Motr Capability

Data Structures
struct	m0_capa_issuer
struct	m0_object_capa
struct	m0_capa_ctxt

Enumerations
enum	m0_capa_entity_type { M0_CAPA_ENTITY_OBJECT, M0_CAPA_ENTITY_LOCKS, M0_CAPA_ENTITY_LAYOUT }
enum	m0_capa_operation { M0_CAPA_OP_DATA_READ, M0_CAPA_OP_DATA_WRITE }
enum	{ M0_CAPA_HMAC_MAX_LEN = 64 }

Functions
M0_INTERNAL int	m0_capa_init (struct m0_capa_ctxt *ctxt)
M0_INTERNAL void	m0_capa_fini (struct m0_capa_ctxt *ctxt)
M0_INTERNAL int	m0_capa_new (struct m0_object_capa *capa, enum m0_capa_entity_type type, enum m0_capa_operation opcode, void *data)
M0_INTERNAL int	m0_capa_get (struct m0_capa_ctxt *ctxt, struct m0_capa_issuer *owner, struct m0_object_capa *capa)
M0_INTERNAL void	m0_capa_put (struct m0_capa_ctxt *ctxt, struct m0_object_capa *capa)
M0_INTERNAL int	m0_capa_auth (struct m0_capa_ctxt *ctxt, struct m0_object_capa *capa, enum m0_capa_operation op)
M0_INTERNAL int	m0_capa_ctxt_init (struct m0_capa_ctxt *ctxt)
M0_INTERNAL void	m0_capa_ctxt_fini (struct m0_capa_ctxt *ctxt)

Detailed Description

Motr Capabilities are an implementation of Capability-based security as described here: http://en.wikipedia.org/wiki/Capability-based_security

The idea is that an authority managing some object (e.g., a lock, a file, a layout, etc., basically, a resource), issues a capability together with this object. Other parties can verify that a capability was issued by the authority but cannot forge capabilities. A typical use case is that a client receives a capability attached to some piece of file system state and then forwards the capability together with the state to another node. For example, a capability attached to a fid and sent back to the server which produced the fid and the capability, can be used to deal with fid-guessing attack. Capabilities can be forwarded to the nodes different from ones where they originated.

Capability HLD : For documentation links, please refer to this file : doc/motr-design-doc-list.rst

Enumeration Type Documentation

anonymous enum

anonymous enum

Enumerator
M0_CAPA_HMAC_MAX_LEN

Definition at line 72 of file capa.h.

m0_capa_entity_type

enum m0_capa_entity_type

Capability Protected Entity Type

Enumerator
M0_CAPA_ENTITY_OBJECT
M0_CAPA_ENTITY_LOCKS
M0_CAPA_ENTITY_LAYOUT

Definition at line 58 of file capa.h.

m0_capa_operation

enum m0_capa_operation

Capability Operations

Enumerator
M0_CAPA_OP_DATA_READ
M0_CAPA_OP_DATA_WRITE

Definition at line 67 of file capa.h.

Function Documentation

m0_capa_auth()

M0_INTERNAL int m0_capa_auth	(	struct m0_capa_ctxt *	ctxt,
		struct m0_object_capa *	capa,
		enum m0_capa_operation	op
	)

Authenticate an operation

Parameters

ctxt	[in]the execution context.
capa	[in]capability to be authenticated.
op	[in] target operation.

Returns

0 means permission is granted. -EPERM means access denied, and others mean error.

Definition at line 75 of file capa.c.

Here is the caller graph for this function:

m0_capa_ctxt_fini()

M0_INTERNAL void m0_capa_ctxt_fini

(

struct m0_capa_ctxt *

ctxt

)

Fini a Motr Capability Context

Parameters

ctxt	the execution context

Definition at line 89 of file capa.c.

Here is the caller graph for this function:

m0_capa_ctxt_init()

M0_INTERNAL int m0_capa_ctxt_init

(

struct m0_capa_ctxt *

ctxt

)

Init a Motr Capability Context

Parameters

ctxt	the execution context

Returns

0 means success. Otherwise failure.

Definition at line 83 of file capa.c.

Here is the caller graph for this function:

m0_capa_fini()

M0_INTERNAL void m0_capa_fini

(

struct m0_capa_ctxt *

ctxt

)

Definition at line 35 of file capa.c.

m0_capa_get()

M0_INTERNAL int m0_capa_get	(	struct m0_capa_ctxt *	ctxt,
		struct m0_capa_issuer *	owner,
		struct m0_object_capa *	capa
	)

Get Capability for an object for specified operation

Parameters

ctxt	[in]the execution context.
owner	[in] owner of this capa.
capa	[in][out]result will be stored here.

Returns

0 means success. Otherwise failure.

Precondition

m0_capa_new() should be called successfully. Reference count will be bumped.

Definition at line 54 of file capa.c.

Here is the call graph for this function:

Here is the caller graph for this function:

m0_capa_init()

M0_INTERNAL int m0_capa_init

(

struct m0_capa_ctxt *

ctxt

)

Definition at line 29 of file capa.c.

m0_capa_new()

M0_INTERNAL int m0_capa_new	(	struct m0_object_capa *	capa,
		enum m0_capa_entity_type	type,
		enum m0_capa_operation	opcode,
		void *	data
	)

New Capability for an object for specified operation

Parameters

capa	[in][out]result will be stored here.
type	[in] type of the capability.
opcode	[in] operation code.
data	[in] opaque object that this capability protects.

Returns

0 means success. Otherwise failure.

Reference count will be initialzed to zero.

Definition at line 41 of file capa.c.

Here is the call graph for this function:

Here is the caller graph for this function:

m0_capa_put()

M0_INTERNAL void m0_capa_put	(	struct m0_capa_ctxt *	ctxt,
		struct m0_object_capa *	capa
	)

Definition at line 66 of file capa.c.

Here is the call graph for this function:

Here is the caller graph for this function: