linux-kernel - Re: [PATCH -V2 00/16] New ACL format for better NFSv4 acl interoperability

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <m34ofucxes.fsf@linux.vnet.ibm.com>
Date:	Tue, 20 Jul 2010 15:01:07 +0530
From:	"Aneesh Kumar K. V" <aneesh.kumar@...ux.vnet.ibm.com>
To:	Andreas Gruenbacher <agruen@...e.de>
Cc:	sfrench@...ibm.com, ffilz@...ibm.com, adilger@....com,
	sandeen@...hat.com, tytso@....edu, staubach@...hat.com,
	bfields@...i.umich.edu, jlayton@...hat.com,
	linux-fsdevel@...r.kernel.org, nfsv4@...ux-nfs.org,
	linux-ext4@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH -V2 00/16]  New ACL format for better NFSv4 acl interoperability

On Mon, 19 Jul 2010 21:19:50 +0200, Andreas Gruenbacher <agruen@...e.de> wrote:
> Aneesh,
> 
> here is a patch on top of the richacl-upstream queue.
> 
> So far, we were assuming that acls are always masked, and the file masks
> could be set so that they would not mask any permissions.  This is fine
> for permission checking, but richacl_apply_masks() didn't recognize when
> the file masks were set to mask nothing, and was still transforming such
> acls unnecessarily.  This could lead to correct but surprising results.
> 
> Instead of using a flag here we could check if the file masks are set to
> "ineffective" values, but that would require the same computation as
> richacl_compute_max_masks(), which can be a slow on large acls.  It is a
> lot easier to instead remember if the file masks are "effective".
> 
> (We still need to compute the file masks in nfsd where no file masks are
> supplied so that the file permission bits will be set to a reasonable
> value. user space will always pass valid file masks in, so we are covered
> in that side.)

We need to update ACL4_VALID_FLAGS to now consider ACL4_MASKED as a
valid flag. This is also needed for userspace. On a related note,
should we move ACL4_MASKED and ACL4_POSIX_MAPPED to be the higher
bits ? That would make sure we will be able to accomodate new flag
value NFSv4 define. Something like 

diff --git a/include/linux/richacl.h b/include/linux/richacl.h
index 929cc32..ff3c12b 100644
--- a/include/linux/richacl.h
+++ b/include/linux/richacl.h
@@ -50,16 +50,17 @@ struct richacl {
 /* a_flags values */
 #define ACL4_AUTO_INHERIT		0x01
 #define ACL4_PROTECTED			0x02
-/*#define ACL4_DEFAULTED			0x04*/
-#define ACL4_MASKED			0x08
-#define ACL4_POSIX_MAPPED		0x10
+#define ACL4_DEFAULTED			0x04
+/* flag value defined by Richacl */
+#define ACL4_MASKED			0x40
+#define ACL4_POSIX_MAPPED		0x80
 
 #define ACL4_VALID_FLAGS (	\
 	ACL4_AUTO_INHERIT |	\
 	ACL4_PROTECTED |	\
+	ACL4_MASKED |		\
 	ACL4_POSIX_MAPPED)
 
-
 /* e_type values */
 #define ACE4_ACCESS_ALLOWED_ACE_TYPE	0x0000
 #define ACE4_ACCESS_DENIED_ACE_TYPE	0x0001



-aneesh


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/