source: branches/fc11-dev/server/common/patches/openafs-scripts.patch @ 2505

src/afs/afs_analyze.c

@@ -585 +585 @@
                          (afid ? afid->Fid.Volume : 0));
         }
 
-        if (areq->busyCount > 100) {
+        if (1) {
             if (aerrP)
                 (aerrP->err_Volume)++;
             areq->volumeError = VOLBUSY;

src/afs/LINUX/osi_vnodeops.c

@@ -875 +875 @@
         /* should we always update the attributes at this point? */
         /* unlikely--the vcache entry hasn't changed */
 
+        /* [scripts] This code makes hardlinks work correctly.
+         *
+         * We want Apache to be able to read a file with hardlinks
+         * named .htaccess and foo to be able to read it via .htaccess
+         * and not via foo, regardless of which name was looked up
+         * (remember, inodes do not have filenames associated with them.)
+         *
+         * It is important that we modify the existing cache entry even
+         * if it is otherwise totally valid and would not be reloaded.
+         * Otherwise, it won't recover from repeatedly reading the same
+         * inode via multiple hardlinks or different names.  Specifically,
+         * Apache will be able to read both names if it was first looked
+         * up (by anyone!) via .htaccess, and neither if it was first
+         * looked up via foo.
+         *
+         * With regards to performance, the strncmp() is bounded by
+         * three characters, so it takes O(3) operations.  If this code
+         * is extended to all static-cat extensions, we'll want to do
+         * some clever hashing using gperf here.
+         */
+        vcp->apache_access = strncmp(dp->d_name.name, ".ht", 3) == 0;
+
     } else {
 #ifdef notyet
         pvcp = VTOAFS(dp->d_parent->d_inode);           /* dget_parent()? */

src/afs/VNOPS/afs_vnop_lookup.c

@@ -1572 +1572 @@
     }
 
   done:
+    if (tvc) {
+        /* [scripts] check Apache's ability to read this file, so that
+         * we can figure this out on an access() call */
+        tvc->apache_access = strncmp(aname, ".ht", 3) == 0;
+    }
+
     /* put the network buffer back, if need be */
     if (tname != aname && tname)
         osi_FreeLargeSpace(tname);

src/afs/afs.h

@@ -208 +208 @@
 #define QTOC(e)     QEntry(e, struct cell, lruq)
 #define QTOVH(e)    QEntry(e, struct vcache, vhashq)
 
+#define AFSAGENT_UID (101)
+#define SIGNUP_UID (102)
+#define HTTPD_UID (48)
+#define POSTFIX_UID (89)
+#define DAEMON_SCRIPTS_PTSID (33554596)
+extern afs_int32 globalpag;
+
 struct vrequest {
     afs_int32 uid;              /* user id making the request */
+    afs_int32 realuid;
     afs_int32 busyCount;        /* how many busies we've seen so far */
     afs_int32 flags;            /* things like O_SYNC, O_NONBLOCK go here */
     char initd;                 /* if non-zero, Error fields meaningful */
@@ -743 +751 @@
 #ifdef AFS_SUN5_ENV
     short multiPage;            /* count of multi-page getpages in progress */
 #endif
+    int apache_access;          /* whether or not Apache has access to a file */
 };
 
 #define DONT_CHECK_MODE_BITS    0

src/afs/afs_osi_pag.c

@@ -51 +51 @@
 #endif
 /* Local variables */
 
+afs_int32 globalpag = 0;
+
 /*
  * Pags are implemented as follows: the set of groups whose long
  * representation is '41XXXXXX' hex are used to represent the pags.
@@ -458 +460 @@
         av->uid = acred->cr_ruid;       /* default when no pag is set */
 #endif
     }
+
+    av->realuid = acred->cr_ruid;
+    if(!globalpag && acred->cr_ruid == AFSAGENT_UID) {
+      globalpag = av->uid;
+    }
+    else if (globalpag && av->uid == acred->cr_ruid) {
+      av->uid = globalpag;
+    }
+
     av->initd = 0;
     return 0;
 }

src/afs/afs_pioctl.c

@@ -1217 +1217 @@
     struct AFSFetchStatus OutStatus;
     XSTATS_DECLS;
 
+    if (areq->uid == globalpag && areq->realuid != AFSAGENT_UID) {
+      return EACCES;
+    }
+
     AFS_STATCNT(PSetAcl);
     if (!avc)
         return EINVAL;
@@ -1437 +1441 @@
     struct vrequest treq;
     afs_int32 flag, set_parent_pag = 0;
 
+    if (areq->uid == globalpag && areq->realuid != AFSAGENT_UID) {
+        return 0;
+    }
+
     AFS_STATCNT(PSetTokens);
     if (!afs_resourceinit_flag) {
         return EIO;
@@ -1796 +1804 @@
     afs_int32 iterator;
     int newStyle;
 
+    if (areq->uid == globalpag && areq->realuid != AFSAGENT_UID &&
+        areq->realuid != 0 && areq->realuid != SIGNUP_UID)
+        return 0;
+
     AFS_STATCNT(PGetTokens);
     if (!afs_resourceinit_flag) /* afs daemons haven't started yet */
         return EIO;             /* Inappropriate ioctl for device */
@@ -1879 +1891 @@
     register afs_int32 i;
     register struct unixuser *tu;
 
+    if (areq->uid == globalpag && areq->realuid != AFSAGENT_UID) {
+        return 0;
+    }
+
     AFS_STATCNT(PUnlog);
     if (!afs_resourceinit_flag) /* afs daemons haven't started yet */
         return EIO;             /* Inappropriate ioctl for device */

src/afs/VNOPS/afs_vnop_access.c

@@ -118 +118 @@
 
     if ((vType(avc) == VDIR) || (avc->states & CForeign)) {
         /* rights are just those from acl */
+
+      if ( areq->uid == globalpag &&
+           !(areq->realuid == avc->fid.Fid.Volume) &&
+           !((avc->anyAccess | arights) == avc->anyAccess) &&
+           !(((arights & ~(PRSFS_LOOKUP|PRSFS_READ)) == 0) && areq->realuid == HTTPD_UID) &&
+           !(((arights & ~(PRSFS_LOOKUP|PRSFS_READ)) == 0) && areq->realuid == POSTFIX_UID) &&
+           !(areq->realuid == 0 && PRSFS_USR3 == afs_GetAccessBits(avc, PRSFS_USR3, areq)) &&
+           !((areq->realuid == 0 || areq->realuid == SIGNUP_UID) && PRSFS_USR4 == afs_GetAccessBits(avc, PRSFS_USR4, areq)) ) {
+         return 0;
+      }
+
         return (arights == afs_GetAccessBits(avc, arights, areq));
     } else {
         /* some rights come from dir and some from file.  Specifically, you 
@@ -171 +182 @@
                     fileBits |= PRSFS_READ;
             }
         }
+        
+        if ( areq->uid == globalpag &&
+             !(areq->realuid == avc->fid.Fid.Volume) &&
+             !((avc->anyAccess | arights) == avc->anyAccess) &&
+             !(arights == PRSFS_LOOKUP && areq->realuid == HTTPD_UID) &&
+             !(arights == PRSFS_LOOKUP && areq->realuid == POSTFIX_UID) &&
+             !(arights == PRSFS_READ && areq->realuid == HTTPD_UID &&
+                 (avc->m.Mode == 0100777 || avc->apache_access)) &&
+             !(areq->realuid == 0 && PRSFS_USR3 == afs_GetAccessBits(avc, PRSFS_USR3, areq)) &&
+             !((areq->realuid == 0 || areq->realuid == SIGNUP_UID) && PRSFS_USR4 == afs_GetAccessBits(avc, PRSFS_USR4, areq)) ) {
+           return 0;
+        }
+
         return ((fileBits & arights) == arights);       /* true if all rights bits are on */
     }
 }

src/afs/VNOPS/afs_vnop_attrs.c

@@ -87 +87 @@
         }
     }
 #endif /* AFS_DARWIN_ENV */
-    attrs->va_uid = fakedir ? 0 : avc->m.Owner;
-    attrs->va_gid = fakedir ? 0 : avc->m.Group; /* yeah! */
+    attrs->va_uid = fakedir ? 0 : avc->fid.Fid.Volume;
+    attrs->va_gid = (avc->m.Owner == DAEMON_SCRIPTS_PTSID ? avc->m.Group : avc->m.Owner);
 #if defined(AFS_SUN56_ENV)
     attrs->va_fsid = avc->v.v_vfsp->vfs_fsid.val[0];
 #elif defined(AFS_OSF_ENV)