From 9e661d9496125d03c668353a9c718e8812f3fe05 Mon Sep 17 00:00:00 2001 From: Poornima G Date: Mon, 26 Dec 2016 14:28:22 +0530 Subject: md-cache: Cache security.ima xattrs Backport of http://review.gluster.org/16296 From kernel version 3.X or greater, creating of a file results in removexattr call on security.ima xattr. But this xattr is not set on the file unless IMA feature is active. With this patch, removxattr call returns ENODATA if it is not found in the cache. > Change-Id: I8136096598a983aebc09901945eba1db1b2f93c9 > Signed-off-by: Poornima G > Reviewed-on: http://review.gluster.org/16296 > Smoke: Gluster Build System > NetBSD-regression: NetBSD Build System > CentOS-regression: Gluster Build System > Reviewed-by: Raghavendra G > (cherry picked from commit ac629e574935a8aed6526936bc83b1c6d295ae67) Change-Id: I27abc23024c8fcf07389608df61ef6e64736d414 BUG: 1415918 Signed-off-by: Poornima G Reviewed-on: https://review.gluster.org/16460 Smoke: Gluster Build System NetBSD-regression: NetBSD Build System CentOS-regression: Gluster Build System Reviewed-by: Raghavendra G --- xlators/performance/md-cache/src/md-cache.c | 81 ++++++++++++++++++++++++++++- 1 file changed, 79 insertions(+), 2 deletions(-) (limited to 'xlators/performance') diff --git a/xlators/performance/md-cache/src/md-cache.c b/xlators/performance/md-cache/src/md-cache.c index d70fa6a8d1a..61f4da34067 100644 --- a/xlators/performance/md-cache/src/md-cache.c +++ b/xlators/performance/md-cache/src/md-cache.c @@ -49,6 +49,8 @@ struct mdc_conf { int timeout; gf_boolean_t cache_posix_acl; gf_boolean_t cache_selinux; + gf_boolean_t cache_capability; + gf_boolean_t cache_ima; gf_boolean_t force_readdirp; gf_boolean_t cache_swift_metadata; gf_boolean_t cache_samba_metadata; @@ -114,6 +116,11 @@ static struct mdc_key { .load = 0, .check = 1, }, + { + .name = "security.ima", + .load = 0, + .check = 1, + }, { .name = NULL, .load = 0, @@ -2226,6 +2233,10 @@ mdc_removexattr (call_frame_t *frame, xlator_t *this, loc_t *loc, const char *name, dict_t *xdata) { mdc_local_t *local = NULL; + int op_errno = ENODATA; + int ret = 0; + dict_t *xattr = NULL; + struct mdc_conf *conf = this->private; local = mdc_local_get (frame); @@ -2233,6 +2244,25 @@ mdc_removexattr (call_frame_t *frame, xlator_t *this, loc_t *loc, local->key = gf_strdup (name); + if (!is_mdc_key_satisfied (name)) + goto uncached; + + ret = mdc_inode_xatt_get (this, loc->inode, &xattr); + if (ret != 0) + goto uncached; + + if (!xattr || !dict_get (xattr, (char *)name)) { + ret = -1; + op_errno = ENODATA; + } + + INCREMENT_ATOMIC (conf->mdc_counter.lock, conf->mdc_counter.xattr_hit); + MDC_STACK_UNWIND (removexattr, frame, ret, op_errno, xdata); + + return 0; + +uncached: + INCREMENT_ATOMIC (conf->mdc_counter.lock, conf->mdc_counter.xattr_miss); STACK_WIND (frame, mdc_removexattr_cbk, FIRST_CHILD(this), FIRST_CHILD(this)->fops->removexattr, loc, name, xdata); @@ -2272,6 +2302,10 @@ mdc_fremovexattr (call_frame_t *frame, xlator_t *this, fd_t *fd, const char *name, dict_t *xdata) { mdc_local_t *local = NULL; + int op_errno = ENODATA; + int ret = 0; + dict_t *xattr = NULL; + struct mdc_conf *conf = this->private; local = mdc_local_get (frame); @@ -2279,6 +2313,24 @@ mdc_fremovexattr (call_frame_t *frame, xlator_t *this, fd_t *fd, local->key = gf_strdup (name); + if (!is_mdc_key_satisfied (name)) + goto uncached; + + ret = mdc_inode_xatt_get (this, fd->inode, &xattr); + if (ret != 0) + goto uncached; + + if (!xattr || !dict_get (xattr, (char *)name)) { + ret = -1; + op_errno = ENODATA; + } + + INCREMENT_ATOMIC (conf->mdc_counter.lock, conf->mdc_counter.xattr_hit); + MDC_STACK_UNWIND (fremovexattr, frame, ret, op_errno, xdata); + return 0; + +uncached: + INCREMENT_ATOMIC (conf->mdc_counter.lock, conf->mdc_counter.xattr_miss); STACK_WIND (frame, mdc_fremovexattr_cbk, FIRST_CHILD(this), FIRST_CHILD(this)->fops->fremovexattr, fd, name, xdata); @@ -2829,7 +2881,16 @@ reconfigure (xlator_t *this, dict_t *options) GF_OPTION_RECONF ("md-cache-timeout", timeout, options, int32, out); GF_OPTION_RECONF ("cache-selinux", conf->cache_selinux, options, bool, out); - mdc_key_load_set (mdc_keys, "security.", conf->cache_selinux); + mdc_key_load_set (mdc_keys, "security.selinux", conf->cache_selinux); + + GF_OPTION_RECONF ("cache-capability-xattrs", conf->cache_capability, + options, bool, out); + mdc_key_load_set (mdc_keys, "security.capability", + conf->cache_capability); + + GF_OPTION_RECONF ("cache-ima-xattrs", conf->cache_ima, options, bool, + out); + mdc_key_load_set (mdc_keys, "security.ima", conf->cache_ima); GF_OPTION_RECONF ("cache-posix-acl", conf->cache_posix_acl, options, bool, out); mdc_key_load_set (mdc_keys, "system.posix_acl_", conf->cache_posix_acl); @@ -2892,7 +2953,15 @@ init (xlator_t *this) GF_OPTION_INIT ("md-cache-timeout", timeout, int32, out); GF_OPTION_INIT ("cache-selinux", conf->cache_selinux, bool, out); - mdc_key_load_set (mdc_keys, "security.", conf->cache_selinux); + mdc_key_load_set (mdc_keys, "security.selinux", conf->cache_selinux); + + GF_OPTION_INIT ("cache-capability-xattrs", conf->cache_capability, + bool, out); + mdc_key_load_set (mdc_keys, "security.capability", + conf->cache_capability); + + GF_OPTION_INIT ("cache-ima-xattrs", conf->cache_ima, bool, out); + mdc_key_load_set (mdc_keys, "security.ima", conf->cache_ima); GF_OPTION_INIT ("cache-posix-acl", conf->cache_posix_acl, bool, out); mdc_key_load_set (mdc_keys, "system.posix_acl_", conf->cache_posix_acl); @@ -3039,6 +3108,14 @@ struct volume_options options[] = { .type = GF_OPTION_TYPE_BOOL, .default_value = "false", }, + { .key = {"cache-capability-xattrs"}, + .type = GF_OPTION_TYPE_BOOL, + .default_value = "true", + }, + { .key = {"cache-ima-xattrs"}, + .type = GF_OPTION_TYPE_BOOL, + .default_value = "true", + }, { .key = {"cache-swift-metadata"}, .type = GF_OPTION_TYPE_BOOL, .default_value = "true", -- cgit