4 * UID and GID to name mapping for clients.
6 * Copyright (c) 2002 The Regents of the University of Michigan.
9 * Marius Aamodt Eriksen <marius@umich.edu>
11 * Redistribution and use in source and binary forms, with or without
12 * modification, are permitted provided that the following conditions
15 * 1. Redistributions of source code must retain the above copyright
16 * notice, this list of conditions and the following disclaimer.
17 * 2. Redistributions in binary form must reproduce the above copyright
18 * notice, this list of conditions and the following disclaimer in the
19 * documentation and/or other materials provided with the distribution.
20 * 3. Neither the name of the University nor the names of its
21 * contributors may be used to endorse or promote products derived
22 * from this software without specific prior written permission.
24 * THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESS OR IMPLIED
25 * WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
26 * MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
27 * DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
29 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
30 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
31 * BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
32 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
33 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
34 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
36 #include <linux/types.h>
37 #include <linux/parser.h>
39 #include <linux/nfs_idmap.h>
40 #include <net/net_namespace.h>
41 #include <linux/sunrpc/rpc_pipe_fs.h>
42 #include <linux/nfs_fs.h>
43 #include <linux/nfs_fs_sb.h>
44 #include <linux/key.h>
45 #include <linux/keyctl.h>
46 #include <linux/key-type.h>
47 #include <keys/user-type.h>
48 #include <linux/module.h>
53 #define NFS_UINT_MAXLEN 11
55 /* Default cache timeout is 10 minutes */
56 unsigned int nfs_idmap_cache_timeout
= 600;
57 static const struct cred
*id_resolver_cache
;
58 static struct key_type key_type_id_resolver_legacy
;
62 * nfs_fattr_init_names - initialise the nfs_fattr owner_name/group_name fields
63 * @fattr: fully initialised struct nfs_fattr
64 * @owner_name: owner name string cache
65 * @group_name: group name string cache
67 void nfs_fattr_init_names(struct nfs_fattr
*fattr
,
68 struct nfs4_string
*owner_name
,
69 struct nfs4_string
*group_name
)
71 fattr
->owner_name
= owner_name
;
72 fattr
->group_name
= group_name
;
75 static void nfs_fattr_free_owner_name(struct nfs_fattr
*fattr
)
77 fattr
->valid
&= ~NFS_ATTR_FATTR_OWNER_NAME
;
78 kfree(fattr
->owner_name
->data
);
81 static void nfs_fattr_free_group_name(struct nfs_fattr
*fattr
)
83 fattr
->valid
&= ~NFS_ATTR_FATTR_GROUP_NAME
;
84 kfree(fattr
->group_name
->data
);
87 static bool nfs_fattr_map_owner_name(struct nfs_server
*server
, struct nfs_fattr
*fattr
)
89 struct nfs4_string
*owner
= fattr
->owner_name
;
92 if (!(fattr
->valid
& NFS_ATTR_FATTR_OWNER_NAME
))
94 if (nfs_map_name_to_uid(server
, owner
->data
, owner
->len
, &uid
) == 0) {
96 fattr
->valid
|= NFS_ATTR_FATTR_OWNER
;
101 static bool nfs_fattr_map_group_name(struct nfs_server
*server
, struct nfs_fattr
*fattr
)
103 struct nfs4_string
*group
= fattr
->group_name
;
106 if (!(fattr
->valid
& NFS_ATTR_FATTR_GROUP_NAME
))
108 if (nfs_map_group_to_gid(server
, group
->data
, group
->len
, &gid
) == 0) {
110 fattr
->valid
|= NFS_ATTR_FATTR_GROUP
;
116 * nfs_fattr_free_names - free up the NFSv4 owner and group strings
117 * @fattr: a fully initialised nfs_fattr structure
119 void nfs_fattr_free_names(struct nfs_fattr
*fattr
)
121 if (fattr
->valid
& NFS_ATTR_FATTR_OWNER_NAME
)
122 nfs_fattr_free_owner_name(fattr
);
123 if (fattr
->valid
& NFS_ATTR_FATTR_GROUP_NAME
)
124 nfs_fattr_free_group_name(fattr
);
128 * nfs_fattr_map_and_free_names - map owner/group strings into uid/gid and free
129 * @server: pointer to the filesystem nfs_server structure
130 * @fattr: a fully initialised nfs_fattr structure
132 * This helper maps the cached NFSv4 owner/group strings in fattr into
133 * their numeric uid/gid equivalents, and then frees the cached strings.
