From e0ad7b073eb7317e5afe0385b02dcb1d52a1eedf Mon Sep 17 00:00:00 2001 From: "akpm@osdl.org" Date: Mon, 9 Jan 2006 20:51:56 -0800 Subject: [PATCH] move xattr permission checks into the VFS ) From: Christoph Hellwig The xattr code has rather complex permission checks because the rules are very different for different attribute namespaces. This patch moves as much as we can into the generic code. Currently all the major disk based filesystems duplicate these checks, while many minor filesystems or network filesystems lack some or all of them. To do this we need defines for the extended attribute names in common code, I moved them up from JFS which had the nicest defintions. Signed-off-by: Christoph Hellwig Acked-by: Dave Kleikamp Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- fs/jfs/xattr.c | 15 --------------- 1 file changed, 15 deletions(-) (limited to 'fs/jfs/xattr.c') diff --git a/fs/jfs/xattr.c b/fs/jfs/xattr.c index 23aa5066b5a4..9dde36a1eb5d 100644 --- a/fs/jfs/xattr.c +++ b/fs/jfs/xattr.c @@ -83,21 +83,6 @@ struct ea_buffer { #define EA_NEW 0x0004 #define EA_MALLOC 0x0008 -/* Namespaces */ -#define XATTR_SYSTEM_PREFIX "system." -#define XATTR_SYSTEM_PREFIX_LEN (sizeof (XATTR_SYSTEM_PREFIX) - 1) - -#define XATTR_USER_PREFIX "user." -#define XATTR_USER_PREFIX_LEN (sizeof (XATTR_USER_PREFIX) - 1) - -#define XATTR_OS2_PREFIX "os2." -#define XATTR_OS2_PREFIX_LEN (sizeof (XATTR_OS2_PREFIX) - 1) - -/* XATTR_SECURITY_PREFIX is defined in include/linux/xattr.h */ -#define XATTR_SECURITY_PREFIX_LEN (sizeof (XATTR_SECURITY_PREFIX) - 1) - -#define XATTR_TRUSTED_PREFIX "trusted." -#define XATTR_TRUSTED_PREFIX_LEN (sizeof (XATTR_TRUSTED_PREFIX) - 1) /* * These three routines are used to recognize on-disk extended attributes -- cgit v1.2.3 From 44a0033f6d5f3e7e2fc37d7b44a1d105c70d4682 Mon Sep 17 00:00:00 2001 From: Christoph Hellwig Date: Mon, 9 Jan 2006 20:51:57 -0800 Subject: [PATCH] remove jfs xattr permission checks remove checks now in the VFS Signed-off-by: Christoph Hellwig Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- fs/jfs/xattr.c | 51 +++++++++------------------------------------------ 1 file changed, 9 insertions(+), 42 deletions(-) (limited to 'fs/jfs/xattr.c') diff --git a/fs/jfs/xattr.c b/fs/jfs/xattr.c index 9dde36a1eb5d..952da5f917cd 100644 --- a/fs/jfs/xattr.c +++ b/fs/jfs/xattr.c @@ -758,36 +758,23 @@ static int can_set_system_xattr(struct inode *inode, const char *name, static int can_set_xattr(struct inode *inode, const char *name, const void *value, size_t value_len) { - if (IS_RDONLY(inode)) - return -EROFS; - - if (IS_IMMUTABLE(inode) || IS_APPEND(inode)) - return -EPERM; - - if(strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN) == 0) - /* - * "system.*" - */ + if (!strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN)) return can_set_system_xattr(inode, name, value, value_len); - if(strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN) == 0) - return (capable(CAP_SYS_ADMIN) ? 0 : -EPERM); - -#ifdef CONFIG_JFS_SECURITY - if (strncmp(name, XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN) - == 0) - return 0; /* Leave it to the security module */ -#endif - - if((strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN) != 0) && - (strncmp(name, XATTR_OS2_PREFIX, XATTR_OS2_PREFIX_LEN) != 0)) + /* + * Don't allow setting an attribute in an unknown namespace. + */ + if (strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN) && + strncmp(name, XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN) && + strncmp(name, XATTR_USER_PREFIX, XATTR_USER_PREFIX_LEN) && + strncmp(name, XATTR_OS2_PREFIX, XATTR_OS2_PREFIX_LEN)) return -EOPNOTSUPP; if (!S_ISREG(inode->i_mode) && (!S_ISDIR(inode->i_mode) || inode->i_mode &S_ISVTX)) return -EPERM; - return permission(inode, MAY_WRITE, NULL); + return 0; } int __jfs_setxattr(tid_t tid, struct inode *inode, const char *name, @@ -957,22 +944,6 @@ int jfs_setxattr(struct dentry *dentry, const char *name, const void *value, return rc; } -static int can_get_xattr(struct inode *inode, const char *name) -{ -#ifdef CONFIG_JFS_SECURITY - if(strncmp(name, XATTR_SECURITY_PREFIX, XATTR_SECURITY_PREFIX_LEN) == 0) - return 0; -#endif - - if(strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN) == 0) - return (capable(CAP_SYS_ADMIN) ? 0 : -EPERM); - - if(strncmp(name, XATTR_SYSTEM_PREFIX, XATTR_SYSTEM_PREFIX_LEN) == 0) - return 0; - - return permission(inode, MAY_READ, NULL); -} - ssize_t __jfs_getxattr(struct inode *inode, const char *name, void *data, size_t buf_size) { @@ -983,12 +954,8 @@ ssize_t __jfs_getxattr(struct inode *inode, const char *name, void *data, ssize_t size; int namelen = strlen(name); char *os2name = NULL; - int rc; char *value; - if ((rc = can_get_xattr(inode, name))) - return rc; - if (strncmp(name, XATTR_OS2_PREFIX, XATTR_OS2_PREFIX_LEN) == 0) { os2name = kmalloc(namelen - XATTR_OS2_PREFIX_LEN + 1, GFP_KERNEL); -- cgit v1.2.3 From 16f7e0fe2ecc30f30652e8185e1772cdebe39109 Mon Sep 17 00:00:00 2001 From: Randy Dunlap Date: Wed, 11 Jan 2006 12:17:46 -0800 Subject: [PATCH] capable/capability.h (fs/) fs: Use where capable() is used. Signed-off-by: Randy Dunlap Acked-by: Tim Schmielau Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- fs/attr.c | 1 + fs/autofs/root.c | 1 + fs/autofs4/root.c | 1 + fs/buffer.c | 1 + fs/compat_ioctl.c | 1 + fs/dcookies.c | 1 + fs/dquot.c | 1 + fs/ext2/acl.c | 1 + fs/ext2/balloc.c | 1 + fs/ext2/ioctl.c | 1 + fs/ext2/xattr_trusted.c | 1 + fs/ext3/acl.c | 1 + fs/ext3/balloc.c | 1 + fs/ext3/ioctl.c | 1 + fs/ext3/xattr_trusted.c | 1 + fs/fat/file.c | 1 + fs/fcntl.c | 1 + fs/file_table.c | 1 + fs/hfsplus/ioctl.c | 1 + fs/hugetlbfs/inode.c | 1 + fs/ioctl.c | 1 + fs/ioprio.c | 1 + fs/jffs2/fs.c | 1 + fs/jfs/xattr.c | 1 + fs/namei.c | 1 + fs/namespace.c | 1 + fs/ncpfs/ioctl.c | 1 + fs/ocfs2/file.c | 1 + fs/open.c | 1 + fs/proc/base.c | 1 + fs/proc/kcore.c | 1 + fs/quota.c | 1 + fs/reiserfs/ioctl.c | 1 + fs/reiserfs/xattr.c | 1 + fs/reiserfs/xattr_acl.c | 1 + fs/reiserfs/xattr_trusted.c | 1 + fs/smbfs/proc.c | 1 + fs/sysfs/inode.c | 1 + fs/udf/file.c | 1 + fs/ufs/balloc.c | 1 + fs/xfs/linux-2.6/xfs_ioctl.c | 1 + fs/xfs/linux-2.6/xfs_iops.c | 1 + fs/xfs/quota/xfs_qm_syscalls.c | 3 +++ fs/xfs/xfs_acl.c | 1 + fs/xfs/xfs_attr.c | 3 +++ fs/xfs/xfs_vnodeops.c | 3 +++ 46 files changed, 52 insertions(+) (limited to 'fs/jfs/xattr.c') diff --git a/fs/attr.c b/fs/attr.c index d63e5096f2f2..97de94670878 100644 --- a/fs/attr.c +++ b/fs/attr.c @@ -10,6 +10,7 @@ #include #include #include +#include #include #include #include diff --git a/fs/autofs/root.c b/fs/autofs/root.c index 808134a5a2fa..870e2cf33016 100644 --- a/fs/autofs/root.c +++ b/fs/autofs/root.c @@ -10,6 +10,7 @@ * * ------------------------------------------------------------------------- */ +#include #include #include #include diff --git a/fs/autofs4/root.c