Context Navigation

← Previous Revision
Latest Revision
Next Revision →
Blame
Revision Log

cxiAclUser.h @ 177

Last change on this file since 177 was 16, checked in by rock, 17 years ago

File size: 22.3 KB

Line
1	/***************************************************************************
2	*
3	* Copyright (C) 2001 International Business Machines
4	* All rights reserved.
5	*
6	* This file is part of the GPFS mmfslinux kernel module.
7	*
8	* Redistribution and use in source and binary forms, with or without
9	* modification, are permitted provided that the following conditions
10	* are met:
11	*
12	* 1. Redistributions of source code must retain the above copyright notice,
13	* this list of conditions and the following disclaimer.
14	* 2. Redistributions in binary form must reproduce the above copyright
15	* notice, this list of conditions and the following disclaimer in the
16	* documentation and/or other materials provided with the distribution.
17	* 3. The name of the author may not be used to endorse or promote products
18	* derived from this software without specific prior written
19	* permission.
20	*
21	* THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
22	* IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
23	* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
24	* IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
25	* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
26	* PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS;
27	* OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
28	* WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR
29	* OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF
30	* ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
31	*
32	*************************************************************************** */
33	#ifndef _h_cxiAclUser
34	#define _h_cxiAclUser
35	/* @(#)02 1.21 src/avs/fs/mmfs/ts/kernext/ibm-kxi/cxiAclUser.h, mmfs, avs_rgpfs24, rgpfs240610b 10/10/05 15:44:03 */
36	/****************************************************************************
37	*
38	* Acl User data
39	*
40	* Contains Tiger Shark Access Control List definitions.
41	* Some of the definitions in this file are exportable data items,
42	* if POSIX compliance is claimed.
43	*
44	***************************************************************************/
45
46	#include <cxiCred.h>
47
48	/* An ACL entry's permission set is defined as a set of 8 bits.
49	Bits seven and eight are currently unused.
50	Bits six, five, and four are delete, insert, and control access.
51	Bits three, two, and one are read, write, and execute/search access.
52	If any of these bits are set, the corresponding access is granted.
53	Otherwise, access is denied.
54	Note: This data type is non-exportable data. */
55	typedef unsigned char acl_permset_t;
56
57	/* This data type is used to distinguish different types of ACLs.
58	Note: This data type is exportable data. */
59	typedef unsigned char internal_acl_type_t;
60	#define ACL_TYPE_ACCESS 1
61	#define ACL_TYPE_DEFAULT 2
62
63	#ifdef NFS4_ACL_TEST
64	// For testing NFS4 ACLS only
65	#define ACL_TYPE_NFS4_ACL_TEST 250
66	#define ACL_TYPE_NFS4_ACL_TEST_SIZE 14
67	#endif /* NFS4_ACL_TEST */
68
69	// The following are for internal use only
70	#define ACL_TYPE_NFS4 251 /* an NFSv4 ACL */
71	#define ACL_TYPE_ACCESS_DELETE 252
72	#define ACL_TYPE_DEFAULT_DELETE 253
73	#define EXTENDED_ACCESS_ONLY 254
74	#define INTERNAL_FORMAT 255
75
76	/* acl_permset_t bits
77	*/
78	#define ACL_PERM_EXECUTE 001
79	#define ACL_PERM_WRITE 002
80	#define ACL_PERM_READ 004
81	#define ACL_PERM_CONTROL 010
82	#define ACL_PERM_INSERT 020 /* Version 2 ACL permission only */
83	#define ACL_PERM_DELETE 040 /* Version 2 ACL permission only */
84
85	#define ACL_PERM_LOOKUP(credP) ACL_PERM_EXECUTE
86	#define ACL_PERM_MASK 077 /* Mask includes all permissions */
87
88	#define ACL_PERM_UMODE 007 /* Mask includes only UNIX mode bits */
89
90	/* VNOP extended access modes that can be checked (gpfs_v_access()).
