1/* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21/* 22 * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved. 23 * Copyright 2011 Nexenta Systems, Inc. All rights reserved. 24 * Copyright (c) 2013 by Delphix. All rights reserved. 25 */ 26 27#include <sys/types.h> 28#include <sys/param.h> 29#include <sys/time.h> 30#include <sys/systm.h> 31#include <sys/sysmacros.h> 32#include <sys/resource.h> 33#include <sys/vfs.h> 34#include <sys/vnode.h> 35#include <sys/file.h> 36#include <sys/stat.h> 37#include <sys/kmem.h> 38#include <sys/cmn_err.h> 39#include <sys/errno.h> 40#include <sys/unistd.h> 41#include <sys/sdt.h> 42#include <sys/fs/zfs.h> 43#include <sys/policy.h> 44#include <sys/zfs_znode.h> 45#include <sys/zfs_fuid.h> 46#include <sys/zfs_acl.h> 47#include <sys/zfs_dir.h> 48#include <sys/zfs_vfsops.h> 49#include <sys/dmu.h> 50#include <sys/dnode.h> 51#include <sys/zap.h> 52#include <sys/sa.h> 53#include <acl/acl_common.h> 54 55#define ALLOW ACE_ACCESS_ALLOWED_ACE_TYPE 56#define DENY ACE_ACCESS_DENIED_ACE_TYPE 57#define MAX_ACE_TYPE ACE_SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE 58#define MIN_ACE_TYPE ALLOW 59 60#define OWNING_GROUP (ACE_GROUP|ACE_IDENTIFIER_GROUP) 61#define EVERYONE_ALLOW_MASK (ACE_READ_ACL|ACE_READ_ATTRIBUTES | \ 62 ACE_READ_NAMED_ATTRS|ACE_SYNCHRONIZE) 63#define EVERYONE_DENY_MASK (ACE_WRITE_ACL|ACE_WRITE_OWNER | \ 64 ACE_WRITE_ATTRIBUTES|ACE_WRITE_NAMED_ATTRS) 65#define OWNER_ALLOW_MASK (ACE_WRITE_ACL | ACE_WRITE_OWNER | \ 66 ACE_WRITE_ATTRIBUTES|ACE_WRITE_NAMED_ATTRS) 67 68#define ZFS_CHECKED_MASKS (ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_READ_DATA| \ 69 ACE_READ_NAMED_ATTRS|ACE_WRITE_DATA|ACE_WRITE_ATTRIBUTES| \ 70 ACE_WRITE_NAMED_ATTRS|ACE_APPEND_DATA|ACE_EXECUTE|ACE_WRITE_OWNER| \ 71 ACE_WRITE_ACL|ACE_DELETE|ACE_DELETE_CHILD|ACE_SYNCHRONIZE) 72 73#define WRITE_MASK_DATA (ACE_WRITE_DATA|ACE_APPEND_DATA|ACE_WRITE_NAMED_ATTRS) 74#define WRITE_MASK_ATTRS (ACE_WRITE_ACL|ACE_WRITE_OWNER|ACE_WRITE_ATTRIBUTES| \ 75 ACE_DELETE|ACE_DELETE_CHILD) 76#define WRITE_MASK (WRITE_MASK_DATA|WRITE_MASK_ATTRS) 77 78#define OGE_CLEAR (ACE_READ_DATA|ACE_LIST_DIRECTORY|ACE_WRITE_DATA| \ 79 ACE_ADD_FILE|ACE_APPEND_DATA|ACE_ADD_SUBDIRECTORY|ACE_EXECUTE) 80 81#define OKAY_MASK_BITS (ACE_READ_DATA|ACE_LIST_DIRECTORY|ACE_WRITE_DATA| \ 82 ACE_ADD_FILE|ACE_APPEND_DATA|ACE_ADD_SUBDIRECTORY|ACE_EXECUTE) 83 84#define ALL_INHERIT (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE | \ 85 ACE_NO_PROPAGATE_INHERIT_ACE|ACE_INHERIT_ONLY_ACE|ACE_INHERITED_ACE) 86 87#define RESTRICTED_CLEAR (ACE_WRITE_ACL|ACE_WRITE_OWNER) 88 89#define V4_ACL_WIDE_FLAGS (ZFS_ACL_AUTO_INHERIT|ZFS_ACL_DEFAULTED|\ 90 ZFS_ACL_PROTECTED) 91 92#define ZFS_ACL_WIDE_FLAGS (V4_ACL_WIDE_FLAGS|ZFS_ACL_TRIVIAL|ZFS_INHERIT_ACE|\ 93 ZFS_ACL_OBJ_ACE) 94 95#define ALL_MODE_EXECS (S_IXUSR | S_IXGRP | S_IXOTH) 96 97static uint16_t 98zfs_ace_v0_get_type(void *acep) 99{ 100 return (((zfs_oldace_t *)acep)->z_type); 101} 102 103static uint16_t 104zfs_ace_v0_get_flags(void *acep) 105{ 106 return (((zfs_oldace_t *)acep)->z_flags); 107} 108 109static uint32_t 110zfs_ace_v0_get_mask(void *acep) 111{ 112 return (((zfs_oldace_t *)acep)->z_access_mask); 113} 114 115static uint64_t 116zfs_ace_v0_get_who(void *acep) 117{ 118 return (((zfs_oldace_t *)acep)->z_fuid); 119} 120 121static void 122zfs_ace_v0_set_type(void *acep, uint16_t type) 123{ 124 ((zfs_oldace_t *)acep)->z_type = type; 125} 126 127static void 128zfs_ace_v0_set_flags(void *acep, uint16_t flags) 129{ 130 ((zfs_oldace_t *)acep)->z_flags = flags; 131} 132 133static void 134zfs_ace_v0_set_mask(void *acep, uint32_t mask) 135{ 136 ((zfs_oldace_t *)acep)->z_access_mask = mask; 137} 138 139static void 140zfs_ace_v0_set_who(void *acep, uint64_t who) 141{ 142 ((zfs_oldace_t *)acep)->z_fuid = who; 143} 144 145/*ARGSUSED*/ 146static size_t 147zfs_ace_v0_size(void *acep) 148{ 149 return (sizeof (zfs_oldace_t)); 150} 151 152static size_t 153zfs_ace_v0_abstract_size(void) 154{ 155 return (sizeof (zfs_oldace_t)); 156} 157 158static int 159zfs_ace_v0_mask_off(void) 160{ 161 return (offsetof(zfs_oldace_t, z_access_mask)); 162} 163 164/*ARGSUSED*/ 165static int 166zfs_ace_v0_data(void *acep, void **datap) 167{ 168 *datap = NULL; 169 return (0); 170} 171 172static acl_ops_t zfs_acl_v0_ops = { 173 zfs_ace_v0_get_mask, 174 zfs_ace_v0_set_mask, 175 zfs_ace_v0_get_flags, 176 zfs_ace_v0_set_flags, 177 zfs_ace_v0_get_type, 178 zfs_ace_v0_set_type, 179 zfs_ace_v0_get_who, 180 zfs_ace_v0_set_who, 181 zfs_ace_v0_size, 182 zfs_ace_v0_abstract_size, 183 zfs_ace_v0_mask_off, 184 zfs_ace_v0_data 185}; 186 187static uint16_t 188zfs_ace_fuid_get_type(void *acep) 189{ 190 return (((zfs_ace_hdr_t *)acep)->z_type); 191} 192 193static uint16_t 194zfs_ace_fuid_get_flags(void *acep) 195{ 196 return (((zfs_ace_hdr_t *)acep)->z_flags); 197} 198 199static uint32_t 200zfs_ace_fuid_get_mask(void *acep) 201{ 202 return (((zfs_ace_hdr_t *)acep)->z_access_mask); 203} 204 205static uint64_t 206zfs_ace_fuid_get_who(void *args) 207{ 208 uint16_t entry_type; 209 zfs_ace_t *acep = args; 210 211 entry_type = acep->z_hdr.z_flags & ACE_TYPE_FLAGS; 212 213 if (entry_type == ACE_OWNER || entry_type == OWNING_GROUP || 214 entry_type == ACE_EVERYONE) 215 return (-1); 216 return (((zfs_ace_t *)acep)->z_fuid); 217} 218 219static void 220zfs_ace_fuid_set_type(void *acep, uint16_t type) 221{ 222 ((zfs_ace_hdr_t *)acep)->z_type = type; 223} 224 225static void 226zfs_ace_fuid_set_flags(void *acep, uint16_t flags) 227{ 228 ((zfs_ace_hdr_t *)acep)->z_flags = flags; 229} 230 231static void 232zfs_ace_fuid_set_mask(void *acep, uint32_t mask) 233{ 234 ((zfs_ace_hdr_t *)acep)->z_access_mask = mask; 235} 236 237static void 238zfs_ace_fuid_set_who(void *arg, uint64_t who) 239{ 240 zfs_ace_t *acep = arg; 241 242 uint16_t entry_type = acep->z_hdr.z_flags & ACE_TYPE_FLAGS; 243 244 if (entry_type == ACE_OWNER || entry_type == OWNING_GROUP || 245 entry_type == ACE_EVERYONE) 246 return; 247 acep->z_fuid = who; 248} 249 250static size_t 251zfs_ace_fuid_size(void *acep) 252{ 253 zfs_ace_hdr_t *zacep = acep; 254 uint16_t entry_type; 255 256 switch (zacep->z_type) { 257 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 258 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 259 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 260 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 261 return (sizeof (zfs_object_ace_t)); 262 case ALLOW: 263 case DENY: 264 entry_type = 265 (((zfs_ace_hdr_t *)acep)->z_flags & ACE_TYPE_FLAGS); 266 if (entry_type == ACE_OWNER || 267 entry_type == OWNING_GROUP || 268 entry_type == ACE_EVERYONE) 269 return (sizeof (zfs_ace_hdr_t)); 270 /*FALLTHROUGH*/ 271 default: 272 return (sizeof (zfs_ace_t)); 273 } 274} 275 276static size_t 277zfs_ace_fuid_abstract_size(void) 278{ 279 return (sizeof (zfs_ace_hdr_t)); 280} 281 282static int 283zfs_ace_fuid_mask_off(void) 284{ 285 return (offsetof(zfs_ace_hdr_t, z_access_mask)); 286} 287 288static int 289zfs_ace_fuid_data(void *acep, void **datap) 290{ 291 zfs_ace_t *zacep = acep; 292 zfs_object_ace_t *zobjp; 293 294 switch (zacep->z_hdr.z_type) { 295 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 296 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 297 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 298 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 299 zobjp = acep; 300 *datap = (caddr_t)zobjp + sizeof (zfs_ace_t); 301 return (sizeof (zfs_object_ace_t) - sizeof (zfs_ace_t)); 302 default: 303 *datap = NULL; 304 return (0); 305 } 306} 307 308static acl_ops_t zfs_acl_fuid_ops = { 309 zfs_ace_fuid_get_mask, 310 zfs_ace_fuid_set_mask, 311 zfs_ace_fuid_get_flags, 312 zfs_ace_fuid_set_flags, 313 zfs_ace_fuid_get_type, 314 zfs_ace_fuid_set_type, 315 zfs_ace_fuid_get_who, 316 zfs_ace_fuid_set_who, 317 zfs_ace_fuid_size, 318 zfs_ace_fuid_abstract_size, 319 zfs_ace_fuid_mask_off, 320 zfs_ace_fuid_data 321}; 322 323/* 324 * The following three functions are provided for compatibility with 325 * older ZPL version in order to determine if the file use to have 326 * an external ACL and what version of ACL previously existed on the 327 * file. Would really be nice to not need this, sigh. 328 */ 329uint64_t 330zfs_external_acl(znode_t *zp) 331{ 332 zfs_acl_phys_t acl_phys; 333 int error; 334 335 if (zp->z_is_sa) 336 return (0); 337 338 /* 339 * Need to deal with a potential 340 * race where zfs_sa_upgrade could cause 341 * z_isa_sa to change. 342 * 343 * If the lookup fails then the state of z_is_sa should have 344 * changed. 