b/fs/autofs4/root.c index 14aa70282e8c..e93a7ae467c9 100644 --- a/fs/autofs4/root.c +++ b/fs/autofs4/root.c @@ -12,6 +12,7 @@ * * ------------------------------------------------------------------------- */ +#include #include #include #include diff --git a/fs/buffer.c b/fs/buffer.c index 6466bc8a3dc7..b9bb7ad6897b 100644 --- a/fs/buffer.c +++ b/fs/buffer.c @@ -26,6 +26,7 @@ #include #include #include +#include #include #include #include diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c index 890bc30fbe20..f51696358a21 100644 --- a/fs/compat_ioctl.c +++ b/fs/compat_ioctl.c @@ -14,6 +14,7 @@ #include #include #include +#include #include #include #include diff --git a/fs/dcookies.c b/fs/dcookies.c index 02aa0ddc582a..f8274a8f83bd 100644 --- a/fs/dcookies.c +++ b/fs/dcookies.c @@ -18,6 +18,7 @@ #include #include #include +#include #include #include #include diff --git a/fs/dquot.c b/fs/dquot.c index cb6d5bfbdfd5..1966c890b48d 100644 --- a/fs/dquot.c +++ b/fs/dquot.c @@ -77,6 +77,7 @@ #include #include #include +#include #include #include diff --git a/fs/ext2/acl.c b/fs/ext2/acl.c index 239133d01d91..35acc43b897f 100644 --- a/fs/ext2/acl.c +++ b/fs/ext2/acl.c @@ -4,6 +4,7 @@ * Copyright (C) 2001-2003 Andreas Gruenbacher, */ +#include #include #include #include diff --git a/fs/ext2/balloc.c b/fs/ext2/balloc.c index bb6908066494..2c00953d4b0b 100644 --- a/fs/ext2/balloc.c +++ b/fs/ext2/balloc.c @@ -16,6 +16,7 @@ #include #include #include +#include /* * balloc.c contains the blocks allocation and deallocation routines diff --git a/fs/ext2/ioctl.c b/fs/ext2/ioctl.c index 709d8676b962..3ca9afdf713d 100644 --- a/fs/ext2/ioctl.c +++ b/fs/ext2/ioctl.c @@ -8,6 +8,7 @@ */ #include "ext2.h" +#include #include #include #include diff --git a/fs/ext2/xattr_trusted.c b/fs/ext2/xattr_trusted.c index 2c072bfea23b..f28a6a499c96 100644 --- a/fs/ext2/xattr_trusted.c +++ b/fs/ext2/xattr_trusted.c @@ -7,6 +7,7 @@ #include #include +#include #include #include #include diff --git a/fs/ext3/acl.c b/fs/ext3/acl.c index 9ed132c96034..47a9da2dfb4f 100644 --- a/fs/ext3/acl.c +++ b/fs/ext3/acl.c @@ -7,6 +7,7 @@ #include #include #include +#include #include #include #include diff --git a/fs/ext3/balloc.c b/fs/ext3/balloc.c index c6393fb4c35a..6250fcdf14a1 100644 --- a/fs/ext3/balloc.c +++ b/fs/ext3/balloc.c @@ -13,6 +13,7 @@ #include #include +#include #include #include #include diff --git a/fs/ext3/ioctl.c b/fs/ext3/ioctl.c index 706d68608381..556cd5510078 100644 --- a/fs/ext3/ioctl.c +++ b/fs/ext3/ioctl.c @@ -9,6 +9,7 @@ #include #include +#include #include #include #include diff --git a/fs/ext3/xattr_trusted.c b/fs/ext3/xattr_trusted.c index 7c693c94f14d..86d91f1186dc 100644 --- a/fs/ext3/xattr_trusted.c +++ b/fs/ext3/xattr_trusted.c @@ -7,6 +7,7 @@ #include #include +#include #include #include #include diff --git a/fs/fat/file.c b/fs/fat/file.c index d30876cf35f5..e99c5a73b39e 100644 --- a/fs/fat/file.c +++ b/fs/fat/file.c @@ -6,6 +6,7 @@ * regular file handling primitives for fat-based filesystems */ +#include #include #include #include diff --git a/fs/fcntl.c b/fs/fcntl.c index 9903bde475f2..d0767fe58362 100644 --- a/fs/fcntl.c +++ b/fs/fcntl.c @@ -9,6 +9,7 @@ #include #include #include +#include #include #include #include diff --git a/fs/file_table.c b/fs/file_table.c index 6142250104a6..768b58167543 100644 --- a/fs/file_table.c +++ b/fs/file_table.c @@ -16,6 +16,7 @@ #include #include #include +#include #include #include diff --git a/fs/hfsplus/ioctl.c b/fs/hfsplus/ioctl.c index e07aa096e07c..13cf848ac833 100644 --- a/fs/hfsplus/ioctl.c +++ b/fs/hfsplus/ioctl.c @@ -12,6 +12,7 @@ * hfsplus ioctls */ +#include #include #include #include diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c index ff1b7d108bd0..ab4c3a9d51b8 100644 --- a/fs/hugetlbfs/inode.c +++ b/fs/hugetlbfs/inode.c @@ -18,6 +18,7 @@ #include #include #include +#include #include #include #include diff --git a/fs/ioctl.c b/fs/ioctl.c index 569209181425..f8aeec3ca10c 100644 --- a/fs/ioctl.c +++ b/fs/ioctl.c @@ -8,6 +8,7 @@ #include #include #include +#include #include #include #include diff --git a/fs/ioprio.c b/fs/ioprio.c index 4bf1c6365a19..ca77008146c0 100644 --- a/fs/ioprio.c +++ b/fs/ioprio.c @@ -22,6 +22,7 @@ #include #include #include +#include #include static int set_task_ioprio(struct task_struct *task, int ioprio) diff --git a/fs/jffs2/fs.c b/fs/jffs2/fs.c index d0fcc5f3497e..09e5d10b8840 100644 --- a/fs/jffs2/fs.c +++ b/fs/jffs2/fs.c @@ -11,6 +11,7 @@ * */ +#include #include #include #include diff --git a/fs/jfs/xattr.c b/fs/jfs/xattr.c index 952da5f917cd..f23048f9471f 100644 --- a/fs/jfs/xattr.c +++ b/fs/jfs/xattr.c @@ -17,6 +17,7 @@ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA */ +#include #include #include #include diff --git a/fs/namei.c b/fs/namei.c index 0a8f073435af..1e5746eb1380 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -28,6 +28,7 @@ #include #include #include +#include #include #include #include diff --git a/fs/namespace.c b/fs/namespace.c index 2ca6145f43d6..8bc15b362d23 100644 --- a/fs/namespace.c +++ b/fs/namespace.c @@ -16,6 +16,7 @@ #include #include #include +#include #include #include #include diff --git a/fs/ncpfs/ioctl.c b/fs/ncpfs/ioctl.c index fd3efdca5ae3..d6e0c089e1b1 100644 --- a/fs/ncpfs/ioctl.c +++ b/fs/ncpfs/ioctl.c @@ -10,6 +10,7 @@ #include #include +#include #include #include #include diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c index ca5f9f90d794..eaf33caa0a1f 100644 --- a/fs/ocfs2/file.c +++ b/fs/ocfs2/file.c @@ -23,6 +23,7 @@ * Boston, MA 021110-1307, USA. */ +#include #include #include #include diff --git a/fs/open.c b/fs/open.c index a3b3a9b5c2ff..8e20c1f32563 100644 --- a/fs/open.c +++ b/fs/open.c @@ -16,6 +16,7 @@ #include #include #include +#include #include #include #include diff --git a/fs/proc/base.c b/fs/proc/base.c index 634355e16986..20feb7568deb 100644 --- a/fs/proc/base.c +++ b/fs/proc/base.c @@ -55,6 +55,7 @@ #include #include #include +#include #include #include #include diff --git a/fs/proc/kcore.c b/fs/proc/kcore.c index 1c7da988fcc3..adc2cd95169a 100644 --- a/fs/proc/kcore.c +++ b/fs/proc/kcore.c @@ -14,6 +14,7 @@ #include #include #include +#include #include #include #include diff --git a/fs/quota.c b/fs/quota.c index d14d872646d4..ba9e0bf32f67 100644 --- a/fs/quota.c +++ b/fs/quota.c @@ -15,6 +15,7 @@ #include #include #include +#include #include /* Check validity of generic quotactl commands */ diff --git a/fs/reiserfs/ioctl.c b/fs/reiserfs/ioctl.c index ba8bf8df6dc7..745c88100895 100644 --- a/fs/reiserfs/ioctl.c +++ b/fs/reiserfs/ioctl.c @@ -2,6 +2,7 @@ * Copyright 2000 by Hans Reiser, licensing governed by reiserfs/README */ +#include #include #include #include diff --git a/fs/reiserfs/xattr.c b/fs/reiserfs/xattr.c index 6f99e01f94ab..cc061bfd437b 100644 --- a/fs/reiserfs/xattr.c +++ b/fs/reiserfs/xattr.c @@ -30,6 +30,7 @@ */ #include +#include #include #include #include diff --git a/fs/reiserfs/xattr_acl.c b/fs/reiserfs/xattr_acl.c index 2dc953504cc0..43de3ba83332 100644 --- a/fs/reiserfs/xattr_acl.c +++ b/fs/reiserfs/xattr_acl.c @@ -1,3 +1,4 @@ +#include #include #include #include diff --git a/fs/reiserfs/xattr_trusted.c b/fs/reiserfs/xattr_trusted.c index 2501f7e66ab9..024a938ca60f 100644 --- a/fs/reiserfs/xattr_trusted.c +++ b/fs/reiserfs/xattr_trusted.c @@ -1,4 +1,5 @@ #include +#include #include #include #include diff --git a/fs/smbfs/proc.c b/fs/smbfs/proc.c index d6baec0f24ad..b1b878b81730 100644 --- a/fs/smbfs/proc.c +++ b/fs/smbfs/proc.c @@ -8,6 +8,7 @@ */ #include +#include #include #include #include diff --git a/fs/sysfs/inode.c b/fs/sysfs/inode.c index c3133219941c..689f7bcfaf30 100644 --- a/fs/sysfs/inode.c +++ b/fs/sysfs/inode.c @@ -11,6 +11,7 @@ #include #include #include +#include #include "sysfs.h" extern struct super_block * sysfs_sb; diff --git a/fs/udf/file.c b/fs/udf/file.c index 8a388289040d..a6f2acc1f15c 100644 --- a/fs/udf/file.c +++ b/fs/udf/file.c @@ -31,6 +31,7 @@ #include #include #include /* memset */ +#include #include #include #include diff --git a/fs/ufs/balloc.c b/fs/ufs/balloc.c index faf1512173eb..a9f4421ddb6f 100644 --- a/fs/ufs/balloc.c +++ b/fs/ufs/balloc.c @@ -13,6 +13,7 @@ #include #include #include +#include #include #include #include diff --git a/fs/xfs/linux-2.6/xfs_ioctl.c b/fs/xfs/linux-2.6/xfs_ioctl.c index f98c5be3dfe7..21667ba6dcd5 100644 --- a/fs/xfs/linux-2.6/xfs_ioctl.c +++ b/fs/xfs/linux-2.6/xfs_ioctl.c @@ -52,6 +52,7 @@ #include "xfs_dfrag.h" #include "xfs_fsops.h" +#include #include #include #include diff --git a/fs/xfs/linux-2.6/xfs_iops.c b/fs/xfs/linux-2.6/xfs_iops.c index 97fb1470cf28..9b8ee3470ecc 100644 --- a/fs/xfs/linux-2.6/xfs_iops.c +++ b/fs/xfs/linux-2.6/xfs_iops.c @@ -51,6 +51,7 @@ #include "xfs_buf_item.h" #include "xfs_utils.h" +#include #include #include diff --git a/fs/xfs/quota/xfs_qm_syscalls.c b/fs/xfs/quota/xfs_qm_syscalls.c index 86a1d09f48d5..676884394aae 100644 --- a/fs/xfs/quota/xfs_qm_syscalls.c +++ b/fs/xfs/quota/xfs_qm_syscalls.c @@ -15,6 +15,9 @@ * along with this program; if not, write the Free Software Foundation, * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA */ + +#include + #include "xfs.h" #include "xfs_fs.h" #include "xfs_bit.h" diff --git a/fs/xfs/xfs_acl.c b/fs/xfs/xfs_acl.c index cc9c91b9e771..4ff0f4e41c61 100644 --- a/fs/xfs/xfs_acl.c +++ b/fs/xfs/xfs_acl.c @@ -36,6 +36,7 @@ #include "xfs_mac.h" #include "xfs_attr.h" +#include #include STATIC int xfs_acl_setmode(vnode_t *, xfs_acl_t *, int *); diff --git a/fs/xfs/xfs_attr.c b/fs/xfs/xfs_attr.c index 1a11c2b51701..e5e91e9c7e89 100644 --- a/fs/xfs/xfs_attr.c +++ b/fs/xfs/xfs_attr.c @@ -15,6 +15,9 @@ * along with this program; if not, write the Free Software Foundation, * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA */ + +#include + #include "xfs.h" #include "xfs_fs.h" #include "xfs_types.h" diff --git a/fs/xfs/xfs_vnodeops.c b/fs/xfs/xfs_vnodeops.c index e03fa2a3d5ed..e92cacde02f5 100644 --- a/fs/xfs/xfs_vnodeops.c +++ b/fs/xfs/xfs_vnodeops.c @@ -15,6 +15,9 @@ * along with this program; if not, write the Free Software Foundation, * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA */ + +#include + #include "xfs.h" #include "xfs_fs.h" #include "xfs_types.h" -- cgit v1.2.3