priv: Introduce and use PRIV_VFS_SETATTR in xxx_setattr()

Replace PRIV_ROOT, PRISON_ROOT combination in xxx_setattr() function
(e.g. ext2fs_setattr()) of several filesystems with PRIV_VFS_SETATTR.

diff --git a/sys/kern/kern_jail.c b/sys/kern/kern_jail.c
index 203a430..c3a921c 100644 (file)
--- a/sys/kern/kern_jail.c
+++ b/sys/kern/kern_jail.c
@@ -690,6 +690,7 @@ prison_priv_check(struct ucred *cred, int priv)
        case PRIV_VFS_MKNOD_BAD:
        case PRIV_VFS_MKNOD_WHT:
        case PRIV_VFS_MKNOD_DIR:
+       case PRIV_VFS_SETATTR:
 
        case PRIV_PROC_SETRLIMIT:
        case PRIV_PROC_SETLOGIN:

diff --git a/sys/sys/priv.h b/sys/sys/priv.h
index 6241ac4..382c730 100644 (file)
--- a/sys/sys/priv.h
+++ b/sys/sys/priv.h
@@ -285,6 +285,7 @@
                                        /* directories for HAMMER. */
 #define        PRIV_VFS_CHMOD          346     /* Can chmod() if not owner */
 #define        PRIV_VFS_REVOKE         347     /* Can revoke() if not owner */
+#define        PRIV_VFS_SETATTR        348     /* Can xxx_setattr() if not owner */
 
 /*
  * Virtual memory privileges.

diff --git a/sys/vfs/gnu/ext2fs/ext2_vnops.c b/sys/vfs/gnu/ext2fs/ext2_vnops.c
index 5198a72..a11f8f6 100644 (file)
--- a/sys/vfs/gnu/ext2fs/ext2_vnops.c
+++ b/sys/vfs/gnu/ext2fs/ext2_vnops.c
@@ -1480,7 +1480,7 @@ ext2_setattr(struct vop_setattr_args *ap)
                if (vp->v_mount->mnt_flag & MNT_RDONLY)
                        return (EROFS);
                if (cred->cr_uid != ip->i_uid &&
-                   (error = priv_check_cred(cred, PRIV_ROOT, PRISON_ROOT)))
+                   (error = priv_check_cred(cred, PRIV_VFS_SETATTR, 0)))
                        return (error);
                /*
                 * Note that a root chflags becomes a user chflags when
@@ -1542,7 +1542,7 @@ ext2_setattr(struct vop_setattr_args *ap)
                if (vp->v_mount->mnt_flag & MNT_RDONLY)
                        return (EROFS);
                if (cred->cr_uid != ip->i_uid &&
-                   (error = priv_check_cred(cred, PRIV_ROOT, PRISON_ROOT)) &&
+                   (error = priv_check_cred(cred, PRIV_VFS_SETATTR, 0)) &&
                    ((vap->va_vaflags & VA_UTIMES_NULL) == 0 ||
                    (error = VOP_ACCESS(vp, VWRITE, cred))))
                        return (error);

diff --git a/sys/vfs/hpfs/hpfs_vnops.c b/sys/vfs/hpfs/hpfs_vnops.c
index 08469b6..3c60bd8 100644 (file)
--- a/sys/vfs/hpfs/hpfs_vnops.c
+++ b/sys/vfs/hpfs/hpfs_vnops.c
@@ -525,7 +525,7 @@ hpfs_setattr(struct vop_setattr_args *ap)
                if (vp->v_mount->mnt_flag & MNT_RDONLY)
                        return (EROFS);
                if (cred->cr_uid != hp->h_uid &&
-                   (error = priv_check_cred(cred, PRIV_ROOT, PRISON_ROOT)) &&
+                   (error = priv_check_cred(cred, PRIV_VFS_SETATTR, 0)) &&
                    ((vap->va_vaflags & VA_UTIMES_NULL) == 0 ||
                    (error = VOP_ACCESS(vp, VWRITE, cred))))
                        return (error);

