subr_acl_nfs4.c revision 232936
1/*- 2 * Copyright (c) 2008-2010 Edward Tomasz Napiera��a <trasz@FreeBSD.org> 3 * All rights reserved. 4 * 5 * Redistribution and use in source and binary forms, with or without 6 * modification, are permitted provided that the following conditions 7 * are met: 8 * 1. Redistributions of source code must retain the above copyright 9 * notice, this list of conditions and the following disclaimer. 10 * 2. Redistributions in binary form must reproduce the above copyright 11 * notice, this list of conditions and the following disclaimer in the 12 * documentation and/or other materials provided with the distribution. 13 * 14 * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 15 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 16 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 17 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 18 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 19 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 20 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 21 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 22 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 24 * SUCH DAMAGE. 25 */ 26 27/* 28 * ACL support routines specific to NFSv4 access control lists. These are 29 * utility routines for code common across file systems implementing NFSv4 30 * ACLs. 31 */ 32 33#ifdef _KERNEL 34#include <sys/cdefs.h> 35__FBSDID("$FreeBSD: head/sys/kern/subr_acl_nfs4.c 232936 2012-03-13 20:27:48Z adrian $"); 36 37#include <sys/param.h> 38#include <sys/kernel.h> 39#include <sys/module.h> 40#include <sys/systm.h> 41#include <sys/mount.h> 42#include <sys/priv.h> 43#include <sys/vnode.h> 44#include <sys/errno.h> 45#include <sys/stat.h> 46#include <sys/sysctl.h> 47#include <sys/acl.h> 48#else 49#include <errno.h> 50#include <assert.h> 51#include <sys/acl.h> 52#include <sys/stat.h> 53#define KASSERT(a, b) assert(a) 54#define CTASSERT(a) 55 56#endif /* !_KERNEL */ 57 58#ifdef _KERNEL 59 60static void acl_nfs4_trivial_from_mode(struct acl *aclp, mode_t mode); 61 62static int acl_nfs4_old_semantics = 0; 63 64SYSCTL_INT(_vfs, OID_AUTO, acl_nfs4_old_semantics, CTLFLAG_RW, 65 &acl_nfs4_old_semantics, 0, "Use pre-PSARC/2010/029 NFSv4 ACL semantics"); 66 67static struct { 68 accmode_t accmode; 69 int mask; 70} accmode2mask[] = {{VREAD, ACL_READ_DATA}, 71 {VWRITE, ACL_WRITE_DATA}, 72 {VAPPEND, ACL_APPEND_DATA}, 73 {VEXEC, ACL_EXECUTE}, 74 {VREAD_NAMED_ATTRS, ACL_READ_NAMED_ATTRS}, 75 {VWRITE_NAMED_ATTRS, ACL_WRITE_NAMED_ATTRS}, 76 {VDELETE_CHILD, ACL_DELETE_CHILD}, 77 {VREAD_ATTRIBUTES, ACL_READ_ATTRIBUTES}, 78 {VWRITE_ATTRIBUTES, ACL_WRITE_ATTRIBUTES}, 79 {VDELETE, ACL_DELETE}, 80 {VREAD_ACL, ACL_READ_ACL}, 81 {VWRITE_ACL, ACL_WRITE_ACL}, 82 {VWRITE_OWNER, ACL_WRITE_OWNER}, 83 {VSYNCHRONIZE, ACL_SYNCHRONIZE}, 84 {0, 0}}; 85 86static int 87_access_mask_from_accmode(accmode_t accmode) 88{ 89 int access_mask = 0, i; 90 91 for (i = 0; accmode2mask[i].accmode != 0; i++) { 92 if (accmode & accmode2mask[i].accmode) 93 access_mask |= accmode2mask[i].mask; 94 } 95 96 /* 97 * VAPPEND is just a modifier for VWRITE; if the caller asked 98 * for 'VAPPEND | VWRITE', we want to check for ACL_APPEND_DATA only. 99 */ 100 if (access_mask & ACL_APPEND_DATA) 101 access_mask &= ~ACL_WRITE_DATA; 102 103 return (access_mask); 104} 105 106/* 107 * Return 0, iff access is allowed, 1 otherwise. 108 */ 109static int 110_acl_denies(const struct acl *aclp, int access_mask, struct ucred *cred, 111 int file_uid, int file_gid, int *denied_explicitly) 112{ 113 int i; 114 const struct acl_entry *entry; 115 116 if (denied_explicitly != NULL) 117 *denied_explicitly = 0; 118 119 KASSERT(aclp->acl_cnt <= ACL_MAX_ENTRIES, 120 ("aclp->acl_cnt <= ACL_MAX_ENTRIES")); 121 122 for (i = 0; i < aclp->acl_cnt; i++) { 123 entry = &(aclp->acl_entry[i]); 124 125 if (entry->ae_entry_type != ACL_ENTRY_TYPE_ALLOW && 126 entry->ae_entry_type != ACL_ENTRY_TYPE_DENY) 127 continue; 128 if (entry->ae_flags & ACL_ENTRY_INHERIT_ONLY) 129 continue; 130 switch (entry->ae_tag) { 131 case ACL_USER_OBJ: 132 if (file_uid != cred->cr_uid) 133 continue; 134 break; 135 case ACL_USER: 136 if (entry->ae_id != cred->cr_uid) 137 continue; 138 break; 139 case ACL_GROUP_OBJ: 140 if (!groupmember(file_gid, cred)) 141 continue; 142 break; 143 case ACL_GROUP: 144 if (!groupmember(entry->ae_id, cred)) 145 continue; 146 break; 147 default: 148 KASSERT(entry->ae_tag == ACL_EVERYONE, 149 ("entry->ae_tag == ACL_EVERYONE")); 150 } 151 152 if (entry->ae_entry_type == ACL_ENTRY_TYPE_DENY) { 153 if (entry->ae_perm & access_mask) { 154 if (denied_explicitly != NULL) 155 *denied_explicitly = 1; 156 return (1); 157 } 158 } 159 160 access_mask &= ~(entry->ae_perm); 161 if (access_mask == 0) 162 return (0); 163 } 164 165 return (1); 166} 167 168int 169vaccess_acl_nfs4(enum vtype type, uid_t file_uid, gid_t file_gid, 170 struct acl *aclp, accmode_t accmode, struct ucred *cred, int *privused) 171{ 172 accmode_t priv_granted = 0; 173 int denied, explicitly_denied, access_mask, is_directory, 174 must_be_owner = 0; 175 mode_t file_mode = 0; 176 177 KASSERT((accmode & ~(VEXEC | VWRITE | VREAD | VADMIN | VAPPEND | 178 VEXPLICIT_DENY | VREAD_NAMED_ATTRS | VWRITE_NAMED_ATTRS | 179 VDELETE_CHILD | VREAD_ATTRIBUTES | VWRITE_ATTRIBUTES | VDELETE | 180 VREAD_ACL | VWRITE_ACL | VWRITE_OWNER | VSYNCHRONIZE)) == 0, 181 ("invalid bit in accmode")); 182 KASSERT((accmode & VAPPEND) == 0 || (accmode & VWRITE), 183 ("VAPPEND without VWRITE")); 184 185 if (privused != NULL) 186 *privused = 0; 187 188 if (accmode & VADMIN) 189 must_be_owner = 1; 190 191 /* 192 * Ignore VSYNCHRONIZE permission. 193 */ 194 accmode &= ~VSYNCHRONIZE; 195 196 access_mask = _access_mask_from_accmode(accmode); 197 198 if (type == VDIR) 199 is_directory = 1; 200 else 201 is_directory = 0; 202 203 /* 204 * File owner is always allowed to read and write the ACL 205 * and basic attributes. This is to prevent a situation 206 * where user would change ACL in a way that prevents him 207 * from undoing the change. 208 */ 209 if (file_uid == cred->cr_uid) 210 access_mask &= ~(ACL_READ_ACL | ACL_WRITE_ACL | 211 ACL_READ_ATTRIBUTES | ACL_WRITE_ATTRIBUTES); 212 213 /* 214 * Ignore append permission for regular files; use write 215 * permission instead. 216 */ 217 if (!is_directory && (access_mask & ACL_APPEND_DATA)) { 218 access_mask &= ~ACL_APPEND_DATA; 219 access_mask |= ACL_WRITE_DATA; 220 } 221 222 denied = _acl_denies(aclp, access_mask, cred, file_uid, file_gid, 223 &explicitly_denied); 224 225 if (must_be_owner) { 226 if (file_uid != cred->cr_uid) 227 denied = EPERM; 228 } 229 230 /* 231 * For VEXEC, ensure that at least one execute bit is set for 232 * non-directories. We have to check the mode here to stay 233 * consistent with execve(2). See the test in 234 * exec_check_permissions(). 235 */ 236 acl_nfs4_sync_mode_from_acl(&file_mode, aclp); 237 if (!denied && !is_directory && (accmode & VEXEC) && 238 (file_mode & (S_IXUSR | S_IXGRP | S_IXOTH)) == 0) 239 denied = EACCES; 240 241 if (!denied) 242 return (0); 243 244 /* 245 * Access failed. Iff it was not denied explicitly and 246 * VEXPLICIT_DENY flag was specified, allow access. 247 */ 248 if ((accmode & VEXPLICIT_DENY) && explicitly_denied == 0) 249 return (0); 250 251 accmode &= ~VEXPLICIT_DENY; 252 253 /* 254 * No match. Try to use privileges, if there are any. 255 */ 256 if (is_directory) { 257 if ((accmode & VEXEC) && !priv_check_cred(cred, 258 PRIV_VFS_LOOKUP, 0)) 259 priv_granted |= VEXEC; 260 } else { 261 /* 262 * Ensure that at least one execute bit is on. Otherwise, 263 * a privileged user will always succeed, and we don't want 264 * this to happen unless the file really is executable. 265 */ 266 if ((accmode & VEXEC) && (file_mode & 267 (S_IXUSR | S_IXGRP | S_IXOTH)) != 0 && 268 !priv_check_cred(cred, PRIV_VFS_EXEC, 0)) 269 priv_granted |= VEXEC; 270 } 271 272 if ((accmode & VREAD) && !priv_check_cred(cred, PRIV_VFS_READ, 0)) 273 priv_granted |= VREAD; 274 275 if ((accmode & (VWRITE | VAPPEND | VDELETE_CHILD)) && 276 !priv_check_cred(cred, PRIV_VFS_WRITE, 0)) 277 priv_granted |= (VWRITE | VAPPEND | VDELETE_CHILD); 278 279 if ((accmode & VADMIN_PERMS) && 280 !priv_check_cred(cred, PRIV_VFS_ADMIN, 0)) 281 priv_granted |= VADMIN_PERMS; 282 283 if ((accmode & VSTAT_PERMS) && 284 !priv_check_cred(cred, PRIV_VFS_STAT, 0)) 285 priv_granted |= VSTAT_PERMS; 286 287 if ((accmode & priv_granted) == accmode) { 288 if (privused != NULL) 289 *privused = 1; 290 291 return (0); 292 } 293 294 if (accmode & (VADMIN_PERMS | VDELETE_CHILD | VDELETE)) 295 denied = EPERM; 296 else 297 denied = EACCES; 298 299 return (denied); 300} 301#endif /* _KERNEL */ 302 303static int 304_acl_entry_matches(struct acl_entry *entry, acl_tag_t tag, acl_perm_t perm, 305 acl_entry_type_t entry_type) 306{ 307 if (entry->ae_tag != tag) 308 return (0); 309 310 if (entry->ae_id != ACL_UNDEFINED_ID) 311 return (0); 312 313 if (entry->ae_perm != perm) 314 return (0); 315 316 if (entry->ae_entry_type != entry_type) 317 return (0); 318 319 if (entry->ae_flags != 0) 320 return (0); 321 322 return (1); 323} 324 325static struct acl_entry * 326_acl_append(struct acl *aclp, acl_tag_t tag, acl_perm_t perm, 327 acl_entry_type_t entry_type) 328{ 329 struct acl_entry *entry; 330 331 KASSERT(aclp->acl_cnt + 1 <= ACL_MAX_ENTRIES, 332 ("aclp->acl_cnt + 1 <= ACL_MAX_ENTRIES")); 333 334 entry = &(aclp->acl_entry[aclp->acl_cnt]); 335 aclp->acl_cnt++; 336 337 entry->ae_tag = tag; 338 entry->ae_id = ACL_UNDEFINED_ID; 339 entry->ae_perm = perm; 340 entry->ae_entry_type = entry_type; 341 entry->ae_flags = 0; 342 343 return (entry); 344} 345 346static struct acl_entry * 347_acl_duplicate_entry(struct acl *aclp, int entry_index) 348{ 349 int i; 350 351 KASSERT(aclp->acl_cnt + 1 <= ACL_MAX_ENTRIES, 352 ("aclp->acl_cnt + 1 <= ACL_MAX_ENTRIES")); 353 354 for (i = aclp->acl_cnt; i > entry_index; i--) 355 aclp->acl_entry[i] = aclp->acl_entry[i - 1]; 356 357 aclp->acl_cnt++; 358 359 return (&(aclp->acl_entry[entry_index + 1])); 360} 361 362static void 363acl_nfs4_sync_acl_from_mode_draft(struct acl *aclp, mode_t mode, 364 int file_owner_id) 365{ 366 int i, meets, must_append; 367 struct acl_entry *entry, *copy, *previous, 368 *a1, *a2, *a3, *a4, *a5, *a6; 369 mode_t amode; 370 const int READ = 04; 371 const int WRITE = 02; 372 const int EXEC = 01; 373 374 KASSERT(aclp->acl_cnt <= ACL_MAX_ENTRIES, 375 ("aclp->acl_cnt <= ACL_MAX_ENTRIES")); 376 377 /* 378 * NFSv4 Minor Version 1, draft-ietf-nfsv4-minorversion1-03.txt 379 * 380 * 3.16.6.3. Applying a Mode to an Existing ACL 381 */ 382 383 /* 384 * 1. For each ACE: 385 */ 386 for (i = 0; i < aclp->acl_cnt; i++) { 387 entry = &(aclp->acl_entry[i]); 388 389 /* 390 * 1.1. If the type is neither ALLOW or DENY - skip. 391 */ 392 if (entry->ae_entry_type != ACL_ENTRY_TYPE_ALLOW && 393 entry->ae_entry_type != ACL_ENTRY_TYPE_DENY) 394 continue; 395 396 /* 397 * 1.2. If ACL_ENTRY_INHERIT_ONLY is set - skip. 398 */ 399 if (entry->ae_flags & ACL_ENTRY_INHERIT_ONLY) 400 continue; 401 402 /* 403 * 1.3. If ACL_ENTRY_FILE_INHERIT or ACL_ENTRY_DIRECTORY_INHERIT 404 * are set: 405 */ 406 if (entry->ae_flags & 407 (ACL_ENTRY_FILE_INHERIT | ACL_ENTRY_DIRECTORY_INHERIT)) { 408 /* 409 * 1.3.1. A copy of the current ACE is made, and placed 410 * in the ACL immediately following the current 411 * ACE. 412 */ 413 copy = _acl_duplicate_entry(aclp, i); 414 415 /* 416 * 1.3.2. In the first ACE, the flag 417 * ACL_ENTRY_INHERIT_ONLY is set. 418 */ 419 entry->ae_flags |= ACL_ENTRY_INHERIT_ONLY; 420 421 /* 422 * 1.3.3. In the second ACE, the following flags 423 * are cleared: 424 * ACL_ENTRY_FILE_INHERIT, 425 * ACL_ENTRY_DIRECTORY_INHERIT, 426 * ACL_ENTRY_NO_PROPAGATE_INHERIT. 427 */ 428 copy->ae_flags &= ~(ACL_ENTRY_FILE_INHERIT | 429 ACL_ENTRY_DIRECTORY_INHERIT | 430 ACL_ENTRY_NO_PROPAGATE_INHERIT); 431 432 /* 433 * The algorithm continues on with the second ACE. 434 */ 435 i++; 436 entry = copy; 437 } 438 439 /* 440 * 1.4. If it's owner@, group@ or everyone@ entry, clear 441 * ACL_READ_DATA, ACL_WRITE_DATA, ACL_APPEND_DATA 442 * and ACL_EXECUTE. Continue to the next entry. 443 */ 444 if (entry->ae_tag == ACL_USER_OBJ || 445 entry->ae_tag == ACL_GROUP_OBJ || 446 entry->ae_tag == ACL_EVERYONE) { 447 entry->ae_perm &= ~(ACL_READ_DATA | ACL_WRITE_DATA | 448 ACL_APPEND_DATA | ACL_EXECUTE); 449 continue; 450 } 451 452 /* 453 * 1.5. Otherwise, if the "who" field did not match one 454 * of OWNER@, GROUP@, EVERYONE@: 455 * 456 * 1.5.1. If the type is ALLOW, check the preceding ACE. 457 * If it does not meet all of the following criteria: 458 */ 459 if (entry->ae_entry_type != ACL_ENTRY_TYPE_ALLOW) 460 continue; 461 462 meets = 0; 463 if (i > 0) { 464 meets = 1; 465 previous = &(aclp->acl_entry[i - 1]); 466 467 /* 468 * 1.5.1.1. The type field is DENY, 469 */ 470 if (previous->ae_entry_type != ACL_ENTRY_TYPE_DENY) 471 meets = 0; 472 473 /* 474 * 1.5.1.2. The "who" field is the same as the current 475 * ACE, 476 * 477 * 1.5.1.3. The flag bit ACE4_IDENTIFIER_GROUP 478 * is the same as it is in the current ACE, 479 * and no other flag bits are set, 480 */ 481 if (previous->ae_id != entry->ae_id || 482 previous->ae_tag != entry->ae_tag) 483 meets = 0; 484 485 if (previous->ae_flags) 486 meets = 0; 487 488 /* 489 * 1.5.1.4. The mask bits are a subset of the mask bits 490 * of the current ACE, and are also subset of 491 * the following: ACL_READ_DATA, 492 * ACL_WRITE_DATA, ACL_APPEND_DATA, ACL_EXECUTE 493 */ 494 if (previous->ae_perm & ~(entry->ae_perm)) 495 meets = 0; 496 497 if (previous->ae_perm & ~(ACL_READ_DATA | 498 ACL_WRITE_DATA | ACL_APPEND_DATA | ACL_EXECUTE)) 499 meets = 0; 500 } 501 502 if (!meets) { 503 /* 504 * Then the ACE of type DENY, with a who equal 505 * to the current ACE, flag bits equal to 506 * (<current ACE flags> & <ACE_IDENTIFIER_GROUP>) 507 * and no mask bits, is prepended. 508 */ 509 previous = entry; 510 entry = _acl_duplicate_entry(aclp, i); 511 512 /* Adjust counter, as we've just added an entry. */ 513 i++; 514 515 previous->ae_tag = entry->ae_tag; 516 previous->ae_id = entry->ae_id; 517 previous->ae_flags = entry->ae_flags; 518 previous->ae_perm = 0; 519 previous->ae_entry_type = ACL_ENTRY_TYPE_DENY; 520 } 521 522 /* 523 * 1.5.2. The following modifications are made to the prepended 524 * ACE. The intent is to mask the following ACE 525 * to disallow ACL_READ_DATA, ACL_WRITE_DATA, 526 * ACL_APPEND_DATA, or ACL_EXECUTE, based upon the group 527 * permissions of the new mode. As a special case, 528 * if the ACE matches the current owner of the file, 529 * the owner bits are used, rather than the group bits. 530 * This is reflected in the algorithm below. 531 */ 532 amode = mode >> 3; 533 534 /* 535 * If ACE4_IDENTIFIER_GROUP is not set, and the "who" field 536 * in ACE matches the owner of the file, we shift amode three 537 * more bits, in order to have the owner permission bits 538 * placed in the three low order bits of amode. 539 */ 540 if (entry->ae_tag == ACL_USER && entry->ae_id == file_owner_id) 541 amode = amode >> 3; 542 543 if (entry->ae_perm & ACL_READ_DATA) { 544 if (amode & READ) 545 previous->ae_perm &= ~ACL_READ_DATA; 546 else 547 previous->ae_perm |= ACL_READ_DATA; 548 } 549 550 if (entry->ae_perm & ACL_WRITE_DATA) { 551 if (amode & WRITE) 552 previous->ae_perm &= ~ACL_WRITE_DATA; 553 else 554 previous->ae_perm |= ACL_WRITE_DATA; 555 } 556 557 if (entry->ae_perm & ACL_APPEND_DATA) { 558 if (amode & WRITE) 559 previous->ae_perm &= ~ACL_APPEND_DATA; 560 else 561 previous->ae_perm |= ACL_APPEND_DATA; 562 } 563 564 if (entry->ae_perm & ACL_EXECUTE) { 565 if (amode & EXEC) 566 previous->ae_perm &= ~ACL_EXECUTE; 567 else 568 previous->ae_perm |= ACL_EXECUTE; 569 } 570 571 /* 572 * 1.5.3. If ACE4_IDENTIFIER_GROUP is set in the flags 573 * of the ALLOW ace: 574 * 575 * XXX: This point is not there in the Falkner's draft. 576 */ 577 if (entry->ae_tag == ACL_GROUP && 578 entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW) { 579 mode_t extramode, ownermode; 580 extramode = (mode >> 3) & 07; 581 ownermode = mode >> 6; 582 extramode &= ~ownermode; 583 584 if (extramode) { 585 if (extramode & READ) { 586 entry->ae_perm &= ~ACL_READ_DATA; 587 previous->ae_perm &= ~ACL_READ_DATA; 588 } 589 590 if (extramode & WRITE) { 591 entry->ae_perm &= 592 ~(ACL_WRITE_DATA | ACL_APPEND_DATA); 593 previous->ae_perm &= 594 ~(ACL_WRITE_DATA | ACL_APPEND_DATA); 595 } 596 597 if (extramode & EXEC) { 598 entry->ae_perm &= ~ACL_EXECUTE; 599 previous->ae_perm &= ~ACL_EXECUTE; 600 } 601 } 602 } 603 } 604 605 /* 606 * 2. If there at least six ACEs, the final six ACEs are examined. 607 * If they are not equal to what we want, append six ACEs. 608 */ 609 must_append = 0; 610 if (aclp->acl_cnt < 6) { 611 must_append = 1; 612 } else { 613 a6 = &(aclp->acl_entry[aclp->acl_cnt - 1]); 614 a5 = &(aclp->acl_entry[aclp->acl_cnt - 2]); 615 a4 = &(aclp->acl_entry[aclp->acl_cnt - 3]); 616 a3 = &(aclp->acl_entry[aclp->acl_cnt - 4]); 617 a2 = &(aclp->acl_entry[aclp->acl_cnt - 5]); 618 a1 = &(aclp->acl_entry[aclp->acl_cnt - 6]); 619 620 if (!_acl_entry_matches(a1, ACL_USER_OBJ, 0, 621 ACL_ENTRY_TYPE_DENY)) 622 must_append = 1; 623 if (!_acl_entry_matches(a2, ACL_USER_OBJ, ACL_WRITE_ACL | 624 ACL_WRITE_OWNER | ACL_WRITE_ATTRIBUTES | 625 ACL_WRITE_NAMED_ATTRS, ACL_ENTRY_TYPE_ALLOW)) 626 must_append = 1; 627 if (!_acl_entry_matches(a3, ACL_GROUP_OBJ, 0, 628 ACL_ENTRY_TYPE_DENY)) 629 must_append = 1; 630 if (!_acl_entry_matches(a4, ACL_GROUP_OBJ, 0, 631 ACL_ENTRY_TYPE_ALLOW)) 632 must_append = 1; 633 if (!_acl_entry_matches(a5, ACL_EVERYONE, ACL_WRITE_ACL | 634 ACL_WRITE_OWNER | ACL_WRITE_ATTRIBUTES | 635 ACL_WRITE_NAMED_ATTRS, ACL_ENTRY_TYPE_DENY)) 636 must_append = 1; 637 if (!_acl_entry_matches(a6, ACL_EVERYONE, ACL_READ_ACL | 638 ACL_READ_ATTRIBUTES | ACL_READ_NAMED_ATTRS | 639 ACL_SYNCHRONIZE, ACL_ENTRY_TYPE_ALLOW)) 640 must_append = 1; 641 } 642 643 if (must_append) { 644 KASSERT(aclp->acl_cnt + 6 <= ACL_MAX_ENTRIES, 645 ("aclp->acl_cnt <= ACL_MAX_ENTRIES")); 646 647 a1 = _acl_append(aclp, ACL_USER_OBJ, 0, ACL_ENTRY_TYPE_DENY); 648 a2 = _acl_append(aclp, ACL_USER_OBJ, ACL_WRITE_ACL | 649 ACL_WRITE_OWNER | ACL_WRITE_ATTRIBUTES | 650 ACL_WRITE_NAMED_ATTRS, ACL_ENTRY_TYPE_ALLOW); 651 a3 = _acl_append(aclp, ACL_GROUP_OBJ, 0, ACL_ENTRY_TYPE_DENY); 652 a4 = _acl_append(aclp, ACL_GROUP_OBJ, 0, ACL_ENTRY_TYPE_ALLOW); 653 a5 = _acl_append(aclp, ACL_EVERYONE, ACL_WRITE_ACL | 654 ACL_WRITE_OWNER | ACL_WRITE_ATTRIBUTES | 655 ACL_WRITE_NAMED_ATTRS, ACL_ENTRY_TYPE_DENY); 656 a6 = _acl_append(aclp, ACL_EVERYONE, ACL_READ_ACL | 657 ACL_READ_ATTRIBUTES | ACL_READ_NAMED_ATTRS | 658 ACL_SYNCHRONIZE, ACL_ENTRY_TYPE_ALLOW); 659 660 KASSERT(a1 != NULL && a2 != NULL && a3 != NULL && a4 != NULL && 661 a5 != NULL && a6 != NULL, ("couldn't append to ACL.")); 662 } 663 664 /* 665 * 3. The final six ACEs are adjusted according to the incoming mode. 666 */ 667 if (mode & S_IRUSR) 668 a2->ae_perm |= ACL_READ_DATA; 669 else 670 a1->ae_perm |= ACL_READ_DATA; 671 if (mode & S_IWUSR) 672 a2->ae_perm |= (ACL_WRITE_DATA | ACL_APPEND_DATA); 673 else 674 a1->ae_perm |= (ACL_WRITE_DATA | ACL_APPEND_DATA); 675 if (mode & S_IXUSR) 676 a2->ae_perm |= ACL_EXECUTE; 677 else 678 a1->ae_perm |= ACL_EXECUTE; 679 680 if (mode & S_IRGRP) 681 a4->ae_perm |= ACL_READ_DATA; 682 else 683 a3->ae_perm |= ACL_READ_DATA; 684 if (mode & S_IWGRP) 685 a4->ae_perm |= (ACL_WRITE_DATA | ACL_APPEND_DATA); 686 else 687 a3->ae_perm |= (ACL_WRITE_DATA | ACL_APPEND_DATA); 688 if (mode & S_IXGRP) 689 a4->ae_perm |= ACL_EXECUTE; 690 else 691 a3->ae_perm |= ACL_EXECUTE; 692 693 if (mode & S_IROTH) 694 a6->ae_perm |= ACL_READ_DATA; 695 else 696 a5->ae_perm |= ACL_READ_DATA; 697 if (mode & S_IWOTH) 698 a6->ae_perm |= (ACL_WRITE_DATA | ACL_APPEND_DATA); 699 else 700 a5->ae_perm |= (ACL_WRITE_DATA | ACL_APPEND_DATA); 701 if (mode & S_IXOTH) 702 a6->ae_perm |= ACL_EXECUTE; 703 else 704 a5->ae_perm |= ACL_EXECUTE; 705} 706 707#ifdef _KERNEL 708void 709acl_nfs4_sync_acl_from_mode(struct acl *aclp, mode_t mode, 710 int file_owner_id) 711{ 712 713 if (acl_nfs4_old_semantics) 714 acl_nfs4_sync_acl_from_mode_draft(aclp, mode, file_owner_id); 715 else 716 acl_nfs4_trivial_from_mode(aclp, mode); 717} 718#endif /* _KERNEL */ 719 720void 721acl_nfs4_sync_mode_from_acl(mode_t *_mode, const struct acl *aclp) 722{ 723 int i; 724 mode_t old_mode = *_mode, mode = 0, seen = 0; 725 const struct acl_entry *entry; 726 727 KASSERT(aclp->acl_cnt <= ACL_MAX_ENTRIES, 728 ("aclp->acl_cnt <= ACL_MAX_ENTRIES")); 729 730 /* 731 * NFSv4 Minor Version 1, draft-ietf-nfsv4-minorversion1-03.txt 732 * 733 * 3.16.6.1. Recomputing mode upon SETATTR of ACL 734 */ 735 736 for (i = 0; i < aclp->acl_cnt; i++) { 737 entry = &(aclp->acl_entry[i]); 738 739 if (entry->ae_entry_type != ACL_ENTRY_TYPE_ALLOW && 740 entry->ae_entry_type != ACL_ENTRY_TYPE_DENY) 741 continue; 742 743 if (entry->ae_flags & ACL_ENTRY_INHERIT_ONLY) 744 continue; 745 746 if (entry->ae_tag == ACL_USER_OBJ) { 747 if ((entry->ae_perm & ACL_READ_DATA) && 748 ((seen & S_IRUSR) == 0)) { 749 seen |= S_IRUSR; 750 if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW) 751 mode |= S_IRUSR; 752 } 753 if ((entry->ae_perm & ACL_WRITE_DATA) && 754 ((seen & S_IWUSR) == 0)) { 755 seen |= S_IWUSR; 756 if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW) 757 mode |= S_IWUSR; 758 } 759 if ((entry->ae_perm & ACL_EXECUTE) && 760 ((seen & S_IXUSR) == 0)) { 761 seen |= S_IXUSR; 762 if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW) 763 mode |= S_IXUSR; 764 } 765 } else if (entry->ae_tag == ACL_GROUP_OBJ) { 766 if ((entry->ae_perm & ACL_READ_DATA) && 767 ((seen & S_IRGRP) == 0)) { 768 seen |= S_IRGRP; 769 if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW) 770 mode |= S_IRGRP; 771 } 772 if ((entry->ae_perm & ACL_WRITE_DATA) && 773 ((seen & S_IWGRP) == 0)) { 774 seen |= S_IWGRP; 775 if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW) 776 mode |= S_IWGRP; 777 } 778 if ((entry->ae_perm & ACL_EXECUTE) && 779 ((seen & S_IXGRP) == 0)) { 780 seen |= S_IXGRP; 781 if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW) 782 mode |= S_IXGRP; 783 } 784 } else if (entry->ae_tag == ACL_EVERYONE) { 785 if (entry->ae_perm & ACL_READ_DATA) { 786 if ((seen & S_IRUSR) == 0) { 787 seen |= S_IRUSR; 788 if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW) 789 mode |= S_IRUSR; 790 } 791 if ((seen & S_IRGRP) == 0) { 792 seen |= S_IRGRP; 793 if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW) 794 mode |= S_IRGRP; 795 } 796 if ((seen & S_IROTH) == 0) { 797 seen |= S_IROTH; 798 if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW) 799 mode |= S_IROTH; 800 } 801 } 802 if (entry->ae_perm & ACL_WRITE_DATA) { 803 if ((seen & S_IWUSR) == 0) { 804 seen |= S_IWUSR; 805 if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW) 806 mode |= S_IWUSR; 807 } 808 if ((seen & S_IWGRP) == 0) { 809 seen |= S_IWGRP; 810 if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW) 811 mode |= S_IWGRP; 812 } 813 if ((seen & S_IWOTH) == 0) { 814 seen |= S_IWOTH; 815 if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW) 816 mode |= S_IWOTH; 817 } 818 } 819 if (entry->ae_perm & ACL_EXECUTE) { 820 if ((seen & S_IXUSR) == 0) { 821 seen |= S_IXUSR; 822 if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW) 823 mode |= S_IXUSR; 824 } 825 if ((seen & S_IXGRP) == 0) { 826 seen |= S_IXGRP; 827 if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW) 828 mode |= S_IXGRP; 829 } 830 if ((seen & S_IXOTH) == 0) { 831 seen |= S_IXOTH; 832 if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW) 833 mode |= S_IXOTH; 834 } 835 } 836 } 837 } 838 839 *_mode = mode | (old_mode & ACL_PRESERVE_MASK); 840} 841 842#ifdef _KERNEL 843/* 844 * Calculate inherited ACL in a manner compatible with NFSv4 Minor Version 1, 845 * draft-ietf-nfsv4-minorversion1-03.txt. 846 */ 847static void 848acl_nfs4_compute_inherited_acl_draft(const struct acl *parent_aclp, 849 struct acl *child_aclp, mode_t mode, int file_owner_id, 850 int is_directory) 851{ 852 int i, flags; 853 const struct acl_entry *parent_entry; 854 struct acl_entry *entry, *copy; 855 856 KASSERT(child_aclp->acl_cnt == 0, ("child_aclp->acl_cnt == 0")); 857 KASSERT(parent_aclp->acl_cnt <= ACL_MAX_ENTRIES, 858 ("parent_aclp->acl_cnt <= ACL_MAX_ENTRIES")); 859 860 /* 861 * NFSv4 Minor Version 1, draft-ietf-nfsv4-minorversion1-03.txt 862 * 863 * 3.16.6.2. Applying the mode given to CREATE or OPEN 864 * to an inherited ACL 865 */ 866 867 /* 868 * 1. Form an ACL that is the concatenation of all inheritable ACEs. 869 */ 870 for (i = 0; i < parent_aclp->acl_cnt; i++) { 871 parent_entry = &(parent_aclp->acl_entry[i]); 872 flags = parent_entry->ae_flags; 873 874 /* 875 * Entry is not inheritable at all. 876 */ 877 if ((flags & (ACL_ENTRY_DIRECTORY_INHERIT | 878 ACL_ENTRY_FILE_INHERIT)) == 0) 879 continue; 880 881 /* 882 * We're creating a file, but entry is not inheritable 883 * by files. 884 */ 885 if (!is_directory && (flags & ACL_ENTRY_FILE_INHERIT) == 0) 886 continue; 887 888 /* 889 * Entry is inheritable only by files, but has NO_PROPAGATE 890 * flag set, and we're creating a directory, so it wouldn't 891 * propagate to any file in that directory anyway. 892 */ 893 if (is_directory && 894 (flags & ACL_ENTRY_DIRECTORY_INHERIT) == 0 && 895 (flags & ACL_ENTRY_NO_PROPAGATE_INHERIT)) 896 continue; 897 898 KASSERT(child_aclp->acl_cnt + 1 <= ACL_MAX_ENTRIES, 899 ("child_aclp->acl_cnt + 1 <= ACL_MAX_ENTRIES")); 900 child_aclp->acl_entry[child_aclp->acl_cnt] = *parent_entry; 901 child_aclp->acl_cnt++; 902 } 903 904 /* 905 * 2. For each entry in the new ACL, adjust its flags, possibly 906 * creating two entries in place of one. 907 */ 908 for (i = 0; i < child_aclp->acl_cnt; i++) { 909 entry = &(child_aclp->acl_entry[i]); 910 911 /* 912 * This is not in the specification, but SunOS 913 * apparently does that. 914 */ 915 if (((entry->ae_flags & ACL_ENTRY_NO_PROPAGATE_INHERIT) || 916 !is_directory) && 917 entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW) 918 entry->ae_perm &= ~(ACL_WRITE_ACL | ACL_WRITE_OWNER); 919 920 /* 921 * 2.A. If the ACL_ENTRY_NO_PROPAGATE_INHERIT is set, or if the object 922 * being created is not a directory, then clear the 923 * following flags: ACL_ENTRY_NO_PROPAGATE_INHERIT, 924 * ACL_ENTRY_FILE_INHERIT, ACL_ENTRY_DIRECTORY_INHERIT, 925 * ACL_ENTRY_INHERIT_ONLY. 926 */ 927 if (entry->ae_flags & ACL_ENTRY_NO_PROPAGATE_INHERIT || 928 !is_directory) { 929 entry->ae_flags &= ~(ACL_ENTRY_NO_PROPAGATE_INHERIT | 930 ACL_ENTRY_FILE_INHERIT | ACL_ENTRY_DIRECTORY_INHERIT | 931 ACL_ENTRY_INHERIT_ONLY); 932 933 /* 934 * Continue on to the next ACE. 935 */ 936 continue; 937 } 938 939 /* 940 * 2.B. If the object is a directory and ACL_ENTRY_FILE_INHERIT 941 * is set, but ACL_ENTRY_NO_PROPAGATE_INHERIT is not set, ensure 942 * that ACL_ENTRY_INHERIT_ONLY is set. Continue to the 943 * next ACE. Otherwise... 944 */ 945 /* 946 * XXX: Read it again and make sure what does the "otherwise" 947 * apply to. 948 */ 949 if (is_directory && 950 (entry->ae_flags & ACL_ENTRY_FILE_INHERIT) && 951 ((entry->ae_flags & ACL_ENTRY_DIRECTORY_INHERIT) == 0)) { 952 entry->ae_flags |= ACL_ENTRY_INHERIT_ONLY; 953 continue; 954 } 955 956 /* 957 * 2.C. If the type of the ACE is neither ALLOW nor deny, 958 * then continue. 959 */ 960 if (entry->ae_entry_type != ACL_ENTRY_TYPE_ALLOW && 961 entry->ae_entry_type != ACL_ENTRY_TYPE_DENY) 962 continue; 963 964 /* 965 * 2.D. Copy the original ACE into a second, adjacent ACE. 966 */ 967 copy = _acl_duplicate_entry(child_aclp, i); 968 969 /* 970 * 2.E. On the first ACE, ensure that ACL_ENTRY_INHERIT_ONLY 971 * is set. 972 */ 973 entry->ae_flags |= ACL_ENTRY_INHERIT_ONLY; 974 975 /* 976 * 2.F. On the second ACE, clear the following flags: 977 * ACL_ENTRY_NO_PROPAGATE_INHERIT, ACL_ENTRY_FILE_INHERIT, 978 * ACL_ENTRY_DIRECTORY_INHERIT, ACL_ENTRY_INHERIT_ONLY. 979 */ 980 copy->ae_flags &= ~(ACL_ENTRY_NO_PROPAGATE_INHERIT | 981 ACL_ENTRY_FILE_INHERIT | ACL_ENTRY_DIRECTORY_INHERIT | 982 ACL_ENTRY_INHERIT_ONLY); 983 984 /* 985 * 2.G. On the second ACE, if the type is ALLOW, 986 * an implementation MAY clear the following 987 * mask bits: ACL_WRITE_ACL, ACL_WRITE_OWNER. 988 */ 989 if (copy->ae_entry_type == ACL_ENTRY_TYPE_ALLOW) 990 copy->ae_perm &= ~(ACL_WRITE_ACL | ACL_WRITE_OWNER); 991 992 /* 993 * Increment the counter to skip the copied entry. 994 */ 995 i++; 996 } 997 998 /* 999 * 3. To ensure that the mode is honored, apply the algorithm describe 1000 * in Section 2.16.6.3, using the mode that is to be used for file 1001 * creation. 1002 */ 1003 acl_nfs4_sync_acl_from_mode(child_aclp, mode, file_owner_id); 1004} 1005#endif /* _KERNEL */ 1006 1007/* 1008 * Populate the ACL with entries inherited from parent_aclp. 1009 */ 1010static void 1011acl_nfs4_inherit_entries(const struct acl *parent_aclp, 1012 struct acl *child_aclp, mode_t mode, int file_owner_id, 1013 int is_directory) 1014{ 1015 int i, flags, tag; 1016 const struct acl_entry *parent_entry; 1017 struct acl_entry *entry; 1018 1019 KASSERT(parent_aclp->acl_cnt <= ACL_MAX_ENTRIES, 1020 ("parent_aclp->acl_cnt <= ACL_MAX_ENTRIES")); 1021 1022 for (i = 0; i < parent_aclp->acl_cnt; i++) { 1023 parent_entry = &(parent_aclp->acl_entry[i]); 1024 flags = parent_entry->ae_flags; 1025 tag = parent_entry->ae_tag; 1026 1027 /* 1028 * Don't inherit owner@, group@, or everyone@ entries. 1029 */ 1030 if (tag == ACL_USER_OBJ || tag == ACL_GROUP_OBJ || 1031 tag == ACL_EVERYONE) 1032 continue; 1033 1034 /* 1035 * Entry is not inheritable at all. 1036 */ 1037 if ((flags & (ACL_ENTRY_DIRECTORY_INHERIT | 1038 ACL_ENTRY_FILE_INHERIT)) == 0) 1039 continue; 1040 1041 /* 1042 * We're creating a file, but entry is not inheritable 1043 * by files. 1044 */ 1045 if (!is_directory && (flags & ACL_ENTRY_FILE_INHERIT) == 0) 1046 continue; 1047 1048 /* 1049 * Entry is inheritable only by files, but has NO_PROPAGATE 1050 * flag set, and we're creating a directory, so it wouldn't 1051 * propagate to any file in that directory anyway. 1052 */ 1053 if (is_directory && 1054 (flags & ACL_ENTRY_DIRECTORY_INHERIT) == 0 && 1055 (flags & ACL_ENTRY_NO_PROPAGATE_INHERIT)) 1056 continue; 1057 1058 /* 1059 * Entry qualifies for being inherited. 1060 */ 1061 KASSERT(child_aclp->acl_cnt + 1 <= ACL_MAX_ENTRIES, 1062 ("child_aclp->acl_cnt + 1 <= ACL_MAX_ENTRIES")); 1063 entry = &(child_aclp->acl_entry[child_aclp->acl_cnt]); 1064 *entry = *parent_entry; 1065 child_aclp->acl_cnt++; 1066 1067 entry->ae_flags &= ~ACL_ENTRY_INHERIT_ONLY; 1068 1069 /* 1070 * If the type of the ACE is neither ALLOW nor DENY, 1071 * then leave it as it is and proceed to the next one. 1072 */ 1073 if (entry->ae_entry_type != ACL_ENTRY_TYPE_ALLOW && 1074 entry->ae_entry_type != ACL_ENTRY_TYPE_DENY) 1075 continue; 1076 1077 /* 1078 * If the ACL_ENTRY_NO_PROPAGATE_INHERIT is set, or if 1079 * the object being created is not a directory, then clear 1080 * the following flags: ACL_ENTRY_NO_PROPAGATE_INHERIT, 1081 * ACL_ENTRY_FILE_INHERIT, ACL_ENTRY_DIRECTORY_INHERIT, 1082 * ACL_ENTRY_INHERIT_ONLY. 1083 */ 1084 if (entry->ae_flags & ACL_ENTRY_NO_PROPAGATE_INHERIT || 1085 !is_directory) { 1086 entry->ae_flags &= ~(ACL_ENTRY_NO_PROPAGATE_INHERIT | 1087 ACL_ENTRY_FILE_INHERIT | ACL_ENTRY_DIRECTORY_INHERIT | 1088 ACL_ENTRY_INHERIT_ONLY); 1089 } 1090 1091 /* 1092 * If the object is a directory and ACL_ENTRY_FILE_INHERIT 1093 * is set, but ACL_ENTRY_DIRECTORY_INHERIT is not set, ensure 1094 * that ACL_ENTRY_INHERIT_ONLY is set. 1095 */ 1096 if (is_directory && 1097 (entry->ae_flags & ACL_ENTRY_FILE_INHERIT) && 1098 ((entry->ae_flags & ACL_ENTRY_DIRECTORY_INHERIT) == 0)) { 1099 entry->ae_flags |= ACL_ENTRY_INHERIT_ONLY; 1100 } 1101 1102 if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW && 1103 (entry->ae_flags & ACL_ENTRY_INHERIT_ONLY) == 0) { 1104 /* 1105 * Some permissions must never be inherited. 