]>
Commit | Line | Data |
---|---|---|
9f0a21e6 MM |
1 | /* |
2 | * CDDL HEADER START | |
3 | * | |
4 | * The contents of this file are subject to the terms of the | |
5 | * Common Development and Distribution License (the "License"). | |
6 | * You may not use this file except in compliance with the License. | |
7 | * | |
8 | * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE | |
9 | * or http://www.opensolaris.org/os/licensing. | |
10 | * See the License for the specific language governing permissions | |
11 | * and limitations under the License. | |
12 | * | |
13 | * When distributing Covered Code, include this CDDL HEADER in each | |
14 | * file and include the License file at usr/src/OPENSOLARIS.LICENSE. | |
15 | * If applicable, add the following below this CDDL HEADER, with the | |
16 | * fields enclosed by brackets "[]" replaced with your own identifying | |
17 | * information: Portions Copyright [yyyy] [name of copyright owner] | |
18 | * | |
19 | * CDDL HEADER END | |
20 | */ | |
21 | /* | |
22 | * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved. | |
23 | * Copyright (c) 2013 by Delphix. All rights reserved. | |
24 | * Copyright 2017 Nexenta Systems, Inc. All rights reserved. | |
25 | */ | |
26 | ||
27 | #include <sys/types.h> | |
28 | #include <sys/param.h> | |
29 | #include <sys/time.h> | |
30 | #include <sys/systm.h> | |
31 | #include <sys/sysmacros.h> | |
32 | #include <sys/resource.h> | |
33 | #include <sys/vfs.h> | |
34 | #include <sys/vnode.h> | |
35 | #include <sys/file.h> | |
36 | #include <sys/stat.h> | |
37 | #include <sys/kmem.h> | |
38 | #include <sys/cmn_err.h> | |
39 | #include <sys/errno.h> | |
40 | #include <sys/unistd.h> | |
41 | #include <sys/sdt.h> | |
42 | #include <sys/fs/zfs.h> | |
43 | #include <sys/policy.h> | |
44 | #include <sys/zfs_znode.h> | |
45 | #include <sys/zfs_fuid.h> | |
46 | #include <sys/zfs_acl.h> | |
47 | #include <sys/zfs_dir.h> | |
48 | #include <sys/zfs_quota.h> | |
49 | #include <sys/zfs_vfsops.h> | |
50 | #include <sys/dmu.h> | |
51 | #include <sys/dnode.h> | |
52 | #include <sys/zap.h> | |
53 | #include <sys/sa.h> | |
54 | #include <acl/acl_common.h> | |
55 | ||
56 | ||
57 | #define ALLOW ACE_ACCESS_ALLOWED_ACE_TYPE | |
58 | #define DENY ACE_ACCESS_DENIED_ACE_TYPE | |
59 | #define MAX_ACE_TYPE ACE_SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE | |
60 | #define MIN_ACE_TYPE ALLOW | |
61 | ||
62 | #define OWNING_GROUP (ACE_GROUP|ACE_IDENTIFIER_GROUP) | |
63 | #define EVERYONE_ALLOW_MASK (ACE_READ_ACL|ACE_READ_ATTRIBUTES | \ | |
64 | ACE_READ_NAMED_ATTRS|ACE_SYNCHRONIZE) | |
65 | #define EVERYONE_DENY_MASK (ACE_WRITE_ACL|ACE_WRITE_OWNER | \ | |
66 | ACE_WRITE_ATTRIBUTES|ACE_WRITE_NAMED_ATTRS) | |
67 | #define OWNER_ALLOW_MASK (ACE_WRITE_ACL | ACE_WRITE_OWNER | \ | |
68 | ACE_WRITE_ATTRIBUTES|ACE_WRITE_NAMED_ATTRS) | |
69 | ||
70 | #define ZFS_CHECKED_MASKS (ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_READ_DATA| \ | |
71 | ACE_READ_NAMED_ATTRS|ACE_WRITE_DATA|ACE_WRITE_ATTRIBUTES| \ | |
72 | ACE_WRITE_NAMED_ATTRS|ACE_APPEND_DATA|ACE_EXECUTE|ACE_WRITE_OWNER| \ | |
73 | ACE_WRITE_ACL|ACE_DELETE|ACE_DELETE_CHILD|ACE_SYNCHRONIZE) | |
74 | ||
75 | #define WRITE_MASK_DATA (ACE_WRITE_DATA|ACE_APPEND_DATA|ACE_WRITE_NAMED_ATTRS) | |
76 | #define WRITE_MASK_ATTRS (ACE_WRITE_ACL|ACE_WRITE_OWNER|ACE_WRITE_ATTRIBUTES| \ | |
77 | ACE_DELETE|ACE_DELETE_CHILD) | |
78 | #define WRITE_MASK (WRITE_MASK_DATA|WRITE_MASK_ATTRS) | |
79 | ||
80 | #define OGE_CLEAR (ACE_READ_DATA|ACE_LIST_DIRECTORY|ACE_WRITE_DATA| \ | |
81 | ACE_ADD_FILE|ACE_APPEND_DATA|ACE_ADD_SUBDIRECTORY|ACE_EXECUTE) | |
82 | ||
83 | #define OKAY_MASK_BITS (ACE_READ_DATA|ACE_LIST_DIRECTORY|ACE_WRITE_DATA| \ | |
84 | ACE_ADD_FILE|ACE_APPEND_DATA|ACE_ADD_SUBDIRECTORY|ACE_EXECUTE) | |
85 | ||
86 | #define ALL_INHERIT (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE | \ | |
87 | ACE_NO_PROPAGATE_INHERIT_ACE|ACE_INHERIT_ONLY_ACE|ACE_INHERITED_ACE) | |
88 | ||
89 | #define RESTRICTED_CLEAR (ACE_WRITE_ACL|ACE_WRITE_OWNER) | |
90 | ||
91 | #define V4_ACL_WIDE_FLAGS (ZFS_ACL_AUTO_INHERIT|ZFS_ACL_DEFAULTED|\ | |
92 | ZFS_ACL_PROTECTED) | |
93 | ||
94 | #define ZFS_ACL_WIDE_FLAGS (V4_ACL_WIDE_FLAGS|ZFS_ACL_TRIVIAL|ZFS_INHERIT_ACE|\ | |
95 | ZFS_ACL_OBJ_ACE) | |
96 | ||
97 | #define ALL_MODE_EXECS (S_IXUSR | S_IXGRP | S_IXOTH) | |
98 | ||
99 | static uint16_t | |
100 | zfs_ace_v0_get_type(void *acep) | |
101 | { | |
102 | return (((zfs_oldace_t *)acep)->z_type); | |
103 | } | |
104 | ||
105 | static uint16_t | |
106 | zfs_ace_v0_get_flags(void *acep) | |
107 | { | |
108 | return (((zfs_oldace_t *)acep)->z_flags); | |
109 | } | |
110 | ||
111 | static uint32_t | |
112 | zfs_ace_v0_get_mask(void *acep) | |
113 | { | |
114 | return (((zfs_oldace_t *)acep)->z_access_mask); | |
115 | } | |
116 | ||
117 | static uint64_t | |
118 | zfs_ace_v0_get_who(void *acep) | |
119 | { | |
120 | return (((zfs_oldace_t *)acep)->z_fuid); | |
121 | } | |
122 | ||
123 | static void | |
124 | zfs_ace_v0_set_type(void *acep, uint16_t type) | |
125 | { | |
126 | ((zfs_oldace_t *)acep)->z_type = type; | |
127 | } | |
128 | ||
129 | static void | |
130 | zfs_ace_v0_set_flags(void *acep, uint16_t flags) | |
131 | { | |
132 | ((zfs_oldace_t *)acep)->z_flags = flags; | |
133 | } | |
134 | ||
135 | static void | |
136 | zfs_ace_v0_set_mask(void *acep, uint32_t mask) | |
137 | { | |
138 | ((zfs_oldace_t *)acep)->z_access_mask = mask; | |
139 | } | |
140 | ||
141 | static void | |
142 | zfs_ace_v0_set_who(void *acep, uint64_t who) | |
143 | { | |
144 | ((zfs_oldace_t *)acep)->z_fuid = who; | |
145 | } | |
146 | ||
147 | /*ARGSUSED*/ | |
148 | static size_t | |
149 | zfs_ace_v0_size(void *acep) | |
150 | { | |
151 | return (sizeof (zfs_oldace_t)); | |
152 | } | |
153 | ||
154 | static size_t | |
155 | zfs_ace_v0_abstract_size(void) | |
156 | { | |
157 | return (sizeof (zfs_oldace_t)); | |
158 | } | |
159 | ||
160 | static int | |
161 | zfs_ace_v0_mask_off(void) | |
162 | { | |
163 | return (offsetof(zfs_oldace_t, z_access_mask)); | |
164 | } | |
165 | ||
166 | /*ARGSUSED*/ | |
167 | static int | |
168 | zfs_ace_v0_data(void *acep, void **datap) | |
169 | { | |
170 | *datap = NULL; | |
171 | return (0); | |
172 | } | |
173 | ||
18168da7 | 174 | static const acl_ops_t zfs_acl_v0_ops = { |
9f0a21e6 MM |
175 | zfs_ace_v0_get_mask, |
176 | zfs_ace_v0_set_mask, | |
177 | zfs_ace_v0_get_flags, | |
178 | zfs_ace_v0_set_flags, | |
179 | zfs_ace_v0_get_type, | |
180 | zfs_ace_v0_set_type, | |
181 | zfs_ace_v0_get_who, | |
182 | zfs_ace_v0_set_who, | |
183 | zfs_ace_v0_size, | |
184 | zfs_ace_v0_abstract_size, | |
185 | zfs_ace_v0_mask_off, | |
186 | zfs_ace_v0_data | |
187 | }; | |
188 | ||
189 | static uint16_t | |
190 | zfs_ace_fuid_get_type(void *acep) | |
191 | { | |
192 | return (((zfs_ace_hdr_t *)acep)->z_type); | |
193 | } | |
194 | ||
195 | static uint16_t | |
196 | zfs_ace_fuid_get_flags(void *acep) | |
197 | { | |
198 | return (((zfs_ace_hdr_t *)acep)->z_flags); | |
199 | } | |
200 | ||
201 | static uint32_t | |
202 | zfs_ace_fuid_get_mask(void *acep) | |
203 | { | |
204 | return (((zfs_ace_hdr_t *)acep)->z_access_mask); | |
205 | } | |
206 | ||
207 | static uint64_t | |
208 | zfs_ace_fuid_get_who(void *args) | |
209 | { | |
210 | uint16_t entry_type; | |
211 | zfs_ace_t *acep = args; | |
212 | ||
213 | entry_type = acep->z_hdr.z_flags & ACE_TYPE_FLAGS; | |
214 | ||
215 | if (entry_type == ACE_OWNER || entry_type == OWNING_GROUP || | |
216 | entry_type == ACE_EVERYONE) | |
217 | return (-1); | |
218 | return (((zfs_ace_t *)acep)->z_fuid); | |
219 | } | |
220 | ||
221 | static void | |
222 | zfs_ace_fuid_set_type(void *acep, uint16_t type) | |
223 | { | |
224 | ((zfs_ace_hdr_t *)acep)->z_type = type; | |
225 | } | |
226 | ||
227 | static void | |
228 | zfs_ace_fuid_set_flags(void *acep, uint16_t flags) | |
229 | { | |
230 | ((zfs_ace_hdr_t *)acep)->z_flags = flags; | |
231 | } | |
232 | ||
233 | static void | |
234 | zfs_ace_fuid_set_mask(void *acep, uint32_t mask) | |
235 | { | |
236 | ((zfs_ace_hdr_t *)acep)->z_access_mask = mask; | |
237 | } | |
238 | ||
239 | static void | |
240 | zfs_ace_fuid_set_who(void *arg, uint64_t who) | |
241 | { | |
242 | zfs_ace_t *acep = arg; | |
243 | ||
244 | uint16_t entry_type = acep->z_hdr.z_flags & ACE_TYPE_FLAGS; | |
245 | ||
246 | if (entry_type == ACE_OWNER || entry_type == OWNING_GROUP || | |
247 | entry_type == ACE_EVERYONE) | |
248 | return; | |
249 | acep->z_fuid = who; | |
250 | } | |
251 | ||
252 | static size_t | |
253 | zfs_ace_fuid_size(void *acep) | |
254 | { | |
255 | zfs_ace_hdr_t *zacep = acep; | |
256 | uint16_t entry_type; | |
257 | ||
258 | switch (zacep->z_type) { | |
259 | case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: | |
260 | case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: | |
261 | case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: | |
262 | case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: | |
263 | return (sizeof (zfs_object_ace_t)); | |
264 | case ALLOW: | |
265 | case DENY: | |
266 | entry_type = | |
267 | (((zfs_ace_hdr_t *)acep)->z_flags & ACE_TYPE_FLAGS); | |
268 | if (entry_type == ACE_OWNER || | |
269 | entry_type == OWNING_GROUP || | |
270 | entry_type == ACE_EVERYONE) | |
271 | return (sizeof (zfs_ace_hdr_t)); | |
9a70e97f | 272 | zfs_fallthrough; |
9f0a21e6 MM |
273 | default: |
274 | return (sizeof (zfs_ace_t)); | |
275 | } | |
276 | } | |
277 | ||
278 | static size_t | |
279 | zfs_ace_fuid_abstract_size(void) | |
280 | { | |
281 | return (sizeof (zfs_ace_hdr_t)); | |
282 | } | |
283 | ||
284 | static int | |
285 | zfs_ace_fuid_mask_off(void) | |
286 | { | |
287 | return (offsetof(zfs_ace_hdr_t, z_access_mask)); | |
288 | } | |
289 | ||
290 | static int | |
291 | zfs_ace_fuid_data(void *acep, void **datap) | |
292 | { | |
293 | zfs_ace_t *zacep = acep; | |
294 | zfs_object_ace_t *zobjp; | |
295 | ||
296 | switch (zacep->z_hdr.z_type) { | |
297 | case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: | |
298 | case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: | |
299 | case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: | |
300 | case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: | |
301 | zobjp = acep; | |
302 | *datap = (caddr_t)zobjp + sizeof (zfs_ace_t); | |
303 | return (sizeof (zfs_object_ace_t) - sizeof (zfs_ace_t)); | |
304 | default: | |
305 | *datap = NULL; | |
306 | return (0); | |
307 | } | |
308 | } | |
309 | ||
18168da7 | 310 | static const acl_ops_t zfs_acl_fuid_ops = { |
9f0a21e6 MM |
311 | zfs_ace_fuid_get_mask, |
312 | zfs_ace_fuid_set_mask, | |
313 | zfs_ace_fuid_get_flags, | |
314 | zfs_ace_fuid_set_flags, | |
315 | zfs_ace_fuid_get_type, | |
316 | zfs_ace_fuid_set_type, | |
317 | zfs_ace_fuid_get_who, | |
318 | zfs_ace_fuid_set_who, | |
319 | zfs_ace_fuid_size, | |
320 | zfs_ace_fuid_abstract_size, | |
321 | zfs_ace_fuid_mask_off, | |
322 | zfs_ace_fuid_data | |
323 | }; | |
324 | ||
325 | /* | |
326 | * The following three functions are provided for compatibility with | |
327 | * older ZPL version in order to determine if the file use to have | |
328 | * an external ACL and what version of ACL previously existed on the | |
329 | * file. Would really be nice to not need this, sigh. | |
330 | */ | |
331 | uint64_t | |
332 | zfs_external_acl(znode_t *zp) | |
333 | { | |
334 | zfs_acl_phys_t acl_phys; | |
335 | int error; | |
336 | ||
337 | if (zp->z_is_sa) | |
338 | return (0); | |
339 | ||
340 | /* | |
341 | * Need to deal with a potential | |