91	*/
92	#define C_ACC ACL_PERM_CONTROL
93	#define I_ACC ACL_PERM_INSERT
94	#define D_ACC ACL_PERM_DELETE
95
96	/* An ACL entry's tag type is defined as a one byte value.
97	It is used to distinguish different types of ACL entries.
98	Note: This data type is exportable data. */
99	typedef unsigned char acl_tag_t;
100	#define ACL_USER_OBJ 1 /* aceShort ACL entry */
101	#define ACL_GROUP_OBJ 2 /* aceShort ACL entry */
102	#define ACL_OTHER 3 /* aceShort ACL entry */
103	#define ACL_MASK 4 /* aceShort ACL entry */
104	#define ACL_USER 5 /* aceShort ACL entry */
105	#define ACL_GROUP 6 /* aceShort ACL entry */
106	#define ACL_FOREIGN_OTHER 7 /* Version 2 ACL entry type (use aceLong) */
107	#define ACL_ANY_OTHER 8 /* Version 2 ACL entry type (use aceShort) */
108	#define ACL_FOREIGN_USER 9 /* Version 2 ACL entry type (use aceLong) */
109	#define ACL_FOREIGN_GROUP 10 /* Version 2 ACL entry type (use aceLong) */
110	#define ACL_UDEFINED_TAG 255
111
112	struct acenodce
113	{
114	char aceComments[1]; /* Short ACL entry */
115	};
116	struct acedce
117	{
118	ext_id_t aceRealm; /* DCE cell specification */
119	char aceComments[1]; /* Version 2 ACL foreign ACL entry */
120	};
121
122	/* An ACL entry consists of a fixed part - ACL entry length, permission set,
123	entry tag type, entry qualifier (uid or gid), and followed by an optional
124	character string.
125	Note: This data type is non-exportable data. */
126	typedef struct
127	{
128	UInt16 aceLength;
129	acl_permset_t acePermissions;
130	acl_tag_t aceTagType;
131	cxiUid_t aceQualifier;
132	union
133	{
134	struct acenodce aceShort;
135	struct acedce aceLong;
136	};
137	} acl_entry_t;
138
139	#define SHORT_ACE_SIZE PTR_TO_INT32(&(((acl_entry_t *) 0)->aceShort.aceComments[0]))
140	#define LONG_ACE_SIZE PTR_TO_INT32(&(((acl_entry_t *) 0)->aceLong.aceComments[0]))
141
142	struct aclv1
143	{
144	acl_entry_t aclEntry[1];
145	};
146
147	struct aclv2
148	{
149	UInt32 aclFlags;
150
151	#define ACLV2_RESERVED_MASK 0xfe000000
152	#define ACLV2_ACLEXTMODE_MASK 0x01ff0000
153	#define ACLV2_UNUSED_MASK 0x0000ffff
154	#define ACLV2_ACLEXTMODE_GET(flags) (((flags) & ACLV2_ACLEXTMODE_MASK) >> 16)
155	#define ACLV2_ACLEXTMODE_PUT(flags, mode) \
156	(flags = ((flags) & ~ACLV2_ACLEXTMODE_MASK) \| ((mode) << 16))
157
158	UInt16 aclOtherAceCnt; // number of any_other & foreign_other
159	ext_id_t defaultRealm; // Default ACL cell
160	acl_entry_t aclEntry[1]; // zero or more ACL entries
161	};
162
163	/* NFSv4 ACL structures:
164	* Internally, GPFS stores all ACLs in its "ACL" structure which includes a
165	* variable-length area where aclVersion-specific information is stored.
166	* For NFSv4 ACLs, this variable area contains a list of acl4_entry_t structures.
167	* The following types and defines are used in the acl4_entry_t structure.
168	*/
169
170	/* Allowing for the NFSv4 ACE to be variable length. */
171	typedef UInt16 ace4_length_t; /* Length of an individual ACE */
172
173	typedef UInt16 ace4_type_t; /* The type of mask in the ACE */
174	/* See gpfs.h for defintions for this field.
175	The following are not yet supported but in code under ifdef */
176	#define ACE4_TYPE_AUDIT 2
177	#define ACE4_TYPE_ALARM 3
178
179	typedef unsigned int ace4_flag_t;
180	/* See gpfs.h for defintions for this field.
181	The following ACE FLAG values are not externalized. */
182	#define ACE4_FLAG_NO_PROPAGATE 0x00000004
183	#define ACE4_FLAG_SUCCESSFUL 0x00000010
184	#define ACE4_FLAG_FAILED 0x00000020
185	#define ACE4_FLAG_EXTERNAL 0x0000004B
186
187	/* The following ACE IFLAG values are not externalized. */
188	#define ACE4_IFLAG_EXCLUDE_FILES 0x40000000
189	#define ACE4_IFLAG_EXCLUDE_DIRS 0x20000000
190	#define ACE4_IFLAG_EXTERNAL 0x80000000
191
192
193	/* Variations to permit/deny/audit/alarm. */
194	typedef unsigned int ace4_mask_t;
195	/* See gpfs.h for defintions for this field. */
196
197	/* NFSv4 "who" strings are translated by nfsd4 to locally-defined ids.
198	* These can be a uid, a gid (if ACE4_FLAG_GROUP_ID is specified), or one
199	* of the "special identifiers" (if ACE4_IFLAG_SPECIAL_ID is specified).
200	*/
201	typedef cxiUid_t ace4_who_t;
202	/* See gpfs.h for SPECIAL_ID defintions for this field.
203	The following ACE special who values are not supported (AIX does not
204	provide the required information in the cred. */
205	#define ACE4_SPECIAL_INTERACTIVE 4
206	#define ACE4_SPECIAL_NETWORK 5
207	#define ACE4_SPECIAL_DIALUP 6
208	#define ACE4_SPECIAL_BATCH 7
209	#define ACE4_SPECIAL_ANONYMOUS 8
210	#define ACE4_SPECIAL_AUTHENTICATED 9
211	#define ACE4_SPECIAL_SERVICE 10
212
213	/* ACEs can be chained together (for speed of processing reasons) by
214	* including the offset to the next ACE in the chain. */
215	typedef Int32 ace4_link_t;
216
217
218
219	#ifdef NFS4_ACL_DEBUG
220	#define ACE4_IFLAG_USER_OBJ 0x10000000
221	#define ACE4_IFLAG_GROUP_OBJ 0x08000000
222	#define ACE4_IFLAG_OTHER 0x04000000
223	#define ACE4_IFLAG_MASK 0x02000000
224	#define ACE4_IFLAG_USER 0x01000000
225	#define ACE4_IFLAG_GROUP 0x00800000
226	#else
227	#define ACE4_IFLAG_USER_OBJ 0x00000000
228	#define ACE4_IFLAG_GROUP_OBJ 0x00000000
229	#define ACE4_IFLAG_OTHER 0x00000000
230	#define ACE4_IFLAG_MASK 0x00000000
231	#define ACE4_IFLAG_USER 0x00000000
232	#define ACE4_IFLAG_GROUP 0x00000000
233	#endif /* NFS4_ACL_DEBUG */
234
235	/* These are the supported iherit flags. aceFlags can be OR'ed against
236	* this combination to see if any of the inherit flags are specified.
