Changeset 9163

Timestamp:

12/15/11 12:46:53 (18 months ago)

Author:

sampson

Message:

Updated FUSE module to support new credential system.

Location:

trunk/src

Files:

• apps/fuse/pvfs2fuse.c (modified) (32 diffs)
• common/security/security-util.c (modified) (2 diffs)

trunk/src/apps/fuse/pvfs2fuse.c

@@ -34 +34 @@
 #include "pint-util.h"
 #include "str-utils.h"
+#include "pvfs2-util.h"
+#include "pint-security.h"
+#include "security-util.h"
 
 typedef struct {
           PVFS_object_ref       ref;
-          PVFS_credentials      creds;
+          PVFS_credential       cred;
 } pvfs_fuse_handle_t;
 
@@ -71 +74 @@
 #endif
 
-static void pvfs_fuse_gen_credentials(
-   PVFS_credentials *credentials)
-{
-   credentials->uid = fuse_get_context()->uid;
-   credentials->gid = fuse_get_context()->gid;
+#define pvfs_fuse_cleanup_credential(cred) PINT_cleanup_credential(cred)
+
+static int pvfs_fuse_gen_credential(
+   PVFS_credential *credential)
+{
+   struct fuse_context *ctx = fuse_get_context();
+   PVFS_credential *new_cred;
+   char uid[16], gid[16];
+   int ret;
+
+   /* convert uid/gid to strings */
+   ret = snprintf(uid, sizeof(uid), "%u", ctx->uid);
+   if (ret < 0 || ret >= sizeof(uid))
+   {
+      return -1;
+   }
+
+   ret = snprintf(gid, sizeof(gid), "%u", ctx->gid);
+   if (ret < 0 || ret >= sizeof(gid))
+   {
+       return -1;
+   }
+
+   /* allocate new credential */
+   new_cred = (PVFS_credential *) malloc(sizeof(PVFS_credential));
+   if (!new_cred)
+   {
+       return -ENOMEM;
+   }
+   memset(new_cred, 0, sizeof(PVFS_credential));
+
+   /* generate credential -- this process must be running as root */
+   ret = PVFS_util_gen_credential(uid, 
+                                  gid, 
+                                  PVFS_DEFAULT_CREDENTIAL_TIMEOUT, 
+                                  NULL,
+                                  new_cred);
+
+   if (ret == 0)
+   {
+       /* copy credential to provided buffer */
+       ret = PINT_copy_credential(new_cred, credential);      
+   }
+
+   /* free generated credential */
+   pvfs_fuse_cleanup_credential(new_cred);
+   free(new_cred);
+
+   return ret;
 }
 
@@ -88 +135 @@
         */
 
-   pvfs_fuse_gen_credentials(&pfh->creds);
+   ret = pvfs_fuse_gen_credential(&pfh->cred);
+   if (ret < 0)
+   {
+      return ret;
+   }
 
    memset(&lk_response, 0, sizeof(lk_response));
    ret = PVFS_sys_lookup(pvfs2fuse.fs_id, 
                                                  (char *)path,
-                                                 &pfh->creds, 
+                                                 &pfh->cred, 
                                                  &lk_response, 
                                                  follow_link);
    if ( ret < 0 ) {
+      pvfs_fuse_cleanup_credential(&pfh->cred);
           return ret;
    }
@@ -117 +169 @@
    ret = PVFS_sys_getattr(pfhp->ref, 
                           PVFS_ATTR_SYS_ALL_NOHINT,
-                          (PVFS_credentials *) &pfhp->creds, 
+                          (PVFS_credential *) &pfhp->cred, 
                           &getattr_response);
    if ( ret < 0 )
@@ -248 +300 @@
    ret = lookup( path, &pfh, PVFS2_LOOKUP_LINK_NO_FOLLOW );
    if ( ret < 0 )
-          return PVFS_ERROR_TO_ERRNO_N( ret );
-
-   return pvfs_fuse_getattr_pfhp( &pfh, stbuf );
+   {
+      return PVFS_ERROR_TO_ERRNO_N( ret );
+   }
+
+   ret = pvfs_fuse_getattr_pfhp( &pfh, stbuf );
+
+   pvfs_fuse_cleanup_credential(&pfh.cred);
+
+   return ret;
 }
 