342 | * race where zfs_sa_upgrade could cause | |
343 | * z_isa_sa to change. | |
344 | * | |
345 | * If the lookup fails then the state of z_is_sa should have | |
346 | * changed. | |
347 | */ | |
348 | ||
349 | if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_ZNODE_ACL(zp->z_zfsvfs), | |
350 | &acl_phys, sizeof (acl_phys))) == 0) | |
351 | return (acl_phys.z_acl_extern_obj); | |
352 | else { | |
353 | /* | |
354 | * after upgrade the SA_ZPL_ZNODE_ACL should have been | |
355 | * removed | |
356 | */ | |
e4efb709 RM |
357 | VERIFY(zp->z_is_sa); |
358 | VERIFY3S(error, ==, ENOENT); | |
9f0a21e6 MM |
359 | return (0); |
360 | } | |
361 | } | |
362 | ||
363 | /* | |
364 | * Determine size of ACL in bytes | |
365 | * | |
366 | * This is more complicated than it should be since we have to deal | |
367 | * with old external ACLs. | |
368 | */ | |
369 | static int | |
370 | zfs_acl_znode_info(znode_t *zp, int *aclsize, int *aclcount, | |
371 | zfs_acl_phys_t *aclphys) | |
372 | { | |
373 | zfsvfs_t *zfsvfs = zp->z_zfsvfs; | |
374 | uint64_t acl_count; | |
375 | int size; | |
376 | int error; | |
377 | ||
378 | ASSERT(MUTEX_HELD(&zp->z_acl_lock)); | |
379 | if (zp->z_is_sa) { | |
380 | if ((error = sa_size(zp->z_sa_hdl, SA_ZPL_DACL_ACES(zfsvfs), | |
381 | &size)) != 0) | |
382 | return (error); | |
383 | *aclsize = size; | |
384 | if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_DACL_COUNT(zfsvfs), | |
385 | &acl_count, sizeof (acl_count))) != 0) | |
386 | return (error); | |
387 | *aclcount = acl_count; | |
388 | } else { | |
389 | if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_ZNODE_ACL(zfsvfs), | |
390 | aclphys, sizeof (*aclphys))) != 0) | |
391 | return (error); | |
392 | ||
393 | if (aclphys->z_acl_version == ZFS_ACL_VERSION_INITIAL) { | |
394 | *aclsize = ZFS_ACL_SIZE(aclphys->z_acl_size); | |
395 | *aclcount = aclphys->z_acl_size; | |
396 | } else { | |
397 | *aclsize = aclphys->z_acl_size; | |
398 | *aclcount = aclphys->z_acl_count; | |
399 | } | |
400 | } | |
401 | return (0); | |
402 | } | |
403 | ||
404 | int | |
405 | zfs_znode_acl_version(znode_t *zp) | |
406 | { | |
407 | zfs_acl_phys_t acl_phys; | |
408 | ||
409 | if (zp->z_is_sa) | |
410 | return (ZFS_ACL_VERSION_FUID); | |
411 | else { | |
412 | int error; | |
413 | ||
414 | /* | |
415 | * Need to deal with a potential | |
416 | * race where zfs_sa_upgrade could cause | |
417 | * z_isa_sa to change. | |
418 | * | |
419 | * If the lookup fails then the state of z_is_sa should have | |
420 | * changed. | |
421 | */ | |
422 | if ((error = sa_lookup(zp->z_sa_hdl, | |
423 | SA_ZPL_ZNODE_ACL(zp->z_zfsvfs), | |
424 | &acl_phys, sizeof (acl_phys))) == 0) | |
425 | return (acl_phys.z_acl_version); | |
426 | else { | |
427 | /* | |
428 | * After upgrade SA_ZPL_ZNODE_ACL should have | |
429 | * been removed. | |
430 | */ | |
e4efb709 RM |
431 | VERIFY(zp->z_is_sa); |
432 | VERIFY3S(error, ==, ENOENT); | |
9f0a21e6 MM |
433 | return (ZFS_ACL_VERSION_FUID); |
434 | } | |
435 | } | |
436 | } | |
437 | ||
438 | static int | |
439 | zfs_acl_version(int version) | |
440 | { | |
441 | if (version < ZPL_VERSION_FUID) | |
442 | return (ZFS_ACL_VERSION_INITIAL); | |
443 | else | |
444 | return (ZFS_ACL_VERSION_FUID); | |
445 | } | |
446 | ||
447 | static int | |
448 | zfs_acl_version_zp(znode_t *zp) | |
449 | { | |
450 | return (zfs_acl_version(zp->z_zfsvfs->z_version)); | |
451 | } | |
452 | ||
453 | zfs_acl_t * | |
454 | zfs_acl_alloc(int vers) | |
455 | { | |
456 | zfs_acl_t *aclp; | |
457 | ||
458 | aclp = kmem_zalloc(sizeof (zfs_acl_t), KM_SLEEP); | |
459 | list_create(&aclp->z_acl, sizeof (zfs_acl_node_t), | |
460 | offsetof(zfs_acl_node_t, z_next)); | |
461 | aclp->z_version = vers; | |
462 | if (vers == ZFS_ACL_VERSION_FUID) | |
463 | aclp->z_ops = &zfs_acl_fuid_ops; | |
464 | else | |
465 | aclp->z_ops = &zfs_acl_v0_ops; | |
466 | return (aclp); | |
467 | } | |
468 | ||
469 | zfs_acl_node_t * | |
470 | zfs_acl_node_alloc(size_t bytes) | |
471 | { | |
472 | zfs_acl_node_t *aclnode; | |
473 | ||
474 | aclnode = kmem_zalloc(sizeof (zfs_acl_node_t), KM_SLEEP); | |
475 | if (bytes) { | |
476 | aclnode->z_acldata = kmem_alloc(bytes, KM_SLEEP); | |
477 | aclnode->z_allocdata = aclnode->z_acldata; | |
478 | aclnode->z_allocsize = bytes; | |
479 | aclnode->z_size = bytes; | |
480 | } | |
481 | ||
482 | return (aclnode); | |
483 | } | |
484 | ||
485 | static void | |
486 | zfs_acl_node_free(zfs_acl_node_t *aclnode) | |
487 | { | |
488 | if (aclnode->z_allocsize) | |
489 | kmem_free(aclnode->z_allocdata, aclnode->z_allocsize); | |
490 | kmem_free(aclnode, sizeof (zfs_acl_node_t)); | |
491 | } | |
492 | ||
493 | static void | |
494 | zfs_acl_release_nodes(zfs_acl_t *aclp) | |
495 | { | |
496 | zfs_acl_node_t *aclnode; | |
497 | ||
498 | while ((aclnode = list_head(&aclp->z_acl))) { | |
499 | list_remove(&aclp->z_acl, aclnode); | |
500 | zfs_acl_node_free(aclnode); | |
501 | } | |
502 | aclp->z_acl_count = 0; | |
503 | aclp->z_acl_bytes = 0; | |
504 | } | |
505 | ||
506 | void | |
507 | zfs_acl_free(zfs_acl_t *aclp) | |
508 | { | |
509 | zfs_acl_release_nodes(aclp); | |
510 | list_destroy(&aclp->z_acl); | |
511 | kmem_free(aclp, sizeof (zfs_acl_t)); | |
512 | } | |
513 | ||
514 | static boolean_t | |
515 | zfs_acl_valid_ace_type(uint_t type, uint_t flags) | |
516 | { | |
517 | uint16_t entry_type; | |
518 | ||
519 | switch (type) { | |
520 | case ALLOW: | |
521 | case DENY: | |
522 | case ACE_SYSTEM_AUDIT_ACE_TYPE: | |
523 | case ACE_SYSTEM_ALARM_ACE_TYPE: | |
524 | entry_type = flags & ACE_TYPE_FLAGS; | |
525 | return (entry_type == ACE_OWNER || | |
526 | entry_type == OWNING_GROUP || | |
527 | entry_type == ACE_EVERYONE || entry_type == 0 || | |
528 | entry_type == ACE_IDENTIFIER_GROUP); | |
529 | default: | |
530 | if (type >= MIN_ACE_TYPE && type <= MAX_ACE_TYPE) | |
531 | return (B_TRUE); | |
532 | } | |
533 | return (B_FALSE); | |
534 | } | |
535 | ||
536 | static boolean_t | |
537 | zfs_ace_valid(vtype_t obj_type, zfs_acl_t *aclp, uint16_t type, uint16_t iflags) | |
538 | { | |
539 | /* | |
540 | * first check type of entry | |
541 | */ | |
542 | ||
543 | if (!zfs_acl_valid_ace_type(type, iflags)) | |
544 | return (B_FALSE); | |
545 | ||
546 | switch (type) { | |
547 | case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: | |
548 | case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: | |
549 | case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: | |
550 | case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: | |
551 | if (aclp->z_version < ZFS_ACL_VERSION_FUID) | |
552 | return (B_FALSE); | |
553 | aclp->z_hints |= ZFS_ACL_OBJ_ACE; | |
554 | } | |
555 | ||
556 | /* | |
557 | * next check inheritance level flags | |
558 | */ | |
559 | ||
560 | if (obj_type == VDIR && | |
561 | (iflags & (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE))) | |
562 | aclp->z_hints |= ZFS_INHERIT_ACE; | |
563 | ||
564 | if (iflags & (ACE_INHERIT_ONLY_ACE|ACE_NO_PROPAGATE_INHERIT_ACE)) { | |
565 | if ((iflags & (ACE_FILE_INHERIT_ACE| | |
566 | ACE_DIRECTORY_INHERIT_ACE)) == 0) { | |
567 | return (B_FALSE); | |
568 | } | |
569 | } | |
570 | ||
571 | return (B_TRUE); | |
572 | } | |
573 | ||
574 | static void * | |
575 | zfs_acl_next_ace(zfs_acl_t *aclp, void *start, uint64_t *who, | |
576 | uint32_t *access_mask, uint16_t *iflags, uint16_t *type) | |
577 | { | |
578 | zfs_acl_node_t *aclnode; | |
579 | ||
e4efb709 | 580 | ASSERT3P(aclp, !=, NULL); |
9f0a21e6 MM |
581 | |
582 | if (start == NULL) { | |
583 | aclnode = list_head(&aclp->z_acl); | |
584 | if (aclnode == NULL) | |
585 | return (NULL); | |
586 | ||
587 | aclp->z_next_ace = aclnode->z_acldata; | |
588 | aclp->z_curr_node = aclnode; | |
589 | aclnode->z_ace_idx = 0; | |
590 | } | |
591 | ||
592 | aclnode = aclp->z_curr_node; | |
593 | ||
594 | if (aclnode == NULL) | |
595 | return (NULL); | |
596 | ||
597 | if (aclnode->z_ace_idx >= aclnode->z_ace_count) { | |
598 | aclnode = list_next(&aclp->z_acl, aclnode); | |
599 | if (aclnode == NULL) | |
600 | return (NULL); | |
601 | else { | |
602 | aclp->z_curr_node = aclnode; | |
603 | aclnode->z_ace_idx = 0; | |
604 | aclp->z_next_ace = aclnode->z_acldata; | |
605 | } | |
606 | } | |
607 | ||
608 | if (aclnode->z_ace_idx < aclnode->z_ace_count) { | |
609 | void *acep = aclp->z_next_ace; | |
610 | size_t ace_size; | |
611 | ||
612 | /* | |
613 | * Make sure we don't overstep our bounds | |
614 | */ | |
615 | ace_size = aclp->z_ops->ace_size(acep); | |
616 | ||
617 | if (((caddr_t)acep + ace_size) > | |
618 | ((caddr_t)aclnode->z_acldata + aclnode->z_size)) { | |
619 | return (NULL); | |
620 | } | |
621 | ||
622 | *iflags = aclp->z_ops->ace_flags_get(acep); | |
623 | *type = aclp->z_ops->ace_type_get(acep); | |
624 | *access_mask = aclp->z_ops->ace_mask_get(acep); | |
625 | *who = aclp->z_ops->ace_who_get(acep); | |
626 | aclp->z_next_ace = (caddr_t)aclp->z_next_ace + ace_size; | |
627 | aclnode->z_ace_idx++; | |
628 | ||
629 | return ((void *)acep); | |
630 | } | |
631 | return (NULL); | |
632 | } | |
633 | ||
634 | /*ARGSUSED*/ | |
635 | static uint64_t | |
636 | zfs_ace_walk(void *datap, uint64_t cookie, int aclcnt, | |
637 | uint16_t *flags, uint16_t *type, uint32_t *mask) | |
638 | { | |
639 | zfs_acl_t *aclp = datap; | |
640 | zfs_ace_hdr_t *acep = (zfs_ace_hdr_t *)(uintptr_t)cookie; | |
641 | uint64_t who; | |
642 | ||
643 | acep = zfs_acl_next_ace(aclp, acep, &who, mask, | |
644 | flags, type); | |
645 | return ((uint64_t)(uintptr_t)acep); | |
646 | } | |
647 | ||
648 | /* | |
649 | * Copy ACE to internal ZFS format. | |
650 | * While processing the ACL each ACE will be validated for correctness. | |
651 | * ACE FUIDs will be created later. | |
652 | */ | |
65c7cc49 | 653 | static int |
9f0a21e6 MM |
654 | zfs_copy_ace_2_fuid(zfsvfs_t *zfsvfs, vtype_t obj_type, zfs_acl_t *aclp, |
655 | void *datap, zfs_ace_t *z_acl, uint64_t aclcnt, size_t *size, | |
656 | zfs_fuid_info_t **fuidp, cred_t *cr) | |
657 | { | |
658 | int i; | |
659 | uint16_t entry_type; | |
660 | zfs_ace_t *aceptr = z_acl; | |
661 | ace_t *acep = datap; | |
662 | zfs_object_ace_t *zobjacep; | |
663 | ace_object_t *aceobjp; | |
664 | ||
665 | for (i = 0; i != aclcnt; i++) { | |
666 | aceptr->z_hdr.z_access_mask = acep->a_access_mask; | |
667 | aceptr->z_hdr.z_flags = acep->a_flags; | |
668 | aceptr->z_hdr.z_type = acep->a_type; | |
669 | entry_type = aceptr->z_hdr.z_flags & ACE_TYPE_FLAGS; | |
670 | if (entry_type != ACE_OWNER && entry_type != OWNING_GROUP && | |
671 | entry_type != ACE_EVERYONE) { | |
672 | aceptr->z_fuid = zfs_fuid_create(zfsvfs, acep->a_who, | |
673 | cr, (entry_type == 0) ? | |
674 | ZFS_ACE_USER : ZFS_ACE_GROUP, fuidp); | |
675 | } | |
676 | ||
677 | /* | |
678 | * Make sure ACE is valid | |
679 | */ | |
680 | if (zfs_ace_valid(obj_type, aclp, aceptr->z_hdr.z_type, | |
681 | aceptr->z_hdr.z_flags) != B_TRUE) | |
682 | return (SET_ERROR(EINVAL)); | |
683 | ||
684 | switch (acep->a_type) { | |
685 | case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: | |
686 | case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: | |
687 | case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: | |
688 | case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: | |
689 | zobjacep = (zfs_object_ace_t *)aceptr; | |
690 | aceobjp = (ace_object_t *)acep; | |
691 | ||
692 | bcopy(aceobjp->a_obj_type, zobjacep->z_object_type, | |
693 | sizeof (aceobjp->a_obj_type)); | |
694 | bcopy(aceobjp->a_inherit_obj_type, | |
695 | zobjacep->z_inherit_type, | |
