fs: port ->get_acl() to pass mnt_idmap

Convert to struct mnt_idmap.

Last cycle we merged the necessary infrastructure in
256c8aed2b42 ("fs: introduce dedicated idmap type for mounts").
This is just the conversion to struct mnt_idmap.

Currently we still pass around the plain namespace that was attached to a
mount. This is in general pretty convenient but it makes it easy to
conflate namespaces that are relevant on the filesystem with namespaces
that are relevent on the mount level. Especially for non-vfs developers
without detailed knowledge in this area this can be a potential source for
bugs.

Once the conversion to struct mnt_idmap is done all helpers down to the
really low-level helpers will take a struct mnt_idmap argument instead of
two namespace arguments. This way it becomes impossible to conflate the two
eliminating the possibility of any bugs. All of the vfs and all filesystems
only operate on struct mnt_idmap.

Acked-by: Dave Chinner <dchinner@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Christian Brauner (Microsoft) <brauner@kernel.org>

diff --git a/Documentation/filesystems/locking.rst b/Documentation/filesystems/locking.rst
index 429b8e4a6284adc43c5f3c9070a285b6c7c9651a..d42d7b8de2f5b6d03fe40f2d0de9b88bd1d37310 100644 (file)
--- a/Documentation/filesystems/locking.rst
+++ b/Documentation/filesystems/locking.rst
@@ -84,7 +84,7 @@ prototypes::
        int (*fileattr_set)(struct user_namespace *mnt_userns,
                            struct dentry *dentry, struct fileattr *fa);
        int (*fileattr_get)(struct dentry *dentry, struct fileattr *fa);
-       struct posix_acl * (*get_acl)(struct user_namespace *, struct dentry *, int);
+       struct posix_acl * (*get_acl)(struct mnt_idmap *, struct dentry *, int);
 
 locking rules:
        all may block

diff --git a/Documentation/filesystems/vfs.rst b/Documentation/filesystems/vfs.rst
index 3fcadfcf4e3ae55b7659e8040e5a0749a984a23c..056e446c70e0e9547fcf61d365769c69e9bd4f5c 100644 (file)
--- a/Documentation/filesystems/vfs.rst
+++ b/Documentation/filesystems/vfs.rst
@@ -443,7 +443,7 @@ As of kernel 2.6.22, the following members are defined:
                int (*atomic_open)(struct inode *, struct dentry *, struct file *,
                                   unsigned open_flag, umode_t create_mode);
                int (*tmpfile) (struct mnt_idmap *, struct inode *, struct file *, umode_t);
-               struct posix_acl * (*get_acl)(struct user_namespace *, struct dentry *, int);
+               struct posix_acl * (*get_acl)(struct mnt_idmap *, struct dentry *, int);
                int (*set_acl)(struct user_namespace *, struct dentry *, struct posix_acl *, int);
                int (*fileattr_set)(struct user_namespace *mnt_userns,
                                    struct dentry *dentry, struct fileattr *fa);

diff --git a/fs/9p/acl.c b/fs/9p/acl.c
index 9848a245fa6f73d67318c0d76f365a5ee704c60c..cfd4545f2d02e4e339606e4f6ea67cc6b2dd7fa1 100644 (file)
--- a/fs/9p/acl.c
+++ b/fs/9p/acl.c
@@ -139,7 +139,7 @@ struct posix_acl *v9fs_iop_get_inode_acl(struct inode *inode, int type, bool rcu
 
 }
 
-struct posix_acl *v9fs_iop_get_acl(struct user_namespace *mnt_userns,
+struct posix_acl *v9fs_iop_get_acl(struct mnt_idmap *idmap,
                                   struct dentry *dentry, int type)
 {
        struct v9fs_session_info *v9ses;

diff --git a/fs/9p/acl.h b/fs/9p/acl.h
index 4c60a2bce5de445d88e7ee52a7fd33bd05f73ea3..e0e58967d91629a422dfbe10214f2996737a0f9a 100644 (file)
--- a/fs/9p/acl.h
+++ b/fs/9p/acl.h
@@ -10,7 +10,7 @@
 int v9fs_get_acl(struct inode *inode, struct p9_fid *fid);
 struct posix_acl *v9fs_iop_get_inode_acl(struct inode *inode, int type,
                                   bool rcu);
-struct posix_acl *v9fs_iop_get_acl(struct user_namespace *mnt_userns,
+struct posix_acl *v9fs_iop_get_acl(struct mnt_idmap *idmap,
                                          struct dentry *dentry, int type);
 int v9fs_iop_set_acl(struct user_namespace *mnt_userns, struct dentry *dentry,
                     struct posix_acl *acl, int type);