135 void nfs_fattr_map_and_free_names(struct nfs_server
*server
, struct nfs_fattr
*fattr
)
137 if (nfs_fattr_map_owner_name(server
, fattr
))
138 nfs_fattr_free_owner_name(fattr
);
139 if (nfs_fattr_map_group_name(server
, fattr
))
140 nfs_fattr_free_group_name(fattr
);
143 static int nfs_map_string_to_numeric(const char *name
, size_t namelen
, __u32
*res
)
148 if (memchr(name
, '@', namelen
) != NULL
|| namelen
>= sizeof(buf
))
150 memcpy(buf
, name
, namelen
);
152 if (strict_strtoul(buf
, 0, &val
) != 0)
158 static int nfs_map_numeric_to_string(__u32 id
, char *buf
, size_t buflen
)
160 return snprintf(buf
, buflen
, "%u", id
);
163 static struct key_type key_type_id_resolver
= {
164 .name
= "id_resolver",
165 .instantiate
= user_instantiate
,
167 .revoke
= user_revoke
,
168 .destroy
= user_destroy
,
169 .describe
= user_describe
,
173 static int nfs_idmap_init_keyring(void)
179 printk(KERN_NOTICE
"NFS: Registering the %s key type\n",
180 key_type_id_resolver
.name
);
182 cred
= prepare_kernel_cred(NULL
);
186 keyring
= key_alloc(&key_type_keyring
, ".id_resolver", 0, 0, cred
,
187 (KEY_POS_ALL
& ~KEY_POS_SETATTR
) |
188 KEY_USR_VIEW
| KEY_USR_READ
,
189 KEY_ALLOC_NOT_IN_QUOTA
);
190 if (IS_ERR(keyring
)) {
191 ret
= PTR_ERR(keyring
);
192 goto failed_put_cred
;
195 ret
= key_instantiate_and_link(keyring
, NULL
, 0, NULL
, NULL
);
199 ret
= register_key_type(&key_type_id_resolver
);
203 set_bit(KEY_FLAG_ROOT_CAN_CLEAR
, &keyring
->flags
);
204 cred
->thread_keyring
= keyring
;
205 cred
->jit_keyring
= KEY_REQKEY_DEFL_THREAD_KEYRING
;
206 id_resolver_cache
= cred
;
216 static void nfs_idmap_quit_keyring(void)
218 key_revoke(id_resolver_cache
->thread_keyring
);
219 unregister_key_type(&key_type_id_resolver
);
220 put_cred(id_resolver_cache
);
224 * Assemble the description to pass to request_key()
225 * This function will allocate a new string and update dest to point
226 * at it. The caller is responsible for freeing dest.
228 * On error 0 is returned. Otherwise, the length of dest is returned.
230 static ssize_t
nfs_idmap_get_desc(const char *name
, size_t namelen
,
231 const char *type
, size_t typelen
, char **desc
)
234 size_t desclen
= typelen
+ namelen
+ 2;
236 *desc
= kmalloc(desclen
, GFP_KERNEL
);
241 memcpy(cp
, type
, typelen
);
245 memcpy(cp
, name
, namelen
);
251 static ssize_t
nfs_idmap_request_key(struct key_type
*key_type
,
252 const char *name
, size_t namelen
,
253 const char *type
, void *data
,
254 size_t data_size
, struct idmap
*idmap
)
256 const struct cred
*saved_cred
;
259 struct user_key_payload
*payload
;
262 ret
= nfs_idmap_get_desc(name
, namelen
, type
, strlen(type
), &desc
);
266 saved_cred
= override_creds(id_resolver_cache
);
268 rkey
= request_key_with_auxdata(key_type
, desc
, "", 0, idmap
);
270 rkey
= request_key(&key_type_id_resolver
, desc
, "");
271 revert_creds(saved_cred
);
280 rkey
->perm
|= KEY_USR_VIEW
;
282 ret
= key_validate(rkey
);
286 payload
= rcu_dereference(rkey
->payload
.data
);
287 if (IS_ERR_OR_NULL(payload
)) {
288 ret
= PTR_ERR(payload
);
292 ret
= payload
->datalen
;
293 if (ret
> 0 && ret
<= data_size
)
294 memcpy(data
, payload
->data
, ret
);
305 static ssize_t
nfs_idmap_get_key(const char *name
, size_t namelen