696 | sizeof (aceobjp->a_inherit_obj_type)); | |
697 | acep = (ace_t *)((caddr_t)acep + sizeof (ace_object_t)); | |
698 | break; | |
699 | default: | |
700 | acep = (ace_t *)((caddr_t)acep + sizeof (ace_t)); | |
701 | } | |
702 | ||
703 | aceptr = (zfs_ace_t *)((caddr_t)aceptr + | |
704 | aclp->z_ops->ace_size(aceptr)); | |
705 | } | |
706 | ||
707 | *size = (caddr_t)aceptr - (caddr_t)z_acl; | |
708 | ||
709 | return (0); | |
710 | } | |
711 | ||
712 | /* | |
713 | * Copy ZFS ACEs to fixed size ace_t layout | |
714 | */ | |
715 | static void | |
716 | zfs_copy_fuid_2_ace(zfsvfs_t *zfsvfs, zfs_acl_t *aclp, cred_t *cr, | |
717 | void *datap, int filter) | |
718 | { | |
719 | uint64_t who; | |
720 | uint32_t access_mask; | |
721 | uint16_t iflags, type; | |
722 | zfs_ace_hdr_t *zacep = NULL; | |
723 | ace_t *acep = datap; | |
724 | ace_object_t *objacep; | |
725 | zfs_object_ace_t *zobjacep; | |
726 | size_t ace_size; | |
727 | uint16_t entry_type; | |
728 | ||
729 | while ((zacep = zfs_acl_next_ace(aclp, zacep, | |
730 | &who, &access_mask, &iflags, &type))) { | |
731 | ||
732 | switch (type) { | |
733 | case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: | |
734 | case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: | |
735 | case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: | |
736 | case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: | |
737 | if (filter) { | |
738 | continue; | |
739 | } | |
740 | zobjacep = (zfs_object_ace_t *)zacep; | |
741 | objacep = (ace_object_t *)acep; | |
742 | bcopy(zobjacep->z_object_type, | |
743 | objacep->a_obj_type, | |
744 | sizeof (zobjacep->z_object_type)); | |
745 | bcopy(zobjacep->z_inherit_type, | |
746 | objacep->a_inherit_obj_type, | |
747 | sizeof (zobjacep->z_inherit_type)); | |
748 | ace_size = sizeof (ace_object_t); | |
749 | break; | |
750 | default: | |
751 | ace_size = sizeof (ace_t); | |
752 | break; | |
753 | } | |
754 | ||
755 | entry_type = (iflags & ACE_TYPE_FLAGS); | |
756 | if ((entry_type != ACE_OWNER && | |
757 | entry_type != OWNING_GROUP && | |
758 | entry_type != ACE_EVERYONE)) { | |
759 | acep->a_who = zfs_fuid_map_id(zfsvfs, who, | |
760 | cr, (entry_type & ACE_IDENTIFIER_GROUP) ? | |
761 | ZFS_ACE_GROUP : ZFS_ACE_USER); | |
762 | } else { | |
763 | acep->a_who = (uid_t)(int64_t)who; | |
764 | } | |
765 | acep->a_access_mask = access_mask; | |
766 | acep->a_flags = iflags; | |
767 | acep->a_type = type; | |
768 | acep = (ace_t *)((caddr_t)acep + ace_size); | |
769 | } | |
770 | } | |
771 | ||
772 | static int | |
773 | zfs_copy_ace_2_oldace(vtype_t obj_type, zfs_acl_t *aclp, ace_t *acep, | |
774 | zfs_oldace_t *z_acl, int aclcnt, size_t *size) | |
775 | { | |
776 | int i; | |
777 | zfs_oldace_t *aceptr = z_acl; | |
778 | ||
779 | for (i = 0; i != aclcnt; i++, aceptr++) { | |
780 | aceptr->z_access_mask = acep[i].a_access_mask; | |
781 | aceptr->z_type = acep[i].a_type; | |
782 | aceptr->z_flags = acep[i].a_flags; | |
783 | aceptr->z_fuid = acep[i].a_who; | |
784 | /* | |
785 | * Make sure ACE is valid | |
786 | */ | |
787 | if (zfs_ace_valid(obj_type, aclp, aceptr->z_type, | |
788 | aceptr->z_flags) != B_TRUE) | |
789 | return (SET_ERROR(EINVAL)); | |
790 | } | |
791 | *size = (caddr_t)aceptr - (caddr_t)z_acl; | |
792 | return (0); | |
793 | } | |
794 | ||
795 | /* | |
796 | * convert old ACL format to new | |
797 | */ | |
798 | void | |
799 | zfs_acl_xform(znode_t *zp, zfs_acl_t *aclp, cred_t *cr) | |
800 | { | |
801 | zfs_oldace_t *oldaclp; | |
802 | int i; | |
803 | uint16_t type, iflags; | |
804 | uint32_t access_mask; | |
805 | uint64_t who; | |
806 | void *cookie = NULL; | |
807 | zfs_acl_node_t *newaclnode; | |
808 | ||
e4efb709 | 809 | ASSERT3U(aclp->z_version, ==, ZFS_ACL_VERSION_INITIAL); |
9f0a21e6 MM |
810 | /* |
811 | * First create the ACE in a contiguous piece of memory | |
812 | * for zfs_copy_ace_2_fuid(). | |
813 | * | |
814 | * We only convert an ACL once, so this won't happen | |
815 | * everytime. | |
816 | */ | |
817 | oldaclp = kmem_alloc(sizeof (zfs_oldace_t) * aclp->z_acl_count, | |
818 | KM_SLEEP); | |
819 | i = 0; | |
820 | while ((cookie = zfs_acl_next_ace(aclp, cookie, &who, | |
821 | &access_mask, &iflags, &type))) { | |
822 | oldaclp[i].z_flags = iflags; | |
823 | oldaclp[i].z_type = type; | |
824 | oldaclp[i].z_fuid = who; | |
825 | oldaclp[i++].z_access_mask = access_mask; | |
826 | } | |
827 | ||
828 | newaclnode = zfs_acl_node_alloc(aclp->z_acl_count * | |
829 | sizeof (zfs_object_ace_t)); | |
830 | aclp->z_ops = &zfs_acl_fuid_ops; | |
e4efb709 | 831 | VERIFY0(zfs_copy_ace_2_fuid(zp->z_zfsvfs, ZTOV(zp)->v_type, aclp, |
9f0a21e6 | 832 | oldaclp, newaclnode->z_acldata, aclp->z_acl_count, |
e4efb709 | 833 | &newaclnode->z_size, NULL, cr)); |
9f0a21e6 MM |
834 | newaclnode->z_ace_count = aclp->z_acl_count; |
835 | aclp->z_version = ZFS_ACL_VERSION; | |
836 | kmem_free(oldaclp, aclp->z_acl_count * sizeof (zfs_oldace_t)); | |
837 | ||
838 | /* | |
839 | * Release all previous ACL nodes | |
840 | */ | |
841 | ||
842 | zfs_acl_release_nodes(aclp); | |
843 | ||
844 | list_insert_head(&aclp->z_acl, newaclnode); | |
845 | ||
846 | aclp->z_acl_bytes = newaclnode->z_size; | |
847 | aclp->z_acl_count = newaclnode->z_ace_count; | |
848 | ||
849 | } | |
850 | ||
851 | /* | |
852 | * Convert unix access mask to v4 access mask | |
853 | */ | |
854 | static uint32_t | |
855 | zfs_unix_to_v4(uint32_t access_mask) | |
856 | { | |
857 | uint32_t new_mask = 0; | |
858 | ||
859 | if (access_mask & S_IXOTH) | |
860 | new_mask |= ACE_EXECUTE; | |
861 | if (access_mask & S_IWOTH) | |
862 | new_mask |= ACE_WRITE_DATA; | |
863 | if (access_mask & S_IROTH) | |
864 | new_mask |= ACE_READ_DATA; | |
865 | return (new_mask); | |
866 | } | |
867 | ||
868 | static void | |
869 | zfs_set_ace(zfs_acl_t *aclp, void *acep, uint32_t access_mask, | |
870 | uint16_t access_type, uint64_t fuid, uint16_t entry_type) | |
871 | { | |
872 | uint16_t type = entry_type & ACE_TYPE_FLAGS; | |
873 | ||
874 | aclp->z_ops->ace_mask_set(acep, access_mask); | |
875 | aclp->z_ops->ace_type_set(acep, access_type); | |
876 | aclp->z_ops->ace_flags_set(acep, entry_type); | |
877 | if ((type != ACE_OWNER && type != OWNING_GROUP && | |
878 | type != ACE_EVERYONE)) | |
879 | aclp->z_ops->ace_who_set(acep, fuid); | |
880 | } | |
881 | ||
882 | /* | |
883 | * Determine mode of file based on ACL. | |
884 | */ | |
885 | uint64_t | |
886 | zfs_mode_compute(uint64_t fmode, zfs_acl_t *aclp, | |
887 | uint64_t *pflags, uint64_t fuid, uint64_t fgid) | |
888 | { | |
889 | int entry_type; | |
890 | mode_t mode; | |
891 | mode_t seen = 0; | |
892 | zfs_ace_hdr_t *acep = NULL; | |
893 | uint64_t who; | |
894 | uint16_t iflags, type; | |
895 | uint32_t access_mask; | |
896 | boolean_t an_exec_denied = B_FALSE; | |
897 | ||
898 | mode = (fmode & (S_IFMT | S_ISUID | S_ISGID | S_ISVTX)); | |
899 | ||
900 | while ((acep = zfs_acl_next_ace(aclp, acep, &who, | |
901 | &access_mask, &iflags, &type))) { | |
902 | ||
903 | if (!zfs_acl_valid_ace_type(type, iflags)) | |
904 | continue; | |
905 | ||
906 | entry_type = (iflags & ACE_TYPE_FLAGS); | |
907 | ||
908 | /* | |
909 | * Skip over any inherit_only ACEs | |
910 | */ | |
911 | if (iflags & ACE_INHERIT_ONLY_ACE) | |
912 | continue; | |
913 | ||
914 | if (entry_type == ACE_OWNER || (entry_type == 0 && | |
915 | who == fuid)) { | |
916 | if ((access_mask & ACE_READ_DATA) && | |
917 | (!(seen & S_IRUSR))) { | |
918 | seen |= S_IRUSR; | |
919 | if (type == ALLOW) { | |
920 | mode |= S_IRUSR; | |
921 | } | |
922 | } | |
923 | if ((access_mask & ACE_WRITE_DATA) && | |
924 | (!(seen & S_IWUSR))) { | |
925 | seen |= S_IWUSR; | |
926 | if (type == ALLOW) { | |
927 | mode |= S_IWUSR; | |
928 | } | |
929 | } | |
930 | if ((access_mask & ACE_EXECUTE) && | |
931 | (!(seen & S_IXUSR))) { | |
932 | seen |= S_IXUSR; | |
933 | if (type == ALLOW) { | |
934 | mode |= S_IXUSR; | |
935 | } | |
936 | } | |
937 | } else if (entry_type == OWNING_GROUP || | |
938 | (entry_type == ACE_IDENTIFIER_GROUP && who == fgid)) { | |
939 | if ((access_mask & ACE_READ_DATA) && | |
940 | (!(seen & S_IRGRP))) { | |
941 | seen |= S_IRGRP; | |
942 | if (type == ALLOW) { | |
943 | mode |= S_IRGRP; | |
944 | } | |
945 | } | |
946 | if ((access_mask & ACE_WRITE_DATA) && | |
947 | (!(seen & S_IWGRP))) { | |
948 | seen |= S_IWGRP; | |
949 | if (type == ALLOW) { | |
950 | mode |= S_IWGRP; | |
951 | } | |
952 | } | |
953 | if ((access_mask & ACE_EXECUTE) && | |
954 | (!(seen & S_IXGRP))) { | |
955 | seen |= S_IXGRP; | |
956 | if (type == ALLOW) { | |
957 | mode |= S_IXGRP; | |
958 | } | |
959 | } | |
960 | } else if (entry_type == ACE_EVERYONE) { | |
961 | if ((access_mask & ACE_READ_DATA)) { | |
962 | if (!(seen & S_IRUSR)) { | |
963 | seen |= S_IRUSR; | |
964 | if (type == ALLOW) { | |
965 | mode |= S_IRUSR; | |
966 | } | |
967 | } | |
968 | if (!(seen & S_IRGRP)) { | |
969 | seen |= S_IRGRP; | |
970 | if (type == ALLOW) { | |
971 | mode |= S_IRGRP; | |
972 | } | |
973 | } | |
974 | if (!(seen & S_IROTH)) { | |
975 | seen |= S_IROTH; | |
976 | if (type == ALLOW) { | |
977 | mode |= S_IROTH; | |
978 | } | |
979 | } | |
980 | } | |
981 | if ((access_mask & ACE_WRITE_DATA)) { | |
982 | if (!(seen & S_IWUSR)) { | |
983 | seen |= S_IWUSR; | |
984 | if (type == ALLOW) { | |
985 | mode |= S_IWUSR; | |
986 | } | |
987 | } | |
988 | if (!(seen & S_IWGRP)) { | |
989 | seen |= S_IWGRP; | |
990 | if (type == ALLOW) { | |
991 | mode |= S_IWGRP; | |
992 | } | |
993 | } | |
994 | if (!(seen & S_IWOTH)) { | |
995 | seen |= S_IWOTH; | |
996 | if (type == ALLOW) { | |
997 | mode |= S_IWOTH; | |
998 | } | |
999 | } | |
1000 | } | |
1001 | if ((access_mask & ACE_EXECUTE)) { | |
1002 | if (!(seen & S_IXUSR)) { | |
1003 | seen |= S_IXUSR; | |
1004 | if (type == ALLOW) { | |
1005 | mode |= S_IXUSR; | |
1006 | } | |
1007 | } | |
1008 | if (!(seen & S_IXGRP)) { | |
1009 | seen |= S_IXGRP; | |
1010 | if (type == ALLOW) { | |
1011 | mode |= S_IXGRP; | |
1012 | } | |
1013 | } | |
1014 | if (!(seen & S_IXOTH)) { | |
1015 | seen |= S_IXOTH; | |
1016 | if (type == ALLOW) { | |
1017 | mode |= S_IXOTH; | |
1018 | } | |
1019 | } | |
1020 | } | |
1021 | } else { | |
1022 | /* | |
1023 | * Only care if this IDENTIFIER_GROUP or | |
1024 | * USER ACE denies execute access to someone, | |
1025 | * mode is not affected | |
1026 | */ | |
1027 | if ((access_mask & ACE_EXECUTE) && type == DENY) | |
1028 | an_exec_denied = B_TRUE; | |
1029 | } | |
1030 | } | |
1031 | ||
1032 | /* | |
1033 | * Failure to allow is effectively a deny, so execute permission | |
1034 | * is denied if it was never mentioned or if we explicitly | |
1035 | * weren't allowed it. | |
1036 | */ | |
1037 | if (!an_exec_denied && | |
1038 | ((seen & ALL_MODE_EXECS) != ALL_MODE_EXECS || | |
1039 | (mode & ALL_MODE_EXECS) != ALL_MODE_EXECS)) | |
1040 | an_exec_denied = B_TRUE; | |
1041 | ||
1042 | if (an_exec_denied) | |
1043 | *pflags &= ~ZFS_NO_EXECS_DENIED; | |
1044 | else | |
1045 | *pflags |= ZFS_NO_EXECS_DENIED; | |
1046 | ||
1047 | return (mode); | |
1048 | } | |
1049 | ||
1050 | /* | |
1051 | * Read an external acl object. If the intent is to modify, always | |
1052 | * create a new acl and leave any cached acl in place. | |
1053 | */ | |
1054 | int | |
1055 | zfs_acl_node_read(znode_t *zp, boolean_t have_lock, zfs_acl_t **aclpp, | |
1056 | boolean_t will_modify) | |
1057 | { | |
1058 | zfs_acl_t *aclp; | |
1059 | int aclsize; | |
1060 | int acl_count; | |
1061 | zfs_acl_node_t *aclnode; | |
1062 | zfs_acl_phys_t znode_acl; | |
1063 | int version; | |