237	*/
238	#define ACE4_FLAG_INHERIT (ACE4_FLAG_FILE_INHERIT \| ACE4_FLAG_DIR_INHERIT \|\
239	ACE4_FLAG_INHERIT_ONLY)
240
241	#define ACE4_SUPPORTED_FLAGS (ACE4_FLAG_INHERIT \| ACE4_FLAG_GROUP_ID \|\
242	ACE4_FLAG_SUCCESSFUL \| ACE4_FLAG_FAILED)
243
244	/* Other IFlags are internal-only */
245	#ifdef NFS4_ACL_DEBUG
246	#define ACE4_SUPPORTED_IFLAGS (ACE4_IFLAG_SPECIAL_ID \| ACE4_IFLAG_EXCLUDE_FILES \|\
247	ACE4_IFLAG_EXCLUDE_DIRS \| ACE4_IFLAG_USER_OBJ \|\
248	ACE4_IFLAG_GROUP_OBJ \| ACE4_IFLAG_OTHER \|\
249	ACE4_IFLAG_MASK \| ACE4_IFLAG_USER \|\
250	ACE4_IFLAG_GROUP)
251	#else
252	#define ACE4_SUPPORTED_IFLAGS (ACE4_IFLAG_SPECIAL_ID \| ACE4_IFLAG_EXCLUDE_FILES \|\
253	ACE4_IFLAG_EXCLUDE_DIRS)
254	#endif
255
256
257	/* GPFS commonly used mask combinations */
258	/* READ/WRITE of NAMED ATTRIBUTES are not covered yet */
259	#define ACE4_POSIX_READ (ACE4_MASK_READ)
260	#define ACE4_POSIX_WRITE (ACE4_MASK_WRITE \| ACE4_MASK_APPEND)
261	#define ACE4_POSIX_EXECUTE (ACE4_MASK_EXECUTE)
262	#define ACE4_POSIX_CONTROL (ACE4_MASK_WRITE_ACL)
263	#define ACE4_POSIX_READ_DIR (ACE4_MASK_LIST_DIR)
264	#define ACE4_POSIX_WRITE_DIR (ACE4_MASK_ADD_FILE \| ACE4_MASK_ADD_SUBDIR \|\
265	ACE4_MASK_DELETE_CHILD)
266	#define ACE4_POSIX_EXECUTE_DIR (ACE4_MASK_SEARCH)
267	#define ACE4_POSIX_CONTROL_DIR (ACE4_MASK_WRITE_ACL)
268	#define ACE4_POSIX_OWNER (ACE4_MASK_WRITE_ACL \| ACE4_MASK_WRITE_ATTR)
269	#define ACE4_POSIX_EVERYONE (ACE4_MASK_READ_ACL \| ACE4_MASK_SYNCHRONIZE)
270
271	/* Some mask values are represented in posix by permissions on the parent. */
272	#define ACE4_POSIX_PARENT (ACE4_MASK_DELETE \| ACE4_MASK_READ_ATTR)
273
274	/* Convenience macros for testing the NFSv4 flags, masks, and special who values.
275	* Note that these macros are bilingual. If a local-endian ACL is available, an
276	* ACEP can be provided. Reading of an ACL directly from the disk buffer is also
277	* possible given the AclLocalEndian (ALE) object. While most use of the ACL
278	* (such as iaccess checks) is done via the ALE, user read/write of the ACL is
279	* done via the AclLocalEndian::exportAcl method with subsequent interpretation
280	* of the ACL then done using the byteSwapped ACL.
281	*/
282
283	#define USE_ALE ((acl4_entry_t )NULL) / Dummy ACEP */
284
285	#define getV4Who(ACEP,ALE) (ACEP)? ((ACEP)->aceWho) : ((ALE).aceWho())
286	#define getV4Type(ACEP,ALE) (ACEP)? ((ACEP)->aceType) : ((ALE).aceType())
287	#define getV4Flags(ACEP,ALE) (ACEP)? ((ACEP)->aceFlags) : ((ALE).aceFlags())
