2005-06-24 05:03:52 +00:00
|
|
|
/*
|
|
|
|
|
* Copyright (c) 2004 The Regents of the University of Michigan.
|
2012-03-21 13:52:07 +00:00
|
|
|
* Copyright (c) 2012 Jeff Layton <jlayton@redhat.com>
|
2005-06-24 05:03:52 +00:00
|
|
|
* All rights reserved.
|
|
|
|
|
*
|
|
|
|
|
* Andy Adamson <andros@citi.umich.edu>
|
|
|
|
|
*
|
|
|
|
|
* Redistribution and use in source and binary forms, with or without
|
|
|
|
|
* modification, are permitted provided that the following conditions
|
|
|
|
|
* are met:
|
|
|
|
|
*
|
|
|
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
|
|
|
* notice, this list of conditions and the following disclaimer.
|
|
|
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
|
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
|
|
|
* documentation and/or other materials provided with the distribution.
|
|
|
|
|
* 3. Neither the name of the University nor the names of its
|
|
|
|
|
* contributors may be used to endorse or promote products derived
|
|
|
|
|
* from this software without specific prior written permission.
|
|
|
|
|
*
|
|
|
|
|
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
|
|
|
|
|
* WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
|
|
|
|
|
* MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
|
|
|
|
|
* DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
|
|
|
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
|
|
|
|
|
* CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
|
|
|
|
|
* SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
|
|
|
|
|
* BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
|
|
|
|
|
* LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
|
|
|
|
|
* NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
|
|
|
|
|
* SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
|
|
|
*
|
|
|
|
|
*/
|
|
|
|
|
|
2005-06-24 05:04:25 +00:00
|
|
|
#include <linux/file.h>
|
include cleanup: Update gfp.h and slab.h includes to prepare for breaking implicit slab.h inclusion from percpu.h
percpu.h is included by sched.h and module.h and thus ends up being
included when building most .c files. percpu.h includes slab.h which
in turn includes gfp.h making everything defined by the two files
universally available and complicating inclusion dependencies.
percpu.h -> slab.h dependency is about to be removed. Prepare for
this change by updating users of gfp and slab facilities include those
headers directly instead of assuming availability. As this conversion
needs to touch large number of source files, the following script is
used as the basis of conversion.
http://userweb.kernel.org/~tj/misc/slabh-sweep.py
The script does the followings.
* Scan files for gfp and slab usages and update includes such that
only the necessary includes are there. ie. if only gfp is used,
gfp.h, if slab is used, slab.h.
* When the script inserts a new include, it looks at the include
blocks and try to put the new include such that its order conforms
to its surrounding. It's put in the include block which contains
core kernel includes, in the same order that the rest are ordered -
alphabetical, Christmas tree, rev-Xmas-tree or at the end if there
doesn't seem to be any matching order.
* If the script can't find a place to put a new include (mostly
because the file doesn't have fitting include block), it prints out
an error message indicating which .h file needs to be added to the
file.
The conversion was done in the following steps.
1. The initial automatic conversion of all .c files updated slightly
over 4000 files, deleting around 700 includes and adding ~480 gfp.h
and ~3000 slab.h inclusions. The script emitted errors for ~400
files.
2. Each error was manually checked. Some didn't need the inclusion,
some needed manual addition while adding it to implementation .h or
embedding .c file was more appropriate for others. This step added
inclusions to around 150 files.
3. The script was run again and the output was compared to the edits
from #2 to make sure no file was left behind.
4. Several build tests were done and a couple of problems were fixed.
e.g. lib/decompress_*.c used malloc/free() wrappers around slab
APIs requiring slab.h to be added manually.
5. The script was run on all .h files but without automatically
editing them as sprinkling gfp.h and slab.h inclusions around .h
files could easily lead to inclusion dependency hell. Most gfp.h
inclusion directives were ignored as stuff from gfp.h was usually
wildly available and often used in preprocessor macros. Each
slab.h inclusion directive was examined and added manually as
necessary.
6. percpu.h was updated not to include slab.h.
7. Build test were done on the following configurations and failures
were fixed. CONFIG_GCOV_KERNEL was turned off for all tests (as my
distributed build env didn't work with gcov compiles) and a few
more options had to be turned off depending on archs to make things
build (like ipr on powerpc/64 which failed due to missing writeq).
* x86 and x86_64 UP and SMP allmodconfig and a custom test config.
* powerpc and powerpc64 SMP allmodconfig
* sparc and sparc64 SMP allmodconfig
* ia64 SMP allmodconfig
* s390 SMP allmodconfig
* alpha SMP allmodconfig
* um on x86_64 SMP allmodconfig
8. percpu.h modifications were reverted so that it could be applied as
a separate patch and serve as bisection point.
Given the fact that I had only a couple of failures from tests on step
6, I'm fairly confident about the coverage of this conversion patch.
If there is a breakage, it's likely to be something in one of the arch
headers which should be easily discoverable easily on most builds of
the specific arch.
Signed-off-by: Tejun Heo <tj@kernel.org>
Guess-its-ok-by: Christoph Lameter <cl@linux-foundation.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Lee Schermerhorn <Lee.Schermerhorn@hp.com>
2010-03-24 08:04:11 +00:00
|
|
|
#include <linux/slab.h>
|
2005-06-24 05:04:25 +00:00
|
|
|
#include <linux/namei.h>
|
2005-06-24 05:03:52 +00:00
|
|
|
#include <linux/crypto.h>
|
Detach sched.h from mm.h
First thing mm.h does is including sched.h solely for can_do_mlock() inline
function which has "current" dereference inside. By dealing with can_do_mlock()
mm.h can be detached from sched.h which is good. See below, why.
This patch
a) removes unconditional inclusion of sched.h from mm.h
b) makes can_do_mlock() normal function in mm/mlock.c
c) exports can_do_mlock() to not break compilation
d) adds sched.h inclusions back to files that were getting it indirectly.
e) adds less bloated headers to some files (asm/signal.h, jiffies.h) that were
getting them indirectly
Net result is:
a) mm.h users would get less code to open, read, preprocess, parse, ... if
they don't need sched.h
b) sched.h stops being dependency for significant number of files:
on x86_64 allmodconfig touching sched.h results in recompile of 4083 files,
after patch it's only 3744 (-8.3%).
Cross-compile tested on
all arm defconfigs, all mips defconfigs, all powerpc defconfigs,
alpha alpha-up
arm
i386 i386-up i386-defconfig i386-allnoconfig
ia64 ia64-up
m68k
mips
parisc parisc-up
powerpc powerpc-up
s390 s390-up
sparc sparc-up
sparc64 sparc64-up
um-x86_64
x86_64 x86_64-up x86_64-defconfig x86_64-allnoconfig
as well as my two usual configs.
Signed-off-by: Alexey Dobriyan <adobriyan@gmail.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
2007-05-20 21:22:52 +00:00
|
|
|
#include <linux/sched.h>
|
2012-03-21 13:52:07 +00:00
|
|
|
#include <linux/fs.h>
|
2012-03-21 13:52:08 +00:00
|
|
|
#include <linux/module.h>
|
2012-03-21 13:52:07 +00:00
|
|
|
#include <net/net_namespace.h>
|
|
|
|
|
#include <linux/sunrpc/rpc_pipe_fs.h>
|
|
|
|
|
#include <linux/sunrpc/clnt.h>
|
|
|
|
|
#include <linux/nfsd/cld.h>
|
2009-12-03 18:30:56 +00:00
|
|
|
|
|
|
|
|
#include "nfsd.h"
|
|
|
|
|
#include "state.h"
|
2009-11-04 23:12:35 +00:00
|
|
|
#include "vfs.h"
|
2012-03-21 13:52:07 +00:00
|
|
|
#include "netns.h"
|
2005-06-24 05:03:52 +00:00
|
|
|
|
|
|
|
|
#define NFSDDBG_FACILITY NFSDDBG_PROC
|
|
|
|
|
|
2012-03-21 20:42:43 +00:00
|
|
|
/* Declarations */
|
|
|
|
|
struct nfsd4_client_tracking_ops {
|
|
|
|
|
int (*init)(struct net *);
|
|
|
|
|
void (*exit)(struct net *);
|
|
|
|
|
void (*create)(struct nfs4_client *);
|
|
|
|
|
void (*remove)(struct nfs4_client *);
|
|
|
|
|
int (*check)(struct nfs4_client *);
|
2014-09-12 20:40:20 +00:00
|
|
|
void (*grace_done)(struct nfsd_net *);
|
2012-03-21 20:42:43 +00:00
|
|
|
};
|
|
|
|
|
|
2005-06-24 05:04:25 +00:00
|
|
|
/* Globals */
|
2011-08-27 00:40:28 +00:00
|
|
|
static char user_recovery_dirname[PATH_MAX] = "/var/lib/nfs/v4recovery";
|
2005-06-24 05:04:25 +00:00
|
|
|
|
CRED: Inaugurate COW credentials
Inaugurate copy-on-write credentials management. This uses RCU to manage the
credentials pointer in the task_struct with respect to accesses by other tasks.
A process may only modify its own credentials, and so does not need locking to
access or modify its own credentials.
A mutex (cred_replace_mutex) is added to the task_struct to control the effect
of PTRACE_ATTACHED on credential calculations, particularly with respect to
execve().
With this patch, the contents of an active credentials struct may not be
changed directly; rather a new set of credentials must be prepared, modified
and committed using something like the following sequence of events:
struct cred *new = prepare_creds();
int ret = blah(new);
if (ret < 0) {
abort_creds(new);
return ret;
}
return commit_creds(new);
There are some exceptions to this rule: the keyrings pointed to by the active
credentials may be instantiated - keyrings violate the COW rule as managing
COW keyrings is tricky, given that it is possible for a task to directly alter
the keys in a keyring in use by another task.
To help enforce this, various pointers to sets of credentials, such as those in
the task_struct, are declared const. The purpose of this is compile-time
discouragement of altering credentials through those pointers. Once a set of
credentials has been made public through one of these pointers, it may not be
modified, except under special circumstances:
(1) Its reference count may incremented and decremented.
(2) The keyrings to which it points may be modified, but not replaced.
The only safe way to modify anything else is to create a replacement and commit
using the functions described in Documentation/credentials.txt (which will be
added by a later patch).
This patch and the preceding patches have been tested with the LTP SELinux
testsuite.
This patch makes several logical sets of alteration:
(1) execve().
This now prepares and commits credentials in various places in the
security code rather than altering the current creds directly.
(2) Temporary credential overrides.
do_coredump() and sys_faccessat() now prepare their own credentials and
temporarily override the ones currently on the acting thread, whilst
preventing interference from other threads by holding cred_replace_mutex
on the thread being dumped.
This will be replaced in a future patch by something that hands down the
credentials directly to the functions being called, rather than altering
the task's objective credentials.
(3) LSM interface.
A number of functions have been changed, added or removed:
(*) security_capset_check(), ->capset_check()
(*) security_capset_set(), ->capset_set()
Removed in favour of security_capset().
(*) security_capset(), ->capset()
New. This is passed a pointer to the new creds, a pointer to the old
creds and the proposed capability sets. It should fill in the new
creds or return an error. All pointers, barring the pointer to the
new creds, are now const.
(*) security_bprm_apply_creds(), ->bprm_apply_creds()
Changed; now returns a value, which will cause the process to be
killed if it's an error.
(*) security_task_alloc(), ->task_alloc_security()
Removed in favour of security_prepare_creds().
(*) security_cred_free(), ->cred_free()
New. Free security data attached to cred->security.
(*) security_prepare_creds(), ->cred_prepare()
New. Duplicate any security data attached to cred->security.
(*) security_commit_creds(), ->cred_commit()
New. Apply any security effects for the upcoming installation of new
security by commit_creds().
(*) security_task_post_setuid(), ->task_post_setuid()
Removed in favour of security_task_fix_setuid().
(*) security_task_fix_setuid(), ->task_fix_setuid()
Fix up the proposed new credentials for setuid(). This is used by
cap_set_fix_setuid() to implicitly adjust capabilities in line with
setuid() changes. Changes are made to the new credentials, rather
than the task itself as in security_task_post_setuid().
(*) security_task_reparent_to_init(), ->task_reparent_to_init()
Removed. Instead the task being reparented to init is referred
directly to init's credentials.
NOTE! This results in the loss of some state: SELinux's osid no
longer records the sid of the thread that forked it.
(*) security_key_alloc(), ->key_alloc()
(*) security_key_permission(), ->key_permission()
Changed. These now take cred pointers rather than task pointers to
refer to the security context.
(4) sys_capset().
This has been simplified and uses less locking. The LSM functions it
calls have been merged.
(5) reparent_to_kthreadd().
This gives the current thread the same credentials as init by simply using
commit_thread() to point that way.
(6) __sigqueue_alloc() and switch_uid()
__sigqueue_alloc() can't stop the target task from changing its creds
beneath it, so this function gets a reference to the currently applicable
user_struct which it then passes into the sigqueue struct it returns if
successful.
switch_uid() is now called from commit_creds(), and possibly should be
folded into that. commit_creds() should take care of protecting
__sigqueue_alloc().
(7) [sg]et[ug]id() and co and [sg]et_current_groups.
The set functions now all use prepare_creds(), commit_creds() and
abort_creds() to build and check a new set of credentials before applying
it.
security_task_set[ug]id() is called inside the prepared section. This
guarantees that nothing else will affect the creds until we've finished.
The calling of set_dumpable() has been moved into commit_creds().
Much of the functionality of set_user() has been moved into
commit_creds().
The get functions all simply access the data directly.
(8) security_task_prctl() and cap_task_prctl().
security_task_prctl() has been modified to return -ENOSYS if it doesn't
want to handle a function, or otherwise return the return value directly
rather than through an argument.
Additionally, cap_task_prctl() now prepares a new set of credentials, even
if it doesn't end up using it.
(9) Keyrings.
A number of changes have been made to the keyrings code:
(a) switch_uid_keyring(), copy_keys(), exit_keys() and suid_keys() have
all been dropped and built in to the credentials functions directly.
They may want separating out again later.
(b) key_alloc() and search_process_keyrings() now take a cred pointer
rather than a task pointer to specify the security context.
(c) copy_creds() gives a new thread within the same thread group a new
thread keyring if its parent had one, otherwise it discards the thread
keyring.
(d) The authorisation key now points directly to the credentials to extend
the search into rather pointing to the task that carries them.
(e) Installing thread, process or session keyrings causes a new set of
credentials to be created, even though it's not strictly necessary for
process or session keyrings (they're shared).
(10) Usermode helper.
The usermode helper code now carries a cred struct pointer in its
subprocess_info struct instead of a new session keyring pointer. This set
of credentials is derived from init_cred and installed on the new process
after it has been cloned.
call_usermodehelper_setup() allocates the new credentials and
call_usermodehelper_freeinfo() discards them if they haven't been used. A
special cred function (prepare_usermodeinfo_creds()) is provided
specifically for call_usermodehelper_setup() to call.
call_usermodehelper_setkeys() adjusts the credentials to sport the
supplied keyring as the new session keyring.
(11) SELinux.
SELinux has a number of changes, in addition to those to support the LSM
interface changes mentioned above:
(a) selinux_setprocattr() no longer does its check for whether the
current ptracer can access processes with the new SID inside the lock
that covers getting the ptracer's SID. Whilst this lock ensures that
the check is done with the ptracer pinned, the result is only valid
until the lock is released, so there's no point doing it inside the
lock.
(12) is_single_threaded().
This function has been extracted from selinux_setprocattr() and put into
a file of its own in the lib/ directory as join_session_keyring() now
wants to use it too.
The code in SELinux just checked to see whether a task shared mm_structs
with other tasks (CLONE_VM), but that isn't good enough. We really want
to know if they're part of the same thread group (CLONE_THREAD).
(13) nfsd.
The NFS server daemon now has to use the COW credentials to set the
credentials it is going to use. It really needs to pass the credentials
down to the functions it calls, but it can't do that until other patches
in this series have been applied.
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: James Morris <jmorris@namei.org>
2008-11-13 23:39:23 +00:00
|
|
|
static int
|
|
|
|
|
nfs4_save_creds(const struct cred **original_creds)
|
2005-06-24 05:04:25 +00:00
|
|
|
{
|
CRED: Inaugurate COW credentials
Inaugurate copy-on-write credentials management. This uses RCU to manage the
credentials pointer in the task_struct with respect to accesses by other tasks.
A process may only modify its own credentials, and so does not need locking to
access or modify its own credentials.
A mutex (cred_replace_mutex) is added to the task_struct to control the effect
of PTRACE_ATTACHED on credential calculations, particularly with respect to
execve().
With this patch, the contents of an active credentials struct may not be
changed directly; rather a new set of credentials must be prepared, modified
and committed using something like the following sequence of events:
struct cred *new = prepare_creds();
int ret = blah(new);
if (ret < 0) {
abort_creds(new);
return ret;
}
return commit_creds(new);
There are some exceptions to this rule: the keyrings pointed to by the active
credentials may be instantiated - keyrings violate the COW rule as managing
COW keyrings is tricky, given that it is possible for a task to directly alter
the keys in a keyring in use by another task.
To help enforce this, various pointers to sets of credentials, such as those in
the task_struct, are declared const. The purpose of this is compile-time
discouragement of altering credentials through those pointers. Once a set of
credentials has been made public through one of these pointers, it may not be
modified, except under special circumstances:
(1) Its reference count may incremented and decremented.
(2) The keyrings to which it points may be modified, but not replaced.
The only safe way to modify anything else is to create a replacement and commit
using the functions described in Documentation/credentials.txt (which will be
added by a later patch).
This patch and the preceding patches have been tested with the LTP SELinux
testsuite.
This patch makes several logical sets of alteration:
(1) execve().
This now prepares and commits credentials in various places in the
security code rather than altering the current creds directly.
(2) Temporary credential overrides.
do_coredump() and sys_faccessat() now prepare their own credentials and
temporarily override the ones currently on the acting thread, whilst
preventing interference from other threads by holding cred_replace_mutex
on the thread being dumped.
This will be replaced in a future patch by something that hands down the
credentials directly to the functions being called, rather than altering
the task's objective credentials.
(3) LSM interface.
A number of functions have been changed, added or removed:
(*) security_capset_check(), ->capset_check()
(*) security_capset_set(), ->capset_set()
Removed in favour of security_capset().
(*) security_capset(), ->capset()
New. This is passed a pointer to the new creds, a pointer to the old
creds and the proposed capability sets. It should fill in the new
creds or return an error. All pointers, barring the pointer to the
new creds, are now const.
(*) security_bprm_apply_creds(), ->bprm_apply_creds()
Changed; now returns a value, which will cause the process to be
killed if it's an error.
(*) security_task_alloc(), ->task_alloc_security()
Removed in favour of security_prepare_creds().
(*) security_cred_free(), ->cred_free()
New. Free security data attached to cred->security.
(*) security_prepare_creds(), ->cred_prepare()
New. Duplicate any security data attached to cred->security.
(*) security_commit_creds(), ->cred_commit()
New. Apply any security effects for the upcoming installation of new
security by commit_creds().
(*) security_task_post_setuid(), ->task_post_setuid()
Removed in favour of security_task_fix_setuid().
(*) security_task_fix_setuid(), ->task_fix_setuid()
Fix up the proposed new credentials for setuid(). This is used by
cap_set_fix_setuid() to implicitly adjust capabilities in line with
setuid() changes. Changes are made to the new credentials, rather
than the task itself as in security_task_post_setuid().
(*) security_task_reparent_to_init(), ->task_reparent_to_init()
Removed. Instead the task being reparented to init is referred
directly to init's credentials.
NOTE! This results in the loss of some state: SELinux's osid no
longer records the sid of the thread that forked it.
(*) security_key_alloc(), ->key_alloc()
(*) security_key_permission(), ->key_permission()
Changed. These now take cred pointers rather than task pointers to
refer to the security context.
(4) sys_capset().
This has been simplified and uses less locking. The LSM functions it
calls have been merged.
(5) reparent_to_kthreadd().
This gives the current thread the same credentials as init by simply using
commit_thread() to point that way.
(6) __sigqueue_alloc() and switch_uid()
__sigqueue_alloc() can't stop the target task from changing its creds
beneath it, so this function gets a reference to the currently applicable
user_struct which it then passes into the sigqueue struct it returns if
successful.
switch_uid() is now called from commit_creds(), and possibly should be
folded into that. commit_creds() should take care of protecting
__sigqueue_alloc().
(7) [sg]et[ug]id() and co and [sg]et_current_groups.
The set functions now all use prepare_creds(), commit_creds() and
abort_creds() to build and check a new set of credentials before applying
it.
security_task_set[ug]id() is called inside the prepared section. This
guarantees that nothing else will affect the creds until we've finished.
The calling of set_dumpable() has been moved into commit_creds().
Much of the functionality of set_user() has been moved into
commit_creds().
The get functions all simply access the data directly.
(8) security_task_prctl() and cap_task_prctl().
security_task_prctl() has been modified to return -ENOSYS if it doesn't
want to handle a function, or otherwise return the return value directly
rather than through an argument.
Additionally, cap_task_prctl() now prepares a new set of credentials, even
if it doesn't end up using it.
(9) Keyrings.
A number of changes have been made to the keyrings code:
(a) switch_uid_keyring(), copy_keys(), exit_keys() and suid_keys() have
all been dropped and built in to the credentials functions directly.
They may want separating out again later.
(b) key_alloc() and search_process_keyrings() now take a cred pointer
rather than a task pointer to specify the security context.
(c) copy_creds() gives a new thread within the same thread group a new
thread keyring if its parent had one, otherwise it discards the thread
keyring.
(d) The authorisation key now points directly to the credentials to extend
the search into rather pointing to the task that carries them.
(e) Installing thread, process or session keyrings causes a new set of
credentials to be created, even though it's not strictly necessary for
process or session keyrings (they're shared).
(10) Usermode helper.
The usermode helper code now carries a cred struct pointer in its
subprocess_info struct instead of a new session keyring pointer. This set
of credentials is derived from init_cred and installed on the new process
after it has been cloned.
call_usermodehelper_setup() allocates the new credentials and
call_usermodehelper_freeinfo() discards them if they haven't been used. A
special cred function (prepare_usermodeinfo_creds()) is provided
specifically for call_usermodehelper_setup() to call.
call_usermodehelper_setkeys() adjusts the credentials to sport the
supplied keyring as the new session keyring.
(11) SELinux.
SELinux has a number of changes, in addition to those to support the LSM
interface changes mentioned above:
(a) selinux_setprocattr() no longer does its check for whether the
current ptracer can access processes with the new SID inside the lock
that covers getting the ptracer's SID. Whilst this lock ensures that
the check is done with the ptracer pinned, the result is only valid
until the lock is released, so there's no point doing it inside the
lock.
(12) is_single_threaded().
This function has been extracted from selinux_setprocattr() and put into
a file of its own in the lib/ directory as join_session_keyring() now
wants to use it too.
The code in SELinux just checked to see whether a task shared mm_structs
with other tasks (CLONE_VM), but that isn't good enough. We really want
to know if they're part of the same thread group (CLONE_THREAD).
(13) nfsd.
The NFS server daemon now has to use the COW credentials to set the
credentials it is going to use. It really needs to pass the credentials
down to the functions it calls, but it can't do that until other patches
in this series have been applied.
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: James Morris <jmorris@namei.org>
2008-11-13 23:39:23 +00:00
|
|
|
struct cred *new;
|
|
|
|
|
|
|
|
|
|
new = prepare_creds();
|
|
|
|
|
if (!new)
|
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
2013-02-02 14:53:11 +00:00
|
|
|
new->fsuid = GLOBAL_ROOT_UID;
|
|
|
|
|
new->fsgid = GLOBAL_ROOT_GID;
|
CRED: Inaugurate COW credentials
Inaugurate copy-on-write credentials management. This uses RCU to manage the
credentials pointer in the task_struct with respect to accesses by other tasks.
A process may only modify its own credentials, and so does not need locking to
access or modify its own credentials.
A mutex (cred_replace_mutex) is added to the task_struct to control the effect
of PTRACE_ATTACHED on credential calculations, particularly with respect to
execve().
With this patch, the contents of an active credentials struct may not be
changed directly; rather a new set of credentials must be prepared, modified
and committed using something like the following sequence of events:
struct cred *new = prepare_creds();
int ret = blah(new);
if (ret < 0) {
abort_creds(new);
return ret;
}
return commit_creds(new);
There are some exceptions to this rule: the keyrings pointed to by the active
credentials may be instantiated - keyrings violate the COW rule as managing
COW keyrings is tricky, given that it is possible for a task to directly alter
the keys in a keyring in use by another task.
To help enforce this, various pointers to sets of credentials, such as those in
the task_struct, are declared const. The purpose of this is compile-time
discouragement of altering credentials through those pointers. Once a set of
credentials has been made public through one of these pointers, it may not be
modified, except under special circumstances:
(1) Its reference count may incremented and decremented.
(2) The keyrings to which it points may be modified, but not replaced.
The only safe way to modify anything else is to create a replacement and commit
using the functions described in Documentation/credentials.txt (which will be
added by a later patch).
This patch and the preceding patches have been tested with the LTP SELinux
testsuite.
This patch makes several logical sets of alteration:
(1) execve().
This now prepares and commits credentials in various places in the
security code rather than altering the current creds directly.
(2) Temporary credential overrides.
do_coredump() and sys_faccessat() now prepare their own credentials and
temporarily override the ones currently on the acting thread, whilst
preventing interference from other threads by holding cred_replace_mutex
on the thread being dumped.
This will be replaced in a future patch by something that hands down the
credentials directly to the functions being called, rather than altering
the task's objective credentials.
(3) LSM interface.
A number of functions have been changed, added or removed:
(*) security_capset_check(), ->capset_check()
(*) security_capset_set(), ->capset_set()
Removed in favour of security_capset().
(*) security_capset(), ->capset()
New. This is passed a pointer to the new creds, a pointer to the old
creds and the proposed capability sets. It should fill in the new
creds or return an error. All pointers, barring the pointer to the
new creds, are now const.
(*) security_bprm_apply_creds(), ->bprm_apply_creds()
Changed; now returns a value, which will cause the process to be
killed if it's an error.
(*) security_task_alloc(), ->task_alloc_security()
Removed in favour of security_prepare_creds().
(*) security_cred_free(), ->cred_free()
New. Free security data attached to cred->security.
(*) security_prepare_creds(), ->cred_prepare()
New. Duplicate any security data attached to cred->security.
(*) security_commit_creds(), ->cred_commit()
New. Apply any security effects for the upcoming installation of new
security by commit_creds().
(*) security_task_post_setuid(), ->task_post_setuid()
Removed in favour of security_task_fix_setuid().
(*) security_task_fix_setuid(), ->task_fix_setuid()
Fix up the proposed new credentials for setuid(). This is used by
cap_set_fix_setuid() to implicitly adjust capabilities in line with
setuid() changes. Changes are made to the new credentials, rather
than the task itself as in security_task_post_setuid().
(*) security_task_reparent_to_init(), ->task_reparent_to_init()
Removed. Instead the task being reparented to init is referred
directly to init's credentials.
NOTE! This results in the loss of some state: SELinux's osid no
longer records the sid of the thread that forked it.
(*) security_key_alloc(), ->key_alloc()
(*) security_key_permission(), ->key_permission()
Changed. These now take cred pointers rather than task pointers to
refer to the security context.
(4) sys_capset().
This has been simplified and uses less locking. The LSM functions it
calls have been merged.
(5) reparent_to_kthreadd().
This gives the current thread the same credentials as init by simply using
commit_thread() to point that way.
(6) __sigqueue_alloc() and switch_uid()
__sigqueue_alloc() can't stop the target task from changing its creds
beneath it, so this function gets a reference to the currently applicable
user_struct which it then passes into the sigqueue struct it returns if
successful.
switch_uid() is now called from commit_creds(), and possibly should be
folded into that. commit_creds() should take care of protecting
__sigqueue_alloc().
(7) [sg]et[ug]id() and co and [sg]et_current_groups.
The set functions now all use prepare_creds(), commit_creds() and
abort_creds() to build and check a new set of credentials before applying
it.
security_task_set[ug]id() is called inside the prepared section. This
guarantees that nothing else will affect the creds until we've finished.
The calling of set_dumpable() has been moved into commit_creds().
Much of the functionality of set_user() has been moved into
commit_creds().
The get functions all simply access the data directly.
(8) security_task_prctl() and cap_task_prctl().
security_task_prctl() has been modified to return -ENOSYS if it doesn't
want to handle a function, or otherwise return the return value directly
rather than through an argument.
Additionally, cap_task_prctl() now prepares a new set of credentials, even
if it doesn't end up using it.
(9) Keyrings.
A number of changes have been made to the keyrings code:
(a) switch_uid_keyring(), copy_keys(), exit_keys() and suid_keys() have
all been dropped and built in to the credentials functions directly.
They may want separating out again later.