345 */ 346 347 if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_ZNODE_ACL(zp->z_zfsvfs), 348 &acl_phys, sizeof (acl_phys))) == 0) 349 return (acl_phys.z_acl_extern_obj); 350 else { 351 /* 352 * after upgrade the SA_ZPL_ZNODE_ACL should have been 353 * removed 354 */ 355 VERIFY(zp->z_is_sa && error == ENOENT); 356 return (0); 357 } 358} 359 360/* 361 * Determine size of ACL in bytes 362 * 363 * This is more complicated than it should be since we have to deal 364 * with old external ACLs. 365 */ 366static int 367zfs_acl_znode_info(znode_t *zp, int *aclsize, int *aclcount, 368 zfs_acl_phys_t *aclphys) 369{ 370 zfsvfs_t *zfsvfs = zp->z_zfsvfs; 371 uint64_t acl_count; 372 int size; 373 int error; 374 375 ASSERT(MUTEX_HELD(&zp->z_acl_lock)); 376 if (zp->z_is_sa) { 377 if ((error = sa_size(zp->z_sa_hdl, SA_ZPL_DACL_ACES(zfsvfs), 378 &size)) != 0) 379 return (error); 380 *aclsize = size; 381 if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_DACL_COUNT(zfsvfs), 382 &acl_count, sizeof (acl_count))) != 0) 383 return (error); 384 *aclcount = acl_count; 385 } else { 386 if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_ZNODE_ACL(zfsvfs), 387 aclphys, sizeof (*aclphys))) != 0) 388 return (error); 389 390 if (aclphys->z_acl_version == ZFS_ACL_VERSION_INITIAL) { 391 *aclsize = ZFS_ACL_SIZE(aclphys->z_acl_size); 392 *aclcount = aclphys->z_acl_size; 393 } else { 394 *aclsize = aclphys->z_acl_size; 395 *aclcount = aclphys->z_acl_count; 396 } 397 } 398 return (0); 399} 400 401int 402zfs_znode_acl_version(znode_t *zp) 403{ 404 zfs_acl_phys_t acl_phys; 405 406 if (zp->z_is_sa) 407 return (ZFS_ACL_VERSION_FUID); 408 else { 409 int error; 410 411 /* 412 * Need to deal with a potential 413 * race where zfs_sa_upgrade could cause 414 * z_isa_sa to change. 415 * 416 * If the lookup fails then the state of z_is_sa should have 417 * changed. 418 */ 419 if ((error = sa_lookup(zp->z_sa_hdl, 420 SA_ZPL_ZNODE_ACL(zp->z_zfsvfs), 421 &acl_phys, sizeof (acl_phys))) == 0) 422 return (acl_phys.z_acl_version); 423 else { 424 /* 425 * After upgrade SA_ZPL_ZNODE_ACL should have 426 * been removed. 427 */ 428 VERIFY(zp->z_is_sa && error == ENOENT); 429 return (ZFS_ACL_VERSION_FUID); 430 } 431 } 432} 433 434static int 435zfs_acl_version(int version) 436{ 437 if (version < ZPL_VERSION_FUID) 438 return (ZFS_ACL_VERSION_INITIAL); 439 else 440 return (ZFS_ACL_VERSION_FUID); 441} 442 443static int 444zfs_acl_version_zp(znode_t *zp) 445{ 446 return (zfs_acl_version(zp->z_zfsvfs->z_version)); 447} 448 449zfs_acl_t * 450zfs_acl_alloc(int vers) 451{ 452 zfs_acl_t *aclp; 453 454 aclp = kmem_zalloc(sizeof (zfs_acl_t), KM_SLEEP); 455 list_create(&aclp->z_acl, sizeof (zfs_acl_node_t), 456 offsetof(zfs_acl_node_t, z_next)); 457 aclp->z_version = vers; 458 if (vers == ZFS_ACL_VERSION_FUID) 459 aclp->z_ops = zfs_acl_fuid_ops; 460 else 461 aclp->z_ops = zfs_acl_v0_ops; 462 return (aclp); 463} 464 465zfs_acl_node_t * 466zfs_acl_node_alloc(size_t bytes) 467{ 468 zfs_acl_node_t *aclnode; 469 470 aclnode = kmem_zalloc(sizeof (zfs_acl_node_t), KM_SLEEP); 471 if (bytes) { 472 aclnode->z_acldata = kmem_alloc(bytes, KM_SLEEP); 473 aclnode->z_allocdata = aclnode->z_acldata; 474 aclnode->z_allocsize = bytes; 475 aclnode->z_size = bytes; 476 } 477 478 return (aclnode); 479} 480 481static void 482zfs_acl_node_free(zfs_acl_node_t *aclnode) 483{ 484 if (aclnode->z_allocsize) 485 kmem_free(aclnode->z_allocdata, aclnode->z_allocsize); 486 kmem_free(aclnode, sizeof (zfs_acl_node_t)); 487} 488 489static void 490zfs_acl_release_nodes(zfs_acl_t *aclp) 491{ 492 zfs_acl_node_t *aclnode; 493 494 while (aclnode = list_head(&aclp->z_acl)) { 495 list_remove(&aclp->z_acl, aclnode); 496 zfs_acl_node_free(aclnode); 497 } 498 aclp->z_acl_count = 0; 499 aclp->z_acl_bytes = 0; 500} 501 502void 503zfs_acl_free(zfs_acl_t *aclp) 504{ 505 zfs_acl_release_nodes(aclp); 506 list_destroy(&aclp->z_acl); 507 kmem_free(aclp, sizeof (zfs_acl_t)); 508} 509 510static boolean_t 511zfs_acl_valid_ace_type(uint_t type, uint_t flags) 512{ 513 uint16_t entry_type; 514 515 switch (type) { 516 case ALLOW: 517 case DENY: 518 case ACE_SYSTEM_AUDIT_ACE_TYPE: 519 case ACE_SYSTEM_ALARM_ACE_TYPE: 520 entry_type = flags & ACE_TYPE_FLAGS; 521 return (entry_type == ACE_OWNER || 522 entry_type == OWNING_GROUP || 523 entry_type == ACE_EVERYONE || entry_type == 0 || 524 entry_type == ACE_IDENTIFIER_GROUP); 525 default: 526 if (type >= MIN_ACE_TYPE && type <= MAX_ACE_TYPE) 527 return (B_TRUE); 528 } 529 return (B_FALSE); 530} 531 532static boolean_t 533zfs_ace_valid(vtype_t obj_type, zfs_acl_t *aclp, uint16_t type, uint16_t iflags) 534{ 535 /* 536 * first check type of entry 537 */ 538 539 if (!zfs_acl_valid_ace_type(type, iflags)) 540 return (B_FALSE); 541 542 switch (type) { 543 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 544 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 545 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 546 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 547 if (aclp->z_version < ZFS_ACL_VERSION_FUID) 548 return (B_FALSE); 549 aclp->z_hints |= ZFS_ACL_OBJ_ACE; 550 } 551 552 /* 553 * next check inheritance level flags 554 */ 555 556 if (obj_type == VDIR && 557 (iflags & (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE))) 558 aclp->z_hints |= ZFS_INHERIT_ACE; 559 560 if (iflags & (ACE_INHERIT_ONLY_ACE|ACE_NO_PROPAGATE_INHERIT_ACE)) { 561 if ((iflags & (ACE_FILE_INHERIT_ACE| 562 ACE_DIRECTORY_INHERIT_ACE)) == 0) { 563 return (B_FALSE); 564 } 565 } 566 567 return (B_TRUE); 568} 569 570static void * 571zfs_acl_next_ace(zfs_acl_t *aclp, void *start, uint64_t *who, 572 uint32_t *access_mask, uint16_t *iflags, uint16_t *type) 573{ 574 zfs_acl_node_t *aclnode; 575 576 ASSERT(aclp); 577 578 if (start == NULL) { 579 aclnode = list_head(&aclp->z_acl); 580 if (aclnode == NULL) 581 return (NULL); 582 583 aclp->z_next_ace = aclnode->z_acldata; 584 aclp->z_curr_node = aclnode; 585 aclnode->z_ace_idx = 0; 586 } 587 588 aclnode = aclp->z_curr_node; 589 590 if (aclnode == NULL) 591 return (NULL); 592 593 if (aclnode->z_ace_idx >= aclnode->z_ace_count) { 594 aclnode = list_next(&aclp->z_acl, aclnode); 595 if (aclnode == NULL) 596 return (NULL); 597 else { 598 aclp->z_curr_node = aclnode; 599 aclnode->z_ace_idx = 0; 600 aclp->z_next_ace = aclnode->z_acldata; 601 } 602 } 603 604 if (aclnode->z_ace_idx < aclnode->z_ace_count) { 605 void *acep = aclp->z_next_ace; 606 size_t ace_size; 607 608 /* 609 * Make sure we don't overstep our bounds 610 */ 611 ace_size = aclp->z_ops.ace_size(acep); 612 613 if (((caddr_t)acep + ace_size) > 614 ((caddr_t)aclnode->z_acldata + aclnode->z_size)) { 615 return (NULL); 616 } 617 618 *iflags = aclp->z_ops.ace_flags_get(acep); 619 *type = aclp->z_ops.ace_type_get(acep); 620 *access_mask = aclp->z_ops.ace_mask_get(acep); 621 *who = aclp->z_ops.ace_who_get(acep); 622 aclp->z_next_ace = (caddr_t)aclp->z_next_ace + ace_size; 623 aclnode->z_ace_idx++; 624 625 return ((void *)acep); 626 } 627 return (NULL); 628} 629 630/*ARGSUSED*/ 631static uint64_t 632zfs_ace_walk(void *datap, uint64_t cookie, int aclcnt, 633 uint16_t *flags, uint16_t *type, uint32_t *mask) 634{ 635 zfs_acl_t *aclp = datap; 636 zfs_ace_hdr_t *acep = (zfs_ace_hdr_t *)(uintptr_t)cookie; 637 uint64_t who; 638 639 acep = zfs_acl_next_ace(aclp, acep, &who, mask, 640 flags, type); 641 return ((uint64_t)(uintptr_t)acep); 642} 643 644static zfs_acl_node_t * 645zfs_acl_curr_node(zfs_acl_t *aclp) 646{ 647 ASSERT(aclp->z_curr_node); 648 return (aclp->z_curr_node); 649} 650 651/* 652 * Copy ACE to internal ZFS format. 653 * While processing the ACL each ACE will be validated for correctness. 654 * ACE FUIDs will be created later. 655 */ 656int 657zfs_copy_ace_2_fuid(zfsvfs_t *zfsvfs, vtype_t obj_type, zfs_acl_t *aclp, 658 void *datap, zfs_ace_t *z_acl, uint64_t aclcnt, size_t *size, 659 zfs_fuid_info_t **fuidp, cred_t *cr) 660{ 661 int i; 662 uint16_t entry_type; 663 zfs_ace_t *aceptr = z_acl; 664 ace_t *acep = datap; 665 zfs_object_ace_t *zobjacep; 666 ace_object_t *aceobjp; 667 668 for (i = 0; i != aclcnt; i++) { 669 aceptr->z_hdr.z_access_mask = acep->a_access_mask; 670 aceptr->z_hdr.z_flags = acep->a_flags; 671 aceptr->z_hdr.z_type = acep->a_type; 672 entry_type = aceptr->z_hdr.z_flags & ACE_TYPE_FLAGS; 673 if (entry_type != ACE_OWNER && entry_type != OWNING_GROUP && 674 entry_type != ACE_EVERYONE) { 675 aceptr->z_fuid = zfs_fuid_create(zfsvfs, acep->a_who, 676 cr, (entry_type == 0) ? 677 ZFS_ACE_USER : ZFS_ACE_GROUP, fuidp); 678 } 679 680 /* 681 * Make sure ACE is valid 682 */ 683 if (zfs_ace_valid(obj_type, aclp, aceptr->z_hdr.z_type, 684 aceptr->z_hdr.z_flags) != B_TRUE) 685 return (SET_ERROR(EINVAL)); 686 687 switch (acep->a_type) { 688 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 689 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 690 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 691 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 692 zobjacep = (zfs_object_ace_t *)aceptr; 693 aceobjp = (ace_object_t *)acep; 694 695 bcopy(aceobjp->a_obj_type, zobjacep->z_object_type, 696 sizeof (aceobjp->a_obj_type)); 697 bcopy(aceobjp->a_inherit_obj_type, 698 zobjacep->z_inherit_type, 699 sizeof (aceobjp->a_inherit_obj_type)); 700 acep = (ace_t *)((caddr_t)acep + sizeof (ace_object_t)); 701 break; 702 default: 703 acep = (ace_t *)((caddr_t)acep + sizeof (ace_t)); 704 } 705 706 aceptr = (zfs_ace_t *)((caddr_t)aceptr + 707 aclp->z_ops.ace_size(aceptr)); 708 } 709 710 *size = (caddr_t)aceptr - (caddr_t)z_acl; 711 712 return (0); 713} 714 715/* 716 * Copy ZFS ACEs to fixed size ace_t layout 717 */ 718static void 719zfs_copy_fuid_2_ace(zfsvfs_t *zfsvfs, zfs_acl_t *aclp, cred_t *cr, 720 void *datap, int filter) 721{ 722 uint64_t who; 723 uint32_t access_mask; 724 uint16_t iflags, type; 725 zfs_ace_hdr_t *zacep = NULL; 726 ace_t *acep = datap; 727 ace_object_t *objacep; 728 zfs_object_ace_t *zobjacep; 729 size_t ace_size; 730 uint16_t entry_type; 731 732 while (zacep = zfs_acl_next_ace(aclp, zacep, 733 &who, &access_mask, &iflags, &type)) { 734 735 switch (type) { 736 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 737 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 738 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 739 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 740 if (filter) { 741 continue; 742 } 743 zobjacep = (zfs_object_ace_t *)zacep; 744 objacep = (ace_object_t *)acep; 745 bcopy(zobjacep->z_object_type, 746 objacep->a_obj_type, 747 sizeof (zobjacep->z_object_type)); 748 bcopy(zobjacep->z_inherit_type, 749 objacep->a_inherit_obj_type, 750 sizeof (zobjacep->z_inherit_type)); 751 ace_size = sizeof (ace_object_t); 752 break; 753 default: 754 ace_size = sizeof (ace_t); 755 break; 756 } 757 758 entry_type = (iflags & ACE_TYPE_FLAGS); 759 if ((entry_type != ACE_OWNER && 760 entry_type != OWNING_GROUP && 761 entry_type != ACE_EVERYONE)) { 762 acep->a_who = zfs_fuid_map_id(zfsvfs, who, 763 cr, (entry_type & ACE_IDENTIFIER_GROUP) ? 