288	#define getV4IFlags(ACEP,ALE) (ACEP)? ((ACEP)->aceIFlags): ((ALE).aceIFlags())
289	#define getV4Mask(ACEP,ALE) (ACEP)? ((ACEP)->aceMask) : ((ALE).aceMask())
290
291	#define isV4Bit(WORD, BIT) (0 != ((WORD) & (BIT)))
292	#define isV4AllBits(WORD, BITS) (BITS == ((WORD) & (BITS)))
293
294	#define isV4Type(ACEP, ALE, VALUE) ((getV4Type(ACEP, ALE)) == (VALUE))
295	#define isV4Who(ACEP, ALE, VALUE) ((getV4Who(ACEP, ALE)) == (VALUE))
296
297	#define isV4Allow(ACEP,ALE) isV4Type(ACEP, ALE, ACE4_TYPE_ALLOW)
298	#define isV4Deny(ACEP,ALE) isV4Type(ACEP, ALE, ACE4_TYPE_DENY)
299	#define isV4Audit(ACEP,ALE) isV4Type(ACEP, ALE, ACE4_TYPE_AUDIT)
300	#define isV4Alarm(ACEP,ALE) isV4Type(ACEP, ALE, ACE4_TYPE_ALARM)
301
302	#define isV4FileInherit(ACEP,ALE) isV4Bit(getV4Flags(ACEP,ALE),ACE4_FLAG_FILE_INHERIT)
303	#define isV4DirInherit(ACEP,ALE) isV4Bit(getV4Flags(ACEP,ALE),ACE4_FLAG_DIR_INHERIT)
304	#define isV4NoPropagate(ACEP,ALE) isV4Bit(getV4Flags(ACEP,ALE),ACE4_FLAG_NO_PROPAGATE)
305	#define isV4InheritOnly(ACEP,ALE) isV4Bit(getV4Flags(ACEP,ALE),ACE4_FLAG_INHERIT_ONLY)
306	#define isV4AuditSuccess(ACEP,ALE) isV4Bit(getV4Flags(ACEP,ALE),ACE4_FLAG_SUCCESSFUL)
307	#define isV4AuditFailure(ACEP,ALE) isV4Bit(getV4Flags(ACEP,ALE),ACE4_FLAG_FAILED)
308	#define isV4GroupId(ACEP,ALE) isV4Bit(getV4Flags(ACEP,ALE),ACE4_FLAG_GROUP_ID)
309	#define isV4Inherit(ACEP,ALE) isV4Bit(getV4Flags(ACEP,ALE),ACE4_FLAG_INHERIT)
310
311	#define isV4SpecialId(ACEP,ALE) isV4Bit(getV4IFlags(ACEP,ALE),ACE4_IFLAG_SPECIAL_ID)
312	#define isV4FileApplicable(ACEP, ALE) \
313	(!isV4Bit(getV4IFlags(ACEP,ALE),ACE4_IFLAG_EXCLUDE_FILES))
314	#define isV4DirApplicable(ACEP, ALE) \
315	(!isV4Bit(getV4IFlags(ACEP,ALE),ACE4_IFLAG_EXCLUDE_DIRS))
316
317	/* Inherit entries may have originally been identified as FILE_INHERIT or
318	* DIR_INHERIT. When such an ACL becomes a default, the entries become
319	* applicable to the object in addition to being inherittable. Such entries
320	* may then need to be marked as not being applicable for files or dirs.
321	* When returning such an ACL, non-applicable entries are removed (they are
322	* here only so there can be a single, common, default ACL).
323	*
324	* The ACE is applicable if
325	* 1) The object is a directory and the entry is either directly applicable
326	* to directories, OR it is inherittable by files.
327	* 2) The object is a file and the entry is directly applicable to files AND
328	* it is not an InheritOnly entry.
329	*/
330
331	#define isV4Applicable(ACEP, ALE, ISDIR) \
332	(( ISDIR && (isV4DirApplicable(ACEP,ALE) \|\| isV4FileInherit(ACEP,ALE))) \|\| \
333	(!ISDIR && (isV4FileApplicable(ACEP,ALE) && !isV4InheritOnly(ACEP,ALE))))
334
335	#define isV4Read(ACEP,ALE) isV4Bit(getV4Mask(ACEP,ALE),ACE4_MASK_READ)
336	#define isV4List(ACEP,ALE) isV4Bit(getV4Mask(ACEP,ALE),ACE4_MASK_LIST_DIR)
337	#define isV4Write(ACEP,ALE) isV4Bit(getV4Mask(ACEP,ALE),ACE4_MASK_WRITE)
338	#define isV4AddFile(ACEP,ALE) isV4Bit(getV4Mask(ACEP,ALE),ACE4_MASK_ADD_FILE)
339	#define isV4Append(ACEP,ALE) isV4Bit(getV4Mask(ACEP,ALE),ACE4_MASK_APPEND)
340	#define isV4AddSubdir(ACEP,ALE) isV4Bit(getV4Mask(ACEP,ALE),ACE4_MASK_ADD_SUBDIR)
341	#define isV4ReadNamed(ACEP,ALE) isV4Bit(getV4Mask(ACEP,ALE),ACE4_MASK_READ_NAMED)
342	#define isV4WriteNamed(ACEP,ALE) isV4Bit(getV4Mask(ACEP,ALE),ACE4_MASK_WRITE_NAMED)
343	#define isV4Execute(ACEP,ALE) isV4Bit(getV4Mask(ACEP,ALE),ACE4_MASK_EXECUTE)
344	#define isV4Search(ACEP,ALE) isV4Bit(getV4Mask(ACEP,ALE),ACE4_MASK_SEARCH)
345	#define isV4DeleteChild(ACEP,ALE) isV4Bit(getV4Mask(ACEP,ALE),ACE4_MASK_DELETE_CHILD)
346	#define isV4ReadAttr(ACEP,ALE) isV4Bit(getV4Mask(ACEP,ALE),ACE4_MASK_READ_ATTR)
347	#define isV4WriteAttr(ACEP,ALE) isV4Bit(getV4Mask(ACEP,ALE),ACE4_MASK_WRITE_ATTR)
348	#define isV4Delete(ACEP,ALE) isV4Bit(getV4Mask(ACEP,ALE),ACE4_MASK_DELETE)
349	#define isV4ReadAcl(ACEP,ALE) isV4Bit(getV4Mask(ACEP,ALE),ACE4_MASK_READ_ACL)
350	#define isV4WriteAcl(ACEP,ALE) isV4Bit(getV4Mask(ACEP,ALE),ACE4_MASK_WRITE_ACL)
351	#define isV4WriteOwner(ACEP,ALE) isV4Bit(getV4Mask(ACEP,ALE),ACE4_MASK_WRITE_OWNER)
352	#define isV4Synchronize(ACEP,ALE) isV4Bit(getV4Mask(ACEP,ALE),ACE4_MASK_SYNCHRONIZE)
353
354	#define isV4Owner(ACEP,ALE) isV4Who(ACEP,ALE,ACE4_SPECIAL_OWNER)
355	#define isV4Group(ACEP,ALE) isV4Who(ACEP,ALE,ACE4_SPECIAL_GROUP)
356	#define isV4Everyone(ACEP,ALE) isV4Who(ACEP,ALE,ACE4_SPECIAL_EVERYONE)
357	#define isV4Interactive(ACEP,ALE) isV4Who(ACEP,ALE,ACE4_SPECIAL_INTERACTIVE)
358	#define isV4Network(ACEP,ALE) isV4Who(ACEP,ALE,ACE4_SPECIAL_NETWORK)
359	#define isV4Dialup(ACEP,ALE) isV4Who(ACEP,ALE,ACE4_SPECIAL_DIALUP)
360	#define isV4Batch(ACEP,ALE) isV4Who(ACEP,ALE,ACE4_SPECIAL_BATCH)
361	#define isV4Anonymous(ACEP,ALE) isV4Who(ACEP,ALE,ACE4_SPECIAL_ANONYMOUS)
362	#define isV4Authentic(ACEP,ALE) isV4Who(ACEP,ALE,ACE4_SPECIAL_AUTHENTICATED)
363	#define isV4Service(ACEP,ALE) isV4Who(ACEP,ALE,ACE4_SPECIAL_SERVICE)
364
365	/* Flag values for gpfs_getacl/NFSv4_getMode */
366	#define GETACL_NFSV4 0x00000001
367	#define GETACL_POSIX 0x00000002
368	#define GETACL_NATIVE 0x00000004
369	#define GETACL_OWNER_IN_GROUP 0x00000008
370	#define GETACL_DONOT_BLD_ACL 0x00000010
371
372	/* The non-opaque/external ACL struct should be used in the
373	* gpfs_getacl and gpfs_putacl calls. While these are defined
374	* in gpfs.h along with the interfaces, we are reserving the
375	* bits here as well in this list of internal-only flags just
376	* to make sure they don't get reused.