@@ -268 +326 @@
    ret = lookup( path, &pfh, PVFS2_LOOKUP_LINK_NO_FOLLOW );
    if ( ret < 0 )
-          return PVFS_ERROR_TO_ERRNO_N( ret );
-   
+   {
+      return PVFS_ERROR_TO_ERRNO_N( ret );
+   }
+
    ret = PVFS_sys_getattr(pfh.ref, 
                                                   PVFS_ATTR_SYS_ALL_NOHINT,
-                                                  (PVFS_credentials *) &pfh.creds, 
+                                                  (PVFS_credential *) &pfh.cred, 
                                                   &getattr_response);
+
+   pvfs_fuse_cleanup_credential(&pfh.cred);
+
    if ( ret < 0 )
           return PVFS_ERROR_TO_ERRNO_N( ret );
@@ -313 +376 @@
    }
 
-   lookup( parent, &parent_pfh, PVFS2_LOOKUP_LINK_FOLLOW );
+   rc = lookup( parent, &parent_pfh, PVFS2_LOOKUP_LINK_FOLLOW );
+   if (rc)
+   {
+      return PVFS_ERROR_TO_ERRNO_N( rc );
+   }
 
    /* Set attributes */
    memset(&attr, 0, sizeof(PVFS_sys_attr));
-   attr.owner = parent_pfh.creds.uid;
-   attr.group = parent_pfh.creds.gid;
+   attr.owner = parent_pfh.cred.userid;
+   attr.group = parent_pfh.cred.group_array[0];
    attr.perms = mode;
    attr.mask = PVFS_ATTR_SYS_ALL_SETABLE;
@@ -325 +392 @@
                                            parent_pfh.ref,
                                            attr,
-                                           &parent_pfh.creds,
+                                           &parent_pfh.cred,
                                            &resp_mkdir);
+
+   pvfs_fuse_cleanup_credential(&parent_pfh.cred);
+
    if (rc)
    {
@@ -354 +424 @@
    }
 
-   lookup( parent, &parent_pfh, PVFS2_LOOKUP_LINK_FOLLOW );
-
-   rc = PVFS_sys_remove(filename, parent_pfh.ref, &parent_pfh.creds);
+   rc = lookup( parent, &parent_pfh, PVFS2_LOOKUP_LINK_FOLLOW );
    if (rc)
    {
+      return PVFS_ERROR_TO_ERRNO_N( rc );
+   }
+
+   rc = PVFS_sys_remove(filename, parent_pfh.ref, &parent_pfh.cred);
+
+   pvfs_fuse_cleanup_credential(&parent_pfh.cred);
+
+   if (rc)
+   {
           return PVFS_ERROR_TO_ERRNO_N( rc );
    }
@@ -377 +454 @@
 static int pvfs_fuse_symlink(const char *from, const char *to)
 {
-   int                  ret                        = 0;
+   int                  ret = 0;
    PVFS_sys_attr        attr;
    PVFS_sysresp_lookup  resp_lookup;
    PVFS_object_ref      parent_ref;
    PVFS_sysresp_symlink resp_sym;
-   PVFS_credentials    credentials;
+   PVFS_credential      credential;
    pvfs_fuse_handle_t   dir_pfh;
    char *tofile, *todir, *cp;
 
-   pvfs_fuse_gen_credentials(&credentials);
+   pvfs_fuse_gen_credential(&credential);
 
    /* Initialize any variables */
@@ -395 +472 @@
 
    /* Set the attributes for the new directory */
-   attr.owner = credentials.uid;
-   attr.group = credentials.gid;
+   attr.owner = credential.userid;
+   attr.group = credential.group_array[0];
    attr.perms = 0777;              
    attr.mask = (PVFS_ATTR_SYS_ALL_SETABLE);
@@ -435 +512 @@
                                                   (char *) from,
                                                   attr, 
-                                                  &credentials, 
+                                                  &credential, 
                                                   &resp_sym);
+
+   pvfs_fuse_cleanup_credential(&credential);
+   pvfs_fuse_cleanup_credential(&dir_pfh.cred);
 
    if (ret < 0)
@@ -491 +571 @@
                                                 toname,
                                                 todir_pfh.ref,
-                                                &todir_pfh.creds);
+                                                &todir_pfh.cred);
+
+   pvfs_fuse_cleanup_credential(&fromdir_pfh.cred);
+   pvfs_fuse_cleanup_credential(&todir_pfh.cred);
+
    if (rc)
           return PVFS_ERROR_TO_ERRNO_N( rc );
@@ -512 +596 @@
    new_attr.mask = PVFS_ATTR_SYS_PERM;
  
-   ret = PVFS_sys_setattr(pfh.ref,new_attr,&pfh.creds);
+   ret = PVFS_sys_setattr(pfh.ref,new_attr,&pfh.cred);
+
+   pvfs_fuse_cleanup_credential(&pfh.cred);
+
    if (ret < 0) 
           return PVFS_ERROR_TO_ERRNO_N( ret );
@@ -534 +621 @@
    new_attr.mask = PVFS_ATTR_SYS_UID | PVFS_ATTR_SYS_GID;
  
-   ret = PVFS_sys_setattr(pfh.ref,new_attr,&pfh.creds);
+   ret = PVFS_sys_setattr(pfh.ref,new_attr,&pfh.cred);
+
+   pvfs_fuse_cleanup_credential(&pfh.cred);
+
    if (ret < 0) 
           return PVFS_ERROR_TO_ERRNO_N( ret );
@@ -550 +640 @@
           return PVFS_ERROR_TO_ERRNO_N( ret );
    
-   ret = PVFS_sys_truncate(pfh.ref,size,&pfh.creds);
+   ret = PVFS_sys_truncate(pfh.ref,size,&pfh.cred);
+
+   pvfs_fuse_cleanup_credential(&pfh.cred);
+
    if (ret < 0) 
           return PVFS_ERROR_TO_ERRNO_N( ret );
@@ -572 +665 @@
    new_attr.mask = PVFS_ATTR_SYS_ATIME | PVFS_ATTR_SYS_MTIME;
  
-   ret = PVFS_sys_setattr(pfh.ref,new_attr,&pfh.creds);
+   ret = PVFS_sys_setattr(pfh.ref,new_attr,&pfh.cred);
+
+   pvfs_fuse_cleanup_credential(&pfh.cred);
+
    if (ret < 0) 
           return PVFS_ERROR_TO_ERRNO_N( ret );
@@ -615 +711 @@
 
    ret = PVFS_sys_read(pfh->ref, file_req, offset, buf,
-                                           mem_req, &pfh->creds, &resp_io);
+                                           mem_req, &pfh->cred, &resp_io);
+
    if (ret == 0) 
    {
@@ -639 +736 @@
 
    ret = PVFS_sys_write(pfh->ref, file_req, offset, (char*)buf,
-                                                mem_req, &pfh->creds, &resp_io);
+                                                mem_req, &pfh->cred, &resp_io);
    if (ret == 0) 
    {
@@ -652 +749 @@
 {
    int                  ret;
-   PVFS_credentials     creds;
+   PVFS_credential      cred;
    PVFS_sysresp_statfs resp_statfs;
 
-   pvfs_fuse_gen_credentials(&creds);
+   ret = pvfs_fuse_gen_credential(&cred);
+   if (ret < 0)
+   {
+       return PVFS_ERROR_TO_ERRNO_N(ret);
+   }
 
    /* gather normal statfs statistics from system interface */
 
-   ret = PVFS_sys_statfs(pvfs2fuse.fs_id, &creds, &resp_statfs);
+   ret = PVFS_sys_statfs(pvfs2fuse.fs_id, &cred, &resp_statfs);
+
+   pvfs_fuse_cleanup_credential(&cred);
+
    if (ret < 0)
    {
@@ -691 +795 @@
   
    if ( pfh != NULL ) {
+      pvfs_fuse_cleanup_credential(&pfh->cred);
       free( pfh );
       SET_FUSE_HANDLE( fi, NULL );
@@ -736 +841 @@
           ret = PVFS_sys_readdir(
                  pfh.ref, (!token ? PVFS_READDIR_START : token),
-                 pvfs_dirent_incount, &pfh.creds, &rd_response);
+                 pvfs_dirent_incount, &pfh.cred, &rd_response);
           if(ret < 0)
-                 return PVFS_ERROR_TO_ERRNO_N( ret );
+      {
+         pvfs_fuse_cleanup_credential(&pfh.cred);
+         return PVFS_ERROR_TO_ERRNO_N( ret );
+      }
 