(b) key_alloc() and search_process_keyrings() now take a cred pointer
rather than a task pointer to specify the security context.
(c) copy_creds() gives a new thread within the same thread group a new
thread keyring if its parent had one, otherwise it discards the thread
keyring.
(d) The authorisation key now points directly to the credentials to extend
the search into rather pointing to the task that carries them.
(e) Installing thread, process or session keyrings causes a new set of
credentials to be created, even though it's not strictly necessary for
process or session keyrings (they're shared).
(10) Usermode helper.
The usermode helper code now carries a cred struct pointer in its
subprocess_info struct instead of a new session keyring pointer. This set
of credentials is derived from init_cred and installed on the new process
after it has been cloned.
call_usermodehelper_setup() allocates the new credentials and
call_usermodehelper_freeinfo() discards them if they haven't been used. A
special cred function (prepare_usermodeinfo_creds()) is provided
specifically for call_usermodehelper_setup() to call.
call_usermodehelper_setkeys() adjusts the credentials to sport the
supplied keyring as the new session keyring.
(11) SELinux.
SELinux has a number of changes, in addition to those to support the LSM
interface changes mentioned above:
(a) selinux_setprocattr() no longer does its check for whether the
current ptracer can access processes with the new SID inside the lock
that covers getting the ptracer's SID. Whilst this lock ensures that
the check is done with the ptracer pinned, the result is only valid
until the lock is released, so there's no point doing it inside the
lock.
(12) is_single_threaded().
This function has been extracted from selinux_setprocattr() and put into
a file of its own in the lib/ directory as join_session_keyring() now
wants to use it too.
The code in SELinux just checked to see whether a task shared mm_structs
with other tasks (CLONE_VM), but that isn't good enough. We really want
to know if they're part of the same thread group (CLONE_THREAD).
(13) nfsd.
The NFS server daemon now has to use the COW credentials to set the
credentials it is going to use. It really needs to pass the credentials
down to the functions it calls, but it can't do that until other patches
in this series have been applied.
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: James Morris <jmorris@namei.org>
2008-11-13 23:39:23 +00:00
|
|
|
*original_creds = override_creds(new);
|
|
|
|
|
put_cred(new);
|
|
|
|
|
return 0;
|
2005-06-24 05:04:25 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void
|
CRED: Inaugurate COW credentials
Inaugurate copy-on-write credentials management. This uses RCU to manage the
credentials pointer in the task_struct with respect to accesses by other tasks.
A process may only modify its own credentials, and so does not need locking to
access or modify its own credentials.
A mutex (cred_replace_mutex) is added to the task_struct to control the effect
of PTRACE_ATTACHED on credential calculations, particularly with respect to
execve().
With this patch, the contents of an active credentials struct may not be
changed directly; rather a new set of credentials must be prepared, modified
and committed using something like the following sequence of events:
struct cred *new = prepare_creds();
int ret = blah(new);
if (ret < 0) {
abort_creds(new);
return ret;
}
return commit_creds(new);
There are some exceptions to this rule: the keyrings pointed to by the active
credentials may be instantiated - keyrings violate the COW rule as managing
COW keyrings is tricky, given that it is possible for a task to directly alter
the keys in a keyring in use by another task.
To help enforce this, various pointers to sets of credentials, such as those in
the task_struct, are declared const. The purpose of this is compile-time
discouragement of altering credentials through those pointers. Once a set of
credentials has been made public through one of these pointers, it may not be
modified, except under special circumstances:
(1) Its reference count may incremented and decremented.
(2) The keyrings to which it points may be modified, but not replaced.
The only safe way to modify anything else is to create a replacement and commit
using the functions described in Documentation/credentials.txt (which will be
added by a later patch).
This patch and the preceding patches have been tested with the LTP SELinux
testsuite.
This patch makes several logical sets of alteration:
(1) execve().
This now prepares and commits credentials in various places in the
security code rather than altering the current creds directly.
(2) Temporary credential overrides.
do_coredump() and sys_faccessat() now prepare their own credentials and
temporarily override the ones currently on the acting thread, whilst
preventing interference from other threads by holding cred_replace_mutex
on the thread being dumped.
This will be replaced in a future patch by something that hands down the
credentials directly to the functions being called, rather than altering
the task's objective credentials.
(3) LSM interface.
A number of functions have been changed, added or removed:
(*) security_capset_check(), ->capset_check()
(*) security_capset_set(), ->capset_set()
Removed in favour of security_capset().
(*) security_capset(), ->capset()
New. This is passed a pointer to the new creds, a pointer to the old
creds and the proposed capability sets. It should fill in the new
creds or return an error. All pointers, barring the pointer to the
new creds, are now const.
(*) security_bprm_apply_creds(), ->bprm_apply_creds()
Changed; now returns a value, which will cause the process to be
killed if it's an error.
(*) security_task_alloc(), ->task_alloc_security()
Removed in favour of security_prepare_creds().
(*) security_cred_free(), ->cred_free()
New. Free security data attached to cred->security.
(*) security_prepare_creds(), ->cred_prepare()
New. Duplicate any security data attached to cred->security.
(*) security_commit_creds(), ->cred_commit()
New. Apply any security effects for the upcoming installation of new
security by commit_creds().
(*) security_task_post_setuid(), ->task_post_setuid()
Removed in favour of security_task_fix_setuid().
(*) security_task_fix_setuid(), ->task_fix_setuid()
Fix up the proposed new credentials for setuid(). This is used by
cap_set_fix_setuid() to implicitly adjust capabilities in line with
setuid() changes. Changes are made to the new credentials, rather
than the task itself as in security_task_post_setuid().
(*) security_task_reparent_to_init(), ->task_reparent_to_init()
Removed. Instead the task being reparented to init is referred
directly to init's credentials.
NOTE! This results in the loss of some state: SELinux's osid no
longer records the sid of the thread that forked it.
(*) security_key_alloc(), ->key_alloc()
(*) security_key_permission(), ->key_permission()
Changed. These now take cred pointers rather than task pointers to
refer to the security context.
(4) sys_capset().
This has been simplified and uses less locking. The LSM functions it
calls have been merged.
(5) reparent_to_kthreadd().
This gives the current thread the same credentials as init by simply using
commit_thread() to point that way.
(6) __sigqueue_alloc() and switch_uid()
__sigqueue_alloc() can't stop the target task from changing its creds
beneath it, so this function gets a reference to the currently applicable
user_struct which it then passes into the sigqueue struct it returns if
successful.
switch_uid() is now called from commit_creds(), and possibly should be
folded into that. commit_creds() should take care of protecting
__sigqueue_alloc().
(7) [sg]et[ug]id() and co and [sg]et_current_groups.
The set functions now all use prepare_creds(), commit_creds() and
abort_creds() to build and check a new set of credentials before applying
it.
security_task_set[ug]id() is called inside the prepared section. This
guarantees that nothing else will affect the creds until we've finished.
The calling of set_dumpable() has been moved into commit_creds().
Much of the functionality of set_user() has been moved into
commit_creds().
The get functions all simply access the data directly.
(8) security_task_prctl() and cap_task_prctl().
security_task_prctl() has been modified to return -ENOSYS if it doesn't
want to handle a function, or otherwise return the return value directly
rather than through an argument.
Additionally, cap_task_prctl() now prepares a new set of credentials, even
if it doesn't end up using it.
(9) Keyrings.
A number of changes have been made to the keyrings code:
(a) switch_uid_keyring(), copy_keys(), exit_keys() and suid_keys() have
all been dropped and built in to the credentials functions directly.
They may want separating out again later.
(b) key_alloc() and search_process_keyrings() now take a cred pointer
rather than a task pointer to specify the security context.
(c) copy_creds() gives a new thread within the same thread group a new
thread keyring if its parent had one, otherwise it discards the thread
keyring.
(d) The authorisation key now points directly to the credentials to extend
the search into rather pointing to the task that carries them.
(e) Installing thread, process or session keyrings causes a new set of
credentials to be created, even though it's not strictly necessary for
process or session keyrings (they're shared).
(10) Usermode helper.
The usermode helper code now carries a cred struct pointer in its
subprocess_info struct instead of a new session keyring pointer. This set
of credentials is derived from init_cred and installed on the new process
after it has been cloned.
call_usermodehelper_setup() allocates the new credentials and
call_usermodehelper_freeinfo() discards them if they haven't been used. A
special cred function (prepare_usermodeinfo_creds()) is provided
specifically for call_usermodehelper_setup() to call.
call_usermodehelper_setkeys() adjusts the credentials to sport the
supplied keyring as the new session keyring.
(11) SELinux.
SELinux has a number of changes, in addition to those to support the LSM
interface changes mentioned above:
(a) selinux_setprocattr() no longer does its check for whether the
current ptracer can access processes with the new SID inside the lock
that covers getting the ptracer's SID. Whilst this lock ensures that
the check is done with the ptracer pinned, the result is only valid
until the lock is released, so there's no point doing it inside the
lock.
(12) is_single_threaded().
This function has been extracted from selinux_setprocattr() and put into
a file of its own in the lib/ directory as join_session_keyring() now
wants to use it too.
The code in SELinux just checked to see whether a task shared mm_structs
with other tasks (CLONE_VM), but that isn't good enough. We really want
to know if they're part of the same thread group (CLONE_THREAD).
(13) nfsd.
The NFS server daemon now has to use the COW credentials to set the
credentials it is going to use. It really needs to pass the credentials
down to the functions it calls, but it can't do that until other patches
in this series have been applied.
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: James Morris <jmorris@namei.org>
2008-11-13 23:39:23 +00:00
|
|
|
nfs4_reset_creds(const struct cred *original)
|
2005-06-24 05:04:25 +00:00
|
|
|
{
|
CRED: Inaugurate COW credentials
Inaugurate copy-on-write credentials management. This uses RCU to manage the
credentials pointer in the task_struct with respect to accesses by other tasks.
A process may only modify its own credentials, and so does not need locking to
access or modify its own credentials.
A mutex (cred_replace_mutex) is added to the task_struct to control the effect
of PTRACE_ATTACHED on credential calculations, particularly with respect to
execve().
With this patch, the contents of an active credentials struct may not be
changed directly; rather a new set of credentials must be prepared, modified
and committed using something like the following sequence of events:
struct cred *new = prepare_creds();
int ret = blah(new);
if (ret < 0) {
abort_creds(new);
return ret;
}
return commit_creds(new);
There are some exceptions to this rule: the keyrings pointed to by the active
credentials may be instantiated - keyrings violate the COW rule as managing
COW keyrings is tricky, given that it is possible for a task to directly alter
the keys in a keyring in use by another task.
To help enforce this, various pointers to sets of credentials, such as those in
the task_struct, are declared const. The purpose of this is compile-time
discouragement of altering credentials through those pointers. Once a set of
credentials has been made public through one of these pointers, it may not be
modified, except under special circumstances:
(1) Its reference count may incremented and decremented.
(2) The keyrings to which it points may be modified, but not replaced.
The only safe way to modify anything else is to create a replacement and commit
using the functions described in Documentation/credentials.txt (which will be
added by a later patch).
This patch and the preceding patches have been tested with the LTP SELinux
testsuite.
This patch makes several logical sets of alteration:
(1) execve().
This now prepares and commits credentials in various places in the
security code rather than altering the current creds directly.
(2) Temporary credential overrides.
do_coredump() and sys_faccessat() now prepare their own credentials and
temporarily override the ones currently on the acting thread, whilst
preventing interference from other threads by holding cred_replace_mutex
on the thread being dumped.
This will be replaced in a future patch by something that hands down the
credentials directly to the functions being called, rather than altering
the task's objective credentials.
(3) LSM interface.
A number of functions have been changed, added or removed:
(*) security_capset_check(), ->capset_check()
(*) security_capset_set(), ->capset_set()
Removed in favour of security_capset().
(*) security_capset(), ->capset()
New. This is passed a pointer to the new creds, a pointer to the old
creds and the proposed capability sets. It should fill in the new
creds or return an error. All pointers, barring the pointer to the
new creds, are now const.
(*) security_bprm_apply_creds(), ->bprm_apply_creds()
Changed; now returns a value, which will cause the process to be
killed if it's an error.
(*) security_task_alloc(), ->task_alloc_security()
Removed in favour of security_prepare_creds().
(*) security_cred_free(), ->cred_free()
New. Free security data attached to cred->security.
(*) security_prepare_creds(), ->cred_prepare()
New. Duplicate any security data attached to cred->security.
(*) security_commit_creds(), ->cred_commit()
New. Apply any security effects for the upcoming installation of new
security by commit_creds().
(*) security_task_post_setuid(), ->task_post_setuid()
Removed in favour of security_task_fix_setuid().
(*) security_task_fix_setuid(), ->task_fix_setuid()
Fix up the proposed new credentials for setuid(). This is used by
cap_set_fix_setuid() to implicitly adjust capabilities in line with
setuid() changes. Changes are made to the new credentials, rather
than the task itself as in security_task_post_setuid().
(*) security_task_reparent_to_init(), ->task_reparent_to_init()
Removed. Instead the task being reparented to init is referred
directly to init's credentials.
NOTE! This results in the loss of some state: SELinux's osid no
longer records the sid of the thread that forked it.
(*) security_key_alloc(), ->key_alloc()
(*) security_key_permission(), ->key_permission()
Changed. These now take cred pointers rather than task pointers to
refer to the security context.
(4) sys_capset().
This has been simplified and uses less locking. The LSM functions it
calls have been merged.
(5) reparent_to_kthreadd().
This gives the current thread the same credentials as init by simply using
commit_thread() to point that way.
(6) __sigqueue_alloc() and switch_uid()
__sigqueue_alloc() can't stop the target task from changing its creds
beneath it, so this function gets a reference to the currently applicable
user_struct which it then passes into the sigqueue struct it returns if
successful.
switch_uid() is now called from commit_creds(), and possibly should be
folded into that. commit_creds() should take care of protecting
__sigqueue_alloc().
(7) [sg]et[ug]id() and co and [sg]et_current_groups.
The set functions now all use prepare_creds(), commit_creds() and
abort_creds() to build and check a new set of credentials before applying
it.
security_task_set[ug]id() is called inside the prepared section. This
guarantees that nothing else will affect the creds until we've finished.
The calling of set_dumpable() has been moved into commit_creds().
Much of the functionality of set_user() has been moved into
commit_creds().
The get functions all simply access the data directly.
(8) security_task_prctl() and cap_task_prctl().
security_task_prctl() has been modified to return -ENOSYS if it doesn't
want to handle a function, or otherwise return the return value directly
rather than through an argument.
Additionally, cap_task_prctl() now prepares a new set of credentials, even
if it doesn't end up using it.
(9) Keyrings.
A number of changes have been made to the keyrings code:
(a) switch_uid_keyring(), copy_keys(), exit_keys() and suid_keys() have
all been dropped and built in to the credentials functions directly.
They may want separating out again later.
(b) key_alloc() and search_process_keyrings() now take a cred pointer
rather than a task pointer to specify the security context.
(c) copy_creds() gives a new thread within the same thread group a new
thread keyring if its parent had one, otherwise it discards the thread
keyring.
(d) The authorisation key now points directly to the credentials to extend
the search into rather pointing to the task that carries them.
(e) Installing thread, process or session keyrings causes a new set of
credentials to be created, even though it's not strictly necessary for
process or session keyrings (they're shared).
(10) Usermode helper.
The usermode helper code now carries a cred struct pointer in its
subprocess_info struct instead of a new session keyring pointer. This set
of credentials is derived from init_cred and installed on the new process
after it has been cloned.
call_usermodehelper_setup() allocates the new credentials and
call_usermodehelper_freeinfo() discards them if they haven't been used. A
special cred function (prepare_usermodeinfo_creds()) is provided
specifically for call_usermodehelper_setup() to call.
call_usermodehelper_setkeys() adjusts the credentials to sport the
supplied keyring as the new session keyring.
(11) SELinux.
SELinux has a number of changes, in addition to those to support the LSM
interface changes mentioned above:
(a) selinux_setprocattr() no longer does its check for whether the
current ptracer can access processes with the new SID inside the lock
that covers getting the ptracer's SID. Whilst this lock ensures that
the check is done with the ptracer pinned, the result is only valid
until the lock is released, so there's no point doing it inside the
lock.
(12) is_single_threaded().
This function has been extracted from selinux_setprocattr() and put into
a file of its own in the lib/ directory as join_session_keyring() now
wants to use it too.
The code in SELinux just checked to see whether a task shared mm_structs
with other tasks (CLONE_VM), but that isn't good enough. We really want
to know if they're part of the same thread group (CLONE_THREAD).
(13) nfsd.
The NFS server daemon now has to use the COW credentials to set the
credentials it is going to use. It really needs to pass the credentials
down to the functions it calls, but it can't do that until other patches
in this series have been applied.
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: James Morris <jmorris@namei.org>
2008-11-13 23:39:23 +00:00
|
|
|
revert_creds(original);
|
2005-06-24 05:04:25 +00:00
|
|
|
}
|
|
|
|
|
|
2005-06-24 05:03:52 +00:00
|
|
|
static void
|
|
|
|
|
md5_to_hex(char *out, char *md5)
|
|
|
|
|
{
|
|
|
|
|
int i;
|
|
|
|
|
|
|
|
|
|
for (i=0; i<16; i++) {
|
|
|
|
|
unsigned char c = md5[i];
|
|
|
|
|
|
|
|
|
|
*out++ = '0' + ((c&0xf0)>>4) + (c>=0xa0)*('a'-'9'-1);
|
|
|
|
|
*out++ = '0' + (c&0x0f) + ((c&0x0f)>=0x0a)*('a'-'9'-1);
|
|
|
|
|
}
|
|
|
|
|
*out = '\0';
|
|
|
|
|
}
|
|
|
|
|
|
2012-11-12 20:00:57 +00:00
|
|
|
static int
|
|
|
|
|
nfs4_make_rec_clidname(char *dname, const struct xdr_netobj *clname)
|
2005-06-24 05:03:52 +00:00
|
|
|
{
|
|
|
|
|
struct xdr_netobj cksum;
|
2006-08-24 09:10:20 +00:00
|
|
|
struct hash_desc desc;
|
2007-10-22 17:43:30 +00:00
|
|
|
struct scatterlist sg;
|
2012-11-12 20:00:57 +00:00
|
|
|
int status;
|
2005-06-24 05:03:52 +00:00
|
|
|
|
|
|
|
|
dprintk("NFSD: nfs4_make_rec_clidname for %.*s\n",
|
|
|
|
|
clname->len, clname->data);
|
2006-08-24 09:10:20 +00:00
|
|
|
desc.flags = CRYPTO_TFM_REQ_MAY_SLEEP;
|
|
|
|
|
desc.tfm = crypto_alloc_hash("md5", 0, CRYPTO_ALG_ASYNC);
|
2012-11-12 20:00:57 +00:00
|
|
|
if (IS_ERR(desc.tfm)) {
|
|
|
|
|
status = PTR_ERR(desc.tfm);
|
2006-08-24 09:10:20 +00:00
|
|
|
goto out_no_tfm;
|
2012-11-12 20:00:57 +00:00
|
|
|
}
|
|
|
|
|
|
2006-08-24 09:10:20 +00:00
|
|
|
cksum.len = crypto_hash_digestsize(desc.tfm);
|
2005-06-24 05:03:52 +00:00
|
|
|
cksum.data = kmalloc(cksum.len, GFP_KERNEL);
|
2012-11-12 20:00:57 +00:00
|
|
|
if (cksum.data == NULL) {
|
|
|
|
|
status = -ENOMEM;
|
2005-06-24 05:03:52 +00:00
|
|
|
goto out;
|
2012-11-12 20:00:57 +00:00
|
|
|
}
|
2005-06-24 05:03:52 +00:00
|
|
|
|
2007-10-22 17:43:30 +00:00
|
|
|
sg_init_one(&sg, clname->data, clname->len);
|
2005-06-24 05:03:52 +00:00
|
|
|
|
2012-11-12 20:00:57 +00:00
|
|
|
status = crypto_hash_digest(&desc, &sg, sg.length, cksum.data);
|
|
|
|
|
if (status)
|
2006-08-24 09:10:20 +00:00
|
|
|
goto out;
|
2005-06-24 05:03:52 +00:00
|
|
|
|
|
|
|
|
md5_to_hex(dname, cksum.data);
|
|
|
|
|
|
2012-11-12 20:00:57 +00:00
|
|
|
status = 0;
|
2005-06-24 05:03:52 +00:00
|
|
|
out:
|
2008-10-20 06:17:09 +00:00
|
|
|
kfree(cksum.data);
|
2006-08-24 09:10:20 +00:00
|
|
|
crypto_free_hash(desc.tfm);
|
|
|
|
|
out_no_tfm:
|
2005-06-24 05:03:52 +00:00
|
|
|
return status;
|
|
|
|
|
}
|
2005-06-24 05:04:25 +00:00
|
|
|
|
2012-11-12 20:00:57 +00:00
|
|
|
/*
|
|
|
|
|
* If we had an error generating the recdir name for the legacy tracker
|
|
|
|
|
* then warn the admin. If the error doesn't appear to be transient,
|
|
|
|
|
* then disable recovery tracking.
|
|
|
|
|
*/
|
|
|
|
|
static void
|
2013-05-09 12:36:23 +00:00
|
|
|
legacy_recdir_name_error(struct nfs4_client *clp, int error)
|
2012-11-12 20:00:57 +00:00
|
|
|
{
|
|
|
|
|
printk(KERN_ERR "NFSD: unable to generate recoverydir "
|
|
|
|
|
"name (%d).\n", error);
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* if the algorithm just doesn't exist, then disable the recovery
|
|
|
|
|
* tracker altogether. The crypto libs will generally return this if
|
|
|
|
|
* FIPS is enabled as well.
|
|
|
|
|
*/
|
|
|
|
|
if (error == -ENOENT) {
|
|
|
|
|
printk(KERN_ERR "NFSD: disabling legacy clientid tracking. "
|
|
|
|
|
"Reboot recovery will not function correctly!\n");
|
2013-05-09 12:36:23 +00:00
|
|
|
nfsd4_client_tracking_exit(clp->net);
|
2012-11-12 20:00:57 +00:00
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2012-03-21 20:42:43 +00:00
|
|
|
static void
|
|
|
|
|
nfsd4_create_clid_dir(struct nfs4_client *clp)
|
2005-06-24 05:04:30 +00:00
|
|
|
{
|
CRED: Inaugurate COW credentials
Inaugurate copy-on-write credentials management. This uses RCU to manage the
credentials pointer in the task_struct with respect to accesses by other tasks.
A process may only modify its own credentials, and so does not need locking to
access or modify its own credentials.
A mutex (cred_replace_mutex) is added to the task_struct to control the effect
of PTRACE_ATTACHED on credential calculations, particularly with respect to
execve().
With this patch, the contents of an active credentials struct may not be
changed directly; rather a new set of credentials must be prepared, modified
and committed using something like the following sequence of events:
struct cred *new = prepare_creds();
int ret = blah(new);
if (ret < 0) {
abort_creds(new);
return ret;
}
return commit_creds(new);
There are some exceptions to this rule: the keyrings pointed to by the active
credentials may be instantiated - keyrings violate the COW rule as managing
COW keyrings is tricky, given that it is possible for a task to directly alter
the keys in a keyring in use by another task.
To help enforce this, various pointers to sets of credentials, such as those in
the task_struct, are declared const. The purpose of this is compile-time
discouragement of altering credentials through those pointers. Once a set of
credentials has been made public through one of these pointers, it may not be
modified, except under special circumstances:
(1) Its reference count may incremented and decremented.
(2) The keyrings to which it points may be modified, but not replaced.
The only safe way to modify anything else is to create a replacement and commit
using the functions described in Documentation/credentials.txt (which will be
added by a later patch).
This patch and the preceding patches have been tested with the LTP SELinux
testsuite.
This patch makes several logical sets of alteration:
(1) execve().
This now prepares and commits credentials in various places in the
security code rather than altering the current creds directly.
(2) Temporary credential overrides.
do_coredump() and sys_faccessat() now prepare their own credentials and
temporarily override the ones currently on the acting thread, whilst
preventing interference from other threads by holding cred_replace_mutex
on the thread being dumped.
This will be replaced in a future patch by something that hands down the
credentials directly to the functions being called, rather than altering
the task's objective credentials.
(3) LSM interface.
A number of functions have been changed, added or removed:
(*) security_capset_check(), ->capset_check()
(*) security_capset_set(), ->capset_set()
Removed in favour of security_capset().
(*) security_capset(), ->capset()
New. This is passed a pointer to the new creds, a pointer to the old
creds and the proposed capability sets. It should fill in the new
creds or return an error. All pointers, barring the pointer to the
new creds, are now const.
(*) security_bprm_apply_creds(), ->bprm_apply_creds()
Changed; now returns a value, which will cause the process to be
killed if it's an error.
(*) security_task_alloc(), ->task_alloc_security()
Removed in favour of security_prepare_creds().
(*) security_cred_free(), ->cred_free()
New. Free security data attached to cred->security.
(*) security_prepare_creds(), ->cred_prepare()
New. Duplicate any security data attached to cred->security.
(*) security_commit_creds(), ->cred_commit()
New. Apply any security effects for the upcoming installation of new
security by commit_creds().
(*) security_task_post_setuid(), ->task_post_setuid()
Removed in favour of security_task_fix_setuid().
(*) security_task_fix_setuid(), ->task_fix_setuid()
Fix up the proposed new credentials for setuid(). This is used by
cap_set_fix_setuid() to implicitly adjust capabilities in line with
setuid() changes. Changes are made to the new credentials, rather
than the task itself as in security_task_post_setuid().
(*) security_task_reparent_to_init(), ->task_reparent_to_init()
Removed. Instead the task being reparented to init is referred
directly to init's credentials.
NOTE! This results in the loss of some state: SELinux's osid no
longer records the sid of the thread that forked it.
(*) security_key_alloc(), ->key_alloc()
(*) security_key_permission(), ->key_permission()
Changed. These now take cred pointers rather than task pointers to
refer to the security context.
(4) sys_capset().
This has been simplified and uses less locking. The LSM functions it
calls have been merged.
(5) reparent_to_kthreadd().
This gives the current thread the same credentials as init by simply using
commit_thread() to point that way.
(6) __sigqueue_alloc() and switch_uid()
__sigqueue_alloc() can't stop the target task from changing its creds
beneath it, so this function gets a reference to the currently applicable
user_struct which it then passes into the sigqueue struct it returns if
successful.
switch_uid() is now called from commit_creds(), and possibly should be
folded into that. commit_creds() should take care of protecting
__sigqueue_alloc().
(7) [sg]et[ug]id() and co and [sg]et_current_groups.
The set functions now all use prepare_creds(), commit_creds() and
abort_creds() to build and check a new set of credentials before applying
it.
security_task_set[ug]id() is called inside the prepared section. This
guarantees that nothing else will affect the creds until we've finished.
The calling of set_dumpable() has been moved into commit_creds().
Much of the functionality of set_user() has been moved into
commit_creds().
The get functions all simply access the data directly.
(8) security_task_prctl() and cap_task_prctl().
security_task_prctl() has been modified to return -ENOSYS if it doesn't
want to handle a function, or otherwise return the return value directly
rather than through an argument.
Additionally, cap_task_prctl() now prepares a new set of credentials, even
if it doesn't end up using it.
(9) Keyrings.
A number of changes have been made to the keyrings code:
(a) switch_uid_keyring(), copy_keys(), exit_keys() and suid_keys() have
all been dropped and built in to the credentials functions directly.
They may want separating out again later.
(b) key_alloc() and search_process_keyrings() now take a cred pointer
rather than a task pointer to specify the security context.
(c) copy_creds() gives a new thread within the same thread group a new
thread keyring if its parent had one, otherwise it discards the thread
keyring.
(d) The authorisation key now points directly to the credentials to extend
the search into rather pointing to the task that carries them.
(e) Installing thread, process or session keyrings causes a new set of
credentials to be created, even though it's not strictly necessary for
process or session keyrings (they're shared).
(10) Usermode helper.
The usermode helper code now carries a cred struct pointer in its
subprocess_info struct instead of a new session keyring pointer. This set
of credentials is derived from init_cred and installed on the new process
after it has been cloned.
call_usermodehelper_setup() allocates the new credentials and
call_usermodehelper_freeinfo() discards them if they haven't been used. A
special cred function (prepare_usermodeinfo_creds()) is provided
specifically for call_usermodehelper_setup() to call.
call_usermodehelper_setkeys() adjusts the credentials to sport the
supplied keyring as the new session keyring.
(11) SELinux.
SELinux has a number of changes, in addition to those to support the LSM
interface changes mentioned above:
(a) selinux_setprocattr() no longer does its check for whether the
current ptracer can access processes with the new SID inside the lock
that covers getting the ptracer's SID. Whilst this lock ensures that
the check is done with the ptracer pinned, the result is only valid
until the lock is released, so there's no point doing it inside the
lock.
(12) is_single_threaded().
