Btrfs: allow subvol deletion by unprivileged user with -o user_subvol_rm_allowed

Add a mount option user_subvol_rm_allowed that allows users to delete a
(potentially non-empty!) subvol when they would otherwise we allowed to do
an rmdir(2).  We duplicate the may_delete() checks from the core VFS code
to implement identical security checks (minus the directory size check).
We additionally require that the user has write+exec permission on the
subvol root inode.

Signed-off-by: Sage Weil <sage@newdream.net>
Signed-off-by: Chris Mason <chris.mason@oracle.com>

1 files changed, 5 insertions, 0 deletions

diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index 0002e6d1a16f..718b10de2049 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -71,6 +71,7 @@ enum {
         Opt_nossd, Opt_ssd_spread, Opt_thread_pool, Opt_noacl, Opt_compress,
         Opt_compress_force, Opt_notreelog, Opt_ratio, Opt_flushoncommit,
         Opt_discard, Opt_space_cache, Opt_clear_cache, Opt_err,
+        Opt_user_subvol_rm_allowed,
 };
 
 static match_table_t tokens = {
@@ -96,6 +97,7 @@ static match_table_t tokens = {
         {Opt_discard, "discard"},
         {Opt_space_cache, "space_cache"},
         {Opt_clear_cache, "clear_cache"},
+        {Opt_user_subvol_rm_allowed, "user_subvol_rm_allowed"},
         {Opt_err, NULL},
 };
 
@@ -246,6 +248,9 @@ int btrfs_parse_options(struct btrfs_root *root, char *options)
                         printk(KERN_INFO "btrfs: force clearing of disk cache\n");
                         btrfs_set_opt(info->mount_opt, CLEAR_CACHE);
                         break;
+                case Opt_user_subvol_rm_allowed:
+                        btrfs_set_opt(info->mount_opt, USER_SUBVOL_RM_ALLOWED);
+                        break;
                 case Opt_err:
                         printk(KERN_INFO "btrfs: unrecognized mount option "
                                "'%s'\n", p);