsupp;
|
||||
|
||||
if (S_ISDIR(inode->i_mode))
|
||||
flags = NFS4_ACL_DIR;
|
||||
|
||||
|
@ -782,16 +779,19 @@ nfsd4_set_nfs4_acl(struct svc_rqst *rqstp, struct svc_fh *fhp,
|
|||
if (host_error < 0)
|
||||
goto out_nfserr;
|
||||
|
||||
host_error = inode->i_op->set_acl(inode, pacl, ACL_TYPE_ACCESS);
|
||||
fh_lock(fhp);
|
||||
|
||||
host_error = set_posix_acl(inode, ACL_TYPE_ACCESS, pacl);
|
||||
if (host_error < 0)
|
||||
goto out_release;
|
||||
goto out_drop_lock;
|
||||
|
||||
if (S_ISDIR(inode->i_mode)) {
|
||||
host_error = inode->i_op->set_acl(inode, dpacl,
|
||||
ACL_TYPE_DEFAULT);
|
||||
host_error = set_posix_acl(inode, ACL_TYPE_DEFAULT, dpacl);
|
||||
}
|
||||
|
||||
out_release:
|
||||
out_drop_lock:
|
||||
fh_unlock(fhp);
|
||||
|
||||
posix_acl_release(pacl);
|
||||
posix_acl_release(dpacl);
|
||||
out_nfserr:
|
||||
|
|
|
@ -820,6 +820,28 @@ posix_acl_xattr_get(const struct xattr_handler *handler,
|
|||
return error;
|
||||
}
|
||||
|
||||
int
|
||||
set_posix_acl(struct inode *inode, int type, struct posix_acl *acl)
|
||||
{
|
||||
if (!IS_POSIXACL(inode))
|
||||
return -EOPNOTSUPP;
|
||||
if (!inode->i_op->set_acl)
|
||||
return -EOPNOTSUPP;
|
||||
|
||||
if (type == ACL_TYPE_DEFAULT && !S_ISDIR(inode->i_mode))
|
||||
return acl ? -EACCES : 0;
|
||||
if (!inode_owner_or_capable(inode))
|
||||
return -EPERM;
|
||||
|
||||
if (acl) {
|
||||
int ret = posix_acl_valid(acl);
|
||||
if (ret)
|
||||
return ret;
|
||||
}
|
||||
return inode->i_op->set_acl(inode, acl, type);
|
||||
}
|
||||
EXPORT_SYMBOL(set_posix_acl);
|
||||
|
||||
static int
|
||||
posix_acl_xattr_set(const struct xattr_handler *handler,
|
||||
struct dentry *unused, struct inode *inode,
|
||||
|
@ -829,30 +851,12 @@ posix_acl_xattr_set(const struct xattr_handler *handler,
|
|||
struct posix_acl *acl = NULL;
|
||||
int ret;
|
||||
|
||||
if (!IS_POSIXACL(inode))
|
||||
return -EOPNOTSUPP;
|
||||
if (!inode->i_op->set_acl)
|
||||
return -EOPNOTSUPP;
|
||||
|
||||
if (handler->flags == ACL_TYPE_DEFAULT && !S_ISDIR(inode->i_mode))
|
||||
return value ? -EACCES : 0;
|
||||
if (!inode_owner_or_capable(inode))
|
||||
return -EPERM;
|
||||
|
||||
if (value) {
|
||||
acl = posix_acl_from_xattr(&init_user_ns, value, size);
|
||||
if (IS_ERR(acl))
|
||||
return PTR_ERR(acl);
|
||||
|
||||
if (acl) {
|
||||
ret = posix_acl_valid(acl);
|
||||
if (ret)
|
||||
goto out;
|
||||
}
|
||||
}
|
||||
|
||||
ret = inode->i_op->set_acl(inode, acl, handler->flags);
|
||||
out:
|
||||
ret = set_posix_acl(inode, handler->flags, acl);
|
||||
posix_acl_release(acl);
|
||||
return ret;
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue