mirror of
https://git.proxmox.com/git/mirror_zfs.git
synced 2025-05-30 10:24:58 +03:00
c8fa39b46c
### Background Various admin operations will be invoked by some userspace task, but the work will be done on a separate kernel thread at a later time. Snapshots are an example, which are triggered through zfs_ioc_snapshot() -> dsl_dataset_snapshot(), but the actual work is from a task dispatched to dp_sync_taskq. Many such tasks end up in dsl_enforce_ds_ss_limits(), where various limits and permissions are enforced. Among other things, it is necessary to ensure that the invoking task (that is, the user) has permission to do things. We can't simply check if the running task has permission; it is a privileged kernel thread, which can do anything. However, in the general case it's not safe to simply query the task for its permissions at the check time, as the task may not exist any more, or its permissions may have changed since it was first invoked. So instead, we capture the permissions by saving CRED() in the user task, and then using it for the check through the secpolicy_* functions. ### Current implementation The current code calls CRED() to get the credential, which gets a pointer to the cred_t inside the current task and passes it to the worker task. However, it doesn't take a reference to the cred_t, and so expects that it won't change, and that the task continues to exist. In practice that is always the case, because we don't let the calling task return from the kernel until the work is done. For Linux, we also take a reference to the current task, because the Linux credential APIs for the most part do not check an arbitrary credential, but rather, query what a task can do. See secpolicy_zfs_proc(). Again, we don't take a reference on the task, just a pointer to it. ### Changes We change to calling crhold() on the task credential, and crfree() when we're done with it. This ensures it stays alive and unchanged for the duration of the call. On the Linux side, we change the main policy checking function priv_policy_ns() to use override_creds()/revert_creds() if necessary to make the provided credential active in the current task, allowing the standard task-permission APIs to do the needed check. Since the task pointer is no longer required, this lets us entirely remove secpolicy_zfs_proc() and the need to carry a task pointer around as well. Sponsored-by: https://despairlabs.com/sponsor/ Signed-off-by: Rob Norris <robn@despairlabs.com> Reviewed-by: Pavel Snajdr <snajpa@snajpa.net> Reviewed-by: Alexander Motin <mav@FreeBSD.org> Reviewed-by: Kyle Evans <kevans@FreeBSD.org> Reviewed-by: Tony Hutter <hutter2@llnl.gov>
74 lines
3.3 KiB
C
74 lines
3.3 KiB
C
// SPDX-License-Identifier: BSD-2-Clause
|
|
/*
|
|
* Copyright (c) 2007 Pawel Jakub Dawidek <pjd@FreeBSD.org>
|
|
* All rights reserved.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in the
|
|
* documentation and/or other materials provided with the distribution.
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE AUTHORS AND CONTRIBUTORS ``AS IS'' AND
|
|
* ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
|
|
* ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHORS OR CONTRIBUTORS BE LIABLE
|
|
* FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
|
|
* DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
|
|
* OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
|
|
* LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
|
|
* OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
|
|
* SUCH DAMAGE.
|
|
*
|
|
* $ $FreeBSD$
|
|
*/
|
|
|
|
#ifndef _OPENSOLARIS_SYS_POLICY_H_
|
|
#define _OPENSOLARIS_SYS_POLICY_H_
|
|
|
|
#include <sys/param.h>
|
|
#include <sys/xvattr.h>
|
|
#include <sys/vnode.h>
|
|
struct mount;
|
|
struct vattr;
|
|
struct znode;
|
|
|
|
int secpolicy_nfs(cred_t *cr);
|
|
int secpolicy_zfs(cred_t *crd);
|
|
int secpolicy_sys_config(cred_t *cr, int checkonly);
|
|
int secpolicy_zinject(cred_t *cr);
|
|
int secpolicy_fs_unmount(cred_t *cr, struct mount *vfsp);
|
|
int secpolicy_basic_link(vnode_t *vp, cred_t *cr);
|
|
int secpolicy_vnode_owner(vnode_t *vp, cred_t *cr, uid_t owner);
|
|
int secpolicy_vnode_chown(vnode_t *vp, cred_t *cr, uid_t owner);
|
|
int secpolicy_vnode_stky_modify(cred_t *cr);
|
|
int secpolicy_vnode_remove(vnode_t *vp, cred_t *cr);
|
|
int secpolicy_vnode_access(cred_t *cr, vnode_t *vp, uid_t owner,
|
|
accmode_t accmode);
|
|
int secpolicy_vnode_access2(cred_t *cr, vnode_t *vp, uid_t owner,
|
|
accmode_t curmode, accmode_t wantmode);
|
|
int secpolicy_vnode_any_access(cred_t *cr, vnode_t *vp, uid_t owner);
|
|
int secpolicy_vnode_setdac(vnode_t *vp, cred_t *cr, uid_t owner);
|
|
int secpolicy_vnode_setattr(cred_t *cr, vnode_t *vp, struct vattr *vap,
|
|
const struct vattr *ovap, int flags,
|
|
int unlocked_access(void *, int, cred_t *), void *node);
|
|
int secpolicy_vnode_create_gid(cred_t *cr);
|
|
int secpolicy_vnode_setids_setgids(vnode_t *vp, cred_t *cr, gid_t gid);
|
|
int secpolicy_vnode_setid_retain(struct znode *zp, cred_t *cr,
|
|
boolean_t issuidroot);
|
|
void secpolicy_setid_clear(struct vattr *vap, vnode_t *vp, cred_t *cr);
|
|
int secpolicy_setid_setsticky_clear(vnode_t *vp, struct vattr *vap,
|
|
const struct vattr *ovap, cred_t *cr);
|
|
int secpolicy_fs_owner(struct mount *vfsp, cred_t *cr);
|
|
int secpolicy_fs_mount(cred_t *cr, vnode_t *mvp, struct mount *vfsp);
|
|
void secpolicy_fs_mount_clearopts(cred_t *cr, struct mount *vfsp);
|
|
int secpolicy_xvattr(vnode_t *vp, xvattr_t *xvap, uid_t owner, cred_t *cr,
|
|
vtype_t vtype);
|
|
int secpolicy_smb(cred_t *cr);
|
|
|
|
#endif /* _OPENSOLARIS_SYS_POLICY_H_ */
|