NFSD: Server implementation of MAC Labeling (18032ca0) · Commits · 戴 / test

fs/nfsd/Kconfig

+16 −0

Original line number	Diff line number	Diff line
		@@ -81,6 +81,22 @@ config NFSD_V4

		If unsure, say N.

		config NFSD_V4_SECURITY_LABEL
		bool "Provide Security Label support for NFSv4 server"
		depends on NFSD_V4 && SECURITY
		help

		Say Y here if you want enable fine-grained security label attribute
		support for NFS version 4. Security labels allow security modules like
		SELinux and Smack to label files to facilitate enforcement of their policies.
		Without this an NFSv4 mount will have the same label on each file.

		If you do not wish to enable fine-grained security labels SELinux or
		Smack policies on NFSv4 files, say N.

		WARNING: there is still a chance of backwards-incompatible protocol changes.
		For now we recommend "Y" only for developers and testers."

		config NFSD_FAULT_INJECTION
		bool "NFS server manual fault injection"
		depends on NFSD_V4 && DEBUG_KERNEL

fs/nfsd/nfs4proc.c

+41 −0

Original line number	Diff line number	Diff line
		@@ -42,6 +42,36 @@
		#include "current_stateid.h"
		#include "netns.h"

		#ifdef CONFIG_NFSD_V4_SECURITY_LABEL
		#include <linux/security.h>

		static inline void
		nfsd4_security_inode_setsecctx(struct svc_fh resfh, struct xdr_netobj label, u32 *bmval)
		{
		struct inode *inode = resfh->fh_dentry->d_inode;
		int status;

		mutex_lock(&inode->i_mutex);
		status = security_inode_setsecctx(resfh->fh_dentry,
		label->data, label->len);
		mutex_unlock(&inode->i_mutex);

		if (status)
		/*
		* XXX: We should really fail the whole open, but we may
		* already have created a new file, so it may be too
		* late. For now this seems the least of evils:
		*/
		bmval[2] &= ~FATTR4_WORD2_SECURITY_LABEL;

		return;
		}
		#else
		static inline void
		nfsd4_security_inode_setsecctx(struct svc_fh resfh, struct xdr_netobj label, u32 *bmval)
		{ }
		#endif

		#define NFSDDBG_FACILITY NFSDDBG_PROC

		static u32 nfsd_attrmask[] = {
		@@ -239,6 +269,9 @@ do_open_lookup(struct svc_rqst rqstp, struct nfsd4_compound_state cstate, stru
		(u32 *)open->op_verf.data,
		&open->op_truncate, &open->op_created);

		if (!status && open->op_label.len)
		nfsd4_security_inode_setsecctx(resfh, &open->op_label, open->op_bmval);

		/*
		* Following rfc 3530 14.2.16, use the returned bitmask
		* to indicate which attributes we used to store the
		@@ -637,6 +670,9 @@ nfsd4_create(struct svc_rqst rqstp, struct nfsd4_compound_state cstate,
		if (status)
		goto out;

		if (create->cr_label.len)
		nfsd4_security_inode_setsecctx(&resfh, &create->cr_label, create->cr_bmval);

		if (create->cr_acl != NULL)
		do_set_nfs4_acl(rqstp, &resfh, create->cr_acl,
		create->cr_bmval);
		@@ -916,6 +952,11 @@ nfsd4_setattr(struct svc_rqst rqstp, struct nfsd4_compound_state cstate,
		setattr->sa_acl);
		if (status)
		goto out;
		if (setattr->sa_label.len)
		status = nfsd4_set_nfs4_label(rqstp, &cstate->current_fh,
		&setattr->sa_label);
		if (status)
		goto out;
		status = nfsd_setattr(rqstp, &cstate->current_fh, &setattr->sa_iattr,
		0, (time_t)0);
		out:

fs/nfsd/nfs4xdr.c

+100 −8

Original line number	Diff line number	Diff line
		@@ -55,6 +55,11 @@
		#include "cache.h"
		#include "netns.h"