1064 | int error; | |
1065 | ||
1066 | ASSERT(MUTEX_HELD(&zp->z_acl_lock)); | |
1067 | if (zp->z_zfsvfs->z_replay == B_FALSE) | |
1068 | ASSERT_VOP_LOCKED(ZTOV(zp), __func__); | |
1069 | ||
1070 | if (zp->z_acl_cached && !will_modify) { | |
1071 | *aclpp = zp->z_acl_cached; | |
1072 | return (0); | |
1073 | } | |
1074 | ||
1075 | version = zfs_znode_acl_version(zp); | |
1076 | ||
1077 | if ((error = zfs_acl_znode_info(zp, &aclsize, | |
1078 | &acl_count, &znode_acl)) != 0) { | |
1079 | goto done; | |
1080 | } | |
1081 | ||
1082 | aclp = zfs_acl_alloc(version); | |
1083 | ||
1084 | aclp->z_acl_count = acl_count; | |
1085 | aclp->z_acl_bytes = aclsize; | |
1086 | ||
1087 | aclnode = zfs_acl_node_alloc(aclsize); | |
1088 | aclnode->z_ace_count = aclp->z_acl_count; | |
1089 | aclnode->z_size = aclsize; | |
1090 | ||
1091 | if (!zp->z_is_sa) { | |
1092 | if (znode_acl.z_acl_extern_obj) { | |
1093 | error = dmu_read(zp->z_zfsvfs->z_os, | |
1094 | znode_acl.z_acl_extern_obj, 0, aclnode->z_size, | |
1095 | aclnode->z_acldata, DMU_READ_PREFETCH); | |
1096 | } else { | |
1097 | bcopy(znode_acl.z_ace_data, aclnode->z_acldata, | |
1098 | aclnode->z_size); | |
1099 | } | |
1100 | } else { | |
1101 | error = sa_lookup(zp->z_sa_hdl, SA_ZPL_DACL_ACES(zp->z_zfsvfs), | |
1102 | aclnode->z_acldata, aclnode->z_size); | |
1103 | } | |
1104 | ||
1105 | if (error != 0) { | |
1106 | zfs_acl_free(aclp); | |
1107 | zfs_acl_node_free(aclnode); | |
1108 | /* convert checksum errors into IO errors */ | |
1109 | if (error == ECKSUM) | |
1110 | error = SET_ERROR(EIO); | |
1111 | goto done; | |
1112 | } | |
1113 | ||
1114 | list_insert_head(&aclp->z_acl, aclnode); | |
1115 | ||
1116 | *aclpp = aclp; | |
1117 | if (!will_modify) | |
1118 | zp->z_acl_cached = aclp; | |
1119 | done: | |
1120 | return (error); | |
1121 | } | |
1122 | ||
1123 | /*ARGSUSED*/ | |
1124 | void | |
1125 | zfs_acl_data_locator(void **dataptr, uint32_t *length, uint32_t buflen, | |
1126 | boolean_t start, void *userdata) | |
1127 | { | |
1128 | zfs_acl_locator_cb_t *cb = (zfs_acl_locator_cb_t *)userdata; | |
1129 | ||
1130 | if (start) { | |
1131 | cb->cb_acl_node = list_head(&cb->cb_aclp->z_acl); | |
1132 | } else { | |
1133 | cb->cb_acl_node = list_next(&cb->cb_aclp->z_acl, | |
1134 | cb->cb_acl_node); | |
1135 | } | |
1136 | *dataptr = cb->cb_acl_node->z_acldata; | |
1137 | *length = cb->cb_acl_node->z_size; | |
1138 | } | |
1139 | ||
1140 | int | |
1141 | zfs_acl_chown_setattr(znode_t *zp) | |
1142 | { | |
1143 | int error; | |
1144 | zfs_acl_t *aclp; | |
1145 | ||
2f385c91 | 1146 | if (zp->z_zfsvfs->z_replay == B_FALSE) { |
9f0a21e6 | 1147 | ASSERT_VOP_ELOCKED(ZTOV(zp), __func__); |
2f385c91 MG |
1148 | ASSERT_VOP_IN_SEQC(ZTOV(zp)); |
1149 | } | |
9f0a21e6 MM |
1150 | ASSERT(MUTEX_HELD(&zp->z_acl_lock)); |
1151 | ||
1152 | if ((error = zfs_acl_node_read(zp, B_TRUE, &aclp, B_FALSE)) == 0) | |
1153 | zp->z_mode = zfs_mode_compute(zp->z_mode, aclp, | |
1154 | &zp->z_pflags, zp->z_uid, zp->z_gid); | |
1155 | return (error); | |
1156 | } | |
1157 | ||
1158 | /* | |
1159 | * common code for setting ACLs. | |
1160 | * | |
1161 | * This function is called from zfs_mode_update, zfs_perm_init, and zfs_setacl. | |
1162 | * zfs_setacl passes a non-NULL inherit pointer (ihp) to indicate that it's | |
1163 | * already checked the acl and knows whether to inherit. | |
1164 | */ | |
1165 | int | |
1166 | zfs_aclset_common(znode_t *zp, zfs_acl_t *aclp, cred_t *cr, dmu_tx_t *tx) | |
1167 | { | |
1168 | int error; | |
1169 | zfsvfs_t *zfsvfs = zp->z_zfsvfs; | |
1170 | dmu_object_type_t otype; | |
1171 | zfs_acl_locator_cb_t locate = { 0 }; | |
1172 | uint64_t mode; | |
1173 | sa_bulk_attr_t bulk[5]; | |
1174 | uint64_t ctime[2]; | |
1175 | int count = 0; | |
1176 | zfs_acl_phys_t acl_phys; | |
1177 | ||
2f385c91 MG |
1178 | if (zp->z_zfsvfs->z_replay == B_FALSE) { |
1179 | ASSERT_VOP_IN_SEQC(ZTOV(zp)); | |
1180 | } | |
1b376d17 | 1181 | |
9f0a21e6 MM |
1182 | mode = zp->z_mode; |
1183 | ||
1184 | mode = zfs_mode_compute(mode, aclp, &zp->z_pflags, | |
1185 | zp->z_uid, zp->z_gid); | |
1186 | ||
1187 | zp->z_mode = mode; | |
1188 | SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_MODE(zfsvfs), NULL, | |
1189 | &mode, sizeof (mode)); | |
1190 | SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_FLAGS(zfsvfs), NULL, | |
1191 | &zp->z_pflags, sizeof (zp->z_pflags)); | |
1192 | SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_CTIME(zfsvfs), NULL, | |
1193 | &ctime, sizeof (ctime)); | |
1194 | ||
1195 | if (zp->z_acl_cached) { | |
1196 | zfs_acl_free(zp->z_acl_cached); | |
1197 | zp->z_acl_cached = NULL; | |
1198 | } | |
1199 | ||
1200 | /* | |
1201 | * Upgrade needed? | |
1202 | */ | |
1203 | if (!zfsvfs->z_use_fuids) { | |
1204 | otype = DMU_OT_OLDACL; | |
1205 | } else { | |
1206 | if ((aclp->z_version == ZFS_ACL_VERSION_INITIAL) && | |
1207 | (zfsvfs->z_version >= ZPL_VERSION_FUID)) | |
1208 | zfs_acl_xform(zp, aclp, cr); | |
e4efb709 | 1209 | ASSERT3U(aclp->z_version, >=, ZFS_ACL_VERSION_FUID); |
9f0a21e6 MM |
1210 | otype = DMU_OT_ACL; |
1211 | } | |
1212 | ||
1213 | /* | |
1214 | * Arrgh, we have to handle old on disk format | |
1215 | * as well as newer (preferred) SA format. | |
1216 | */ | |
1217 | ||
1218 | if (zp->z_is_sa) { /* the easy case, just update the ACL attribute */ | |
1219 | locate.cb_aclp = aclp; | |
1220 | SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_DACL_ACES(zfsvfs), | |
1221 | zfs_acl_data_locator, &locate, aclp->z_acl_bytes); | |
1222 | SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_DACL_COUNT(zfsvfs), | |
1223 | NULL, &aclp->z_acl_count, sizeof (uint64_t)); | |
1224 | } else { /* Painful legacy way */ | |
1225 | zfs_acl_node_t *aclnode; | |
1226 | uint64_t off = 0; | |
1227 | uint64_t aoid; | |
1228 | ||
1229 | if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_ZNODE_ACL(zfsvfs), | |
1230 | &acl_phys, sizeof (acl_phys))) != 0) | |
1231 | return (error); | |
1232 | ||
1233 | aoid = acl_phys.z_acl_extern_obj; | |
1234 | ||
1235 | if (aclp->z_acl_bytes > ZFS_ACE_SPACE) { | |
1236 | /* | |
1237 | * If ACL was previously external and we are now | |
1238 | * converting to new ACL format then release old | |
1239 | * ACL object and create a new one. | |
1240 | */ | |
1241 | if (aoid && | |
1242 | aclp->z_version != acl_phys.z_acl_version) { | |
1243 | error = dmu_object_free(zfsvfs->z_os, aoid, tx); | |
1244 | if (error) | |
1245 | return (error); | |
1246 | aoid = 0; | |
1247 | } | |
1248 | if (aoid == 0) { | |
1249 | aoid = dmu_object_alloc(zfsvfs->z_os, | |
1250 | otype, aclp->z_acl_bytes, | |
1251 | otype == DMU_OT_ACL ? | |
1252 | DMU_OT_SYSACL : DMU_OT_NONE, | |
1253 | otype == DMU_OT_ACL ? | |
1254 | DN_OLD_MAX_BONUSLEN : 0, tx); | |
1255 | } else { | |
1256 | (void) dmu_object_set_blocksize(zfsvfs->z_os, | |
1257 | aoid, aclp->z_acl_bytes, 0, tx); | |
1258 | } | |
1259 | acl_phys.z_acl_extern_obj = aoid; | |
1260 | for (aclnode = list_head(&aclp->z_acl); aclnode; | |
1261 | aclnode = list_next(&aclp->z_acl, aclnode)) { | |
1262 | if (aclnode->z_ace_count == 0) | |
1263 | continue; | |
1264 | dmu_write(zfsvfs->z_os, aoid, off, | |
1265 | aclnode->z_size, aclnode->z_acldata, tx); | |
1266 | off += aclnode->z_size; | |
1267 | } | |
1268 | } else { | |
1269 | void *start = acl_phys.z_ace_data; | |
1270 | /* | |
1271 | * Migrating back embedded? | |
1272 | */ | |
1273 | if (acl_phys.z_acl_extern_obj) { | |
1274 | error = dmu_object_free(zfsvfs->z_os, | |
1275 | acl_phys.z_acl_extern_obj, tx); | |
1276 | if (error) | |
1277 | return (error); | |
1278 | acl_phys.z_acl_extern_obj = 0; | |
1279 | } | |
1280 | ||
1281 | for (aclnode = list_head(&aclp->z_acl); aclnode; | |
1282 | aclnode = list_next(&aclp->z_acl, aclnode)) { | |
1283 | if (aclnode->z_ace_count == 0) | |
1284 | continue; | |
1285 | bcopy(aclnode->z_acldata, start, | |
1286 | aclnode->z_size); | |
1287 | start = (caddr_t)start + aclnode->z_size; | |
1288 | } | |
1289 | } | |
1290 | /* | |
1291 | * If Old version then swap count/bytes to match old | |
1292 | * layout of znode_acl_phys_t. | |
1293 | */ | |
1294 | if (aclp->z_version == ZFS_ACL_VERSION_INITIAL) { | |
1295 | acl_phys.z_acl_size = aclp->z_acl_count; | |
1296 | acl_phys.z_acl_count = aclp->z_acl_bytes; | |
1297 | } else { | |
1298 | acl_phys.z_acl_size = aclp->z_acl_bytes; | |
1299 | acl_phys.z_acl_count = aclp->z_acl_count; | |
1300 | } | |
1301 | acl_phys.z_acl_version = aclp->z_version; | |
1302 | ||
1303 | SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_ZNODE_ACL(zfsvfs), NULL, | |
1304 | &acl_phys, sizeof (acl_phys)); | |
1305 | } | |
1306 | ||
1307 | /* | |
1308 | * Replace ACL wide bits, but first clear them. | |
1309 | */ | |
1310 | zp->z_pflags &= ~ZFS_ACL_WIDE_FLAGS; | |
1311 | ||
1312 | zp->z_pflags |= aclp->z_hints; | |
1313 | ||
1314 | if (ace_trivial_common(aclp, 0, zfs_ace_walk) == 0) | |
1315 | zp->z_pflags |= ZFS_ACL_TRIVIAL; | |
1316 | ||
1317 | zfs_tstamp_update_setup(zp, STATE_CHANGED, NULL, ctime); | |
1318 | return (sa_bulk_update(zp->z_sa_hdl, bulk, count, tx)); | |
1319 | } | |
1320 | ||
1321 | static void | |
1322 | zfs_acl_chmod(vtype_t vtype, uint64_t mode, boolean_t split, boolean_t trim, | |
1323 | zfs_acl_t *aclp) | |
1324 | { | |
1325 | void *acep = NULL; | |
1326 | uint64_t who; | |
1327 | int new_count, new_bytes; | |
1328 | int ace_size; | |
1329 | int entry_type; | |
1330 | uint16_t iflags, type; | |
1331 | uint32_t access_mask; | |
1332 | zfs_acl_node_t *newnode; | |
1333 | size_t abstract_size = aclp->z_ops->ace_abstract_size(); | |
1334 | void *zacep; | |
1335 | boolean_t isdir; | |
1336 | trivial_acl_t masks; | |
1337 | ||
1338 | new_count = new_bytes = 0; | |
1339 | ||
1340 | isdir = (vtype == VDIR); | |
1341 | ||
1342 | acl_trivial_access_masks((mode_t)mode, isdir, &masks); | |
1343 | ||
1344 | newnode = zfs_acl_node_alloc((abstract_size * 6) + aclp->z_acl_bytes); | |
1345 | ||
1346 | zacep = newnode->z_acldata; | |
1347 | if (masks.allow0) { | |
1348 | zfs_set_ace(aclp, zacep, masks.allow0, ALLOW, -1, ACE_OWNER); | |
1349 | zacep = (void *)((uintptr_t)zacep + abstract_size); | |
1350 | new_count++; | |
1351 | new_bytes += abstract_size; | |
1352 | } | |
1353 | if (masks.deny1) { | |
1354 | zfs_set_ace(aclp, zacep, masks.deny1, DENY, -1, ACE_OWNER); | |
1355 | zacep = (void *)((uintptr_t)zacep + abstract_size); | |
1356 | new_count++; | |
1357 | new_bytes += abstract_size; | |
1358 | } | |
1359 | if (masks.deny2) { | |
1360 | zfs_set_ace(aclp, zacep, masks.deny2, DENY, -1, OWNING_GROUP); | |
1361 | zacep = (void *)((uintptr_t)zacep + abstract_size); | |
1362 | new_count++; | |
1363 | new_bytes += abstract_size; | |
1364 | } | |
1365 | ||
1366 | while ((acep = zfs_acl_next_ace(aclp, acep, &who, &access_mask, | |
1367 | &iflags, &type))) { | |
1368 | entry_type = (iflags & ACE_TYPE_FLAGS); | |
1369 | /* | |
1370 | * ACEs used to represent the file mode may be divided | |
1371 | * into an equivalent pair of inherit-only and regular | |
1372 | * ACEs, if they are inheritable. | |
1373 | * Skip regular ACEs, which are replaced by the new mode. | |
1374 | */ | |
1375 | if (split && (entry_type == ACE_OWNER || | |
1376 | entry_type == OWNING_GROUP || | |
1377 | entry_type == ACE_EVERYONE)) { | |
1378 | if (!isdir || !(iflags & | |
1379 | (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE))) | |
1380 | continue; | |
1381 | /* | |
1382 | * We preserve owner@, group@, or @everyone | |
1383 | * permissions, if they are inheritable, by | |
