[lustre-devel] [PATCH 18/20] staging: lustre: llite: Remove filtering of seclabel xattr
Robin Humble
rjh+lustre at cita.utoronto.ca
Thu Jul 27 10:14:31 PDT 2017
Hi James,
sorry, but this isn't my patch.
I deleted a couple of lines from xattr.c, not the below.
I think you might have got the wrong commit comment somehow?
I took lkml etc. out of the CC 'cos I'm not subscribed there.
cheers,
robin
On Wed, Jul 26, 2017 at 11:22:34AM -0400, James Simmons wrote:
>From: Robin Humble <plaguedbypenguins at gmail.com>
>
>The security.capability xattr is used to implement File
>Capabilities in recent Linux versions. Capabilities are a
>fine grained approach to granting executables elevated
>privileges. eg. /bin/ping can have capabilities
>cap_net_admin, cap_net_raw+ep instead of being setuid root.
>
>This xattr has long been filtered out by llite, initially for
>stability reasons (b15587), and later over performance
>concerns as this xattr is read for every file with eg.
>'ls --color'. Since LU-2869 xattr's are cached on clients,
>alleviating most performance concerns.
>
>Removing llite's filtering of the security.capability xattr
>enables using Lustre as a root filesystem, which is used on
>some large clusters.
>
>Signed-off-by: Robin Humble <plaguedbypenguins at gmail.com>
>Intel-bug-id: https://jira.hpdd.intel.com/browse/LU-9562
>Reviewed-on: https://review.whamcloud.com/27292
>Reviewed-by: John L. Hammond <john.hammond at intel.com>
>Reviewed-by: Sebastien Buisson <sbuisson at ddn.com>
>Reviewed-by: Oleg Drokin <oleg.drokin at intel.com>
>Signed-off-by: James Simmons <jsimmons at infradead.org>
>---
> drivers/staging/lustre/lustre/llite/file.c | 58 ++++++++++++++++++++++
> .../staging/lustre/lustre/llite/llite_internal.h | 4 ++
> drivers/staging/lustre/lustre/llite/namei.c | 6 +++
> 3 files changed, 68 insertions(+)
>
>diff --git a/drivers/staging/lustre/lustre/llite/file.c b/drivers/staging/lustre/lustre/llite/file.c
>index 215479a..a324580 100644
>--- a/drivers/staging/lustre/lustre/llite/file.c
>+++ b/drivers/staging/lustre/lustre/llite/file.c
>@@ -3040,6 +3040,61 @@ struct posix_acl *ll_get_acl(struct inode *inode, int type)
> return acl;
> }
>
>+#ifdef CONFIG_FS_POSIX_ACL
>+int ll_set_acl(struct inode *inode, struct posix_acl *acl, int type)
>+{
>+ const char *name = NULL;
>+ char *value = NULL;
>+ size_t size = 0;
>+ int rc = 0;
>+
>+ switch (type) {
>+ case ACL_TYPE_ACCESS:
>+ if (acl) {
>+ rc = posix_acl_update_mode(inode, &inode->i_mode, &acl);
>+ if (rc)
>+ goto out;
>+ }
>+ name = XATTR_NAME_POSIX_ACL_ACCESS;
>+ break;
>+ case ACL_TYPE_DEFAULT:
>+ if (!S_ISDIR(inode->i_mode)) {
>+ rc = acl ? -EACCES : 0;
>+ goto out;
>+ }
>+ name = XATTR_NAME_POSIX_ACL_DEFAULT;
>+ break;
>+ default:
>+ rc = -EINVAL;
>+ goto out;
>+ }
>+
>+ if (acl) {
>+ size = posix_acl_xattr_size(acl->a_count);
>+ value = kmalloc(size, GFP_NOFS);
>+ if (!value) {
>+ rc = -ENOMEM;
>+ goto out;
>+ }
>+
>+ rc = posix_acl_to_xattr(&init_user_ns, acl, value, size);
>+ if (rc < 0)
>+ goto out_free;
>+ }
>+
>+ /* dentry is only used for *.lov attributes so it's safe to be NULL */
>+ rc = __vfs_setxattr(NULL, inode, name, value, size, XATTR_CREATE);
>+out_free:
>+ kfree(value);
>+out:
>+ if (!rc)
>+ set_cached_acl(inode, type, acl);
>+ else
>+ forget_cached_acl(inode, type);
>+ return rc;
>+}
>+#endif /* CONFIG_FS_POSIX_ACL */
>+
> int ll_inode_permission(struct inode *inode, int mask)
> {
> struct ll_sb_info *sbi;
>@@ -3162,6 +3217,9 @@ int ll_inode_permission(struct inode *inode, int mask)
> .listxattr = ll_listxattr,
> .fiemap = ll_fiemap,
> .get_acl = ll_get_acl,
>+#ifdef CONFIG_FS_POSIX_ACL
>+ .set_acl = ll_set_acl,
>+#endif
> };
>
> /* dynamic ioctl number support routines */
>diff --git a/drivers/staging/lustre/lustre/llite/llite_internal.h b/drivers/staging/lustre/lustre/llite/llite_internal.h
>index cd3311a..b3374bc 100644
>--- a/drivers/staging/lustre/lustre/llite/llite_internal.h
>+++ b/drivers/staging/lustre/lustre/llite/llite_internal.h
>@@ -752,6 +752,10 @@ enum ldlm_mode ll_take_md_lock(struct inode *inode, __u64 bits,
> int ll_getattr(const struct path *path, struct kstat *stat,
> u32 request_mask, unsigned int flags);
> struct posix_acl *ll_get_acl(struct inode *inode, int type);
>+#ifdef CONFIG_FS_POSIX_ACL
>+int ll_set_acl(struct inode *inode, struct posix_acl *acl, int type);
>+#endif /* CONFIG_FS_POSIX_ACL */
>+
> int ll_migrate(struct inode *parent, struct file *file, int mdtidx,
> const char *name, int namelen);
> int ll_get_fid_by_name(struct inode *parent, const char *name,
>diff --git a/drivers/staging/lustre/lustre/llite/namei.c b/drivers/staging/lustre/lustre/llite/namei.c
>index a208a8b..14dccbe 100644
>--- a/drivers/staging/lustre/lustre/llite/namei.c
>+++ b/drivers/staging/lustre/lustre/llite/namei.c
>@@ -1187,6 +1187,9 @@ static int ll_rename(struct inode *src, struct dentry *src_dchild,
> .permission = ll_inode_permission,
> .listxattr = ll_listxattr,
> .get_acl = ll_get_acl,
>+#ifdef CONFIG_FS_POSIX_ACL
>+ .set_acl = ll_set_acl,
>+#endif
> };
>
> const struct inode_operations ll_special_inode_operations = {
>@@ -1195,4 +1198,7 @@ static int ll_rename(struct inode *src, struct dentry *src_dchild,
> .permission = ll_inode_permission,
> .listxattr = ll_listxattr,
> .get_acl = ll_get_acl,
>+#ifdef CONFIG_FS_POSIX_ACL
>+ .set_acl = ll_set_acl,
>+#endif
> };
>--
>1.8.3.1
>
>_______________________________________________
>lustre-devel mailing list
>lustre-devel at lists.lustre.org
>http://lists.lustre.org/listinfo.cgi/lustre-devel-lustre.org
More information about the lustre-devel
mailing list