diff --git a/fs/cifs/cifsacl.c b/fs/cifs/cifsacl.c
index bbf58c2439da2fcd015c1a503f43da170bfff2f2..1fae9b60e48f031cb6aee5c231f76808e689e3c9 100644 (file)
--- a/fs/cifs/cifsacl.c
+++ b/fs/cifs/cifsacl.c
@@ -1674,7 +1674,7 @@ id_mode_to_cifs_acl(struct inode *inode, const char *path, __u64 *pnmode,
        return rc;
 }
 
-struct posix_acl *cifs_get_acl(struct user_namespace *mnt_userns,
+struct posix_acl *cifs_get_acl(struct mnt_idmap *idmap,
                               struct dentry *dentry, int type)
 {
 #if defined(CONFIG_CIFS_ALLOW_INSECURE_LEGACY) && defined(CONFIG_CIFS_POSIX)

diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
index 1207b39686fb9de19eaecbae9339144b317f6172..aeae6544cdd83692edb9a0289df3d07bad4ab6bc 100644 (file)
--- a/fs/cifs/cifsproto.h
+++ b/fs/cifs/cifsproto.h
@@ -225,7 +225,7 @@ extern struct cifs_ntsd *get_cifs_acl(struct cifs_sb_info *, struct inode *,
                                      const char *, u32 *, u32);
 extern struct cifs_ntsd *get_cifs_acl_by_fid(struct cifs_sb_info *,
                                const struct cifs_fid *, u32 *, u32);
-extern struct posix_acl *cifs_get_acl(struct user_namespace *mnt_userns,
+extern struct posix_acl *cifs_get_acl(struct mnt_idmap *idmap,
                                      struct dentry *dentry, int type);
 extern int cifs_set_acl(struct user_namespace *mnt_userns,
                        struct dentry *dentry, struct posix_acl *acl, int type);

diff --git a/fs/ecryptfs/inode.c b/fs/ecryptfs/inode.c
index cf85901d7a5de9a96b8cd97098db1a3290346530..8487ac0cc2395110aa8337ab84fed2872b0cf16b 100644 (file)
--- a/fs/ecryptfs/inode.c
+++ b/fs/ecryptfs/inode.c
@@ -1122,10 +1122,10 @@ static int ecryptfs_fileattr_set(struct user_namespace *mnt_userns,
        return rc;
 }
 
-static struct posix_acl *ecryptfs_get_acl(struct user_namespace *mnt_userns,
+static struct posix_acl *ecryptfs_get_acl(struct mnt_idmap *idmap,
                                          struct dentry *dentry, int type)
 {
-       return vfs_get_acl(mnt_userns, ecryptfs_dentry_to_lower(dentry),
+       return vfs_get_acl(idmap, ecryptfs_dentry_to_lower(dentry),
                           posix_acl_xattr_name(type));
 }
 

diff --git a/fs/overlayfs/inode.c b/fs/overlayfs/inode.c
index ad33253ed7e94aba5f98e7f9719d730447f8c3d1..3ea4fc54f46996756a39723e0d6336e6abd23164 100644 (file)
--- a/fs/overlayfs/inode.c
+++ b/fs/overlayfs/inode.c
@@ -515,14 +515,16 @@ struct posix_acl *ovl_get_acl_path(const struct path *path,
 {
        struct posix_acl *real_acl, *clone;
        struct user_namespace *mnt_userns;
+       struct mnt_idmap *idmap;
        struct inode *realinode = d_inode(path->dentry);
 
-       mnt_userns = mnt_user_ns(path->mnt);
+       idmap = mnt_idmap(path->mnt);
+       mnt_userns = mnt_idmap_owner(idmap);
 
        if (noperm)
                real_acl = get_inode_acl(realinode, posix_acl_type(acl_name));
        else
-               real_acl = vfs_get_acl(mnt_userns, path->dentry, acl_name);
+               real_acl = vfs_get_acl(idmap, path->dentry, acl_name);
        if (IS_ERR_OR_NULL(real_acl))
                return real_acl;
 
@@ -555,7 +557,7 @@ struct posix_acl *ovl_get_acl_path(const struct path *path,
  *
  * This is obviously only relevant when idmapped layers are used.
  */
-struct posix_acl *do_ovl_get_acl(struct user_namespace *mnt_userns,
+struct posix_acl *do_ovl_get_acl(struct mnt_idmap *idmap,
                                 struct inode *inode, int type,
                                 bool rcu, bool noperm)
 {
@@ -618,7 +620,7 @@ static int ovl_set_or_remove_acl(struct dentry *dentry, struct inode *inode,
 
                ovl_path_lower(dentry, &realpath);
                old_cred = ovl_override_creds(dentry->d_sb);
-               real_acl = vfs_get_acl(mnt_user_ns(realpath.mnt), realdentry,
+               real_acl = vfs_get_acl(mnt_idmap(realpath.mnt), realdentry,
                                       acl_name);
                revert_creds(old_cred);
                if (IS_ERR(real_acl)) {

diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
index b6e17f631b539b2d678e41d935364db27274d8ba..1e8b0be85e4b8450804ff5e3a0d053bbc03221df 100644 (file)
--- a/fs/overlayfs/overlayfs.h
+++ b/fs/overlayfs/overlayfs.h
@@ -610,18 +610,18 @@ int ovl_xattr_get(struct dentry *dentry, struct inode *inode, const char *name,
 ssize_t ovl_listxattr(struct dentry *dentry, char *list, size_t size);
 
 #ifdef CONFIG_FS_POSIX_ACL
-struct posix_acl *do_ovl_get_acl(struct user_namespace *mnt_userns,
+struct posix_acl *do_ovl_get_acl(struct mnt_idmap *idmap,
                                 struct inode *inode, int type,
                                 bool rcu, bool noperm);
 static inline struct posix_acl *ovl_get_inode_acl(struct inode *inode, int type,
                                                  bool rcu)
 {
-       return do_ovl_get_acl(&init_user_ns, inode, type, rcu, true);
+       return do_ovl_get_acl(&nop_mnt_idmap, inode, type, rcu, true);
 }
-static inline struct posix_acl *ovl_get_acl(struct user_namespace *mnt_userns,
+static inline struct posix_acl *ovl_get_acl(struct mnt_idmap *idmap,
                                            struct dentry *dentry, int type)
 {
-       return do_ovl_get_acl(mnt_userns, d_inode(dentry), type, false, false);
+       return do_ovl_get_acl(idmap, d_inode(dentry), type, false, false);
 }
 int ovl_set_acl(struct user_namespace *mnt_userns, struct dentry *dentry,
                struct posix_acl *acl, int type);

diff --git a/fs/posix_acl.c b/fs/posix_acl.c
index d7bc81fc084095c0415b08d5534dbe7581c5ddfb..17e141a94671f50327799415b66a3cce397de514 100644 (file)
--- a/fs/posix_acl.c
+++ b/fs/posix_acl.c
@@ -111,7 +111,7 @@ void forget_all_cached_acls(struct inode *inode)
 }
 EXPORT_SYMBOL(forget_all_cached_acls);
 
-static struct posix_acl *__get_acl(struct user_namespace *mnt_userns,
+static struct posix_acl *__get_acl(struct mnt_idmap *idmap,
                                   struct dentry *dentry, struct inode *inode,
                                   int type)
 {
@@ -154,7 +154,7 @@ static struct posix_acl *__get_acl(struct user_namespace *mnt_userns,
         * we'll just create the negative cache entry.
         */
        if (dentry && inode->i_op->get_acl) {
-               acl = inode->i_op->get_acl(mnt_userns, dentry, type);
+               acl = inode->i_op->get_acl(idmap, dentry, type);
        } else if (inode->i_op->get_inode_acl) {
                acl = inode->i_op->get_inode_acl(inode, type, false);
        } else {
@@ -181,7 +181,7 @@ static struct posix_acl *__get_acl(struct user_namespace *mnt_userns,
 
 struct posix_acl *get_inode_acl(struct inode *inode, int type)
 {
-       return __get_acl(&init_user_ns, NULL, inode, type);
+       return __get_acl(&nop_mnt_idmap, NULL, inode, type);
 }
 EXPORT_SYMBOL(get_inode_acl);
 