764 ZFS_ACE_GROUP : ZFS_ACE_USER); 765 } else { 766 acep->a_who = (uid_t)(int64_t)who; 767 } 768 acep->a_access_mask = access_mask; 769 acep->a_flags = iflags; 770 acep->a_type = type; 771 acep = (ace_t *)((caddr_t)acep + ace_size); 772 } 773} 774 775static int 776zfs_copy_ace_2_oldace(vtype_t obj_type, zfs_acl_t *aclp, ace_t *acep, 777 zfs_oldace_t *z_acl, int aclcnt, size_t *size) 778{ 779 int i; 780 zfs_oldace_t *aceptr = z_acl; 781 782 for (i = 0; i != aclcnt; i++, aceptr++) { 783 aceptr->z_access_mask = acep[i].a_access_mask; 784 aceptr->z_type = acep[i].a_type; 785 aceptr->z_flags = acep[i].a_flags; 786 aceptr->z_fuid = acep[i].a_who; 787 /* 788 * Make sure ACE is valid 789 */ 790 if (zfs_ace_valid(obj_type, aclp, aceptr->z_type, 791 aceptr->z_flags) != B_TRUE) 792 return (SET_ERROR(EINVAL)); 793 } 794 *size = (caddr_t)aceptr - (caddr_t)z_acl; 795 return (0); 796} 797 798/* 799 * convert old ACL format to new 800 */ 801void 802zfs_acl_xform(znode_t *zp, zfs_acl_t *aclp, cred_t *cr) 803{ 804 zfs_oldace_t *oldaclp; 805 int i; 806 uint16_t type, iflags; 807 uint32_t access_mask; 808 uint64_t who; 809 void *cookie = NULL; 810 zfs_acl_node_t *newaclnode; 811 812 ASSERT(aclp->z_version == ZFS_ACL_VERSION_INITIAL); 813 /* 814 * First create the ACE in a contiguous piece of memory 815 * for zfs_copy_ace_2_fuid(). 816 * 817 * We only convert an ACL once, so this won't happen 818 * everytime. 819 */ 820 oldaclp = kmem_alloc(sizeof (zfs_oldace_t) * aclp->z_acl_count, 821 KM_SLEEP); 822 i = 0; 823 while (cookie = zfs_acl_next_ace(aclp, cookie, &who, 824 &access_mask, &iflags, &type)) { 825 oldaclp[i].z_flags = iflags; 826 oldaclp[i].z_type = type; 827 oldaclp[i].z_fuid = who; 828 oldaclp[i++].z_access_mask = access_mask; 829 } 830 831 newaclnode = zfs_acl_node_alloc(aclp->z_acl_count * 832 sizeof (zfs_object_ace_t)); 833 aclp->z_ops = zfs_acl_fuid_ops; 834 VERIFY(zfs_copy_ace_2_fuid(zp->z_zfsvfs, ZTOV(zp)->v_type, aclp, 835 oldaclp, newaclnode->z_acldata, aclp->z_acl_count, 836 &newaclnode->z_size, NULL, cr) == 0); 837 newaclnode->z_ace_count = aclp->z_acl_count; 838 aclp->z_version = ZFS_ACL_VERSION; 839 kmem_free(oldaclp, aclp->z_acl_count * sizeof (zfs_oldace_t)); 840 841 /* 842 * Release all previous ACL nodes 843 */ 844 845 zfs_acl_release_nodes(aclp); 846 847 list_insert_head(&aclp->z_acl, newaclnode); 848 849 aclp->z_acl_bytes = newaclnode->z_size; 850 aclp->z_acl_count = newaclnode->z_ace_count; 851 852} 853 854/* 855 * Convert unix access mask to v4 access mask 856 */ 857static uint32_t 858zfs_unix_to_v4(uint32_t access_mask) 859{ 860 uint32_t new_mask = 0; 861 862 if (access_mask & S_IXOTH) 863 new_mask |= ACE_EXECUTE; 864 if (access_mask & S_IWOTH) 865 new_mask |= ACE_WRITE_DATA; 866 if (access_mask & S_IROTH) 867 new_mask |= ACE_READ_DATA; 868 return (new_mask); 869} 870 871static void 872zfs_set_ace(zfs_acl_t *aclp, void *acep, uint32_t access_mask, 873 uint16_t access_type, uint64_t fuid, uint16_t entry_type) 874{ 875 uint16_t type = entry_type & ACE_TYPE_FLAGS; 876 877 aclp->z_ops.ace_mask_set(acep, access_mask); 878 aclp->z_ops.ace_type_set(acep, access_type); 879 aclp->z_ops.ace_flags_set(acep, entry_type); 880 if ((type != ACE_OWNER && type != OWNING_GROUP && 881 type != ACE_EVERYONE)) 882 aclp->z_ops.ace_who_set(acep, fuid); 883} 884 885/* 886 * Determine mode of file based on ACL. 887 * Also, create FUIDs for any User/Group ACEs 888 */ 889uint64_t 890zfs_mode_compute(uint64_t fmode, zfs_acl_t *aclp, 891 uint64_t *pflags, uint64_t fuid, uint64_t fgid) 892{ 893 int entry_type; 894 mode_t mode; 895 mode_t seen = 0; 896 zfs_ace_hdr_t *acep = NULL; 897 uint64_t who; 898 uint16_t iflags, type; 899 uint32_t access_mask; 900 boolean_t an_exec_denied = B_FALSE; 901 902 mode = (fmode & (S_IFMT | S_ISUID | S_ISGID | S_ISVTX)); 903 904 while (acep = zfs_acl_next_ace(aclp, acep, &who, 905 &access_mask, &iflags, &type)) { 906 907 if (!zfs_acl_valid_ace_type(type, iflags)) 908 continue; 909 910 entry_type = (iflags & ACE_TYPE_FLAGS); 911 912 /* 913 * Skip over owner@, group@ or everyone@ inherit only ACEs 914 */ 915 if ((iflags & ACE_INHERIT_ONLY_ACE) && 916 (entry_type == ACE_OWNER || entry_type == ACE_EVERYONE || 917 entry_type == OWNING_GROUP)) 918 continue; 919 920 if (entry_type == ACE_OWNER || (entry_type == 0 && 921 who == fuid)) { 922 if ((access_mask & ACE_READ_DATA) && 923 (!(seen & S_IRUSR))) { 924 seen |= S_IRUSR; 925 if (type == ALLOW) { 926 mode |= S_IRUSR; 927 } 928 } 929 if ((access_mask & ACE_WRITE_DATA) && 930 (!(seen & S_IWUSR))) { 931 seen |= S_IWUSR; 932 if (type == ALLOW) { 933 mode |= S_IWUSR; 934 } 935 } 936 if ((access_mask & ACE_EXECUTE) && 937 (!(seen & S_IXUSR))) { 938 seen |= S_IXUSR; 939 if (type == ALLOW) { 940 mode |= S_IXUSR; 941 } 942 } 943 } else if (entry_type == OWNING_GROUP || 944 (entry_type == ACE_IDENTIFIER_GROUP && who == fgid)) { 945 if ((access_mask & ACE_READ_DATA) && 946 (!(seen & S_IRGRP))) { 947 seen |= S_IRGRP; 948 if (type == ALLOW) { 949 mode |= S_IRGRP; 950 } 951 } 952 if ((access_mask & ACE_WRITE_DATA) && 953 (!(seen & S_IWGRP))) { 954 seen |= S_IWGRP; 955 if (type == ALLOW) { 956 mode |= S_IWGRP; 957 } 958 } 959 if ((access_mask & ACE_EXECUTE) && 960 (!(seen & S_IXGRP))) { 961 seen |= S_IXGRP; 962 if (type == ALLOW) { 963 mode |= S_IXGRP; 964 } 965 } 966 } else if (entry_type == ACE_EVERYONE) { 967 if ((access_mask & ACE_READ_DATA)) { 968 if (!(seen & S_IRUSR)) { 969 seen |= S_IRUSR; 970 if (type == ALLOW) { 971 mode |= S_IRUSR; 972 } 973 } 974 if (!(seen & S_IRGRP)) { 975 seen |= S_IRGRP; 976 if (type == ALLOW) { 977 mode |= S_IRGRP; 978 } 979 } 980 if (!(seen & S_IROTH)) { 981 seen |= S_IROTH; 982 if (type == ALLOW) { 983 mode |= S_IROTH; 984 } 985 } 986 } 987 if ((access_mask & ACE_WRITE_DATA)) { 988 if (!(seen & S_IWUSR)) { 989 seen |= S_IWUSR; 990 if (type == ALLOW) { 991 mode |= S_IWUSR; 992 } 993 } 994 if (!(seen & S_IWGRP)) { 995 seen |= S_IWGRP; 996 if (type == ALLOW) { 997 mode |= S_IWGRP; 998 } 999 } 1000 if (!(seen & S_IWOTH)) { 1001 seen |= S_IWOTH; 1002 if (type == ALLOW) { 1003 mode |= S_IWOTH; 1004 } 1005 } 1006 } 1007 if ((access_mask & ACE_EXECUTE)) { 1008 if (!(seen & S_IXUSR)) { 1009 seen |= S_IXUSR; 1010 if (type == ALLOW) { 1011 mode |= S_IXUSR; 1012 } 1013 } 1014 if (!(seen & S_IXGRP)) { 1015 seen |= S_IXGRP; 1016 if (type == ALLOW) { 1017 mode |= S_IXGRP; 1018 } 1019 } 1020 if (!(seen & S_IXOTH)) { 1021 seen |= S_IXOTH; 1022 if (type == ALLOW) { 1023 mode |= S_IXOTH; 1024 } 1025 } 1026 } 1027 } else { 1028 /* 1029 * Only care if this IDENTIFIER_GROUP or 1030 * USER ACE denies execute access to someone, 1031 * mode is not affected 1032 */ 1033 if ((access_mask & ACE_EXECUTE) && type == DENY) 1034 an_exec_denied = B_TRUE; 1035 } 1036 } 1037 1038 /* 1039 * Failure to allow is effectively a deny, so execute permission 1040 * is denied if it was never mentioned or if we explicitly 1041 * weren't allowed it. 1042 */ 1043 if (!an_exec_denied && 1044 ((seen & ALL_MODE_EXECS) != ALL_MODE_EXECS || 1045 (mode & ALL_MODE_EXECS) != ALL_MODE_EXECS)) 1046 an_exec_denied = B_TRUE; 1047 1048 if (an_exec_denied) 1049 *pflags &= ~ZFS_NO_EXECS_DENIED; 1050 else 1051 *pflags |= ZFS_NO_EXECS_DENIED; 1052 1053 return (mode); 1054} 1055 1056/* 1057 * Read an external acl object. If the intent is to modify, always 1058 * create a new acl and leave any cached acl in place. 