Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9c46a6df authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'nfsd-4.7-2' of git://linux-nfs.org/~bfields/linux 

Pull nfsd bugfixes from Bruce Fields:
 "Fix missing server-side permission checks on setting NFS ACLs"

* tag 'nfsd-4.7-2' of git://linux-nfs.org/~bfields/linux:
  nfsd: check permissions when setting ACLs
  posix_acl: Add set_posix_acl
parents 7f1a00b6 99965378

fs/nfsd/nfs2acl.c

+10 −10
Original line number Diff line number Diff line
@@ -104,22 +104,21 @@ static __be32 nfsacld_proc_setacl(struct svc_rqst * rqstp, 
		goto out;



	inode = d_inode(fh->fh_dentry);

	if (!IS_POSIXACL(inode) || !inode->i_op->set_acl) {

		error = -EOPNOTSUPP;

		goto out_errno;

	}



	error = fh_want_write(fh);

	if (error)

		goto out_errno;



	error = inode->i_op->set_acl(inode, argp->acl_access, ACL_TYPE_ACCESS);

	fh_lock(fh);



	error = set_posix_acl(inode, ACL_TYPE_ACCESS, argp->acl_access);

	if (error)

		goto out_drop_write;

	error = inode->i_op->set_acl(inode, argp->acl_default,

				     ACL_TYPE_DEFAULT);

		goto out_drop_lock;

	error = set_posix_acl(inode, ACL_TYPE_DEFAULT, argp->acl_default);

	if (error)

		goto out_drop_write;

		goto out_drop_lock;



	fh_unlock(fh);



	fh_drop_write(fh);
@@ -131,7 +130,8 @@ static __be32 nfsacld_proc_setacl(struct svc_rqst * rqstp, 
	posix_acl_release(argp->acl_access);

	posix_acl_release(argp->acl_default);

	return nfserr;

out_drop_write:

out_drop_lock:

	fh_unlock(fh);

	fh_drop_write(fh);

out_errno:

	nfserr = nfserrno(error);

fs/nfsd/nfs3acl.c

+7 −9
Original line number Diff line number Diff line
@@ -95,22 +95,20 @@ static __be32 nfsd3_proc_setacl(struct svc_rqst * rqstp, 
		goto out;



	inode = d_inode(fh->fh_dentry);

	if (!IS_POSIXACL(inode) || !inode->i_op->set_acl) {

		error = -EOPNOTSUPP;

		goto out_errno;

	}



	error = fh_want_write(fh);

	if (error)

		goto out_errno;



	error = inode->i_op->set_acl(inode, argp->acl_access, ACL_TYPE_ACCESS);

	fh_lock(fh);



	error = set_posix_acl(inode, ACL_TYPE_ACCESS, argp->acl_access);

	if (error)

		goto out_drop_write;

	error = inode->i_op->set_acl(inode, argp->acl_default,

				     ACL_TYPE_DEFAULT);

		goto out_drop_lock;

	error = set_posix_acl(inode, ACL_TYPE_DEFAULT, argp->acl_default);



out_drop_write:

out_drop_lock:

	fh_unlock(fh);

	fh_drop_write(fh);

out_errno:

	nfserr = nfserrno(error);

fs/nfsd/nfs4acl.c

+8 −8
Original line number Diff line number Diff line
@@ -770,9 +770,6 @@ nfsd4_set_nfs4_acl(struct svc_rqst *rqstp, struct svc_fh *fhp, 
	dentry = fhp->fh_dentry;

	inode = d_inode(dentry);



	if (!inode->i_op->set_acl || !IS_POSIXACL(inode))

		return nfserr_attrnotsupp;



	if (S_ISDIR(inode->i_mode))

		flags = NFS4_ACL_DIR;
@@ -782,16 +779,19 @@ nfsd4_set_nfs4_acl(struct svc_rqst *rqstp, struct svc_fh *fhp, 
	if (host_error < 0)

		goto out_nfserr;



	host_error = inode->i_op->set_acl(inode, pacl, ACL_TYPE_ACCESS);

	fh_lock(fhp);



	host_error = set_posix_acl(inode, ACL_TYPE_ACCESS, pacl);

	if (host_error < 0)

		goto out_release;

		goto out_drop_lock;



	if (S_ISDIR(inode->i_mode)) {

		host_error = inode->i_op->set_acl(inode, dpacl,

						  ACL_TYPE_DEFAULT);

		host_error = set_posix_acl(inode, ACL_TYPE_DEFAULT, dpacl);

	}



out_release:

out_drop_lock:

	fh_unlock(fhp);



	posix_acl_release(pacl);

	posix_acl_release(dpacl);

out_nfserr:

fs/posix_acl.c

+23 −19
Original line number Diff line number Diff line
@@ -820,39 +820,43 @@ posix_acl_xattr_get(const struct xattr_handler *handler, 
	return error;

}



static int

posix_acl_xattr_set(const struct xattr_handler *handler,

		    struct dentry *unused, struct inode *inode,

		    const char *name, const void *value,

		    size_t size, int flags)

int

set_posix_acl(struct inode *inode, int type, struct posix_acl *acl)

{

	struct posix_acl *acl = NULL;

	int ret;



	if (!IS_POSIXACL(inode))

		return -EOPNOTSUPP;

	if (!inode->i_op->set_acl)

		return -EOPNOTSUPP;



	if (handler->flags == ACL_TYPE_DEFAULT && !S_ISDIR(inode->i_mode))

		return value ? -EACCES : 0;

	if (type == ACL_TYPE_DEFAULT && !S_ISDIR(inode->i_mode))

		return acl ? -EACCES : 0;

	if (!inode_owner_or_capable(inode))

		return -EPERM;



	if (value) {

		acl = posix_acl_from_xattr(&init_user_ns, value, size);

		if (IS_ERR(acl))

			return PTR_ERR(acl);



	if (acl) {

			ret = posix_acl_valid(acl);

		int ret = posix_acl_valid(acl);

		if (ret)

				goto out;

			return ret;

	}

	return inode->i_op->set_acl(inode, acl, type);

}

EXPORT_SYMBOL(set_posix_acl);



	ret = inode->i_op->set_acl(inode, acl, handler->flags);

out:

static int

posix_acl_xattr_set(const struct xattr_handler *handler,

		    struct dentry *unused, struct inode *inode,

		    const char *name, const void *value,

		    size_t size, int flags)

{

	struct posix_acl *acl = NULL;

	int ret;



	if (value) {

		acl = posix_acl_from_xattr(&init_user_ns, value, size);

		if (IS_ERR(acl))

			return PTR_ERR(acl);

	}

	ret = set_posix_acl(inode, handler->flags, acl);

	posix_acl_release(acl);

	return ret;

}