Commit e901c7fc authored by Scott Mayhew's avatar Scott Mayhew Committed by Chuck Lever
Browse files

NFSD: Fix permission check for read access to executable-only files 



Commit abc02e56 ("NFSD: Support write delegations in LAYOUTGET")
added NFSD_MAY_OWNER_OVERRIDE to the access flags passed from
nfsd4_layoutget() to fh_verify().  This causes LAYOUTGET to fail for
executable-only files, and causes xfstests generic/126 to fail on
pNFS SCSI.

To allow read access to executable-only files, what we really want is:
1. The "permissions" portion of the access flags (the lower 6 bits)
   must be exactly NFSD_MAY_READ
2. The "hints" portion of the access flags (the upper 26 bits) can
   contain any combination of NFSD_MAY_OWNER_OVERRIDE and
   NFSD_MAY_READ_IF_EXEC

Fixes: abc02e56 ("NFSD: Support write delegations in LAYOUTGET")
Cc: stable@vger.kernel.org # v6.6+
Signed-off-by: default avatarScott Mayhew <smayhew@redhat.com>
Reviewed-by: default avatarJeff Layton <jlayton@kernel.org>
Reviewed-by: default avatarNeilBrown <neil@brown.name>
Signed-off-by: default avatarChuck Lever <chuck.lever@oracle.com>
parent c6c209ce

fs/nfsd/vfs.c

+2 −2
Original line number Diff line number Diff line
@@ -2906,8 +2906,8 @@ nfsd_permission(struct svc_cred *cred, struct svc_export *exp, 


	/* Allow read access to binaries even when mode 111 */

	if (err == -EACCES && S_ISREG(inode->i_mode) &&

	     (acc == (NFSD_MAY_READ | NFSD_MAY_OWNER_OVERRIDE) ||

	      acc == (NFSD_MAY_READ | NFSD_MAY_READ_IF_EXEC)))

	     (((acc & NFSD_MAY_MASK) == NFSD_MAY_READ) &&

	      (acc & (NFSD_MAY_OWNER_OVERRIDE | NFSD_MAY_READ_IF_EXEC))))

		err = inode_permission(&nop_mnt_idmap, inode, MAY_EXEC);



	return err? nfserrno(err) : 0;