377	*/
378	#define GETACL_STRUCT_RESERVED 0X00000020
379	#define PUTACL_STRUCT_RESERVED 0X00000020
380
381	typedef struct
382	{
383	ace4_length_t aceLength;
384	ace4_type_t aceType; /* allow, deny, audit, alarm */
385	ace4_flag_t aceFlags; /* V4 flags */
386	ace4_flag_t aceIFlags; /* Internal (GPFS flags) */
387	ace4_mask_t aceMask; /* extended "mode" bits */
388	ace4_who_t aceWho; /* uid, gid, or special identifier */
389	ace4_link_t aceNextAA; /* Next Audit or Alarm ACE */
390	} acl4_entry_t;
391
392	struct aclv4
393	{
394	Int32 aceCount; // Total number of ACEs
395	ace4_link_t aaListOffset; // Offset to first Audit/Alarm ACE
396	acl4_entry_t aclEntry[1]; // zero or more ACL entries
397	};
398
399
400	/* An ACL consists of header information (length, type, etc.).
401	followed by at least three, but may be more, ACL entries.
402	The three required entries must be ACL_USER_OBJ, ACL_GROUP_OBJ,
403	and ACL_OTHER. The first four bytes of the ACL header must always
404	be the length of the entire ACL.
405	Note: This data type is non-exportable data. */
406	typedef struct
407	{
408	UInt32 aclLength; // total length (hdr + acl entries)
409	UInt16 aclVersion; // version number
410	internal_acl_type_t aclType; // type of ACL: default or access
411
412	/* NT format ACLs (aclVersion == ACL_NT_VERSION) are opaque strings
413	* starting here (&aclBuf[0]). The version-unique portions of the other
414	* ACL versions are at the end of this struct (v1 and v2 below).
415	*/
416	union
417	{
418	char aclBuf[1]; // Opaque NT ACL used by NSS
419	acl_permset_t aclMask; // ACL_MASK entry
420	acl_permset_t aclGroupObj; // ACL_GROUP_OBJ entry
421	};
422	cxiMode_t aclMode; // file mode (at acl create time)
423	UInt32 aclUserAceCnt; // number of ACL_USER entries
424	UInt32 aclGroupAceCnt; // number of ACL_GROUP entries
425	UInt32 aclFlags;
426
427	#define ACL_NEW_MODE_ATTR_BIT 0x00000001 // if set, replace the current mode
428	#define ACL_GROUP_CONTROL_BIT 0x00000002 // ACL_GROUP_OBJ control bit
429	#define ACL_OTHER_CONTROL_BIT 0x00000004 // ACL_OTHER control bit
430	#define ACL_MASK_CONTROL_BIT 0X00000008 // ACL_MASK control bit
431	#define RESERVED_MASK 0xfffffff0 // guaranteed to be zero
432
433	union
434	{
435	struct aclv1 v1;
436	struct aclv2 v2;
437	#ifdef NFS4_ACL
438	struct aclv4 v4;
439	#endif /* NFS4_ACL */
440	};
441	} ACL;
442
443	/* The following is used as a pointer to an ACL in working storage.
444	Note: This data type is non-exportable data. */
445	typedef ACL *acl_t;
446
447	#define ACL_HEADER_SIZE_V1 PTR_TO_INT32(&(((acl_t) 0)->v1.aclEntry[0]))
448	#define ACL_HEADER_SIZE_V2 PTR_TO_INT32(&(((acl_t) 0)->v2.aclEntry[0]))
449
450	#ifdef NFS4_ACL
451	/* Offset to gpfs_ace4_t structs in the NFSv4 ACL we externalize */
452	#define ACL_EXT_HEADER_SIZE_V4 PTR_TO_INT32(&(((acl_t) 0)->aclBuf[0]))
453
454	/* Offset to acl4_entry_t structs in our internal ACL format. */
455	#define ACL_HEADER_SIZE_V4 PTR_TO_INT32(&(((acl_t) 0)->v4.aclEntry[0]))
456
457	/* Next ACE in an NFSv4 ACL (internal, local-endian format only) */
458	#define ACL4_ENTRY_NEXT(ACEP) (acl4_entry_t *)((caddr_t)ACEP + ACEP->aceLength)
459
460	#define ACL_ENTRY_START(ACLP,VER) \
461	(acl_entry_t *)((VER == GPFS_ACL_VERSION_NFS4) ? \
462	(caddr_t)ACLP + ACL_HEADER_SIZE_V4 : \
463	((VER == ACL_FIRST_VERSION) ? \
464	(caddr_t)ACLP + ACL_HEADER_SIZE_V1 : \
465	(caddr_t)ACLP + ACL_HEADER_SIZE_V2));
466	#else
467	#define ACL_ENTRY_START(ACLP,VER) \
468	(acl_entry_t *)((VER == ACL_FIRST_VERSION) ? \
469	(caddr_t)ACLP + ACL_HEADER_SIZE_V1 : \
470	(caddr_t)ACLP + ACL_HEADER_SIZE_V2);
471	#endif /* NFS4_ACL */
472
473	/* Upper bound on the size of a base acl (header + 4 entries for base
474	permissions and mask). The correct value would be
475	ACL_HEADER_SIZE + 4*SHORT_ACE_SIZE
476	However, ACL_BASE_SIZE_MAX needs to be a compile-time constant, because
477	it is used to declare a char array on the stack as temporary buffer for
478	assembling a base acl. Unfortunately, the compiler does not accept the
479	offset calculations in the ACL_HEADER_SIZE and SHORT_ACE_SIZE macros as
480	constants. The definition below slightly over-estimates the base acl size,
481	but is sufficient for our purpose, since we only need an upper bound. */
482	#define ACL_BASE_SIZE_MAX (sizeof(ACL) + 3*sizeof(acl_entry_t))
483
484	/* acl format versions */
485	#define ACL_FIRST_VERSION 1
486	#define ACL_SECOND_VERSION 2
487
488	#ifdef NFS4_ACL
489	#define ACL_VERSION 4
490	#else
491	#define ACL_VERSION 2
492	#endif /* NFS4_ACL */
493
494	#ifdef NFS4_ACL
495	#define GPFS_ACL_VERSION_NFS4 4
496	#endif /* NFS4_ACL */
497
498	#define DEFAULT_ACLMASK_V2 077 // rwxcid
499	#define DEFAULT_ACLMASK_V1 017 // rwxc
500
501	#define ACLMASK(_VERSION) \
502	(((_VERSION) == ACL_FIRST_VERSION) ? DEFAULT_ACLMASK_V1 : \
503	DEFAULT_ACLMASK_V2);
504	#define MASK_SET 0x80
505
506	/* Mapping for the index tables used by the verifyTSAcl routine.
507	Note: This data type is non-exportable data. */
508	typedef struct
509	{
510	acl_entry_t *aceP;
511	cxiUid_t key;
512	ext_id_t extKey; /* cell */
513	caddr_t nxt;
514	} aceIndxTable_t;
515
516	/* Macro to test whether the ACL_MASK is explicitly set */
517	#define ACLMASK_SET(_aclMask) (((_aclMask) & MASK_SET) != 0)
518
519	#define REM_STAT_REMOTE_FS 1
520
521	typedef struct
522	{
523	UInt32 flags;
524	UInt32 sgUIDHigh;
525	UInt32 sgUIDLow;
526	UInt32 inum;
527	UInt32 mode;
528	UInt32 uid;
529	UInt32 gid;
530	} rem_stat_t;
531
532
533	#endif /* _h_cxiAclUser */
534

Note: See TracBrowser for help on using the repository browser.

Context Navigation

source: gpfs_3.1_ker2.6.20/lpp/mmfs/src/include/cxi/cxiAclUser.h @ 177

Download in other formats: