From patchwork Wed Jan 18 14:56:49 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Chengen Du X-Patchwork-Id: 1728285 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=91.189.94.19; helo=huckleberry.canonical.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=) Authentication-Results: legolas.ozlabs.org; dkim=fail reason="signature verification failed" (2048-bit key; unprotected) header.d=canonical.com header.i=@canonical.com header.a=rsa-sha256 header.s=20210705 header.b=CUmAH63K; dkim-atps=neutral Received: from huckleberry.canonical.com (huckleberry.canonical.com [91.189.94.19]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4Nxpl025wdz23h2 for ; Thu, 19 Jan 2023 01:57:15 +1100 (AEDT) Received: from localhost ([127.0.0.1] helo=huckleberry.canonical.com) by huckleberry.canonical.com with esmtp (Exim 4.86_2) (envelope-from ) id 1pI9s5-0006xs-Qh; Wed, 18 Jan 2023 14:57:01 +0000 Received: from smtp-relay-internal-1.internal ([10.131.114.114] helo=smtp-relay-internal-1.canonical.com) by huckleberry.canonical.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1pI9s3-0006wf-Fn for kernel-team@lists.ubuntu.com; Wed, 18 Jan 2023 14:56:59 +0000 Received: from mail-pl1-f197.google.com (mail-pl1-f197.google.com [209.85.214.197]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id 3B07F4191E for ; Wed, 18 Jan 2023 14:56:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=canonical.com; s=20210705; t=1674053819; bh=1ztq/T5A7IJ8ZJQH6sMmUmwYtWPumVS2CgQ/e5H3sac=; h=From:To:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=CUmAH63KTfY2/T0aQjW1M4Vi/8HoYy0vcjO6+hmSpv1itBs29KCfh0oY5Jm++340h PTipV60GGvsjuon6r7SqOtD7BgzuS3S8ojTYbqSMxNOuUwrUMbLdKk65mjvFIDdKvx MbsqC3ARaubKHVSDAjZ2H1LtogmblURdjEk+e3nM7e4JLV0YBttUF81R2H/ZUd0sAu /QTDr1GU3k6pVRqFKZMKXGu+ZoFqZ9hCXiPpBItjR9tJxV/4wIrgOEv5vhf+OBnR0b +Mo1kbwJJAEFPZP2glmZH6k1g92RuMn8Jee+KmAzrfLoscLQhJ+QvRvP/jRSYThSIM Z96GkjBJHMaRA== Received: by mail-pl1-f197.google.com with SMTP id d7-20020a170903230700b00194821e606dso7540047plh.7 for ; Wed, 18 Jan 2023 06:56:59 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=1ztq/T5A7IJ8ZJQH6sMmUmwYtWPumVS2CgQ/e5H3sac=; b=5XfESWfz2dHZQ88xVc0hhWHCNh1ApypYW2pLlbCmTC57xvQ4hSriU9P2cK9XVIQuo6 2tFaXsXRzQmeUdJyD6MRsbmuRhoKmlcaCSqZoHAcGHIT5ELpA/P9/7OLEAlX8baGPxgu VwLuFWWyNFwu0JB/7DBPEbLgr5zqpd+iUNxCJ4avyWy2FhemffxSYyXBTWtZOUQRIJVP ZSnMVgY4DzpWhDKT6ddpyrbVBb88PS0LYEU89BRJ9AHLeim/bvuZAPEPKnyFgnX5roPt YR6vxIJ0RHbkARmFM9/ymFOJsy9S1Argy4JByEq7HM42zrfWeDFuTUztU5iJb5Pzc1CQ qjeA== X-Gm-Message-State: AFqh2kpTTP8T6YQ4kKwFK/9K7YG93uFLxpnknyTlJm/fNYacWF2CJWRI jurE890yh3dC9OwqQwWtvVRwKUlUdtF1k02wkS36BaFMl6wD9O9gPxYmLnhckdDDn85IzhYFPVn Ys6SYn0mHEMb50T5KZgShx+mJ6uFdDXUVHfU5B1mEPQ== X-Received: by 2002:aa7:8619:0:b0:581:12c5:1356 with SMTP id p25-20020aa78619000000b0058112c51356mr7786404pfn.30.1674053817315; Wed, 18 Jan 2023 06:56:57 -0800 (PST) X-Google-Smtp-Source: AMrXdXvYMXH5/Q+1Zxq8Ufq3vYpEU/toIfHFSsvwwa5agr/ORAiDf2QDDqJtvBbRKlgsK/ElXUvUrw== X-Received: by 2002:aa7:8619:0:b0:581:12c5:1356 with SMTP id p25-20020aa78619000000b0058112c51356mr7786389pfn.30.1674053817009; Wed, 18 Jan 2023 06:56:57 -0800 (PST) Received: from chengendu.. (111-248-160-17.dynamic-ip.hinet.net. [111.248.160.17]) by smtp.gmail.com with ESMTPSA id p2-20020aa79e82000000b005825b8e0540sm6964736pfq.204.2023.01.18.06.56.56 for (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 18 Jan 2023 06:56:56 -0800 (PST) From: Chengen Du To: kernel-team@lists.ubuntu.com Subject: [SRU][Bionic][PATCH 1/4] (upstream) cred: add cred_fscmp() for comparing creds. Date: Wed, 18 Jan 2023 22:56:49 +0800 Message-Id: <20230118145652.35953-2-chengen.du@canonical.com> X-Mailer: git-send-email 2.37.2 In-Reply-To: <20230118145652.35953-1-chengen.du@canonical.com> References: <20230118145652.35953-1-chengen.du@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: NeilBrown BugLink: https://bugs.launchpad.net/bugs/2003053 NFS needs to compare to credentials, to see if they can be treated the same w.r.t. filesystem access. Sometimes an ordering is needed when credentials are used as a key to an rbtree. NFS currently has its own private credential management from before 'struct cred' existed. To move it over to more consistent use of 'struct cred' we need a comparison function. This patch adds that function. Signed-off-by: NeilBrown Signed-off-by: Anna Schumaker (cherry picked from commit d89b22d46a40da3a1630ecea111beaf3ef10bc21) Signed-off-by: Chengen Du --- include/linux/cred.h | 1 + kernel/cred.c | 55 ++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 56 insertions(+) diff --git a/include/linux/cred.h b/include/linux/cred.h index 044c6b72d1e9..dbef5294121e 100644 --- a/include/linux/cred.h +++ b/include/linux/cred.h @@ -169,6 +169,7 @@ extern int change_create_files_as(struct cred *, struct inode *); extern int set_security_override(struct cred *, u32); extern int set_security_override_from_ctx(struct cred *, const char *); extern int set_create_files_as(struct cred *, struct inode *); +extern int cred_fscmp(const struct cred *, const struct cred *); extern void __init cred_init(void); /* diff --git a/kernel/cred.c b/kernel/cred.c index eed2bc6aa7d8..ca3ccdbccd7e 100644 --- a/kernel/cred.c +++ b/kernel/cred.c @@ -19,6 +19,7 @@ #include #include #include +#include #if 0 #define kdebug(FMT, ...) \ @@ -589,6 +590,60 @@ void revert_creds(const struct cred *old) } EXPORT_SYMBOL(revert_creds); +/** + * cred_fscmp - Compare two credentials with respect to filesystem access. + * @a: The first credential + * @b: The second credential + * + * cred_cmp() will return zero if both credentials have the same + * fsuid, fsgid, and supplementary groups. That is, if they will both + * provide the same access to files based on mode/uid/gid. + * If the credentials are different, then either -1 or 1 will + * be returned depending on whether @a comes before or after @b + * respectively in an arbitrary, but stable, ordering of credentials. + * + * Return: -1, 0, or 1 depending on comparison + */ +int cred_fscmp(const struct cred *a, const struct cred *b) +{ + struct group_info *ga, *gb; + int g; + + if (a == b) + return 0; + if (uid_lt(a->fsuid, b->fsuid)) + return -1; + if (uid_gt(a->fsuid, b->fsuid)) + return 1; + + if (gid_lt(a->fsgid, b->fsgid)) + return -1; + if (gid_gt(a->fsgid, b->fsgid)) + return 1; + + ga = a->group_info; + gb = b->group_info; + if (ga == gb) + return 0; + if (ga == NULL) + return -1; + if (gb == NULL) + return 1; + if (ga->ngroups < gb->ngroups) + return -1; + if (ga->ngroups > gb->ngroups) + return 1; + + for (g = 0; g < ga->ngroups; g++) { + if (gid_lt(ga->gid[g], gb->gid[g])) + return -1; + if (gid_gt(ga->gid[g], gb->gid[g])) + return 1; + } + return 0; +} +EXPORT_SYMBOL(cred_fscmp); + /* * initialise the credentials stuff */