+++ /dev/null
-#include "include/types.h"
-#include <sys/stat.h>
-#include "posix_acl.h"
-#include "UserPerm.h"
-
-#ifndef ACCESSPERMS
-#define ACCESSPERMS (S_IRWXU|S_IRWXG|S_IRWXO)
-#endif
-
-int posix_acl_check(const void *xattr, size_t size)
-{
- const acl_ea_header *header;
- if (size < sizeof(*header))
- return -1;
- header = reinterpret_cast<const acl_ea_header*>(xattr);
- ceph_le32 expected_version;
- expected_version = ACL_EA_VERSION;
- if (header->a_version != expected_version)
- return -1;
-
- const acl_ea_entry *entry = header->a_entries;
- size -= sizeof(*header);
- if (size % sizeof(*entry))
- return -1;
-
- int count = size / sizeof(*entry);
- if (count == 0)
- return 0;
-
- int state = ACL_USER_OBJ;
- int needs_mask = 0;
- for (int i = 0; i < count; ++i) {
- __u16 tag = entry->e_tag;
- switch(tag) {
- case ACL_USER_OBJ:
- if (state == ACL_USER_OBJ) {
- state = ACL_USER;
- break;
- }
- return -1;
- case ACL_USER:
- if (state != ACL_USER)
- return -1;
- needs_mask = 1;
- break;
- case ACL_GROUP_OBJ:
- if (state == ACL_USER) {
- state = ACL_GROUP;
- break;
- }
- return -1;
- case ACL_GROUP:
- if (state != ACL_GROUP)
- return -1;
- needs_mask = 1;
- break;
- case ACL_MASK:
- if (state != ACL_GROUP)
- return -1;
- state = ACL_OTHER;
- break;
- case ACL_OTHER:
- if (state == ACL_OTHER ||
- (state == ACL_GROUP && !needs_mask)) {
- state = 0;
- break;
- }
- // fall-thru
- default:
- return -1;
- }
- ++entry;
- }
-
- return state == 0 ? count : -1;
-}
-
-int posix_acl_equiv_mode(const void *xattr, size_t size, mode_t *mode_p)
-{
- if (posix_acl_check(xattr, size) < 0)
- return -EINVAL;
-
- int not_equiv = 0;
- mode_t mode = 0;
-
- const acl_ea_header *header = reinterpret_cast<const acl_ea_header*>(xattr);
- const acl_ea_entry *entry = header->a_entries;
- int count = (size - sizeof(*header)) / sizeof(*entry);
- for (int i = 0; i < count; ++i) {
- __u16 tag = entry->e_tag;
- __u16 perm = entry->e_perm;
- switch(tag) {
- case ACL_USER_OBJ:
- mode |= (perm & S_IRWXO) << 6;
- break;
- case ACL_GROUP_OBJ:
- mode |= (perm & S_IRWXO) << 3;
- break;
- case ACL_OTHER:
- mode |= perm & S_IRWXO;
- break;
- case ACL_MASK:
- mode = (mode & ~S_IRWXG) | ((perm & S_IRWXO) << 3);
- /* fall through */
- case ACL_USER:
- case ACL_GROUP:
- not_equiv = 1;
- break;
- default:
- return -EINVAL;
- }
- ++entry;
- }
- if (mode_p)
- *mode_p = (*mode_p & ~ACCESSPERMS) | mode;
- return not_equiv;
-}
-
-int posix_acl_inherit_mode(bufferptr& acl, mode_t *mode_p)
-{
- if (posix_acl_check(acl.c_str(), acl.length()) <= 0)
- return -EIO;
-
- acl_ea_entry *group_entry = NULL, *mask_entry = NULL;
- mode_t mode = *mode_p;
- int not_equiv = 0;
-
- acl_ea_header *header = reinterpret_cast<acl_ea_header*>(acl.c_str());
- acl_ea_entry *entry = header->a_entries;
- int count = (acl.length() - sizeof(*header)) / sizeof(*entry);
- for (int i = 0; i < count; ++i) {
- __u16 tag = entry->e_tag;
- __u16 perm = entry->e_perm;
- switch(tag) {
- case ACL_USER_OBJ:
- perm &= (mode >> 6) | ~S_IRWXO;
- mode &= (perm << 6) | ~S_IRWXU;
- entry->e_perm = perm;
- break;
- case ACL_USER:
- case ACL_GROUP:
- not_equiv = 1;
- break;
- case ACL_GROUP_OBJ:
- group_entry = entry;
- break;
- case ACL_OTHER:
- perm &= mode | ~S_IRWXO;
- mode &= perm | ~S_IRWXO;
- entry->e_perm = perm;
- break;
- case ACL_MASK:
- mask_entry = entry;
- not_equiv = 1;
- break;
- default:
- return -EIO;
-
- }
- ++entry;
- }
-
- if (mask_entry) {
- __u16 perm = mask_entry->e_perm;
- perm &= (mode >> 3) | ~S_IRWXO;
- mode &= (perm << 3) | ~S_IRWXG;
- mask_entry->e_perm = perm;
- } else {
- if (!group_entry)
- return -EIO;
- __u16 perm = group_entry->e_perm;
- perm &= (mode >> 3) | ~S_IRWXO;
- mode &= (perm << 3) | ~S_IRWXG;
- group_entry->e_perm = perm;
- }
-
- *mode_p = (*mode_p & ~ACCESSPERMS) | mode;
- return not_equiv;
-}
-
-int posix_acl_access_chmod(bufferptr& acl, mode_t mode)
-{
- if (posix_acl_check(acl.c_str(), acl.length()) <= 0)
- return -EIO;
-
- acl_ea_entry *group_entry = NULL, *mask_entry = NULL;
-
- acl_ea_header *header = reinterpret_cast<acl_ea_header*>(acl.c_str());
- acl_ea_entry *entry = header->a_entries;
- int count = (acl.length() - sizeof(*header)) / sizeof(*entry);
- for (int i = 0; i < count; ++i) {
- __u16 tag = entry->e_tag;
- switch(tag) {
- case ACL_USER_OBJ:
- entry->e_perm = (mode & S_IRWXU) >> 6;
- break;
- case ACL_GROUP_OBJ:
- group_entry = entry;
- break;
- case ACL_MASK:
- mask_entry = entry;
- break;
- case ACL_OTHER:
- entry->e_perm = mode & S_IRWXO;
- break;
- default:
- break;
- }
- ++entry;
- }
-
- if (mask_entry) {
- mask_entry->e_perm = (mode & S_IRWXG) >> 3;
- } else {
- if (!group_entry)
- return -EIO;
- group_entry->e_perm = (mode & S_IRWXG) >> 3;
- }
- return 0;
-}
-
-int posix_acl_permits(const bufferptr& acl, uid_t i_uid, gid_t i_gid,
- const UserPerm& perms, unsigned want)
-{
- if (posix_acl_check(acl.c_str(), acl.length()) < 0)
- return -EIO;
-
- const acl_ea_header *header = reinterpret_cast<const acl_ea_header*>(acl.c_str());
- const acl_ea_entry *entry = header->a_entries;
- const acl_ea_entry *next_entry;
- __u16 perm, tag;
- __u32 id;
- int group_found = 0;
- int idx;
- int count = (acl.length() - sizeof(*header)) / sizeof(*entry);
- for (idx = 0; idx < count; ++idx) {
- tag = entry->e_tag;
- perm = entry->e_perm;
- switch(tag) {
- case ACL_USER_OBJ:
- if (i_uid == perms.uid())
- goto check_perm;
- break;
- case ACL_USER:
- id = entry->e_id;
- if (id == perms.uid())
- goto check_mask;
- break;
- case ACL_GROUP_OBJ:
- /* fall through */
- case ACL_GROUP:
- id = (tag == ACL_GROUP_OBJ) ? i_gid : entry->e_id;
- if (perms.gid_in_groups(id)) {
- group_found = 1;
- if ((perm & want) == want)
- goto check_mask;
- }
- break;
- case ACL_MASK:
- break;
- case ACL_OTHER:
- if (group_found)
- return -EACCES;
- else
- goto check_perm;
- break;
- default:
- return -EIO;
- }
- ++entry;
- }
- return -EIO;
-
-check_mask:
- next_entry = entry + 1;
- for (++idx; idx < count; ++idx) {
- tag = next_entry->e_tag;
- if (tag == ACL_MASK) {
- __u16 mask = next_entry->e_perm;
- if ((perm & mask & want) == want)
- return 0;
- return -EACCES;
- }
- ++next_entry;
- }
-check_perm:
- if ((perm & want) == want)
- return 0;
- return -EACCES;
-}
Code Review / stor4nfv.git / blobdiff