1059 */ 1060static int 1061zfs_acl_node_read(znode_t *zp, zfs_acl_t **aclpp, boolean_t will_modify) 1062{ 1063 zfs_acl_t *aclp; 1064 int aclsize; 1065 int acl_count; 1066 zfs_acl_node_t *aclnode; 1067 zfs_acl_phys_t znode_acl; 1068 int version; 1069 int error; 1070 1071 ASSERT(MUTEX_HELD(&zp->z_acl_lock)); 1072 ASSERT_VOP_LOCKED(ZTOV(zp), __func__); 1073 1074 if (zp->z_acl_cached && !will_modify) { 1075 *aclpp = zp->z_acl_cached; 1076 return (0); 1077 } 1078 1079 version = zfs_znode_acl_version(zp); 1080 1081 if ((error = zfs_acl_znode_info(zp, &aclsize, 1082 &acl_count, &znode_acl)) != 0) { 1083 goto done; 1084 } 1085 1086 aclp = zfs_acl_alloc(version); 1087 1088 aclp->z_acl_count = acl_count; 1089 aclp->z_acl_bytes = aclsize; 1090 1091 aclnode = zfs_acl_node_alloc(aclsize); 1092 aclnode->z_ace_count = aclp->z_acl_count; 1093 aclnode->z_size = aclsize; 1094 1095 if (!zp->z_is_sa) { 1096 if (znode_acl.z_acl_extern_obj) { 1097 error = dmu_read(zp->z_zfsvfs->z_os, 1098 znode_acl.z_acl_extern_obj, 0, aclnode->z_size, 1099 aclnode->z_acldata, DMU_READ_PREFETCH); 1100 } else { 1101 bcopy(znode_acl.z_ace_data, aclnode->z_acldata, 1102 aclnode->z_size); 1103 } 1104 } else { 1105 error = sa_lookup(zp->z_sa_hdl, SA_ZPL_DACL_ACES(zp->z_zfsvfs), 1106 aclnode->z_acldata, aclnode->z_size); 1107 } 1108 1109 if (error != 0) { 1110 zfs_acl_free(aclp); 1111 zfs_acl_node_free(aclnode); 1112 /* convert checksum errors into IO errors */ 1113 if (error == ECKSUM) 1114 error = SET_ERROR(EIO); 1115 goto done; 1116 } 1117 1118 list_insert_head(&aclp->z_acl, aclnode); 1119 1120 *aclpp = aclp; 1121 if (!will_modify) 1122 zp->z_acl_cached = aclp; 1123done: 1124 return (error); 1125} 1126 1127/*ARGSUSED*/ 1128void 1129zfs_acl_data_locator(void **dataptr, uint32_t *length, uint32_t buflen, 1130 boolean_t start, void *userdata) 1131{ 1132 zfs_acl_locator_cb_t *cb = (zfs_acl_locator_cb_t *)userdata; 1133 1134 if (start) { 1135 cb->cb_acl_node = list_head(&cb->cb_aclp->z_acl); 1136 } else { 1137 cb->cb_acl_node = list_next(&cb->cb_aclp->z_acl, 1138 cb->cb_acl_node); 1139 } 1140 *dataptr = cb->cb_acl_node->z_acldata; 1141 *length = cb->cb_acl_node->z_size; 1142} 1143 1144int 1145zfs_acl_chown_setattr(znode_t *zp) 1146{ 1147 int error; 1148 zfs_acl_t *aclp; 1149 1150 ASSERT_VOP_ELOCKED(ZTOV(zp), __func__); 1151 ASSERT(MUTEX_HELD(&zp->z_acl_lock)); 1152 1153 if ((error = zfs_acl_node_read(zp, &aclp, B_FALSE)) == 0) 1154 zp->z_mode = zfs_mode_compute(zp->z_mode, aclp, 1155 &zp->z_pflags, zp->z_uid, zp->z_gid); 1156 return (error); 1157} 1158 1159/* 1160 * common code for setting ACLs. 1161 * 1162 * This function is called from zfs_mode_update, zfs_perm_init, and zfs_setacl. 1163 * zfs_setacl passes a non-NULL inherit pointer (ihp) to indicate that it's 1164 * already checked the acl and knows whether to inherit. 1165 */ 1166int 1167zfs_aclset_common(znode_t *zp, zfs_acl_t *aclp, cred_t *cr, dmu_tx_t *tx) 1168{ 1169 int error; 1170 zfsvfs_t *zfsvfs = zp->z_zfsvfs; 1171 dmu_object_type_t otype; 1172 zfs_acl_locator_cb_t locate = { 0 }; 1173 uint64_t mode; 1174 sa_bulk_attr_t bulk[5]; 1175 uint64_t ctime[2]; 1176 int count = 0; 1177 zfs_acl_phys_t acl_phys; 1178 1179 mode = zp->z_mode; 1180 1181 mode = zfs_mode_compute(mode, aclp, &zp->z_pflags, 1182 zp->z_uid, zp->z_gid); 1183 1184 zp->z_mode = mode; 1185 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_MODE(zfsvfs), NULL, 1186 &mode, sizeof (mode)); 1187 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_FLAGS(zfsvfs), NULL, 1188 &zp->z_pflags, sizeof (zp->z_pflags)); 1189 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_CTIME(zfsvfs), NULL, 1190 &ctime, sizeof (ctime)); 1191 1192 if (zp->z_acl_cached) { 1193 zfs_acl_free(zp->z_acl_cached); 1194 zp->z_acl_cached = NULL; 1195 } 1196 1197 /* 1198 * Upgrade needed? 1199 */ 1200 if (!zfsvfs->z_use_fuids) { 1201 otype = DMU_OT_OLDACL; 1202 } else { 1203 if ((aclp->z_version == ZFS_ACL_VERSION_INITIAL) && 1204 (zfsvfs->z_version >= ZPL_VERSION_FUID)) 1205 zfs_acl_xform(zp, aclp, cr); 1206 ASSERT(aclp->z_version >= ZFS_ACL_VERSION_FUID); 1207 otype = DMU_OT_ACL; 1208 } 1209 1210 /* 1211 * Arrgh, we have to handle old on disk format 1212 * as well as newer (preferred) SA format. 1213 */ 1214 1215 if (zp->z_is_sa) { /* the easy case, just update the ACL attribute */ 1216 locate.cb_aclp = aclp; 1217 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_DACL_ACES(zfsvfs), 1218 zfs_acl_data_locator, &locate, aclp->z_acl_bytes); 1219 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_DACL_COUNT(zfsvfs), 1220 NULL, &aclp->z_acl_count, sizeof (uint64_t)); 1221 } else { /* Painful legacy way */ 1222 zfs_acl_node_t *aclnode; 1223 uint64_t off = 0; 1224 uint64_t aoid; 1225 1226 if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_ZNODE_ACL(zfsvfs), 1227 &acl_phys, sizeof (acl_phys))) != 0) 1228 return (error); 1229 1230 aoid = acl_phys.z_acl_extern_obj; 1231 1232 if (aclp->z_acl_bytes > ZFS_ACE_SPACE) { 1233 /* 1234 * If ACL was previously external and we are now 1235 * converting to new ACL format then release old 1236 * ACL object and create a new one. 1237 */ 1238 if (aoid && 1239 aclp->z_version != acl_phys.z_acl_version) { 1240 error = dmu_object_free(zfsvfs->z_os, aoid, tx); 1241 if (error) 1242 return (error); 1243 aoid = 0; 1244 } 1245 if (aoid == 0) { 1246 aoid = dmu_object_alloc(zfsvfs->z_os, 1247 otype, aclp->z_acl_bytes, 1248 otype == DMU_OT_ACL ? 1249 DMU_OT_SYSACL : DMU_OT_NONE, 1250 otype == DMU_OT_ACL ? 1251 DN_MAX_BONUSLEN : 0, tx); 1252 } else { 1253 (void) dmu_object_set_blocksize(zfsvfs->z_os, 1254 aoid, aclp->z_acl_bytes, 0, tx); 1255 } 1256 acl_phys.z_acl_extern_obj = aoid; 1257 for (aclnode = list_head(&aclp->z_acl); aclnode; 1258 aclnode = list_next(&aclp->z_acl, aclnode)) { 1259 if (aclnode->z_ace_count == 0) 1260 continue; 1261 dmu_write(zfsvfs->z_os, aoid, off, 1262 aclnode->z_size, aclnode->z_acldata, tx); 1263 off += aclnode->z_size; 1264 } 1265 } else { 1266 void *start = acl_phys.z_ace_data; 1267 /* 1268 * Migrating back embedded? 1269 */ 1270 if (acl_phys.z_acl_extern_obj) { 1271 error = dmu_object_free(zfsvfs->z_os, 1272 acl_phys.z_acl_extern_obj, tx); 1273 if (error) 1274 return (error); 1275 acl_phys.z_acl_extern_obj = 0; 1276 } 1277 1278 for (aclnode = list_head(&aclp->z_acl); aclnode; 1279 aclnode = list_next(&aclp->z_acl, aclnode)) { 1280 if (aclnode->z_ace_count == 0) 1281 continue; 1282 bcopy(aclnode->z_acldata, start, 1283 aclnode->z_size); 1284 start = (caddr_t)start + aclnode->z_size; 1285 } 1286 } 1287 /* 1288 * If Old version then swap count/bytes to match old 1289 * layout of znode_acl_phys_t. 1290 */ 1291 if (aclp->z_version == ZFS_ACL_VERSION_INITIAL) { 1292 acl_phys.z_acl_size = aclp->z_acl_count; 1293 acl_phys.z_acl_count = aclp->z_acl_bytes; 1294 } else { 1295 acl_phys.z_acl_size = aclp->z_acl_bytes; 1296 acl_phys.z_acl_count = aclp->z_acl_count; 1297 } 1298 acl_phys.z_acl_version = aclp->z_version; 1299 1300 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_ZNODE_ACL(zfsvfs), NULL, 1301 &acl_phys, sizeof (acl_phys)); 1302 } 1303 1304 /* 1305 * Replace ACL wide bits, but first clear them. 1306 */ 1307 zp->z_pflags &= ~ZFS_ACL_WIDE_FLAGS; 1308 1309 zp->z_pflags |= aclp->z_hints; 1310 1311 if (ace_trivial_common(aclp, 0, zfs_ace_walk) == 0) 1312 zp->z_pflags |= ZFS_ACL_TRIVIAL; 1313 1314 zfs_tstamp_update_setup(zp, STATE_CHANGED, NULL, ctime, B_TRUE); 1315 return (sa_bulk_update(zp->z_sa_hdl, bulk, count, tx)); 1316} 1317 1318static void 1319zfs_acl_chmod(vtype_t vtype, uint64_t mode, boolean_t trim, zfs_acl_t *aclp) 1320{ 1321 void *acep = NULL; 1322 uint64_t who; 1323 int new_count, new_bytes; 1324 int ace_size; 1325 int entry_type; 1326 uint16_t iflags, type; 1327 uint32_t access_mask; 1328 zfs_acl_node_t *newnode; 1329 size_t abstract_size = aclp->z_ops.ace_abstract_size(); 1330 void *zacep; 1331 boolean_t isdir; 1332 trivial_acl_t masks; 1333 1334 new_count = new_bytes = 0; 1335 1336 isdir = (vtype == VDIR); 1337 1338 acl_trivial_access_masks((mode_t)mode, isdir, &masks); 1339 1340 newnode = zfs_acl_node_alloc((abstract_size * 6) + aclp->z_acl_bytes); 1341 1342 zacep = newnode->z_acldata; 1343 if (masks.allow0) { 1344 zfs_set_ace(aclp, zacep, masks.allow0, ALLOW, -1, ACE_OWNER); 1345 zacep = (void *)((uintptr_t)zacep + abstract_size); 1346 new_count++; 1347 new_bytes += abstract_size; 1348 } 1349 if (masks.deny1) { 1350 zfs_set_ace(aclp, zacep, masks.deny1, DENY, -1, ACE_OWNER); 1351 zacep = (void *)((uintptr_t)zacep + abstract_size); 1352 new_count++; 1353 new_bytes += abstract_size; 1354 } 1355 if (masks.deny2) { 1356 zfs_set_ace(aclp, zacep, masks.deny2, DENY, -1, OWNING_GROUP); 1357 zacep = (void *)((uintptr_t)zacep + abstract_size); 1358 new_count++; 1359 new_bytes += abstract_size; 1360 } 1361 1362 while (acep = zfs_acl_next_ace(aclp, acep, &who, &access_mask, 1363 &iflags, &type)) { 1364 uint16_t inherit_flags; 1365 1366 entry_type = (iflags & ACE_TYPE_FLAGS); 1367 inherit_flags = (iflags & ALL_INHERIT); 1368 1369 if ((entry_type == ACE_OWNER || entry_type == ACE_EVERYONE || 1370 (entry_type == OWNING_GROUP)) && 1371 ((inherit_flags & ACE_INHERIT_ONLY_ACE) == 0)) { 1372 continue; 1373 } 1374 1375 /* 1376 * If this ACL has any inheritable ACEs, mark that in 1377 * the hints (which are later masked into the pflags) 1378 * so create knows to do inheritance. 1379 */ 1380 if (isdir && (inherit_flags & 1381 (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE))) 1382 aclp->z_hints |= ZFS_INHERIT_ACE; 1383 1384 if ((type != ALLOW && type != DENY) || 1385 (inherit_flags & ACE_INHERIT_ONLY_ACE)) { 1386 switch (type) { 1387 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 1388 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 1389 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 1390 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 1391 aclp->z_hints |= ZFS_ACL_OBJ_ACE; 1392 break; 1393 } 1394 } else { 1395 1396 /* 1397 * Limit permissions to be no greater than 1398 * group permissions. 1399 * The "aclinherit" and "aclmode" properties 1400 * affect policy for create and chmod(2), 1401 * respectively. 1402 */ 1403 if ((type == ALLOW) && trim) 1404 access_mask &= masks.group; 1405 } 1406 zfs_set_ace(aclp, zacep, access_mask, type, who, iflags); 1407 ace_size = aclp->z_ops.ace_size(acep); 1408 zacep = (void *)((uintptr_t)zacep + ace_size); 1409 new_count++; 1410 new_bytes += ace_size; 1411 } 1412 zfs_set_ace(aclp, zacep, masks.owner, 0, -1, ACE_OWNER); 1413 zacep = (void *)((uintptr_t)zacep + abstract_size); 1414 zfs_set_ace(aclp, zacep, masks.group, 0, -1, OWNING_GROUP); 1415 zacep = (void *)((uintptr_t)zacep + abstract_size); 1416 zfs_set_ace(aclp, zacep, masks.everyone, 0, -1, ACE_EVERYONE); 1417 1418 new_count += 3; 1419 new_bytes += abstract_size * 3; 1420 zfs_acl_release_nodes(aclp); 1421 aclp->z_acl_count = new_count; 1422 aclp->z_acl_bytes = new_bytes; 1423 newnode->z_ace_count = new_count; 1424 newnode->z_size = new_bytes; 1425 list_insert_tail(&aclp->z_acl, newnode); 1426} 1427 1428int 1429zfs_acl_chmod_setattr(znode_t *zp, zfs_acl_t **aclp, uint64_t mode) 1430{ 1431 int error = 0; 1432 1433 mutex_enter(&zp->z_acl_lock); 1434 ASSERT_VOP_ELOCKED(ZTOV(zp), __func__); 1435 if (zp->z_zfsvfs->z_acl_mode == ZFS_ACL_DISCARD) 1436 *aclp = zfs_acl_alloc(zfs_acl_version_zp(zp)); 1437 else 1438 error = zfs_acl_node_read(zp, aclp, B_TRUE); 1439 1440 if (error == 0) { 1441 (*aclp)->z_hints = zp->z_pflags & V4_ACL_WIDE_FLAGS; 1442 zfs_acl_chmod(ZTOV(zp)->v_type, mode, 1443 (zp->z_zfsvfs->z_acl_mode == ZFS_ACL_GROUPMASK), *aclp); 1444 } 1445 mutex_exit(&zp->z_acl_lock); 1446 1447 return (error); 1448} 1449 1450/* 1451 * strip off write_owner and write_acl 1452 */ 1453static void 1454zfs_restricted_update(zfsvfs_t *zfsvfs, zfs_acl_t *aclp, void *acep) 1455{ 1456 uint32_t mask = aclp->z_ops.ace_mask_get(acep); 1457 1458 if ((zfsvfs->z_acl_inherit == ZFS_ACL_RESTRICTED) && 1459 (aclp->z_ops.ace_type_get(acep) == ALLOW)) { 1460 mask &= ~RESTRICTED_CLEAR; 1461 aclp->z_ops.ace_mask_set(acep, mask); 1462 } 1463} 1464 1465/* 1466 * Should ACE be inherited? 1467 */ 1468static int 1469zfs_ace_can_use(vtype_t vtype, uint16_t acep_flags) 1470{ 1471 int iflags = (acep_flags & 0xf); 1472 1473 if ((vtype == VDIR) && (iflags & ACE_DIRECTORY_INHERIT_ACE)) 1474 return (1); 1475 else if (iflags & ACE_FILE_INHERIT_ACE) 1476 return (!((vtype == VDIR) && 1477 (iflags & ACE_NO_PROPAGATE_INHERIT_ACE))); 1478 return (0); 1479} 1480 1481/* 1482 * inherit inheritable ACEs from parent 1483 */ 1484static zfs_acl_t * 1485zfs_acl_inherit(zfsvfs_t *zfsvfs, vtype_t vtype, zfs_acl_t *paclp, 1486 uint64_t mode, boolean_t *need_chmod) 1487{ 1488 void *pacep; 1489 void *acep; 1490 zfs_acl_node_t *aclnode; 1491 zfs_acl_t *aclp = NULL; 1492 uint64_t who; 1493 uint32_t access_mask; 1494 uint16_t iflags, newflags, type; 1495 size_t ace_size; 1496 void *data1, *data2; 1497 size_t data1sz, data2sz; 1498 boolean_t vdir = vtype == VDIR; 1499 boolean_t vreg = vtype == VREG; 1500 boolean_t passthrough, passthrough_x, noallow; 1501 1502 passthrough_x = 1503 zfsvfs->z_acl_inherit == ZFS_ACL_PASSTHROUGH_X; 1504 passthrough = passthrough_x || 1505 zfsvfs->z_acl_inherit == ZFS_ACL_PASSTHROUGH; 1506 noallow = 1507 zfsvfs->z_acl_inherit == ZFS_ACL_NOALLOW; 1508 1509 *need_chmod = B_TRUE; 1510 pacep = NULL; 1511 aclp = zfs_acl_alloc(paclp->z_version); 1512 if (zfsvfs->z_acl_inherit == ZFS_ACL_DISCARD || vtype == VLNK) 1513 return (aclp); 1514 while (pacep = zfs_acl_next_ace(paclp, pacep, &who, 1515 &access_mask, &iflags, &type)) { 1516 1517 /* 1518 * don't inherit bogus ACEs 1519 */ 1520 if (!zfs_acl_valid_ace_type(type, iflags)) 1521 continue; 1522 1523 if (noallow && type == ALLOW) 1524 continue; 1525 1526 ace_size = aclp->z_ops.ace_size(pacep); 1527 1528 if (!zfs_ace_can_use(vtype, iflags)) 1529 continue; 1530 1531 /* 1532 * If owner@, group@, or everyone@ inheritable 1533 * then zfs_acl_chmod() isn't needed. 1534 */ 1535 if (passthrough && 1536 ((iflags & (ACE_OWNER|ACE_EVERYONE)) || 1537 ((iflags & OWNING_GROUP) == 1538 OWNING_GROUP)) && (vreg || (vdir && (iflags & 1539 ACE_DIRECTORY_INHERIT_ACE)))) { 1540 *need_chmod = B_FALSE; 1541 } 1542 1543 if (!vdir && passthrough_x && 1544 ((mode & (S_IXUSR | S_IXGRP | S_IXOTH)) == 0)) { 1545 access_mask &= ~ACE_EXECUTE; 1546 } 1547 1548 aclnode = zfs_acl_node_alloc(ace_size); 1549 list_insert_tail(&aclp->z_acl, aclnode); 1550 acep = aclnode->z_acldata; 1551 1552 zfs_set_ace(aclp, acep, access_mask, type, 1553 who, iflags|ACE_INHERITED_ACE); 1554 1555 /* 1556 * Copy special opaque data if any 1557 */ 1558 if ((data1sz = paclp->z_ops.ace_data(pacep, &data1)) != 0) { 1559 VERIFY((data2sz = aclp->z_ops.ace_data(acep, 1560 &data2)) == data1sz); 1561 bcopy(data1, data2, data2sz); 1562 } 1563 1564 aclp->z_acl_count++; 1565 aclnode->z_ace_count++; 1566 aclp->z_acl_bytes += aclnode->z_size; 1567 newflags = aclp->z_ops.ace_flags_get(acep); 1568 1569 if (vdir) 1570 aclp->z_hints |= ZFS_INHERIT_ACE; 1571 1572 if ((iflags & ACE_NO_PROPAGATE_INHERIT_ACE) || !vdir) { 1573 newflags &= ~ALL_INHERIT; 1574 aclp->z_ops.ace_flags_set(acep, 1575 newflags|ACE_INHERITED_ACE); 1576 zfs_restricted_update(zfsvfs, aclp, acep); 1577 continue; 1578 } 1579 1580 ASSERT(vdir); 1581 1582 /* 1583 * If only FILE_INHERIT is set then turn on 1584 * inherit_only 1585 */ 1586 if ((iflags & (ACE_FILE_INHERIT_ACE | 1587 ACE_DIRECTORY_INHERIT_ACE)) == ACE_FILE_INHERIT_ACE) { 1588 newflags |= ACE_INHERIT_ONLY_ACE; 1589 aclp->z_ops.ace_flags_set(acep, 1590 newflags|ACE_INHERITED_ACE); 1591 } else { 1592 newflags &= ~ACE_INHERIT_ONLY_ACE; 1593 aclp->z_ops.ace_flags_set(acep, 1594 newflags|ACE_INHERITED_ACE); 1595 } 1596 } 1597 return (aclp); 1598} 1599 1600/* 1601 * Create file system object initial permissions 1602 * including inheritable ACEs. 1603 */ 1604int 1605zfs_acl_ids_create(znode_t *dzp, int flag, vattr_t *vap, cred_t *cr, 1606 vsecattr_t *vsecp, zfs_acl_ids_t *acl_ids) 1607{ 1608 int error; 1609 zfsvfs_t *zfsvfs = dzp->z_zfsvfs; 1610 zfs_acl_t *paclp; 1611 gid_t gid; 1612 boolean_t need_chmod = B_TRUE; 1613 boolean_t inherited = B_FALSE; 1614 1615 if ((flag & IS_ROOT_NODE) == 0) 1616 ASSERT_VOP_ELOCKED(ZTOV(dzp), __func__); 1617 else 1618 ASSERT(dzp->z_vnode == NULL); 1619 bzero(acl_ids, sizeof (zfs_acl_ids_t)); 1620 acl_ids->z_mode = MAKEIMODE(vap->va_type, vap->va_mode); 1621 1622 if (vsecp) 1623 if ((error = zfs_vsec_2_aclp(zfsvfs, vap->va_type, vsecp, cr, 1624 &acl_ids->z_fuidp, &acl_ids->z_aclp)) != 0) 1625 return (error); 1626 /* 1627 * Determine uid and gid. 1628 */ 1629 if ((flag & IS_ROOT_NODE) || zfsvfs->z_replay || 1630 ((flag & IS_XATTR) && (vap->va_type == VDIR))) { 1631 acl_ids->z_fuid = zfs_fuid_create(zfsvfs, 1632 (uint64_t)vap->va_uid, cr, 1633 ZFS_OWNER, &acl_ids->z_fuidp); 1634 acl_ids->z_fgid = zfs_fuid_create(zfsvfs, 1635 (uint64_t)vap->va_gid, cr, 1636 ZFS_GROUP, &acl_ids->z_fuidp); 1637 gid = vap->va_gid; 1638 } else { 1639 acl_ids->z_fuid = zfs_fuid_create_cred(zfsvfs, ZFS_OWNER, 1640 cr, &acl_ids->z_fuidp); 1641 acl_ids->z_fgid = 0; 1642 if (vap->va_mask & AT_GID) { 1643 acl_ids->z_fgid = zfs_fuid_create(zfsvfs, 1644 (uint64_t)vap->va_gid, 1645 cr, ZFS_GROUP, &acl_ids->z_fuidp); 1646 gid = vap->va_gid; 1647 if (acl_ids->z_fgid != dzp->z_gid && 1648 !groupmember(vap->va_gid, cr) && 1649 secpolicy_vnode_create_gid(cr) != 0) 1650 acl_ids->z_fgid = 0; 1651 } 1652 if (acl_ids->z_fgid == 0) { 1653 if (dzp->z_mode & S_ISGID) { 1654 char *domain; 1655 uint32_t rid; 1656 1657 acl_ids->z_fgid = dzp->z_gid; 1658 gid = zfs_fuid_map_id(zfsvfs, acl_ids->z_fgid, 1659 cr, ZFS_GROUP); 1660 1661 if (zfsvfs->z_use_fuids && 1662 IS_EPHEMERAL(acl_ids->z_fgid)) { 1663 domain = zfs_fuid_idx_domain( 1664 &zfsvfs->z_fuid_idx, 1665 FUID_INDEX(acl_ids->z_fgid)); 1666 rid = FUID_RID(acl_ids->z_fgid); 1667 zfs_fuid_node_add(&acl_ids->z_fuidp, 1668 domain, rid, 1669 FUID_INDEX(acl_ids->z_fgid), 1670 acl_ids->z_fgid, ZFS_GROUP); 1671 } 1672 } else { 1673 acl_ids->z_fgid = zfs_fuid_create_cred(zfsvfs, 1674 ZFS_GROUP, cr, &acl_ids->z_fuidp); 1675#ifdef __FreeBSD_kernel__ 1676 gid = acl_ids->z_fgid = dzp->z_gid; 1677#else 1678 gid = crgetgid(cr); 1679#endif 1680 } 1681 } 1682 } 1683 1684 /* 1685 * If we're creating a directory, and the parent directory has the 1686 * set-GID bit set, set in on the new directory. 1687 * Otherwise, if the user is neither privileged nor a member of the 1688 * file's new group, clear the file's set-GID bit. 1689 */ 1690 1691 if (!(flag & IS_ROOT_NODE) && (dzp->z_mode & S_ISGID) && 1692 (vap->va_type == VDIR)) { 1693 acl_ids->z_mode |= S_ISGID; 1694 } else { 1695 if ((acl_ids->z_mode & S_ISGID) && 1696 secpolicy_vnode_setids_setgids(ZTOV(dzp), cr, gid) != 0) 1697 acl_ids->z_mode &= ~S_ISGID; 1698 } 1699 1700 if (acl_ids->z_aclp == NULL) { 1701 mutex_enter(&dzp->z_acl_lock); 1702 if (!(flag & IS_ROOT_NODE) && 1703 (dzp->z_pflags & ZFS_INHERIT_ACE) && 1704 !(dzp->z_pflags & ZFS_XATTR)) { 1705 VERIFY(0 == zfs_acl_node_read(dzp, &paclp, B_FALSE)); 1706 acl_ids->z_aclp = zfs_acl_inherit(zfsvfs, 1707 vap->va_type, paclp, acl_ids->z_mode, &need_chmod); 1708 inherited = B_TRUE; 1709 } else { 1710 acl_ids->z_aclp = 1711 zfs_acl_alloc(zfs_acl_version_zp(dzp)); 1712 acl_ids->z_aclp->z_hints |= ZFS_ACL_TRIVIAL; 1713 } 1714 mutex_exit(&dzp->z_acl_lock); 1715 if (need_chmod) { 1716 acl_ids->z_aclp->z_hints |= (vap->va_type == VDIR) ? 1717 ZFS_ACL_AUTO_INHERIT : 0; 1718 zfs_acl_chmod(vap->va_type, acl_ids->z_mode, 1719 (zfsvfs->z_acl_inherit == ZFS_ACL_RESTRICTED), 1720 acl_ids->z_aclp); 1721 } 1722 } 1723 1724 if (inherited || vsecp) { 1725 acl_ids->z_mode = zfs_mode_compute(acl_ids->z_mode, 1726 acl_ids->z_aclp, &acl_ids->z_aclp->z_hints, 1727 acl_ids->z_fuid, acl_ids->z_fgid); 1728 if (ace_trivial_common(acl_ids->z_aclp, 0, zfs_ace_walk) == 0) 1729 acl_ids->z_aclp->z_hints |= ZFS_ACL_TRIVIAL; 1730 } 1731 1732 return (0); 1733} 1734 1735/* 1736 * Free ACL and fuid_infop, but not the acl_ids structure 1737 */ 1738void 1739zfs_acl_ids_free(zfs_acl_ids_t *acl_ids) 1740{ 1741 if (acl_ids->z_aclp) 1742 zfs_acl_free(acl_ids->z_aclp); 1743 if (acl_ids->z_fuidp) 1744 zfs_fuid_info_free(acl_ids->z_fuidp); 1745 acl_ids->z_aclp = NULL; 1746 acl_ids->z_fuidp = NULL; 1747} 1748 1749boolean_t 1750zfs_acl_ids_overquota(zfsvfs_t *zfsvfs, zfs_acl_ids_t *acl_ids) 1751{ 1752 return (zfs_fuid_overquota(zfsvfs, B_FALSE, acl_ids->z_fuid) || 1753 zfs_fuid_overquota(zfsvfs, B_TRUE, acl_ids->z_fgid)); 1754} 1755 1756/* 1757 * Retrieve a file's ACL 1758 */ 1759int 1760zfs_getacl(znode_t *zp, vsecattr_t *vsecp, boolean_t skipaclchk, cred_t *cr) 1761{ 1762 zfs_acl_t *aclp; 1763 ulong_t mask; 1764 int error; 1765 int count = 0; 1766 int largeace = 0; 1767 1768 mask = vsecp->vsa_mask & (VSA_ACE | VSA_ACECNT | 1769 VSA_ACE_ACLFLAGS | VSA_ACE_ALLTYPES); 1770 1771 if (mask == 0) 1772 return (SET_ERROR(ENOSYS)); 1773 1774 if (error = zfs_zaccess(zp, ACE_READ_ACL, 0, skipaclchk, cr)) 1775 return (error); 1776 1777 mutex_enter(&zp->z_acl_lock); 1778 1779 ASSERT_VOP_LOCKED(ZTOV(zp), __func__); 1780 error = zfs_acl_node_read(zp, &aclp, B_FALSE); 1781 if (error != 0) { 1782 mutex_exit(&zp->z_acl_lock); 1783 return (error); 1784 } 1785 1786 /* 1787 * Scan ACL to determine number of ACEs 1788 */ 1789 if ((zp->z_pflags & ZFS_ACL_OBJ_ACE) && !(mask & VSA_ACE_ALLTYPES)) { 1790 void *zacep = NULL; 1791 uint64_t who; 1792 uint32_t access_mask; 1793 uint16_t type, iflags; 1794 1795 while (zacep = zfs_acl_next_ace(aclp, zacep, 1796 &who, &access_mask, &iflags, &type)) { 1797 switch (type) { 1798 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 1799 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 1800 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 1801 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 1802 largeace++; 1803 continue; 1804 default: 1805 count++; 1806 } 1807 } 1808 vsecp->vsa_aclcnt = count; 1809 } else 1810 count = (int)aclp->z_acl_count; 1811 1812 if (mask & VSA_ACECNT) { 1813 vsecp->vsa_aclcnt = count; 1814 } 1815 1816 if (mask & VSA_ACE) { 1817 size_t aclsz; 1818 1819 aclsz = count * sizeof (ace_t) + 1820 sizeof (ace_object_t) * largeace; 1821 1822 vsecp->vsa_aclentp = kmem_alloc(aclsz, KM_SLEEP); 1823 vsecp->vsa_aclentsz = aclsz; 1824 1825 if (aclp->z_version == ZFS_ACL_VERSION_FUID) 1826 zfs_copy_fuid_2_ace(zp->z_zfsvfs, aclp, cr, 1827 vsecp->vsa_aclentp, !(mask & VSA_ACE_ALLTYPES)); 1828 else { 1829 zfs_acl_node_t *aclnode; 1830 void *start = vsecp->vsa_aclentp; 1831 1832 for (aclnode = list_head(&aclp->z_acl); aclnode; 1833 aclnode = list_next(&aclp->z_acl, aclnode)) { 1834 bcopy(aclnode->z_acldata, start, 1835 aclnode->z_size); 1836 start = (caddr_t)start + aclnode->z_size; 1837 } 1838 ASSERT((caddr_t)start - (caddr_t)vsecp->vsa_aclentp == 1839 aclp->z_acl_bytes); 1840 } 1841 } 1842 if (mask & VSA_ACE_ACLFLAGS) { 1843 vsecp->vsa_aclflags = 0; 1844 if (zp->z_pflags & ZFS_ACL_DEFAULTED) 1845 vsecp->vsa_aclflags |= ACL_DEFAULTED; 1846 if (zp->z_pflags & ZFS_ACL_PROTECTED) 1847 vsecp->vsa_aclflags |= ACL_PROTECTED; 1848 if (zp->z_pflags & ZFS_ACL_AUTO_INHERIT) 1849 vsecp->vsa_aclflags |= ACL_AUTO_INHERIT; 1850 } 1851 1852 mutex_exit(&zp->z_acl_lock); 1853 1854 return (0); 1855} 1856 1857int 1858zfs_vsec_2_aclp(zfsvfs_t *zfsvfs, vtype_t obj_type, 1859 vsecattr_t *vsecp, cred_t *cr, zfs_fuid_info_t **fuidp, zfs_acl_t **zaclp) 1860{ 1861 zfs_acl_t *aclp; 1862 zfs_acl_node_t *aclnode; 1863 int aclcnt = vsecp->vsa_aclcnt; 1864 int error; 1865 1866 if (vsecp->vsa_aclcnt > MAX_ACL_ENTRIES || vsecp->vsa_aclcnt <= 0) 1867 return (SET_ERROR(EINVAL)); 1868 1869 aclp = zfs_acl_alloc(zfs_acl_version(zfsvfs->z_version)); 1870 1871 aclp->z_hints = 0; 1872 aclnode = zfs_acl_node_alloc(aclcnt * sizeof (zfs_object_ace_t)); 1873 if (aclp->z_version == ZFS_ACL_VERSION_INITIAL) { 1874 if ((error = zfs_copy_ace_2_oldace(obj_type, aclp, 1875 (ace_t *)vsecp->vsa_aclentp, aclnode->z_acldata, 1876 aclcnt, &aclnode->z_size)) != 0) { 1877 zfs_acl_free(aclp); 1878 zfs_acl_node_free(aclnode); 1879 return (error); 1880 } 1881 } else { 1882 if ((error = zfs_copy_ace_2_fuid(zfsvfs, obj_type, aclp, 1883 vsecp->vsa_aclentp, aclnode->z_acldata, aclcnt, 1884 &aclnode->z_size, fuidp, cr)) != 0) { 1885 zfs_acl_free(aclp); 1886 zfs_acl_node_free(aclnode); 1887 return (error); 1888 } 1889 } 1890 aclp->z_acl_bytes = aclnode->z_size; 1891 aclnode->z_ace_count = aclcnt; 1892 aclp->z_acl_count = aclcnt; 1893 list_insert_head(&aclp->z_acl, aclnode); 1894 1895 /* 1896 * If flags are being set then add them to z_hints 1897 */ 1898 if (vsecp->vsa_mask & VSA_ACE_ACLFLAGS) { 1899 if (vsecp->vsa_aclflags & ACL_PROTECTED) 1900 aclp->z_hints |= ZFS_ACL_PROTECTED; 1901 if (vsecp->vsa_aclflags & ACL_DEFAULTED) 1902 aclp->z_hints |= ZFS_ACL_DEFAULTED; 1903 if (vsecp->vsa_aclflags & ACL_AUTO_INHERIT) 1904 aclp->z_hints |= ZFS_ACL_AUTO_INHERIT; 1905 } 1906 1907 *zaclp = aclp; 1908 1909 return (0); 1910} 1911 1912/* 1913 * Set a file's ACL 1914 */ 1915int 1916zfs_setacl(znode_t *zp, vsecattr_t *vsecp, boolean_t skipaclchk, cred_t *cr) 1917{ 1918 zfsvfs_t *zfsvfs = zp->z_zfsvfs; 1919 zilog_t *zilog = zfsvfs->z_log; 1920 ulong_t mask = vsecp->vsa_mask & (VSA_ACE | VSA_ACECNT); 1921 dmu_tx_t *tx; 1922 int error; 1923 zfs_acl_t *aclp; 1924 zfs_fuid_info_t *fuidp = NULL; 1925 boolean_t fuid_dirtied; 1926 uint64_t acl_obj; 1927 1928 ASSERT_VOP_ELOCKED(ZTOV(zp), __func__); 1929 if (mask == 0) 1930 return (SET_ERROR(ENOSYS)); 1931 1932 if (zp->z_pflags & ZFS_IMMUTABLE) 1933 return (SET_ERROR(EPERM)); 1934 1935 if (error = zfs_zaccess(zp, ACE_WRITE_ACL, 0, skipaclchk, cr)) 1936 return (error); 1937 1938 error = zfs_vsec_2_aclp(zfsvfs, ZTOV(zp)->v_type, vsecp, cr, &fuidp, 1939 &aclp); 1940 if (error) 1941 return (error); 1942 1943 /* 1944 * If ACL wide flags aren't being set then preserve any 1945 * existing flags. 1946 */ 1947 if (!(vsecp->vsa_mask & VSA_ACE_ACLFLAGS)) { 1948 aclp->z_hints |= 1949 (zp->z_pflags & V4_ACL_WIDE_FLAGS); 1950 } 1951top: 1952 mutex_enter(&zp->z_acl_lock); 1953 1954 tx = dmu_tx_create(zfsvfs->z_os); 1955 1956 dmu_tx_hold_sa(tx, zp->z_sa_hdl, B_TRUE); 1957 1958 fuid_dirtied = zfsvfs->z_fuid_dirty; 1959 if (fuid_dirtied) 1960 zfs_fuid_txhold(zfsvfs, tx); 1961 1962 /* 1963 * If old version and ACL won't fit in bonus and we aren't 1964 * upgrading then take out necessary DMU holds 1965 */ 1966 1967 if ((acl_obj = zfs_external_acl(zp)) != 0) { 1968 if (zfsvfs->z_version >= ZPL_VERSION_FUID && 1969 zfs_znode_acl_version(zp) <= ZFS_ACL_VERSION_INITIAL) { 1970 dmu_tx_hold_free(tx, acl_obj, 0, 1971 DMU_OBJECT_END); 1972 dmu_tx_hold_write(tx, DMU_NEW_OBJECT, 0, 1973 aclp->z_acl_bytes); 1974 } else { 1975 dmu_tx_hold_write(tx, acl_obj, 0, aclp->z_acl_bytes); 1976 } 1977 } else if (!zp->z_is_sa && aclp->z_acl_bytes > ZFS_ACE_SPACE) { 1978 dmu_tx_hold_write(tx, DMU_NEW_OBJECT, 0, aclp->z_acl_bytes); 1979 } 1980 1981 zfs_sa_upgrade_txholds(tx, zp); 1982 error = dmu_tx_assign(tx, TXG_NOWAIT); 1983 if (error) { 1984 mutex_exit(&zp->z_acl_lock); 1985 1986 if (error == ERESTART) { 1987 dmu_tx_wait(tx); 1988 dmu_tx_abort(tx); 1989 goto top; 1990 } 1991 dmu_tx_abort(tx); 1992 zfs_acl_free(aclp); 1993 return (error); 1994 } 1995 1996 error = zfs_aclset_common(zp, aclp, cr, tx); 1997 ASSERT(error == 0); 1998 ASSERT(zp->z_acl_cached == NULL); 1999 zp->z_acl_cached = aclp; 2000 2001 if (fuid_dirtied) 2002 zfs_fuid_sync(zfsvfs, tx); 2003 2004 zfs_log_acl(zilog, tx, zp, vsecp, fuidp); 2005 2006 if (fuidp) 2007 zfs_fuid_info_free(fuidp); 2008 dmu_tx_commit(tx); 2009 mutex_exit(&zp->z_acl_lock); 2010 2011 return (error); 2012} 2013 2014/* 2015 * Check accesses of interest (AoI) against attributes of the dataset 2016 * such as read-only. Returns zero if no AoI conflict with dataset 2017 * attributes, otherwise an appropriate errno is returned. 2018 */ 2019static int 2020zfs_zaccess_dataset_check(znode_t *zp, uint32_t v4_mode) 2021{ 2022 if ((v4_mode & WRITE_MASK) && 2023 (zp->z_zfsvfs->z_vfs->vfs_flag & VFS_RDONLY) && 2024 (!IS_DEVVP(ZTOV(zp)) || 2025 (IS_DEVVP(ZTOV(zp)) && (v4_mode & WRITE_MASK_ATTRS)))) { 2026 return (SET_ERROR(EROFS)); 2027 } 2028 2029 /* 2030 * Only check for READONLY on non-directories. 2031 */ 2032 if ((v4_mode & WRITE_MASK_DATA) && 2033 (((ZTOV(zp)->v_type != VDIR) && 2034 (zp->z_pflags & (ZFS_READONLY | ZFS_IMMUTABLE))) || 2035 (ZTOV(zp)->v_type == VDIR && 2036 (zp->z_pflags & ZFS_IMMUTABLE)))) { 2037 return (SET_ERROR(EPERM)); 2038 } 2039 2040#ifdef illumos 2041 if ((v4_mode & (ACE_DELETE | ACE_DELETE_CHILD)) && 2042 (zp->z_pflags & ZFS_NOUNLINK)) { 2043 return (SET_ERROR(EPERM)); 2044 } 2045#else 2046 /* 2047 * In FreeBSD we allow to modify directory's content is ZFS_NOUNLINK 2048 * (sunlnk) is set. We just don't allow directory removal, which is 2049 * handled in zfs_zaccess_delete(). 