This function has been extracted from selinux_setprocattr() and put into
a file of its own in the lib/ directory as join_session_keyring() now
wants to use it too.
The code in SELinux just checked to see whether a task shared mm_structs
with other tasks (CLONE_VM), but that isn't good enough. We really want
to know if they're part of the same thread group (CLONE_THREAD).
(13) nfsd.
The NFS server daemon now has to use the COW credentials to set the
credentials it is going to use. It really needs to pass the credentials
down to the functions it calls, but it can't do that until other patches
in this series have been applied.
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: James Morris <jmorris@namei.org>
2008-11-13 23:39:23 +00:00
|
|
|
const struct cred *original_cred;
|
2012-11-12 20:00:57 +00:00
|
|
|
char dname[HEXDIR_LEN];
|
2010-03-22 16:32:14 +00:00
|
|
|
struct dentry *dir, *dentry;
|
2012-11-12 20:00:55 +00:00
|
|
|
struct nfs4_client_reclaim *crp;
|
2005-06-24 05:04:30 +00:00
|
|
|
int status;
|
2012-11-14 15:21:16 +00:00
|
|
|
struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
|
2005-06-24 05:04:30 +00:00
|
|
|
|
2012-03-21 13:52:02 +00:00
|
|
|
if (test_and_set_bit(NFSD4_CLIENT_STABLE, &clp->cl_flags))
|
2012-01-05 20:38:41 +00:00
|
|
|
return;
|
2012-11-26 13:16:25 +00:00
|
|
|
if (!nn->rec_file)
|
2012-01-05 20:38:41 +00:00
|
|
|
return;
|
2012-11-12 20:00:57 +00:00
|
|
|
|
|
|
|
|
status = nfs4_make_rec_clidname(dname, &clp->cl_name);
|
|
|
|
|
if (status)
|
2013-05-09 12:36:23 +00:00
|
|
|
return legacy_recdir_name_error(clp, status);
|
2012-11-12 20:00:57 +00:00
|
|
|
|
CRED: Inaugurate COW credentials
Inaugurate copy-on-write credentials management. This uses RCU to manage the
credentials pointer in the task_struct with respect to accesses by other tasks.
A process may only modify its own credentials, and so does not need locking to
access or modify its own credentials.
A mutex (cred_replace_mutex) is added to the task_struct to control the effect
of PTRACE_ATTACHED on credential calculations, particularly with respect to
execve().
With this patch, the contents of an active credentials struct may not be
changed directly; rather a new set of credentials must be prepared, modified
and committed using something like the following sequence of events:
struct cred *new = prepare_creds();
int ret = blah(new);
if (ret < 0) {
abort_creds(new);
return ret;
}
return commit_creds(new);
There are some exceptions to this rule: the keyrings pointed to by the active
credentials may be instantiated - keyrings violate the COW rule as managing
COW keyrings is tricky, given that it is possible for a task to directly alter
the keys in a keyring in use by another task.
To help enforce this, various pointers to sets of credentials, such as those in
the task_struct, are declared const. The purpose of this is compile-time
discouragement of altering credentials through those pointers. Once a set of
credentials has been made public through one of these pointers, it may not be
modified, except under special circumstances:
(1) Its reference count may incremented and decremented.
(2) The keyrings to which it points may be modified, but not replaced.
The only safe way to modify anything else is to create a replacement and commit
using the functions described in Documentation/credentials.txt (which will be
added by a later patch).
This patch and the preceding patches have been tested with the LTP SELinux
testsuite.
This patch makes several logical sets of alteration:
(1) execve().
This now prepares and commits credentials in various places in the
security code rather than altering the current creds directly.
(2) Temporary credential overrides.
do_coredump() and sys_faccessat() now prepare their own credentials and
temporarily override the ones currently on the acting thread, whilst
preventing interference from other threads by holding cred_replace_mutex
on the thread being dumped.
This will be replaced in a future patch by something that hands down the
credentials directly to the functions being called, rather than altering
the task's objective credentials.
(3) LSM interface.
A number of functions have been changed, added or removed:
(*) security_capset_check(), ->capset_check()
(*) security_capset_set(), ->capset_set()
Removed in favour of security_capset().
(*) security_capset(), ->capset()
New. This is passed a pointer to the new creds, a pointer to the old
creds and the proposed capability sets. It should fill in the new
creds or return an error. All pointers, barring the pointer to the
new creds, are now const.
(*) security_bprm_apply_creds(), ->bprm_apply_creds()
Changed; now returns a value, which will cause the process to be
killed if it's an error.
(*) security_task_alloc(), ->task_alloc_security()
Removed in favour of security_prepare_creds().
(*) security_cred_free(), ->cred_free()
New. Free security data attached to cred->security.
(*) security_prepare_creds(), ->cred_prepare()
New. Duplicate any security data attached to cred->security.
(*) security_commit_creds(), ->cred_commit()
New. Apply any security effects for the upcoming installation of new
security by commit_creds().
(*) security_task_post_setuid(), ->task_post_setuid()
Removed in favour of security_task_fix_setuid().
(*) security_task_fix_setuid(), ->task_fix_setuid()
Fix up the proposed new credentials for setuid(). This is used by
cap_set_fix_setuid() to implicitly adjust capabilities in line with
setuid() changes. Changes are made to the new credentials, rather
than the task itself as in security_task_post_setuid().
(*) security_task_reparent_to_init(), ->task_reparent_to_init()
Removed. Instead the task being reparented to init is referred
directly to init's credentials.
NOTE! This results in the loss of some state: SELinux's osid no
longer records the sid of the thread that forked it.
(*) security_key_alloc(), ->key_alloc()
(*) security_key_permission(), ->key_permission()
Changed. These now take cred pointers rather than task pointers to
refer to the security context.
(4) sys_capset().
This has been simplified and uses less locking. The LSM functions it
calls have been merged.
(5) reparent_to_kthreadd().
This gives the current thread the same credentials as init by simply using
commit_thread() to point that way.
(6) __sigqueue_alloc() and switch_uid()
__sigqueue_alloc() can't stop the target task from changing its creds
beneath it, so this function gets a reference to the currently applicable
user_struct which it then passes into the sigqueue struct it returns if
successful.
switch_uid() is now called from commit_creds(), and possibly should be
folded into that. commit_creds() should take care of protecting
__sigqueue_alloc().
(7) [sg]et[ug]id() and co and [sg]et_current_groups.
The set functions now all use prepare_creds(), commit_creds() and
abort_creds() to build and check a new set of credentials before applying
it.
security_task_set[ug]id() is called inside the prepared section. This
guarantees that nothing else will affect the creds until we've finished.
The calling of set_dumpable() has been moved into commit_creds().
Much of the functionality of set_user() has been moved into
commit_creds().
The get functions all simply access the data directly.
(8) security_task_prctl() and cap_task_prctl().
security_task_prctl() has been modified to return -ENOSYS if it doesn't
want to handle a function, or otherwise return the return value directly
rather than through an argument.
Additionally, cap_task_prctl() now prepares a new set of credentials, even
if it doesn't end up using it.
(9) Keyrings.
A number of changes have been made to the keyrings code:
(a) switch_uid_keyring(), copy_keys(), exit_keys() and suid_keys() have
all been dropped and built in to the credentials functions directly.
They may want separating out again later.
(b) key_alloc() and search_process_keyrings() now take a cred pointer
rather than a task pointer to specify the security context.
(c) copy_creds() gives a new thread within the same thread group a new
thread keyring if its parent had one, otherwise it discards the thread
keyring.
(d) The authorisation key now points directly to the credentials to extend
the search into rather pointing to the task that carries them.
(e) Installing thread, process or session keyrings causes a new set of
credentials to be created, even though it's not strictly necessary for
process or session keyrings (they're shared).
(10) Usermode helper.
The usermode helper code now carries a cred struct pointer in its
subprocess_info struct instead of a new session keyring pointer. This set
of credentials is derived from init_cred and installed on the new process
after it has been cloned.
call_usermodehelper_setup() allocates the new credentials and
call_usermodehelper_freeinfo() discards them if they haven't been used. A
special cred function (prepare_usermodeinfo_creds()) is provided
specifically for call_usermodehelper_setup() to call.
call_usermodehelper_setkeys() adjusts the credentials to sport the
supplied keyring as the new session keyring.
(11) SELinux.
SELinux has a number of changes, in addition to those to support the LSM
interface changes mentioned above:
(a) selinux_setprocattr() no longer does its check for whether the
current ptracer can access processes with the new SID inside the lock
that covers getting the ptracer's SID. Whilst this lock ensures that
the check is done with the ptracer pinned, the result is only valid
until the lock is released, so there's no point doing it inside the
lock.
(12) is_single_threaded().
This function has been extracted from selinux_setprocattr() and put into
a file of its own in the lib/ directory as join_session_keyring() now
wants to use it too.
The code in SELinux just checked to see whether a task shared mm_structs
with other tasks (CLONE_VM), but that isn't good enough. We really want
to know if they're part of the same thread group (CLONE_THREAD).
(13) nfsd.
The NFS server daemon now has to use the COW credentials to set the
credentials it is going to use. It really needs to pass the credentials
down to the functions it calls, but it can't do that until other patches
in this series have been applied.
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: James Morris <jmorris@namei.org>
2008-11-13 23:39:23 +00:00
|
|
|
status = nfs4_save_creds(&original_cred);
|
|
|
|
|
if (status < 0)
|
2012-01-05 20:38:41 +00:00
|
|
|
return;
|
2005-06-24 05:04:30 +00:00
|
|
|
|
2012-11-26 13:16:25 +00:00
|
|
|
status = mnt_want_write_file(nn->rec_file);
|
2012-06-12 14:20:33 +00:00
|
|
|
if (status)
|
2014-09-02 14:11:27 +00:00
|
|
|
goto out_creds;
|
2012-06-12 14:20:33 +00:00
|
|
|
|
2012-11-26 13:16:25 +00:00
|
|
|
dir = nn->rec_file->f_path.dentry;
|
2005-06-24 05:04:30 +00:00
|
|
|
/* lock the parent */
|
2010-03-22 16:32:14 +00:00
|
|
|
mutex_lock(&dir->d_inode->i_mutex);
|
2005-06-24 05:04:30 +00:00
|
|
|
|
2010-03-22 16:32:14 +00:00
|
|
|
dentry = lookup_one_len(dname, dir, HEXDIR_LEN-1);
|
2005-06-24 05:04:30 +00:00
|
|
|
if (IS_ERR(dentry)) {
|
|
|
|
|
status = PTR_ERR(dentry);
|
|
|
|
|
goto out_unlock;
|
|
|
|
|
}
|
2011-08-13 00:30:12 +00:00
|
|
|
if (dentry->d_inode)
|
2012-01-02 22:30:05 +00:00
|
|
|
/*
|
|
|
|
|
* In the 4.1 case, where we're called from
|
|
|
|
|
* reclaim_complete(), records from the previous reboot
|
|
|
|
|
* may still be left, so this is OK.
|
|
|
|
|
*
|
|
|
|
|
* In the 4.0 case, we should never get here; but we may
|
|
|
|
|
* as well be forgiving and just succeed silently.
|
|
|
|
|
*/
|
2005-06-24 05:04:30 +00:00
|
|
|
goto out_put;
|
2010-03-22 16:32:14 +00:00
|
|
|
status = vfs_mkdir(dir->d_inode, dentry, S_IRWXU);
|
2005-06-24 05:04:30 +00:00
|
|
|
out_put:
|
|
|
|
|
dput(dentry);
|
|
|
|
|
out_unlock:
|
2010-03-22 16:32:14 +00:00
|
|
|
mutex_unlock(&dir->d_inode->i_mutex);
|
2012-11-12 20:00:55 +00:00
|
|
|
if (status == 0) {
|
2012-11-26 13:16:30 +00:00
|
|
|
if (nn->in_grace) {
|
2012-11-14 15:21:16 +00:00
|
|
|
crp = nfs4_client_to_reclaim(dname, nn);
|
2012-11-12 20:00:55 +00:00
|
|
|
if (crp)
|
|
|
|
|
crp->cr_clp = clp;
|
|
|
|
|
}
|
2012-11-26 13:16:25 +00:00
|
|
|
vfs_fsync(nn->rec_file, 0);
|
2012-11-12 20:00:55 +00:00
|
|
|
} else {
|
2011-08-13 00:30:12 +00:00
|
|
|
printk(KERN_ERR "NFSD: failed to write recovery record"
|
|
|
|
|
" (err %d); please check that %s exists"
|
|
|
|
|
" and is writeable", status,
|
|
|
|
|
user_recovery_dirname);
|
2012-11-12 20:00:55 +00:00
|
|
|
}
|
2012-11-26 13:16:25 +00:00
|
|
|
mnt_drop_write_file(nn->rec_file);
|
2014-09-02 14:11:27 +00:00
|
|
|
out_creds:
|
CRED: Inaugurate COW credentials
Inaugurate copy-on-write credentials management. This uses RCU to manage the
credentials pointer in the task_struct with respect to accesses by other tasks.
A process may only modify its own credentials, and so does not need locking to
access or modify its own credentials.
A mutex (cred_replace_mutex) is added to the task_struct to control the effect
of PTRACE_ATTACHED on credential calculations, particularly with respect to
execve().
With this patch, the contents of an active credentials struct may not be
changed directly; rather a new set of credentials must be prepared, modified
and committed using something like the following sequence of events:
struct cred *new = prepare_creds();
int ret = blah(new);
if (ret < 0) {
abort_creds(new);
return ret;
}
return commit_creds(new);
There are some exceptions to this rule: the keyrings pointed to by the active
credentials may be instantiated - keyrings violate the COW rule as managing
COW keyrings is tricky, given that it is possible for a task to directly alter
the keys in a keyring in use by another task.
To help enforce this, various pointers to sets of credentials, such as those in
the task_struct, are declared const. The purpose of this is compile-time
discouragement of altering credentials through those pointers. Once a set of
credentials has been made public through one of these pointers, it may not be
modified, except under special circumstances:
(1) Its reference count may incremented and decremented.
(2) The keyrings to which it points may be modified, but not replaced.
The only safe way to modify anything else is to create a replacement and commit
using the functions described in Documentation/credentials.txt (which will be
added by a later patch).
This patch and the preceding patches have been tested with the LTP SELinux
testsuite.
This patch makes several logical sets of alteration:
(1) execve().
This now prepares and commits credentials in various places in the
security code rather than altering the current creds directly.
(2) Temporary credential overrides.
do_coredump() and sys_faccessat() now prepare their own credentials and
temporarily override the ones currently on the acting thread, whilst
preventing interference from other threads by holding cred_replace_mutex
on the thread being dumped.
This will be replaced in a future patch by something that hands down the
credentials directly to the functions being called, rather than altering
the task's objective credentials.
(3) LSM interface.
A number of functions have been changed, added or removed:
(*) security_capset_check(), ->capset_check()
(*) security_capset_set(), ->capset_set()
Removed in favour of security_capset().
(*) security_capset(), ->capset()
New. This is passed a pointer to the new creds, a pointer to the old
creds and the proposed capability sets. It should fill in the new
creds or return an error. All pointers, barring the pointer to the
new creds, are now const.
(*) security_bprm_apply_creds(), ->bprm_apply_creds()
Changed; now returns a value, which will cause the process to be
killed if it's an error.
(*) security_task_alloc(), ->task_alloc_security()
Removed in favour of security_prepare_creds().
(*) security_cred_free(), ->cred_free()
New. Free security data attached to cred->security.
(*) security_prepare_creds(), ->cred_prepare()
New. Duplicate any security data attached to cred->security.
(*) security_commit_creds(), ->cred_commit()
New. Apply any security effects for the upcoming installation of new
security by commit_creds().
(*) security_task_post_setuid(), ->task_post_setuid()
Removed in favour of security_task_fix_setuid().
(*) security_task_fix_setuid(), ->task_fix_setuid()
Fix up the proposed new credentials for setuid(). This is used by
cap_set_fix_setuid() to implicitly adjust capabilities in line with
setuid() changes. Changes are made to the new credentials, rather
than the task itself as in security_task_post_setuid().
(*) security_task_reparent_to_init(), ->task_reparent_to_init()
Removed. Instead the task being reparented to init is referred
directly to init's credentials.
NOTE! This results in the loss of some state: SELinux's osid no
longer records the sid of the thread that forked it.
(*) security_key_alloc(), ->key_alloc()
(*) security_key_permission(), ->key_permission()
Changed. These now take cred pointers rather than task pointers to
refer to the security context.
(4) sys_capset().
This has been simplified and uses less locking. The LSM functions it
calls have been merged.
(5) reparent_to_kthreadd().
This gives the current thread the same credentials as init by simply using
commit_thread() to point that way.
(6) __sigqueue_alloc() and switch_uid()
__sigqueue_alloc() can't stop the target task from changing its creds
beneath it, so this function gets a reference to the currently applicable
user_struct which it then passes into the sigqueue struct it returns if
successful.
switch_uid() is now called from commit_creds(), and possibly should be
folded into that. commit_creds() should take care of protecting
__sigqueue_alloc().
(7) [sg]et[ug]id() and co and [sg]et_current_groups.
The set functions now all use prepare_creds(), commit_creds() and
abort_creds() to build and check a new set of credentials before applying
it.
security_task_set[ug]id() is called inside the prepared section. This
guarantees that nothing else will affect the creds until we've finished.
The calling of set_dumpable() has been moved into commit_creds().
Much of the functionality of set_user() has been moved into
commit_creds().
The get functions all simply access the data directly.
(8) security_task_prctl() and cap_task_prctl().
security_task_prctl() has been modified to return -ENOSYS if it doesn't
want to handle a function, or otherwise return the return value directly
rather than through an argument.
Additionally, cap_task_prctl() now prepares a new set of credentials, even
if it doesn't end up using it.
(9) Keyrings.
A number of changes have been made to the keyrings code:
(a) switch_uid_keyring(), copy_keys(), exit_keys() and suid_keys() have
all been dropped and built in to the credentials functions directly.
They may want separating out again later.
(b) key_alloc() and search_process_keyrings() now take a cred pointer
rather than a task pointer to specify the security context.
(c) copy_creds() gives a new thread within the same thread group a new
thread keyring if its parent had one, otherwise it discards the thread
keyring.
(d) The authorisation key now points directly to the credentials to extend
the search into rather pointing to the task that carries them.
(e) Installing thread, process or session keyrings causes a new set of
credentials to be created, even though it's not strictly necessary for
process or session keyrings (they're shared).
(10) Usermode helper.
The usermode helper code now carries a cred struct pointer in its
subprocess_info struct instead of a new session keyring pointer. This set
of credentials is derived from init_cred and installed on the new process
after it has been cloned.
call_usermodehelper_setup() allocates the new credentials and
call_usermodehelper_freeinfo() discards them if they haven't been used. A
special cred function (prepare_usermodeinfo_creds()) is provided
specifically for call_usermodehelper_setup() to call.
call_usermodehelper_setkeys() adjusts the credentials to sport the
supplied keyring as the new session keyring.
(11) SELinux.
SELinux has a number of changes, in addition to those to support the LSM
interface changes mentioned above:
(a) selinux_setprocattr() no longer does its check for whether the
current ptracer can access processes with the new SID inside the lock
that covers getting the ptracer's SID. Whilst this lock ensures that
the check is done with the ptracer pinned, the result is only valid
until the lock is released, so there's no point doing it inside the
lock.
(12) is_single_threaded().
This function has been extracted from selinux_setprocattr() and put into
a file of its own in the lib/ directory as join_session_keyring() now
wants to use it too.
The code in SELinux just checked to see whether a task shared mm_structs
with other tasks (CLONE_VM), but that isn't good enough. We really want
to know if they're part of the same thread group (CLONE_THREAD).
(13) nfsd.
The NFS server daemon now has to use the COW credentials to set the
credentials it is going to use. It really needs to pass the credentials
down to the functions it calls, but it can't do that until other patches
in this series have been applied.
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: James Morris <jmorris@namei.org>
2008-11-13 23:39:23 +00:00
|
|
|
nfs4_reset_creds(original_cred);
|
2005-06-24 05:04:30 +00:00
|
|
|
}
|
|
|
|
|
|
2012-11-14 15:21:16 +00:00
|
|
|
typedef int (recdir_func)(struct dentry *, struct dentry *, struct nfsd_net *);
|
2005-06-24 05:04:25 +00:00
|
|
|
|
2009-03-13 20:02:59 +00:00
|
|
|
struct name_list {
|
|
|
|
|
char name[HEXDIR_LEN];
|
2005-06-24 05:04:25 +00:00
|
|
|
struct list_head list;
|
|
|
|
|
};
|
|
|
|
|
|
2013-05-15 22:49:12 +00:00
|
|
|
struct nfs4_dir_ctx {
|
|
|
|
|
struct dir_context ctx;
|
|
|
|
|
struct list_head names;
|
|
|
|
|
};
|
|
|
|
|
|
2005-06-24 05:04:25 +00:00
|
|
|
static int
|
2009-03-13 20:02:59 +00:00
|
|
|
nfsd4_build_namelist(void *arg, const char *name, int namlen,
|
2006-10-03 08:13:46 +00:00
|
|
|
loff_t offset, u64 ino, unsigned int d_type)
|
2005-06-24 05:04:25 +00:00
|
|
|
{
|
2013-05-15 22:49:12 +00:00
|
|
|
struct nfs4_dir_ctx *ctx = arg;
|
2009-03-13 20:02:59 +00:00
|
|
|
struct name_list *entry;
|
2005-06-24 05:04:25 +00:00
|
|
|
|
2009-03-13 20:02:59 +00:00
|
|
|
if (namlen != HEXDIR_LEN - 1)
|
2006-10-20 06:28:59 +00:00
|
|
|
return 0;
|
2009-03-13 20:02:59 +00:00
|
|
|
entry = kmalloc(sizeof(struct name_list), GFP_KERNEL);
|
|
|
|
|
if (entry == NULL)
|
2005-06-24 05:04:25 +00:00
|
|
|
return -ENOMEM;
|
2009-03-13 20:02:59 +00:00
|
|
|
memcpy(entry->name, name, HEXDIR_LEN - 1);
|
|
|
|
|
entry->name[HEXDIR_LEN - 1] = '\0';
|
2013-05-15 22:49:12 +00:00
|
|
|
list_add(&entry->list, &ctx->names);
|
2005-06-24 05:04:25 +00:00
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int
|
2012-11-14 15:21:16 +00:00
|
|
|
nfsd4_list_rec_dir(recdir_func *f, struct nfsd_net *nn)
|
2005-06-24 05:04:25 +00:00
|
|
|
{
|
CRED: Inaugurate COW credentials
Inaugurate copy-on-write credentials management. This uses RCU to manage the
credentials pointer in the task_struct with respect to accesses by other tasks.
A process may only modify its own credentials, and so does not need locking to
access or modify its own credentials.
A mutex (cred_replace_mutex) is added to the task_struct to control the effect
of PTRACE_ATTACHED on credential calculations, particularly with respect to
execve().
With this patch, the contents of an active credentials struct may not be
changed directly; rather a new set of credentials must be prepared, modified
and committed using something like the following sequence of events:
struct cred *new = prepare_creds();
int ret = blah(new);
if (ret < 0) {
abort_creds(new);
return ret;
}
return commit_creds(new);
There are some exceptions to this rule: the keyrings pointed to by the active
credentials may be instantiated - keyrings violate the COW rule as managing
COW keyrings is tricky, given that it is possible for a task to directly alter
the keys in a keyring in use by another task.
To help enforce this, various pointers to sets of credentials, such as those in
the task_struct, are declared const. The purpose of this is compile-time
discouragement of altering credentials through those pointers. Once a set of
credentials has been made public through one of these pointers, it may not be
modified, except under special circumstances:
(1) Its reference count may incremented and decremented.
(2) The keyrings to which it points may be modified, but not replaced.
The only safe way to modify anything else is to create a replacement and commit
using the functions described in Documentation/credentials.txt (which will be
added by a later patch).
This patch and the preceding patches have been tested with the LTP SELinux
testsuite.
This patch makes several logical sets of alteration:
(1) execve().
This now prepares and commits credentials in various places in the
security code rather than altering the current creds directly.
(2) Temporary credential overrides.
do_coredump() and sys_faccessat() now prepare their own credentials and
temporarily override the ones currently on the acting thread, whilst
preventing interference from other threads by holding cred_replace_mutex
on the thread being dumped.
This will be replaced in a future patch by something that hands down the
credentials directly to the functions being called, rather than altering
the task's objective credentials.
(3) LSM interface.
A number of functions have been changed, added or removed:
(*) security_capset_check(), ->capset_check()
(*) security_capset_set(), ->capset_set()
Removed in favour of security_capset().
(*) security_capset(), ->capset()
New. This is passed a pointer to the new creds, a pointer to the old
creds and the proposed capability sets. It should fill in the new
creds or return an error. All pointers, barring the pointer to the
new creds, are now const.
(*) security_bprm_apply_creds(), ->bprm_apply_creds()
Changed; now returns a value, which will cause the process to be
killed if it's an error.
(*) security_task_alloc(), ->task_alloc_security()
Removed in favour of security_prepare_creds().
(*) security_cred_free(), ->cred_free()
New. Free security data attached to cred->security.
(*) security_prepare_creds(), ->cred_prepare()
New. Duplicate any security data attached to cred->security.
(*) security_commit_creds(), ->cred_commit()
New. Apply any security effects for the upcoming installation of new
security by commit_creds().
(*) security_task_post_setuid(), ->task_post_setuid()
Removed in favour of security_task_fix_setuid().
(*) security_task_fix_setuid(), ->task_fix_setuid()
Fix up the proposed new credentials for setuid(). This is used by
cap_set_fix_setuid() to implicitly adjust capabilities in line with
setuid() changes. Changes are made to the new credentials, rather
than the task itself as in security_task_post_setuid().
(*) security_task_reparent_to_init(), ->task_reparent_to_init()
Removed. Instead the task being reparented to init is referred
directly to init's credentials.
NOTE! This results in the loss of some state: SELinux's osid no
longer records the sid of the thread that forked it.
(*) security_key_alloc(), ->key_alloc()
(*) security_key_permission(), ->key_permission()
Changed. These now take cred pointers rather than task pointers to
refer to the security context.
(4) sys_capset().
This has been simplified and uses less locking. The LSM functions it
calls have been merged.
(5) reparent_to_kthreadd().
This gives the current thread the same credentials as init by simply using
commit_thread() to point that way.
(6) __sigqueue_alloc() and switch_uid()
__sigqueue_alloc() can't stop the target task from changing its creds
beneath it, so this function gets a reference to the currently applicable
user_struct which it then passes into the sigqueue struct it returns if
successful.
switch_uid() is now called from commit_creds(), and possibly should be
folded into that. commit_creds() should take care of protecting
__sigqueue_alloc().
(7) [sg]et[ug]id() and co and [sg]et_current_groups.
The set functions now all use prepare_creds(), commit_creds() and
abort_creds() to build and check a new set of credentials before applying
it.
security_task_set[ug]id() is called inside the prepared section. This
guarantees that nothing else will affect the creds until we've finished.
The calling of set_dumpable() has been moved into commit_creds().
Much of the functionality of set_user() has been moved into
commit_creds().
The get functions all simply access the data directly.
(8) security_task_prctl() and cap_task_prctl().
security_task_prctl() has been modified to return -ENOSYS if it doesn't
want to handle a function, or otherwise return the return value directly
rather than through an argument.
Additionally, cap_task_prctl() now prepares a new set of credentials, even
if it doesn't end up using it.
(9) Keyrings.
A number of changes have been made to the keyrings code:
(a) switch_uid_keyring(), copy_keys(), exit_keys() and suid_keys() have
all been dropped and built in to the credentials functions directly.
They may want separating out again later.
(b) key_alloc() and search_process_keyrings() now take a cred pointer
rather than a task pointer to specify the security context.
(c) copy_creds() gives a new thread within the same thread group a new
thread keyring if its parent had one, otherwise it discards the thread
keyring.
(d) The authorisation key now points directly to the credentials to extend
the search into rather pointing to the task that carries them.
(e) Installing thread, process or session keyrings causes a new set of
credentials to be created, even though it's not strictly necessary for
process or session keyrings (they're shared).
(10) Usermode helper.
The usermode helper code now carries a cred struct pointer in its
subprocess_info struct instead of a new session keyring pointer. This set
of credentials is derived from init_cred and installed on the new process
after it has been cloned.
call_usermodehelper_setup() allocates the new credentials and
call_usermodehelper_freeinfo() discards them if they haven't been used. A
special cred function (prepare_usermodeinfo_creds()) is provided
specifically for call_usermodehelper_setup() to call.
call_usermodehelper_setkeys() adjusts the credentials to sport the
supplied keyring as the new session keyring.
(11) SELinux.
SELinux has a number of changes, in addition to those to support the LSM
interface changes mentioned above:
(a) selinux_setprocattr() no longer does its check for whether the
current ptracer can access processes with the new SID inside the lock
that covers getting the ptracer's SID. Whilst this lock ensures that
the check is done with the ptracer pinned, the result is only valid
until the lock is released, so there's no point doing it inside the
lock.