@@ -1121,7 +1121,7 @@ EXPORT_SYMBOL_GPL(vfs_set_acl);
 
 /**
  * vfs_get_acl - get posix acls
- * @mnt_userns: user namespace of the mount
+ * @idmap: idmap of the mount
  * @dentry: the dentry based on which to retrieve the posix acls
  * @acl_name: the name of the posix acl
  *
@@ -1130,9 +1130,10 @@ EXPORT_SYMBOL_GPL(vfs_set_acl);
  *
  * Return: On success POSIX ACLs in VFS format, on error negative errno.
  */
-struct posix_acl *vfs_get_acl(struct user_namespace *mnt_userns,
+struct posix_acl *vfs_get_acl(struct mnt_idmap *idmap,
                              struct dentry *dentry, const char *acl_name)
 {
+       struct user_namespace *mnt_userns = mnt_idmap_owner(idmap);
        struct inode *inode = d_inode(dentry);
        struct posix_acl *acl;
        int acl_type, error;
@@ -1154,7 +1155,7 @@ struct posix_acl *vfs_get_acl(struct user_namespace *mnt_userns,
        if (S_ISLNK(inode->i_mode))
                return ERR_PTR(-EOPNOTSUPP);
 
-       acl = __get_acl(mnt_userns, dentry, inode, acl_type);
+       acl = __get_acl(idmap, dentry, inode, acl_type);
        if (IS_ERR(acl))
                return acl;
        if (!acl)
@@ -1256,7 +1257,7 @@ ssize_t do_get_acl(struct mnt_idmap *idmap, struct dentry *dentry,
        ssize_t error;
        struct posix_acl *acl;
 
-       acl = vfs_get_acl(mnt_idmap_owner(idmap), dentry, acl_name);
+       acl = vfs_get_acl(idmap, dentry, acl_name);
        if (IS_ERR(acl))
                return PTR_ERR(acl);
 

diff --git a/include/linux/fs.h b/include/linux/fs.h
index 4855fd071bf81416e4002b1efdfcbe513f25298c..31a714377ba2bdbdd3214572e141274969a6836d 100644 (file)
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@ -2164,7 +2164,7 @@ struct inode_operations {
                           umode_t create_mode);
        int (*tmpfile) (struct mnt_idmap *, struct inode *,
                        struct file *, umode_t);
-       struct posix_acl *(*get_acl)(struct user_namespace *, struct dentry *,
+       struct posix_acl *(*get_acl)(struct mnt_idmap *, struct dentry *,
                                     int);
        int (*set_acl)(struct user_namespace *, struct dentry *,
                       struct posix_acl *, int);

diff --git a/include/linux/posix_acl.h b/include/linux/posix_acl.h
index ee608d22ecb93641f4cfad3d34b9b38625c9b77d..042ef62f92760f55a74cdd2d7af1305dcf3d55e6 100644 (file)
--- a/include/linux/posix_acl.h
+++ b/include/linux/posix_acl.h
@@ -102,7 +102,7 @@ static inline void cache_no_acl(struct inode *inode)
 
 int vfs_set_acl(struct user_namespace *mnt_userns, struct dentry *dentry,
                const char *acl_name, struct posix_acl *kacl);
-struct posix_acl *vfs_get_acl(struct user_namespace *mnt_userns,
+struct posix_acl *vfs_get_acl(struct mnt_idmap *idmap,
                              struct dentry *dentry, const char *acl_name);
 int vfs_remove_acl(struct user_namespace *mnt_userns, struct dentry *dentry,
                   const char *acl_name);
@@ -141,7 +141,7 @@ static inline int vfs_set_acl(struct user_namespace *mnt_userns,
        return -EOPNOTSUPP;
 }
 
-static inline struct posix_acl *vfs_get_acl(struct user_namespace *mnt_userns,
+static inline struct posix_acl *vfs_get_acl(struct mnt_idmap *idmap,
                                            struct dentry *dentry,
                                            const char *acl_name)
 {