Skip to content

Commit 6749f74

Browse files
amarcionekamarcionek
committed
Added Subject to access method
Access method should check against the caller's RPC credentials. Addresses #71. Signed-off-by: Adam Marcionek <[email protected]>
1 parent 805c7b4 commit 6749f74

File tree

5 files changed

+43
-130
lines changed

5 files changed

+43
-130
lines changed

‎core/src/main/java/org/dcache/nfs/v3/NfsServerV3.java‎

Lines changed: 22 additions & 127 deletions
Original file line numberDiff line numberDiff line change
@@ -19,141 +19,36 @@
1919
*/
2020
package org.dcache.nfs.v3;
2121

22+
import static org.dcache.nfs.v3.HimeraNfsUtils.defaultPostOpAttr;
23+
import static org.dcache.nfs.v3.HimeraNfsUtils.defaultWccData;
24+
import static org.dcache.nfs.v3.NameUtils.checkFilename;
25+
26+
import java.util.Iterator;
27+
28+
import javax.security.auth.Subject;
29+
2230
import org.dcache.auth.Subjects;
31+
import org.dcache.nfs.ChimeraNFSException;
2332
import org.dcache.nfs.ExportFile;
2433
import org.dcache.nfs.nfsstat;
25-
import org.dcache.nfs.ChimeraNFSException;
26-
import org.dcache.nfs.v3.xdr.LOOKUP3res;
27-
import org.dcache.nfs.v3.xdr.WRITE3resfail;
28-
import org.dcache.nfs.v3.xdr.RMDIR3resok;
29-
import org.dcache.nfs.v3.xdr.SYMLINK3resfail;
30-
import org.dcache.nfs.v3.xdr.post_op_fh3;
31-
import org.dcache.nfs.v3.xdr.READLINK3args;
32-
import org.dcache.nfs.v3.xdr.uint64;
33-
import org.dcache.nfs.v3.xdr.MKDIR3res;
34-
import org.dcache.nfs.v3.xdr.WRITE3args;
35-
import org.dcache.nfs.v3.xdr.createmode3;
36-
import org.dcache.nfs.v3.xdr.post_op_attr;
37-
import org.dcache.nfs.v3.xdr.LINK3resfail;
38-
import org.dcache.nfs.v3.xdr.READ3resfail;
39-
import org.dcache.nfs.v3.xdr.MKDIR3resok;
40-
import org.dcache.nfs.v3.xdr.READDIR3args;
41-
import org.dcache.nfs.v3.xdr.LOOKUP3resfail;
42-
import org.dcache.nfs.v3.xdr.dirlistplus3;
43-
import org.dcache.nfs.v3.xdr.SYMLINK3resok;
44-
import org.dcache.nfs.v3.xdr.READDIR3resok;
45-
import org.dcache.nfs.v3.xdr.entry3;
46-
import org.dcache.nfs.v3.xdr.READ3args;
47-
import org.dcache.nfs.v3.xdr.LOOKUP3args;
48-
import org.dcache.nfs.v3.xdr.PATHCONF3res;
49-
import org.dcache.nfs.v3.xdr.LINK3args;
50-
import org.dcache.nfs.v3.xdr.REMOVE3res;
51-
import org.dcache.nfs.v3.xdr.READ3resok;
52-
import org.dcache.nfs.v3.xdr.sattr3;
53-
import org.dcache.nfs.v3.xdr.count3;
54-
import org.dcache.nfs.v3.xdr.MKNOD3args;
55-
import org.dcache.nfs.v3.xdr.READ3res;
56-
import org.dcache.nfs.v3.xdr.READLINK3resok;
57-
import org.dcache.nfs.v3.xdr.cookie3;
58-
import org.dcache.nfs.v3.xdr.LOOKUP3resok;
59-
import org.dcache.nfs.v3.xdr.READDIR3resfail;
60-
import org.dcache.nfs.v3.xdr.RMDIR3res;
61-
import org.dcache.nfs.v3.xdr.RMDIR3resfail;
62-
import org.dcache.nfs.v3.xdr.WRITE3resok;
63-
import org.dcache.nfs.v3.xdr.REMOVE3resfail;
64-
import org.dcache.nfs.v3.xdr.WRITE3res;
65-
import org.dcache.nfs.v3.xdr.wcc_data;
66-
import org.dcache.nfs.v3.xdr.nfs3_prot;
67-
import org.dcache.nfs.v3.xdr.MKDIR3resfail;
68-
import org.dcache.nfs.v3.xdr.RENAME3resok;
69-
import org.dcache.nfs.v3.xdr.dirlist3;
70-
import org.dcache.nfs.v3.xdr.READDIRPLUS3args;
71-
import org.dcache.nfs.v3.xdr.MKDIR3args;
72-
import org.dcache.nfs.v3.xdr.fattr3;
73-
import org.dcache.nfs.v3.xdr.MKNOD3res;
74-
import org.dcache.nfs.v3.xdr.fileid3;
75-
import org.dcache.nfs.v3.xdr.SETATTR3resfail;
76-
import org.dcache.nfs.v3.xdr.uint32;
77-
import org.dcache.nfs.v3.xdr.entryplus3;
78-
import org.dcache.nfs.v3.xdr.pre_op_attr;
79-
import org.dcache.nfs.v3.xdr.SETATTR3args;
80-
import org.dcache.nfs.v3.xdr.SYMLINK3res;
81-
import org.dcache.nfs.v3.xdr.PATHCONF3args;
82-
import org.dcache.nfs.v3.xdr.writeverf3;
83-
import org.dcache.nfs.v3.xdr.RENAME3args;
84-
import org.dcache.nfs.v3.xdr.SYMLINK3args;
85-
import org.dcache.nfs.v3.xdr.READDIRPLUS3resfail;
86-
import org.dcache.nfs.v3.xdr.nfs_fh3;
87-
import org.dcache.nfs.v3.xdr.REMOVE3resok;
88-
import org.dcache.nfs.v3.xdr.READLINK3res;
89-
import org.dcache.nfs.v3.xdr.RENAME3res;
90-
import org.dcache.nfs.v3.xdr.RMDIR3args;
91-
import org.dcache.nfs.v3.xdr.READDIRPLUS3resok;
92-
import org.dcache.nfs.v3.xdr.cookieverf3;
93-
import org.dcache.nfs.v3.xdr.nfs3_protServerStub;
94-
import org.dcache.nfs.v3.xdr.READDIRPLUS3res;
95-
import org.dcache.nfs.v3.xdr.nfstime3;
96-
import org.dcache.nfs.v3.xdr.LINK3resok;
97-
import org.dcache.nfs.v3.xdr.size3;
98-
import org.dcache.nfs.v3.xdr.REMOVE3args;
99-
import org.dcache.nfs.v3.xdr.wcc_attr;
100-
import org.dcache.nfs.v3.xdr.SETATTR3res;
101-
import org.dcache.nfs.v3.xdr.LINK3res;
102-
import org.dcache.nfs.v3.xdr.SETATTR3resok;
103-
import org.dcache.nfs.v3.xdr.READDIR3res;
104-
import org.dcache.nfs.v3.xdr.PATHCONF3resok;
105-
import org.dcache.nfs.v3.xdr.nfspath3;
106-
import org.dcache.nfs.v3.xdr.filename3;
107-
import org.dcache.nfs.v3.xdr.FSINFO3res;
108-
import org.dcache.nfs.v3.xdr.GETATTR3resok;
109-
import org.dcache.nfs.v3.xdr.CREATE3args;
110-
import org.dcache.nfs.v3.xdr.CREATE3resok;
111-
import org.dcache.nfs.v3.xdr.FSSTAT3args;
112-
import org.dcache.nfs.v3.xdr.FSSTAT3resok;
113-
import org.dcache.nfs.v3.xdr.FSINFO3args;
114-
import org.dcache.nfs.v3.xdr.CREATE3res;
115-
import org.dcache.nfs.v3.xdr.GETATTR3args;
116-
import org.dcache.nfs.v3.xdr.ACCESS3resfail;
117-
import org.dcache.nfs.v3.xdr.GETATTR3res;
118-
import org.dcache.nfs.v3.xdr.COMMIT3res;
119-
import org.dcache.nfs.v3.xdr.FSINFO3resok;
120-
import org.dcache.nfs.v3.xdr.ACCESS3resok;
121-
import org.dcache.nfs.v3.xdr.FSSTAT3res;
122-
import org.dcache.nfs.v3.xdr.COMMIT3args;
123-
import org.dcache.nfs.v3.xdr.ACCESS3args;
124-
import org.dcache.nfs.v3.xdr.CREATE3resfail;
125-
import org.dcache.nfs.v3.xdr.FSINFO3resfail;
126-
import org.dcache.nfs.v3.xdr.ACCESS3res;
127-
import org.dcache.nfs.v3.xdr.COMMIT3resok;
128-
import java.io.IOException;
129-
import java.util.Iterator;
130-
131-
import org.dcache.nfs.v3.xdr.COMMIT3resfail;
132-
import org.dcache.nfs.v3.xdr.FSSTAT3resfail;
133-
import org.dcache.nfs.v3.xdr.MKNOD3resfail;
134-
import org.dcache.nfs.v3.xdr.READLINK3resfail;
135-
import org.dcache.nfs.v3.xdr.RENAME3resfail;
34+
import org.dcache.nfs.status.ExistException;
35+
import org.dcache.nfs.status.NfsIoException;
36+
import org.dcache.nfs.status.NoEntException;
37+
import org.dcache.nfs.status.NotDirException;
38+
import org.dcache.nfs.status.TooSmallException;
39+
import org.dcache.nfs.v3.xdr.*;
13640
import org.dcache.nfs.vfs.DirectoryEntry;
137-
import org.dcache.nfs.vfs.VirtualFileSystem;
41+
import org.dcache.nfs.vfs.DirectoryStream;
42+
import org.dcache.nfs.vfs.FsStat;
43+
import org.dcache.nfs.vfs.Inode;
44+
import org.dcache.nfs.vfs.PseudoFs;
13845
import org.dcache.nfs.vfs.Stat;
139-
import org.dcache.nfs.status.*;
140-
import org.dcache.oncrpc4j.util.Bytes;
141-
import org.dcache.oncrpc4j.rpc.OncRpcException;
46+
import org.dcache.nfs.vfs.VirtualFileSystem;
14247
import org.dcache.oncrpc4j.rpc.RpcCall;
48+
import org.dcache.oncrpc4j.util.Bytes;
14349
import org.slf4j.Logger;
14450
import org.slf4j.LoggerFactory;
14551

146-
import static org.dcache.nfs.v3.HimeraNfsUtils.defaultPostOpAttr;
147-
import static org.dcache.nfs.v3.HimeraNfsUtils.defaultWccData;
148-
import static org.dcache.nfs.v3.NameUtils.checkFilename;
149-
150-
import org.dcache.nfs.vfs.FsStat;
151-
import org.dcache.nfs.vfs.Inode;
152-
import org.dcache.nfs.vfs.PseudoFs;
153-
import org.dcache.nfs.vfs.DirectoryStream;
154-
155-
import javax.security.auth.Subject;
156-
15752
public class NfsServerV3 extends nfs3_protServerStub {
15853

15954
// needed to calculate replay size for READDIR3 and READDIRPLUS3
@@ -201,7 +96,7 @@ public ACCESS3res NFSPROC3_ACCESS_3(RpcCall call$, ACCESS3args arg1) {
20196

20297
HimeraNfsUtils.fill_attributes(objStat, res.resok.obj_attributes.attributes);
20398

204-
int realAccess = fs.access(inode, arg1.access.value);
99+
int realAccess = fs.access(inode, arg1.access.value, call$.getCredential().getSubject());
205100

206101
res.resok.access = new uint32(realAccess);
207102
} catch (ChimeraNFSException hne) {

‎core/src/main/java/org/dcache/nfs/v4/OperationACCESS.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,7 +46,7 @@ public void process(CompoundContext context, nfs_resop4 result)
4646
final ACCESS4res res = result.opaccess;
4747
int requestedAccess = _args.opaccess.access.value;
4848

49-
int realAccess = context.getFs().access(context.currentInode(), requestedAccess);
49+
int realAccess = context.getFs().access(context.currentInode(), requestedAccess, context.getSubject());
5050

5151
_log.debug("NFS Request ACCESS uid: {} {} {}",
5252
context.getSubject(), requestedAccess, realAccess );

‎core/src/main/java/org/dcache/nfs/v4/OperationOPEN.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -183,7 +183,7 @@ public void process(CompoundContext context, nfs_resop4 result) throws ChimeraNF
183183
Integer.toOctalString(fileStat.getMode() & 0777));
184184
}
185185

186-
if (context.getFs().access(inode, nfs4_prot.ACCESS4_MODIFY) == 0) {
186+
if (context.getFs().access(inode, nfs4_prot.ACCESS4_MODIFY, context.getSubject()) == 0) {
187187
throw new AccessException();
188188
}
189189

@@ -296,7 +296,7 @@ private void checkCanAccess(CompoundContext context, Inode inode, uint32_t share
296296
throw new InvalException("Invalid share_access mode: " + share_access.value);
297297
}
298298

299-
if (context.getFs().access(inode, accessMode) != accessMode) {
299+
if (context.getFs().access(inode, accessMode, context.getSubject()) != accessMode) {
300300
throw new AccessException();
301301
}
302302

‎core/src/main/java/org/dcache/nfs/vfs/ForwardingFileSystem.java‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -45,6 +45,11 @@ public int access(Inode inode, int mode) throws IOException {
4545
return delegate().access(inode, mode);
4646
}
4747

48+
@Override
49+
public int access(Inode inode, int mode, Subject subject) throws IOException {
50+
return delegate().access(inode, mode, subject);
51+
}
52+
4853
@Override
4954
public Inode create(Inode parent, Stat.Type type, String path, Subject subject, int mode) throws IOException {
5055
return delegate().create(parent, type, path, subject, mode);

‎core/src/main/java/org/dcache/nfs/vfs/VirtualFileSystem.java‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -52,9 +52,22 @@ public interface VirtualFileSystem {
5252
* @param mode a mask of permission bits to check.
5353
* @return an allowed subset of permissions from the given mask.
5454
* @throws IOException
55+
* @deprecated Replaced by {@link #access(Inode, int, Subject)}
5556
*/
57+
@Deprecated
5658
int access(Inode inode, int mode) throws IOException;
5759

60+
/**
61+
* Check access to file system object.
62+
*
63+
* @param inode inode of the object to check.
64+
* @param mode a mask of permission bits to check.
65+
* @param subject the user subject making the request.
66+
* @return an allowed subset of permissions from the given mask.
67+
* @throws IOException
68+
*/
69+
int access(Inode inode, int mode, Subject subject) throws IOException;
70+
5871
/**
5972
* Create a new object in a given directory with a specific name.
6073
*

0 commit comments

Comments
 (0)