diff --git a/sys/vfs/msdosfs/msdosfs_vnops.c b/sys/vfs/msdosfs/msdosfs_vnops.c
index 0a2052b..131b2b2 100644 (file)
--- a/sys/vfs/msdosfs/msdosfs_vnops.c
+++ b/sys/vfs/msdosfs/msdosfs_vnops.c
@@ -416,7 +416,7 @@ msdosfs_setattr(struct vop_setattr_args *ap)
                if (vp->v_mount->mnt_flag & MNT_RDONLY)
                        return (EROFS);
                if (cred->cr_uid != pmp->pm_uid &&
-                   (error = priv_check_cred(cred, PRIV_ROOT, PRISON_ROOT)))
+                   (error = priv_check_cred(cred, PRIV_VFS_SETATTR, 0)))
                        return (error);
                /*
                 * We are very inconsistent about handling unsupported
@@ -457,7 +457,7 @@ msdosfs_setattr(struct vop_setattr_args *ap)
                        gid = pmp->pm_gid;
                if ((cred->cr_uid != pmp->pm_uid || uid != pmp->pm_uid ||
                    (gid != pmp->pm_gid && !groupmember(gid, cred))) &&
-                   (error = priv_check_cred(cred, PRIV_ROOT, PRISON_ROOT)))
+                   (error = priv_check_cred(cred, PRIV_VFS_SETATTR, 0)))
                        return error;
                if (uid != pmp->pm_uid || gid != pmp->pm_gid)
                        return EINVAL;
@@ -489,7 +489,7 @@ msdosfs_setattr(struct vop_setattr_args *ap)
                if (vp->v_mount->mnt_flag & MNT_RDONLY)
                        return (EROFS);
                if (cred->cr_uid != pmp->pm_uid &&
-                   (error = priv_check_cred(cred, PRIV_ROOT, PRISON_ROOT)) &&
+                   (error = priv_check_cred(cred, PRIV_VFS_SETATTR, 0)) &&
                    ((vap->va_vaflags & VA_UTIMES_NULL) == 0 ||
                    (error = VOP_ACCESS(ap->a_vp, VWRITE, cred))))
                        return (error);
@@ -518,7 +518,7 @@ msdosfs_setattr(struct vop_setattr_args *ap)
                if (vp->v_mount->mnt_flag & MNT_RDONLY)
                        return (EROFS);
                if (cred->cr_uid != pmp->pm_uid &&
-                   (error = priv_check_cred(cred, PRIV_ROOT, PRISON_ROOT)))
+                   (error = priv_check_cred(cred, PRIV_VFS_SETATTR, 0)))
                        return (error);
                if (vp->v_type != VDIR) {
                        /* We ignore the read and execute bits. */

diff --git a/sys/vfs/smbfs/smbfs_vnops.c b/sys/vfs/smbfs/smbfs_vnops.c
index e3a5068..df54519 100644 (file)
--- a/sys/vfs/smbfs/smbfs_vnops.c
+++ b/sys/vfs/smbfs/smbfs_vnops.c
@@ -366,7 +366,7 @@ smbfs_setattr(struct vop_setattr_args *ap)
                atime = &vap->va_atime;
        if (mtime != atime) {
                if (ap->a_cred->cr_uid != VTOSMBFS(vp)->sm_args.uid &&
-                   (error = priv_check_cred(ap->a_cred, PRIV_ROOT, PRISON_ROOT)) &&
+                   (error = priv_check_cred(ap->a_cred, PRIV_VFS_SETATTR, 0)) &&
                    ((vap->va_vaflags & VA_UTIMES_NULL) == 0 ||
                    (error = VOP_ACCESS(vp, VWRITE, ap->a_cred))))
                        return (error);

diff --git a/sys/vfs/ufs/ufs_vnops.c b/sys/vfs/ufs/ufs_vnops.c
index 09423fd..6f67abd 100644 (file)
--- a/sys/vfs/ufs/ufs_vnops.c
+++ b/sys/vfs/ufs/ufs_vnops.c
@@ -466,7 +466,7 @@ ufs_setattr(struct vop_setattr_args *ap)
                if (vp->v_mount->mnt_flag & MNT_RDONLY)
                        return (EROFS);
                if (cred->cr_uid != ip->i_uid &&
-                   (error = priv_check_cred(cred, PRIV_ROOT, PRISON_ROOT)))
+                   (error = priv_check_cred(cred, PRIV_VFS_SETATTR, 0)))
                        return (error);
                /*
                 * Note that a root chflags becomes a user chflags when
@@ -528,7 +528,7 @@ ufs_setattr(struct vop_setattr_args *ap)
                if (vp->v_mount->mnt_flag & MNT_RDONLY)
                        return (EROFS);
                if (cred->cr_uid != ip->i_uid &&
-                   (error = priv_check_cred(cred, PRIV_ROOT, PRISON_ROOT)) &&
+                   (error = priv_check_cred(cred, PRIV_VFS_SETATTR, 0)) &&
                    ((vap->va_vaflags & VA_UTIMES_NULL) == 0 ||
                    (error = VOP_ACCESS(vp, VWRITE, cred))))
                        return (error);