thebestvibedev/tromcho.net
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Allow to enforce permissions at the server side

Browse Source
This commit is contained in:
Vitaliy Filippov
2025-08-24 16:20:19 +03:00
parent fb1c3e00f4
commit fbf14fb0cb
16 changed files with 225 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/nfs/nfs_kv_read.cpp
+14 -2
View File
@@ -66,6 +66,12 @@ resume_1:
cb(st->res < 0 ? st->res : -EINVAL);
return;
}
if (st->self->parent->enforce_perms && !kv_is_accessible(st->rop->auth_sys, st->ientry, ACCESS3_READ))
{
auto cb = std::move(st->cb);
cb(-EACCES);
return;
}
if (st->ientry["shared_ino"].uint64_value() != 0)
{
if (st->offset >= st->ientry["size"].uint64_value())
@@ -142,9 +148,9 @@ resume_2:
return;
}
}
else if (st->self->rdma_conn)
else if (st->self->rdma_conn || st->self->parent->enforce_perms)
{
// Take ientry from read_hack_cache for RDMA connections
// Take ientry from read_hack_cache for RDMA connections or for the permission check
{
auto rh_it = st->self->parent->kvfs->read_hack_cache.find(st->ino);
if (rh_it != st->self->parent->kvfs->read_hack_cache.end())
@@ -170,6 +176,12 @@ resume_4:
}
st->self->parent->kvfs->read_hack_cache[st->ino] = st->ientry;
}
if (st->self->parent->enforce_perms && !kv_is_accessible(st->rop->auth_sys, st->ientry, ACCESS3_READ))
{
auto cb = std::move(st->cb);
cb(-EACCES);
return;
}
}
st->aligned_offset = align_down(st->offset);
st->aligned_size = align_up(st->offset+st->size) - st->aligned_offset;