,
306 const char *type
, void *data
,
307 size_t data_size
, struct idmap
*idmap
)
309 ssize_t ret
= nfs_idmap_request_key(&key_type_id_resolver
,
310 name
, namelen
, type
, data
,
313 ret
= nfs_idmap_request_key(&key_type_id_resolver_legacy
,
314 name
, namelen
, type
, data
,
321 static ssize_t
nfs_idmap_lookup_name(__u32 id
, const char *type
, char *buf
,
322 size_t buflen
, struct idmap
*idmap
)
324 char id_str
[NFS_UINT_MAXLEN
];
328 id_len
= snprintf(id_str
, sizeof(id_str
), "%u", id
);
329 ret
= nfs_idmap_get_key(id_str
, id_len
, type
, buf
, buflen
, idmap
);
336 static int nfs_idmap_lookup_id(const char *name
, size_t namelen
, const char *type
,
337 __u32
*id
, struct idmap
*idmap
)
339 char id_str
[NFS_UINT_MAXLEN
];
344 data_size
= nfs_idmap_get_key(name
, namelen
, type
, id_str
, NFS_UINT_MAXLEN
, idmap
);
345 if (data_size
<= 0) {
348 ret
= strict_strtol(id_str
, 10, &id_long
);
349 *id
= (__u32
)id_long
;
354 /* idmap classic begins here */
355 module_param(nfs_idmap_cache_timeout
, int, 0644);
358 struct rpc_pipe
*idmap_pipe
;
359 struct key_construction
*idmap_key_cons
;
363 Opt_find_uid
, Opt_find_gid
, Opt_find_user
, Opt_find_group
, Opt_find_err
366 static const match_table_t nfs_idmap_tokens
= {
367 { Opt_find_uid
, "uid:%s" },
368 { Opt_find_gid
, "gid:%s" },
369 { Opt_find_user
, "user:%s" },
370 { Opt_find_group
, "group:%s" },
371 { Opt_find_err
, NULL
}
374 static int nfs_idmap_legacy_upcall(struct key_construction
*, const char *, void *);
375 static ssize_t
idmap_pipe_downcall(struct file
*, const char __user
*,
377 static void idmap_pipe_destroy_msg(struct rpc_pipe_msg
*);
379 static const struct rpc_pipe_ops idmap_upcall_ops
= {
380 .upcall
= rpc_pipe_generic_upcall
,
381 .downcall
= idmap_pipe_downcall
,
382 .destroy_msg
= idmap_pipe_destroy_msg
,
385 static struct key_type key_type_id_resolver_legacy
= {
386 .name
= "id_resolver",
387 .instantiate
= user_instantiate
,
389 .revoke
= user_revoke
,
390 .destroy
= user_destroy
,
391 .describe
= user_describe
,
393 .request_key
= nfs_idmap_legacy_upcall
,
396 static void __nfs_idmap_unregister(struct rpc_pipe
*pipe
)
399 rpc_unlink(pipe
->dentry
);
402 static int __nfs_idmap_register(struct dentry
*dir
,
404 struct rpc_pipe
*pipe
)
406 struct dentry
*dentry
;
408 dentry
= rpc_mkpipe_dentry(dir
, "idmap", idmap
, pipe
);
410 return PTR_ERR(dentry
);
411 pipe
->dentry
= dentry
;
415 static void nfs_idmap_unregister(struct nfs_client
*clp
,
416 struct rpc_pipe
*pipe
)
418 struct net
*net
= clp
->net
;
419 struct super_block
*pipefs_sb
;
421 pipefs_sb
= rpc_get_sb_net(net
);
423 __nfs_idmap_unregister(pipe
);
428 static int nfs_idmap_register(struct nfs_client
*clp
,
430 struct rpc_pipe
*pipe
)
432 struct net
*net
= clp
->net
;
433 struct super_block
*pipefs_sb
;
436 pipefs_sb
= rpc_get_sb_net(net
);
438 if (clp
->cl_rpcclient
->cl_dentry
)
439 err
= __nfs_idmap_register(clp
->cl_rpcclient
->cl_dentry
,
447 nfs_idmap_new(struct nfs_client
*clp
)
450 struct rpc_pipe
*pipe
;
453 BUG_ON(clp
->cl_idmap
!= NULL
);
455 idmap
= kzalloc(sizeof(*idmap
), GFP_KERNEL
);
459 pipe
= rpc_mkpipe_data(&idmap_upcall_ops
, 0);
461 error
= PTR_ERR(pipe
);
465 error
= nfs_idmap_register(clp
, idmap
, pipe
);