		#ifdef CONFIG_NFSD_V4_SECURITY_LABEL
		#include <linux/security.h>
		#endif


		#define NFSDDBG_FACILITY NFSDDBG_XDR

		/*
		@@ -242,7 +247,8 @@ nfsd4_decode_bitmap(struct nfsd4_compoundargs argp, u32 bmval)

		static __be32
		nfsd4_decode_fattr(struct nfsd4_compoundargs argp, u32 bmval,
		struct iattr iattr, struct nfs4_acl *acl)
		struct iattr iattr, struct nfs4_acl *acl,
		struct xdr_netobj *label)
		{
		int expected_len, len = 0;
		u32 dummy32;
		@@ -380,6 +386,32 @@ nfsd4_decode_fattr(struct nfsd4_compoundargs argp, u32 bmval,
		goto xdr_error;
		}
		}

		label->len = 0;
		#ifdef CONFIG_NFSD_V4_SECURITY_LABEL
		if (bmval[2] & FATTR4_WORD2_SECURITY_LABEL) {
		READ_BUF(4);
		len += 4;
		READ32(dummy32); /* lfs: we don't use it */
		READ_BUF(4);
		len += 4;
		READ32(dummy32); /* pi: we don't use it either */
		READ_BUF(4);
		len += 4;
		READ32(dummy32);
		READ_BUF(dummy32);
		if (dummy32 > NFSD4_MAX_SEC_LABEL_LEN)
		return nfserr_badlabel;
		len += (XDR_QUADLEN(dummy32) << 2);
		READMEM(buf, dummy32);
		label->data = kzalloc(dummy32 + 1, GFP_KERNEL);
		if (!label->data)
		return nfserr_jukebox;
		defer_free(argp, kfree, label->data);
		memcpy(label->data, buf, dummy32);
		}
		#endif

		if (bmval[0] & ~NFSD_WRITEABLE_ATTRS_WORD0
		\|\| bmval[1] & ~NFSD_WRITEABLE_ATTRS_WORD1
		\|\| bmval[2] & ~NFSD_WRITEABLE_ATTRS_WORD2)
		@@ -576,7 +608,7 @@ nfsd4_decode_create(struct nfsd4_compoundargs argp, struct nfsd4_create create
		return status;

		status = nfsd4_decode_fattr(argp, create->cr_bmval, &create->cr_iattr,
		&create->cr_acl);
		&create->cr_acl, &create->cr_label);
		if (status)
		goto out;

		@@ -827,7 +859,7 @@ nfsd4_decode_open(struct nfsd4_compoundargs argp, struct nfsd4_open open)
		case NFS4_CREATE_UNCHECKED:
		case NFS4_CREATE_GUARDED:
		status = nfsd4_decode_fattr(argp, open->op_bmval,
		&open->op_iattr, &open->op_acl);
		&open->op_iattr, &open->op_acl, &open->op_label);
		if (status)
		goto out;
		break;
		@@ -841,7 +873,7 @@ nfsd4_decode_open(struct nfsd4_compoundargs argp, struct nfsd4_open open)
		READ_BUF(NFS4_VERIFIER_SIZE);
		COPYMEM(open->op_verf.data, NFS4_VERIFIER_SIZE);
		status = nfsd4_decode_fattr(argp, open->op_bmval,
		&open->op_iattr, &open->op_acl);
		&open->op_iattr, &open->op_acl, &open->op_label);
		if (status)
		goto out;
		break;
		@@ -1063,7 +1095,7 @@ nfsd4_decode_setattr(struct nfsd4_compoundargs argp, struct nfsd4_setattr seta
		if (status)
		return status;
		return nfsd4_decode_fattr(argp, setattr->sa_bmval, &setattr->sa_iattr,
		&setattr->sa_acl);
		&setattr->sa_acl, &setattr->sa_label);
		}

		static __be32
		@@ -1954,6 +1986,36 @@ nfsd4_encode_aclname(struct svc_rqst rqstp, struct nfs4_ace ace,
		FATTR4_WORD0_RDATTR_ERROR)
		#define WORD1_ABSENT_FS_ATTRS FATTR4_WORD1_MOUNTED_ON_FILEID

		#ifdef CONFIG_NFSD_V4_SECURITY_LABEL
		static inline __be32
		nfsd4_encode_security_label(struct svc_rqst rqstp, void context, int len, __be32 *pp, int buflen)
		{
		__be32 p = pp;

		if (*buflen < ((XDR_QUADLEN(len) << 2) + 4 + 4 + 4))
		return nfserr_resource;