           for(i = 0; i < rd_response.pvfs_dirent_outcount; i++)
@@ -756 +864 @@
 
    } while(rd_response.pvfs_dirent_outcount == pvfs_dirent_incount);
+
+   pvfs_fuse_cleanup_credential(&pfh.cred);
 
    return 0;
@@ -767 +877 @@
    pvfs_fuse_handle_t   pfh;
    int                  in_group_flag = 0;
+   PVFS_uid     uid;
+   PVFS_gid     gid;
 
    ret = lookup( path, &pfh, PVFS2_LOOKUP_LINK_FOLLOW );
@@ -773 +885 @@
 
    /* give root permission, no matter what */
-   if ( pfh.creds.uid == 0 )
+   if ( pfh.cred.userid == 0 )
           return 0;
 
@@ -782 +894 @@
    ret = PVFS_sys_getattr(pfh.ref, 
                           PVFS_ATTR_SYS_ALL_NOHINT,
-                          (PVFS_credentials *) &pfh.creds, 
+                          (PVFS_credential *) &pfh.cred, 
                           &getattr_response);
+
+   /* copy uid and gid so credential can be freed */
+   uid = pfh.cred.userid;
+   gid = pfh.cred.group_array[0];
+   pvfs_fuse_cleanup_credential(&pfh.cred);
+
    if ( ret < 0 )
-          return PVFS_ERROR_TO_ERRNO_N( ret );
+   {            
+          return PVFS_ERROR_TO_ERRNO_N( ret );
+   }
 
    attrs = &getattr_response.attr;
@@ -792 +912 @@
 
    /* see if uid matches object owner */
-   if ( attrs->owner == pfh.creds.uid )
+   if ( attrs->owner == uid )
    {
           /* see if object user permissions match access type */
@@ -823 +943 @@
    }
 
-   /* see if gid matches object group */
-   if(attrs->group == pfh.creds.gid)
+   /* see if gid matches object group 
+      TODO: check all groups */
+   if(attrs->group == gid)
    {
           /* default group match */
@@ -833 +954 @@
 #if 0
           /* no default group match, check supplementary groups */
-          ret = PINT_check_group(pfh.creds.uid, attrs->group);
+          ret = PINT_check_group(uid, attrs->group);
           if(ret == 0)
           {
@@ -899 +1020 @@
    /* Set attributes */
    memset(&attr, 0, sizeof(PVFS_sys_attr));
-   attr.owner = dir_pfh.creds.uid;
-   attr.group = dir_pfh.creds.gid;
+   attr.owner = dir_pfh.cred.userid;
+   attr.group = dir_pfh.cred.group_array[0];
    attr.perms = mode;
    attr.atime = time(NULL);
@@ -910 +1031 @@
                                                 dir_pfh.ref,
                                                 attr,
-                                                &dir_pfh.creds,
+                                                &dir_pfh.cred,
                                                 NULL,
                                                 &resp_create);
@@ -936 +1057 @@
 
    pfhp->ref = resp_create.ref;
-   pfhp->creds = dir_pfh.creds;
+   pfhp->cred = dir_pfh.cred;
 
    SET_FUSE_HANDLE( fi, pfhp );

trunk/src/common/security/security-util.c

@@ -222 +222 @@
     if (cap)
     {
-        free(cap->handle_array);
-        free(cap->signature);
-        free(cap->issuer);
-
+        if (cap->handle_array)
+        {
+            free(cap->handle_array);
+        }
+        if (cap->signature)
+        {
+            free(cap->signature);
+        }
+        if (cap->issuer)
+        {
+            free(cap->issuer);
+        }
+        
         cap->handle_array = NULL;
         cap->signature = NULL;
@@ -366 +375 @@
     if (cred)
     {
-        free(cred->group_array);
-        free(cred->issuer);
-        free(cred->signature);
-
+        if (cred->group_array)
+        {
+            free(cred->group_array);
+        }
+        if (cred->issuer)
+        {
+            free(cred->issuer);
+        }
+        if (cred->signature)
+        {
+            free(cred->signature);
+        }
+        
         cred->group_array = NULL;
         cred->issuer = NULL;