Commit 3970acf7 authored by Boris Protopopov's avatar Boris Protopopov Committed by Steve French
Browse files

SMB3: Add support for getting and setting SACLs 



Add SYSTEM_SECURITY access flag and use with smb2 when opening
files for getting/setting SACLs. Add "system.cifs_ntsd_full"
extended attribute to allow user-space access to the functionality.
Avoid multiple server calls when setting owner, DACL, and SACL.

Signed-off-by: default avatarBoris Protopopov <pboris@amazon.com>
Signed-off-by: default avatarSteve French <stfrench@microsoft.com>
parent 0bf1bafb

fs/cifs/cifsacl.c

+9 −6
Original line number Diff line number Diff line
@@ -1195,7 +1195,8 @@ static int build_sec_desc(struct cifs_ntsd *pntsd, struct cifs_ntsd *pnntsd, 
}



struct cifs_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *cifs_sb,

		const struct cifs_fid *cifsfid, u32 *pacllen)

				      const struct cifs_fid *cifsfid, u32 *pacllen,

				      u32 __maybe_unused unused)

{

	struct cifs_ntsd *pntsd = NULL;

	unsigned int xid;
@@ -1263,7 +1264,7 @@ static struct cifs_ntsd *get_cifs_acl_by_path(struct cifs_sb_info *cifs_sb, 
/* Retrieve an ACL from the server */

struct cifs_ntsd *get_cifs_acl(struct cifs_sb_info *cifs_sb,

				      struct inode *inode, const char *path,

				      u32 *pacllen)

			       u32 *pacllen, u32 info)

{

	struct cifs_ntsd *pntsd = NULL;

	struct cifsFileInfo *open_file = NULL;
@@ -1273,7 +1274,7 @@ struct cifs_ntsd *get_cifs_acl(struct cifs_sb_info *cifs_sb, 
	if (!open_file)

		return get_cifs_acl_by_path(cifs_sb, path, pacllen);



	pntsd = get_cifs_acl_by_fid(cifs_sb, &open_file->fid, pacllen);

	pntsd = get_cifs_acl_by_fid(cifs_sb, &open_file->fid, pacllen, info);

	cifsFileInfo_put(open_file);

	return pntsd;

}
@@ -1338,6 +1339,7 @@ cifs_acl_to_fattr(struct cifs_sb_info *cifs_sb, struct cifs_fattr *fattr, 
	int rc = 0;

	struct tcon_link *tlink = cifs_sb_tlink(cifs_sb);

	struct smb_version_operations *ops;

	const u32 info = 0;



	cifs_dbg(NOISY, "converting ACL to mode for %s\n", path);
@@ -1347,9 +1349,9 @@ cifs_acl_to_fattr(struct cifs_sb_info *cifs_sb, struct cifs_fattr *fattr, 
	ops = tlink_tcon(tlink)->ses->server->ops;



	if (pfid && (ops->get_acl_by_fid))

		pntsd = ops->get_acl_by_fid(cifs_sb, pfid, &acllen);

		pntsd = ops->get_acl_by_fid(cifs_sb, pfid, &acllen, info);

	else if (ops->get_acl)

		pntsd = ops->get_acl(cifs_sb, inode, path, &acllen);

		pntsd = ops->get_acl(cifs_sb, inode, path, &acllen, info);

	else {

		cifs_put_tlink(tlink);

		return -EOPNOTSUPP;
@@ -1388,6 +1390,7 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 *pnmode, 
	struct tcon_link *tlink = cifs_sb_tlink(cifs_sb);

	struct smb_version_operations *ops;

	bool mode_from_sid, id_from_sid;

	const u32 info = 0;



	if (IS_ERR(tlink))

		return PTR_ERR(tlink);
@@ -1403,7 +1406,7 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 *pnmode, 
		return -EOPNOTSUPP;

	}



	pntsd = ops->get_acl(cifs_sb, inode, path, &secdesclen);

	pntsd = ops->get_acl(cifs_sb, inode, path, &secdesclen, info);

	if (IS_ERR(pntsd)) {

		rc = PTR_ERR(pntsd);

		cifs_dbg(VFS, "%s: error %d getting sec desc\n", __func__, rc);

fs/cifs/cifsglob.h

+2 −2
Original line number Diff line number Diff line
@@ -456,9 +456,9 @@ struct smb_version_operations { 
			const char *, const void *, const __u16,

			const struct nls_table *, struct cifs_sb_info *);

	struct cifs_ntsd * (*get_acl)(struct cifs_sb_info *, struct inode *,

			const char *, u32 *);

			const char *, u32 *, u32);

	struct cifs_ntsd * (*get_acl_by_fid)(struct cifs_sb_info *,

			const struct cifs_fid *, u32 *);

			const struct cifs_fid *, u32 *, u32);

	int (*set_acl)(struct cifs_ntsd *, __u32, struct inode *, const char *,

			int);

	/* writepages retry size */

fs/cifs/cifspdu.h

+2 −0
Original line number Diff line number Diff line
@@ -240,6 +240,8 @@ 
#define SYNCHRONIZE           0x00100000  /* The file handle can waited on to */

					  /* synchronize with the completion  */

					  /* of an input/output request       */

#define SYSTEM_SECURITY       0x01000000  /* The system access control list   */

					  /* can be read and changed          */

#define GENERIC_ALL           0x10000000

#define GENERIC_EXECUTE       0x20000000

#define GENERIC_WRITE         0x40000000

fs/cifs/cifsproto.h

+2 −2
Original line number Diff line number Diff line
@@ -218,9 +218,9 @@ extern int cifs_acl_to_fattr(struct cifs_sb_info *cifs_sb, 
extern int id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 *pnmode,

					kuid_t uid, kgid_t gid);

extern struct cifs_ntsd *get_cifs_acl(struct cifs_sb_info *, struct inode *,

					const char *, u32 *);

				      const char *, u32 *, u32);

extern struct cifs_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *,

						const struct cifs_fid *, u32 *);

				const struct cifs_fid *, u32 *, u32);

extern int set_cifs_acl(struct cifs_ntsd *, __u32, struct inode *,

				const char *, int);

extern unsigned int setup_authusers_ACE(struct cifs_ace *pace);

fs/cifs/smb2ops.c

+19 −12
Original line number Diff line number Diff line
@@ -3214,7 +3214,7 @@ smb2_query_reparse_tag(const unsigned int xid, struct cifs_tcon *tcon, 


static struct cifs_ntsd *

get_smb2_acl_by_fid(struct cifs_sb_info *cifs_sb,

		const struct cifs_fid *cifsfid, u32 *pacllen)

		    const struct cifs_fid *cifsfid, u32 *pacllen, u32 info)

{

	struct cifs_ntsd *pntsd = NULL;

	unsigned int xid;
@@ -3228,7 +3228,8 @@ get_smb2_acl_by_fid(struct cifs_sb_info *cifs_sb, 
	cifs_dbg(FYI, "trying to get acl\n");



	rc = SMB2_query_acl(xid, tlink_tcon(tlink), cifsfid->persistent_fid,

			    cifsfid->volatile_fid, (void **)&pntsd, pacllen);

			    cifsfid->volatile_fid, (void **)&pntsd, pacllen,

			    info);

	free_xid(xid);



	cifs_put_tlink(tlink);
@@ -3242,7 +3243,7 @@ get_smb2_acl_by_fid(struct cifs_sb_info *cifs_sb, 


static struct cifs_ntsd *

get_smb2_acl_by_path(struct cifs_sb_info *cifs_sb,

		const char *path, u32 *pacllen)

		     const char *path, u32 *pacllen, u32 info)

{

	struct cifs_ntsd *pntsd = NULL;

	u8 oplock = SMB2_OPLOCK_LEVEL_NONE;
@@ -3280,12 +3281,16 @@ get_smb2_acl_by_path(struct cifs_sb_info *cifs_sb, 
	oparms.fid = &fid;

	oparms.reconnect = false;



	if (info & SACL_SECINFO)

		oparms.desired_access |= SYSTEM_SECURITY;



	rc = SMB2_open(xid, &oparms, utf16_path, &oplock, NULL, NULL, NULL,

		       NULL);

	kfree(utf16_path);

	if (!rc) {

		rc = SMB2_query_acl(xid, tlink_tcon(tlink), fid.persistent_fid,

			    fid.volatile_fid, (void **)&pntsd, pacllen);

				    fid.volatile_fid, (void **)&pntsd, pacllen,

				    info);

		SMB2_close(xid, tcon, fid.persistent_fid, fid.volatile_fid);

	}
@@ -3319,10 +3324,12 @@ set_smb2_acl(struct cifs_ntsd *pnntsd, __u32 acllen, 
	tcon = tlink_tcon(tlink);

	xid = get_xid();



	if (aclflag == CIFS_ACL_OWNER || aclflag == CIFS_ACL_GROUP)

		access_flags = WRITE_OWNER;

	else

		access_flags = WRITE_DAC;

	if (aclflag & CIFS_ACL_OWNER || aclflag & CIFS_ACL_GROUP)

		access_flags |= WRITE_OWNER;

	if (aclflag & CIFS_ACL_SACL)

		access_flags |= SYSTEM_SECURITY;

	if (aclflag & CIFS_ACL_DACL)

		access_flags |= WRITE_DAC;



	utf16_path = cifs_convert_path_to_utf16(path, cifs_sb);

	if (!utf16_path) {
@@ -3357,7 +3364,7 @@ set_smb2_acl(struct cifs_ntsd *pnntsd, __u32 acllen, 
static struct cifs_ntsd *

get_smb2_acl(struct cifs_sb_info *cifs_sb,

	     struct inode *inode, const char *path,

				      u32 *pacllen)

	     u32 *pacllen, u32 info)

{

	struct cifs_ntsd *pntsd = NULL;

	struct cifsFileInfo *open_file = NULL;
@@ -3365,9 +3372,9 @@ get_smb2_acl(struct cifs_sb_info *cifs_sb, 
	if (inode)

		open_file = find_readable_file(CIFS_I(inode), true);

	if (!open_file)

		return get_smb2_acl_by_path(cifs_sb, path, pacllen);

		return get_smb2_acl_by_path(cifs_sb, path, pacllen, info);



	pntsd = get_smb2_acl_by_fid(cifs_sb, &open_file->fid, pacllen);

	pntsd = get_smb2_acl_by_fid(cifs_sb, &open_file->fid, pacllen, info);

	cifsFileInfo_put(open_file);

	return pntsd;

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE