/** * Lookup with version checking. * * This checks version of 'name'. Many reint functions uses 'name' for child not * FID, therefore we need to get object by name and check its version. */ int mdt_lookup_version_check(struct mdt_thread_info *info, struct mdt_object *p, struct lu_name *lname, struct lu_fid *fid, int idx) { int rc, vbrc; rc = mdo_lookup(info->mti_env, mdt_object_child(p), lname, fid, &info->mti_spec); /* Check version only during replay */ if (!req_is_replay(mdt_info_req(info))) return rc; info->mti_ver[idx] = ENOENT_VERSION; if (rc == 0) { struct mdt_object *child; child = mdt_object_find(info->mti_env, info->mti_mdt, fid); if (likely(!IS_ERR(child))) { mdt_obj_version_get(info, child, &info->mti_ver[idx]); mdt_object_put(info->mti_env, child); } } vbrc = mdt_version_check(mdt_info_req(info), info->mti_ver[idx], idx); return vbrc ? vbrc : rc; }
/** * Save enoent version, it is needed when it is obvious that object doesn't * exist, e.g. child during create. */ static void mdt_enoent_version_save(struct mdt_thread_info *info, int idx) { /* save version of file name for replay, it must be ENOENT here */ if (!req_is_replay(mdt_info_req(info))) { info->mti_ver[idx] = ENOENT_VERSION; mdt_version_save(mdt_info_req(info), info->mti_ver[idx], idx); } }
/** * Get version from disk and save in reply buffer. * * Versions are saved in reply only during normal operations not replays. */ void mdt_version_get_save(struct mdt_thread_info *info, struct mdt_object *mto, int idx) { /* don't save versions during replay */ if (!req_is_replay(mdt_info_req(info))) { mdt_obj_version_get(info, mto, &info->mti_ver[idx]); mdt_version_save(mdt_info_req(info), info->mti_ver[idx], idx); } }
/** * Get version from disk and check it, no save in reply. */ int mdt_version_get_check(struct mdt_thread_info *info, struct mdt_object *mto, int idx) { /* only check versions during replay */ if (!req_is_replay(mdt_info_req(info))) return 0; mdt_obj_version_get(info, mto, &info->mti_ver[idx]); return mdt_version_check(mdt_info_req(info), info->mti_ver[idx], idx); }
/** * Get version from disk and check if recovery or just save. */ int mdt_version_get_check_save(struct mdt_thread_info *info, struct mdt_object *mto, int idx) { int rc = 0; mdt_obj_version_get(info, mto, &info->mti_ver[idx]); if (req_is_replay(mdt_info_req(info))) rc = mdt_version_check(mdt_info_req(info), info->mti_ver[idx], idx); else mdt_version_save(mdt_info_req(info), info->mti_ver[idx], idx); return rc; }
static int mdt_rename_unpack(struct mdt_thread_info *info) { struct lu_ucred *uc = mdt_ucred(info); struct mdt_rec_rename *rec; struct md_attr *ma = &info->mti_attr; struct lu_attr *attr = &info->mti_attr.ma_attr; struct mdt_reint_record *rr = &info->mti_rr; struct req_capsule *pill = info->mti_pill; int rc; ENTRY; CLASSERT(sizeof(struct mdt_rec_rename) == sizeof(struct mdt_rec_reint)); rec = req_capsule_client_get(pill, &RMF_REC_REINT); if (rec == NULL) RETURN(-EFAULT); /* This prior initialization is needed for old_init_ucred_reint() */ uc->uc_fsuid = rec->rn_fsuid; uc->uc_fsgid = rec->rn_fsgid; uc->uc_cap = rec->rn_cap; uc->uc_suppgids[0] = rec->rn_suppgid1; uc->uc_suppgids[1] = rec->rn_suppgid2; attr->la_uid = rec->rn_fsuid; attr->la_gid = rec->rn_fsgid; rr->rr_fid1 = &rec->rn_fid1; rr->rr_fid2 = &rec->rn_fid2; attr->la_ctime = rec->rn_time; attr->la_mtime = rec->rn_time; /* rename_tgt contains the mode already */ attr->la_mode = rec->rn_mode; attr->la_valid = LA_UID | LA_GID | LA_CTIME | LA_MTIME | LA_MODE; if (req_capsule_get_size(pill, &RMF_CAPA1, RCL_CLIENT)) mdt_set_capainfo(info, 0, rr->rr_fid1, req_capsule_client_get(pill, &RMF_CAPA1)); if (req_capsule_get_size(pill, &RMF_CAPA2, RCL_CLIENT)) mdt_set_capainfo(info, 1, rr->rr_fid2, req_capsule_client_get(pill, &RMF_CAPA2)); rc = mdt_name_unpack(pill, &RMF_NAME, &rr->rr_name, 0); if (rc < 0) RETURN(rc); rc = mdt_name_unpack(pill, &RMF_SYMTGT, &rr->rr_tgt_name, 0); if (rc < 0) RETURN(rc); if (rec->rn_bias & MDS_VTX_BYPASS) ma->ma_attr_flags |= MDS_VTX_BYPASS; else ma->ma_attr_flags &= ~MDS_VTX_BYPASS; info->mti_spec.no_create = !!req_is_replay(mdt_info_req(info)); rc = mdt_dlmreq_unpack(info); RETURN(rc); }
static int mdt_rename_unpack(struct mdt_thread_info *info) { struct md_ucred *uc = mdt_ucred(info); struct mdt_rec_rename *rec; struct md_attr *ma = &info->mti_attr; struct lu_attr *attr = &info->mti_attr.ma_attr; struct mdt_reint_record *rr = &info->mti_rr; struct req_capsule *pill = info->mti_pill; int rc; ENTRY; CLASSERT(sizeof(struct mdt_rec_rename) == sizeof(struct mdt_rec_reint)); rec = req_capsule_client_get(pill, &RMF_REC_REINT); if (rec == NULL) RETURN(-EFAULT); uc->mu_fsuid = rec->rn_fsuid; uc->mu_fsgid = rec->rn_fsgid; uc->mu_cap = rec->rn_cap; uc->mu_suppgids[0] = rec->rn_suppgid1; uc->mu_suppgids[1] = rec->rn_suppgid2; attr->la_uid = rec->rn_fsuid; attr->la_gid = rec->rn_fsgid; rr->rr_fid1 = &rec->rn_fid1; rr->rr_fid2 = &rec->rn_fid2; attr->la_ctime = rec->rn_time; attr->la_mtime = rec->rn_time; /* rename_tgt contains the mode already */ attr->la_mode = rec->rn_mode; attr->la_valid = LA_UID | LA_GID | LA_CTIME | LA_MTIME | LA_MODE; if (req_capsule_get_size(pill, &RMF_CAPA1, RCL_CLIENT)) mdt_set_capainfo(info, 0, rr->rr_fid1, req_capsule_client_get(pill, &RMF_CAPA1)); if (req_capsule_get_size(pill, &RMF_CAPA2, RCL_CLIENT)) mdt_set_capainfo(info, 1, rr->rr_fid2, req_capsule_client_get(pill, &RMF_CAPA2)); info->mti_spec.sp_ck_split = !!(rec->rn_bias & MDS_CHECK_SPLIT); info->mti_cross_ref = !!(rec->rn_bias & MDS_CROSS_REF); rr->rr_name = req_capsule_client_get(pill, &RMF_NAME); rr->rr_tgt = req_capsule_client_get(pill, &RMF_SYMTGT); if (rr->rr_name == NULL || rr->rr_tgt == NULL) RETURN(-EFAULT); rr->rr_namelen = req_capsule_get_size(pill, &RMF_NAME, RCL_CLIENT) - 1; rr->rr_tgtlen = req_capsule_get_size(pill, &RMF_SYMTGT, RCL_CLIENT) - 1; if (!info->mti_cross_ref) LASSERT(rr->rr_namelen > 0 && rr->rr_tgtlen > 0); if (rec->rn_bias & MDS_VTX_BYPASS) ma->ma_attr_flags |= MDS_VTX_BYPASS; else ma->ma_attr_flags &= ~MDS_VTX_BYPASS; info->mti_spec.no_create = !!req_is_replay(mdt_info_req(info)); rc = mdt_dlmreq_unpack(info); RETURN(rc); }
static int mdt_getxattr_all(struct mdt_thread_info *info, struct mdt_body *reqbody, struct mdt_body *repbody, struct lu_buf *buf, struct md_object *next) { const struct lu_env *env = info->mti_env; struct ptlrpc_request *req = mdt_info_req(info); struct mdt_export_data *med = mdt_req2med(req); struct lu_ucred *uc = mdt_ucred(info); char *v, *b, *eadatahead, *eadatatail; __u32 *sizes; int eadatasize, eavallen = 0, eavallens = 0, rc; ENTRY; /* * The format of the pill is the following: * EADATA: attr1\0attr2\0...attrn\0 * EAVALS: val1val2...valn * EAVALS_LENS: 4,4,...4 */ eadatahead = buf->lb_buf; /* Fill out EADATA first */ eadatasize = mo_xattr_list(env, next, buf); if (eadatasize < 0) GOTO(out, rc = eadatasize); eadatatail = eadatahead + eadatasize; v = req_capsule_server_get(info->mti_pill, &RMF_EAVALS); sizes = req_capsule_server_get(info->mti_pill, &RMF_EAVALS_LENS); /* Fill out EAVALS and EAVALS_LENS */ for (b = eadatahead; b < eadatatail; b += strlen(b) + 1, v += rc) { buf->lb_buf = v; buf->lb_len = reqbody->eadatasize - eavallen; rc = mdt_getxattr_one(info, b, next, buf, med, uc); if (rc < 0) GOTO(out, rc); sizes[eavallens] = rc; eavallens++; eavallen += rc; } repbody->aclsize = eavallen; repbody->max_mdsize = eavallens; req_capsule_shrink(info->mti_pill, &RMF_EAVALS, eavallen, RCL_SERVER); req_capsule_shrink(info->mti_pill, &RMF_EAVALS_LENS, eavallens * sizeof(__u32), RCL_SERVER); req_capsule_shrink(info->mti_pill, &RMF_EADATA, eadatasize, RCL_SERVER); GOTO(out, rc = eadatasize); out: return rc; }
/* return EADATA length to the caller. negative value means error */ static int mdt_getxattr_pack_reply(struct mdt_thread_info * info) { struct req_capsule *pill = info->mti_pill ; struct ptlrpc_request *req = mdt_info_req(info); char *xattr_name; __u64 valid = info->mti_body->valid; static const char user_string[] = "user."; int size, rc; ENTRY; if (OBD_FAIL_CHECK(OBD_FAIL_MDS_GETXATTR_PACK)) RETURN(-ENOMEM); /* Determine how many bytes we need */ if (valid & OBD_MD_FLXATTR) { xattr_name = req_capsule_client_get(pill, &RMF_NAME); if (!xattr_name) RETURN(-EFAULT); if (!(req->rq_export->exp_connect_flags & OBD_CONNECT_XATTR) && !strncmp(xattr_name, user_string, sizeof(user_string) - 1)) RETURN(-EOPNOTSUPP); size = mo_xattr_get(info->mti_env, mdt_object_child(info->mti_object), &LU_BUF_NULL, xattr_name); } else if (valid & OBD_MD_FLXATTRLS) { size = mo_xattr_list(info->mti_env, mdt_object_child(info->mti_object), &LU_BUF_NULL); } else { CDEBUG(D_INFO, "Valid bits: "LPX64"\n", info->mti_body->valid); RETURN(-EINVAL); } if (size == -ENODATA) { size = 0; } else if (size < 0) { CERROR("Error geting EA size: %d\n", size); RETURN(size); } if (info->mti_body->eadatasize != 0 && info->mti_body->eadatasize < size) RETURN(-ERANGE); req_capsule_set_size(pill, &RMF_EADATA, RCL_SERVER, info->mti_body->eadatasize == 0 ? 0 : size); rc = req_capsule_server_pack(pill); if (rc) { LASSERT(rc < 0); RETURN(rc); } RETURN(size); }
static int mdt_reint_create(struct mdt_thread_info *info, struct mdt_lock_handle *lhc) { struct ptlrpc_request *req = mdt_info_req(info); int rc; ENTRY; if (OBD_FAIL_CHECK(OBD_FAIL_MDS_REINT_CREATE)) RETURN(err_serious(-ESTALE)); if (info->mti_dlm_req) ldlm_request_cancel(mdt_info_req(info), info->mti_dlm_req, 0); switch (info->mti_attr.ma_attr.la_mode & S_IFMT) { case S_IFDIR:{ /* Cross-ref case. */ /* TODO: we can add LPROC_MDT_CROSS for cross-ref stats */ if (info->mti_cross_ref) { rc = mdt_md_mkobj(info); } else { LASSERT(info->mti_rr.rr_namelen > 0); mdt_counter_incr(req->rq_export, LPROC_MDT_MKDIR); rc = mdt_md_create(info); } break; } case S_IFREG: case S_IFLNK: case S_IFCHR: case S_IFBLK: case S_IFIFO: case S_IFSOCK:{ /* Special file should stay on the same node as parent. */ LASSERT(info->mti_rr.rr_namelen > 0); mdt_counter_incr(req->rq_export, LPROC_MDT_MKNOD); rc = mdt_md_create(info); break; } default: rc = err_serious(-EOPNOTSUPP); } RETURN(rc); }
static int mdt_reint_create(struct mdt_thread_info *info, struct mdt_lock_handle *lhc) { struct ptlrpc_request *req = mdt_info_req(info); int rc; ENTRY; if (OBD_FAIL_CHECK(OBD_FAIL_MDS_REINT_CREATE)) RETURN(err_serious(-ESTALE)); if (info->mti_dlm_req) ldlm_request_cancel(mdt_info_req(info), info->mti_dlm_req, 0); LASSERT(info->mti_rr.rr_namelen > 0); switch (info->mti_attr.ma_attr.la_mode & S_IFMT) { case S_IFDIR: mdt_counter_incr(req, LPROC_MDT_MKDIR); break; case S_IFREG: case S_IFLNK: case S_IFCHR: case S_IFBLK: case S_IFIFO: case S_IFSOCK: /* Special file should stay on the same node as parent. */ mdt_counter_incr(req, LPROC_MDT_MKNOD); break; default: CERROR("%s: Unsupported mode %o\n", mdt2obd_dev(info->mti_mdt)->obd_name, info->mti_attr.ma_attr.la_mode); RETURN(err_serious(-EOPNOTSUPP)); } rc = mdt_md_create(info); RETURN(rc); }
/* Partial request to create object only */ static int mdt_md_mkobj(struct mdt_thread_info *info) { struct mdt_device *mdt = info->mti_mdt; struct mdt_object *o; struct mdt_body *repbody; struct md_attr *ma = &info->mti_attr; int rc; ENTRY; DEBUG_REQ(D_INODE, mdt_info_req(info), "Partial create "DFID"", PFID(info->mti_rr.rr_fid2)); repbody = req_capsule_server_get(info->mti_pill, &RMF_MDT_BODY); o = mdt_object_find(info->mti_env, mdt, info->mti_rr.rr_fid2, MDT_OBJ_MAY_NOT_EXIST); if (!IS_ERR(o)) { struct md_object *next = mdt_object_child(o); ma->ma_need = MA_INODE; ma->ma_valid = 0; /* * Cross-ref create can encounter already created obj in case of * recovery, just get attr in that case. */ if (mdt_object_exists(o) == 1) { rc = mo_attr_get(info->mti_env, next, ma); } else { /* * Here, NO permission check for object_create, * such check has been done on the original MDS. */ rc = mo_object_create(info->mti_env, next, &info->mti_spec, ma); } if (rc == 0) { /* Return fid & attr to client. */ if (ma->ma_valid & MA_INODE) mdt_pack_attr2body(info, repbody, &ma->ma_attr, mdt_object_fid(o)); } mdt_object_put(info->mti_env, o); } else rc = PTR_ERR(o); mdt_create_pack_capa(info, rc, o, repbody); RETURN(rc); }
int mdt_init_ucred_reint(struct mdt_thread_info *info) { struct ptlrpc_request *req = mdt_info_req(info); struct md_ucred *uc = mdt_ucred(info); if ((uc->mu_valid == UCRED_OLD) || (uc->mu_valid == UCRED_NEW)) return 0; mdt_exit_ucred(info); if (!req->rq_auth_gss || req->rq_auth_usr_mdt || !req->rq_user_desc) return old_init_ucred_reint(info); else return new_init_ucred(info, REC_INIT, NULL); }
/* Do not ignore root_squash for non-setattr case. */ int mdt_fix_attr_ucred(struct mdt_thread_info *info, __u32 op) { struct ptlrpc_request *req = mdt_info_req(info); struct md_ucred *uc = mdt_ucred(info); struct lu_attr *attr = &info->mti_attr.ma_attr; struct mdt_export_data *med = mdt_req2med(req); struct lustre_idmap_table *idmap = med->med_idmap; if ((uc->mu_valid != UCRED_OLD) && (uc->mu_valid != UCRED_NEW)) return -EINVAL; if (op != REINT_SETATTR) { if ((attr->la_valid & LA_UID) && (attr->la_uid != -1)) attr->la_uid = uc->mu_fsuid; /* for S_ISGID, inherit gid from his parent, such work will be * done in cmm/mdd layer, here set all cases as uc->mu_fsgid. */ if ((attr->la_valid & LA_GID) && (attr->la_gid != -1)) attr->la_gid = uc->mu_fsgid; } else if (exp_connect_rmtclient(info->mti_exp)) { /* NB: -1 case will be handled by mdt_fix_attr() later. */ if ((attr->la_valid & LA_UID) && (attr->la_uid != -1)) { uid_t uid = lustre_idmap_lookup_uid(uc, idmap, 0, attr->la_uid); if (uid == CFS_IDMAP_NOTFOUND) { CDEBUG(D_SEC, "Deny chown to uid %u\n", attr->la_uid); return -EPERM; } attr->la_uid = uid; } if ((attr->la_valid & LA_GID) && (attr->la_gid != -1)) { gid_t gid = lustre_idmap_lookup_gid(uc, idmap, 0, attr->la_gid); if (gid == CFS_IDMAP_NOTFOUND) { CDEBUG(D_SEC, "Deny chown to gid %u\n", attr->la_gid); return -EPERM; } attr->la_gid = gid; } } return 0; }
int mdt_init_ucred(struct mdt_thread_info *info, struct mdt_body *body) { struct ptlrpc_request *req = mdt_info_req(info); struct lu_ucred *uc = mdt_ucred(info); LASSERT(uc != NULL); if ((uc->uc_valid == UCRED_OLD) || (uc->uc_valid == UCRED_NEW)) return 0; mdt_exit_ucred(info); if (!req->rq_auth_gss || req->rq_auth_usr_mdt || !req->rq_user_desc) return old_init_ucred(info, body); else return new_init_ucred(info, BODY_INIT, body); }
static int mdt_rmtlsetfacl(struct mdt_thread_info *info, struct md_object *next, const char *xattr_name, ext_acl_xattr_header *header, posix_acl_xattr_header **out) { struct ptlrpc_request *req = mdt_info_req(info); struct mdt_export_data *med = mdt_req2med(req); struct md_ucred *uc = mdt_ucred(info); struct lu_buf *buf = &info->mti_buf; int rc; ENTRY; rc = lustre_ext_acl_xattr_id2server(uc, med->med_idmap, header); if (rc) RETURN(rc); rc = mo_xattr_get(info->mti_env, next, &LU_BUF_NULL, xattr_name); if (rc == -ENODATA) rc = 0; else if (rc < 0) RETURN(rc); buf->lb_len = rc; if (buf->lb_len > 0) { OBD_ALLOC_LARGE(buf->lb_buf, buf->lb_len); if (unlikely(buf->lb_buf == NULL)) RETURN(-ENOMEM); rc = mo_xattr_get(info->mti_env, next, buf, xattr_name); if (rc < 0) { CERROR("getxattr failed: %d\n", rc); GOTO(_out, rc); } } else buf->lb_buf = NULL; rc = lustre_acl_xattr_merge2posix((posix_acl_xattr_header *)(buf->lb_buf), buf->lb_len, header, out); EXIT; _out: if (rc <= 0 && buf->lb_buf != NULL) OBD_FREE_LARGE(buf->lb_buf, buf->lb_len); return rc; }
static int old_init_ucred(struct mdt_thread_info *info, struct mdt_body *body) { struct lu_ucred *uc = mdt_ucred(info); struct mdt_device *mdt = info->mti_mdt; struct md_identity *identity = NULL; ENTRY; LASSERT(uc != NULL); uc->uc_valid = UCRED_INVALID; uc->uc_o_uid = uc->uc_uid = body->uid; uc->uc_o_gid = uc->uc_gid = body->gid; uc->uc_o_fsuid = uc->uc_fsuid = body->fsuid; uc->uc_o_fsgid = uc->uc_fsgid = body->fsgid; uc->uc_suppgids[0] = body->suppgid; uc->uc_suppgids[1] = -1; uc->uc_ginfo = NULL; if (!is_identity_get_disabled(mdt->mdt_identity_cache)) { identity = mdt_identity_get(mdt->mdt_identity_cache, uc->uc_fsuid); if (IS_ERR(identity)) { if (unlikely(PTR_ERR(identity) == -EREMCHG)) { identity = NULL; } else { CDEBUG(D_SEC, "Deny access without identity: " "uid %u\n", uc->uc_fsuid); RETURN(-EACCES); } } } uc->uc_identity = identity; /* process root_squash here. */ mdt_root_squash(info, mdt_info_req(info)->rq_peer.nid); /* remove fs privilege for non-root user. */ if (uc->uc_fsuid) uc->uc_cap = body->capability & ~CFS_CAP_FS_MASK; else uc->uc_cap = body->capability; uc->uc_valid = UCRED_OLD; RETURN(0); }
/* * please see comment above LOV_MAGIC_V1_DEF */ static void mdt_fix_lov_magic(struct mdt_thread_info *info) { struct mdt_reint_record *rr = &info->mti_rr; struct lov_user_md_v1 *v1; v1 = (void *)rr->rr_eadata; LASSERT(v1); if (unlikely(req_is_replay(mdt_info_req(info)))) { if (v1->lmm_magic == LOV_USER_MAGIC_V1) { v1->lmm_magic = LOV_MAGIC_V1_DEF; } else if (v1->lmm_magic == __swab32(LOV_USER_MAGIC_V1)) { v1->lmm_magic = __swab32(LOV_MAGIC_V1_DEF); } else if (v1->lmm_magic == LOV_USER_MAGIC_V3) { v1->lmm_magic = LOV_MAGIC_V3_DEF; } else if (v1->lmm_magic == __swab32(LOV_USER_MAGIC_V3)) { v1->lmm_magic = __swab32(LOV_MAGIC_V3_DEF); } } }
/* * Reverse mapping */ void mdt_body_reverse_idmap(struct mdt_thread_info *info, struct mdt_body *body) { struct ptlrpc_request *req = mdt_info_req(info); struct lu_ucred *uc = mdt_ucred(info); struct mdt_export_data *med = mdt_req2med(req); struct lustre_idmap_table *idmap = med->med_idmap; if (!exp_connect_rmtclient(info->mti_exp)) return; if (body->mbo_valid & OBD_MD_FLUID) { uid_t uid; uid = lustre_idmap_lookup_uid(uc, idmap, 1, body->mbo_uid); if (uid == CFS_IDMAP_NOTFOUND) { uid = NOBODY_UID; if (body->mbo_valid & OBD_MD_FLMODE) body->mbo_mode = (body->mbo_mode & ~S_IRWXU) | ((body->mbo_mode & S_IRWXO) << 6); } body->mbo_uid = uid; } if (body->mbo_valid & OBD_MD_FLGID) { gid_t gid; gid = lustre_idmap_lookup_gid(uc, idmap, 1, body->mbo_gid); if (gid == CFS_IDMAP_NOTFOUND) { gid = NOBODY_GID; if (body->mbo_valid & OBD_MD_FLMODE) body->mbo_mode = (body->mbo_mode & ~S_IRWXG) | ((body->mbo_mode & S_IRWXO) << 3); } body->mbo_gid = gid; } }
