MFV r243395:
Introduce a new dataset aclmode setting "restricted" to protect ACL's being destroyed or corrupted by a drive-by chmod. illumos-gate 13889:a67716f16746 3254 add support in zfs for aclmode=restricted References: https://www.illumos.org/issues/3254 MFC after: 2 weeks
This commit is contained in:
commit
7faa32552f
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=243560
@ -760,7 +760,7 @@ If no inheritable
|
|||||||
.Tn ACE Ns s
|
.Tn ACE Ns s
|
||||||
exist that affect the mode, then the mode is set in accordance to the requested
|
exist that affect the mode, then the mode is set in accordance to the requested
|
||||||
mode from the application.
|
mode from the application.
|
||||||
.It Sy aclmode Ns = Ns Cm discard | groupmask | passthrough
|
.It Sy aclmode Ns = Ns Cm discard | groupmask | passthrough | restricted
|
||||||
Controls how an
|
Controls how an
|
||||||
.Tn ACL
|
.Tn ACL
|
||||||
is modified during
|
is modified during
|
||||||
@ -790,6 +790,32 @@ indicates that no changes are made to the
|
|||||||
other than creating or updating the necessary
|
other than creating or updating the necessary
|
||||||
.Tn ACL
|
.Tn ACL
|
||||||
entries to represent the new mode of the file or directory.
|
entries to represent the new mode of the file or directory.
|
||||||
|
An
|
||||||
|
.Sy aclmode
|
||||||
|
property of
|
||||||
|
.Cm restricted
|
||||||
|
will cause the
|
||||||
|
.Xr chmod 2
|
||||||
|
operation to return an error when used on any file or directory which has
|
||||||
|
a non-trivial
|
||||||
|
.Tn ACL
|
||||||
|
whose entries can not be represented by a mode.
|
||||||
|
.Xr chmod 2
|
||||||
|
is required to change the set user ID, set group ID, or sticky bits on a file
|
||||||
|
or directory, as they do not have equivalent
|
||||||
|
.Tn ACL
|
||||||
|
entries.
|
||||||
|
In order to use
|
||||||
|
.Xr chmod 2
|
||||||
|
on a file or directory with a non-trivial
|
||||||
|
.Tn ACL
|
||||||
|
when
|
||||||
|
.Sy aclmode
|
||||||
|
is set to
|
||||||
|
.Cm restricted ,
|
||||||
|
you must first remove all
|
||||||
|
.Tn ACL
|
||||||
|
entries which do not represent the current mode.
|
||||||
.It Sy atime Ns = Ns Cm on | off
|
.It Sy atime Ns = Ns Cm on | off
|
||||||
Controls whether the access time for files is updated when they are read.
|
Controls whether the access time for files is updated when they are read.
|
||||||
Turning this property off avoids producing write traffic when reading files and
|
Turning this property off avoids producing write traffic when reading files and
|
||||||
|
@ -109,6 +109,7 @@ zfs_prop_init(void)
|
|||||||
{ "discard", ZFS_ACL_DISCARD },
|
{ "discard", ZFS_ACL_DISCARD },
|
||||||
{ "groupmask", ZFS_ACL_GROUPMASK },
|
{ "groupmask", ZFS_ACL_GROUPMASK },
|
||||||
{ "passthrough", ZFS_ACL_PASSTHROUGH },
|
{ "passthrough", ZFS_ACL_PASSTHROUGH },
|
||||||
|
{ "restricted", ZFS_ACL_RESTRICTED },
|
||||||
{ NULL }
|
{ NULL }
|
||||||
};
|
};
|
||||||
|
|
||||||
@ -217,7 +218,8 @@ zfs_prop_init(void)
|
|||||||
"hidden | visible", "SNAPDIR", snapdir_table);
|
"hidden | visible", "SNAPDIR", snapdir_table);
|
||||||
zprop_register_index(ZFS_PROP_ACLMODE, "aclmode", ZFS_ACL_DISCARD,
|
zprop_register_index(ZFS_PROP_ACLMODE, "aclmode", ZFS_ACL_DISCARD,
|
||||||
PROP_INHERIT, ZFS_TYPE_FILESYSTEM,
|
PROP_INHERIT, ZFS_TYPE_FILESYSTEM,
|
||||||
"discard | groupmask | passthrough", "ACLMODE", acl_mode_table);
|
"discard | groupmask | passthrough | restricted", "ACLMODE",
|
||||||
|
acl_mode_table);
|
||||||
zprop_register_index(ZFS_PROP_ACLINHERIT, "aclinherit",
|
zprop_register_index(ZFS_PROP_ACLINHERIT, "aclinherit",
|
||||||
ZFS_ACL_RESTRICTED, PROP_INHERIT, ZFS_TYPE_FILESYSTEM,
|
ZFS_ACL_RESTRICTED, PROP_INHERIT, ZFS_TYPE_FILESYSTEM,
|
||||||
"discard | noallow | restricted | passthrough | passthrough-x",
|
"discard | noallow | restricted | passthrough | passthrough-x",
|
||||||
|
@ -3257,6 +3257,12 @@ zfs_setattr(vnode_t *vp, vattr_t *vap, int flags, cred_t *cr,
|
|||||||
uint64_t acl_obj;
|
uint64_t acl_obj;
|
||||||
new_mode = (pmode & S_IFMT) | (vap->va_mode & ~S_IFMT);
|
new_mode = (pmode & S_IFMT) | (vap->va_mode & ~S_IFMT);
|
||||||
|
|
||||||
|
if (zp->z_zfsvfs->z_acl_mode == ZFS_ACL_RESTRICTED &&
|
||||||
|
!(zp->z_pflags & ZFS_ACL_TRIVIAL)) {
|
||||||
|
err = EPERM;
|
||||||
|
goto out;
|
||||||
|
}
|
||||||
|
|
||||||
if (err = zfs_acl_chmod_setattr(zp, &aclp, new_mode))
|
if (err = zfs_acl_chmod_setattr(zp, &aclp, new_mode))
|
||||||
goto out;
|
goto out;
|
||||||
|
|
||||||
|
Loading…
Reference in New Issue
Block a user