(12) is_single_threaded().
This function has been extracted from selinux_setprocattr() and put into
a file of its own in the lib/ directory as join_session_keyring() now
wants to use it too.
The code in SELinux just checked to see whether a task shared mm_structs
with other tasks (CLONE_VM), but that isn't good enough. We really want
to know if they're part of the same thread group (CLONE_THREAD).
(13) nfsd.
The NFS server daemon now has to use the COW credentials to set the
credentials it is going to use. It really needs to pass the credentials
down to the functions it calls, but it can't do that until other patches
in this series have been applied.
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: James Morris <jmorris@namei.org>
2008-11-13 23:39:23 +00:00
|
|
|
const struct cred *original_cred;
|
2012-11-26 13:16:25 +00:00
|
|
|
struct dentry *dir = nn->rec_file->f_path.dentry;
|
2013-05-23 02:22:04 +00:00
|
|
|
struct nfs4_dir_ctx ctx = {
|
|
|
|
|
.ctx.actor = nfsd4_build_namelist,
|
|
|
|
|
.names = LIST_HEAD_INIT(ctx.names)
|
|
|
|
|
};
|
2005-06-24 05:04:25 +00:00
|
|
|
int status;
|
|
|
|
|
|
CRED: Inaugurate COW credentials
Inaugurate copy-on-write credentials management. This uses RCU to manage the
credentials pointer in the task_struct with respect to accesses by other tasks.
A process may only modify its own credentials, and so does not need locking to
access or modify its own credentials.
A mutex (cred_replace_mutex) is added to the task_struct to control the effect
of PTRACE_ATTACHED on credential calculations, particularly with respect to
execve().
With this patch, the contents of an active credentials struct may not be
changed directly; rather a new set of credentials must be prepared, modified
and committed using something like the following sequence of events:
struct cred *new = prepare_creds();
int ret = blah(new);
if (ret < 0) {
abort_creds(new);
return ret;
}
return commit_creds(new);
There are some exceptions to this rule: the keyrings pointed to by the active
credentials may be instantiated - keyrings violate the COW rule as managing
COW keyrings is tricky, given that it is possible for a task to directly alter
the keys in a keyring in use by another task.
To help enforce this, various pointers to sets of credentials, such as those in
the task_struct, are declared const. The purpose of this is compile-time
discouragement of altering credentials through those pointers. Once a set of
credentials has been made public through one of these pointers, it may not be
modified, except under special circumstances:
(1) Its reference count may incremented and decremented.
(2) The keyrings to which it points may be modified, but not replaced.
The only safe way to modify anything else is to create a replacement and commit
using the functions described in Documentation/credentials.txt (which will be
added by a later patch).
This patch and the preceding patches have been tested with the LTP SELinux
testsuite.
This patch makes several logical sets of alteration:
(1) execve().
This now prepares and commits credentials in various places in the
security code rather than altering the current creds directly.
(2) Temporary credential overrides.
do_coredump() and sys_faccessat() now prepare their own credentials and
temporarily override the ones currently on the acting thread, whilst
preventing interference from other threads by holding cred_replace_mutex
on the thread being dumped.
This will be replaced in a future patch by something that hands down the
credentials directly to the functions being called, rather than altering
the task's objective credentials.
(3) LSM interface.
A number of functions have been changed, added or removed:
(*) security_capset_check(), ->capset_check()
(*) security_capset_set(), ->capset_set()
Removed in favour of security_capset().
(*) security_capset(), ->capset()
New. This is passed a pointer to the new creds, a pointer to the old
creds and the proposed capability sets. It should fill in the new
creds or return an error. All pointers, barring the pointer to the
new creds, are now const.
(*) security_bprm_apply_creds(), ->bprm_apply_creds()
Changed; now returns a value, which will cause the process to be
killed if it's an error.
(*) security_task_alloc(), ->task_alloc_security()
Removed in favour of security_prepare_creds().
(*) security_cred_free(), ->cred_free()
New. Free security data attached to cred->security.
(*) security_prepare_creds(), ->cred_prepare()
New. Duplicate any security data attached to cred->security.
(*) security_commit_creds(), ->cred_commit()
New. Apply any security effects for the upcoming installation of new
security by commit_creds().
(*) security_task_post_setuid(), ->task_post_setuid()
Removed in favour of security_task_fix_setuid().
(*) security_task_fix_setuid(), ->task_fix_setuid()
Fix up the proposed new credentials for setuid(). This is used by
cap_set_fix_setuid() to implicitly adjust capabilities in line with
setuid() changes. Changes are made to the new credentials, rather
than the task itself as in security_task_post_setuid().
(*) security_task_reparent_to_init(), ->task_reparent_to_init()
Removed. Instead the task being reparented to init is referred
directly to init's credentials.
NOTE! This results in the loss of some state: SELinux's osid no
longer records the sid of the thread that forked it.
(*) security_key_alloc(), ->key_alloc()
(*) security_key_permission(), ->key_permission()
Changed. These now take cred pointers rather than task pointers to
refer to the security context.
(4) sys_capset().
This has been simplified and uses less locking. The LSM functions it
calls have been merged.
(5) reparent_to_kthreadd().
This gives the current thread the same credentials as init by simply using
commit_thread() to point that way.
(6) __sigqueue_alloc() and switch_uid()
__sigqueue_alloc() can't stop the target task from changing its creds
beneath it, so this function gets a reference to the currently applicable
user_struct which it then passes into the sigqueue struct it returns if
successful.
switch_uid() is now called from commit_creds(), and possibly should be
folded into that. commit_creds() should take care of protecting
__sigqueue_alloc().
(7) [sg]et[ug]id() and co and [sg]et_current_groups.
The set functions now all use prepare_creds(), commit_creds() and
abort_creds() to build and check a new set of credentials before applying
it.
security_task_set[ug]id() is called inside the prepared section. This
guarantees that nothing else will affect the creds until we've finished.
The calling of set_dumpable() has been moved into commit_creds().
Much of the functionality of set_user() has been moved into
commit_creds().
The get functions all simply access the data directly.
(8) security_task_prctl() and cap_task_prctl().
security_task_prctl() has been modified to return -ENOSYS if it doesn't
want to handle a function, or otherwise return the return value directly
rather than through an argument.
Additionally, cap_task_prctl() now prepares a new set of credentials, even
if it doesn't end up using it.
(9) Keyrings.
A number of changes have been made to the keyrings code:
(a) switch_uid_keyring(), copy_keys(), exit_keys() and suid_keys() have
all been dropped and built in to the credentials functions directly.
They may want separating out again later.
(b) key_alloc() and search_process_keyrings() now take a cred pointer
rather than a task pointer to specify the security context.
(c) copy_creds() gives a new thread within the same thread group a new
thread keyring if its parent had one, otherwise it discards the thread
keyring.
(d) The authorisation key now points directly to the credentials to extend
the search into rather pointing to the task that carries them.
(e) Installing thread, process or session keyrings causes a new set of
credentials to be created, even though it's not strictly necessary for
process or session keyrings (they're shared).
(10) Usermode helper.
The usermode helper code now carries a cred struct pointer in its
subprocess_info struct instead of a new session keyring pointer. This set
of credentials is derived from init_cred and installed on the new process
after it has been cloned.
call_usermodehelper_setup() allocates the new credentials and
call_usermodehelper_freeinfo() discards them if they haven't been used. A
special cred function (prepare_usermodeinfo_creds()) is provided
specifically for call_usermodehelper_setup() to call.
call_usermodehelper_setkeys() adjusts the credentials to sport the
supplied keyring as the new session keyring.
(11) SELinux.
SELinux has a number of changes, in addition to those to support the LSM
interface changes mentioned above:
(a) selinux_setprocattr() no longer does its check for whether the
current ptracer can access processes with the new SID inside the lock
that covers getting the ptracer's SID. Whilst this lock ensures that
the check is done with the ptracer pinned, the result is only valid
until the lock is released, so there's no point doing it inside the
lock.
(12) is_single_threaded().
This function has been extracted from selinux_setprocattr() and put into
a file of its own in the lib/ directory as join_session_keyring() now
wants to use it too.
The code in SELinux just checked to see whether a task shared mm_structs
with other tasks (CLONE_VM), but that isn't good enough. We really want
to know if they're part of the same thread group (CLONE_THREAD).
(13) nfsd.
The NFS server daemon now has to use the COW credentials to set the
credentials it is going to use. It really needs to pass the credentials
down to the functions it calls, but it can't do that until other patches
in this series have been applied.
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: James Morris <jmorris@namei.org>
2008-11-13 23:39:23 +00:00
|
|
|
status = nfs4_save_creds(&original_cred);
|
|
|
|
|
if (status < 0)
|
|
|
|
|
return status;
|
2005-06-24 05:04:25 +00:00
|
|
|
|
2012-11-26 13:16:25 +00:00
|
|
|
status = vfs_llseek(nn->rec_file, 0, SEEK_SET);
|
2011-07-07 22:43:21 +00:00
|
|
|
if (status < 0) {
|
|
|
|
|
nfs4_reset_creds(original_cred);
|
|
|
|
|
return status;
|
|
|
|
|
}
|
|
|
|
|
|
2013-05-15 17:52:59 +00:00
|
|
|
status = iterate_dir(nn->rec_file, &ctx.ctx);
|
2009-05-11 20:10:19 +00:00
|
|
|
mutex_lock_nested(&dir->d_inode->i_mutex, I_MUTEX_PARENT);
|
2013-05-15 17:52:59 +00:00
|
|
|
while (!list_empty(&ctx.names)) {
|
2011-07-07 22:43:21 +00:00
|
|
|
struct name_list *entry;
|
2013-05-15 17:52:59 +00:00
|
|
|
entry = list_entry(ctx.names.next, struct name_list, list);
|
2011-07-07 22:43:21 +00:00
|
|
|
if (!status) {
|
|
|
|
|
struct dentry *dentry;
|
|
|
|
|
dentry = lookup_one_len(entry->name, dir, HEXDIR_LEN-1);
|
|
|
|
|
if (IS_ERR(dentry)) {
|
|
|
|
|
status = PTR_ERR(dentry);
|
|
|
|
|
break;
|
|
|
|
|
}
|
2012-11-14 15:21:16 +00:00
|
|
|
status = f(dir, dentry, nn);
|
2011-07-07 22:43:21 +00:00
|
|
|
dput(dentry);
|
2009-03-13 20:02:59 +00:00
|
|
|
}
|
|
|
|
|
list_del(&entry->list);
|
|
|
|
|
kfree(entry);
|
2005-06-24 05:04:25 +00:00
|
|
|
}
|
2009-04-20 22:18:37 +00:00
|
|
|
mutex_unlock(&dir->d_inode->i_mutex);
|
CRED: Inaugurate COW credentials
Inaugurate copy-on-write credentials management. This uses RCU to manage the
credentials pointer in the task_struct with respect to accesses by other tasks.
A process may only modify its own credentials, and so does not need locking to
access or modify its own credentials.
A mutex (cred_replace_mutex) is added to the task_struct to control the effect
of PTRACE_ATTACHED on credential calculations, particularly with respect to
execve().
With this patch, the contents of an active credentials struct may not be
changed directly; rather a new set of credentials must be prepared, modified
and committed using something like the following sequence of events:
struct cred *new = prepare_creds();
int ret = blah(new);
if (ret < 0) {
abort_creds(new);
return ret;
}
return commit_creds(new);
There are some exceptions to this rule: the keyrings pointed to by the active
credentials may be instantiated - keyrings violate the COW rule as managing
COW keyrings is tricky, given that it is possible for a task to directly alter
the keys in a keyring in use by another task.
To help enforce this, various pointers to sets of credentials, such as those in
the task_struct, are declared const. The purpose of this is compile-time
discouragement of altering credentials through those pointers. Once a set of
credentials has been made public through one of these pointers, it may not be
modified, except under special circumstances:
(1) Its reference count may incremented and decremented.
(2) The keyrings to which it points may be modified, but not replaced.
The only safe way to modify anything else is to create a replacement and commit
using the functions described in Documentation/credentials.txt (which will be
added by a later patch).
This patch and the preceding patches have been tested with the LTP SELinux
testsuite.
This patch makes several logical sets of alteration:
(1) execve().
This now prepares and commits credentials in various places in the
security code rather than altering the current creds directly.
(2) Temporary credential overrides.
do_coredump() and sys_faccessat() now prepare their own credentials and
temporarily override the ones currently on the acting thread, whilst
preventing interference from other threads by holding cred_replace_mutex
on the thread being dumped.
This will be replaced in a future patch by something that hands down the
credentials directly to the functions being called, rather than altering
the task's objective credentials.
(3) LSM interface.
A number of functions have been changed, added or removed:
(*) security_capset_check(), ->capset_check()
(*) security_capset_set(), ->capset_set()
Removed in favour of security_capset().
(*) security_capset(), ->capset()
New. This is passed a pointer to the new creds, a pointer to the old
creds and the proposed capability sets. It should fill in the new
creds or return an error. All pointers, barring the pointer to the
new creds, are now const.
(*) security_bprm_apply_creds(), ->bprm_apply_creds()
Changed; now returns a value, which will cause the process to be
killed if it's an error.
(*) security_task_alloc(), ->task_alloc_security()
Removed in favour of security_prepare_creds().
(*) security_cred_free(), ->cred_free()
New. Free security data attached to cred->security.
(*) security_prepare_creds(), ->cred_prepare()
New. Duplicate any security data attached to cred->security.
(*) security_commit_creds(), ->cred_commit()
New. Apply any security effects for the upcoming installation of new
security by commit_creds().
(*) security_task_post_setuid(), ->task_post_setuid()
Removed in favour of security_task_fix_setuid().
(*) security_task_fix_setuid(), ->task_fix_setuid()
Fix up the proposed new credentials for setuid(). This is used by
cap_set_fix_setuid() to implicitly adjust capabilities in line with
setuid() changes. Changes are made to the new credentials, rather
than the task itself as in security_task_post_setuid().
(*) security_task_reparent_to_init(), ->task_reparent_to_init()
Removed. Instead the task being reparented to init is referred
directly to init's credentials.
NOTE! This results in the loss of some state: SELinux's osid no
longer records the sid of the thread that forked it.
(*) security_key_alloc(), ->key_alloc()
(*) security_key_permission(), ->key_permission()
Changed. These now take cred pointers rather than task pointers to
refer to the security context.
(4) sys_capset().
This has been simplified and uses less locking. The LSM functions it
calls have been merged.
(5) reparent_to_kthreadd().
This gives the current thread the same credentials as init by simply using
commit_thread() to point that way.
(6) __sigqueue_alloc() and switch_uid()
__sigqueue_alloc() can't stop the target task from changing its creds
beneath it, so this function gets a reference to the currently applicable
user_struct which it then passes into the sigqueue struct it returns if
successful.
switch_uid() is now called from commit_creds(), and possibly should be
folded into that. commit_creds() should take care of protecting
__sigqueue_alloc().
(7) [sg]et[ug]id() and co and [sg]et_current_groups.
The set functions now all use prepare_creds(), commit_creds() and
abort_creds() to build and check a new set of credentials before applying
it.
security_task_set[ug]id() is called inside the prepared section. This
guarantees that nothing else will affect the creds until we've finished.
The calling of set_dumpable() has been moved into commit_creds().
Much of the functionality of set_user() has been moved into
commit_creds().
The get functions all simply access the data directly.
(8) security_task_prctl() and cap_task_prctl().
security_task_prctl() has been modified to return -ENOSYS if it doesn't
want to handle a function, or otherwise return the return value directly
rather than through an argument.
Additionally, cap_task_prctl() now prepares a new set of credentials, even
if it doesn't end up using it.
(9) Keyrings.
A number of changes have been made to the keyrings code:
(a) switch_uid_keyring(), copy_keys(), exit_keys() and suid_keys() have
all been dropped and built in to the credentials functions directly.
They may want separating out again later.
(b) key_alloc() and search_process_keyrings() now take a cred pointer
rather than a task pointer to specify the security context.
(c) copy_creds() gives a new thread within the same thread group a new
thread keyring if its parent had one, otherwise it discards the thread
keyring.
(d) The authorisation key now points directly to the credentials to extend
the search into rather pointing to the task that carries them.
(e) Installing thread, process or session keyrings causes a new set of
credentials to be created, even though it's not strictly necessary for
process or session keyrings (they're shared).
(10) Usermode helper.
The usermode helper code now carries a cred struct pointer in its
subprocess_info struct instead of a new session keyring pointer. This set
of credentials is derived from init_cred and installed on the new process
after it has been cloned.
call_usermodehelper_setup() allocates the new credentials and
call_usermodehelper_freeinfo() discards them if they haven't been used. A
special cred function (prepare_usermodeinfo_creds()) is provided
specifically for call_usermodehelper_setup() to call.
call_usermodehelper_setkeys() adjusts the credentials to sport the
supplied keyring as the new session keyring.
(11) SELinux.
SELinux has a number of changes, in addition to those to support the LSM
interface changes mentioned above:
(a) selinux_setprocattr() no longer does its check for whether the
current ptracer can access processes with the new SID inside the lock
that covers getting the ptracer's SID. Whilst this lock ensures that
the check is done with the ptracer pinned, the result is only valid
until the lock is released, so there's no point doing it inside the
lock.
(12) is_single_threaded().
This function has been extracted from selinux_setprocattr() and put into
a file of its own in the lib/ directory as join_session_keyring() now
wants to use it too.
The code in SELinux just checked to see whether a task shared mm_structs
with other tasks (CLONE_VM), but that isn't good enough. We really want
to know if they're part of the same thread group (CLONE_THREAD).
(13) nfsd.
The NFS server daemon now has to use the COW credentials to set the
credentials it is going to use. It really needs to pass the credentials
down to the functions it calls, but it can't do that until other patches
in this series have been applied.
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: James Morris <jmorris@namei.org>
2008-11-13 23:39:23 +00:00
|
|
|
nfs4_reset_creds(original_cred);
|
2005-06-24 05:04:25 +00:00
|
|
|
return status;
|
|
|
|
|
}
|
|
|
|
|
|
2005-06-24 05:04:30 +00:00
|
|
|
static int
|
2012-11-26 13:16:25 +00:00
|
|
|
nfsd4_unlink_clid_dir(char *name, int namlen, struct nfsd_net *nn)
|
2005-06-24 05:04:30 +00:00
|
|
|
{
|
2010-03-22 16:32:14 +00:00
|
|
|
struct dentry *dir, *dentry;
|
2005-06-24 05:04:30 +00:00
|
|
|
int status;
|
|
|
|
|
|
|
|
|
|
dprintk("NFSD: nfsd4_unlink_clid_dir. name %.*s\n", namlen, name);
|
|
|
|
|
|
2012-11-26 13:16:25 +00:00
|
|
|
dir = nn->rec_file->f_path.dentry;
|
2010-03-22 16:32:14 +00:00
|
|
|
mutex_lock_nested(&dir->d_inode->i_mutex, I_MUTEX_PARENT);
|
|
|
|
|
dentry = lookup_one_len(name, dir, namlen);
|
2005-06-24 05:04:30 +00:00
|
|
|
if (IS_ERR(dentry)) {
|
|
|
|
|
status = PTR_ERR(dentry);
|
2009-04-20 22:18:37 +00:00
|
|
|
goto out_unlock;
|
2005-06-24 05:04:30 +00:00
|
|
|
}
|
|
|
|
|
status = -ENOENT;
|
|
|
|
|
if (!dentry->d_inode)
|
|
|
|
|
goto out;
|
2010-03-22 16:32:14 +00:00
|
|
|
status = vfs_rmdir(dir->d_inode, dentry);
|
2005-06-24 05:04:30 +00:00
|
|
|
out:
|
|
|
|
|
dput(dentry);
|
2009-04-20 22:18:37 +00:00
|
|
|
out_unlock:
|
2010-03-22 16:32:14 +00:00
|
|
|
mutex_unlock(&dir->d_inode->i_mutex);
|
2005-06-24 05:04:30 +00:00
|
|
|
return status;
|
|
|
|
|
}
|
|
|
|
|
|
2012-03-21 20:42:43 +00:00
|
|
|
static void
|
2005-06-24 05:04:30 +00:00
|
|
|
nfsd4_remove_clid_dir(struct nfs4_client *clp)
|
|
|
|
|
{
|
CRED: Inaugurate COW credentials
Inaugurate copy-on-write credentials management. This uses RCU to manage the
credentials pointer in the task_struct with respect to accesses by other tasks.
A process may only modify its own credentials, and so does not need locking to
access or modify its own credentials.
A mutex (cred_replace_mutex) is added to the task_struct to control the effect
of PTRACE_ATTACHED on credential calculations, particularly with respect to
execve().
With this patch, the contents of an active credentials struct may not be
changed directly; rather a new set of credentials must be prepared, modified
and committed using something like the following sequence of events:
struct cred *new = prepare_creds();
int ret = blah(new);
if (ret < 0) {
abort_creds(new);
return ret;
}
return commit_creds(new);
There are some exceptions to this rule: the keyrings pointed to by the active
credentials may be instantiated - keyrings violate the COW rule as managing
COW keyrings is tricky, given that it is possible for a task to directly alter
the keys in a keyring in use by another task.
To help enforce this, various pointers to sets of credentials, such as those in
the task_struct, are declared const. The purpose of this is compile-time
discouragement of altering credentials through those pointers. Once a set of
credentials has been made public through one of these pointers, it may not be
modified, except under special circumstances:
(1) Its reference count may incremented and decremented.
(2) The keyrings to which it points may be modified, but not replaced.
The only safe way to modify anything else is to create a replacement and commit
using the functions described in Documentation/credentials.txt (which will be
added by a later patch).
This patch and the preceding patches have been tested with the LTP SELinux
testsuite.
This patch makes several logical sets of alteration:
(1) execve().
This now prepares and commits credentials in various places in the
security code rather than altering the current creds directly.
(2) Temporary credential overrides.
do_coredump() and sys_faccessat() now prepare their own credentials and
temporarily override the ones currently on the acting thread, whilst
preventing interference from other threads by holding cred_replace_mutex
on the thread being dumped.
This will be replaced in a future patch by something that hands down the
credentials directly to the functions being called, rather than altering
the task's objective credentials.
(3) LSM interface.
A number of functions have been changed, added or removed:
(*) security_capset_check(), ->capset_check()
(*) security_capset_set(), ->capset_set()
Removed in favour of security_capset().
(*) security_capset(), ->capset()
New. This is passed a pointer to the new creds, a pointer to the old
creds and the proposed capability sets. It should fill in the new
creds or return an error. All pointers, barring the pointer to the
new creds, are now const.
(*) security_bprm_apply_creds(), ->bprm_apply_creds()
Changed; now returns a value, which will cause the process to be
killed if it's an error.
(*) security_task_alloc(), ->task_alloc_security()
Removed in favour of security_prepare_creds().
(*) security_cred_free(), ->cred_free()
New. Free security data attached to cred->security.
(*) security_prepare_creds(), ->cred_prepare()
New. Duplicate any security data attached to cred->security.
(*) security_commit_creds(), ->cred_commit()
New. Apply any security effects for the upcoming installation of new
security by commit_creds().
(*) security_task_post_setuid(), ->task_post_setuid()
Removed in favour of security_task_fix_setuid().
(*) security_task_fix_setuid(), ->task_fix_setuid()
Fix up the proposed new credentials for setuid(). This is used by
cap_set_fix_setuid() to implicitly adjust capabilities in line with
setuid() changes. Changes are made to the new credentials, rather
than the task itself as in security_task_post_setuid().
(*) security_task_reparent_to_init(), ->task_reparent_to_init()
Removed. Instead the task being reparented to init is referred
directly to init's credentials.
NOTE! This results in the loss of some state: SELinux's osid no
longer records the sid of the thread that forked it.
(*) security_key_alloc(), ->key_alloc()
(*) security_key_permission(), ->key_permission()
Changed. These now take cred pointers rather than task pointers to
refer to the security context.
(4) sys_capset().
This has been simplified and uses less locking. The LSM functions it
calls have been merged.
(5) reparent_to_kthreadd().
This gives the current thread the same credentials as init by simply using
commit_thread() to point that way.
(6) __sigqueue_alloc() and switch_uid()
__sigqueue_alloc() can't stop the target task from changing its creds
beneath it, so this function gets a reference to the currently applicable
user_struct which it then passes into the sigqueue struct it returns if
successful.
switch_uid() is now called from commit_creds(), and possibly should be
folded into that. commit_creds() should take care of protecting
__sigqueue_alloc().
(7) [sg]et[ug]id() and co and [sg]et_current_groups.
The set functions now all use prepare_creds(), commit_creds() and
abort_creds() to build and check a new set of credentials before applying
it.
security_task_set[ug]id() is called inside the prepared section. This
guarantees that nothing else will affect the creds until we've finished.
The calling of set_dumpable() has been moved into commit_creds().
Much of the functionality of set_user() has been moved into
commit_creds().
The get functions all simply access the data directly.
(8) security_task_prctl() and cap_task_prctl().
security_task_prctl() has been modified to return -ENOSYS if it doesn't
want to handle a function, or otherwise return the return value directly
rather than through an argument.
Additionally, cap_task_prctl() now prepares a new set of credentials, even
if it doesn't end up using it.
(9) Keyrings.
A number of changes have been made to the keyrings code:
(a) switch_uid_keyring(), copy_keys(), exit_keys() and suid_keys() have
all been dropped and built in to the credentials functions directly.
They may want separating out again later.
(b) key_alloc() and search_process_keyrings() now take a cred pointer
rather than a task pointer to specify the security context.
(c) copy_creds() gives a new thread within the same thread group a new
thread keyring if its parent had one, otherwise it discards the thread
keyring.
(d) The authorisation key now points directly to the credentials to extend
the search into rather pointing to the task that carries them.
(e) Installing thread, process or session keyrings causes a new set of
credentials to be created, even though it's not strictly necessary for
process or session keyrings (they're shared).
(10) Usermode helper.
The usermode helper code now carries a cred struct pointer in its
subprocess_info struct instead of a new session keyring pointer. This set
of credentials is derived from init_cred and installed on the new process
after it has been cloned.
call_usermodehelper_setup() allocates the new credentials and
call_usermodehelper_freeinfo() discards them if they haven't been used. A
special cred function (prepare_usermodeinfo_creds()) is provided
specifically for call_usermodehelper_setup() to call.
call_usermodehelper_setkeys() adjusts the credentials to sport the
supplied keyring as the new session keyring.
(11) SELinux.
SELinux has a number of changes, in addition to those to support the LSM
interface changes mentioned above:
(a) selinux_setprocattr() no longer does its check for whether the
current ptracer can access processes with the new SID inside the lock
that covers getting the ptracer's SID. Whilst this lock ensures that
the check is done with the ptracer pinned, the result is only valid
until the lock is released, so there's no point doing it inside the
lock.
(12) is_single_threaded().
This function has been extracted from selinux_setprocattr() and put into
a file of its own in the lib/ directory as join_session_keyring() now
wants to use it too.
The code in SELinux just checked to see whether a task shared mm_structs
with other tasks (CLONE_VM), but that isn't good enough. We really want
to know if they're part of the same thread group (CLONE_THREAD).
(13) nfsd.
The NFS server daemon now has to use the COW credentials to set the
credentials it is going to use. It really needs to pass the credentials
down to the functions it calls, but it can't do that until other patches
in this series have been applied.
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: James Morris <jmorris@namei.org>
2008-11-13 23:39:23 +00:00
|
|
|
const struct cred *original_cred;
|
2012-11-12 20:00:55 +00:00
|
|
|
struct nfs4_client_reclaim *crp;
|
2012-11-12 20:00:57 +00:00
|
|
|
char dname[HEXDIR_LEN];
|
2005-06-24 05:04:30 +00:00
|
|
|
int status;
|
2012-11-14 15:21:16 +00:00
|
|
|
struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
|
2005-06-24 05:04:30 +00:00
|
|
|
|
2012-11-26 13:16:25 +00:00
|
|
|
if (!nn->rec_file || !test_bit(NFSD4_CLIENT_STABLE, &clp->cl_flags))
|
2005-06-24 05:04:30 +00:00
|
|
|
return;
|
|
|
|
|
|
2012-11-12 20:00:57 +00:00
|
|
|
status = nfs4_make_rec_clidname(dname, &clp->cl_name);
|
|
|
|
|
if (status)
|
2013-05-09 12:36:23 +00:00
|
|
|
return legacy_recdir_name_error(clp, status);
|
2012-11-12 20:00:57 +00:00
|
|
|
|
2012-11-26 13:16:25 +00:00
|
|
|
status = mnt_want_write_file(nn->rec_file);
|
2008-02-15 22:37:34 +00:00
|
|
|
if (status)
|
|
|
|
|
goto out;
|
2012-03-21 13:52:02 +00:00
|
|
|
clear_bit(NFSD4_CLIENT_STABLE, &clp->cl_flags);
|
CRED: Inaugurate COW credentials
Inaugurate copy-on-write credentials management. This uses RCU to manage the
credentials pointer in the task_struct with respect to accesses by other tasks.