int mdt_init_idmap(struct mdt_thread_info *info) { struct ptlrpc_request *req = mdt_info_req(info); struct mdt_export_data *med = mdt_req2med(req); struct obd_export *exp = req->rq_export; char *client = libcfs_nid2str(req->rq_peer.nid); struct obd_device *obd = exp->exp_obd; int rc = 0; ENTRY; if (exp_connect_rmtclient(exp)) { cfs_down(&med->med_idmap_sem); if (!med->med_idmap) med->med_idmap = lustre_idmap_init(); cfs_up(&med->med_idmap_sem); if (IS_ERR(med->med_idmap)) { long err = PTR_ERR(med->med_idmap); med->med_idmap = NULL; CERROR("client %s -> target %s " "failed to init idmap [%ld]!\n", client, obd->obd_name, err); RETURN(err); } else if (!med->med_idmap) { CERROR("client %s -> target %s " "failed to init(2) idmap!\n", client, obd->obd_name); RETURN(-ENOMEM); } CDEBUG(D_SEC, "client %s -> target %s is remote.\n", client, obd->obd_name); /* NB, MDS_CONNECT establish root idmap too! */ rc = mdt_handle_idmap(info); } RETURN(rc); }
static int old_init_ucred_reint(struct mdt_thread_info *info) { struct md_ucred *uc = mdt_ucred(info); struct mdt_device *mdt = info->mti_mdt; struct md_identity *identity = NULL; ENTRY; uc->mu_valid = UCRED_INVALID; uc->mu_o_uid = uc->mu_o_fsuid = uc->mu_uid = uc->mu_fsuid; uc->mu_o_gid = uc->mu_o_fsgid = uc->mu_gid = uc->mu_fsgid; uc->mu_ginfo = NULL; if (!is_identity_get_disabled(mdt->mdt_identity_cache)) { identity = mdt_identity_get(mdt->mdt_identity_cache, uc->mu_fsuid); if (IS_ERR(identity)) { if (unlikely(PTR_ERR(identity) == -EREMCHG)) { identity = NULL; } else { CDEBUG(D_SEC, "Deny access without identity: " "uid %u\n", uc->mu_fsuid); RETURN(-EACCES); } } } uc->mu_identity = identity; /* process root_squash here. */ mdt_root_squash(info, mdt_info_req(info)->rq_peer.nid); /* remove fs privilege for non-root user. */ if (uc->mu_fsuid) uc->mu_cap &= ~CFS_CAP_FS_MASK; uc->mu_valid = UCRED_OLD; RETURN(0); }
int mdt_reint_setxattr(struct mdt_thread_info *info, struct mdt_lock_handle *unused) { struct ptlrpc_request *req = mdt_info_req(info); struct mdt_lock_handle *lh; const struct lu_env *env = info->mti_env; struct lu_buf *buf = &info->mti_buf; struct mdt_reint_record *rr = &info->mti_rr; struct md_attr *ma = &info->mti_attr; struct lu_attr *attr = &info->mti_attr.ma_attr; struct mdt_object *obj; struct md_object *child; __u64 valid = attr->la_valid; const char *xattr_name = rr->rr_name.ln_name; int xattr_len = rr->rr_eadatalen; __u64 lockpart = MDS_INODELOCK_UPDATE; int rc; ENTRY; CDEBUG(D_INODE, "setxattr for "DFID": %s %s\n", PFID(rr->rr_fid1), valid & OBD_MD_FLXATTR ? "set" : "remove", xattr_name); if (info->mti_dlm_req) ldlm_request_cancel(req, info->mti_dlm_req, 0, LATF_SKIP); if (OBD_FAIL_CHECK(OBD_FAIL_MDS_SETXATTR)) RETURN(err_serious(-ENOMEM)); rc = mdt_init_ucred_reint(info); if (rc != 0) RETURN(rc); if (strncmp(xattr_name, XATTR_USER_PREFIX, sizeof(XATTR_USER_PREFIX) - 1) == 0) { if (!(exp_connect_flags(req->rq_export) & OBD_CONNECT_XATTR)) GOTO(out, rc = -EOPNOTSUPP); } else if (strncmp(xattr_name, XATTR_TRUSTED_PREFIX, sizeof(XATTR_TRUSTED_PREFIX) - 1) == 0) { /* setxattr(LMV) with lum is used to shrink dir layout */ if (strcmp(xattr_name, XATTR_NAME_LMV) == 0) { __u32 *magic = rr->rr_eadata; /* we don't let to remove LMV? */ if (!rr->rr_eadata) GOTO(out, rc = 0); if (le32_to_cpu(*magic) == LMV_USER_MAGIC || le32_to_cpu(*magic) == LMV_USER_MAGIC_SPECIFIC) { rc = mdt_dir_layout_shrink(info); GOTO(out, rc); } } if (!md_capable(mdt_ucred(info), CFS_CAP_SYS_ADMIN)) GOTO(out, rc = -EPERM); if (strcmp(xattr_name, XATTR_NAME_LOV) == 0 || strcmp(xattr_name, XATTR_NAME_LMA) == 0 || strcmp(xattr_name, XATTR_NAME_LMV) == 0 || strcmp(xattr_name, XATTR_NAME_LINK) == 0 || strcmp(xattr_name, XATTR_NAME_FID) == 0 || strcmp(xattr_name, XATTR_NAME_VERSION) == 0 || strcmp(xattr_name, XATTR_NAME_SOM) == 0 || strcmp(xattr_name, XATTR_NAME_HSM) == 0 || strcmp(xattr_name, XATTR_NAME_LFSCK_NAMESPACE) == 0) GOTO(out, rc = 0); } else if ((valid & OBD_MD_FLXATTR) && (strcmp(xattr_name, XATTR_NAME_ACL_ACCESS) == 0 || strcmp(xattr_name, XATTR_NAME_ACL_DEFAULT) == 0)) { rc = mdt_nodemap_map_acl(info, rr->rr_eadata, xattr_len, xattr_name, NODEMAP_CLIENT_TO_FS); if (rc < 0) GOTO(out, rc); /* ACLs were mapped out, return an error so the user knows */ if (rc != xattr_len) GOTO(out, rc = -EPERM); } else if ((strlen(xattr_name) > strlen(XATTR_LUSTRE_LOV) + 1) && strncmp(xattr_name, XATTR_LUSTRE_LOV, strlen(XATTR_LUSTRE_LOV)) == 0) { if (strncmp(xattr_name, XATTR_LUSTRE_LOV".add", strlen(XATTR_LUSTRE_LOV".add")) && strncmp(xattr_name, XATTR_LUSTRE_LOV".set", strlen(XATTR_LUSTRE_LOV".set")) && strncmp(xattr_name, XATTR_LUSTRE_LOV".del", strlen(XATTR_LUSTRE_LOV".del"))) { CERROR("%s: invalid xattr name: %s\n", mdt_obd_name(info->mti_mdt), xattr_name); GOTO(out, rc = -EINVAL); } lockpart |= MDS_INODELOCK_LAYOUT; } /* Revoke all clients' lookup lock, since the access * permissions for this inode is changed when ACL_ACCESS is * set. This isn't needed for ACL_DEFAULT, since that does * not change the access permissions of this inode, nor any * other existing inodes. It is setting the ACLs inherited * by new directories/files at create time. */ /* We need revoke both LOOKUP|PERM lock here, see mdt_attr_set. */ if (!strcmp(xattr_name, XATTR_NAME_ACL_ACCESS)) lockpart |= MDS_INODELOCK_PERM | MDS_INODELOCK_LOOKUP; /* We need to take the lock on behalf of old clients so that newer * clients flush their xattr caches */ else lockpart |= MDS_INODELOCK_XATTR; lh = &info->mti_lh[MDT_LH_PARENT]; /* ACLs were sent to clients under LCK_CR locks, so taking LCK_EX * to cancel them. */ mdt_lock_reg_init(lh, LCK_EX); obj = mdt_object_find_lock(info, rr->rr_fid1, lh, lockpart); if (IS_ERR(obj)) GOTO(out, rc = PTR_ERR(obj)); tgt_vbr_obj_set(env, mdt_obj2dt(obj)); rc = mdt_version_get_check_save(info, obj, 0); if (rc) GOTO(out_unlock, rc); if (unlikely(!(valid & OBD_MD_FLCTIME))) { /* This isn't strictly an error, but all current clients * should set OBD_MD_FLCTIME when setting attributes. */ CWARN("%s: client miss to set OBD_MD_FLCTIME when " "setxattr %s: [object "DFID"] [valid %llu]\n", mdt_obd_name(info->mti_mdt), xattr_name, PFID(rr->rr_fid1), valid); attr->la_ctime = ktime_get_real_seconds(); } attr->la_valid = LA_CTIME; child = mdt_object_child(obj); if (valid & OBD_MD_FLXATTR) { int flags = 0; if (attr->la_flags & XATTR_REPLACE) flags |= LU_XATTR_REPLACE; if (attr->la_flags & XATTR_CREATE) flags |= LU_XATTR_CREATE; mdt_fail_write(env, info->mti_mdt->mdt_bottom, OBD_FAIL_MDS_SETXATTR_WRITE); buf->lb_buf = rr->rr_eadata; buf->lb_len = xattr_len; rc = mo_xattr_set(env, child, buf, xattr_name, flags); /* update ctime after xattr changed */ if (rc == 0) { ma->ma_attr_flags |= MDS_PERM_BYPASS; mo_attr_set(env, child, ma); } } else if (valid & OBD_MD_FLXATTRRM) { rc = mo_xattr_del(env, child, xattr_name); /* update ctime after xattr changed */ if (rc == 0) { ma->ma_attr_flags |= MDS_PERM_BYPASS; mo_attr_set(env, child, ma); } } else { CDEBUG(D_INFO, "valid bits: %#llx\n", valid); rc = -EINVAL; } if (rc == 0) mdt_counter_incr(req, LPROC_MDT_SETXATTR); EXIT; out_unlock: mdt_object_unlock_put(info, obj, lh, rc); out: mdt_exit_ucred(info); return rc; }
int mdt_reint_setxattr(struct mdt_thread_info *info, struct mdt_lock_handle *unused) { struct ptlrpc_request *req = mdt_info_req(info); struct md_ucred *uc = mdt_ucred(info); struct mdt_lock_handle *lh; const struct lu_env *env = info->mti_env; struct lu_buf *buf = &info->mti_buf; struct mdt_reint_record *rr = &info->mti_rr; struct md_attr *ma = &info->mti_attr; struct lu_attr *attr = &info->mti_attr.ma_attr; struct mdt_object *obj; struct md_object *child; __u64 valid = attr->la_valid; const char *xattr_name = rr->rr_name; int xattr_len = rr->rr_eadatalen; __u64 lockpart; int rc; posix_acl_xattr_header *new_xattr = NULL; __u32 remote = exp_connect_rmtclient(info->mti_exp); __u32 perm; ENTRY; CDEBUG(D_INODE, "setxattr for "DFID"\n", PFID(rr->rr_fid1)); if (OBD_FAIL_CHECK(OBD_FAIL_MDS_SETXATTR)) RETURN(err_serious(-ENOMEM)); CDEBUG(D_INODE, "%s xattr %s\n", valid & OBD_MD_FLXATTR ? "set" : "remove", xattr_name); rc = mdt_init_ucred_reint(info); if (rc != 0) RETURN(rc); if (valid & OBD_MD_FLRMTRSETFACL) { if (unlikely(!remote)) GOTO(out, rc = err_serious(-EINVAL)); perm = mdt_identity_get_perm(uc->mu_identity, remote, req->rq_peer.nid); if (!(perm & CFS_RMTACL_PERM)) GOTO(out, rc = err_serious(-EPERM)); } if (strncmp(xattr_name, XATTR_USER_PREFIX, sizeof(XATTR_USER_PREFIX) - 1) == 0) { if (!(req->rq_export->exp_connect_flags & OBD_CONNECT_XATTR)) GOTO(out, rc = -EOPNOTSUPP); if (strcmp(xattr_name, XATTR_NAME_LOV) == 0) GOTO(out, rc = -EACCES); if (strcmp(xattr_name, XATTR_NAME_LMA) == 0) GOTO(out, rc = 0); if (strcmp(xattr_name, XATTR_NAME_LINK) == 0) GOTO(out, rc = 0); } else if ((valid & OBD_MD_FLXATTR) && (strncmp(xattr_name, XATTR_NAME_ACL_ACCESS, sizeof(XATTR_NAME_ACL_ACCESS) - 1) == 0 || strncmp(xattr_name, XATTR_NAME_ACL_DEFAULT, sizeof(XATTR_NAME_ACL_DEFAULT) - 1) == 0)) { /* currently lustre limit acl access size */ if (xattr_len > LUSTRE_POSIX_ACL_MAX_SIZE) GOTO(out, -ERANGE); } lockpart = MDS_INODELOCK_UPDATE; /* Revoke all clients' lookup lock, since the access * permissions for this inode is changed when ACL_ACCESS is * set. This isn't needed for ACL_DEFAULT, since that does * not change the access permissions of this inode, nor any * other existing inodes. It is setting the ACLs inherited * by new directories/files at create time. */ if (!strcmp(xattr_name, XATTR_NAME_ACL_ACCESS)) lockpart |= MDS_INODELOCK_LOOKUP; lh = &info->mti_lh[MDT_LH_PARENT]; /* ACLs were sent to clients under LCK_CR locks, so taking LCK_EX * to cancel them. */ mdt_lock_reg_init(lh, LCK_EX); obj = mdt_object_find_lock(info, rr->rr_fid1, lh, lockpart); if (IS_ERR(obj)) GOTO(out, rc = PTR_ERR(obj)); info->mti_mos = obj; rc = mdt_version_get_check_save(info, obj, 0); if (rc) GOTO(out_unlock, rc); if (unlikely(!(valid & OBD_MD_FLCTIME))) { /* This isn't strictly an error, but all current clients * should set OBD_MD_FLCTIME when setting attributes. */ CWARN("%s: client miss to set OBD_MD_FLCTIME when " "setxattr %s: [object "DFID"] [valid "LPU64"]\n", info->mti_exp->exp_obd->obd_name, xattr_name, PFID(rr->rr_fid1), valid); attr->la_ctime = cfs_time_current_sec(); } attr->la_valid = LA_CTIME; child = mdt_object_child(obj); if (valid & OBD_MD_FLXATTR) { char *xattr = (void *)rr->rr_eadata; if (xattr_len > 0) { int flags = 0; if (valid & OBD_MD_FLRMTLSETFACL) { if (unlikely(!remote)) GOTO(out_unlock, rc = -EINVAL); xattr_len = mdt_rmtlsetfacl(info, child, xattr_name, (ext_acl_xattr_header *)xattr, &new_xattr); if (xattr_len < 0) GOTO(out_unlock, rc = xattr_len); xattr = (char *)new_xattr; } if (attr->la_flags & XATTR_REPLACE) flags |= LU_XATTR_REPLACE; if (attr->la_flags & XATTR_CREATE) flags |= LU_XATTR_CREATE; mdt_fail_write(env, info->mti_mdt->mdt_bottom, OBD_FAIL_MDS_SETXATTR_WRITE); buf->lb_buf = xattr; buf->lb_len = xattr_len; rc = mo_xattr_set(env, child, buf, xattr_name, flags); /* update ctime after xattr changed */ if (rc == 0) { ma->ma_attr_flags |= MDS_PERM_BYPASS; mo_attr_set(env, child, ma); } } } else if (valid & OBD_MD_FLXATTRRM) { rc = mo_xattr_del(env, child, xattr_name); /* update ctime after xattr changed */ if (rc == 0) { ma->ma_attr_flags |= MDS_PERM_BYPASS; mo_attr_set(env, child, ma); } } else { CDEBUG(D_INFO, "valid bits: "LPX64"\n", valid); rc = -EINVAL; } if (rc == 0) mdt_counter_incr(req->rq_export, LPROC_MDT_SETXATTR); EXIT; out_unlock: mdt_object_unlock_put(info, obj, lh, rc); if (unlikely(new_xattr != NULL)) lustre_posix_acl_xattr_free(new_xattr, xattr_len); out: mdt_exit_ucred(info); return rc; }
static int new_init_ucred(struct mdt_thread_info *info, ucred_init_type_t type, void *buf) { struct ptlrpc_request *req = mdt_info_req(info); struct mdt_device *mdt = info->mti_mdt; struct ptlrpc_user_desc *pud = req->rq_user_desc; struct md_ucred *ucred = mdt_ucred(info); lnet_nid_t peernid = req->rq_peer.nid; __u32 perm = 0; __u32 remote = exp_connect_rmtclient(info->mti_exp); int setuid; int setgid; int rc = 0; ENTRY; LASSERT(req->rq_auth_gss); LASSERT(!req->rq_auth_usr_mdt); LASSERT(req->rq_user_desc); ucred->mu_valid = UCRED_INVALID; ucred->mu_o_uid = pud->pud_uid; ucred->mu_o_gid = pud->pud_gid; ucred->mu_o_fsuid = pud->pud_fsuid; ucred->mu_o_fsgid = pud->pud_fsgid; if (type == BODY_INIT) { struct mdt_body *body = (struct mdt_body *)buf; ucred->mu_suppgids[0] = body->suppgid; ucred->mu_suppgids[1] = -1; } /* sanity check: we expect the uid which client claimed is true */ if (remote) { if (req->rq_auth_mapped_uid == INVALID_UID) { CDEBUG(D_SEC, "remote user not mapped, deny access!\n"); RETURN(-EACCES); } if (ptlrpc_user_desc_do_idmap(req, pud)) RETURN(-EACCES); if (req->rq_auth_mapped_uid != pud->pud_uid) { CDEBUG(D_SEC, "remote client %s: auth/mapped uid %u/%u " "while client claims %u:%u/%u:%u\n", libcfs_nid2str(peernid), req->rq_auth_uid, req->rq_auth_mapped_uid, pud->pud_uid, pud->pud_gid, pud->pud_fsuid, pud->pud_fsgid); RETURN(-EACCES); } } else { if (req->rq_auth_uid != pud->pud_uid) { CDEBUG(D_SEC, "local client %s: auth uid %u " "while client claims %u:%u/%u:%u\n", libcfs_nid2str(peernid), req->rq_auth_uid, pud->pud_uid, pud->pud_gid, pud->pud_fsuid, pud->pud_fsgid); RETURN(-EACCES); } } if (is_identity_get_disabled(mdt->mdt_identity_cache)) { if (remote) { CDEBUG(D_SEC, "remote client must run with identity_get " "enabled!\n"); RETURN(-EACCES); } else { ucred->mu_identity = NULL; perm = CFS_SETUID_PERM | CFS_SETGID_PERM | CFS_SETGRP_PERM; } } else { struct md_identity *identity; identity = mdt_identity_get(mdt->mdt_identity_cache, pud->pud_uid); if (IS_ERR(identity)) { if (unlikely(PTR_ERR(identity) == -EREMCHG && !remote)) { ucred->mu_identity = NULL; perm = CFS_SETUID_PERM | CFS_SETGID_PERM | CFS_SETGRP_PERM; } else { CDEBUG(D_SEC, "Deny access without identity: uid %u\n", pud->pud_uid); RETURN(-EACCES); } } else { ucred->mu_identity = identity; perm = mdt_identity_get_perm(ucred->mu_identity, remote, peernid); } } /* find out the setuid/setgid attempt */ setuid = (pud->pud_uid != pud->pud_fsuid); setgid = ((pud->pud_gid != pud->pud_fsgid) || (ucred->mu_identity && (pud->pud_gid != ucred->mu_identity->mi_gid))); /* check permission of setuid */ if (setuid && !(perm & CFS_SETUID_PERM)) { CDEBUG(D_SEC, "mdt blocked setuid attempt (%u -> %u) from %s\n", pud->pud_uid, pud->pud_fsuid, libcfs_nid2str(peernid)); GOTO(out, rc = -EACCES); } /* check permission of setgid */ if (setgid && !(perm & CFS_SETGID_PERM)) { CDEBUG(D_SEC, "mdt blocked setgid attempt (%u:%u/%u:%u -> %u) " "from %s\n", pud->pud_uid, pud->pud_gid, pud->pud_fsuid, pud->pud_fsgid, ucred->mu_identity->mi_gid, libcfs_nid2str(peernid)); GOTO(out, rc = -EACCES); } /* * NB: remote client not allowed to setgroups anyway. */ if (!remote && perm & CFS_SETGRP_PERM) { if (pud->pud_ngroups) { /* setgroups for local client */ ucred->mu_ginfo = cfs_groups_alloc(pud->pud_ngroups); if (!ucred->mu_ginfo) { CERROR("failed to alloc %d groups\n", pud->pud_ngroups); GOTO(out, rc = -ENOMEM); } lustre_groups_from_list(ucred->mu_ginfo, pud->pud_groups); lustre_groups_sort(ucred->mu_ginfo); } else { ucred->mu_ginfo = NULL; } } else { ucred->mu_suppgids[0] = -1; ucred->mu_suppgids[1] = -1; ucred->mu_ginfo = NULL; } ucred->mu_uid = pud->pud_uid; ucred->mu_gid = pud->pud_gid; ucred->mu_fsuid = pud->pud_fsuid; ucred->mu_fsgid = pud->pud_fsgid; /* process root_squash here. */ mdt_root_squash(info, peernid); /* remove fs privilege for non-root user. */ if (ucred->mu_fsuid) ucred->mu_cap = pud->pud_cap & ~CFS_CAP_FS_MASK; else ucred->mu_cap = pud->pud_cap; if (remote && !(perm & CFS_RMTOWN_PERM)) ucred->mu_cap &= ~(CFS_CAP_SYS_RESOURCE_MASK | CFS_CAP_CHOWN_MASK); ucred->mu_valid = UCRED_NEW; EXIT; out: if (rc) { if (ucred->mu_ginfo) { cfs_put_group_info(ucred->mu_ginfo); ucred->mu_ginfo = NULL; } if (ucred->mu_identity) { mdt_identity_put(mdt->mdt_identity_cache, ucred->mu_identity); ucred->mu_identity = NULL; } } return rc; }
int mdt_getxattr(struct mdt_thread_info *info) { struct ptlrpc_request *req = mdt_info_req(info); struct mdt_export_data *med = mdt_req2med(req); struct md_ucred *uc = mdt_ucred(info); struct mdt_body *reqbody; struct mdt_body *repbody = NULL; struct md_object *next; struct lu_buf *buf; __u32 remote = exp_connect_rmtclient(info->mti_exp); __u32 perm; int easize, rc; ENTRY; LASSERT(info->mti_object != NULL); LASSERT(lu_object_assert_exists(&info->mti_object->mot_obj.mo_lu)); CDEBUG(D_INODE, "getxattr "DFID"\n", PFID(&info->mti_body->fid1)); reqbody = req_capsule_client_get(info->mti_pill, &RMF_MDT_BODY); if (reqbody == NULL) RETURN(err_serious(-EFAULT)); rc = mdt_init_ucred(info, reqbody); if (rc) RETURN(err_serious(rc)); next = mdt_object_child(info->mti_object); if (info->mti_body->valid & OBD_MD_FLRMTRGETFACL) { if (unlikely(!remote)) GOTO(out, rc = err_serious(-EINVAL)); perm = mdt_identity_get_perm(uc->mu_identity, remote, req->rq_peer.nid); if (!