467 rpc_destroy_pipe_data(pipe
);
471 idmap
->idmap_pipe
= pipe
;
473 clp
->cl_idmap
= idmap
;
478 nfs_idmap_delete(struct nfs_client
*clp
)
480 struct idmap
*idmap
= clp
->cl_idmap
;
484 nfs_idmap_unregister(clp
, idmap
->idmap_pipe
);
485 rpc_destroy_pipe_data(idmap
->idmap_pipe
);
486 clp
->cl_idmap
= NULL
;
490 static int __rpc_pipefs_event(struct nfs_client
*clp
, unsigned long event
,
491 struct super_block
*sb
)
496 case RPC_PIPEFS_MOUNT
:
497 BUG_ON(clp
->cl_rpcclient
->cl_dentry
== NULL
);
498 err
= __nfs_idmap_register(clp
->cl_rpcclient
->cl_dentry
,
500 clp
->cl_idmap
->idmap_pipe
);
502 case RPC_PIPEFS_UMOUNT
:
503 if (clp
->cl_idmap
->idmap_pipe
) {
504 struct dentry
*parent
;
506 parent
= clp
->cl_idmap
->idmap_pipe
->dentry
->d_parent
;
507 __nfs_idmap_unregister(clp
->cl_idmap
->idmap_pipe
);
509 * Note: This is a dirty hack. SUNRPC hook has been
510 * called already but simple_rmdir() call for the
511 * directory returned with error because of idmap pipe
512 * inside. Thus now we have to remove this directory
515 if (rpc_rmdir(parent
))
516 printk(KERN_ERR
"NFS: %s: failed to remove "
517 "clnt dir!\n", __func__
);
521 printk(KERN_ERR
"NFS: %s: unknown event: %ld\n", __func__
,
528 static struct nfs_client
*nfs_get_client_for_event(struct net
*net
, int event
)
530 struct nfs_net
*nn
= net_generic(net
, nfs_net_id
);
531 struct dentry
*cl_dentry
;
532 struct nfs_client
*clp
;
534 spin_lock(&nn
->nfs_client_lock
);
535 list_for_each_entry(clp
, &nn
->nfs_client_list
, cl_share_link
) {
536 if (clp
->rpc_ops
!= &nfs_v4_clientops
)
538 cl_dentry
= clp
->cl_idmap
->idmap_pipe
->dentry
;
539 if (((event
== RPC_PIPEFS_MOUNT
) && cl_dentry
) ||
540 ((event
== RPC_PIPEFS_UMOUNT
) && !cl_dentry
))
542 atomic_inc(&clp
->cl_count
);
543 spin_unlock(&nn
->nfs_client_lock
);
546 spin_unlock(&nn
->nfs_client_lock
);
550 static int rpc_pipefs_event(struct notifier_block
*nb
, unsigned long event
,
553 struct super_block
*sb
= ptr
;
554 struct nfs_client
*clp
;
557 while ((clp
= nfs_get_client_for_event(sb
->s_fs_info
, event
))) {
558 error
= __rpc_pipefs_event(clp
, event
, sb
);
566 #define PIPEFS_NFS_PRIO 1
568 static struct notifier_block nfs_idmap_block
= {
569 .notifier_call
= rpc_pipefs_event
,
570 .priority
= SUNRPC_PIPEFS_NFS_PRIO
,
573 int nfs_idmap_init(void)
576 ret
= nfs_idmap_init_keyring();
579 ret
= rpc_pipefs_notifier_register(&nfs_idmap_block
);
581 nfs_idmap_quit_keyring();
586 void nfs_idmap_quit(void)
588 rpc_pipefs_notifier_unregister(&nfs_idmap_block
);
589 nfs_idmap_quit_keyring();
592 static int nfs_idmap_prepare_message(char *desc
, struct idmap_msg
*im
,
593 struct rpc_pipe_msg
*msg
)
598 memset(im
, 0, sizeof(*im
));
599 memset(msg
, 0, sizeof(*msg
));
601 im
->im_type
= IDMAP_TYPE_GROUP
;
602 token
= match_token(desc
, nfs_idmap_tokens
, &substr
);
606 im
->im_type
= IDMAP_TYPE_USER
;
608 im
->im_conv
= IDMAP_CONV_NAMETOID
;
609 ret
= match_strlcpy(im
->im_name
, &substr
, IDMAP_NAMESZ
);
613 im
->im_type
= IDMAP_TYPE_USER
;
615 im
->im_conv
= IDMAP_CONV_IDTONAME
;
616 ret
= match_int(&substr
, &im
->im_id
);
625 msg
->len
= sizeof(struct idmap_msg
);
631 static int nfs_idmap_legacy_upcall(struct key_construction
*cons
,
635 struct rpc_pipe_msg