A process may only modify its own credentials, and so does not need locking to
access or modify its own credentials.
A mutex (cred_replace_mutex) is added to the task_struct to control the effect
of PTRACE_ATTACHED on credential calculations, particularly with respect to
execve().
With this patch, the contents of an active credentials struct may not be
changed directly; rather a new set of credentials must be prepared, modified
and committed using something like the following sequence of events:
struct cred *new = prepare_creds();
int ret = blah(new);
if (ret < 0) {
abort_creds(new);
return ret;
}
return commit_creds(new);
There are some exceptions to this rule: the keyrings pointed to by the active
credentials may be instantiated - keyrings violate the COW rule as managing
COW keyrings is tricky, given that it is possible for a task to directly alter
the keys in a keyring in use by another task.
To help enforce this, various pointers to sets of credentials, such as those in
the task_struct, are declared const. The purpose of this is compile-time
discouragement of altering credentials through those pointers. Once a set of
credentials has been made public through one of these pointers, it may not be
modified, except under special circumstances:
(1) Its reference count may incremented and decremented.
(2) The keyrings to which it points may be modified, but not replaced.
The only safe way to modify anything else is to create a replacement and commit
using the functions described in Documentation/credentials.txt (which will be
added by a later patch).
This patch and the preceding patches have been tested with the LTP SELinux
testsuite.
This patch makes several logical sets of alteration:
(1) execve().
This now prepares and commits credentials in various places in the
security code rather than altering the current creds directly.
(2) Temporary credential overrides.
do_coredump() and sys_faccessat() now prepare their own credentials and
temporarily override the ones currently on the acting thread, whilst
preventing interference from other threads by holding cred_replace_mutex
on the thread being dumped.
This will be replaced in a future patch by something that hands down the
credentials directly to the functions being called, rather than altering
the task's objective credentials.
(3) LSM interface.
A number of functions have been changed, added or removed:
(*) security_capset_check(), ->capset_check()
(*) security_capset_set(), ->capset_set()
Removed in favour of security_capset().
(*) security_capset(), ->capset()
New. This is passed a pointer to the new creds, a pointer to the old
creds and the proposed capability sets. It should fill in the new
creds or return an error. All pointers, barring the pointer to the
new creds, are now const.
(*) security_bprm_apply_creds(), ->bprm_apply_creds()
Changed; now returns a value, which will cause the process to be
killed if it's an error.
(*) security_task_alloc(), ->task_alloc_security()
Removed in favour of security_prepare_creds().
(*) security_cred_free(), ->cred_free()
New. Free security data attached to cred->security.
(*) security_prepare_creds(), ->cred_prepare()
New. Duplicate any security data attached to cred->security.
(*) security_commit_creds(), ->cred_commit()
New. Apply any security effects for the upcoming installation of new
security by commit_creds().
(*) security_task_post_setuid(), ->task_post_setuid()
Removed in favour of security_task_fix_setuid().
(*) security_task_fix_setuid(), ->task_fix_setuid()
Fix up the proposed new credentials for setuid(). This is used by
cap_set_fix_setuid() to implicitly adjust capabilities in line with
setuid() changes. Changes are made to the new credentials, rather
than the task itself as in security_task_post_setuid().
(*) security_task_reparent_to_init(), ->task_reparent_to_init()
Removed. Instead the task being reparented to init is referred
directly to init's credentials.
NOTE! This results in the loss of some state: SELinux's osid no
longer records the sid of the thread that forked it.
(*) security_key_alloc(), ->key_alloc()
(*) security_key_permission(), ->key_permission()
Changed. These now take cred pointers rather than task pointers to
refer to the security context.
(4) sys_capset().
This has been simplified and uses less locking. The LSM functions it
calls have been merged.
(5) reparent_to_kthreadd().
This gives the current thread the same credentials as init by simply using
commit_thread() to point that way.
(6) __sigqueue_alloc() and switch_uid()
__sigqueue_alloc() can't stop the target task from changing its creds
beneath it, so this function gets a reference to the currently applicable
user_struct which it then passes into the sigqueue struct it returns if
successful.
switch_uid() is now called from commit_creds(), and possibly should be
folded into that. commit_creds() should take care of protecting
__sigqueue_alloc().
(7) [sg]et[ug]id() and co and [sg]et_current_groups.
The set functions now all use prepare_creds(), commit_creds() and
abort_creds() to build and check a new set of credentials before applying
it.
security_task_set[ug]id() is called inside the prepared section. This
guarantees that nothing else will affect the creds until we've finished.
The calling of set_dumpable() has been moved into commit_creds().
Much of the functionality of set_user() has been moved into
commit_creds().
The get functions all simply access the data directly.
(8) security_task_prctl() and cap_task_prctl().
security_task_prctl() has been modified to return -ENOSYS if it doesn't
want to handle a function, or otherwise return the return value directly
rather than through an argument.
Additionally, cap_task_prctl() now prepares a new set of credentials, even
if it doesn't end up using it.
(9) Keyrings.
A number of changes have been made to the keyrings code:
(a) switch_uid_keyring(), copy_keys(), exit_keys() and suid_keys() have
all been dropped and built in to the credentials functions directly.
They may want separating out again later.
(b) key_alloc() and search_process_keyrings() now take a cred pointer
rather than a task pointer to specify the security context.
(c) copy_creds() gives a new thread within the same thread group a new
thread keyring if its parent had one, otherwise it discards the thread
keyring.
(d) The authorisation key now points directly to the credentials to extend
the search into rather pointing to the task that carries them.
(e) Installing thread, process or session keyrings causes a new set of
credentials to be created, even though it's not strictly necessary for
process or session keyrings (they're shared).
(10) Usermode helper.
The usermode helper code now carries a cred struct pointer in its
subprocess_info struct instead of a new session keyring pointer. This set
of credentials is derived from init_cred and installed on the new process
after it has been cloned.
call_usermodehelper_setup() allocates the new credentials and
call_usermodehelper_freeinfo() discards them if they haven't been used. A
special cred function (prepare_usermodeinfo_creds()) is provided
specifically for call_usermodehelper_setup() to call.
call_usermodehelper_setkeys() adjusts the credentials to sport the
supplied keyring as the new session keyring.
(11) SELinux.
SELinux has a number of changes, in addition to those to support the LSM
interface changes mentioned above:
(a) selinux_setprocattr() no longer does its check for whether the
current ptracer can access processes with the new SID inside the lock
that covers getting the ptracer's SID. Whilst this lock ensures that
the check is done with the ptracer pinned, the result is only valid
until the lock is released, so there's no point doing it inside the
lock.
(12) is_single_threaded().
This function has been extracted from selinux_setprocattr() and put into
a file of its own in the lib/ directory as join_session_keyring() now
wants to use it too.
The code in SELinux just checked to see whether a task shared mm_structs
with other tasks (CLONE_VM), but that isn't good enough. We really want
to know if they're part of the same thread group (CLONE_THREAD).
(13) nfsd.
The NFS server daemon now has to use the COW credentials to set the
credentials it is going to use. It really needs to pass the credentials
down to the functions it calls, but it can't do that until other patches
in this series have been applied.
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: James Morris <jmorris@namei.org>
2008-11-13 23:39:23 +00:00
|
|
|
|
|
|
|
|
status = nfs4_save_creds(&original_cred);
|
|
|
|
|
if (status < 0)
|
2012-11-09 20:31:53 +00:00
|
|
|
goto out_drop_write;
|
CRED: Inaugurate COW credentials
Inaugurate copy-on-write credentials management. This uses RCU to manage the
credentials pointer in the task_struct with respect to accesses by other tasks.
A process may only modify its own credentials, and so does not need locking to
access or modify its own credentials.
A mutex (cred_replace_mutex) is added to the task_struct to control the effect
of PTRACE_ATTACHED on credential calculations, particularly with respect to
execve().
With this patch, the contents of an active credentials struct may not be
changed directly; rather a new set of credentials must be prepared, modified
and committed using something like the following sequence of events:
struct cred *new = prepare_creds();
int ret = blah(new);
if (ret < 0) {
abort_creds(new);
return ret;
}
return commit_creds(new);
There are some exceptions to this rule: the keyrings pointed to by the active
credentials may be instantiated - keyrings violate the COW rule as managing
COW keyrings is tricky, given that it is possible for a task to directly alter
the keys in a keyring in use by another task.
To help enforce this, various pointers to sets of credentials, such as those in
the task_struct, are declared const. The purpose of this is compile-time
discouragement of altering credentials through those pointers. Once a set of
credentials has been made public through one of these pointers, it may not be
modified, except under special circumstances:
(1) Its reference count may incremented and decremented.
(2) The keyrings to which it points may be modified, but not replaced.
The only safe way to modify anything else is to create a replacement and commit
using the functions described in Documentation/credentials.txt (which will be
added by a later patch).
This patch and the preceding patches have been tested with the LTP SELinux
testsuite.
This patch makes several logical sets of alteration:
(1) execve().
This now prepares and commits credentials in various places in the
security code rather than altering the current creds directly.
(2) Temporary credential overrides.
do_coredump() and sys_faccessat() now prepare their own credentials and
temporarily override the ones currently on the acting thread, whilst
preventing interference from other threads by holding cred_replace_mutex
on the thread being dumped.
This will be replaced in a future patch by something that hands down the
credentials directly to the functions being called, rather than altering
the task's objective credentials.
(3) LSM interface.
A number of functions have been changed, added or removed:
(*) security_capset_check(), ->capset_check()
(*) security_capset_set(), ->capset_set()
Removed in favour of security_capset().
(*) security_capset(), ->capset()
New. This is passed a pointer to the new creds, a pointer to the old
creds and the proposed capability sets. It should fill in the new
creds or return an error. All pointers, barring the pointer to the
new creds, are now const.
(*) security_bprm_apply_creds(), ->bprm_apply_creds()
Changed; now returns a value, which will cause the process to be
killed if it's an error.
(*) security_task_alloc(), ->task_alloc_security()
Removed in favour of security_prepare_creds().
(*) security_cred_free(), ->cred_free()
New. Free security data attached to cred->security.
(*) security_prepare_creds(), ->cred_prepare()
New. Duplicate any security data attached to cred->security.
(*) security_commit_creds(), ->cred_commit()
New. Apply any security effects for the upcoming installation of new
security by commit_creds().
(*) security_task_post_setuid(), ->task_post_setuid()
Removed in favour of security_task_fix_setuid().
(*) security_task_fix_setuid(), ->task_fix_setuid()
Fix up the proposed new credentials for setuid(). This is used by
cap_set_fix_setuid() to implicitly adjust capabilities in line with
setuid() changes. Changes are made to the new credentials, rather
than the task itself as in security_task_post_setuid().
(*) security_task_reparent_to_init(), ->task_reparent_to_init()
Removed. Instead the task being reparented to init is referred
directly to init's credentials.
NOTE! This results in the loss of some state: SELinux's osid no
longer records the sid of the thread that forked it.
(*) security_key_alloc(), ->key_alloc()
(*) security_key_permission(), ->key_permission()
Changed. These now take cred pointers rather than task pointers to
refer to the security context.
(4) sys_capset().
This has been simplified and uses less locking. The LSM functions it
calls have been merged.
(5) reparent_to_kthreadd().
This gives the current thread the same credentials as init by simply using
commit_thread() to point that way.
(6) __sigqueue_alloc() and switch_uid()
__sigqueue_alloc() can't stop the target task from changing its creds
beneath it, so this function gets a reference to the currently applicable
user_struct which it then passes into the sigqueue struct it returns if
successful.
switch_uid() is now called from commit_creds(), and possibly should be
folded into that. commit_creds() should take care of protecting
__sigqueue_alloc().
(7) [sg]et[ug]id() and co and [sg]et_current_groups.
The set functions now all use prepare_creds(), commit_creds() and
abort_creds() to build and check a new set of credentials before applying
it.
security_task_set[ug]id() is called inside the prepared section. This
guarantees that nothing else will affect the creds until we've finished.
The calling of set_dumpable() has been moved into commit_creds().
Much of the functionality of set_user() has been moved into
commit_creds().
The get functions all simply access the data directly.
(8) security_task_prctl() and cap_task_prctl().
security_task_prctl() has been modified to return -ENOSYS if it doesn't
want to handle a function, or otherwise return the return value directly
rather than through an argument.
Additionally, cap_task_prctl() now prepares a new set of credentials, even
if it doesn't end up using it.
(9) Keyrings.
A number of changes have been made to the keyrings code:
(a) switch_uid_keyring(), copy_keys(), exit_keys() and suid_keys() have
all been dropped and built in to the credentials functions directly.
They may want separating out again later.
(b) key_alloc() and search_process_keyrings() now take a cred pointer
rather than a task pointer to specify the security context.
(c) copy_creds() gives a new thread within the same thread group a new
thread keyring if its parent had one, otherwise it discards the thread
keyring.
(d) The authorisation key now points directly to the credentials to extend
the search into rather pointing to the task that carries them.
(e) Installing thread, process or session keyrings causes a new set of
credentials to be created, even though it's not strictly necessary for
process or session keyrings (they're shared).
(10) Usermode helper.
The usermode helper code now carries a cred struct pointer in its
subprocess_info struct instead of a new session keyring pointer. This set
of credentials is derived from init_cred and installed on the new process
after it has been cloned.
call_usermodehelper_setup() allocates the new credentials and
call_usermodehelper_freeinfo() discards them if they haven't been used. A
special cred function (prepare_usermodeinfo_creds()) is provided
specifically for call_usermodehelper_setup() to call.
call_usermodehelper_setkeys() adjusts the credentials to sport the
supplied keyring as the new session keyring.
(11) SELinux.
SELinux has a number of changes, in addition to those to support the LSM
interface changes mentioned above:
(a) selinux_setprocattr() no longer does its check for whether the
current ptracer can access processes with the new SID inside the lock
that covers getting the ptracer's SID. Whilst this lock ensures that
the check is done with the ptracer pinned, the result is only valid
until the lock is released, so there's no point doing it inside the
lock.
(12) is_single_threaded().
This function has been extracted from selinux_setprocattr() and put into
a file of its own in the lib/ directory as join_session_keyring() now
wants to use it too.
The code in SELinux just checked to see whether a task shared mm_structs
with other tasks (CLONE_VM), but that isn't good enough. We really want
to know if they're part of the same thread group (CLONE_THREAD).
(13) nfsd.
The NFS server daemon now has to use the COW credentials to set the
credentials it is going to use. It really needs to pass the credentials
down to the functions it calls, but it can't do that until other patches
in this series have been applied.
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: James Morris <jmorris@namei.org>
2008-11-13 23:39:23 +00:00
|
|
|
|
2012-11-26 13:16:25 +00:00
|
|
|
status = nfsd4_unlink_clid_dir(dname, HEXDIR_LEN-1, nn);
|
CRED: Inaugurate COW credentials
Inaugurate copy-on-write credentials management. This uses RCU to manage the
credentials pointer in the task_struct with respect to accesses by other tasks.
A process may only modify its own credentials, and so does not need locking to
access or modify its own credentials.
A mutex (cred_replace_mutex) is added to the task_struct to control the effect
of PTRACE_ATTACHED on credential calculations, particularly with respect to
execve().
With this patch, the contents of an active credentials struct may not be
changed directly; rather a new set of credentials must be prepared, modified
and committed using something like the following sequence of events:
struct cred *new = prepare_creds();
int ret = blah(new);
if (ret < 0) {
abort_creds(new);
return ret;
}
return commit_creds(new);
There are some exceptions to this rule: the keyrings pointed to by the active
credentials may be instantiated - keyrings violate the COW rule as managing
COW keyrings is tricky, given that it is possible for a task to directly alter
the keys in a keyring in use by another task.
To help enforce this, various pointers to sets of credentials, such as those in
the task_struct, are declared const. The purpose of this is compile-time
discouragement of altering credentials through those pointers. Once a set of
credentials has been made public through one of these pointers, it may not be
modified, except under special circumstances:
(1) Its reference count may incremented and decremented.
(2) The keyrings to which it points may be modified, but not replaced.
The only safe way to modify anything else is to create a replacement and commit
using the functions described in Documentation/credentials.txt (which will be
added by a later patch).
This patch and the preceding patches have been tested with the LTP SELinux
testsuite.
This patch makes several logical sets of alteration:
(1) execve().
This now prepares and commits credentials in various places in the
security code rather than altering the current creds directly.
(2) Temporary credential overrides.
do_coredump() and sys_faccessat() now prepare their own credentials and
temporarily override the ones currently on the acting thread, whilst
preventing interference from other threads by holding cred_replace_mutex
on the thread being dumped.
This will be replaced in a future patch by something that hands down the
credentials directly to the functions being called, rather than altering
the task's objective credentials.
(3) LSM interface.
A number of functions have been changed, added or removed:
(*) security_capset_check(), ->capset_check()
(*) security_capset_set(), ->capset_set()
Removed in favour of security_capset().
(*) security_capset(), ->capset()
New. This is passed a pointer to the new creds, a pointer to the old
creds and the proposed capability sets. It should fill in the new
creds or return an error. All pointers, barring the pointer to the
new creds, are now const.
(*) security_bprm_apply_creds(), ->bprm_apply_creds()
Changed; now returns a value, which will cause the process to be
killed if it's an error.
(*) security_task_alloc(), ->task_alloc_security()
Removed in favour of security_prepare_creds().
(*) security_cred_free(), ->cred_free()
New. Free security data attached to cred->security.
(*) security_prepare_creds(), ->cred_prepare()
New. Duplicate any security data attached to cred->security.
(*) security_commit_creds(), ->cred_commit()
New. Apply any security effects for the upcoming installation of new
security by commit_creds().
(*) security_task_post_setuid(), ->task_post_setuid()
Removed in favour of security_task_fix_setuid().
(*) security_task_fix_setuid(), ->task_fix_setuid()
Fix up the proposed new credentials for setuid(). This is used by
cap_set_fix_setuid() to implicitly adjust capabilities in line with
setuid() changes. Changes are made to the new credentials, rather
than the task itself as in security_task_post_setuid().
(*) security_task_reparent_to_init(), ->task_reparent_to_init()
Removed. Instead the task being reparented to init is referred
directly to init's credentials.
NOTE! This results in the loss of some state: SELinux's osid no
longer records the sid of the thread that forked it.
(*) security_key_alloc(), ->key_alloc()
(*) security_key_permission(), ->key_permission()
Changed. These now take cred pointers rather than task pointers to
refer to the security context.
(4) sys_capset().
This has been simplified and uses less locking. The LSM functions it
calls have been merged.
(5) reparent_to_kthreadd().
This gives the current thread the same credentials as init by simply using
commit_thread() to point that way.
(6) __sigqueue_alloc() and switch_uid()
__sigqueue_alloc() can't stop the target task from changing its creds
beneath it, so this function gets a reference to the currently applicable
user_struct which it then passes into the sigqueue struct it returns if
successful.
switch_uid() is now called from commit_creds(), and possibly should be
folded into that. commit_creds() should take care of protecting
__sigqueue_alloc().
(7) [sg]et[ug]id() and co and [sg]et_current_groups.
The set functions now all use prepare_creds(), commit_creds() and
abort_creds() to build and check a new set of credentials before applying
it.
security_task_set[ug]id() is called inside the prepared section. This
guarantees that nothing else will affect the creds until we've finished.
The calling of set_dumpable() has been moved into commit_creds().
Much of the functionality of set_user() has been moved into
commit_creds().
The get functions all simply access the data directly.
(8) security_task_prctl() and cap_task_prctl().
security_task_prctl() has been modified to return -ENOSYS if it doesn't
want to handle a function, or otherwise return the return value directly
rather than through an argument.
Additionally, cap_task_prctl() now prepares a new set of credentials, even
if it doesn't end up using it.
(9) Keyrings.
A number of changes have been made to the keyrings code:
(a) switch_uid_keyring(), copy_keys(), exit_keys() and suid_keys() have
all been dropped and built in to the credentials functions directly.
They may want separating out again later.
(b) key_alloc() and search_process_keyrings() now take a cred pointer
rather than a task pointer to specify the security context.
(c) copy_creds() gives a new thread within the same thread group a new
thread keyring if its parent had one, otherwise it discards the thread
keyring.
(d) The authorisation key now points directly to the credentials to extend
the search into rather pointing to the task that carries them.
(e) Installing thread, process or session keyrings causes a new set of
credentials to be created, even though it's not strictly necessary for
process or session keyrings (they're shared).
(10) Usermode helper.
The usermode helper code now carries a cred struct pointer in its
subprocess_info struct instead of a new session keyring pointer. This set
of credentials is derived from init_cred and installed on the new process
after it has been cloned.
call_usermodehelper_setup() allocates the new credentials and
call_usermodehelper_freeinfo() discards them if they haven't been used. A
special cred function (prepare_usermodeinfo_creds()) is provided
specifically for call_usermodehelper_setup() to call.
call_usermodehelper_setkeys() adjusts the credentials to sport the
supplied keyring as the new session keyring.
(11) SELinux.
SELinux has a number of changes, in addition to those to support the LSM
interface changes mentioned above:
(a) selinux_setprocattr() no longer does its check for whether the
current ptracer can access processes with the new SID inside the lock
that covers getting the ptracer's SID. Whilst this lock ensures that
the check is done with the ptracer pinned, the result is only valid
until the lock is released, so there's no point doing it inside the
lock.
(12) is_single_threaded().
This function has been extracted from selinux_setprocattr() and put into
a file of its own in the lib/ directory as join_session_keyring() now
wants to use it too.
The code in SELinux just checked to see whether a task shared mm_structs
with other tasks (CLONE_VM), but that isn't good enough. We really want
to know if they're part of the same thread group (CLONE_THREAD).
(13) nfsd.
The NFS server daemon now has to use the COW credentials to set the
credentials it is going to use. It really needs to pass the credentials
down to the functions it calls, but it can't do that until other patches
in this series have been applied.
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: James Morris <jmorris@namei.org>
2008-11-13 23:39:23 +00:00
|
|
|
nfs4_reset_creds(original_cred);
|
2012-11-12 20:00:55 +00:00
|
|
|
if (status == 0) {
|
2012-11-26 13:16:25 +00:00
|
|
|
vfs_fsync(nn->rec_file, 0);
|
2012-11-26 13:16:30 +00:00
|
|
|
if (nn->in_grace) {
|
2012-11-12 20:00:55 +00:00
|
|
|
/* remove reclaim record */
|
2012-11-14 15:21:16 +00:00
|
|
|
crp = nfsd4_find_reclaim_client(dname, nn);
|
2012-11-12 20:00:55 +00:00
|
|
|
if (crp)
|
2012-11-14 15:21:16 +00:00
|
|
|
nfs4_remove_reclaim_record(crp, nn);
|
2012-11-12 20:00:55 +00:00
|
|
|
}
|
|
|
|
|
}
|
2012-11-09 20:31:53 +00:00
|
|
|
out_drop_write:
|
2012-11-26 13:16:25 +00:00
|
|
|
mnt_drop_write_file(nn->rec_file);
|
2008-02-15 22:37:34 +00:00
|
|
|
out:
|
2005-06-24 05:04:30 +00:00
|
|
|
if (status)
|
|
|
|
|
printk("NFSD: Failed to remove expired client state directory"
|
2012-11-12 20:00:57 +00:00
|
|
|
" %.*s\n", HEXDIR_LEN, dname);
|
2005-06-24 05:04:30 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int
|
2012-11-14 15:21:16 +00:00
|
|
|
purge_old(struct dentry *parent, struct dentry *child, struct nfsd_net *nn)
|
2005-06-24 05:04:30 +00:00
|
|
|
{
|
|
|
|
|
int status;
|
|
|
|
|
|
2012-11-14 15:21:16 +00:00
|
|
|
if (nfs4_has_reclaimed_state(child->d_name.name, nn))
|
2006-10-20 06:28:59 +00:00
|
|
|
return 0;
|
2005-06-24 05:04:30 +00:00
|
|
|
|
2009-04-20 22:18:37 +00:00
|
|
|
status = vfs_rmdir(parent->d_inode, child);
|
2005-06-24 05:04:30 +00:00
|
|
|
if (status)
|
2013-09-16 14:57:01 +00:00
|
|
|
printk("failed to remove client recovery directory %pd\n",
|
|
|
|
|
child);
|
2005-06-24 05:04:30 +00:00
|
|
|
/* Keep trying, success or failure: */
|
2006-10-20 06:28:59 +00:00
|
|
|
return 0;
|
2005-06-24 05:04:30 +00:00
|
|
|
}
|
|
|
|
|
|
2012-03-21 20:42:43 +00:00
|
|
|
static void
|
2014-09-12 20:40:20 +00:00
|
|
|
nfsd4_recdir_purge_old(struct nfsd_net *nn)
|
2012-03-21 20:42:43 +00:00
|
|
|
{
|
2005-06-24 05:04:30 +00:00
|
|
|
int status;
|
|
|
|
|
|
2012-11-26 13:16:30 +00:00
|
|
|
nn->in_grace = false;
|
2012-11-26 13:16:25 +00:00
|
|
|
if (!nn->rec_file)
|
2005-06-24 05:04:30 +00:00
|
|
|
return;
|
2012-11-26 13:16:25 +00:00
|
|
|
status = mnt_want_write_file(nn->rec_file);
|
2008-02-15 22:37:34 +00:00
|
|
|
if (status)
|
|
|
|
|
goto out;
|
2012-11-14 15:21:16 +00:00
|
|
|
status = nfsd4_list_rec_dir(purge_old, nn);
|
2005-06-24 05:04:30 +00:00
|
|
|
if (status == 0)
|
2012-11-26 13:16:25 +00:00
|
|
|
vfs_fsync(nn->rec_file, 0);
|
|
|
|
|
mnt_drop_write_file(nn->rec_file);
|
2008-02-15 22:37:34 +00:00
|
|
|
out:
|
2012-11-14 15:21:16 +00:00
|
|
|
nfs4_release_reclaim(nn);
|
2005-06-24 05:04:30 +00:00
|
|
|
if (status)
|
|
|
|
|
printk("nfsd4: failed to purge old clients from recovery"
|
2013-09-16 14:57:01 +00:00
|
|
|
" directory %pD\n", nn->rec_file);
|
2005-06-24 05:04:30 +00:00
|
|
|
}
|
|
|
|
|
|
2005-06-24 05:04:25 +00:00
|
|
|
static int
|
2012-11-14 15:21:16 +00:00
|
|
|
load_recdir(struct dentry *parent, struct dentry *child, struct nfsd_net *nn)
|
2005-06-24 05:04:25 +00:00
|
|
|
{
|
|
|
|
|
if (child->d_name.len != HEXDIR_LEN - 1) {
|
2013-09-16 14:57:01 +00:00
|
|
|
printk("nfsd4: illegal name %pd in recovery directory\n",
|
|
|
|
|
child);
|
2005-06-24 05:04:25 +00:00
|
|
|
/* Keep trying; maybe the others are OK: */
|
2006-10-20 06:28:59 +00:00
|
|
|
return 0;
|
2005-06-24 05:04:25 +00:00
|
|
|
}
|
2012-11-14 15:21:16 +00:00
|
|
|
nfs4_client_to_reclaim(child->d_name.name, nn);
|
2006-10-20 06:28:59 +00:00
|
|
|
return 0;
|
2005-06-24 05:04:25 +00:00
|
|
|
}
|
|
|
|
|
|
2012-03-21 20:42:43 +00:00
|
|
|
static int
|
2012-11-14 15:21:16 +00:00
|
|
|
nfsd4_recdir_load(struct net *net) {
|
2005-06-24 05:04:25 +00:00
|
|
|
int status;
|
2012-11-14 15:21:16 +00:00
|
|
|
struct nfsd_net *nn = net_generic(net, nfsd_net_id);
|
2005-06-24 05:04:25 +00:00
|
|
|
|
2012-11-26 13:16:25 +00:00
|
|
|
if (!nn->rec_file)
|
2010-03-22 16:32:14 +00:00
|
|
|
return 0;
|
|
|
|
|
|
2012-11-14 15:21:16 +00:00
|
|
|
status = nfsd4_list_rec_dir(load_recdir, nn);
|
2005-06-24 05:04:25 +00:00
|
|
|
if (status)
|
|
|
|
|
printk("nfsd4: failed loading clients from recovery"
|
2013-09-16 14:57:01 +00:00
|
|
|
" directory %pD\n", nn->rec_file);
|
2005-06-24 05:04:25 +00:00
|
|
|
return status;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* Hold reference to the recovery directory.
|
|
|
|
|
*/
|
|
|
|
|
|
2012-03-21 20:42:43 +00:00
|
|
|
static int
|
2012-11-26 13:16:25 +00:00
|
|
|
nfsd4_init_recdir(struct net *net)
|
2005-06-24 05:04:25 +00:00
|
|
|
{
|
2012-11-26 13:16:25 +00:00
|
|
|
struct nfsd_net *nn = net_generic(net, nfsd_net_id);
|
CRED: Inaugurate COW credentials
Inaugurate copy-on-write credentials management. This uses RCU to manage the
credentials pointer in the task_struct with respect to accesses by other tasks.