(perm & CFS_RMTACL_PERM)) GOTO(out, rc = err_serious(-EPERM)); rc = mo_permission(info->mti_env, NULL, next, NULL, MAY_RGETFACL); if (rc) GOTO(out, rc = err_serious(rc)); } easize = mdt_getxattr_pack_reply(info); if (easize < 0) GOTO(out, rc = err_serious(easize)); repbody = req_capsule_server_get(info->mti_pill, &RMF_MDT_BODY); LASSERT(repbody != NULL); /* No need further getxattr. */ if (easize == 0 || reqbody->eadatasize == 0) GOTO(out, rc = easize); buf = &info->mti_buf; buf->lb_buf = req_capsule_server_get(info->mti_pill, &RMF_EADATA); buf->lb_len = easize; if (info->mti_body->valid & OBD_MD_FLXATTR) { int flags = CFS_IC_NOTHING; char *xattr_name = req_capsule_client_get(info->mti_pill, &RMF_NAME); CDEBUG(D_INODE, "getxattr %s\n", xattr_name); rc = mo_xattr_get(info->mti_env, next, buf, xattr_name); if (rc < 0) { CERROR("getxattr failed: %d\n", rc); GOTO(out, rc); } if (info->mti_body->valid & (OBD_MD_FLRMTLSETFACL | OBD_MD_FLRMTLGETFACL)) flags = CFS_IC_ALL; else if (info->mti_body->valid & OBD_MD_FLRMTRGETFACL) flags = CFS_IC_MAPPED; if (rc > 0 && flags != CFS_IC_NOTHING) { int rc1; if (unlikely(!remote)) GOTO(out, rc = -EINVAL); rc1 = lustre_posix_acl_xattr_id2client(uc, med->med_idmap, (posix_acl_xattr_header *)(buf->lb_buf), rc, flags); if (unlikely(rc1 < 0)) rc = rc1; } } else if (info->mti_body->valid & OBD_MD_FLXATTRLS) { CDEBUG(D_INODE, "listxattr\n"); rc = mo_xattr_list(info->mti_env, next, buf); if (rc < 0) CDEBUG(D_INFO, "listxattr failed: %d\n", rc); } else LBUG(); EXIT; out: if (rc >= 0) { mdt_counter_incr(req->rq_export, LPROC_MDT_GETXATTR); repbody->eadatasize = rc; rc = 0; } mdt_exit_ucred(info); return rc; }
/* return EADATA length to the caller. negative value means error */ static int mdt_getxattr_pack_reply(struct mdt_thread_info * info) { struct req_capsule *pill = info->mti_pill ; struct ptlrpc_request *req = mdt_info_req(info); char *xattr_name; __u64 valid; static const char user_string[] = "user."; int size, rc; ENTRY; if (OBD_FAIL_CHECK(OBD_FAIL_MDS_GETXATTR_PACK)) RETURN(-ENOMEM); valid = info->mti_body->valid & (OBD_MD_FLXATTR | OBD_MD_FLXATTRLS); /* Determine how many bytes we need */ if (valid == OBD_MD_FLXATTR) { xattr_name = req_capsule_client_get(pill, &RMF_NAME); if (!xattr_name) RETURN(-EFAULT); if (!(exp_connect_flags(req->rq_export) & OBD_CONNECT_XATTR) && !strncmp(xattr_name, user_string, sizeof(user_string) - 1)) RETURN(-EOPNOTSUPP); size = mo_xattr_get(info->mti_env, mdt_object_child(info->mti_object), &LU_BUF_NULL, xattr_name); } else if (valid == OBD_MD_FLXATTRLS) { size = mo_xattr_list(info->mti_env, mdt_object_child(info->mti_object), &LU_BUF_NULL); } else if (valid == OBD_MD_FLXATTRALL) { /* N.B. eadatasize = 0 is not valid for FLXATTRALL */ /* We could calculate accurate sizes, but this would * introduce a lot of overhead, let's do it later... */ size = info->mti_body->eadatasize; req_capsule_set_size(pill, &RMF_EAVALS, RCL_SERVER, size); req_capsule_set_size(pill, &RMF_EAVALS_LENS, RCL_SERVER, size); } else { CDEBUG(D_INFO, "Valid bits: "LPX64"\n", info->mti_body->valid); RETURN(-EINVAL); } if (size == -ENODATA) { size = 0; } else if (size < 0) { CERROR("Error geting EA size: %d\n", size); RETURN(size); } req_capsule_set_size(pill, &RMF_EADATA, RCL_SERVER, info->mti_body->eadatasize == 0 ? 0 : size); rc = req_capsule_server_pack(pill); if (rc) { LASSERT(rc < 0); RETURN(rc); } RETURN(size); }
int mdt_getxattr(struct mdt_thread_info *info) { struct ptlrpc_request *req = mdt_info_req(info); struct mdt_export_data *med = mdt_req2med(req); struct lu_ucred *uc = lu_ucred(info->mti_env); struct mdt_body *reqbody; struct mdt_body *repbody = NULL; struct md_object *next; struct lu_buf *buf; __u32 remote = exp_connect_rmtclient(info->mti_exp); __u32 perm; int easize, rc; obd_valid valid; ENTRY; LASSERT(info->mti_object != NULL); LASSERT(lu_object_assert_exists(&info->mti_object->mot_obj)); CDEBUG(D_INODE, "getxattr "DFID"\n", PFID(&info->mti_body->fid1)); reqbody = req_capsule_client_get(info->mti_pill, &RMF_MDT_BODY); if (reqbody == NULL) RETURN(err_serious(-EFAULT)); rc = mdt_init_ucred(info, reqbody); if (rc) RETURN(err_serious(rc)); next = mdt_object_child(info->mti_object); if (info->mti_body->valid & OBD_MD_FLRMTRGETFACL) { if (unlikely(!remote)) GOTO(out, rc = err_serious(-EINVAL)); perm = mdt_identity_get_perm(uc->uc_identity, remote, req->rq_peer.nid); if (!(perm & CFS_RMTACL_PERM)) GOTO(out, rc = err_serious(-EPERM)); rc = mo_permission(info->mti_env, NULL, next, NULL, MAY_RGETFACL); if (rc) GOTO(out, rc = err_serious(rc)); } easize = mdt_getxattr_pack_reply(info); if (easize < 0) GOTO(out, rc = err_serious(easize)); repbody = req_capsule_server_get(info->mti_pill, &RMF_MDT_BODY); LASSERT(repbody != NULL); /* No need further getxattr. */ if (easize == 0 || reqbody->eadatasize == 0) GOTO(out, rc = easize); buf = &info->mti_buf; buf->lb_buf = req_capsule_server_get(info->mti_pill, &RMF_EADATA); buf->lb_len = easize; valid = info->mti_body->valid & (OBD_MD_FLXATTR | OBD_MD_FLXATTRLS); if (valid == OBD_MD_FLXATTR) { char *xattr_name = req_capsule_client_get(info->mti_pill, &RMF_NAME); rc = mdt_getxattr_one(info, xattr_name, next, buf, med, uc); } else if (valid == OBD_MD_FLXATTRLS) { CDEBUG(D_INODE, "listxattr\n"); rc = mo_xattr_list(info->mti_env, next, buf); if (rc < 0) CDEBUG(D_INFO, "listxattr failed: %d\n", rc); } else if (valid == OBD_MD_FLXATTRALL) { rc = mdt_getxattr_all(info, reqbody, repbody, buf, next); } else LBUG(); EXIT; out: if (rc >= 0) { mdt_counter_incr(req, LPROC_MDT_GETXATTR); repbody->eadatasize = rc; rc = 0; } mdt_exit_ucred(info); return rc; }
int mdt_check_ucred(struct mdt_thread_info *info) { struct ptlrpc_request *req = mdt_info_req(info); struct mdt_device *mdt = info->mti_mdt; struct ptlrpc_user_desc *pud = req->rq_user_desc; struct md_ucred *ucred = mdt_ucred(info); struct md_identity *identity = NULL; lnet_nid_t peernid = req->rq_peer.nid; __u32 perm = 0; __u32 remote = exp_connect_rmtclient(info->mti_exp); int setuid; int setgid; int rc = 0; ENTRY; if ((ucred->mu_valid == UCRED_OLD) || (ucred->mu_valid == UCRED_NEW)) RETURN(0); if (!req->rq_auth_gss || req->rq_auth_usr_mdt || !req->rq_user_desc) RETURN(0); /* sanity check: if we use strong authentication, we expect the * uid which client claimed is true */ if (remote) { if (req->rq_auth_mapped_uid == INVALID_UID) { CDEBUG(D_SEC, "remote user not mapped, deny access!