		/*
		* For now we use a 0 here to indicate the null translation; in
		* the future we may place a call to translation code here.
		*/
		if ((*buflen -= 8) < 0)
		return nfserr_resource;

		WRITE32(0); /* lfs */
		WRITE32(0); /* pi */
		p = xdr_encode_opaque(p, context, len);
		*buflen -= (XDR_QUADLEN(len) << 2) + 4;

		*pp = p;
		return 0;
		}
		#else
		static inline __be32
		nfsd4_encode_security_label(struct svc_rqst rqstp, struct dentry dentry, __be32 *pp, int buflen)
		{ return 0; }
		#endif

		static __be32 fattr_handle_absent_fs(u32 bmval0, u32 bmval1, u32 *rdattr_err)
		{
		/* As per referral draft: */
		@@ -2013,6 +2075,9 @@ nfsd4_encode_fattr(struct svc_fh fhp, struct svc_export exp,
		int err;
		int aclsupport = 0;
		struct nfs4_acl *acl = NULL;
		void *context = NULL;
		int contextlen;
		bool contextsupport = false;
		struct nfsd4_compoundres *resp = rqstp->rq_resp;
		u32 minorversion = resp->cstate.minorversion;
		struct path path = {
		@@ -2066,6 +2131,21 @@ nfsd4_encode_fattr(struct svc_fh fhp, struct svc_export exp,
		}
		}

		#ifdef CONFIG_NFSD_V4_SECURITY_LABEL
		if ((bmval[2] & FATTR4_WORD2_SECURITY_LABEL) \|\|
		bmval[0] & FATTR4_WORD0_SUPPORTED_ATTRS) {
		err = security_inode_getsecctx(dentry->d_inode,
		&context, &contextlen);
		contextsupport = (err == 0);
		if (bmval2 & FATTR4_WORD2_SECURITY_LABEL) {
		if (err == -EOPNOTSUPP)
		bmval2 &= ~FATTR4_WORD2_SECURITY_LABEL;
		else if (err)
		goto out_nfserr;
		}
		}
		#endif /* CONFIG_NFSD_V4_SECURITY_LABEL */

		if (bmval2) {
		if ((buflen -= 16) < 0)
		goto out_resource;
		@@ -2094,6 +2174,8 @@ nfsd4_encode_fattr(struct svc_fh fhp, struct svc_export exp,

		if (!aclsupport)
		word0 &= ~FATTR4_WORD0_ACL;
		if (!contextsupport)
		word2 &= ~FATTR4_WORD2_SECURITY_LABEL;
		if (!word2) {
		if ((buflen -= 12) < 0)
		goto out_resource;
		@@ -2401,6 +2483,12 @@ out_acl:
		get_parent_attributes(exp, &stat);
		WRITE64(stat.ino);
		}
		if (bmval2 & FATTR4_WORD2_SECURITY_LABEL) {
		status = nfsd4_encode_security_label(rqstp, context,
		contextlen, &p, &buflen);
		if (status)
		goto out;
		}
		if (bmval2 & FATTR4_WORD2_SUPPATTR_EXCLCREAT) {
		WRITE32(3);
		WRITE32(NFSD_SUPPATTR_EXCLCREAT_WORD0);
		@@ -2413,6 +2501,8 @@ out_acl:
		status = nfs_ok;

		out:
		if (context)
		security_release_secctx(context, contextlen);
		kfree(acl);
		if (fhp == &tempfh)
		fh_put(&tempfh);
		@@ -3177,16 +3267,18 @@ nfsd4_encode_setattr(struct nfsd4_compoundres *resp, __be32 nfserr, struct nfsd4
		{
		__be32 *p;

