Re: [PATCH v23 09/22] richacl: Permission check algorithm

[Jeff Layton]

On Thu, 2016-06-30 at 15:47 +0200, Andreas Gruenbacher wrote:
> A richacl roughly grants a requested access if the NFSv4 acl in the
> richacl grants the requested permissions according to the NFSv4
> permission check algorithm and the file mask that applies to the process
> includes the requested permissions.
> 
> Signed-off-by: Andreas Gruenbacher <agruenba@xxxxxxxxxx>
> Reviewed-by: J. Bruce Fields <bfields@xxxxxxxxxxxx>
> ---
> Âfs/richacl.cÂÂÂÂÂÂÂÂÂÂÂÂ| 128 ++++++++++++++++++++++++++++++++++++++++++++++++
> Âinclude/linux/richacl.h |ÂÂÂ1 +
> Â2 files changed, 129 insertions(+)
> 
> diff --git a/fs/richacl.c b/fs/richacl.c
> index 056228f..cb0ef3f 100644
> --- a/fs/richacl.c
> +++ b/fs/richacl.c
> @@ -338,3 +338,131 @@ restart:
> Â	acl->a_flags &= ~(RICHACL_WRITE_THROUGH | RICHACL_MASKED);
> Â}
> ÂEXPORT_SYMBOL_GPL(richacl_compute_max_masks);
> +
> +/**
> + * richacl_permissionÂÂ-ÂÂrichacl permission check algorithm
> + * @inode:	inode to check
> + * @acl:	rich acl of the inode
> + * @want:	requested access (MAY_* flags)
> + *
> + * Checks if the current process is granted @mask flags in @acl.
> + */

nit: there is no @mask parm here. Do you mean @want ?

> +int
> +richacl_permission(struct inode *inode, const struct richacl *acl,
> +		ÂÂÂint want)
> +{
> +	const struct richace *ace;
> +	unsigned int mask = richacl_want_to_mask(want);
> +	unsigned int requested = mask, denied = 0;
> +	int in_owning_group = in_group_p(inode->i_gid);
> +	int in_owner_or_group_class = in_owning_group;
> +
> +	/*
> +	Â* A process is
> +	Â*ÂÂÂ- in the owner file class if it owns the file,
> +	Â*ÂÂÂ- in the group file class if it is in the file's owning group or
> +	Â*ÂÂÂÂÂit matches any of the user or group entries, and
> +	Â*ÂÂÂ- in the other file class otherwise.
> +	Â* The file class is only relevant for determining which file mask to
> +	Â* apply, which only happens for masked acls.
> +	Â*/
> +	if (acl->a_flags & RICHACL_MASKED) {
> +		if ((acl->a_flags & RICHACL_WRITE_THROUGH) &&
> +		ÂÂÂÂuid_eq(current_fsuid(), inode->i_uid)) {
> +			denied = requested & ~acl->a_owner_mask;
> +			goto out;
> +		}
> +	} else {
> +		/*
> +		Â* When the acl is not masked, there is no need to determine if
> +		Â* the process is in the group class and we can break out
> +		Â* earlier of the loop below.
> +		Â*/
> +		in_owner_or_group_class = 1;
> +	}
> +
> +	/*
> +	Â* Check if the acl grants the requested access and determine which
> +	Â* file class the process is in.
> +	Â*/
> +	richacl_for_each_entry(ace, acl) {
> +		unsigned int ace_mask = ace->e_mask;
> +
> +		if (richace_is_inherit_only(ace))
> +			continue;
> +		if (richace_is_owner(ace)) {
> +			if (!uid_eq(current_fsuid(), inode->i_uid))
> +				continue;
> +			goto entry_matches_owner;
> +		} else if (richace_is_group(ace)) {
> +			if (!in_owning_group)
> +				continue;
> +		} else if (richace_is_unix_user(ace)) {
> +			if (!uid_eq(current_fsuid(), ace->e_id.uid))
> +				continue;
> +			if (uid_eq(current_fsuid(), inode->i_uid))
> +				goto entry_matches_owner;
> +		} else if (richace_is_unix_group(ace)) {
> +			if (!in_group_p(ace->e_id.gid))
> +				continue;
> +		} else
> +			goto entry_matches_everyone;
> +
> +		/*
> +		Â* Apply the group file mask to entries other than owner@ and
> +		Â* everyone@ or user entries matching the owner.ÂÂThis ensures
> +		Â* that we grant the same permissions as the acl computed by
> +		Â* richacl_apply_masks().
> +		Â*
> +		Â* Without this restriction, the following richacl would grant
> +		Â* rw access to processes which are both the owner and in the
> +		Â* owning group, but not to other users in the owning group,
> +		Â* which could not be represented without masks:
> +		Â*
> +		Â*ÂÂowner:rw::mask
> +		Â*ÂÂgroup@:rw::allow
> +		Â*/
> +		if ((acl->a_flags & RICHACL_MASKED) && richace_is_allow(ace))
> +			ace_mask &= acl->a_group_mask;
> +
> +entry_matches_owner:
> +		/* The process is in the owner or group file class. */
> +		in_owner_or_group_class = 1;
> +
> +entry_matches_everyone:
> +		/* Check which mask flags the ACE allows or denies. */
> +		if (richace_is_deny(ace))
> +			denied |= ace_mask & mask;
> +		mask &= ~ace_mask;
> +
> +		/*
> +		Â* Keep going until we know which file class
> +		Â* the process is in.
> +		Â*/
> +		if (!mask && in_owner_or_group_class)
> +			break;
> +	}
> +	denied |= mask;
> +
> +	if (acl->a_flags & RICHACL_MASKED) {
> +		/*
> +		Â* The file class a process is in determines which file mask
> +		Â* applies.ÂÂCheck if that file mask also grants the requested
> +		Â* access.
> +		Â*/
> +		if (uid_eq(current_fsuid(), inode->i_uid))
> +			denied |= requested & ~acl->a_owner_mask;
> +		else if (in_owner_or_group_class)
> +			denied |= requested & ~acl->a_group_mask;
> +		else {
> +			if (acl->a_flags & RICHACL_WRITE_THROUGH)
> +				denied = requested & ~acl->a_other_mask;
> +			else
> +				denied |= requested & ~acl->a_other_mask;
> +		}
> +	}
> +
> +out:
> +	return denied ? -EACCES : 0;
> +}
> +EXPORT_SYMBOL_GPL(richacl_permission);
> diff --git a/include/linux/richacl.h b/include/linux/richacl.h
> index 3559b2c..be9fb65 100644
> --- a/include/linux/richacl.h
> +++ b/include/linux/richacl.h
> @@ -179,5 +179,6 @@ extern int richacl_masks_to_mode(const struct richacl *);
> Âextern unsigned int richacl_mode_to_mask(umode_t);
> Âextern unsigned int richacl_want_to_mask(unsigned int);
> Âextern void richacl_compute_max_masks(struct richacl *);
> +extern int richacl_permission(struct inode *, const struct richacl *, int);
> Â
> Â#endif /* __RICHACL_H */

Reviewed-by: Jeff Layton <jlayton@xxxxxxxxxx>