*msg
;
636 struct idmap_msg
*im
;
637 struct idmap
*idmap
= (struct idmap
*)aux
;
638 struct key
*key
= cons
->key
;
641 /* msg and im are freed in idmap_pipe_destroy_msg */
642 msg
= kmalloc(sizeof(*msg
), GFP_KERNEL
);
648 im
= kmalloc(sizeof(*im
), GFP_KERNEL
);
654 ret
= nfs_idmap_prepare_message(key
->description
, im
, msg
);
658 idmap
->idmap_key_cons
= cons
;
660 ret
= rpc_queue_upcall(idmap
->idmap_pipe
, msg
);
671 key_revoke(cons
->key
);
672 key_revoke(cons
->authkey
);
676 static int nfs_idmap_instantiate(struct key
*key
, struct key
*authkey
, char *data
)
678 return key_instantiate_and_link(key
, data
, strlen(data
) + 1,
679 id_resolver_cache
->thread_keyring
,
683 static int nfs_idmap_read_message(struct idmap_msg
*im
, struct key
*key
, struct key
*authkey
)
685 char id_str
[NFS_UINT_MAXLEN
];
688 switch (im
->im_conv
) {
689 case IDMAP_CONV_NAMETOID
:
690 sprintf(id_str
, "%d", im
->im_id
);
691 ret
= nfs_idmap_instantiate(key
, authkey
, id_str
);
693 case IDMAP_CONV_IDTONAME
:
694 ret
= nfs_idmap_instantiate(key
, authkey
, im
->im_name
);
702 idmap_pipe_downcall(struct file
*filp
, const char __user
*src
, size_t mlen
)
704 struct rpc_inode
*rpci
= RPC_I(filp
->f_path
.dentry
->d_inode
);
705 struct idmap
*idmap
= (struct idmap
*)rpci
->private;
706 struct key_construction
*cons
= idmap
->idmap_key_cons
;
711 if (mlen
!= sizeof(im
)) {
716 if (copy_from_user(&im
, src
, mlen
) != 0) {
721 if (!(im
.im_status
& IDMAP_STATUS_SUCCESS
)) {
723 complete_request_key(idmap
->idmap_key_cons
, -ENOKEY
);
727 namelen_in
= strnlen(im
.im_name
, IDMAP_NAMESZ
);
728 if (namelen_in
== 0 || namelen_in
== IDMAP_NAMESZ
) {
733 ret
= nfs_idmap_read_message(&im
, cons
->key
, cons
->authkey
);
735 key_set_timeout(cons
->key
, nfs_idmap_cache_timeout
);
740 complete_request_key(idmap
->idmap_key_cons
, ret
);
746 idmap_pipe_destroy_msg(struct rpc_pipe_msg
*msg
)
748 /* Free memory allocated in nfs_idmap_legacy_upcall() */
753 int nfs_map_name_to_uid(const struct nfs_server
*server
, const char *name
, size_t namelen
, __u32
*uid
)
755 struct idmap
*idmap
= server
->nfs_client
->cl_idmap
;
757 if (nfs_map_string_to_numeric(name
, namelen
, uid
))
759 return nfs_idmap_lookup_id(name
, namelen
, "uid", uid
, idmap
);
762 int nfs_map_group_to_gid(const struct nfs_server
*server
, const char *name
, size_t namelen
, __u32
*gid
)
764 struct idmap
*idmap
= server
->nfs_client
->cl_idmap
;
766 if (nfs_map_string_to_numeric(name
, namelen
, gid
))
768 return nfs_idmap_lookup_id(name
, namelen
, "gid", gid
, idmap
);
771 int nfs_map_uid_to_name(const struct nfs_server
*server
, __u32 uid
, char *buf
, size_t buflen
)
773 struct idmap
*idmap
= server
->nfs_client
->cl_idmap
;
776 if (!(server
->caps
& NFS_CAP_UIDGID_NOMAP
))
777 ret
= nfs_idmap_lookup_name(uid
, "user", buf
, buflen
, idmap
);
779 ret
= nfs_map_numeric_to_string(uid
, buf
, buflen
);
782 int nfs_map_gid_to_group(const struct nfs_server
*server
, __u32 gid
, char *buf
, size_t buflen
)
784 struct idmap
*idmap
= server
->nfs_client
->cl_idmap
;
787 if (!(server
->caps
& NFS_CAP_UIDGID_NOMAP
))
788 ret
= nfs_idmap_lookup_name(gid
, "group", buf
, buflen
, idmap
);
790 ret
= nfs_map_numeric_to_string(gid
, buf
, buflen
);