From: Robin Humble <plaguedbypengu...@gmail.com> The security.capability xattr is used to implement File Capabilities in recent Linux versions. Capabilities are a fine grained approach to granting executables elevated privileges. eg. /bin/ping can have capabilities cap_net_admin, cap_net_raw+ep instead of being setuid root.
This xattr has long been filtered out by llite, initially for stability reasons (b15587), and later over performance concerns as this xattr is read for every file with eg. 'ls --color'. Since LU-2869 xattr's are cached on clients, alleviating most performance concerns. Removing llite's filtering of the security.capability xattr enables using Lustre as a root filesystem, which is used on some large clusters. Signed-off-by: Robin Humble <plaguedbypengu...@gmail.com> Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-9562 Reviewed-on: https://review.whamcloud.com/27292 Reviewed-by: John L. Hammond <john.hamm...@intel.com> Reviewed-by: Sebastien Buisson <sbuis...@ddn.com> Reviewed-by: Oleg Drokin <oleg.dro...@intel.com> Signed-off-by: James Simmons <jsimm...@infradead.org> --- drivers/staging/lustre/lustre/llite/file.c | 58 ++++++++++++++++++++++ .../staging/lustre/lustre/llite/llite_internal.h | 4 ++ drivers/staging/lustre/lustre/llite/namei.c | 6 +++ 3 files changed, 68 insertions(+) diff --git a/drivers/staging/lustre/lustre/llite/file.c b/drivers/staging/lustre/lustre/llite/file.c index 215479a..a324580 100644 --- a/drivers/staging/lustre/lustre/llite/file.c +++ b/drivers/staging/lustre/lustre/llite/file.c @@ -3040,6 +3040,61 @@ struct posix_acl *ll_get_acl(struct inode *inode, int type) return acl; } +#ifdef CONFIG_FS_POSIX_ACL +int ll_set_acl(struct inode *inode, struct posix_acl *acl, int type) +{ + const char *name = NULL; + char *value = NULL; + size_t size = 0; + int rc = 0; + + switch (type) { + case ACL_TYPE_ACCESS: + if (acl) { + rc = posix_acl_update_mode(inode, &inode->i_mode, &acl); + if (rc) + goto out; + } + name = XATTR_NAME_POSIX_ACL_ACCESS; + break; + case ACL_TYPE_DEFAULT: + if (!S_ISDIR(inode->i_mode)) { + rc = acl ? -EACCES : 0; + goto out; + } + name = XATTR_NAME_POSIX_ACL_DEFAULT; + break; + default: + rc = -EINVAL; + goto out; + } + + if (acl) { + size = posix_acl_xattr_size(acl->a_count); + value = kmalloc(size, GFP_NOFS); + if (!value) { + rc = -ENOMEM; + goto out; + } + + rc = posix_acl_to_xattr(&init_user_ns, acl, value, size); + if (rc < 0) + goto out_free; + } + + /* dentry is only used for *.lov attributes so it's safe to be NULL */ + rc = __vfs_setxattr(NULL, inode, name, value, size, XATTR_CREATE); +out_free: + kfree(value); +out: + if (!rc) + set_cached_acl(inode, type, acl); + else + forget_cached_acl(inode, type); + return rc; +} +#endif /* CONFIG_FS_POSIX_ACL */ + int ll_inode_permission(struct inode *inode, int mask) { struct ll_sb_info *sbi; @@ -3162,6 +3217,9 @@ int ll_inode_permission(struct inode *inode, int mask) .listxattr = ll_listxattr, .fiemap = ll_fiemap, .get_acl = ll_get_acl, +#ifdef CONFIG_FS_POSIX_ACL + .set_acl = ll_set_acl, +#endif }; /* dynamic ioctl number support routines */ diff --git a/drivers/staging/lustre/lustre/llite/llite_internal.h b/drivers/staging/lustre/lustre/llite/llite_internal.h index cd3311a..b3374bc 100644 --- a/drivers/staging/lustre/lustre/llite/llite_internal.h +++ b/drivers/staging/lustre/lustre/llite/llite_internal.h @@ -752,6 +752,10 @@ enum ldlm_mode ll_take_md_lock(struct inode *inode, __u64 bits, int ll_getattr(const struct path *path, struct kstat *stat, u32 request_mask, unsigned int flags); struct posix_acl *ll_get_acl(struct inode *inode, int type); +#ifdef CONFIG_FS_POSIX_ACL +int ll_set_acl(struct inode *inode, struct posix_acl *acl, int type); +#endif /* CONFIG_FS_POSIX_ACL */ + int ll_migrate(struct inode *parent, struct file *file, int mdtidx, const char *name, int namelen); int ll_get_fid_by_name(struct inode *parent, const char *name, diff --git a/drivers/staging/lustre/lustre/llite/namei.c b/drivers/staging/lustre/lustre/llite/namei.c index a208a8b..14dccbe 100644 --- a/drivers/staging/lustre/lustre/llite/namei.c +++ b/drivers/staging/lustre/lustre/llite/namei.c @@ -1187,6 +1187,9 @@ static int ll_rename(struct inode *src, struct dentry *src_dchild, .permission = ll_inode_permission, .listxattr = ll_listxattr, .get_acl = ll_get_acl, +#ifdef CONFIG_FS_POSIX_ACL + .set_acl = ll_set_acl, +#endif }; const struct inode_operations ll_special_inode_operations = { @@ -1195,4 +1198,7 @@ static int ll_rename(struct inode *src, struct dentry *src_dchild, .permission = ll_inode_permission, .listxattr = ll_listxattr, .get_acl = ll_get_acl, +#ifdef CONFIG_FS_POSIX_ACL + .set_acl = ll_set_acl, +#endif }; -- 1.8.3.1 _______________________________________________ devel mailing list de...@linuxdriverproject.org http://driverdev.linuxdriverproject.org/mailman/listinfo/driverdev-devel