2050 */ 2051 if ((v4_mode & ACE_DELETE) && 2052 (zp->z_pflags & ZFS_NOUNLINK)) { 2053 return (EPERM); 2054 } 2055#endif 2056 2057 if (((v4_mode & (ACE_READ_DATA|ACE_EXECUTE)) && 2058 (zp->z_pflags & ZFS_AV_QUARANTINED))) { 2059 return (SET_ERROR(EACCES)); 2060 } 2061 2062 return (0); 2063} 2064 2065/* 2066 * The primary usage of this function is to loop through all of the 2067 * ACEs in the znode, determining what accesses of interest (AoI) to 2068 * the caller are allowed or denied. The AoI are expressed as bits in 2069 * the working_mode parameter. As each ACE is processed, bits covered 2070 * by that ACE are removed from the working_mode. This removal 2071 * facilitates two things. The first is that when the working mode is 2072 * empty (= 0), we know we've looked at all the AoI. The second is 2073 * that the ACE interpretation rules don't allow a later ACE to undo 2074 * something granted or denied by an earlier ACE. Removing the 2075 * discovered access or denial enforces this rule. At the end of 2076 * processing the ACEs, all AoI that were found to be denied are 2077 * placed into the working_mode, giving the caller a mask of denied 2078 * accesses. Returns: 2079 * 0 if all AoI granted 2080 * EACCESS if the denied mask is non-zero 2081 * other error if abnormal failure (e.g., IO error) 2082 * 2083 * A secondary usage of the function is to determine if any of the 2084 * AoI are granted. If an ACE grants any access in 2085 * the working_mode, we immediately short circuit out of the function. 2086 * This mode is chosen by setting anyaccess to B_TRUE. The 2087 * working_mode is not a denied access mask upon exit if the function 2088 * is used in this manner. 2089 */ 2090static int 2091zfs_zaccess_aces_check(znode_t *zp, uint32_t *working_mode, 2092 boolean_t anyaccess, cred_t *cr) 2093{ 2094 zfsvfs_t *zfsvfs = zp->z_zfsvfs; 2095 zfs_acl_t *aclp; 2096 int error; 2097 uid_t uid = crgetuid(cr); 2098 uint64_t who; 2099 uint16_t type, iflags; 2100 uint16_t entry_type; 2101 uint32_t access_mask; 2102 uint32_t deny_mask = 0; 2103 zfs_ace_hdr_t *acep = NULL; 2104 boolean_t checkit; 2105 uid_t gowner; 2106 uid_t fowner; 2107 2108 zfs_fuid_map_ids(zp, cr, &fowner, &gowner); 2109 2110 mutex_enter(&zp->z_acl_lock); 2111 2112 ASSERT_VOP_LOCKED(ZTOV(zp), __func__); 2113 error = zfs_acl_node_read(zp, &aclp, B_FALSE); 2114 if (error != 0) { 2115 mutex_exit(&zp->z_acl_lock); 2116 return (error); 2117 } 2118 2119 ASSERT(zp->z_acl_cached); 2120 2121 while (acep = zfs_acl_next_ace(aclp, acep, &who, &access_mask, 2122 &iflags, &type)) { 2123 uint32_t mask_matched; 2124 2125 if (!zfs_acl_valid_ace_type(type, iflags)) 2126 continue; 2127 2128 if (ZTOV(zp)->v_type == VDIR && (iflags & ACE_INHERIT_ONLY_ACE)) 2129 continue; 2130 2131 /* Skip ACE if it does not affect any AoI */ 2132 mask_matched = (access_mask & *working_mode); 2133 if (!mask_matched) 2134 continue; 2135 2136 entry_type = (iflags & ACE_TYPE_FLAGS); 2137 2138 checkit = B_FALSE; 2139 2140 switch (entry_type) { 2141 case ACE_OWNER: 2142 if (uid == fowner) 2143 checkit = B_TRUE; 2144 break; 2145 case OWNING_GROUP: 2146 who = gowner; 2147 /*FALLTHROUGH*/ 2148 case ACE_IDENTIFIER_GROUP: 2149 checkit = zfs_groupmember(zfsvfs, who, cr); 2150 break; 2151 case ACE_EVERYONE: 2152 checkit = B_TRUE; 2153 break; 2154 2155 /* USER Entry */ 2156 default: 2157 if (entry_type == 0) { 2158 uid_t newid; 2159 2160 newid = zfs_fuid_map_id(zfsvfs, who, cr, 2161 ZFS_ACE_USER); 2162 if (newid != IDMAP_WK_CREATOR_OWNER_UID && 2163 uid == newid) 2164 checkit = B_TRUE; 2165 break; 2166 } else { 2167 mutex_exit(&zp->z_acl_lock); 2168 return (SET_ERROR(EIO)); 2169 } 2170 } 2171 2172 if (checkit) { 2173 if (type == DENY) { 2174 DTRACE_PROBE3(zfs__ace__denies, 2175 znode_t *, zp, 2176 zfs_ace_hdr_t *, acep, 2177 uint32_t, mask_matched); 2178 deny_mask |= mask_matched; 2179 } else { 2180 DTRACE_PROBE3(zfs__ace__allows, 2181 znode_t *, zp, 2182 zfs_ace_hdr_t *, acep, 2183 uint32_t, mask_matched); 2184 if (anyaccess) { 2185 mutex_exit(&zp->z_acl_lock); 2186 return (0); 2187 } 2188 } 2189 *working_mode &= ~mask_matched; 2190 } 2191 2192 /* Are we done? */ 2193 if (*working_mode == 0) 2194 break; 2195 } 2196 2197 mutex_exit(&zp->z_acl_lock); 2198 2199 /* Put the found 'denies' back on the working mode */ 2200 if (deny_mask) { 2201 *working_mode |= deny_mask; 2202 return (SET_ERROR(EACCES)); 2203 } else if (*working_mode) { 2204 return (-1); 2205 } 2206 2207 return (0); 2208} 2209 2210/* 2211 * Return true if any access whatsoever granted, we don't actually 2212 * care what access is granted. 2213 */ 2214boolean_t 2215zfs_has_access(znode_t *zp, cred_t *cr) 2216{ 2217 uint32_t have = ACE_ALL_PERMS; 2218 2219 if (zfs_zaccess_aces_check(zp, &have, B_TRUE, cr) != 0) { 2220 uid_t owner; 2221 2222 owner = zfs_fuid_map_id(zp->z_zfsvfs, zp->z_uid, cr, ZFS_OWNER); 2223 return (secpolicy_vnode_any_access(cr, ZTOV(zp), owner) == 0); 2224 } 2225 return (B_TRUE); 2226} 2227 2228static int 2229zfs_zaccess_common(znode_t *zp, uint32_t v4_mode, uint32_t *working_mode, 2230 boolean_t *check_privs, boolean_t skipaclchk, cred_t *cr) 2231{ 2232 zfsvfs_t *zfsvfs = zp->z_zfsvfs; 2233 int err; 2234 2235 *working_mode = v4_mode; 2236 *check_privs = B_TRUE; 2237 2238 /* 2239 * Short circuit empty requests 2240 */ 2241 if (v4_mode == 0 || zfsvfs->z_replay) { 2242 *working_mode = 0; 2243 return (0); 2244 } 2245 2246 if ((err = zfs_zaccess_dataset_check(zp, v4_mode)) != 0) { 2247 *check_privs = B_FALSE; 2248 return (err); 2249 } 2250 2251 /* 2252 * The caller requested that the ACL check be skipped. This 2253 * would only happen if the caller checked VOP_ACCESS() with a 2254 * 32 bit ACE mask and already had the appropriate permissions. 2255 */ 2256 if (skipaclchk) { 2257 *working_mode = 0; 2258 return (0); 2259 } 2260 2261 return (zfs_zaccess_aces_check(zp, working_mode, B_FALSE, cr)); 2262} 2263 2264static int 2265zfs_zaccess_append(znode_t *zp, uint32_t *working_mode, boolean_t *check_privs, 2266 cred_t *cr) 2267{ 2268 if (*working_mode != ACE_WRITE_DATA) 2269 return (SET_ERROR(EACCES)); 2270 2271 return (zfs_zaccess_common(zp, ACE_APPEND_DATA, working_mode, 2272 check_privs, B_FALSE, cr)); 2273} 2274 2275int 2276zfs_fastaccesschk_execute(znode_t *zdp, cred_t *cr) 2277{ 2278 boolean_t owner = B_FALSE; 2279 boolean_t groupmbr = B_FALSE; 2280 boolean_t is_attr; 2281 uid_t uid = crgetuid(cr); 2282 int error; 2283 2284 if (zdp->z_pflags & ZFS_AV_QUARANTINED) 2285 return (SET_ERROR(EACCES)); 2286 2287 is_attr = ((zdp->z_pflags & ZFS_XATTR) && 2288 (ZTOV(zdp)->v_type == VDIR)); 2289 if (is_attr) 2290 goto slow; 2291 2292 2293 mutex_enter(&zdp->z_acl_lock); 2294 2295 if (zdp->z_pflags & ZFS_NO_EXECS_DENIED) { 2296 mutex_exit(&zdp->z_acl_lock); 2297 return (0); 2298 } 2299 2300 if (FUID_INDEX(zdp->z_uid) != 0 || FUID_INDEX(zdp->z_gid) != 0) { 2301 mutex_exit(&zdp->z_acl_lock); 2302 goto slow; 2303 } 2304 2305 if (uid == zdp->z_uid) { 2306 owner = B_TRUE; 2307 if (zdp->z_mode & S_IXUSR) { 2308 mutex_exit(&zdp->z_acl_lock); 2309 return (0); 2310 } else { 2311 mutex_exit(&zdp->z_acl_lock); 2312 goto slow; 2313 } 2314 } 2315 if (groupmember(zdp->z_gid, cr)) { 2316 groupmbr = B_TRUE; 2317 if (zdp->z_mode & S_IXGRP) { 2318 mutex_exit(&zdp->z_acl_lock); 2319 return (0); 2320 } else { 2321 mutex_exit(&zdp->z_acl_lock); 2322 goto slow; 2323 } 2324 } 2325 if (!owner && !groupmbr) { 2326 if (zdp->z_mode & S_IXOTH) { 2327 mutex_exit(&zdp->z_acl_lock); 2328 return (0); 2329 } 2330 } 2331 2332 mutex_exit(&zdp->z_acl_lock); 2333 2334slow: 2335 DTRACE_PROBE(zfs__fastpath__execute__access__miss); 2336 ZFS_ENTER(zdp->z_zfsvfs); 2337 error = zfs_zaccess(zdp, ACE_EXECUTE, 0, B_FALSE, cr); 2338 ZFS_EXIT(zdp->z_zfsvfs); 2339 return (error); 2340} 2341 2342/* 2343 * Determine whether Access should be granted/denied. 2344 * 2345 * The least priv subsytem is always consulted as a basic privilege 2346 * can define any form of access. 2347 */ 2348int 2349zfs_zaccess(znode_t *zp, int mode, int flags, boolean_t skipaclchk, cred_t *cr) 2350{ 2351 uint32_t working_mode; 2352 int error; 2353 int is_attr; 2354 boolean_t check_privs; 2355 znode_t *xzp; 2356 znode_t *check_zp = zp; 2357 mode_t needed_bits; 2358 uid_t owner; 2359 2360 is_attr = ((zp->z_pflags & ZFS_XATTR) && (ZTOV(zp)->v_type == VDIR)); 2361 2362#ifdef __FreeBSD_kernel__ 2363 /* 2364 * In FreeBSD, we don't care about permissions of individual ADS. 2365 * Note that not checking them is not just an optimization - without 2366 * this shortcut, EA operations may bogusly fail with EACCES. 