Permission to create an object (create, mkdir, symlink, mknod) needs to take supplementary groups into account. Add a supplementary group request extension. This can contain an arbitrary number of group IDs and can be added to any request. This extension is not added to any request by default. Add FUSE_CREATE_SUPP_GROUP init flag to enable supplementary group info in creation requests. This adds just a single supplementary group that matches the parent group in the case described above. In other cases the extension is not added.
Showing the changes to include/uapi (1 of 4 files). Show all
Unified · Split
| @@ -204,6 +204,8 @@ · 203 unmodified lines | |||
| 204 | * - add total_extlen to fuse_in_header | 204 | * - add total_extlen to fuse_in_header |
| 205 | * - add FUSE_MAX_NR_SECCTX | 205 | * - add FUSE_MAX_NR_SECCTX |
| 206 | * - add extension header | 206 | * - add extension header |
| 207 | * - add FUSE_EXT_GROUPS | ||
| 208 | * - add FUSE_CREATE_SUPP_GROUP | ||
| 207 | */ | 209 | */ |
| 208 | 210 | ||
| 209 | #ifndef _LINUX_FUSE_H | 211 | #ifndef _LINUX_FUSE_H |
| @@ -365,6 +367,8 @@ struct fuse_file_lock { · 155 unmodified lines | |||
| 365 | * FUSE_SECURITY_CTX: add security context to create, mkdir, symlink, and | 367 | * FUSE_SECURITY_CTX: add security context to create, mkdir, symlink, and |
| 366 | * mknod | 368 | * mknod |
| 367 | * FUSE_HAS_INODE_DAX: use per inode DAX | 369 | * FUSE_HAS_INODE_DAX: use per inode DAX |
| 370 | * FUSE_CREATE_SUPP_GROUP: add supplementary group info to create, mkdir, | ||
| 371 | * symlink and mknod (single group that matches parent) | ||
| 368 | */ | 372 | */ |
| 369 | #define FUSE_ASYNC_READ (1 << 0) | 373 | #define FUSE_ASYNC_READ (1 << 0) |
| 370 | #define FUSE_POSIX_LOCKS (1 << 1) | 374 | #define FUSE_POSIX_LOCKS (1 << 1) |
| @@ -401,6 +405,7 @@ struct fuse_file_lock { · 30 unmodified lines | |||
| 401 | /* bits 32..63 get shifted down 32 bits into the flags2 field */ | 405 | /* bits 32..63 get shifted down 32 bits into the flags2 field */ |
| 402 | #define FUSE_SECURITY_CTX (1ULL << 32) | 406 | #define FUSE_SECURITY_CTX (1ULL << 32) |
| 403 | #define FUSE_HAS_INODE_DAX (1ULL << 33) | 407 | #define FUSE_HAS_INODE_DAX (1ULL << 33) |
| 408 | #define FUSE_CREATE_SUPP_GROUP (1ULL << 34) | ||
| 404 | 409 | ||
| 405 | /** | 410 | /** |
| 406 | * CUSE INIT request/reply flags | 411 | * CUSE INIT request/reply flags |
| @@ -509,10 +514,12 @@ struct fuse_file_lock { · 102 unmodified lines | |||
| 509 | /** | 514 | /** |
| 510 | * extension type | 515 | * extension type |
| 511 | * FUSE_MAX_NR_SECCTX: maximum value of &fuse_secctx_header.nr_secctx | 516 | * FUSE_MAX_NR_SECCTX: maximum value of &fuse_secctx_header.nr_secctx |
| 517 | * FUSE_EXT_GROUPS: &fuse_supp_groups extension | ||
| 512 | */ | 518 | */ |
| 513 | enum fuse_ext_type { | 519 | enum fuse_ext_type { |
| 514 | /* Types 0..31 are reserved for fuse_secctx_header */ | 520 | /* Types 0..31 are reserved for fuse_secctx_header */ |
| 515 | FUSE_MAX_NR_SECCTX = 31, | 521 | FUSE_MAX_NR_SECCTX = 31, |
| 522 | FUSE_EXT_GROUPS = 32, | ||
| 516 | }; | 523 | }; |
| 517 | 524 | ||
| 518 | enum fuse_opcode { | 525 | enum fuse_opcode { |
| @@ -1073,4 +1080,14 @@ struct fuse_ext_header { · 554 unmodified lines | |||
| 1073 | uint32_t type; | 1080 | uint32_t type; |
| 1074 | }; | 1081 | }; |
| 1075 | 1082 | ||
| 1083 | /** | ||
| 1084 | * struct fuse_supp_groups - Supplementary group extension | ||
| 1085 | * @nr_groups: number of supplementary groups | ||
| 1086 | * @groups: flexible array of group IDs | ||
| 1087 | */ | ||
| 1088 | struct fuse_supp_groups { | ||
| 1089 | uint32_t nr_groups; | ||
| 1090 | uint32_t groups[]; | ||
| 1091 | }; | ||
| 1092 | |||
| 1076 | #endif /* _LINUX_FUSE_H */ | 1093 | #endif /* _LINUX_FUSE_H */ |