NFS: Ensure security label is set for root inode

[linux-2.6-microblaze.git] / fs / nfs / getroot.c

diff --git a/fs/nfs/getroot.c b/fs/nfs/getroot.c
index 878c4c5..aaeeb46 100644 (file)
--- a/fs/nfs/getroot.c
+++ b/fs/nfs/getroot.c
@@ -64,66 +64,102 @@ static int nfs_superblock_set_dummy_root(struct super_block *sb, struct inode *i
 /*
  * get an NFS2/NFS3 root dentry from the root filehandle
  */
-struct dentry *nfs_get_root(struct super_block *sb, struct nfs_fh *mntfh,
-                           const char *devname)
+int nfs_get_root(struct super_block *s, struct fs_context *fc)
 {
-       struct nfs_server *server = NFS_SB(sb);
+       struct nfs_fs_context *ctx = nfs_fc2context(fc);
+       struct nfs_server *server = NFS_SB(s);
        struct nfs_fsinfo fsinfo;
-       struct dentry *ret;
+       struct dentry *root;
        struct inode *inode;
-       void *name = kstrdup(devname, GFP_KERNEL);
-       int error;
+       char *name;
+       int error = -ENOMEM;
+       unsigned long kflags = 0, kflags_out = 0;
 
+       name = kstrdup(fc->source, GFP_KERNEL);
        if (!name)
-               return ERR_PTR(-ENOMEM);
+               goto out;
 
        /* get the actual root for this mount */
        fsinfo.fattr = nfs_alloc_fattr();
-       if (fsinfo.fattr == NULL) {
-               kfree(name);
-               return ERR_PTR(-ENOMEM);
-       }
+       if (fsinfo.fattr == NULL)
+               goto out_name;
 
-       error = server->nfs_client->rpc_ops->getroot(server, mntfh, &fsinfo);
+       fsinfo.fattr->label = nfs4_label_alloc(server, GFP_KERNEL);
+       if (IS_ERR(fsinfo.fattr->label))
+               goto out_fattr;
+       error = server->nfs_client->rpc_ops->getroot(server, ctx->mntfh, &fsinfo);
        if (error < 0) {
                dprintk("nfs_get_root: getattr error = %d\n", -error);
-               ret = ERR_PTR(error);
-               goto out;
+               nfs_errorf(fc, "NFS: Couldn't getattr on root");
+               goto out_label;
        }
 
-       inode = nfs_fhget(sb, mntfh, fsinfo.fattr, NULL);
+       inode = nfs_fhget(s, ctx->mntfh, fsinfo.fattr, NULL);
        if (IS_ERR(inode)) {
                dprintk("nfs_get_root: get root inode failed\n");
-               ret = ERR_CAST(inode);
-               goto out;
+               error = PTR_ERR(inode);
+               nfs_errorf(fc, "NFS: Couldn't get root inode");
+               goto out_label;
        }
 
-       error = nfs_superblock_set_dummy_root(sb, inode);
-       if (error != 0) {
-               ret = ERR_PTR(error);
-               goto out;
-       }
+       error = nfs_superblock_set_dummy_root(s, inode);
+       if (error != 0)
+               goto out_label;
 
        /* root dentries normally start off anonymous and get spliced in later
         * if the dentry tree reaches them; however if the dentry already
         * exists, we'll pick it up at this point and use it as the root
         */
-       ret = d_obtain_root(inode);
-       if (IS_ERR(ret)) {
+       root = d_obtain_root(inode);
+       if (IS_ERR(root)) {
                dprintk("nfs_get_root: get root dentry failed\n");
-               goto out;
+               error = PTR_ERR(root);
+               nfs_errorf(fc, "NFS: Couldn't get root dentry");
+               goto out_label;
        }
 
-       security_d_instantiate(ret, inode);
-       spin_lock(&ret->d_lock);
-       if (IS_ROOT(ret) && !ret->d_fsdata &&
-           !(ret->d_flags & DCACHE_NFSFS_RENAMED)) {
-               ret->d_fsdata = name;
+       security_d_instantiate(root, inode);
+       spin_lock(&root->d_lock);
+       if (IS_ROOT(root) && !root->d_fsdata &&
+           !(root->d_flags & DCACHE_NFSFS_RENAMED)) {
+               root->d_fsdata = name;
                name = NULL;
        }
-       spin_unlock(&ret->d_lock);
-out:
-       kfree(name);
+       spin_unlock(&root->d_lock);
+       fc->root = root;
+       if (NFS_SB(s)->caps & NFS_CAP_SECURITY_LABEL)
+               kflags |= SECURITY_LSM_NATIVE_LABELS;
+       if (ctx->clone_data.sb) {
+               if (d_inode(fc->root)->i_fop != &nfs_dir_operations) {
+                       error = -ESTALE;
+                       goto error_splat_root;
+               }
+               /* clone lsm security options from the parent to the new sb */
+               error = security_sb_clone_mnt_opts(ctx->clone_data.sb,
+                                                  s, kflags, &kflags_out);
+       } else {
+               error = security_sb_set_mnt_opts(s, fc->security,
+                                                       kflags, &kflags_out);
+       }
+       if (error)
+               goto error_splat_root;
+       if (NFS_SB(s)->caps & NFS_CAP_SECURITY_LABEL &&
+               !(kflags_out & SECURITY_LSM_NATIVE_LABELS))
+               NFS_SB(s)->caps &= ~NFS_CAP_SECURITY_LABEL;
+
+       nfs_setsecurity(inode, fsinfo.fattr, fsinfo.fattr->label);
+       error = 0;
+
+out_label:
+       nfs4_label_free(fsinfo.fattr->label);
+out_fattr:
        nfs_free_fattr(fsinfo.fattr);
-       return ret;
+out_name:
+       kfree(name);
+out:
+       return error;
+error_splat_root:
+       dput(fc->root);
+       fc->root = NULL;
+       goto out_label;
 }