2367 */ 2368 if (zp->z_pflags & ZFS_XATTR) 2369 return (0); 2370#else 2371 /* 2372 * If attribute then validate against base file 2373 */ 2374 if (is_attr) { 2375 uint64_t parent; 2376 2377 if ((error = sa_lookup(zp->z_sa_hdl, 2378 SA_ZPL_PARENT(zp->z_zfsvfs), &parent, 2379 sizeof (parent))) != 0) 2380 return (error); 2381 2382 if ((error = zfs_zget(zp->z_zfsvfs, 2383 parent, &xzp)) != 0) { 2384 return (error); 2385 } 2386 2387 check_zp = xzp; 2388 2389 /* 2390 * fixup mode to map to xattr perms 2391 */ 2392 2393 if (mode & (ACE_WRITE_DATA|ACE_APPEND_DATA)) { 2394 mode &= ~(ACE_WRITE_DATA|ACE_APPEND_DATA); 2395 mode |= ACE_WRITE_NAMED_ATTRS; 2396 } 2397 2398 if (mode & (ACE_READ_DATA|ACE_EXECUTE)) { 2399 mode &= ~(ACE_READ_DATA|ACE_EXECUTE); 2400 mode |= ACE_READ_NAMED_ATTRS; 2401 } 2402 } 2403#endif 2404 2405 owner = zfs_fuid_map_id(zp->z_zfsvfs, zp->z_uid, cr, ZFS_OWNER); 2406 /* 2407 * Map the bits required to the standard vnode flags VREAD|VWRITE|VEXEC 2408 * in needed_bits. Map the bits mapped by working_mode (currently 2409 * missing) in missing_bits. 2410 * Call secpolicy_vnode_access2() with (needed_bits & ~checkmode), 2411 * needed_bits. 2412 */ 2413 needed_bits = 0; 2414 2415 working_mode = mode; 2416 if ((working_mode & (ACE_READ_ACL|ACE_READ_ATTRIBUTES)) && 2417 owner == crgetuid(cr)) 2418 working_mode &= ~(ACE_READ_ACL|ACE_READ_ATTRIBUTES); 2419 2420 if (working_mode & (ACE_READ_DATA|ACE_READ_NAMED_ATTRS| 2421 ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_SYNCHRONIZE)) 2422 needed_bits |= VREAD; 2423 if (working_mode & (ACE_WRITE_DATA|ACE_WRITE_NAMED_ATTRS| 2424 ACE_APPEND_DATA|ACE_WRITE_ATTRIBUTES|ACE_SYNCHRONIZE)) 2425 needed_bits |= VWRITE; 2426 if (working_mode & ACE_EXECUTE) 2427 needed_bits |= VEXEC; 2428 2429 if ((error = zfs_zaccess_common(check_zp, mode, &working_mode, 2430 &check_privs, skipaclchk, cr)) == 0) { 2431 if (is_attr) 2432 VN_RELE(ZTOV(xzp)); 2433 return (secpolicy_vnode_access2(cr, ZTOV(zp), owner, 2434 needed_bits, needed_bits)); 2435 } 2436 2437 if (error && !check_privs) { 2438 if (is_attr) 2439 VN_RELE(ZTOV(xzp)); 2440 return (error); 2441 } 2442 2443 if (error && (flags & V_APPEND)) { 2444 error = zfs_zaccess_append(zp, &working_mode, &check_privs, cr); 2445 } 2446 2447 if (error && check_privs) { 2448 mode_t checkmode = 0; 2449 2450 /* 2451 * First check for implicit owner permission on 2452 * read_acl/read_attributes 2453 */ 2454 2455 error = 0; 2456 ASSERT(working_mode != 0); 2457 2458 if ((working_mode & (ACE_READ_ACL|ACE_READ_ATTRIBUTES) && 2459 owner == crgetuid(cr))) 2460 working_mode &= ~(ACE_READ_ACL|ACE_READ_ATTRIBUTES); 2461 2462 if (working_mode & (ACE_READ_DATA|ACE_READ_NAMED_ATTRS| 2463 ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_SYNCHRONIZE)) 2464 checkmode |= VREAD; 2465 if (working_mode & (ACE_WRITE_DATA|ACE_WRITE_NAMED_ATTRS| 2466 ACE_APPEND_DATA|ACE_WRITE_ATTRIBUTES|ACE_SYNCHRONIZE)) 2467 checkmode |= VWRITE; 2468 if (working_mode & ACE_EXECUTE) 2469 checkmode |= VEXEC; 2470 2471 error = secpolicy_vnode_access2(cr, ZTOV(check_zp), owner, 2472 needed_bits & ~checkmode, needed_bits); 2473 2474 if (error == 0 && (working_mode & ACE_WRITE_OWNER)) 2475 error = secpolicy_vnode_chown(ZTOV(check_zp), cr, owner); 2476 if (error == 0 && (working_mode & ACE_WRITE_ACL)) 2477 error = secpolicy_vnode_setdac(ZTOV(check_zp), cr, owner); 2478 2479 if (error == 0 && (working_mode & 2480 (ACE_DELETE|ACE_DELETE_CHILD))) 2481 error = secpolicy_vnode_remove(ZTOV(check_zp), cr); 2482 2483 if (error == 0 && (working_mode & ACE_SYNCHRONIZE)) { 2484 error = secpolicy_vnode_chown(ZTOV(check_zp), cr, owner); 2485 } 2486 if (error == 0) { 2487 /* 2488 * See if any bits other than those already checked 2489 * for are still present. If so then return EACCES 2490 */ 2491 if (working_mode & ~(ZFS_CHECKED_MASKS)) { 2492 error = SET_ERROR(EACCES); 2493 } 2494 } 2495 } else if (error == 0) { 2496 error = secpolicy_vnode_access2(cr, ZTOV(zp), owner, 2497 needed_bits, needed_bits); 2498 } 2499 2500 2501 if (is_attr) 2502 VN_RELE(ZTOV(xzp)); 2503 2504 return (error); 2505} 2506 2507/* 2508 * Translate traditional unix VREAD/VWRITE/VEXEC mode into 2509 * native ACL format and call zfs_zaccess() 2510 */ 2511int 2512zfs_zaccess_rwx(znode_t *zp, mode_t mode, int flags, cred_t *cr) 2513{ 2514 return (zfs_zaccess(zp, zfs_unix_to_v4(mode >> 6), flags, B_FALSE, cr)); 2515} 2516 2517/* 2518 * Access function for secpolicy_vnode_setattr 2519 */ 2520int 2521zfs_zaccess_unix(znode_t *zp, mode_t mode, cred_t *cr) 2522{ 2523 int v4_mode = zfs_unix_to_v4(mode >> 6); 2524 2525 return (zfs_zaccess(zp, v4_mode, 0, B_FALSE, cr)); 2526} 2527 2528static int 2529zfs_delete_final_check(znode_t *zp, znode_t *dzp, 2530 mode_t available_perms, cred_t *cr) 2531{ 2532 int error; 2533 uid_t downer; 2534 2535 downer = zfs_fuid_map_id(dzp->z_zfsvfs, dzp->z_uid, cr, ZFS_OWNER); 2536 2537 error = secpolicy_vnode_access2(cr, ZTOV(dzp), 2538 downer, available_perms, VWRITE|VEXEC); 2539 2540 if (error == 0) 2541 error = zfs_sticky_remove_access(dzp, zp, cr); 2542 2543 return (error); 2544} 2545 2546/* 2547 * Determine whether Access should be granted/deny, without 2548 * consulting least priv subsystem. 2549 * 2550 * The following chart is the recommended NFSv4 enforcement for 2551 * ability to delete an object. 2552 * 2553 * ------------------------------------------------------- 2554 * | Parent Dir | Target Object Permissions | 2555 * | permissions | | 2556 * ------------------------------------------------------- 2557 * | | ACL Allows | ACL Denies| Delete | 2558 * | | Delete | Delete | unspecified| 2559 * ------------------------------------------------------- 2560 * | ACL Allows | Permit | Permit | Permit | 2561 * | DELETE_CHILD | | 2562 * ------------------------------------------------------- 2563 * | ACL Denies | Permit | Deny | Deny | 2564 * | DELETE_CHILD | | | | 2565 * ------------------------------------------------------- 2566 * | ACL specifies | | | | 2567 * | only allow | Permit | Permit | Permit | 2568 * | write and | | | | 2569 * | execute | | | | 2570 * ------------------------------------------------------- 2571 * | ACL denies | | | | 2572 * | write and | Permit | Deny | Deny | 2573 * | execute | | | | 2574 * ------------------------------------------------------- 2575 * ^ 2576 * | 2577 * No search privilege, can't even look up file? 2578 * 2579 */ 2580int 2581zfs_zaccess_delete(znode_t *dzp, znode_t *zp, cred_t *cr) 2582{ 2583 uint32_t dzp_working_mode = 0; 2584 uint32_t zp_working_mode = 0; 2585 int dzp_error, zp_error; 2586 mode_t available_perms; 2587 boolean_t dzpcheck_privs = B_TRUE; 2588 boolean_t zpcheck_privs = B_TRUE; 2589 2590 /* 2591 * We want specific DELETE permissions to 2592 * take precedence over WRITE/EXECUTE. We don't 2593 * want an ACL such as this to mess us up. 2594 * user:joe:write_data:deny,user:joe:delete:allow 2595 * 2596 * However, deny permissions may ultimately be overridden 2597 * by secpolicy_vnode_access(). 2598 * 2599 * We will ask for all of the necessary permissions and then 2600 * look at the working modes from the directory and target object 2601 * to determine what was found. 2602 */ 2603 2604 if (zp->z_pflags & (ZFS_IMMUTABLE | ZFS_NOUNLINK)) 2605 return (SET_ERROR(EPERM)); 2606 2607 /* 2608 * First row 2609 * If the directory permissions allow the delete, we are done. 2610 */ 2611 if ((dzp_error = zfs_zaccess_common(dzp, ACE_DELETE_CHILD, 2612 &dzp_working_mode, &dzpcheck_privs, B_FALSE, cr)) == 0) 2613 return (0); 2614 2615 /* 2616 * If target object has delete permission then we are done 2617 */ 2618 if ((zp_error = zfs_zaccess_common(zp, ACE_DELETE, &zp_working_mode, 2619 &zpcheck_privs, B_FALSE, cr)) == 0) 2620 return (0); 2621 2622 ASSERT(dzp_error && zp_error); 2623 2624 if (!dzpcheck_privs) 2625 return (dzp_error); 2626 if (!zpcheck_privs) 2627 return (zp_error); 2628 2629 /* 2630 * Second row 2631 * 2632 * If directory returns EACCES then delete_child was denied 2633 * due to deny delete_child. In this case send the request through 2634 * secpolicy_vnode_remove(). We don't use zfs_delete_final_check() 2635 * since that *could* allow the delete based on write/execute permission 2636 * and we want delete permissions to override write/execute. 2637 */ 2638 2639 if (dzp_error == EACCES) 2640 return (secpolicy_vnode_remove(ZTOV(dzp), cr)); /* XXXPJD: s/dzp/zp/ ? */ 2641 2642 /* 2643 * Third Row 2644 * only need to see if we have write/execute on directory. 2645 */ 2646 2647 dzp_error = zfs_zaccess_common(dzp, ACE_EXECUTE|ACE_WRITE_DATA, 2648 &dzp_working_mode, &dzpcheck_privs, B_FALSE, cr); 2649 2650 if (dzp_error != 0 && !dzpcheck_privs) 2651 return (dzp_error); 2652 2653 /* 2654 * Fourth row 2655 */ 2656 2657 available_perms = (dzp_working_mode & ACE_WRITE_DATA) ? 0 : VWRITE; 2658 available_perms |= (dzp_working_mode & ACE_EXECUTE) ? 0 : VEXEC; 2659 2660 return (zfs_delete_final_check(zp, dzp, available_perms, cr)); 2661 2662} 2663 2664int 2665zfs_zaccess_rename(znode_t *sdzp, znode_t *szp, znode_t *tdzp, 2666 znode_t *tzp, cred_t *cr) 2667{ 2668 int add_perm; 2669 int error; 2670 2671 if (szp->z_pflags & ZFS_AV_QUARANTINED) 2672 return (SET_ERROR(EACCES)); 2673 2674 add_perm = (ZTOV(szp)->v_type == VDIR) ? 2675 ACE_ADD_SUBDIRECTORY : ACE_ADD_FILE; 2676 2677 /* 2678 * Rename permissions are combination of delete permission + 2679 * add file/subdir permission. 2680 * 2681 * BSD operating systems also require write permission 2682 * on the directory being moved from one parent directory 2683 * to another. 2684 */ 2685 if (ZTOV(szp)->v_type == VDIR && ZTOV(sdzp) != ZTOV(tdzp)) { 2686 if (error = zfs_zaccess(szp, ACE_WRITE_DATA, 0, B_FALSE, cr)) 2687 return (error); 2688 } 2689 2690 /* 2691 * first make sure we do the delete portion. 2692 * 2693 * If that succeeds then check for add_file/add_subdir permissions 2694 */ 2695 2696 if (error = zfs_zaccess_delete(sdzp, szp, cr)) 2697 return (error); 2698 2699 /* 2700 * If we have a tzp, see if we can delete it? 2701 */ 2702 if (tzp) { 2703 if (error = zfs_zaccess_delete(tdzp, tzp, cr)) 2704 return (error); 2705 } 2706 2707 /* 2708 * Now check for add permissions 2709 */ 2710 error = zfs_zaccess(tdzp, add_perm, 0, B_FALSE, cr); 2711 2712 return (error); 2713} 2714