\n"); RETURN(-EACCES); } if (ptlrpc_user_desc_do_idmap(req, pud)) RETURN(-EACCES); if (req->rq_auth_mapped_uid != pud->pud_uid) { CDEBUG(D_SEC, "remote client %s: auth/mapped uid %u/%u " "while client claims %u:%u/%u:%u\n", libcfs_nid2str(peernid), req->rq_auth_uid, req->rq_auth_mapped_uid, pud->pud_uid, pud->pud_gid, pud->pud_fsuid, pud->pud_fsgid); RETURN(-EACCES); } } else { if (req->rq_auth_uid != pud->pud_uid) { CDEBUG(D_SEC, "local client %s: auth uid %u " "while client claims %u:%u/%u:%u\n", libcfs_nid2str(peernid), req->rq_auth_uid, pud->pud_uid, pud->pud_gid, pud->pud_fsuid, pud->pud_fsgid); RETURN(-EACCES); } } if (is_identity_get_disabled(mdt->mdt_identity_cache)) { if (remote) { CDEBUG(D_SEC, "remote client must run with identity_get " "enabled!\n"); RETURN(-EACCES); } RETURN(0); } identity = mdt_identity_get(mdt->mdt_identity_cache, pud->pud_uid); if (IS_ERR(identity)) { if (unlikely(PTR_ERR(identity) == -EREMCHG && !remote)) { RETURN(0); } else { CDEBUG(D_SEC, "Deny access without identity: uid %u\n", pud->pud_uid); RETURN(-EACCES); } } perm = mdt_identity_get_perm(identity, remote, peernid); /* find out the setuid/setgid attempt */ setuid = (pud->pud_uid != pud->pud_fsuid); setgid = (pud->pud_gid != pud->pud_fsgid || pud->pud_gid != identity->mi_gid); /* check permission of setuid */ if (setuid && !(perm & CFS_SETUID_PERM)) { CDEBUG(D_SEC, "mdt blocked setuid attempt (%u -> %u) from %s\n", pud->pud_uid, pud->pud_fsuid, libcfs_nid2str(peernid)); GOTO(out, rc = -EACCES); } /* check permission of setgid */ if (setgid && !(perm & CFS_SETGID_PERM)) { CDEBUG(D_SEC, "mdt blocked setgid attempt (%u:%u/%u:%u -> %u) " "from %s\n", pud->pud_uid, pud->pud_gid, pud->pud_fsuid, pud->pud_fsgid, identity->mi_gid, libcfs_nid2str(peernid)); GOTO(out, rc = -EACCES); } EXIT; out: mdt_identity_put(mdt->mdt_identity_cache, identity); return rc; }
/* return EADATA length to the caller. negative value means error */ static int mdt_getxattr_pack_reply(struct mdt_thread_info * info) { struct req_capsule *pill = info->mti_pill; struct ptlrpc_request *req = mdt_info_req(info); const char *xattr_name; u64 valid; static const char user_string[] = "user."; int size; int rc = 0; int rc2; ENTRY; valid = info->mti_body->mbo_valid & (OBD_MD_FLXATTR | OBD_MD_FLXATTRLS); /* Determine how many bytes we need */ if (valid == OBD_MD_FLXATTR) { xattr_name = req_capsule_client_get(pill, &RMF_NAME); if (!xattr_name) RETURN(-EFAULT); if (!(exp_connect_flags(req->rq_export) & OBD_CONNECT_XATTR) && !strncmp(xattr_name, user_string, sizeof(user_string) - 1)) RETURN(-EOPNOTSUPP); size = mo_xattr_get(info->mti_env, mdt_object_child(info->mti_object), &LU_BUF_NULL, xattr_name); if (size == -ENODATA) { /* XXX: Some client code will not handle -ENODATA * for XATTR_NAME_LOV (trusted.lov) properly. */ if (strcmp(xattr_name, XATTR_NAME_LOV) == 0) rc = 0; else rc = -ENODATA; size = 0; } } else if (valid == OBD_MD_FLXATTRLS) { xattr_name = "list"; size = mo_xattr_list(info->mti_env, mdt_object_child(info->mti_object), &LU_BUF_NULL); } else if (valid == OBD_MD_FLXATTRALL) { xattr_name = "all"; /* N.B. eadatasize = 0 is not valid for FLXATTRALL */ /* We could calculate accurate sizes, but this would * introduce a lot of overhead, let's do it later... */ size = info->mti_body->mbo_eadatasize; req_capsule_set_size(pill, &RMF_EAVALS, RCL_SERVER, size); req_capsule_set_size(pill, &RMF_EAVALS_LENS, RCL_SERVER, size); } else { CDEBUG(D_INFO, "Valid bits: %#llx\n", info->mti_body->mbo_valid); RETURN(-EINVAL); } if (size < 0) { if (size != -EOPNOTSUPP && size != -ENOENT) CERROR("%s: error geting EA size for '%s': rc = %d\n", mdt_obd_name(info->mti_mdt), xattr_name, size); RETURN(size); } if (req_capsule_has_field(pill, &RMF_ACL, RCL_SERVER)) req_capsule_set_size(pill, &RMF_ACL, RCL_SERVER, LUSTRE_POSIX_ACL_MAX_SIZE_OLD); req_capsule_set_size(pill, &RMF_EADATA, RCL_SERVER, info->mti_body->mbo_eadatasize == 0 ? 0 : size); rc2 = req_capsule_server_pack(pill); if (rc2 < 0) RETURN(rc2); if (OBD_FAIL_CHECK(OBD_FAIL_MDS_GETXATTR_PACK)) RETURN(-ENOMEM); RETURN(rc < 0 ? rc : size); }
int mdt_getxattr(struct mdt_thread_info *info) { struct ptlrpc_request *req = mdt_info_req(info); struct mdt_body *reqbody; struct mdt_body *repbody = NULL; struct md_object *next; struct lu_buf *buf; int easize, rc; u64 valid; ENTRY; LASSERT(info->mti_object != NULL); LASSERT(lu_object_assert_exists(&info->mti_object->mot_obj)); CDEBUG(D_INODE, "getxattr "DFID"\n", PFID(&info->mti_body->mbo_fid1)); rc = req_check_sepol(info->mti_pill); if (rc) RETURN(err_serious(rc)); reqbody = req_capsule_client_get(info->mti_pill, &RMF_MDT_BODY); if (reqbody == NULL) RETURN(err_serious(-EFAULT)); rc = mdt_init_ucred(info, reqbody); if (rc) RETURN(err_serious(rc)); next = mdt_object_child(info->mti_object); easize = mdt_getxattr_pack_reply(info); if (easize == -ENODATA) GOTO(out, rc = easize); else if (easize < 0) GOTO(out, rc = err_serious(easize)); repbody = req_capsule_server_get(info->mti_pill, &RMF_MDT_BODY); LASSERT(repbody != NULL); /* No need further getxattr. */ if (easize == 0 || reqbody->mbo_eadatasize == 0) GOTO(out, rc = easize); buf = &info->mti_buf; buf->lb_buf = req_capsule_server_get(info->mti_pill, &RMF_EADATA); buf->lb_len = easize; valid = info->mti_body->mbo_valid & (OBD_MD_FLXATTR | OBD_MD_FLXATTRLS); if (valid == OBD_MD_FLXATTR) { const char *xattr_name = req_capsule_client_get(info->mti_pill, &RMF_NAME); rc = mo_xattr_get(info->mti_env, next, buf, xattr_name); if (rc < 0) GOTO(out, rc); rc = mdt_nodemap_map_acl(info, buf->lb_buf, rc, xattr_name, NODEMAP_FS_TO_CLIENT); } else if (valid == OBD_MD_FLXATTRLS) { CDEBUG(D_INODE, "listxattr\n"); rc = mo_xattr_list(info->mti_env, next, buf); if (rc < 0) CDEBUG(D_INFO, "listxattr failed: %d\n", rc); } else if (valid == OBD_MD_FLXATTRALL) { rc = mdt_getxattr_all(info, reqbody, repbody, buf, next); } else LBUG(); EXIT; out: if (rc >= 0) { mdt_counter_incr(req, LPROC_MDT_GETXATTR); /* LU-11109: Set OBD_MD_FLXATTR on success so that * newer clients can distinguish between nonexistent * xattrs and zero length values. */ repbody->mbo_valid |= OBD_MD_FLXATTR; repbody->mbo_eadatasize = rc; rc = 0; } mdt_exit_ucred(info); return rc; }