1384 | * copying them to inherit_only ACEs. This | |
1385 | * prevents inheritable permissions from being | |
1386 | * altered along with the file mode. | |
1387 | */ | |
1388 | iflags |= ACE_INHERIT_ONLY_ACE; | |
1389 | } | |
1390 | ||
1391 | /* | |
1392 | * If this ACL has any inheritable ACEs, mark that in | |
1393 | * the hints (which are later masked into the pflags) | |
1394 | * so create knows to do inheritance. | |
1395 | */ | |
1396 | if (isdir && (iflags & | |
1397 | (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE))) | |
1398 | aclp->z_hints |= ZFS_INHERIT_ACE; | |
1399 | ||
1400 | if ((type != ALLOW && type != DENY) || | |
1401 | (iflags & ACE_INHERIT_ONLY_ACE)) { | |
1402 | switch (type) { | |
1403 | case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: | |
1404 | case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: | |
1405 | case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: | |
1406 | case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: | |
1407 | aclp->z_hints |= ZFS_ACL_OBJ_ACE; | |
1408 | break; | |
1409 | } | |
1410 | } else { | |
1411 | /* | |
1412 | * Limit permissions granted by ACEs to be no greater | |
1413 | * than permissions of the requested group mode. | |
1414 | * Applies when the "aclmode" property is set to | |
1415 | * "groupmask". | |
1416 | */ | |
1417 | if ((type == ALLOW) && trim) | |
1418 | access_mask &= masks.group; | |
1419 | } | |
1420 | zfs_set_ace(aclp, zacep, access_mask, type, who, iflags); | |
1421 | ace_size = aclp->z_ops->ace_size(acep); | |
1422 | zacep = (void *)((uintptr_t)zacep + ace_size); | |
1423 | new_count++; | |
1424 | new_bytes += ace_size; | |
1425 | } | |
1426 | zfs_set_ace(aclp, zacep, masks.owner, ALLOW, -1, ACE_OWNER); | |
1427 | zacep = (void *)((uintptr_t)zacep + abstract_size); | |
1428 | zfs_set_ace(aclp, zacep, masks.group, ALLOW, -1, OWNING_GROUP); | |
1429 | zacep = (void *)((uintptr_t)zacep + abstract_size); | |
1430 | zfs_set_ace(aclp, zacep, masks.everyone, ALLOW, -1, ACE_EVERYONE); | |
1431 | ||
1432 | new_count += 3; | |
1433 | new_bytes += abstract_size * 3; | |
1434 | zfs_acl_release_nodes(aclp); | |
1435 | aclp->z_acl_count = new_count; | |
1436 | aclp->z_acl_bytes = new_bytes; | |
1437 | newnode->z_ace_count = new_count; | |
1438 | newnode->z_size = new_bytes; | |
1439 | list_insert_tail(&aclp->z_acl, newnode); | |
1440 | } | |
1441 | ||
1442 | int | |
1443 | zfs_acl_chmod_setattr(znode_t *zp, zfs_acl_t **aclp, uint64_t mode) | |
1444 | { | |
1445 | int error = 0; | |
1446 | ||
1447 | mutex_enter(&zp->z_acl_lock); | |
1448 | if (zp->z_zfsvfs->z_replay == B_FALSE) | |
1449 | ASSERT_VOP_ELOCKED(ZTOV(zp), __func__); | |
1450 | if (zp->z_zfsvfs->z_acl_mode == ZFS_ACL_DISCARD) | |
1451 | *aclp = zfs_acl_alloc(zfs_acl_version_zp(zp)); | |
1452 | else | |
1453 | error = zfs_acl_node_read(zp, B_TRUE, aclp, B_TRUE); | |
1454 | ||
1455 | if (error == 0) { | |
1456 | (*aclp)->z_hints = zp->z_pflags & V4_ACL_WIDE_FLAGS; | |
1457 | zfs_acl_chmod(ZTOV(zp)->v_type, mode, B_TRUE, | |
1458 | (zp->z_zfsvfs->z_acl_mode == ZFS_ACL_GROUPMASK), *aclp); | |
1459 | } | |
1460 | mutex_exit(&zp->z_acl_lock); | |
1461 | ||
1462 | return (error); | |
1463 | } | |
1464 | ||
1465 | /* | |
1466 | * Should ACE be inherited? | |
1467 | */ | |
1468 | static int | |
1469 | zfs_ace_can_use(vtype_t vtype, uint16_t acep_flags) | |
1470 | { | |
1471 | int iflags = (acep_flags & 0xf); | |
1472 | ||
1473 | if ((vtype == VDIR) && (iflags & ACE_DIRECTORY_INHERIT_ACE)) | |
1474 | return (1); | |
1475 | else if (iflags & ACE_FILE_INHERIT_ACE) | |
1476 | return (!((vtype == VDIR) && | |
1477 | (iflags & ACE_NO_PROPAGATE_INHERIT_ACE))); | |
1478 | return (0); | |
1479 | } | |
1480 | ||
1481 | /* | |
1482 | * inherit inheritable ACEs from parent | |
1483 | */ | |
1484 | static zfs_acl_t * | |
1485 | zfs_acl_inherit(zfsvfs_t *zfsvfs, vtype_t vtype, zfs_acl_t *paclp, | |
1486 | uint64_t mode, boolean_t *need_chmod) | |
1487 | { | |
1488 | void *pacep = NULL; | |
1489 | void *acep; | |
1490 | zfs_acl_node_t *aclnode; | |
1491 | zfs_acl_t *aclp = NULL; | |
1492 | uint64_t who; | |
1493 | uint32_t access_mask; | |
1494 | uint16_t iflags, newflags, type; | |
1495 | size_t ace_size; | |
1496 | void *data1, *data2; | |
1497 | size_t data1sz, data2sz; | |
1498 | uint_t aclinherit; | |
1499 | boolean_t isdir = (vtype == VDIR); | |
1500 | boolean_t isreg = (vtype == VREG); | |
1501 | ||
1502 | *need_chmod = B_TRUE; | |
1503 | ||
1504 | aclp = zfs_acl_alloc(paclp->z_version); | |
1505 | aclinherit = zfsvfs->z_acl_inherit; | |
1506 | if (aclinherit == ZFS_ACL_DISCARD || vtype == VLNK) | |
1507 | return (aclp); | |
1508 | ||
1509 | while ((pacep = zfs_acl_next_ace(paclp, pacep, &who, | |
1510 | &access_mask, &iflags, &type))) { | |
1511 | ||
1512 | /* | |
1513 | * don't inherit bogus ACEs | |
1514 | */ | |
1515 | if (!zfs_acl_valid_ace_type(type, iflags)) | |
1516 | continue; | |
1517 | ||
1518 | /* | |
1519 | * Check if ACE is inheritable by this vnode | |
1520 | */ | |
1521 | if ((aclinherit == ZFS_ACL_NOALLOW && type == ALLOW) || | |
1522 | !zfs_ace_can_use(vtype, iflags)) | |
1523 | continue; | |
1524 | ||
1525 | /* | |
1526 | * If owner@, group@, or everyone@ inheritable | |
1527 | * then zfs_acl_chmod() isn't needed. | |
1528 | */ | |
1529 | if ((aclinherit == ZFS_ACL_PASSTHROUGH || | |
1530 | aclinherit == ZFS_ACL_PASSTHROUGH_X) && | |
1531 | ((iflags & (ACE_OWNER|ACE_EVERYONE)) || | |
1532 | ((iflags & OWNING_GROUP) == OWNING_GROUP)) && | |
1533 | (isreg || (isdir && (iflags & ACE_DIRECTORY_INHERIT_ACE)))) | |
1534 | *need_chmod = B_FALSE; | |
1535 | ||
1536 | /* | |
1537 | * Strip inherited execute permission from file if | |
1538 | * not in mode | |
1539 | */ | |
1540 | if (aclinherit == ZFS_ACL_PASSTHROUGH_X && type == ALLOW && | |
1541 | !isdir && ((mode & (S_IXUSR|S_IXGRP|S_IXOTH)) == 0)) { | |
1542 | access_mask &= ~ACE_EXECUTE; | |
1543 | } | |
1544 | ||
1545 | /* | |
1546 | * Strip write_acl and write_owner from permissions | |
1547 | * when inheriting an ACE | |
1548 | */ | |
1549 | if (aclinherit == ZFS_ACL_RESTRICTED && type == ALLOW) { | |
1550 | access_mask &= ~RESTRICTED_CLEAR; | |
1551 | } | |
1552 | ||
1553 | ace_size = aclp->z_ops->ace_size(pacep); | |
1554 | aclnode = zfs_acl_node_alloc(ace_size); | |
1555 | list_insert_tail(&aclp->z_acl, aclnode); | |
1556 | acep = aclnode->z_acldata; | |
1557 | ||
1558 | zfs_set_ace(aclp, acep, access_mask, type, | |
1559 | who, iflags|ACE_INHERITED_ACE); | |
1560 | ||
1561 | /* | |
1562 | * Copy special opaque data if any | |
1563 | */ | |
1564 | if ((data1sz = paclp->z_ops->ace_data(pacep, &data1)) != 0) { | |
e4efb709 RM |
1565 | data2sz = aclp->z_ops->ace_data(acep, &data2); |
1566 | VERIFY3U(data2sz, ==, data1sz); | |
9f0a21e6 MM |
1567 | bcopy(data1, data2, data2sz); |
1568 | } | |
1569 | ||
1570 | aclp->z_acl_count++; | |
1571 | aclnode->z_ace_count++; | |
1572 | aclp->z_acl_bytes += aclnode->z_size; | |
1573 | newflags = aclp->z_ops->ace_flags_get(acep); | |
1574 | ||
1575 | /* | |
1576 | * If ACE is not to be inherited further, or if the vnode is | |
1577 | * not a directory, remove all inheritance flags | |
1578 | */ | |
1579 | if (!isdir || (iflags & ACE_NO_PROPAGATE_INHERIT_ACE)) { | |
1580 | newflags &= ~ALL_INHERIT; | |
1581 | aclp->z_ops->ace_flags_set(acep, | |
1582 | newflags|ACE_INHERITED_ACE); | |
1583 | continue; | |
1584 | } | |
1585 | ||
1586 | /* | |
1587 | * This directory has an inheritable ACE | |
1588 | */ | |
1589 | aclp->z_hints |= ZFS_INHERIT_ACE; | |
1590 | ||
1591 | /* | |
1592 | * If only FILE_INHERIT is set then turn on | |
1593 | * inherit_only | |
1594 | */ | |
1595 | if ((iflags & (ACE_FILE_INHERIT_ACE | | |
1596 | ACE_DIRECTORY_INHERIT_ACE)) == ACE_FILE_INHERIT_ACE) { | |
1597 | newflags |= ACE_INHERIT_ONLY_ACE; | |
1598 | aclp->z_ops->ace_flags_set(acep, | |
1599 | newflags|ACE_INHERITED_ACE); | |
1600 | } else { | |
1601 | newflags &= ~ACE_INHERIT_ONLY_ACE; | |
1602 | aclp->z_ops->ace_flags_set(acep, | |
1603 | newflags|ACE_INHERITED_ACE); | |
1604 | } | |
1605 | } | |
a741b386 AW |
1606 | if (zfsvfs->z_acl_mode == ZFS_ACL_RESTRICTED && |
1607 | aclp->z_acl_count != 0) { | |
1608 | *need_chmod = B_FALSE; | |
1609 | } | |
9f0a21e6 MM |
1610 | |
1611 | return (aclp); | |
1612 | } | |
1613 | ||
1614 | /* | |
1615 | * Create file system object initial permissions | |
1616 | * including inheritable ACEs. | |
1617 | * Also, create FUIDs for owner and group. | |
1618 | */ | |
1619 | int | |
1620 | zfs_acl_ids_create(znode_t *dzp, int flag, vattr_t *vap, cred_t *cr, | |
1621 | vsecattr_t *vsecp, zfs_acl_ids_t *acl_ids) | |
1622 | { | |
1623 | int error; | |
1624 | zfsvfs_t *zfsvfs = dzp->z_zfsvfs; | |
1625 | zfs_acl_t *paclp; | |
1626 | gid_t gid; | |
1627 | boolean_t need_chmod = B_TRUE; | |
1628 | boolean_t trim = B_FALSE; | |
1629 | boolean_t inherited = B_FALSE; | |
1630 | ||
1631 | if ((flag & IS_ROOT_NODE) == 0) { | |
1632 | if (zfsvfs->z_replay == B_FALSE) | |
1633 | ASSERT_VOP_ELOCKED(ZTOV(dzp), __func__); | |
1634 | } else | |
e4efb709 | 1635 | ASSERT3P(dzp->z_vnode, ==, NULL); |
9f0a21e6 MM |
1636 | bzero(acl_ids, sizeof (zfs_acl_ids_t)); |
1637 | acl_ids->z_mode = MAKEIMODE(vap->va_type, vap->va_mode); | |
1638 | ||
1639 | if (vsecp) | |
1640 | if ((error = zfs_vsec_2_aclp(zfsvfs, vap->va_type, vsecp, cr, | |
1641 | &acl_ids->z_fuidp, &acl_ids->z_aclp)) != 0) | |
1642 | return (error); | |
1643 | /* | |
1644 | * Determine uid and gid. | |
1645 | */ | |
1646 | if ((flag & IS_ROOT_NODE) || zfsvfs->z_replay || | |
1647 | ((flag & IS_XATTR) && (vap->va_type == VDIR))) { | |
1648 | acl_ids->z_fuid = zfs_fuid_create(zfsvfs, | |
1649 | (uint64_t)vap->va_uid, cr, | |
1650 | ZFS_OWNER, &acl_ids->z_fuidp); | |
1651 | acl_ids->z_fgid = zfs_fuid_create(zfsvfs, | |
1652 | (uint64_t)vap->va_gid, cr, | |
1653 | ZFS_GROUP, &acl_ids->z_fuidp); | |
1654 | gid = vap->va_gid; | |
1655 | } else { | |
1656 | acl_ids->z_fuid = zfs_fuid_create_cred(zfsvfs, ZFS_OWNER, | |
1657 | cr, &acl_ids->z_fuidp); | |
1658 | acl_ids->z_fgid = 0; | |
1659 | if (vap->va_mask & AT_GID) { | |
1660 | acl_ids->z_fgid = zfs_fuid_create(zfsvfs, | |
1661 | (uint64_t)vap->va_gid, | |
1662 | cr, ZFS_GROUP, &acl_ids->z_fuidp); | |
1663 | gid = vap->va_gid; | |
1664 | if (acl_ids->z_fgid != dzp->z_gid && | |
1665 | !groupmember(vap->va_gid, cr) && | |
1666 | secpolicy_vnode_create_gid(cr) != 0) | |
1667 | acl_ids->z_fgid = 0; | |
1668 | } | |
1669 | if (acl_ids->z_fgid == 0) { | |
cfdc432e MM |
1670 | char *domain; |
1671 | uint32_t rid; | |
1672 | ||
1673 | acl_ids->z_fgid = dzp->z_gid; | |
1674 | gid = zfs_fuid_map_id(zfsvfs, acl_ids->z_fgid, | |
1675 | cr, ZFS_GROUP); | |
1676 | ||
1677 | if (zfsvfs->z_use_fuids && | |
1678 | IS_EPHEMERAL(acl_ids->z_fgid)) { | |
1679 | domain = | |
1680 | zfs_fuid_idx_domain(&zfsvfs->z_fuid_idx, | |
1681 | FUID_INDEX(acl_ids->z_fgid)); | |
1682 | rid = FUID_RID(acl_ids->z_fgid); | |
1683 | zfs_fuid_node_add(&acl_ids->z_fuidp, | |
1684 | domain, rid, FUID_INDEX(acl_ids->z_fgid), | |
1685 | acl_ids->z_fgid, ZFS_GROUP); | |
9f0a21e6 MM |
1686 | } |
1687 | } | |
1688 | } | |
1689 | ||
1690 | /* | |
1691 | * If we're creating a directory, and the parent directory has the | |
1692 | * set-GID bit set, set in on the new directory. | |
1693 | * Otherwise, if the user is neither privileged nor a member of the | |
1694 | * file's new group, clear the file's set-GID bit. | |
1695 | */ | |
1696 | ||
1697 | if (!(flag & IS_ROOT_NODE) && (dzp->z_mode & S_ISGID) && | |
1698 | (vap->va_type == VDIR)) { | |
1699 | acl_ids->z_mode |= S_ISGID; | |
1700 | } else { | |
1701 | if ((acl_ids->z_mode & S_ISGID) && | |
1702 | secpolicy_vnode_setids_setgids(ZTOV(dzp), cr, gid) != 0) | |
1703 | acl_ids->z_mode &= ~S_ISGID; | |
1704 | } | |
1705 | ||
1706 | if (acl_ids->z_aclp == NULL) { | |
1707 | mutex_enter(&dzp->z_acl_lock); | |
1708 | if (!(flag & IS_ROOT_NODE) && | |
1709 | (dzp->z_pflags & ZFS_INHERIT_ACE) && | |
1710 | !(dzp->z_pflags & ZFS_XATTR)) { | |
1711 | VERIFY0(zfs_acl_node_read(dzp, B_TRUE, | |
1712 | &paclp, B_FALSE)); | |
1713 | acl_ids->z_aclp = zfs_acl_inherit(zfsvfs, | |
1714 | vap->va_type, paclp, acl_ids->z_mode, &need_chmod); | |
1715 | inherited = B_TRUE; | |
1716 | } else { | |
1717 | acl_ids->z_aclp = | |
1718 | zfs_acl_alloc(zfs_acl_version_zp(dzp)); | |
1719 | acl_ids->z_aclp->z_hints |= ZFS_ACL_TRIVIAL; | |
1720 | } | |
1721 | mutex_exit(&dzp->z_acl_lock); | |
1722 | ||
1723 | if (need_chmod) { | |
1724 | if (vap->va_type == VDIR) | |
1725 | acl_ids->z_aclp->z_hints |= | |
1726 | ZFS_ACL_AUTO_INHERIT; | |
1727 | ||
1728 | if (zfsvfs->z_acl_mode == ZFS_ACL_GROUPMASK && | |
1729 | zfsvfs->z_acl_inherit != ZFS_ACL_PASSTHROUGH && | |
1730 | zfsvfs->z_acl_inherit != ZFS_ACL_PASSTHROUGH_X) | |
1731 | trim = B_TRUE; | |
1732 | zfs_acl_chmod(vap->va_type, acl_ids->z_mode, B_FALSE, | |
1733 | trim, acl_ids->z_aclp); | |
1734 | } | |
1735 | } | |
1736 | ||
1737 | if (inherited || vsecp) { | |
1738 | acl_ids->z_mode = zfs_mode_compute(acl_ids->z_mode, | |
1739 | acl_ids->z_aclp, &acl_ids->z_aclp->z_hints, | |
1740 | acl_ids->z_fuid, acl_ids->z_fgid); | |
1741 | if (ace_trivial_common(acl_ids->z_aclp, 0, zfs_ace_walk) == 0) | |
1742 | acl_ids->z_aclp->z_hints |= ZFS_ACL_TRIVIAL; | |
1743 | } | |
1744 | ||
1745 | return (0); | |
1746 | } | |
1747 | ||
1748 | /* | |
1749 | * Free ACL and fuid_infop, but not the acl_ids structure | |
1750 | */ | |
1751 | void | |
1752 | zfs_acl_ids_free(zfs_acl_ids_t *acl_ids) | |
1753 | { | |
1754 | if (acl_ids->z_aclp) | |
1755 | zfs_acl_free(acl_ids->z_aclp); | |
1756 | if (acl_ids->z_fuidp) | |
1757 | zfs_fuid_info_free(acl_ids->z_fuidp); | |
1758 | acl_ids->z_aclp = NULL; | |
1759 | acl_ids->z_fuidp = NULL; | |
1760 | } | |
1761 | ||
1762 | boolean_t | |
1763 | zfs_acl_ids_overquota(zfsvfs_t *zv, zfs_acl_ids_t *acl_ids, uint64_t projid) | |
1764 | { | |
1765 | return (zfs_id_overquota(zv, DMU_USERUSED_OBJECT, acl_ids->z_fuid) || | |
1766 | zfs_id_overquota(zv, DMU_GROUPUSED_OBJECT, acl_ids->z_fgid) || | |
1767 | (projid != ZFS_DEFAULT_PROJID && projid != ZFS_INVALID_PROJID && | |
1768 | zfs_id_overquota(zv, DMU_PROJECTUSED_OBJECT, projid))); | |
1769 | } | |
1770 | ||
1771 | /* | |
1772 | * Retrieve a file's ACL | |
1773 | */ | |
1774 | int | |
1775 | zfs_getacl(znode_t *zp, vsecattr_t *vsecp, boolean_t skipaclchk, cred_t *cr) | |
1776 | { | |
1777 | zfs_acl_t *aclp; | |
1778 | ulong_t mask; | |
1779 | int error; | |
1780 | int count = 0; | |
1781 | int largeace = 0; | |
1782 | ||
1783 | mask = vsecp->vsa_mask & (VSA_ACE | VSA_ACECNT | | |
1784 | VSA_ACE_ACLFLAGS | VSA_ACE_ALLTYPES); | |
1785 | ||
1786 | if (mask == 0) | |
1787 | return (SET_ERROR(ENOSYS)); | |
1788 | ||
1789 | if ((error = zfs_zaccess(zp, ACE_READ_ACL, 0, skipaclchk, cr))) | |
1790 | return (error); | |
1791 | ||
1792 | mutex_enter(&zp->z_acl_lock); | |
1793 | ||
1794 | if (zp->z_zfsvfs->z_replay == B_FALSE) | |
1795 | ASSERT_VOP_LOCKED(ZTOV(zp), __func__); | |
1796 | error = zfs_acl_node_read(zp, B_TRUE, &aclp, B_FALSE); | |
1797 | if (error != 0) { | |
1798 | mutex_exit(&zp->z_acl_lock); | |
1799 | return (error); | |
1800 | } | |
1801 | ||
1802 | /* | |
1803 | * Scan ACL to determine number of ACEs | |
1804 | */ | |
1805 | if ((zp->z_pflags & ZFS_ACL_OBJ_ACE) && !(mask & VSA_ACE_ALLTYPES)) { | |
1806 | void *zacep = NULL; | |
1807 | uint64_t who; | |
1808 | uint32_t access_mask; | |
1809 | uint16_t type, iflags; | |
1810 | ||
1811 | while ((zacep = zfs_acl_next_ace(aclp, zacep, | |
1812 | &who, &access_mask, &iflags, &type))) { | |
1813 | switch (type) { | |
1814 | case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: | |
1815 | case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: | |
1816 | case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: | |
1817 | case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: | |
1818 | largeace++; | |
1819 | continue; | |
1820 | default: | |
1821 | count++; | |
1822 | } | |
1823 | } | |
1824 | vsecp->vsa_aclcnt = count; | |
1825 | } else | |
1826 | count = (int)aclp->z_acl_count; | |
1827 | ||
1828 | if (mask & VSA_ACECNT) { | |
1829 | vsecp->vsa_aclcnt = count; | |
1830 | } | |
1831 | ||
1832 | if (mask & VSA_ACE) { | |
1833 | size_t aclsz; | |
1834 | ||
1835 | aclsz = count * sizeof (ace_t) + | |
1836 | sizeof (ace_object_t) * largeace; | |
1837 | ||
1838 | vsecp->vsa_aclentp = kmem_alloc(aclsz, KM_SLEEP); | |
1839 | vsecp->vsa_aclentsz = aclsz; | |
1840 | ||
1841 | if (aclp->z_version == ZFS_ACL_VERSION_FUID) | |
1842 | zfs_copy_fuid_2_ace(zp->z_zfsvfs, aclp, cr, | |
1843 | vsecp->vsa_aclentp, !(mask & VSA_ACE_ALLTYPES)); | |
1844 | else { | |
1845 | zfs_acl_node_t *aclnode; | |
1846 | void *start = vsecp->vsa_aclentp; | |
1847 | ||
1848 | for (aclnode = list_head(&aclp->z_acl); aclnode; | |
1849 | aclnode = list_next(&aclp->z_acl, aclnode)) { | |
1850 | bcopy(aclnode->z_acldata, start, | |
1851 | aclnode->z_size); | |
1852 | start = (caddr_t)start + aclnode->z_size; | |
1853 | } | |
e4efb709 RM |
1854 | ASSERT3U((caddr_t)start - (caddr_t)vsecp->vsa_aclentp, |
1855 | ==, aclp->z_acl_bytes); | |
9f0a21e6 MM |
1856 | } |
1857 | } | |
1858 | if (mask & VSA_ACE_ACLFLAGS) { | |
1859 | vsecp->vsa_aclflags = 0; | |
1860 | if (zp->z_pflags & ZFS_ACL_DEFAULTED) | |
1861 | vsecp->vsa_aclflags |= ACL_DEFAULTED; | |
1862 | if (zp->z_pflags & ZFS_ACL_PROTECTED) | |
1863 | vsecp->vsa_aclflags |= ACL_PROTECTED; | |
1864 | if (zp->z_pflags & ZFS_ACL_AUTO_INHERIT) | |
1865 | vsecp->vsa_aclflags |= ACL_AUTO_INHERIT; | |
1866 | } | |
1867 | ||
1868 | mutex_exit(&zp->z_acl_lock); | |
1869 | ||
1870 | return (0); | |
1871 | } | |
1872 | ||
1873 | int | |
1874 | zfs_vsec_2_aclp(zfsvfs_t *zfsvfs, umode_t obj_type, | |
1875 | vsecattr_t *vsecp, cred_t *cr, zfs_fuid_info_t **fuidp, zfs_acl_t **zaclp) | |
1876 | { | |
1877 | zfs_acl_t *aclp; | |
1878 | zfs_acl_node_t *aclnode; | |
1879 | int aclcnt = vsecp->vsa_aclcnt; | |
1880 | int error; | |
1881 | ||
1882 | if (vsecp->vsa_aclcnt > MAX_ACL_ENTRIES || vsecp->vsa_aclcnt <= 0) | |
1883 | return (SET_ERROR(EINVAL)); | |
1884 | ||
1885 | aclp = zfs_acl_alloc(zfs_acl_version(zfsvfs->z_version)); | |
1886 | ||
1887 | aclp->z_hints = 0; | |
1888 | aclnode = zfs_acl_node_alloc(aclcnt * sizeof (zfs_object_ace_t)); | |
1889 | if (aclp->z_version == ZFS_ACL_VERSION_INITIAL) { | |
1890 | if ((error = zfs_copy_ace_2_oldace(obj_type, aclp, | |
1891 | (ace_t *)vsecp->vsa_aclentp, aclnode->z_acldata, | |
1892 | aclcnt, &aclnode->z_size)) != 0) { | |
1893 | zfs_acl_free(aclp); | |
1894 | zfs_acl_node_free(aclnode); | |
1895 | return (error); | |
1896 | } | |
1897 | } else { | |
1898 | if ((error = zfs_copy_ace_2_fuid(zfsvfs, obj_type, aclp, | |
1899 | vsecp->vsa_aclentp, aclnode->z_acldata, aclcnt, | |
1900 | &aclnode->z_size, fuidp, cr)) != 0) { | |
1901 | zfs_acl_free(aclp); | |
1902 | zfs_acl_node_free(aclnode); | |
1903 | return (error); | |
1904 | } | |
1905 | } | |
1906 | aclp->z_acl_bytes = aclnode->z_size; | |
1907 | aclnode->z_ace_count = aclcnt; | |
1908 | aclp->z_acl_count = aclcnt; | |
1909 | list_insert_head(&aclp->z_acl, aclnode); | |
1910 | ||
1911 | /* | |
1912 | * If flags are being set then add them to z_hints | |
1913 | */ | |
1914 | if (vsecp->vsa_mask & VSA_ACE_ACLFLAGS) { | |
1915 | if (vsecp->vsa_aclflags & ACL_PROTECTED) | |
1916 | aclp->z_hints |= ZFS_ACL_PROTECTED; | |
1917 | if (vsecp->vsa_aclflags & ACL_DEFAULTED) | |
1918 | aclp->z_hints |= ZFS_ACL_DEFAULTED; | |
1919 | if (vsecp->vsa_aclflags & ACL_AUTO_INHERIT) | |
1920 | aclp->z_hints |= ZFS_ACL_AUTO_INHERIT; | |
1921 | } | |
1922 | ||
1923 | *zaclp = aclp; | |
1924 | ||
1925 | return (0); | |
1926 | } | |
1927 | ||
1928 | /* | |
1929 | * Set a file's ACL | |
1930 | */ | |
1931 | int | |
1932 | zfs_setacl(znode_t *zp, vsecattr_t *vsecp, boolean_t skipaclchk, cred_t *cr) | |
1933 | { | |
1934 | zfsvfs_t *zfsvfs = zp->z_zfsvfs; | |
1935 | zilog_t *zilog = zfsvfs->z_log; | |
1936 | ulong_t mask = vsecp->vsa_mask & (VSA_ACE | VSA_ACECNT); | |
1937 | dmu_tx_t *tx; | |
1938 | int error; | |
1939 | zfs_acl_t *aclp; | |
1940 | zfs_fuid_info_t *fuidp = NULL; | |
1941 | boolean_t fuid_dirtied; | |
1942 | uint64_t acl_obj; | |
1943 | ||
1944 | if (zp->z_zfsvfs->z_replay == B_FALSE) | |
1945 | ASSERT_VOP_ELOCKED(ZTOV(zp), __func__); | |
1946 | if (mask == 0) | |
1947 | return (SET_ERROR(ENOSYS)); | |
1948 | ||
1949 | if (zp->z_pflags & ZFS_IMMUTABLE) | |
1950 | return (SET_ERROR(EPERM)); | |
1951 | ||
1952 | if ((error = zfs_zaccess(zp, ACE_WRITE_ACL, 0, skipaclchk, cr))) | |
1953 | return (error); | |
1954 | ||
1955 | error = zfs_vsec_2_aclp(zfsvfs, ZTOV(zp)->v_type, vsecp, cr, &fuidp, | |
1956 | &aclp); | |
1957 | if (error) | |
1958 | return (error); | |
1959 | ||
1960 | /* | |
1961 | * If ACL wide flags aren't being set then preserve any | |
1962 | * existing flags. | |
1963 | */ | |
1964 | if (!(vsecp->vsa_mask & VSA_ACE_ACLFLAGS)) { | |
1965 | aclp->z_hints |= | |
1966 | (zp->z_pflags & V4_ACL_WIDE_FLAGS); | |
1967 | } | |
1968 | top: | |
1969 | mutex_enter(&zp->z_acl_lock); | |
1970 | ||
1971 | tx = dmu_tx_create(zfsvfs->z_os); | |
1972 | ||
1973 | dmu_tx_hold_sa(tx, zp->z_sa_hdl, B_TRUE); | |
1974 | ||
1975 | fuid_dirtied = zfsvfs->z_fuid_dirty; | |
1976 | if (fuid_dirtied) | |
1977 | zfs_fuid_txhold(zfsvfs, tx); | |
1978 | ||
1979 | /* | |
1980 | * If old version and ACL won't fit in bonus and we aren't | |
1981 | * upgrading then take out necessary DMU holds | |
1982 | */ | |
1983 | ||
1984 | if ((acl_obj = zfs_external_acl(zp)) != 0) { | |
1985 | if (zfsvfs->z_version >= ZPL_VERSION_FUID && | |
1986 | zfs_znode_acl_version(zp) <= ZFS_ACL_VERSION_INITIAL) { | |
1987 | dmu_tx_hold_free(tx, acl_obj, 0, | |
1988 | DMU_OBJECT_END); | |
1989 | dmu_tx_hold_write(tx, DMU_NEW_OBJECT, 0, | |
1990 | aclp->z_acl_bytes); | |
1991 | } else { | |
1992 | dmu_tx_hold_write(tx, acl_obj, 0, aclp->z_acl_bytes); | |
1993 | } | |
1994 | } else if (!zp->z_is_sa && aclp->z_acl_bytes > ZFS_ACE_SPACE) { | |
1995 | dmu_tx_hold_write(tx, DMU_NEW_OBJECT, 0, aclp->z_acl_bytes); | |
1996 | } | |
1997 | ||
1998 | zfs_sa_upgrade_txholds(tx, zp); | |
1999 | error = dmu_tx_assign(tx, TXG_NOWAIT); | |
2000 | if (error) { | |
2001 | mutex_exit(&zp->z_acl_lock); | |
2002 | ||
2003 | if (error == ERESTART) { | |
2004 | dmu_tx_wait(tx); | |
2005 | dmu_tx_abort(tx); | |
2006 | goto top; | |
2007 | } | |
2008 | dmu_tx_abort(tx); | |
2009 | zfs_acl_free(aclp); | |
2010 | return (error); | |
2011 | } | |
2012 | ||
2013 | error = zfs_aclset_common(zp, aclp, cr, tx); | |
e4efb709 RM |
2014 | ASSERT0(error); |
2015 | ASSERT3P(zp->z_acl_cached, ==, NULL); | |
9f0a21e6 MM |
2016 | zp->z_acl_cached = aclp; |
2017 | ||
2018 | if (fuid_dirtied) | |
2019 | zfs_fuid_sync(zfsvfs, tx); | |
2020 | ||
2021 | zfs_log_acl(zilog, tx, zp, vsecp, fuidp); | |
2022 | ||
2023 | if (fuidp) | |
2024 | zfs_fuid_info_free(fuidp); | |
2025 | dmu_tx_commit(tx); | |
2026 | mutex_exit(&zp->z_acl_lock); | |
2027 | ||
2028 | return (error); | |
2029 | } | |
2030 | ||
2031 | /* | |
2032 | * Check accesses of interest (AoI) against attributes of the dataset | |
2033 | * such as read-only. Returns zero if no AoI conflict with dataset | |
2034 | * attributes, otherwise an appropriate errno is returned. | |
2035 | */ | |
2036 | static int | |
2037 | zfs_zaccess_dataset_check(znode_t *zp, uint32_t v4_mode) | |
2038 | { | |
2039 | if ((v4_mode & WRITE_MASK) && | |
2040 | (zp->z_zfsvfs->z_vfs->vfs_flag & VFS_RDONLY) && | |
2041 | (!IS_DEVVP(ZTOV(zp)) || | |
2042 | (IS_DEVVP(ZTOV(zp)) && (v4_mode & WRITE_MASK_ATTRS)))) { | |
2043 | return (SET_ERROR(EROFS)); | |
2044 | } | |
2045 | ||
2046 | /* | |
2047 | * Intentionally allow ZFS_READONLY through here. | |
2048 | * See zfs_zaccess_common(). | |
2049 | */ | |
2050 | if ((v4_mode & WRITE_MASK_DATA) && | |
2051 | (zp->z_pflags & ZFS_IMMUTABLE)) { | |
2052 | return (SET_ERROR(EPERM)); | |
2053 | } | |
2054 | ||
2055 | /* | |
2056 | * In FreeBSD we allow to modify directory's content is ZFS_NOUNLINK | |
2057 | * (sunlnk) is set. We just don't allow directory removal, which is | |
2058 | * handled in zfs_zaccess_delete(). | |
2059 | */ | |
2060 | if ((v4_mode & ACE_DELETE) && | |
2061 | (zp->z_pflags & ZFS_NOUNLINK)) { | |
2062 | return (EPERM); | |
2063 | } | |
2064 | ||
2065 | if (((v4_mode & (ACE_READ_DATA|ACE_EXECUTE)) && | |
2066 | (zp->z_pflags & ZFS_AV_QUARANTINED))) { | |
2067 | return (SET_ERROR(EACCES)); | |
2068 | } | |
2069 | ||
2070 | return (0); | |
2071 | } | |
2072 | ||
2073 | /* | |
2074 | * The primary usage of this function is to loop through all of the | |
2075 | * ACEs in the znode, determining what accesses of interest (AoI) to | |
2076 | * the caller are allowed or denied. The AoI are expressed as bits in | |
2077 | * the working_mode parameter. As each ACE is processed, bits covered | |
2078 | * by that ACE are removed from the working_mode. This removal | |
2079 | * facilitates two things. The first is that when the working mode is | |
2080 | * empty (= 0), we know we've looked at all the AoI. The second is | |
2081 | * that the ACE interpretation rules don't allow a later ACE to undo | |
2082 | * something granted or denied by an earlier ACE. Removing the | |
2083 | * discovered access or denial enforces this rule. At the end of | |
2084 | * processing the ACEs, all AoI that were found to be denied are | |
2085 | * placed into the working_mode, giving the caller a mask of denied | |
2086 | * accesses. Returns: | |
2087 | * 0 if all AoI granted | |
2088 | * EACCESS if the denied mask is non-zero | |
2089 | * other error if abnormal failure (e.g., IO error) | |
2090 | * | |
2091 | * A secondary usage of the function is to determine if any of the | |
2092 | * AoI are granted. If an ACE grants any access in | |
2093 | * the working_mode, we immediately short circuit out of the function. | |
2094 | * This mode is chosen by setting anyaccess to B_TRUE. The | |
2095 | * working_mode is not a denied access mask upon exit if the function | |
2096 | * is used in this manner. | |
2097 | */ | |
2098 | static int | |
2099 | zfs_zaccess_aces_check(znode_t *zp, uint32_t *working_mode, | |
2100 | boolean_t anyaccess, cred_t *cr) | |
2101 | { | |
2102 | zfsvfs_t *zfsvfs = zp->z_zfsvfs; | |
2103 | zfs_acl_t *aclp; | |
2104 | int error; | |
2105 | uid_t uid = crgetuid(cr); | |
2106 | uint64_t who; | |
2107 | uint16_t type, iflags; | |
2108 | uint16_t entry_type; | |
2109 | uint32_t access_mask; | |
2110 | uint32_t deny_mask = 0; | |
2111 | zfs_ace_hdr_t *acep = NULL; | |
2112 | boolean_t checkit; | |
2113 | uid_t gowner; | |
2114 | uid_t fowner; | |
2115 | ||
2116 | zfs_fuid_map_ids(zp, cr, &fowner, &gowner); | |
2117 | ||
2118 | mutex_enter(&zp->z_acl_lock); | |
2119 | ||
2120 | if (zp->z_zfsvfs->z_replay == B_FALSE) | |
2121 | ASSERT_VOP_LOCKED(ZTOV(zp), __func__); | |
2122 | error = zfs_acl_node_read(zp, B_TRUE, &aclp, B_FALSE); | |
2123 | if (error != 0) { | |
2124 | mutex_exit(&zp->z_acl_lock); | |
2125 | return (error); | |
2126 | } | |
2127 | ||
e4efb709 | 2128 | ASSERT3P(zp->z_acl_cached, !=, NULL); |
9f0a21e6 MM |
2129 | |
2130 | while ((acep = zfs_acl_next_ace(aclp, acep, &who, &access_mask, | |
2131 | &iflags, &type))) { | |
2132 | uint32_t mask_matched; | |
2133 | ||
2134 | if (!zfs_acl_valid_ace_type(type, iflags)) | |
2135 | continue; | |
2136 | ||
2137 | if (ZTOV(zp)->v_type == VDIR && (iflags & ACE_INHERIT_ONLY_ACE)) | |
2138 | continue; | |
2139 | ||
2140 | /* Skip ACE if it does not affect any AoI */ | |
2141 | mask_matched = (access_mask & *working_mode); | |
2142 | if (!mask_matched) | |
2143 | continue; | |
2144 | ||
2145 | entry_type = (iflags & ACE_TYPE_FLAGS); | |
2146 | ||
2147 | checkit = B_FALSE; | |
2148 | ||
2149 | switch (entry_type) { | |
2150 | case ACE_OWNER: | |
2151 | if (uid == fowner) | |
2152 | checkit = B_TRUE; | |
2153 | break; | |
2154 | case OWNING_GROUP: | |
2155 | who = gowner; | |
9a70e97f | 2156 | zfs_fallthrough; |
9f0a21e6 MM |
2157 | case ACE_IDENTIFIER_GROUP: |
2158 | checkit = zfs_groupmember(zfsvfs, who, cr); | |
2159 | break; | |
2160 | case ACE_EVERYONE: | |
2161 | checkit = B_TRUE; | |
2162 | break; | |
2163 | ||
2164 | /* USER Entry */ | |
2165 | default: | |
2166 | if (entry_type == 0) { | |
2167 | uid_t newid; | |
2168 | ||
2169 | newid = zfs_fuid_map_id(zfsvfs, who, cr, | |
2170 | ZFS_ACE_USER); | |
2171 | if (newid != UID_NOBODY && | |
2172 | uid == newid) | |
2173 | checkit = B_TRUE; | |
2174 | break; | |
2175 | } else { | |
2176 | mutex_exit(&zp->z_acl_lock); | |
2177 | return (SET_ERROR(EIO)); | |
2178 | } | |
2179 | } | |
2180 | ||
2181 | if (checkit) { | |
2182 | if (type == DENY) { | |
2183 | DTRACE_PROBE3(zfs__ace__denies, | |
2184 | znode_t *, zp, | |
2185 | zfs_ace_hdr_t *, acep, | |
2186 | uint32_t, mask_matched); | |
2187 | deny_mask |= mask_matched; | |
2188 | } else { | |
2189 | DTRACE_PROBE3(zfs__ace__allows, | |
2190 | znode_t *, zp, | |
2191 | zfs_ace_hdr_t *, acep, | |
2192 | uint32_t, mask_matched); | |
2193 | if (anyaccess) { | |
2194 | mutex_exit(&zp->z_acl_lock); | |
2195 | return (0); | |
2196 | } | |
2197 | } | |
2198 | *working_mode &= ~mask_matched; | |
2199 | } | |
2200 | ||
2201 | /* Are we done? */ | |
2202 | if (*working_mode == 0) | |
2203 | break; | |
2204 | } | |
2205 | ||
2206 | mutex_exit(&zp->z_acl_lock); | |
2207 | ||
2208 | /* Put the found 'denies' back on the working mode */ | |
2209 | if (deny_mask) { | |
2210 | *working_mode |= deny_mask; | |
2211 | return (SET_ERROR(EACCES)); | |
2212 | } else if (*working_mode) { | |
2213 | return (-1); | |
2214 | } | |
2215 | ||
2216 | return (0); | |
2217 | } | |
2218 | ||
2219 | /* | |
2220 | * Return true if any access whatsoever granted, we don't actually | |
2221 | * care what access is granted. | |
2222 | */ | |
2223 | boolean_t | |
2224 | zfs_has_access(znode_t *zp, cred_t *cr) | |
2225 | { | |
2226 | uint32_t have = ACE_ALL_PERMS; | |
2227 | ||
2228 | if (zfs_zaccess_aces_check(zp, &have, B_TRUE, cr) != 0) { | |
2229 | uid_t owner; | |
2230 | ||
2231 | owner = zfs_fuid_map_id(zp->z_zfsvfs, zp->z_uid, cr, ZFS_OWNER); | |
2232 | return (secpolicy_vnode_any_access(cr, ZTOV(zp), owner) == 0); | |
2233 | } | |
2234 | return (B_TRUE); | |
2235 | } | |
2236 | ||
2237 | static int | |
2238 | zfs_zaccess_common(znode_t *zp, uint32_t v4_mode, uint32_t *working_mode, | |
2239 | boolean_t *check_privs, boolean_t skipaclchk, cred_t *cr) | |
2240 | { | |
2241 | zfsvfs_t *zfsvfs = zp->z_zfsvfs; | |
2242 | int err; | |
2243 | ||
2244 | *working_mode = v4_mode; | |
2245 | *check_privs = B_TRUE; | |
2246 | ||
2247 | /* | |
2248 | * Short circuit empty requests | |
2249 | */ | |
2250 | if (v4_mode == 0 || zfsvfs->z_replay) { | |
2251 | *working_mode = 0; | |
2252 | return (0); | |
2253 | } | |
2254 | ||
2255 | if ((err = zfs_zaccess_dataset_check(zp, v4_mode)) != 0) { | |
2256 | *check_privs = B_FALSE; | |
2257 | return (err); | |
2258 | } | |
2259 | ||
2260 | /* | |
2261 | * The caller requested that the ACL check be skipped. This | |
2262 | * would only happen if the caller checked VOP_ACCESS() with a | |
2263 | * 32 bit ACE mask and already had the appropriate permissions. | |
2264 | */ | |
2265 | if (skipaclchk) { | |
2266 | *working_mode = 0; | |
2267 | return (0); | |
2268 | } | |
2269 | ||
2270 | /* | |
2271 | * Note: ZFS_READONLY represents the "DOS R/O" attribute. | |
2272 | * When that flag is set, we should behave as if write access | |
2273 | * were not granted by anything in the ACL. In particular: | |
2274 | * We _must_ allow writes after opening the file r/w, then | |
2275 | * setting the DOS R/O attribute, and writing some more. | |
2276 | * (Similar to how you can write after fchmod(fd, 0444).) | |
2277 | * | |
2278 | * Therefore ZFS_READONLY is ignored in the dataset check | |
2279 | * above, and checked here as if part of the ACL check. | |
2280 | * Also note: DOS R/O is ignored for directories. | |
2281 | */ | |
2282 | if ((v4_mode & WRITE_MASK_DATA) && | |
2283 | (ZTOV(zp)->v_type != VDIR) && | |
2284 | (zp->z_pflags & ZFS_READONLY)) { | |
2285 | return (SET_ERROR(EPERM)); | |
2286 | } | |
2287 | ||
2288 | return (zfs_zaccess_aces_check(zp, working_mode, B_FALSE, cr)); | |
2289 | } | |
2290 | ||
2291 | static int | |
2292 | zfs_zaccess_append(znode_t *zp, uint32_t *working_mode, boolean_t *check_privs, | |
2293 | cred_t *cr) | |
2294 | { | |
2295 | if (*working_mode != ACE_WRITE_DATA) | |
2296 | return (SET_ERROR(EACCES)); | |
2297 | ||
2298 | return (zfs_zaccess_common(zp, ACE_APPEND_DATA, working_mode, | |
2299 | check_privs, B_FALSE, cr)); | |
2300 | } | |
2301 | ||
2302 | /* | |
2303 | * Check if VEXEC is allowed. | |
2304 | * | |
2305 | * This routine is based on zfs_fastaccesschk_execute which has slowpath | |
2306 | * calling zfs_zaccess. This would be incorrect on FreeBSD (see | |
2307 | * zfs_freebsd_access for the difference). Thus this variant let's the | |
2308 | * caller handle the slowpath (if necessary). | |
2309 | * | |
2310 | * On top of that we perform a lockless check for ZFS_NO_EXECS_DENIED. | |
2311 | * | |
2312 | * Safe access to znode_t is provided by the vnode lock. | |
2313 | */ | |
2314 | int | |
2315 | zfs_fastaccesschk_execute(znode_t *zdp, cred_t *cr) | |
2316 | { | |
9f0a21e6 | 2317 | boolean_t is_attr; |
9f0a21e6 MM |
2318 | |
2319 | if (zdp->z_pflags & ZFS_AV_QUARANTINED) | |
2320 | return (1); | |
2321 | ||
2322 | is_attr = ((zdp->z_pflags & ZFS_XATTR) && | |
2323 | (ZTOV(zdp)->v_type == VDIR)); | |
2324 | if (is_attr) | |
2325 | return (1); | |
2326 | ||
2327 | if (zdp->z_pflags & ZFS_NO_EXECS_DENIED) | |
2328 | return (0); | |
2329 | ||
9f0a21e6 MM |
2330 | return (1); |
2331 | } | |
2332 | ||
2333 | ||
2334 | /* | |
2335 | * Determine whether Access should be granted/denied. | |
2336 | * | |
2337 | * The least priv subsystem is always consulted as a basic privilege | |
2338 | * can define any form of access. | |
2339 | */ | |
2340 | int | |
2341 | zfs_zaccess(znode_t *zp, int mode, int flags, boolean_t skipaclchk, cred_t *cr) | |
2342 | { | |
2343 | uint32_t working_mode; | |
2344 | int error; | |
2345 | int is_attr; | |
2346 | boolean_t check_privs; | |
2347 | znode_t *xzp = NULL; | |
2348 | znode_t *check_zp = zp; | |
2349 | mode_t needed_bits; | |
2350 | uid_t owner; | |
2351 | ||
2352 | is_attr = ((zp->z_pflags & ZFS_XATTR) && (ZTOV(zp)->v_type == VDIR)); | |
2353 | ||
9f0a21e6 MM |
2354 | /* |
2355 | * In FreeBSD, we don't care about permissions of individual ADS. | |
2356 | * Note that not checking them is not just an optimization - without | |
2357 | * this shortcut, EA operations may bogusly fail with EACCES. | |
2358 | */ | |
2359 | if (zp->z_pflags & ZFS_XATTR) | |
2360 | return (0); | |
9f0a21e6 MM |
2361 | |
2362 | owner = zfs_fuid_map_id(zp->z_zfsvfs, zp->z_uid, cr, ZFS_OWNER); | |
8c0991e8 | 2363 | |
9f0a21e6 MM |
2364 | /* |
2365 | * Map the bits required to the standard vnode flags VREAD|VWRITE|VEXEC | |
2366 | * in needed_bits. Map the bits mapped by working_mode (currently | |
2367 | * missing) in missing_bits. | |
2368 | * Call secpolicy_vnode_access2() with (needed_bits & ~checkmode), | |
2369 | * needed_bits. | |
2370 | */ | |
2371 | needed_bits = 0; | |
2372 | ||
2373 | working_mode = mode; | |
2374 | if ((working_mode & (ACE_READ_ACL|ACE_READ_ATTRIBUTES)) && | |
2375 | owner == crgetuid(cr)) | |
2376 | working_mode &= ~(ACE_READ_ACL|ACE_READ_ATTRIBUTES); | |
2377 | ||
2378 | if (working_mode & (ACE_READ_DATA|ACE_READ_NAMED_ATTRS| | |
2379 | ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_SYNCHRONIZE)) | |
2380 | needed_bits |= VREAD; | |
2381 | if (working_mode & (ACE_WRITE_DATA|ACE_WRITE_NAMED_ATTRS| | |
2382 | ACE_APPEND_DATA|ACE_WRITE_ATTRIBUTES|ACE_SYNCHRONIZE)) | |
2383 | needed_bits |= VWRITE; | |
2384 | if (working_mode & ACE_EXECUTE) | |
2385 | needed_bits |= VEXEC; | |
2386 | ||
2387 | if ((error = zfs_zaccess_common(check_zp, mode, &working_mode, | |
2388 | &check_privs, skipaclchk, cr)) == 0) { | |
2389 | if (is_attr) | |
2390 | VN_RELE(ZTOV(xzp)); | |
2391 | return (secpolicy_vnode_access2(cr, ZTOV(zp), owner, | |
2392 | needed_bits, needed_bits)); | |
2393 | } | |
2394 | ||
2395 | if (error && !check_privs) { | |
2396 | if (is_attr) | |
2397 | VN_RELE(ZTOV(xzp)); | |
2398 | return (error); | |
2399 | } | |
2400 | ||
2401 | if (error && (flags & V_APPEND)) { | |
2402 | error = zfs_zaccess_append(zp, &working_mode, &check_privs, cr); | |
2403 | } | |
2404 | ||
2405 | if (error && check_privs) { | |
2406 | mode_t checkmode = 0; | |
2407 | vnode_t *check_vp = ZTOV(check_zp); | |
2408 | ||
2409 | /* | |
2410 | * First check for implicit owner permission on | |
2411 | * read_acl/read_attributes | |
2412 | */ | |
2413 | ||
2414 | error = 0; | |
e4efb709 | 2415 | ASSERT3U(working_mode, !=, 0); |
9f0a21e6 MM |
2416 | |
2417 | if ((working_mode & (ACE_READ_ACL|ACE_READ_ATTRIBUTES) && | |
2418 | owner == crgetuid(cr))) | |
2419 | working_mode &= ~(ACE_READ_ACL|ACE_READ_ATTRIBUTES); | |
2420 | ||
2421 | if (working_mode & (ACE_READ_DATA|ACE_READ_NAMED_ATTRS| | |
2422 | ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_SYNCHRONIZE)) | |
2423 | checkmode |= VREAD; | |
2424 | if (working_mode & (ACE_WRITE_DATA|ACE_WRITE_NAMED_ATTRS| | |
2425 | ACE_APPEND_DATA|ACE_WRITE_ATTRIBUTES|ACE_SYNCHRONIZE)) | |
2426 | checkmode |= VWRITE; | |
2427 | if (working_mode & ACE_EXECUTE) | |
2428 | checkmode |= VEXEC; | |
2429 | ||
2430 | error = secpolicy_vnode_access2(cr, check_vp, owner, | |
2431 | needed_bits & ~checkmode, needed_bits); | |
2432 | ||
2433 | if (error == 0 && (working_mode & ACE_WRITE_OWNER)) | |
2434 | error = secpolicy_vnode_chown(check_vp, cr, owner); | |
2435 | if (error == 0 && (working_mode & ACE_WRITE_ACL)) | |
2436 | error = secpolicy_vnode_setdac(check_vp, cr, owner); | |
2437 | ||
2438 | if (error == 0 && (working_mode & | |
2439 | (ACE_DELETE|ACE_DELETE_CHILD))) | |
2440 | error = secpolicy_vnode_remove(check_vp, cr); | |
2441 | ||
2442 | if (error == 0 && (working_mode & ACE_SYNCHRONIZE)) { | |
2443 | error = secpolicy_vnode_chown(check_vp, cr, owner); | |
2444 | } | |
2445 | if (error == 0) { | |
2446 | /* | |
2447 | * See if any bits other than those already checked | |
2448 | * for are still present. If so then return EACCES | |
2449 | */ | |
2450 | if (working_mode & ~(ZFS_CHECKED_MASKS)) { | |
2451 | error = SET_ERROR(EACCES); | |
2452 | } | |
2453 | } | |
2454 | } else if (error == 0) { | |
2455 | error = secpolicy_vnode_access2(cr, ZTOV(zp), owner, | |
2456 | needed_bits, needed_bits); | |
2457 | } | |
2458 | ||
2459 | ||
2460 | if (is_attr) | |
2461 | VN_RELE(ZTOV(xzp)); | |
2462 | ||
2463 | return (error); | |
2464 | } | |
2465 | ||
2466 | /* | |
2467 | * Translate traditional unix VREAD/VWRITE/VEXEC mode into | |
485b50bb | 2468 | * NFSv4-style ZFS ACL format and call zfs_zaccess() |
9f0a21e6 MM |
2469 | */ |
2470 | int | |
2471 | zfs_zaccess_rwx(znode_t *zp, mode_t mode, int flags, cred_t *cr) | |
2472 | { | |
2473 | return (zfs_zaccess(zp, zfs_unix_to_v4(mode >> 6), flags, B_FALSE, cr)); | |
2474 | } | |
2475 | ||
2476 | /* | |
2477 | * Access function for secpolicy_vnode_setattr | |
2478 | */ | |
2479 | int | |
2480 | zfs_zaccess_unix(znode_t *zp, mode_t mode, cred_t *cr) | |
2481 | { | |
2482 | int v4_mode = zfs_unix_to_v4(mode >> 6); | |
2483 | ||
2484 | return (zfs_zaccess(zp, v4_mode, 0, B_FALSE, cr)); | |
2485 | } | |
2486 | ||
2487 | static int | |
2488 | zfs_delete_final_check(znode_t *zp, znode_t *dzp, | |
2489 | mode_t available_perms, cred_t *cr) | |
2490 | { | |
2491 | int error; | |
2492 | uid_t downer; | |
2493 | ||
2494 | downer = zfs_fuid_map_id(dzp->z_zfsvfs, dzp->z_uid, cr, ZFS_OWNER); | |
2495 | ||
2496 | error = secpolicy_vnode_access2(cr, ZTOV(dzp), | |
2497 | downer, available_perms, VWRITE|VEXEC); | |
2498 | ||
2499 | if (error == 0) | |
2500 | error = zfs_sticky_remove_access(dzp, zp, cr); | |
2501 | ||
2502 | return (error); | |
2503 | } | |
2504 | ||
2505 | /* | |
2506 | * Determine whether Access should be granted/deny, without | |
2507 | * consulting least priv subsystem. | |
2508 | * | |
2509 | * The following chart is the recommended NFSv4 enforcement for | |
2510 | * ability to delete an object. | |
2511 | * | |
2512 | * ------------------------------------------------------- | |
2513 | * | Parent Dir | Target Object Permissions | | |
2514 | * | permissions | | | |
2515 | * ------------------------------------------------------- | |
2516 | * | | ACL Allows | ACL Denies| Delete | | |
2517 | * | | Delete | Delete | unspecified| | |
2518 | * ------------------------------------------------------- | |
2519 | * | ACL Allows | Permit | Permit | Permit | | |
2520 | * | DELETE_CHILD | | | |
2521 | * ------------------------------------------------------- | |
2522 | * | ACL Denies | Permit | Deny | Deny | | |
2523 | * | DELETE_CHILD | | | | | |
2524 | * ------------------------------------------------------- | |
2525 | * | ACL specifies | | | | | |
2526 | * | only allow | Permit | Permit | Permit | | |
2527 | * | write and | | | | | |
2528 | * | execute | | | | | |
2529 | * ------------------------------------------------------- | |
2530 | * | ACL denies | | | | | |
2531 | * | write and | Permit | Deny | Deny | | |
2532 | * | execute | | | | | |
2533 | * ------------------------------------------------------- | |
2534 | * ^ | |
2535 | * | | |
2536 | * No search privilege, can't even look up file? | |
2537 | * | |
2538 | */ | |
2539 | int | |
2540 | zfs_zaccess_delete(znode_t *dzp, znode_t *zp, cred_t *cr) | |
2541 | { | |
2542 | uint32_t dzp_working_mode = 0; | |
2543 | uint32_t zp_working_mode = 0; | |
2544 | int dzp_error, zp_error; | |
2545 | mode_t available_perms; | |
2546 | boolean_t dzpcheck_privs = B_TRUE; | |
2547 | boolean_t zpcheck_privs = B_TRUE; | |
2548 | ||
2549 | /* | |
2550 | * We want specific DELETE permissions to | |
2551 | * take precedence over WRITE/EXECUTE. We don't | |
2552 | * want an ACL such as this to mess us up. | |
2553 | * user:joe:write_data:deny,user:joe:delete:allow | |
2554 | * | |
2555 | * However, deny permissions may ultimately be overridden | |
2556 | * by secpolicy_vnode_access(). | |
2557 | * | |
2558 | * We will ask for all of the necessary permissions and then | |
2559 | * look at the working modes from the directory and target object | |
2560 | * to determine what was found. | |
2561 | */ | |
2562 | ||
2563 | if (zp->z_pflags & (ZFS_IMMUTABLE | ZFS_NOUNLINK)) | |
2564 | return (SET_ERROR(EPERM)); | |
2565 | ||
2566 | /* | |
2567 | * First row | |
2568 | * If the directory permissions allow the delete, we are done. | |
2569 | */ | |
2570 | if ((dzp_error = zfs_zaccess_common(dzp, ACE_DELETE_CHILD, | |
2571 | &dzp_working_mode, &dzpcheck_privs, B_FALSE, cr)) == 0) | |
2572 | return (0); | |
2573 | ||
2574 | /* | |
2575 | * If target object has delete permission then we are done | |
2576 | */ | |
2577 | if ((zp_error = zfs_zaccess_common(zp, ACE_DELETE, &zp_working_mode, | |
2578 | &zpcheck_privs, B_FALSE, cr)) == 0) | |
2579 | return (0); | |
2580 | ||
e4efb709 RM |
2581 | ASSERT(dzp_error); |
2582 | ASSERT(zp_error); | |
9f0a21e6 MM |
2583 | |
2584 | if (!dzpcheck_privs) | |
2585 | return (dzp_error); | |
2586 | if (!zpcheck_privs) | |
2587 | return (zp_error); | |
2588 | ||
2589 | /* | |
2590 | * Second row | |
2591 | * | |
2592 | * If directory returns EACCES then delete_child was denied | |
2593 | * due to deny delete_child. In this case send the request through | |
2594 | * secpolicy_vnode_remove(). We don't use zfs_delete_final_check() | |
2595 | * since that *could* allow the delete based on write/execute permission | |
2596 | * and we want delete permissions to override write/execute. | |
2597 | */ | |
2598 | ||
2599 | if (dzp_error == EACCES) { | |
2600 | /* XXXPJD: s/dzp/zp/ ? */ | |
2601 | return (secpolicy_vnode_remove(ZTOV(dzp), cr)); | |
2602 | } | |
2603 | /* | |
2604 | * Third Row | |
2605 | * only need to see if we have write/execute on directory. | |
2606 | */ | |
2607 | ||
2608 | dzp_error = zfs_zaccess_common(dzp, ACE_EXECUTE|ACE_WRITE_DATA, | |
2609 | &dzp_working_mode, &dzpcheck_privs, B_FALSE, cr); | |
2610 | ||
2611 | if (dzp_error != 0 && !dzpcheck_privs) | |
2612 | return (dzp_error); | |
2613 | ||
2614 | /* | |
2615 | * Fourth row | |
2616 | */ | |
2617 | ||
2618 | available_perms = (dzp_working_mode & ACE_WRITE_DATA) ? 0 : VWRITE; | |
2619 | available_perms |= (dzp_working_mode & ACE_EXECUTE) ? 0 : VEXEC; | |
2620 | ||
2621 | return (zfs_delete_final_check(zp, dzp, available_perms, cr)); | |
2622 | ||
2623 | } | |
2624 | ||
2625 | int | |
2626 | zfs_zaccess_rename(znode_t *sdzp, znode_t *szp, znode_t *tdzp, | |
2627 | znode_t *tzp, cred_t *cr) | |
2628 | { | |
2629 | int add_perm; | |
2630 | int error; | |
2631 | ||
2632 | if (szp->z_pflags & ZFS_AV_QUARANTINED) | |
2633 | return (SET_ERROR(EACCES)); | |
2634 | ||
2635 | add_perm = (ZTOV(szp)->v_type == VDIR) ? | |
2636 | ACE_ADD_SUBDIRECTORY : ACE_ADD_FILE; | |
2637 | ||
2638 | /* | |
2639 | * Rename permissions are combination of delete permission + | |
2640 | * add file/subdir permission. | |
2641 | * | |
2642 | * BSD operating systems also require write permission | |
2643 | * on the directory being moved from one parent directory | |
2644 | * to another. | |
2645 | */ | |
2646 | if (ZTOV(szp)->v_type == VDIR && ZTOV(sdzp) != ZTOV(tdzp)) { | |
2647 | if ((error = zfs_zaccess(szp, ACE_WRITE_DATA, 0, B_FALSE, cr))) | |
2648 | return (error); | |
2649 | } | |
2650 | ||
2651 | /* | |
2652 | * first make sure we do the delete portion. | |
2653 | * | |
2654 | * If that succeeds then check for add_file/add_subdir permissions | |
2655 | */ | |
2656 | ||
2657 | if ((error = zfs_zaccess_delete(sdzp, szp, cr))) | |
2658 | return (error); | |
2659 | ||
2660 | /* | |
2661 | * If we have a tzp, see if we can delete it? | |
2662 | */ | |
2663 | if (tzp && (error = zfs_zaccess_delete(tdzp, tzp, cr))) | |
2664 | return (error); | |
2665 | ||
2666 | /* | |
2667 | * Now check for add permissions | |
2668 | */ | |
2669 | error = zfs_zaccess(tdzp, add_perm, 0, B_FALSE, cr); | |
2670 | ||
2671 | return (error); | |
2672 | } |