A process may only modify its own credentials, and so does not need locking to
access or modify its own credentials.
A mutex (cred_replace_mutex) is added to the task_struct to control the effect
of PTRACE_ATTACHED on credential calculations, particularly with respect to
execve().
With this patch, the contents of an active credentials struct may not be
changed directly; rather a new set of credentials must be prepared, modified
and committed using something like the following sequence of events:
struct cred *new = prepare_creds();
int ret = blah(new);
if (ret < 0) {
abort_creds(new);
return ret;
}
return commit_creds(new);
There are some exceptions to this rule: the keyrings pointed to by the active
credentials may be instantiated - keyrings violate the COW rule as managing
COW keyrings is tricky, given that it is possible for a task to directly alter
the keys in a keyring in use by another task.
To help enforce this, various pointers to sets of credentials, such as those in
the task_struct, are declared const. The purpose of this is compile-time
discouragement of altering credentials through those pointers. Once a set of
credentials has been made public through one of these pointers, it may not be
modified, except under special circumstances:
(1) Its reference count may incremented and decremented.
(2) The keyrings to which it points may be modified, but not replaced.
The only safe way to modify anything else is to create a replacement and commit
using the functions described in Documentation/credentials.txt (which will be
added by a later patch).
This patch and the preceding patches have been tested with the LTP SELinux
testsuite.
This patch makes several logical sets of alteration:
(1) execve().
This now prepares and commits credentials in various places in the
security code rather than altering the current creds directly.
(2) Temporary credential overrides.
do_coredump() and sys_faccessat() now prepare their own credentials and
temporarily override the ones currently on the acting thread, whilst
preventing interference from other threads by holding cred_replace_mutex
on the thread being dumped.
This will be replaced in a future patch by something that hands down the
credentials directly to the functions being called, rather than altering
the task's objective credentials.
(3) LSM interface.
A number of functions have been changed, added or removed:
(*) security_capset_check(), ->capset_check()
(*) security_capset_set(), ->capset_set()
Removed in favour of security_capset().
(*) security_capset(), ->capset()
New. This is passed a pointer to the new creds, a pointer to the old
creds and the proposed capability sets. It should fill in the new
creds or return an error. All pointers, barring the pointer to the
new creds, are now const.
(*) security_bprm_apply_creds(), ->bprm_apply_creds()
Changed; now returns a value, which will cause the process to be
killed if it's an error.
(*) security_task_alloc(), ->task_alloc_security()
Removed in favour of security_prepare_creds().
(*) security_cred_free(), ->cred_free()
New. Free security data attached to cred->security.
(*) security_prepare_creds(), ->cred_prepare()
New. Duplicate any security data attached to cred->security.
(*) security_commit_creds(), ->cred_commit()
New. Apply any security effects for the upcoming installation of new
security by commit_creds().
(*) security_task_post_setuid(), ->task_post_setuid()
Removed in favour of security_task_fix_setuid().
(*) security_task_fix_setuid(), ->task_fix_setuid()
Fix up the proposed new credentials for setuid(). This is used by
cap_set_fix_setuid() to implicitly adjust capabilities in line with
setuid() changes. Changes are made to the new credentials, rather
than the task itself as in security_task_post_setuid().
(*) security_task_reparent_to_init(), ->task_reparent_to_init()
Removed. Instead the task being reparented to init is referred
directly to init's credentials.
NOTE! This results in the loss of some state: SELinux's osid no
longer records the sid of the thread that forked it.
(*) security_key_alloc(), ->key_alloc()
(*) security_key_permission(), ->key_permission()
Changed. These now take cred pointers rather than task pointers to
refer to the security context.
(4) sys_capset().
This has been simplified and uses less locking. The LSM functions it
calls have been merged.
(5) reparent_to_kthreadd().
This gives the current thread the same credentials as init by simply using
commit_thread() to point that way.
(6) __sigqueue_alloc() and switch_uid()
__sigqueue_alloc() can't stop the target task from changing its creds
beneath it, so this function gets a reference to the currently applicable
user_struct which it then passes into the sigqueue struct it returns if
successful.
switch_uid() is now called from commit_creds(), and possibly should be
folded into that. commit_creds() should take care of protecting
__sigqueue_alloc().
(7) [sg]et[ug]id() and co and [sg]et_current_groups.
The set functions now all use prepare_creds(), commit_creds() and
abort_creds() to build and check a new set of credentials before applying
it.
security_task_set[ug]id() is called inside the prepared section. This
guarantees that nothing else will affect the creds until we've finished.
The calling of set_dumpable() has been moved into commit_creds().
Much of the functionality of set_user() has been moved into
commit_creds().
The get functions all simply access the data directly.
(8) security_task_prctl() and cap_task_prctl().
security_task_prctl() has been modified to return -ENOSYS if it doesn't
want to handle a function, or otherwise return the return value directly
rather than through an argument.
Additionally, cap_task_prctl() now prepares a new set of credentials, even
if it doesn't end up using it.
(9) Keyrings.
A number of changes have been made to the keyrings code:
(a) switch_uid_keyring(), copy_keys(), exit_keys() and suid_keys() have
all been dropped and built in to the credentials functions directly.
They may want separating out again later.
(b) key_alloc() and search_process_keyrings() now take a cred pointer
rather than a task pointer to specify the security context.
(c) copy_creds() gives a new thread within the same thread group a new
thread keyring if its parent had one, otherwise it discards the thread
keyring.
(d) The authorisation key now points directly to the credentials to extend
the search into rather pointing to the task that carries them.
(e) Installing thread, process or session keyrings causes a new set of
credentials to be created, even though it's not strictly necessary for
process or session keyrings (they're shared).
(10) Usermode helper.
The usermode helper code now carries a cred struct pointer in its
subprocess_info struct instead of a new session keyring pointer. This set
of credentials is derived from init_cred and installed on the new process
after it has been cloned.
call_usermodehelper_setup() allocates the new credentials and
call_usermodehelper_freeinfo() discards them if they haven't been used. A
special cred function (prepare_usermodeinfo_creds()) is provided
specifically for call_usermodehelper_setup() to call.
call_usermodehelper_setkeys() adjusts the credentials to sport the
supplied keyring as the new session keyring.
(11) SELinux.
SELinux has a number of changes, in addition to those to support the LSM
interface changes mentioned above:
(a) selinux_setprocattr() no longer does its check for whether the
current ptracer can access processes with the new SID inside the lock
that covers getting the ptracer's SID. Whilst this lock ensures that
the check is done with the ptracer pinned, the result is only valid
until the lock is released, so there's no point doing it inside the
lock.
(12) is_single_threaded().
This function has been extracted from selinux_setprocattr() and put into
a file of its own in the lib/ directory as join_session_keyring() now
wants to use it too.
The code in SELinux just checked to see whether a task shared mm_structs
with other tasks (CLONE_VM), but that isn't good enough. We really want
to know if they're part of the same thread group (CLONE_THREAD).
(13) nfsd.
The NFS server daemon now has to use the COW credentials to set the
credentials it is going to use. It really needs to pass the credentials
down to the functions it calls, but it can't do that until other patches
in this series have been applied.
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: James Morris <jmorris@namei.org>
2008-11-13 23:39:23 +00:00
|
|
|
const struct cred *original_cred;
|
|
|
|
|
int status;
|
2005-06-24 05:04:25 +00:00
|
|
|
|
|
|
|
|
printk("NFSD: Using %s as the NFSv4 state recovery directory\n",
|
2011-08-27 00:40:28 +00:00
|
|
|
user_recovery_dirname);
|
2005-06-24 05:04:25 +00:00
|
|
|
|
2012-11-26 13:16:25 +00:00
|
|
|
BUG_ON(nn->rec_file);
|
2005-06-24 05:04:25 +00:00
|
|
|
|
CRED: Inaugurate COW credentials
Inaugurate copy-on-write credentials management. This uses RCU to manage the
credentials pointer in the task_struct with respect to accesses by other tasks.
A process may only modify its own credentials, and so does not need locking to
access or modify its own credentials.
A mutex (cred_replace_mutex) is added to the task_struct to control the effect
of PTRACE_ATTACHED on credential calculations, particularly with respect to
execve().
With this patch, the contents of an active credentials struct may not be
changed directly; rather a new set of credentials must be prepared, modified
and committed using something like the following sequence of events:
struct cred *new = prepare_creds();
int ret = blah(new);
if (ret < 0) {
abort_creds(new);
return ret;
}
return commit_creds(new);
There are some exceptions to this rule: the keyrings pointed to by the active
credentials may be instantiated - keyrings violate the COW rule as managing
COW keyrings is tricky, given that it is possible for a task to directly alter
the keys in a keyring in use by another task.
To help enforce this, various pointers to sets of credentials, such as those in
the task_struct, are declared const. The purpose of this is compile-time
discouragement of altering credentials through those pointers. Once a set of
credentials has been made public through one of these pointers, it may not be
modified, except under special circumstances:
(1) Its reference count may incremented and decremented.
(2) The keyrings to which it points may be modified, but not replaced.
The only safe way to modify anything else is to create a replacement and commit
using the functions described in Documentation/credentials.txt (which will be
added by a later patch).
This patch and the preceding patches have been tested with the LTP SELinux
testsuite.
This patch makes several logical sets of alteration:
(1) execve().
This now prepares and commits credentials in various places in the
security code rather than altering the current creds directly.
(2) Temporary credential overrides.
do_coredump() and sys_faccessat() now prepare their own credentials and
temporarily override the ones currently on the acting thread, whilst
preventing interference from other threads by holding cred_replace_mutex
on the thread being dumped.
This will be replaced in a future patch by something that hands down the
credentials directly to the functions being called, rather than altering
the task's objective credentials.
(3) LSM interface.
A number of functions have been changed, added or removed:
(*) security_capset_check(), ->capset_check()
(*) security_capset_set(), ->capset_set()
Removed in favour of security_capset().
(*) security_capset(), ->capset()
New. This is passed a pointer to the new creds, a pointer to the old
creds and the proposed capability sets. It should fill in the new
creds or return an error. All pointers, barring the pointer to the
new creds, are now const.
(*) security_bprm_apply_creds(), ->bprm_apply_creds()
Changed; now returns a value, which will cause the process to be
killed if it's an error.
(*) security_task_alloc(), ->task_alloc_security()
Removed in favour of security_prepare_creds().
(*) security_cred_free(), ->cred_free()
New. Free security data attached to cred->security.
(*) security_prepare_creds(), ->cred_prepare()
New. Duplicate any security data attached to cred->security.
(*) security_commit_creds(), ->cred_commit()
New. Apply any security effects for the upcoming installation of new
security by commit_creds().
(*) security_task_post_setuid(), ->task_post_setuid()
Removed in favour of security_task_fix_setuid().
(*) security_task_fix_setuid(), ->task_fix_setuid()
Fix up the proposed new credentials for setuid(). This is used by
cap_set_fix_setuid() to implicitly adjust capabilities in line with
setuid() changes. Changes are made to the new credentials, rather
than the task itself as in security_task_post_setuid().
(*) security_task_reparent_to_init(), ->task_reparent_to_init()
Removed. Instead the task being reparented to init is referred
directly to init's credentials.
NOTE! This results in the loss of some state: SELinux's osid no
longer records the sid of the thread that forked it.
(*) security_key_alloc(), ->key_alloc()
(*) security_key_permission(), ->key_permission()
Changed. These now take cred pointers rather than task pointers to
refer to the security context.
(4) sys_capset().
This has been simplified and uses less locking. The LSM functions it
calls have been merged.
(5) reparent_to_kthreadd().
This gives the current thread the same credentials as init by simply using
commit_thread() to point that way.
(6) __sigqueue_alloc() and switch_uid()
__sigqueue_alloc() can't stop the target task from changing its creds
beneath it, so this function gets a reference to the currently applicable
user_struct which it then passes into the sigqueue struct it returns if
successful.
switch_uid() is now called from commit_creds(), and possibly should be
folded into that. commit_creds() should take care of protecting
__sigqueue_alloc().
(7) [sg]et[ug]id() and co and [sg]et_current_groups.
The set functions now all use prepare_creds(), commit_creds() and
abort_creds() to build and check a new set of credentials before applying
it.
security_task_set[ug]id() is called inside the prepared section. This
guarantees that nothing else will affect the creds until we've finished.
The calling of set_dumpable() has been moved into commit_creds().
Much of the functionality of set_user() has been moved into
commit_creds().
The get functions all simply access the data directly.
(8) security_task_prctl() and cap_task_prctl().
security_task_prctl() has been modified to return -ENOSYS if it doesn't
want to handle a function, or otherwise return the return value directly
rather than through an argument.
Additionally, cap_task_prctl() now prepares a new set of credentials, even
if it doesn't end up using it.
(9) Keyrings.
A number of changes have been made to the keyrings code:
(a) switch_uid_keyring(), copy_keys(), exit_keys() and suid_keys() have
all been dropped and built in to the credentials functions directly.
They may want separating out again later.
(b) key_alloc() and search_process_keyrings() now take a cred pointer
rather than a task pointer to specify the security context.
(c) copy_creds() gives a new thread within the same thread group a new
thread keyring if its parent had one, otherwise it discards the thread
keyring.
(d) The authorisation key now points directly to the credentials to extend
the search into rather pointing to the task that carries them.
(e) Installing thread, process or session keyrings causes a new set of
credentials to be created, even though it's not strictly necessary for
process or session keyrings (they're shared).
(10) Usermode helper.
The usermode helper code now carries a cred struct pointer in its
subprocess_info struct instead of a new session keyring pointer. This set
of credentials is derived from init_cred and installed on the new process
after it has been cloned.
call_usermodehelper_setup() allocates the new credentials and
call_usermodehelper_freeinfo() discards them if they haven't been used. A
special cred function (prepare_usermodeinfo_creds()) is provided
specifically for call_usermodehelper_setup() to call.
call_usermodehelper_setkeys() adjusts the credentials to sport the
supplied keyring as the new session keyring.
(11) SELinux.
SELinux has a number of changes, in addition to those to support the LSM
interface changes mentioned above:
(a) selinux_setprocattr() no longer does its check for whether the
current ptracer can access processes with the new SID inside the lock
that covers getting the ptracer's SID. Whilst this lock ensures that
the check is done with the ptracer pinned, the result is only valid
until the lock is released, so there's no point doing it inside the
lock.
(12) is_single_threaded().
This function has been extracted from selinux_setprocattr() and put into
a file of its own in the lib/ directory as join_session_keyring() now
wants to use it too.
The code in SELinux just checked to see whether a task shared mm_structs
with other tasks (CLONE_VM), but that isn't good enough. We really want
to know if they're part of the same thread group (CLONE_THREAD).
(13) nfsd.
The NFS server daemon now has to use the COW credentials to set the
credentials it is going to use. It really needs to pass the credentials
down to the functions it calls, but it can't do that until other patches
in this series have been applied.
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: James Morris <jmorris@namei.org>
2008-11-13 23:39:23 +00:00
|
|
|
status = nfs4_save_creds(&original_cred);
|
|
|
|
|
if (status < 0) {
|
|
|
|
|
printk("NFSD: Unable to change credentials to find recovery"
|
|
|
|
|
" directory: error %d\n",
|
|
|
|
|
status);
|
2012-03-21 20:42:43 +00:00
|
|
|
return status;
|
CRED: Inaugurate COW credentials
Inaugurate copy-on-write credentials management. This uses RCU to manage the
credentials pointer in the task_struct with respect to accesses by other tasks.
A process may only modify its own credentials, and so does not need locking to
access or modify its own credentials.
A mutex (cred_replace_mutex) is added to the task_struct to control the effect
of PTRACE_ATTACHED on credential calculations, particularly with respect to
execve().
With this patch, the contents of an active credentials struct may not be
changed directly; rather a new set of credentials must be prepared, modified
and committed using something like the following sequence of events:
struct cred *new = prepare_creds();
int ret = blah(new);
if (ret < 0) {
abort_creds(new);
return ret;
}
return commit_creds(new);
There are some exceptions to this rule: the keyrings pointed to by the active
credentials may be instantiated - keyrings violate the COW rule as managing
COW keyrings is tricky, given that it is possible for a task to directly alter
the keys in a keyring in use by another task.
To help enforce this, various pointers to sets of credentials, such as those in
the task_struct, are declared const. The purpose of this is compile-time
discouragement of altering credentials through those pointers. Once a set of
credentials has been made public through one of these pointers, it may not be
modified, except under special circumstances:
(1) Its reference count may incremented and decremented.
(2) The keyrings to which it points may be modified, but not replaced.
The only safe way to modify anything else is to create a replacement and commit
using the functions described in Documentation/credentials.txt (which will be
added by a later patch).
This patch and the preceding patches have been tested with the LTP SELinux
testsuite.
This patch makes several logical sets of alteration:
(1) execve().
This now prepares and commits credentials in various places in the
security code rather than altering the current creds directly.
(2) Temporary credential overrides.
do_coredump() and sys_faccessat() now prepare their own credentials and
temporarily override the ones currently on the acting thread, whilst
preventing interference from other threads by holding cred_replace_mutex
on the thread being dumped.
This will be replaced in a future patch by something that hands down the
credentials directly to the functions being called, rather than altering
the task's objective credentials.
(3) LSM interface.
A number of functions have been changed, added or removed:
(*) security_capset_check(), ->capset_check()
(*) security_capset_set(), ->capset_set()
Removed in favour of security_capset().
(*) security_capset(), ->capset()
New. This is passed a pointer to the new creds, a pointer to the old
creds and the proposed capability sets. It should fill in the new
creds or return an error. All pointers, barring the pointer to the
new creds, are now const.
(*) security_bprm_apply_creds(), ->bprm_apply_creds()
Changed; now returns a value, which will cause the process to be
killed if it's an error.
(*) security_task_alloc(), ->task_alloc_security()
Removed in favour of security_prepare_creds().
(*) security_cred_free(), ->cred_free()
New. Free security data attached to cred->security.
(*) security_prepare_creds(), ->cred_prepare()
New. Duplicate any security data attached to cred->security.
(*) security_commit_creds(), ->cred_commit()
New. Apply any security effects for the upcoming installation of new
security by commit_creds().
(*) security_task_post_setuid(), ->task_post_setuid()
Removed in favour of security_task_fix_setuid().
(*) security_task_fix_setuid(), ->task_fix_setuid()
Fix up the proposed new credentials for setuid(). This is used by
cap_set_fix_setuid() to implicitly adjust capabilities in line with
setuid() changes. Changes are made to the new credentials, rather
than the task itself as in security_task_post_setuid().
(*) security_task_reparent_to_init(), ->task_reparent_to_init()
Removed. Instead the task being reparented to init is referred
directly to init's credentials.
NOTE! This results in the loss of some state: SELinux's osid no
longer records the sid of the thread that forked it.
(*) security_key_alloc(), ->key_alloc()
(*) security_key_permission(), ->key_permission()
Changed. These now take cred pointers rather than task pointers to
refer to the security context.
(4) sys_capset().
This has been simplified and uses less locking. The LSM functions it
calls have been merged.
(5) reparent_to_kthreadd().
This gives the current thread the same credentials as init by simply using
commit_thread() to point that way.
(6) __sigqueue_alloc() and switch_uid()
__sigqueue_alloc() can't stop the target task from changing its creds
beneath it, so this function gets a reference to the currently applicable
user_struct which it then passes into the sigqueue struct it returns if
successful.
switch_uid() is now called from commit_creds(), and possibly should be
folded into that. commit_creds() should take care of protecting
__sigqueue_alloc().
(7) [sg]et[ug]id() and co and [sg]et_current_groups.
The set functions now all use prepare_creds(), commit_creds() and
abort_creds() to build and check a new set of credentials before applying
it.
security_task_set[ug]id() is called inside the prepared section. This
guarantees that nothing else will affect the creds until we've finished.
The calling of set_dumpable() has been moved into commit_creds().
Much of the functionality of set_user() has been moved into
commit_creds().
The get functions all simply access the data directly.
(8) security_task_prctl() and cap_task_prctl().
security_task_prctl() has been modified to return -ENOSYS if it doesn't
want to handle a function, or otherwise return the return value directly
rather than through an argument.
Additionally, cap_task_prctl() now prepares a new set of credentials, even
if it doesn't end up using it.
(9) Keyrings.
A number of changes have been made to the keyrings code:
(a) switch_uid_keyring(), copy_keys(), exit_keys() and suid_keys() have
all been dropped and built in to the credentials functions directly.
They may want separating out again later.
(b) key_alloc() and search_process_keyrings() now take a cred pointer
rather than a task pointer to specify the security context.
(c) copy_creds() gives a new thread within the same thread group a new
thread keyring if its parent had one, otherwise it discards the thread
keyring.
(d) The authorisation key now points directly to the credentials to extend
the search into rather pointing to the task that carries them.
(e) Installing thread, process or session keyrings causes a new set of
credentials to be created, even though it's not strictly necessary for
process or session keyrings (they're shared).
(10) Usermode helper.
The usermode helper code now carries a cred struct pointer in its
subprocess_info struct instead of a new session keyring pointer. This set
of credentials is derived from init_cred and installed on the new process
after it has been cloned.
call_usermodehelper_setup() allocates the new credentials and
call_usermodehelper_freeinfo() discards them if they haven't been used. A
special cred function (prepare_usermodeinfo_creds()) is provided
specifically for call_usermodehelper_setup() to call.
call_usermodehelper_setkeys() adjusts the credentials to sport the
supplied keyring as the new session keyring.
(11) SELinux.
SELinux has a number of changes, in addition to those to support the LSM
interface changes mentioned above:
(a) selinux_setprocattr() no longer does its check for whether the
current ptracer can access processes with the new SID inside the lock
that covers getting the ptracer's SID. Whilst this lock ensures that
the check is done with the ptracer pinned, the result is only valid
until the lock is released, so there's no point doing it inside the
lock.
(12) is_single_threaded().
This function has been extracted from selinux_setprocattr() and put into
a file of its own in the lib/ directory as join_session_keyring() now
wants to use it too.
The code in SELinux just checked to see whether a task shared mm_structs
with other tasks (CLONE_VM), but that isn't good enough. We really want
to know if they're part of the same thread group (CLONE_THREAD).
(13) nfsd.
The NFS server daemon now has to use the COW credentials to set the
credentials it is going to use. It really needs to pass the credentials
down to the functions it calls, but it can't do that until other patches
in this series have been applied.
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: James Morris <jmorris@namei.org>
2008-11-13 23:39:23 +00:00
|
|
|
}
|
2005-06-24 05:04:25 +00:00
|
|
|
|
2012-11-26 13:16:25 +00:00
|
|
|
nn->rec_file = filp_open(user_recovery_dirname, O_RDONLY | O_DIRECTORY, 0);
|
|
|
|
|
if (IS_ERR(nn->rec_file)) {
|
2006-01-19 01:43:29 +00:00
|
|
|
printk("NFSD: unable to find recovery directory %s\n",
|
2011-08-27 00:40:28 +00:00
|
|
|
user_recovery_dirname);
|
2012-11-26 13:16:25 +00:00
|
|
|
status = PTR_ERR(nn->rec_file);
|
|
|
|
|
nn->rec_file = NULL;
|
2010-03-22 16:32:14 +00:00
|
|
|
}
|
2005-06-24 05:04:25 +00:00
|
|
|
|
CRED: Inaugurate COW credentials
Inaugurate copy-on-write credentials management. This uses RCU to manage the
credentials pointer in the task_struct with respect to accesses by other tasks.
A process may only modify its own credentials, and so does not need locking to
access or modify its own credentials.
A mutex (cred_replace_mutex) is added to the task_struct to control the effect
of PTRACE_ATTACHED on credential calculations, particularly with respect to
execve().
With this patch, the contents of an active credentials struct may not be
changed directly; rather a new set of credentials must be prepared, modified
and committed using something like the following sequence of events:
struct cred *new = prepare_creds();
int ret = blah(new);
if (ret < 0) {
abort_creds(new);
return ret;
}
return commit_creds(new);
There are some exceptions to this rule: the keyrings pointed to by the active
credentials may be instantiated - keyrings violate the COW rule as managing
COW keyrings is tricky, given that it is possible for a task to directly alter
the keys in a keyring in use by another task.
To help enforce this, various pointers to sets of credentials, such as those in
the task_struct, are declared const. The purpose of this is compile-time
discouragement of altering credentials through those pointers. Once a set of
credentials has been made public through one of these pointers, it may not be
modified, except under special circumstances:
(1) Its reference count may incremented and decremented.
(2) The keyrings to which it points may be modified, but not replaced.
The only safe way to modify anything else is to create a replacement and commit
using the functions described in Documentation/credentials.txt (which will be
added by a later patch).
This patch and the preceding patches have been tested with the LTP SELinux
testsuite.
This patch makes several logical sets of alteration:
(1) execve().
This now prepares and commits credentials in various places in the
security code rather than altering the current creds directly.
(2) Temporary credential overrides.
do_coredump() and sys_faccessat() now prepare their own credentials and
temporarily override the ones currently on the acting thread, whilst
preventing interference from other threads by holding cred_replace_mutex
on the thread being dumped.
This will be replaced in a future patch by something that hands down the
credentials directly to the functions being called, rather than altering
the task's objective credentials.
(3) LSM interface.
A number of functions have been changed, added or removed:
(*) security_capset_check(), ->capset_check()
(*) security_capset_set(), ->capset_set()
Removed in favour of security_capset().
(*) security_capset(), ->capset()
New. This is passed a pointer to the new creds, a pointer to the old
creds and the proposed capability sets. It should fill in the new
creds or return an error. All pointers, barring the pointer to the
new creds, are now const.
(*) security_bprm_apply_creds(), ->bprm_apply_creds()
Changed; now returns a value, which will cause the process to be
killed if it's an error.
(*) security_task_alloc(), ->task_alloc_security()
Removed in favour of security_prepare_creds().
(*) security_cred_free(), ->cred_free()
New. Free security data attached to cred->security.
(*) security_prepare_creds(), ->cred_prepare()
New. Duplicate any security data attached to cred->security.
(*) security_commit_creds(), ->cred_commit()
New. Apply any security effects for the upcoming installation of new
security by commit_creds().
(*) security_task_post_setuid(), ->task_post_setuid()
Removed in favour of security_task_fix_setuid().
(*) security_task_fix_setuid(), ->task_fix_setuid()
Fix up the proposed new credentials for setuid(). This is used by
cap_set_fix_setuid() to implicitly adjust capabilities in line with
setuid() changes. Changes are made to the new credentials, rather
than the task itself as in security_task_post_setuid().
(*) security_task_reparent_to_init(), ->task_reparent_to_init()
Removed. Instead the task being reparented to init is referred
directly to init's credentials.
NOTE! This results in the loss of some state: SELinux's osid no
longer records the sid of the thread that forked it.
(*) security_key_alloc(), ->key_alloc()
(*) security_key_permission(), ->key_permission()
Changed. These now take cred pointers rather than task pointers to
refer to the security context.
(4) sys_capset().
This has been simplified and uses less locking. The LSM functions it
calls have been merged.
(5) reparent_to_kthreadd().
This gives the current thread the same credentials as init by simply using
commit_thread() to point that way.
(6) __sigqueue_alloc() and switch_uid()
__sigqueue_alloc() can't stop the target task from changing its creds
beneath it, so this function gets a reference to the currently applicable
user_struct which it then passes into the sigqueue struct it returns if
successful.
switch_uid() is now called from commit_creds(), and possibly should be
folded into that. commit_creds() should take care of protecting
__sigqueue_alloc().
(7) [sg]et[ug]id() and co and [sg]et_current_groups.
The set functions now all use prepare_creds(), commit_creds() and
abort_creds() to build and check a new set of credentials before applying
it.
security_task_set[ug]id() is called inside the prepared section. This
guarantees that nothing else will affect the creds until we've finished.
The calling of set_dumpable() has been moved into commit_creds().
Much of the functionality of set_user() has been moved into
commit_creds().
The get functions all simply access the data directly.
(8) security_task_prctl() and cap_task_prctl().
security_task_prctl() has been modified to return -ENOSYS if it doesn't
want to handle a function, or otherwise return the return value directly
rather than through an argument.
Additionally, cap_task_prctl() now prepares a new set of credentials, even
if it doesn't end up using it.
(9) Keyrings.
A number of changes have been made to the keyrings code:
(a) switch_uid_keyring(), copy_keys(), exit_keys() and suid_keys() have
all been dropped and built in to the credentials functions directly.
They may want separating out again later.
(b) key_alloc() and search_process_keyrings() now take a cred pointer
rather than a task pointer to specify the security context.
(c) copy_creds() gives a new thread within the same thread group a new
thread keyring if its parent had one, otherwise it discards the thread
keyring.
(d) The authorisation key now points directly to the credentials to extend
the search into rather pointing to the task that carries them.
(e) Installing thread, process or session keyrings causes a new set of
credentials to be created, even though it's not strictly necessary for
process or session keyrings (they're shared).
(10) Usermode helper.
The usermode helper code now carries a cred struct pointer in its
subprocess_info struct instead of a new session keyring pointer. This set
of credentials is derived from init_cred and installed on the new process
after it has been cloned.
call_usermodehelper_setup() allocates the new credentials and
call_usermodehelper_freeinfo() discards them if they haven't been used. A
special cred function (prepare_usermodeinfo_creds()) is provided
specifically for call_usermodehelper_setup() to call.
call_usermodehelper_setkeys() adjusts the credentials to sport the
supplied keyring as the new session keyring.
(11) SELinux.
SELinux has a number of changes, in addition to those to support the LSM
interface changes mentioned above:
(a) selinux_setprocattr() no longer does its check for whether the
current ptracer can access processes with the new SID inside the lock
that covers getting the ptracer's SID. Whilst this lock ensures that
the check is done with the ptracer pinned, the result is only valid
until the lock is released, so there's no point doing it inside the
lock.
(12) is_single_threaded().
This function has been extracted from selinux_setprocattr() and put into
a file of its own in the lib/ directory as join_session_keyring() now
wants to use it too.
The code in SELinux just checked to see whether a task shared mm_structs
with other tasks (CLONE_VM), but that isn't good enough. We really want
to know if they're part of the same thread group (CLONE_THREAD).
(13) nfsd.
The NFS server daemon now has to use the COW credentials to set the
credentials it is going to use. It really needs to pass the credentials
down to the functions it calls, but it can't do that until other patches
in this series have been applied.
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Signed-off-by: James Morris <jmorris@namei.org>
2008-11-13 23:39:23 +00:00
|
|
|
nfs4_reset_creds(original_cred);
|
2012-11-12 20:00:55 +00:00
|
|
|
if (!status)
|
2012-11-26 13:16:30 +00:00
|
|
|
nn->in_grace = true;
|
2012-03-21 20:42:43 +00:00
|
|
|
return status;
|
2005-06-24 05:04:25 +00:00
|
|
|
}
|
|
|
|
|
|
2014-09-02 14:12:17 +00:00
|
|
|
static void
|
|
|
|
|
nfsd4_shutdown_recdir(struct net *net)
|
|
|
|
|
{
|
|
|
|
|
struct nfsd_net *nn = net_generic(net, nfsd_net_id);
|
|
|
|
|
|
|
|
|
|
if (!nn->rec_file)
|
|
|
|
|
return;
|
|
|
|
|
fput(nn->rec_file);
|
|
|
|
|
nn->rec_file = NULL;
|
|
|
|
|
}
|
2012-11-14 15:21:16 +00:00
|
|
|
|
|
|
|
|
static int
|
|
|
|
|
nfs4_legacy_state_init(struct net *net)
|
|
|
|
|
{
|
|
|
|
|
struct nfsd_net *nn = net_generic(net, nfsd_net_id);
|
|
|
|
|
int i;
|
|
|
|
|
|
|
|
|
|
nn->reclaim_str_hashtbl = kmalloc(sizeof(struct list_head) *
|
|
|
|
|
CLIENT_HASH_SIZE, GFP_KERNEL);
|
|
|
|
|
if (!nn->reclaim_str_hashtbl)
|
|
|
|
|
return -ENOMEM;
|
|
|
|
|
|
|
|
|
|
for (i = 0; i < CLIENT_HASH_SIZE; i++)
|
|
|
|
|
INIT_LIST_HEAD(&nn->reclaim_str_hashtbl[i]);
|
|
|
|
|
nn->reclaim_str_hashtbl_size = 0;
|
|
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void
|
|
|
|
|
nfs4_legacy_state_shutdown(struct net *net)
|
|
|
|
|
{
|
|
|
|
|
struct nfsd_net *nn = net_generic(net, nfsd_net_id);
|
|
|
|
|
|
|
|
|
|
kfree(nn->reclaim_str_hashtbl);
|
|
|
|
|
}
|
|
|
|
|
|
2012-03-21 20:42:43 +00:00
|
|
|
static int
|
|
|
|
|
nfsd4_load_reboot_recovery_data(struct net *net)
|
|
|
|
|
{
|
|
|
|
|
int status;
|
|
|
|
|
|
2012-11-26 13:16:25 +00:00
|
|
|
status = nfsd4_init_recdir(net);
|
2012-11-14 15:21:16 +00:00
|
|
|
if (status)
|
2014-09-02 14:12:17 +00:00
|
|
|
return status;
|
|
|
|
|
|
|
|
|
|
status = nfsd4_recdir_load(net);
|
|
|
|
|
if (status)
|
|
|
|
|
nfsd4_shutdown_recdir(net);
|
|
|
|
|
|
2012-11-14 15:21:16 +00:00
|
|
|
return status;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int
|
|
|
|
|
nfsd4_legacy_tracking_init(struct net *net)
|
|
|
|
|
{
|
|
|
|
|
int status;
|
|
|
|
|
|
2012-03-21 13:52:09 +00:00
|
|
|
/* XXX: The legacy code won't work in a container */
|
|
|
|
|
if (net != &init_net) {
|
|
|
|
|
WARN(1, KERN_ERR "NFSD: attempt to initialize legacy client "
|
|
|
|
|
"tracking in a container!\n");
|
|
|
|
|
return -EINVAL;
|
|
|
|
|
}
|
|
|
|
|
|
2012-11-14 15:21:16 +00:00
|
|
|
status = nfs4_legacy_state_init(net);
|
2012-03-21 20:42:43 +00:00
|
|
|
if (status)
|
2012-11-14 15:21:16 +00:00
|
|
|
return status;
|
|
|
|
|
|
|
|
|
|
status = nfsd4_load_reboot_recovery_data(net);
|
|
|
|
|
if (status)
|
|
|
|
|
goto err;
|
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
|
|
err:
|
|
|
|
|
nfs4_legacy_state_shutdown(net);
|
2012-03-21 20:42:43 +00:00
|
|
|
return status;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void
|
|
|
|
|
nfsd4_legacy_tracking_exit(struct net *net)
|
|
|
|
|
{
|
2012-11-14 15:21:16 +00:00
|
|
|
struct nfsd_net *nn = net_generic(net, nfsd_net_id);
|
|
|
|
|
|
|
|
|
|
nfs4_release_reclaim(nn);
|
2014-09-02 14:12:17 +00:00
|
|
|
nfsd4_shutdown_recdir(net);
|
2012-11-14 15:21:16 +00:00
|
|
|
nfs4_legacy_state_shutdown(net);
|
2012-03-21 20:42:43 +00:00
|
|
|
}
|
|
|
|
|
|
2011-08-27 00:40:28 +00:00
|
|
|
/*
|
|
|
|
|
* Change the NFSv4 recovery directory to recdir.
|
|
|
|
|
*/
|
|
|
|
|
int
|
|
|
|
|
nfs4_reset_recoverydir(char *recdir)
|
|
|
|
|
{
|
|
|
|
|
int status;
|
|
|
|
|
struct path path;
|
|
|
|
|
|
|
|
|
|
status = kern_path(recdir, LOOKUP_FOLLOW, &path);
|
|
|
|
|
if (status)
|
|
|
|
|
return status;
|
|
|
|
|
status = -ENOTDIR;
|
|
|
|
|
if (S_ISDIR(path.dentry->d_inode->i_mode)) {
|
|
|
|
|
strcpy(user_recovery_dirname, recdir);
|
|
|
|
|
status = 0;
|
|
|
|
|
}
|
|
|
|
|
path_put(&path);
|
|
|
|
|
return status;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
char *
|
|
|
|
|
nfs4_recoverydir(void)
|
|
|
|
|
{
|
|
|
|
|
return user_recovery_dirname;
|
|
|
|
|
}
|
2012-03-21 20:42:43 +00:00
|
|
|
|
|
|
|
|
static int
|
|
|
|
|
nfsd4_check_legacy_client(struct nfs4_client *clp)
|
|
|
|
|
{
|
2012-11-12 20:00:57 +00:00
|
|
|
int status;
|
|
|
|
|
char dname[HEXDIR_LEN];
|
2012-11-12 20:00:55 +00:00
|
|
|
struct nfs4_client_reclaim *crp;
|
2012-11-14 15:21:16 +00:00
|
|
|
struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
|
2012-11-12 20:00:55 +00:00
|
|
|
|
2012-03-21 20:42:43 +00:00
|
|
|
/* did we already find that this client is stable? */
|
|
|
|
|
if (test_bit(NFSD4_CLIENT_STABLE, &clp->cl_flags))
|
|
|
|
|
return 0;
|
|
|
|
|
|
2012-11-12 20:00:57 +00:00
|
|
|
status = nfs4_make_rec_clidname(dname, &clp->cl_name);
|
|
|
|
|
if (status) {
|
2013-05-09 12:36:23 +00:00
|
|
|
legacy_recdir_name_error(clp, status);
|
2012-11-12 20:00:57 +00:00
|
|
|
return status;
|
|
|
|
|
}
|
|
|
|
|
|
2012-03-21 20:42:43 +00:00
|
|
|
/* look for it in the reclaim hashtable otherwise */
|
2012-11-14 15:21:16 +00:00
|
|
|
crp = nfsd4_find_reclaim_client(dname, nn);
|
2012-11-12 20:00:55 +00:00
|
|
|
if (crp) {
|
2012-03-21 20:42:43 +00:00
|
|
|
set_bit(NFSD4_CLIENT_STABLE, &clp->cl_flags);
|
2012-11-12 20:00:55 +00:00
|
|
|
crp->cr_clp = clp;
|
2012-03-21 20:42:43 +00:00
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return -ENOENT;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static struct nfsd4_client_tracking_ops nfsd4_legacy_tracking_ops = {
|
2012-11-14 15:21:16 +00:00
|
|
|
.init = nfsd4_legacy_tracking_init,
|
2012-03-21 20:42:43 +00:00
|
|
|
.exit = nfsd4_legacy_tracking_exit,
|
|
|
|
|
.create = nfsd4_create_clid_dir,
|
|
|
|
|
.remove = nfsd4_remove_clid_dir,
|
|
|
|
|
.check = nfsd4_check_legacy_client,
|
|
|
|
|
.grace_done = nfsd4_recdir_purge_old,
|
|
|
|
|
};
|
|
|
|
|
|
2012-03-21 13:52:07 +00:00
|
|
|
/* Globals */
|
|
|
|
|
#define NFSD_PIPE_DIR "nfsd"
|
|
|
|
|
#define NFSD_CLD_PIPE "cld"
|
|
|
|
|
|
|
|
|
|
/* per-net-ns structure for holding cld upcall info */
|
|
|
|
|
struct cld_net {
|
|
|
|
|
struct rpc_pipe *cn_pipe;
|
|
|
|
|
spinlock_t cn_lock;
|
|
|
|
|
struct list_head cn_list;
|
|
|
|
|
unsigned int cn_xid;
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
struct cld_upcall {
|
|
|
|
|
struct list_head cu_list;
|
|
|
|
|
struct cld_net *cu_net;
|
|
|
|
|
struct task_struct *cu_task;
|
|
|
|
|
struct cld_msg cu_msg;
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
static int
|
|
|
|
|
__cld_pipe_upcall(struct rpc_pipe *pipe, struct cld_msg *cmsg)
|
|
|
|
|
{
|
|
|
|
|
int ret;
|
|
|
|
|
struct rpc_pipe_msg msg;
|
|
|
|
|
|
|
|
|
|
memset(&msg, 0, sizeof(msg));
|
|
|
|
|
msg.data = cmsg;
|
|
|
|
|
msg.len = sizeof(*cmsg);
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* Set task state before we queue the upcall. That prevents
|
|
|
|
|
* wake_up_process in the downcall from racing with schedule.
|
|
|
|
|
*/
|
|
|
|
|
set_current_state(TASK_UNINTERRUPTIBLE);
|
|
|
|
|
ret = rpc_queue_upcall(pipe, &msg);
|
|
|
|
|
if (ret < 0) {
|
|
|
|
|
set_current_state(TASK_RUNNING);
|
|
|
|
|
goto out;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
schedule();
|
|
|
|
|
set_current_state(TASK_RUNNING);
|
|
|
|
|
|
|
|
|
|
if (msg.errno < 0)
|
|
|
|
|
ret = msg.errno;
|
|
|
|
|
out:
|
|
|
|
|
return ret;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int
|
|
|
|
|
cld_pipe_upcall(struct rpc_pipe *pipe, struct cld_msg *cmsg)
|
|
|
|
|
{
|
|
|
|
|
int ret;
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* -EAGAIN occurs when pipe is closed and reopened while there are
|
|
|
|
|
* upcalls queued.
|
|
|
|
|
*/
|
|
|
|
|
do {
|
|
|
|
|
ret = __cld_pipe_upcall(pipe, cmsg);
|
|
|
|
|
} while (ret == -EAGAIN);
|
|
|
|
|
|
|
|
|
|
return ret;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static ssize_t
|
|
|
|
|
cld_pipe_downcall(struct file *filp, const char __user *src, size_t mlen)
|
|
|
|
|
{
|
|
|
|
|
struct cld_upcall *tmp, *cup;
|
2012-04-25 20:58:05 +00:00
|
|
|
struct cld_msg __user *cmsg = (struct cld_msg __user *)src;
|
2012-03-21 13:52:07 +00:00
|
|
|
uint32_t xid;
|
|
|
|
|
struct nfsd_net *nn = net_generic(filp->f_dentry->d_sb->s_fs_info,
|
|
|
|
|
nfsd_net_id);
|
|
|
|
|
struct cld_net *cn = nn->cld_net;
|
|
|
|
|
|
|
|
|
|
if (mlen != sizeof(*cmsg)) {
|
2012-04-30 19:25:31 +00:00
|
|
|
dprintk("%s: got %zu bytes, expected %zu\n", __func__, mlen,
|
2012-03-21 13:52:07 +00:00
|
|
|
sizeof(*cmsg));
|
|
|
|
|
return -EINVAL;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* copy just the xid so we can try to find that */
|
|
|
|
|
if (copy_from_user(&xid, &cmsg->cm_xid, sizeof(xid)) != 0) {
|
|
|
|
|
dprintk("%s: error when copying xid from userspace", __func__);
|
|
|
|
|
return -EFAULT;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* walk the list and find corresponding xid */
|
|
|
|
|
cup = NULL;
|
|
|
|
|
spin_lock(&cn->cn_lock);
|
|
|
|
|
list_for_each_entry(tmp, &cn->cn_list, cu_list) {
|
|
|
|
|
if (get_unaligned(&tmp->cu_msg.cm_xid) == xid) {
|
|
|
|
|
cup = tmp;
|
|
|
|
|
list_del_init(&cup->cu_list);
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
spin_unlock(&cn->cn_lock);
|
|
|
|
|
|
|
|
|
|
/* couldn't find upcall? */
|
|
|
|
|
if (!cup) {
|
2012-03-28 11:36:01 +00:00
|
|
|
dprintk("%s: couldn't find upcall -- xid=%u\n", __func__, xid);
|
2012-03-21 13:52:07 +00:00
|
|
|
return -EINVAL;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (copy_from_user(&cup->cu_msg, src, mlen) != 0)
|
|
|
|
|
return -EFAULT;
|
|
|
|
|
|
|
|
|
|
wake_up_process(cup->cu_task);
|
|
|
|
|
return mlen;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void
|
|
|
|
|
cld_pipe_destroy_msg(struct rpc_pipe_msg *msg)
|
|
|
|
|
{
|
|
|
|
|
struct cld_msg *cmsg = msg->data;
|
|
|
|
|
struct cld_upcall *cup = container_of(cmsg, struct cld_upcall,
|
|
|
|
|
cu_msg);
|
|
|
|
|
|
|
|
|
|
/* errno >= 0 means we got a downcall */
|
|
|
|
|
if (msg->errno >= 0)
|
|
|
|
|
return;
|
|
|
|
|
|
|
|
|
|
wake_up_process(cup->cu_task);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static const struct rpc_pipe_ops cld_upcall_ops = {
|
|
|
|
|
.upcall = rpc_pipe_generic_upcall,
|
|
|
|
|
.downcall = cld_pipe_downcall,
|
|
|
|
|
.destroy_msg = cld_pipe_destroy_msg,
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
static struct dentry *
|
|
|
|
|
nfsd4_cld_register_sb(struct super_block *sb, struct rpc_pipe *pipe)
|
|
|
|
|
{
|
|
|
|
|
struct dentry *dir, *dentry;
|
|
|
|
|
|
|
|
|
|
dir = rpc_d_lookup_sb(sb, NFSD_PIPE_DIR);
|
|
|
|
|
if (dir == NULL)
|
|
|
|
|
return ERR_PTR(-ENOENT);
|
|
|
|
|
dentry = rpc_mkpipe_dentry(dir, NFSD_CLD_PIPE, NULL, pipe);
|
|
|
|
|
dput(dir);
|
|
|
|
|
return dentry;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void
|
|
|
|
|
nfsd4_cld_unregister_sb(struct rpc_pipe *pipe)
|
|
|
|
|
{
|
|
|
|
|
if (pipe->dentry)
|
|
|
|
|
rpc_unlink(pipe->dentry);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static struct dentry *
|
|
|
|
|
nfsd4_cld_register_net(struct net *net, struct rpc_pipe *pipe)
|
|
|
|
|
{
|
|
|
|
|
struct super_block *sb;
|
|
|
|
|
struct dentry *dentry;
|
|
|
|
|
|
|
|
|
|
sb = rpc_get_sb_net(net);
|
|
|
|
|
if (!sb)
|
|
|
|
|
return NULL;
|
|
|
|
|
dentry = nfsd4_cld_register_sb(sb, pipe);
|
|
|
|
|
rpc_put_sb_net(net);
|
|
|
|
|
return dentry;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void
|
|
|
|
|
nfsd4_cld_unregister_net(struct net *net, struct rpc_pipe *pipe)
|
|
|
|
|
{
|
|
|
|
|
struct super_block *sb;
|
|
|
|
|
|
|
|
|
|
sb = rpc_get_sb_net(net);
|
|
|
|
|
if (sb) {
|
|
|
|
|
nfsd4_cld_unregister_sb(pipe);
|
|
|
|
|
rpc_put_sb_net(net);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Initialize rpc_pipefs pipe for communication with client tracking daemon */
|
|
|
|
|
static int
|
|
|
|
|
nfsd4_init_cld_pipe(struct net *net)
|
|
|
|
|
{
|
|
|
|
|
int ret;
|
|
|
|
|
struct dentry *dentry;
|
|
|
|
|
struct nfsd_net *nn = net_generic(net, nfsd_net_id);
|
|
|
|
|
struct cld_net *cn;
|
|
|
|
|
|
|
|
|
|
if (nn->cld_net)
|
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
|
|
cn = kzalloc(sizeof(*cn), GFP_KERNEL);
|
|
|
|
|
if (!cn) {
|
|
|
|
|
ret = -ENOMEM;
|
|
|
|
|
goto err;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
cn->cn_pipe = rpc_mkpipe_data(&cld_upcall_ops, RPC_PIPE_WAIT_FOR_OPEN);
|
|
|
|
|
if (IS_ERR(cn->cn_pipe)) {
|
|
|
|
|
ret = PTR_ERR(cn->cn_pipe);
|
|
|
|
|
goto err;
|
|
|
|
|
}
|
|
|
|
|
spin_lock_init(&cn->cn_lock);
|
|
|
|
|
INIT_LIST_HEAD(&cn->cn_list);
|
|
|
|
|
|
|
|
|
|
dentry = nfsd4_cld_register_net(net, cn->cn_pipe);
|
|
|
|
|
if (IS_ERR(dentry)) {
|
|
|
|
|
ret = PTR_ERR(dentry);
|
|
|
|
|
goto err_destroy_data;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
cn->cn_pipe->dentry = dentry;
|
|
|
|
|
nn->cld_net = cn;
|
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
|
|
err_destroy_data:
|
|
|
|
|
rpc_destroy_pipe_data(cn->cn_pipe);
|
|
|
|
|
err:
|
|
|
|
|
kfree(cn);
|
|
|
|
|
printk(KERN_ERR "NFSD: unable to create nfsdcld upcall pipe (%d)\n",
|
|
|
|
|
ret);
|
|
|
|
|
return ret;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void
|
|
|
|
|
nfsd4_remove_cld_pipe(struct net *net)
|
|
|
|
|
{
|
|
|
|
|
struct nfsd_net *nn = net_generic(net, nfsd_net_id);
|
|
|
|
|
struct cld_net *cn = nn->cld_net;
|
|
|
|
|
|
|
|
|
|
nfsd4_cld_unregister_net(net, cn->cn_pipe);
|
|
|
|
|
rpc_destroy_pipe_data(cn->cn_pipe);
|
|
|
|
|
kfree(nn->cld_net);
|
|
|
|
|
nn->cld_net = NULL;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static struct cld_upcall *
|
|
|
|
|
alloc_cld_upcall(struct cld_net *cn)
|
|
|
|
|
{
|
|
|
|
|
struct cld_upcall *new, *tmp;
|
|
|
|
|
|
|
|
|
|
new = kzalloc(sizeof(*new), GFP_KERNEL);
|
|
|
|
|
if (!new)
|
|
|
|
|
return new;
|
|
|
|
|
|
|
|
|
|
/* FIXME: hard cap on number in flight? */
|
|
|
|
|
restart_search:
|
|
|
|
|
spin_lock(&cn->cn_lock);
|
|
|
|
|
list_for_each_entry(tmp, &cn->cn_list, cu_list) {
|
|
|
|
|
if (tmp->cu_msg.cm_xid == cn->cn_xid) {
|
|
|
|
|
cn->cn_xid++;
|
|
|
|
|
spin_unlock(&cn->cn_lock);
|
|
|
|
|
goto restart_search;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
new->cu_task = current;
|
|
|
|
|
new->cu_msg.cm_vers = CLD_UPCALL_VERSION;
|
|
|
|
|
put_unaligned(cn->cn_xid++, &new->cu_msg.cm_xid);
|
|
|
|
|
new->cu_net = cn;
|
|
|
|
|
list_add(&new->cu_list, &cn->cn_list);
|
|
|
|
|
spin_unlock(&cn->cn_lock);
|
|
|
|
|
|
|
|
|
|
dprintk("%s: allocated xid %u\n", __func__, new->cu_msg.cm_xid);
|
|
|
|
|
|
|
|
|
|
return new;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void
|
|
|
|
|
free_cld_upcall(struct cld_upcall *victim)
|
|
|
|
|
{
|
|
|
|
|
struct cld_net *cn = victim->cu_net;
|
|
|
|
|
|
|
|
|
|
spin_lock(&cn->cn_lock);
|
|
|
|
|
list_del(&victim->cu_list);
|
|
|
|
|
spin_unlock(&cn->cn_lock);
|
|
|
|
|
kfree(victim);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Ask daemon to create a new record */
|
|
|
|
|
static void
|
|
|
|
|
nfsd4_cld_create(struct nfs4_client *clp)
|
|
|
|
|
{
|
|
|
|
|
int ret;
|
|
|
|
|
struct cld_upcall *cup;
|
2012-11-14 15:21:10 +00:00
|
|
|
struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
|
2012-03-21 13:52:07 +00:00
|
|
|
struct cld_net *cn = nn->cld_net;
|
|
|
|
|
|
|
|
|
|
/* Don't upcall if it's already stored */
|
|
|
|
|
if (test_bit(NFSD4_CLIENT_STABLE, &clp->cl_flags))
|
|
|
|
|
return;
|
|
|
|
|
|
|
|
|
|
cup = alloc_cld_upcall(cn);
|
|
|
|
|
if (!cup) {
|
|
|
|
|
ret = -ENOMEM;
|
|
|
|
|
goto out_err;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
cup->cu_msg.cm_cmd = Cld_Create;
|
|
|
|
|
cup->cu_msg.cm_u.cm_name.cn_len = clp->cl_name.len;
|
|
|
|
|
memcpy(cup->cu_msg.cm_u.cm_name.cn_id, clp->cl_name.data,
|
|
|
|
|
clp->cl_name.len);
|
|
|
|
|
|
|
|
|
|
ret = cld_pipe_upcall(cn->cn_pipe, &cup->cu_msg);
|
|
|
|
|
if (!ret) {
|
|
|
|
|
ret = cup->cu_msg.cm_status;
|
|
|
|
|
set_bit(NFSD4_CLIENT_STABLE, &clp->cl_flags);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
free_cld_upcall(cup);
|
|
|
|
|
out_err:
|
|
|
|
|
if (ret)
|
|
|
|
|
printk(KERN_ERR "NFSD: Unable to create client "
|
|
|
|
|
"record on stable storage: %d\n", ret);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Ask daemon to create a new record */
|
|
|
|
|
static void
|
|
|
|
|
nfsd4_cld_remove(struct nfs4_client *clp)
|
|
|
|
|
{
|
|
|
|
|
int ret;
|
|
|
|
|
struct cld_upcall *cup;
|
2012-11-14 15:21:10 +00:00
|
|
|
struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
|
2012-03-21 13:52:07 +00:00
|
|
|
struct cld_net *cn = nn->cld_net;
|
|
|
|
|
|
|
|
|
|
/* Don't upcall if it's already removed */
|
|
|
|
|
if (!test_bit(NFSD4_CLIENT_STABLE, &clp->cl_flags))
|
|
|
|
|
return;
|
|
|
|
|
|
|
|
|
|
cup = alloc_cld_upcall(cn);
|
|
|
|
|
if (!cup) {
|
|
|
|
|
ret = -ENOMEM;
|
|
|
|
|
goto out_err;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
cup->cu_msg.cm_cmd = Cld_Remove;
|
|
|
|
|
cup->cu_msg.cm_u.cm_name.cn_len = clp->cl_name.len;
|
|
|
|
|
memcpy(cup->cu_msg.cm_u.cm_name.cn_id, clp->cl_name.data,
|
|
|
|
|
clp->cl_name.len);
|
|
|
|
|
|
|
|
|
|
ret = cld_pipe_upcall(cn->cn_pipe, &cup->cu_msg);
|
|
|
|
|
if (!ret) {
|
|
|
|
|
ret = cup->cu_msg.cm_status;
|
|
|
|
|
clear_bit(NFSD4_CLIENT_STABLE, &clp->cl_flags);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
free_cld_upcall(cup);
|
|
|
|
|
out_err:
|
|
|
|
|
if (ret)
|
|
|
|
|
printk(KERN_ERR "NFSD: Unable to remove client "
|
|
|
|
|
"record from stable storage: %d\n", ret);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
/* Check for presence of a record, and update its timestamp */
|
|
|
|
|
static int
|
|
|
|
|
nfsd4_cld_check(struct nfs4_client *clp)
|
|
|
|
|
{
|
|
|
|
|
int ret;
|
|
|
|
|
struct cld_upcall *cup;
|
2012-11-14 15:21:10 +00:00
|
|
|
struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
|
2012-03-21 13:52:07 +00:00
|
|
|
struct cld_net *cn = nn->cld_net;
|
|
|
|
|
|
|
|
|
|
/* Don't upcall if one was already stored during this grace pd */
|
|
|
|
|
if (test_bit(NFSD4_CLIENT_STABLE, &clp->cl_flags))
|
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
|
|
cup = alloc_cld_upcall(cn);
|
|
|
|
|
if (!cup) {
|
|
|
|
|
printk(KERN_ERR "NFSD: Unable to check client record on "
|
|
|
|
|
"stable storage: %d\n", -ENOMEM);