		RESERVE_SPACE(12);
		RESERVE_SPACE(16);
		if (nfserr) {
		WRITE32(2);
		WRITE32(3);
		WRITE32(0);
		WRITE32(0);
		WRITE32(0);
		}
		else {
		WRITE32(2);
		WRITE32(3);
		WRITE32(setattr->sa_bmval[0]);
		WRITE32(setattr->sa_bmval[1]);
		WRITE32(setattr->sa_bmval[2]);
		}
		ADJUST_ARGS();
		return nfserr;

fs/nfsd/nfsd.h

+16 −2

Original line number	Diff line number	Diff line
		@@ -328,6 +328,13 @@ void nfsd_lockd_shutdown(void);
		#define NFSD4_1_SUPPORTED_ATTRS_WORD2 \
		(NFSD4_SUPPORTED_ATTRS_WORD2 \| FATTR4_WORD2_SUPPATTR_EXCLCREAT)

		#ifdef CONFIG_NFSD_V4_SECURITY_LABEL
		#define NFSD4_2_SUPPORTED_ATTRS_WORD2 \
		(NFSD4_1_SUPPORTED_ATTRS_WORD2 \| FATTR4_WORD2_SECURITY_LABEL)
		#else
		#define NFSD4_2_SUPPORTED_ATTRS_WORD2 0
		#endif

		static inline u32 nfsd_suppattrs0(u32 minorversion)
		{
		return minorversion ? NFSD4_1_SUPPORTED_ATTRS_WORD0
		@@ -342,8 +349,11 @@ static inline u32 nfsd_suppattrs1(u32 minorversion)

		static inline u32 nfsd_suppattrs2(u32 minorversion)
		{
		return minorversion ? NFSD4_1_SUPPORTED_ATTRS_WORD2
		: NFSD4_SUPPORTED_ATTRS_WORD2;
		switch (minorversion) {
		default: return NFSD4_2_SUPPORTED_ATTRS_WORD2;
		case 1: return NFSD4_1_SUPPORTED_ATTRS_WORD2;
		case 0: return NFSD4_SUPPORTED_ATTRS_WORD2;
		}
		}

		/* These will return ERR_INVAL if specified in GETATTR or READDIR. */
		@@ -356,7 +366,11 @@ static inline u32 nfsd_suppattrs2(u32 minorversion)
		#define NFSD_WRITEABLE_ATTRS_WORD1 \
		(FATTR4_WORD1_MODE \| FATTR4_WORD1_OWNER \| FATTR4_WORD1_OWNER_GROUP \
		\| FATTR4_WORD1_TIME_ACCESS_SET \| FATTR4_WORD1_TIME_MODIFY_SET)
		#ifdef CONFIG_NFSD_V4_SECURITY_LABEL
		#define NFSD_WRITEABLE_ATTRS_WORD2 FATTR4_WORD2_SECURITY_LABEL
		#else
		#define NFSD_WRITEABLE_ATTRS_WORD2 0
		#endif

		#define NFSD_SUPPATTR_EXCLCREAT_WORD0 \
		NFSD_WRITEABLE_ATTRS_WORD0

fs/nfsd/vfs.c

+28 −0

Original line number	Diff line number	Diff line
		@@ -28,6 +28,7 @@
		#include <asm/uaccess.h>
		#include <linux/exportfs.h>
		#include <linux/writeback.h>
		#include <linux/security.h>

		#ifdef CONFIG_NFSD_V3
		#include "xdr3.h"
		@@ -621,6 +622,33 @@ int nfsd4_is_junction(struct dentry *dentry)
		return 0;
		return 1;
		}
		#ifdef CONFIG_NFSD_V4_SECURITY_LABEL
		__be32 nfsd4_set_nfs4_label(struct svc_rqst rqstp, struct svc_fh fhp,
		struct xdr_netobj *label)
		{
		__be32 error;
		int host_error;
		struct dentry *dentry;

		error = fh_verify(rqstp, fhp, 0 /* S_IFREG */, NFSD_MAY_SATTR);
		if (error)
		return error;

		dentry = fhp->fh_dentry;

		mutex_lock(&dentry->d_inode->i_mutex);
		host_error = security_inode_setsecctx(dentry, label->data, label->len);
		mutex_unlock(&dentry->d_inode->i_mutex);
		return nfserrno(host_error);
		}
		#else
		__be32 nfsd4_set_nfs4_label(struct svc_rqst rqstp, struct svc_fh fhp,
		struct xdr_netobj *label)
		{
		return nfserr_notsupp;
		}
		#endif

		#endif /* defined(CONFIG_NFSD_V4) */

		#ifdef CONFIG_NFSD_V3

Admin message