|
|
|
|
|
return -ENOMEM;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
cup->cu_msg.cm_cmd = Cld_Check;
|
|
|
|
|
cup->cu_msg.cm_u.cm_name.cn_len = clp->cl_name.len;
|
|
|
|
|
memcpy(cup->cu_msg.cm_u.cm_name.cn_id, clp->cl_name.data,
|
|
|
|
|
clp->cl_name.len);
|
|
|
|
|
|
|
|
|
|
ret = cld_pipe_upcall(cn->cn_pipe, &cup->cu_msg);
|
|
|
|
|
if (!ret) {
|
|
|
|
|
ret = cup->cu_msg.cm_status;
|
|
|
|
|
set_bit(NFSD4_CLIENT_STABLE, &clp->cl_flags);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
free_cld_upcall(cup);
|
|
|
|
|
return ret;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void
|
2014-09-12 20:40:20 +00:00
|
|
|
nfsd4_cld_grace_done(struct nfsd_net *nn)
|
2012-03-21 13:52:07 +00:00
|
|
|
{
|
|
|
|
|
int ret;
|
|
|
|
|
struct cld_upcall *cup;
|
|
|
|
|
struct cld_net *cn = nn->cld_net;
|
|
|
|
|
|
|
|
|
|
cup = alloc_cld_upcall(cn);
|
|
|
|
|
if (!cup) {
|
|
|
|
|
ret = -ENOMEM;
|
|
|
|
|
goto out_err;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
cup->cu_msg.cm_cmd = Cld_GraceDone;
|
2014-09-12 20:40:20 +00:00
|
|
|
cup->cu_msg.cm_u.cm_gracetime = (int64_t)nn->boot_time;
|
2012-03-21 13:52:07 +00:00
|
|
|
ret = cld_pipe_upcall(cn->cn_pipe, &cup->cu_msg);
|
|
|
|
|
if (!ret)
|
|
|
|
|
ret = cup->cu_msg.cm_status;
|
|
|
|
|
|
|
|
|
|
free_cld_upcall(cup);
|
|
|
|
|
out_err:
|
|
|
|
|
if (ret)
|
|
|
|
|
printk(KERN_ERR "NFSD: Unable to end grace period: %d\n", ret);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static struct nfsd4_client_tracking_ops nfsd4_cld_tracking_ops = {
|
|
|
|
|
.init = nfsd4_init_cld_pipe,
|
|
|
|
|
.exit = nfsd4_remove_cld_pipe,
|
|
|
|
|
.create = nfsd4_cld_create,
|
|
|
|
|
.remove = nfsd4_cld_remove,
|
|
|
|
|
.check = nfsd4_cld_check,
|
|
|
|
|
.grace_done = nfsd4_cld_grace_done,
|
|
|
|
|
};
|
|
|
|
|
|
2012-11-12 20:00:48 +00:00
|
|
|
/* upcall via usermodehelper */
|
|
|
|
|
static char cltrack_prog[PATH_MAX] = "/sbin/nfsdcltrack";
|
|
|
|
|
module_param_string(cltrack_prog, cltrack_prog, sizeof(cltrack_prog),
|
|
|
|
|
S_IRUGO|S_IWUSR);
|
|
|
|
|
MODULE_PARM_DESC(cltrack_prog, "Path to the nfsdcltrack upcall program");
|
|
|
|
|
|
2012-11-12 20:00:50 +00:00
|
|
|
static bool cltrack_legacy_disable;
|
|
|
|
|
module_param(cltrack_legacy_disable, bool, S_IRUGO|S_IWUSR);
|
|
|
|
|
MODULE_PARM_DESC(cltrack_legacy_disable,
|
|
|
|
|
"Disable legacy recoverydir conversion. Default: false");
|
|
|
|
|
|
|
|
|
|
#define LEGACY_TOPDIR_ENV_PREFIX "NFSDCLTRACK_LEGACY_TOPDIR="
|
|
|
|
|
#define LEGACY_RECDIR_ENV_PREFIX "NFSDCLTRACK_LEGACY_RECDIR="
|
2014-09-12 20:40:21 +00:00
|
|
|
#define HAS_SESSION_ENV_PREFIX "NFSDCLTRACK_CLIENT_HAS_SESSION="
|
|
|
|
|
#define GRACE_START_ENV_PREFIX "NFSDCLTRACK_GRACE_START="
|
2012-11-12 20:00:50 +00:00
|
|
|
|
|
|
|
|
static char *
|
|
|
|
|
nfsd4_cltrack_legacy_topdir(void)
|
|
|
|
|
{
|
|
|
|
|
int copied;
|
|
|
|
|
size_t len;
|
|
|
|
|
char *result;
|
|
|
|
|
|
|
|
|
|
if (cltrack_legacy_disable)
|
|
|
|
|
return NULL;
|
|
|
|
|
|
|
|
|
|
len = strlen(LEGACY_TOPDIR_ENV_PREFIX) +
|
|
|
|
|
strlen(nfs4_recoverydir()) + 1;
|
|
|
|
|
|
|
|
|
|
result = kmalloc(len, GFP_KERNEL);
|
|
|
|
|
if (!result)
|
|
|
|
|
return result;
|
|
|
|
|
|
|
|
|
|
copied = snprintf(result, len, LEGACY_TOPDIR_ENV_PREFIX "%s",
|
|
|
|
|
nfs4_recoverydir());
|
|
|
|
|
if (copied >= len) {
|
|
|
|
|
/* just return nothing if output was truncated */
|
|
|
|
|
kfree(result);
|
|
|
|
|
return NULL;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return result;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static char *
|
2012-11-12 20:00:57 +00:00
|
|
|
nfsd4_cltrack_legacy_recdir(const struct xdr_netobj *name)
|
2012-11-12 20:00:50 +00:00
|
|
|
{
|
|
|
|
|
int copied;
|
|
|
|
|
size_t len;
|
|
|
|
|
char *result;
|
|
|
|
|
|
|
|
|
|
if (cltrack_legacy_disable)
|
|
|
|
|
return NULL;
|
|
|
|
|
|
|
|
|
|
/* +1 is for '/' between "topdir" and "recdir" */
|
|
|
|
|
len = strlen(LEGACY_RECDIR_ENV_PREFIX) +
|
|
|
|
|
strlen(nfs4_recoverydir()) + 1 + HEXDIR_LEN;
|
|
|
|
|
|
|
|
|
|
result = kmalloc(len, GFP_KERNEL);
|
|
|
|
|
if (!result)
|
|
|
|
|
return result;
|
|
|
|
|
|
2012-11-12 20:00:57 +00:00
|
|
|
copied = snprintf(result, len, LEGACY_RECDIR_ENV_PREFIX "%s/",
|
|
|
|
|
nfs4_recoverydir());
|
|
|
|
|
if (copied > (len - HEXDIR_LEN)) {
|
|
|
|
|
/* just return nothing if output will be truncated */
|
|
|
|
|
kfree(result);
|
|
|
|
|
return NULL;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
copied = nfs4_make_rec_clidname(result + copied, name);
|
|
|
|
|
if (copied) {
|
2012-11-12 20:00:50 +00:00
|
|
|
kfree(result);
|
|
|
|
|
return NULL;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return result;
|
|
|
|
|
}
|
|
|
|
|
|
2014-09-12 20:40:21 +00:00
|
|
|
static char *
|
|
|
|
|
nfsd4_cltrack_client_has_session(struct nfs4_client *clp)
|
|
|
|
|
{
|
|
|
|
|
int copied;
|
|
|
|
|
size_t len;
|
|
|
|
|
char *result;
|
|
|
|
|
|
|
|
|
|
/* prefix + Y/N character + terminating NULL */
|
|
|
|
|
len = strlen(HAS_SESSION_ENV_PREFIX) + 1 + 1;
|
|
|
|
|
|
|
|
|
|
result = kmalloc(len, GFP_KERNEL);
|
|
|
|
|
if (!result)
|
|
|
|
|
return result;
|
|
|
|
|
|
|
|
|
|
copied = snprintf(result, len, HAS_SESSION_ENV_PREFIX "%c",
|
|
|
|
|
clp->cl_minorversion ? 'Y' : 'N');
|
|
|
|
|
if (copied >= len) {
|
|
|
|
|
/* just return nothing if output was truncated */
|
|
|
|
|
kfree(result);
|
|
|
|
|
return NULL;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return result;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static char *
|
|
|
|
|
nfsd4_cltrack_grace_start(time_t grace_start)
|
|
|
|
|
{
|
|
|
|
|
int copied;
|
|
|
|
|
size_t len;
|
|
|
|
|
char *result;
|
|
|
|
|
|
|
|
|
|
/* prefix + max width of int64_t string + terminating NULL */
|
|
|
|
|
len = strlen(GRACE_START_ENV_PREFIX) + 22 + 1;
|
|
|
|
|
|
|
|
|
|
result = kmalloc(len, GFP_KERNEL);
|
|
|
|
|
if (!result)
|
|
|
|
|
return result;
|
|
|
|
|
|
|
|
|
|
copied = snprintf(result, len, GRACE_START_ENV_PREFIX "%ld",
|
|
|
|
|
grace_start);
|
|
|
|
|
if (copied >= len) {
|
|
|
|
|
/* just return nothing if output was truncated */
|
|
|
|
|
kfree(result);
|
|
|
|
|
return NULL;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
return result;
|
|
|
|
|
}
|
|
|
|
|
|
2012-11-12 20:00:48 +00:00
|
|
|
static int
|
2014-09-12 20:40:21 +00:00
|
|
|
nfsd4_umh_cltrack_upcall(char *cmd, char *arg, char *env0, char *env1)
|
2012-11-12 20:00:48 +00:00
|
|
|
{
|
2014-09-12 20:40:21 +00:00
|
|
|
char *envp[3];
|
2012-11-12 20:00:48 +00:00
|
|
|
char *argv[4];
|
|
|
|
|
int ret;
|
|
|
|
|
|
|
|
|
|
if (unlikely(!cltrack_prog[0])) {
|
|
|
|
|
dprintk("%s: cltrack_prog is disabled\n", __func__);
|
|
|
|
|
return -EACCES;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
dprintk("%s: cmd: %s\n", __func__, cmd);
|
|
|
|
|
dprintk("%s: arg: %s\n", __func__, arg ? arg : "(null)");
|
2014-09-12 20:40:21 +00:00
|
|
|
dprintk("%s: env0: %s\n", __func__, env0 ? env0 : "(null)");
|
|
|
|
|
dprintk("%s: env1: %s\n", __func__, env1 ? env1 : "(null)");
|
2012-11-12 20:00:50 +00:00
|
|
|
|
2014-09-12 20:40:21 +00:00
|
|
|
envp[0] = env0;
|
|
|
|
|
envp[1] = env1;
|
|
|
|
|
envp[2] = NULL;
|
2012-11-12 20:00:48 +00:00
|
|
|
|
|
|
|
|
argv[0] = (char *)cltrack_prog;
|
|
|
|
|
argv[1] = cmd;
|
|
|
|
|
argv[2] = arg;
|
|
|
|
|
argv[3] = NULL;
|
|
|
|
|
|
|
|
|
|
ret = call_usermodehelper(argv[0], argv, envp, UMH_WAIT_PROC);
|
|
|
|
|
/*
|
|
|
|
|
* Disable the upcall mechanism if we're getting an ENOENT or EACCES
|
|
|
|
|
* error. The admin can re-enable it on the fly by using sysfs
|
|
|
|
|
* once the problem has been fixed.
|
|
|
|
|
*/
|
|
|
|
|
if (ret == -ENOENT || ret == -EACCES) {
|
|
|
|
|
dprintk("NFSD: %s was not found or isn't executable (%d). "
|
|
|
|
|
"Setting cltrack_prog to blank string!",
|
|
|
|
|
cltrack_prog, ret);
|
|
|
|
|
cltrack_prog[0] = '\0';
|
|
|
|
|
}
|
|
|
|
|
dprintk("%s: %s return value: %d\n", __func__, cltrack_prog, ret);
|
|
|
|
|
|
|
|
|
|
return ret;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static char *
|
|
|
|
|
bin_to_hex_dup(const unsigned char *src, int srclen)
|
|
|
|
|
{
|
|
|
|
|
int i;
|
|
|
|
|
char *buf, *hex;
|
|
|
|
|
|
|
|
|
|
/* +1 for terminating NULL */
|
|
|
|
|
buf = kmalloc((srclen * 2) + 1, GFP_KERNEL);
|
|
|
|
|
if (!buf)
|
|
|
|
|
return buf;
|
|
|
|
|
|
|
|
|
|
hex = buf;
|
|
|
|
|
for (i = 0; i < srclen; i++) {
|
|
|
|
|
sprintf(hex, "%2.2x", *src++);
|
|
|
|
|
hex += 2;
|
|
|
|
|
}
|
|
|
|
|
return buf;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int
|
2014-09-12 20:40:21 +00:00
|
|
|
nfsd4_umh_cltrack_init(struct net *net)
|
2012-11-12 20:00:48 +00:00
|
|
|
{
|
2014-09-12 20:40:21 +00:00
|
|
|
int ret;
|
|
|
|
|
struct nfsd_net *nn = net_generic(net, nfsd_net_id);
|
|
|
|
|
char *grace_start = nfsd4_cltrack_grace_start(nn->boot_time);
|
|
|
|
|
|
2013-02-01 12:56:22 +00:00
|
|
|
/* XXX: The usermode helper s not working in container yet. */
|
|
|
|
|
if (net != &init_net) {
|
|
|
|
|
WARN(1, KERN_ERR "NFSD: attempt to initialize umh client "
|
|
|
|
|
"tracking in a container!\n");
|
|
|
|
|
return -EINVAL;
|
|
|
|
|
}
|
2014-09-12 20:40:21 +00:00
|
|
|
|
|
|
|
|
ret = nfsd4_umh_cltrack_upcall("init", NULL, grace_start, NULL);
|
|
|
|
|
kfree(grace_start);
|
|
|
|
|
return ret;
|
2012-11-12 20:00:48 +00:00
|
|
|
}
|
|
|
|
|
|
2014-09-12 20:40:21 +00:00
|
|
|
static void
|
|
|
|
|
nfsd4_cltrack_upcall_lock(struct nfs4_client *clp)
|
|
|
|
|
{
|
|
|
|
|
wait_on_bit_lock(&clp->cl_flags, NFSD4_CLIENT_UPCALL_LOCK,
|
|
|
|
|
TASK_UNINTERRUPTIBLE);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void
|
|
|
|
|
nfsd4_cltrack_upcall_unlock(struct nfs4_client *clp)
|
|
|
|
|
{
|
|
|
|
|
smp_mb__before_atomic();
|
|
|
|
|
clear_bit(NFSD4_CLIENT_UPCALL_LOCK, &clp->cl_flags);
|
|
|
|
|
smp_mb__after_atomic();
|
|
|
|
|
wake_up_bit(&clp->cl_flags, NFSD4_CLIENT_UPCALL_LOCK);
|
|
|
|
|
}
|
|
|
|
|
|
2012-11-12 20:00:48 +00:00
|
|
|
static void
|
|
|
|
|
nfsd4_umh_cltrack_create(struct nfs4_client *clp)
|
|
|
|
|
{
|
2014-09-12 20:40:21 +00:00
|
|
|
char *hexid, *has_session, *grace_start;
|
|
|
|
|
struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
|
2012-11-12 20:00:48 +00:00
|
|
|
|
|
|
|
|
hexid = bin_to_hex_dup(clp->cl_name.data, clp->cl_name.len);
|
|
|
|
|
if (!hexid) {
|
|
|
|
|
dprintk("%s: can't allocate memory for upcall!\n", __func__);
|
|
|
|
|
return;
|
|
|
|
|
}
|
2014-09-12 20:40:21 +00:00
|
|
|
|
2014-09-12 20:40:21 +00:00
|
|
|
has_session = nfsd4_cltrack_client_has_session(clp);
|
|
|
|
|
grace_start = nfsd4_cltrack_grace_start(nn->boot_time);
|
2014-09-12 20:40:21 +00:00
|
|
|
|
|
|
|
|
nfsd4_cltrack_upcall_lock(clp);
|
2014-09-12 20:40:21 +00:00
|
|
|
if (!nfsd4_umh_cltrack_upcall("create", hexid, has_session, grace_start))
|
|
|
|
|
set_bit(NFSD4_CLIENT_STABLE, &clp->cl_flags);
|
2014-09-12 20:40:21 +00:00
|
|
|
nfsd4_cltrack_upcall_unlock(clp);
|
|
|
|
|
|
2014-09-12 20:40:21 +00:00
|
|
|
kfree(has_session);
|
|
|
|
|
kfree(grace_start);
|
2012-11-12 20:00:48 +00:00
|
|
|
kfree(hexid);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void
|
|
|
|
|
nfsd4_umh_cltrack_remove(struct nfs4_client *clp)
|
|
|
|
|
{
|
|
|
|
|
char *hexid;
|
|
|
|
|
|
2014-09-12 20:40:21 +00:00
|
|
|
if (!test_bit(NFSD4_CLIENT_STABLE, &clp->cl_flags))
|
|
|
|
|
return;
|
|
|
|
|
|
2012-11-12 20:00:48 +00:00
|
|
|
hexid = bin_to_hex_dup(clp->cl_name.data, clp->cl_name.len);
|
|
|
|
|
if (!hexid) {
|
|
|
|
|
dprintk("%s: can't allocate memory for upcall!\n", __func__);
|
|
|
|
|
return;
|
|
|
|
|
}
|
2014-09-12 20:40:21 +00:00
|
|
|
|
|
|
|
|
nfsd4_cltrack_upcall_lock(clp);
|
2014-09-12 20:40:21 +00:00
|
|
|
if (test_bit(NFSD4_CLIENT_STABLE, &clp->cl_flags) &&
|
|
|
|
|
nfsd4_umh_cltrack_upcall("remove", hexid, NULL, NULL) == 0)
|
|
|
|
|
clear_bit(NFSD4_CLIENT_STABLE, &clp->cl_flags);
|
2014-09-12 20:40:21 +00:00
|
|
|
nfsd4_cltrack_upcall_unlock(clp);
|
|
|
|
|
|
2012-11-12 20:00:48 +00:00
|
|
|
kfree(hexid);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static int
|
|
|
|
|
nfsd4_umh_cltrack_check(struct nfs4_client *clp)
|
|
|
|
|
{
|
|
|
|
|
int ret;
|
2014-09-12 20:40:21 +00:00
|
|
|
char *hexid, *has_session, *legacy;
|
2012-11-12 20:00:48 +00:00
|
|
|
|
2014-09-12 20:40:21 +00:00
|
|
|
if (test_bit(NFSD4_CLIENT_STABLE, &clp->cl_flags))
|
|
|
|
|
return 0;
|
|
|
|
|
|
2012-11-12 20:00:48 +00:00
|
|
|
hexid = bin_to_hex_dup(clp->cl_name.data, clp->cl_name.len);
|
|
|
|
|
if (!hexid) {
|
|
|
|
|
dprintk("%s: can't allocate memory for upcall!\n", __func__);
|
|
|
|
|
return -ENOMEM;
|
|
|
|
|
}
|
2014-09-12 20:40:21 +00:00
|
|
|
|
|
|
|
|
has_session = nfsd4_cltrack_client_has_session(clp);
|
2012-11-12 20:00:57 +00:00
|
|
|
legacy = nfsd4_cltrack_legacy_recdir(&clp->cl_name);
|
2014-09-12 20:40:21 +00:00
|
|
|
|
|
|
|
|
nfsd4_cltrack_upcall_lock(clp);
|
2014-09-12 20:40:21 +00:00
|
|
|
if (test_bit(NFSD4_CLIENT_STABLE, &clp->cl_flags)) {
|
|
|
|
|
ret = 0;
|
|
|
|
|
} else {
|
|
|
|
|
ret = nfsd4_umh_cltrack_upcall("check", hexid, has_session, legacy);
|
|
|
|
|
if (ret == 0)
|
|
|
|
|
set_bit(NFSD4_CLIENT_STABLE, &clp->cl_flags);
|
|
|
|
|
}
|
2014-09-12 20:40:21 +00:00
|
|
|
nfsd4_cltrack_upcall_unlock(clp);
|
2014-09-12 20:40:21 +00:00
|
|
|
kfree(has_session);
|
2012-11-12 20:00:50 +00:00
|
|
|
kfree(legacy);
|
2012-11-12 20:00:48 +00:00
|
|
|
kfree(hexid);
|
2014-09-12 20:40:21 +00:00
|
|
|
|
2012-11-12 20:00:48 +00:00
|
|
|
return ret;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static void
|
2014-09-12 20:40:20 +00:00
|
|
|
nfsd4_umh_cltrack_grace_done(struct nfsd_net *nn)
|
2012-11-12 20:00:48 +00:00
|
|
|
{
|
2012-11-12 20:00:50 +00:00
|
|
|
char *legacy;
|
2012-11-12 20:00:48 +00:00
|
|
|
char timestr[22]; /* FIXME: better way to determine max size? */
|
|
|
|
|
|
2014-09-12 20:40:20 +00:00
|
|
|
sprintf(timestr, "%ld", nn->boot_time);
|
2012-11-12 20:00:50 +00:00
|
|
|
legacy = nfsd4_cltrack_legacy_topdir();
|
2014-09-12 20:40:21 +00:00
|
|
|
nfsd4_umh_cltrack_upcall("gracedone", timestr, legacy, NULL);
|
2012-11-12 20:00:50 +00:00
|
|
|
kfree(legacy);
|
2012-11-12 20:00:48 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
static struct nfsd4_client_tracking_ops nfsd4_umh_tracking_ops = {
|
|
|
|
|
.init = nfsd4_umh_cltrack_init,
|
|
|
|
|
.exit = NULL,
|
|
|
|
|
.create = nfsd4_umh_cltrack_create,
|
|
|
|
|
.remove = nfsd4_umh_cltrack_remove,
|
|
|
|
|
.check = nfsd4_umh_cltrack_check,
|
|
|
|
|
.grace_done = nfsd4_umh_cltrack_grace_done,
|
|
|
|
|
};
|
|
|
|
|
|
2012-03-21 20:42:43 +00:00
|
|
|
int
|
|
|
|
|
nfsd4_client_tracking_init(struct net *net)
|
|
|
|
|
{
|
|
|
|
|
int status;
|
2012-03-21 13:52:07 +00:00
|
|
|
struct path path;
|
2012-12-04 11:29:27 +00:00
|
|
|
struct nfsd_net *nn = net_generic(net, nfsd_net_id);
|
2012-03-21 20:42:43 +00:00
|
|
|
|
2012-11-12 20:00:49 +00:00
|
|
|
/* just run the init if it the method is already decided */
|
2012-12-04 11:29:27 +00:00
|
|
|
if (nn->client_tracking_ops)
|
2012-11-12 20:00:49 +00:00
|
|
|
goto do_init;
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* First, try a UMH upcall. It should succeed or fail quickly, so
|
|
|
|
|
* there's little harm in trying that first.
|
|
|
|
|
*/
|
2012-12-04 11:29:27 +00:00
|
|
|
nn->client_tracking_ops = &nfsd4_umh_tracking_ops;
|
|
|
|
|
status = nn->client_tracking_ops->init(net);
|
2012-11-12 20:00:49 +00:00
|
|
|
if (!status)
|
|
|
|
|
return status;
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
|
* See if the recoverydir exists and is a directory. If it is,
|
|
|
|
|
* then use the legacy ops.
|
|
|
|
|
*/
|
2012-12-04 11:29:27 +00:00
|
|
|
nn->client_tracking_ops = &nfsd4_legacy_tracking_ops;
|
2012-11-12 20:00:49 +00:00
|
|
|
status = kern_path(nfs4_recoverydir(), LOOKUP_FOLLOW, &path);
|
|
|
|
|
if (!status) {
|
|
|
|
|
status = S_ISDIR(path.dentry->d_inode->i_mode);
|
|
|
|
|
path_put(&path);
|
|
|
|
|
if (status)
|
|
|
|
|
goto do_init;
|
2012-03-21 13:52:07 +00:00
|
|
|
}
|
2012-03-21 20:42:43 +00:00
|
|
|
|
2012-11-12 20:00:49 +00:00
|
|
|
/* Finally, try to use nfsdcld */
|
2012-12-04 11:29:27 +00:00
|
|
|
nn->client_tracking_ops = &nfsd4_cld_tracking_ops;
|
2012-11-12 20:00:51 +00:00
|
|
|
printk(KERN_WARNING "NFSD: the nfsdcld client tracking upcall will be "
|
|
|
|
|
"removed in 3.10. Please transition to using "
|
|
|
|
|
"nfsdcltrack.\n");
|
2012-11-12 20:00:49 +00:00
|
|
|
do_init:
|
2012-12-04 11:29:27 +00:00
|
|
|
status = nn->client_tracking_ops->init(net);
|
2012-03-21 20:42:43 +00:00
|
|
|
if (status) {
|
|
|
|
|
printk(KERN_WARNING "NFSD: Unable to initialize client "
|
|
|
|
|
"recovery tracking! (%d)\n", status);
|
2012-12-04 11:29:27 +00:00
|
|
|
nn->client_tracking_ops = NULL;
|
2012-03-21 20:42:43 +00:00
|
|
|
}
|
|
|
|
|
return status;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void
|
|
|
|
|
nfsd4_client_tracking_exit(struct net *net)
|
|
|
|
|
{
|
2012-12-04 11:29:27 +00:00
|
|
|
struct nfsd_net *nn = net_generic(net, nfsd_net_id);
|
|
|
|
|
|
|
|
|
|
if (nn->client_tracking_ops) {
|
|
|
|
|
if (nn->client_tracking_ops->exit)
|
|
|
|
|
nn->client_tracking_ops->exit(net);
|
|
|
|
|
nn->client_tracking_ops = NULL;
|
2012-03-21 20:42:43 +00:00
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void
|
|
|
|
|
nfsd4_client_record_create(struct nfs4_client *clp)
|
|
|
|
|
{
|
2012-12-04 11:29:27 +00:00
|
|
|
struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
|
|
|
|
|
|
|
|
|
|
if (nn->client_tracking_ops)
|
|
|
|
|
nn->client_tracking_ops->create(clp);
|
2012-03-21 20:42:43 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void
|
|
|
|
|
nfsd4_client_record_remove(struct nfs4_client *clp)
|
|
|
|
|
{
|
2012-12-04 11:29:27 +00:00
|
|
|
struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
|
|
|
|
|
|
|
|
|
|
if (nn->client_tracking_ops)
|
|
|
|
|
nn->client_tracking_ops->remove(clp);
|
2012-03-21 20:42:43 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
int
|
|
|
|
|
nfsd4_client_record_check(struct nfs4_client *clp)
|
|
|
|
|
{
|
2012-12-04 11:29:27 +00:00
|
|
|
struct nfsd_net *nn = net_generic(clp->net, nfsd_net_id);
|
|
|
|
|
|
|
|
|
|
if (nn->client_tracking_ops)
|
|
|
|
|
return nn->client_tracking_ops->check(clp);
|
2012-03-21 20:42:43 +00:00
|
|
|
|
|
|
|
|
return -EOPNOTSUPP;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void
|
2014-09-12 20:40:20 +00:00
|
|
|
nfsd4_record_grace_done(struct nfsd_net *nn)
|
2012-03-21 20:42:43 +00:00
|
|
|
{
|
2012-12-04 11:29:27 +00:00
|
|
|
if (nn->client_tracking_ops)
|
2014-09-12 20:40:20 +00:00
|
|
|
nn->client_tracking_ops->grace_done(nn);
|
2012-03-21 20:42:43 +00:00
|
|
|
}
|
2012-03-21 13:52:08 +00:00
|
|
|
|
|
|
|
|
static int
|
|
|
|
|
rpc_pipefs_event(struct notifier_block *nb, unsigned long event, void *ptr)
|
|
|
|
|
{
|
|
|
|
|
struct super_block *sb = ptr;
|
|
|
|
|
struct net *net = sb->s_fs_info;
|
|
|
|
|
struct nfsd_net *nn = net_generic(net, nfsd_net_id);
|
|
|
|
|
struct cld_net *cn = nn->cld_net;
|
|
|
|
|
struct dentry *dentry;
|
|
|
|
|
int ret = 0;
|
|
|
|
|
|
|
|
|
|
if (!try_module_get(THIS_MODULE))
|
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
|
|
if (!cn) {
|
|
|
|
|
module_put(THIS_MODULE);
|
|
|
|
|
return 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
switch (event) {
|
|
|
|
|
case RPC_PIPEFS_MOUNT:
|
|
|
|
|
dentry = nfsd4_cld_register_sb(sb, cn->cn_pipe);
|
|
|
|
|
if (IS_ERR(dentry)) {
|
|
|
|
|
ret = PTR_ERR(dentry);
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
cn->cn_pipe->dentry = dentry;
|
|
|
|
|
break;
|
|
|
|
|
case RPC_PIPEFS_UMOUNT:
|
|
|
|
|
if (cn->cn_pipe->dentry)
|
|
|
|
|
nfsd4_cld_unregister_sb(cn->cn_pipe);
|
|
|
|
|
break;
|
|
|
|
|
default:
|
|
|
|
|
ret = -ENOTSUPP;
|
|
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
module_put(THIS_MODULE);
|
|
|
|
|
return ret;
|
|
|
|
|
}
|
|
|
|
|
|
2012-04-25 20:56:22 +00:00
|
|
|
static struct notifier_block nfsd4_cld_block = {
|
2012-03-21 13:52:08 +00:00
|
|
|
.notifier_call = rpc_pipefs_event,
|
|
|
|
|
};
|
2012-03-29 11:52:49 +00:00
|
|
|
|
|
|
|
|
int
|
|
|
|
|
register_cld_notifier(void)
|
|
|
|
|
{
|
|
|
|
|
return rpc_pipefs_notifier_register(&nfsd4_cld_block);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void
|
|
|
|
|
unregister_cld_notifier(void)
|
|
|
|
|
{
|
|
|
|
|
rpc_pipefs_notifier_unregister(&nfsd4_cld_block);
|
|
|
|
|
}
|