1106 */ 1107 entry->ae_perm &= ~(ACL_WRITE_ACL | ACL_WRITE_OWNER | 1108 ACL_WRITE_NAMED_ATTRS | ACL_WRITE_ATTRIBUTES); 1109 1110 /* 1111 * Others must be masked according to the file mode. 1112 */ 1113 if ((mode & S_IRGRP) == 0) 1114 entry->ae_perm &= ~ACL_READ_DATA; 1115 if ((mode & S_IWGRP) == 0) 1116 entry->ae_perm &= 1117 ~(ACL_WRITE_DATA | ACL_APPEND_DATA); 1118 if ((mode & S_IXGRP) == 0) 1119 entry->ae_perm &= ~ACL_EXECUTE; 1120 } 1121 } 1122} 1123 1124/* 1125 * Calculate inherited ACL in a manner compatible with PSARC/2010/029. 1126 * It's also being used to calculate a trivial ACL, by inheriting from 1127 * a NULL ACL. 1128 */ 1129static void 1130acl_nfs4_compute_inherited_acl_psarc(const struct acl *parent_aclp, 1131 struct acl *aclp, mode_t mode, int file_owner_id, int is_directory) 1132{ 1133 acl_perm_t user_allow_first = 0, user_deny = 0, group_deny = 0; 1134 acl_perm_t user_allow, group_allow, everyone_allow; 1135 1136 KASSERT(aclp->acl_cnt == 0, ("aclp->acl_cnt == 0")); 1137 1138 user_allow = group_allow = everyone_allow = ACL_READ_ACL | 1139 ACL_READ_ATTRIBUTES | ACL_READ_NAMED_ATTRS | ACL_SYNCHRONIZE; 1140 user_allow |= ACL_WRITE_ACL | ACL_WRITE_OWNER | ACL_WRITE_ATTRIBUTES | 1141 ACL_WRITE_NAMED_ATTRS; 1142 1143 if (mode & S_IRUSR) 1144 user_allow |= ACL_READ_DATA; 1145 if (mode & S_IWUSR) 1146 user_allow |= (ACL_WRITE_DATA | ACL_APPEND_DATA); 1147 if (mode & S_IXUSR) 1148 user_allow |= ACL_EXECUTE; 1149 1150 if (mode & S_IRGRP) 1151 group_allow |= ACL_READ_DATA; 1152 if (mode & S_IWGRP) 1153 group_allow |= (ACL_WRITE_DATA | ACL_APPEND_DATA); 1154 if (mode & S_IXGRP) 1155 group_allow |= ACL_EXECUTE; 1156 1157 if (mode & S_IROTH) 1158 everyone_allow |= ACL_READ_DATA; 1159 if (mode & S_IWOTH) 1160 everyone_allow |= (ACL_WRITE_DATA | ACL_APPEND_DATA); 1161 if (mode & S_IXOTH) 1162 everyone_allow |= ACL_EXECUTE; 1163 1164 user_deny = ((group_allow | everyone_allow) & ~user_allow); 1165 group_deny = everyone_allow & ~group_allow; 1166 user_allow_first = group_deny & ~user_deny; 1167 1168 if (user_allow_first != 0) 1169 _acl_append(aclp, ACL_USER_OBJ, user_allow_first, 1170 ACL_ENTRY_TYPE_ALLOW); 1171 if (user_deny != 0) 1172 _acl_append(aclp, ACL_USER_OBJ, user_deny, 1173 ACL_ENTRY_TYPE_DENY); 1174 if (group_deny != 0) 1175 _acl_append(aclp, ACL_GROUP_OBJ, group_deny, 1176 ACL_ENTRY_TYPE_DENY); 1177 1178 if (parent_aclp != NULL) 1179 acl_nfs4_inherit_entries(parent_aclp, aclp, mode, 1180 file_owner_id, is_directory); 1181 1182 _acl_append(aclp, ACL_USER_OBJ, user_allow, ACL_ENTRY_TYPE_ALLOW); 1183 _acl_append(aclp, ACL_GROUP_OBJ, group_allow, ACL_ENTRY_TYPE_ALLOW); 1184 _acl_append(aclp, ACL_EVERYONE, everyone_allow, ACL_ENTRY_TYPE_ALLOW); 1185} 1186 1187#ifdef _KERNEL 1188void 1189acl_nfs4_compute_inherited_acl(const struct acl *parent_aclp, 1190 struct acl *child_aclp, mode_t mode, int file_owner_id, 1191 int is_directory) 1192{ 1193 1194 if (acl_nfs4_old_semantics) 1195 acl_nfs4_compute_inherited_acl_draft(parent_aclp, child_aclp, 1196 mode, file_owner_id, is_directory); 1197 else 1198 acl_nfs4_compute_inherited_acl_psarc(parent_aclp, child_aclp, 1199 mode, file_owner_id, is_directory); 1200} 1201#endif /* _KERNEL */ 1202 1203/* 1204 * Calculate trivial ACL in a manner compatible with PSARC/2010/029. 1205 * Note that this results in an ACL different from (but semantically 1206 * equal to) the "canonical six" trivial ACL computed using algorithm 1207 * described in draft-ietf-nfsv4-minorversion1-03.txt, 3.16.6.2. 1208 */ 1209static void 1210acl_nfs4_trivial_from_mode(struct acl *aclp, mode_t mode) 1211{ 1212 1213 aclp->acl_cnt = 0; 1214 acl_nfs4_compute_inherited_acl_psarc(NULL, aclp, mode, -1, -1); 1215} 1216 1217#ifndef _KERNEL 1218/* 1219 * This routine is used by libc to implement acl_strip_np(3) 1220 * and acl_is_trivial_np(3). 1221 */ 1222void 1223acl_nfs4_trivial_from_mode_libc(struct acl *aclp, int mode, int canonical_six) 1224{ 1225 1226 aclp->acl_cnt = 0; 1227 if (canonical_six) 1228 acl_nfs4_sync_acl_from_mode_draft(aclp, mode, -1); 1229 else 1230 acl_nfs4_trivial_from_mode(aclp, mode); 1231} 1232#endif /* !_KERNEL */ 1233 1234#ifdef _KERNEL 1235static int 1236_acls_are_equal(const struct acl *a, const struct acl *b) 1237{ 1238 int i; 1239 const struct acl_entry *entrya, *entryb; 1240 1241 if (a->acl_cnt != b->acl_cnt) 1242 return (0); 1243 1244 for (i = 0; i < b->acl_cnt; i++) { 1245 entrya = &(a->acl_entry[i]); 1246 entryb = &(b->acl_entry[i]); 1247 1248 if (entrya->ae_tag != entryb->ae_tag || 1249 entrya->ae_id != entryb->ae_id || 1250 entrya->ae_perm != entryb->ae_perm || 1251 entrya->ae_entry_type != entryb->ae_entry_type || 1252 entrya->ae_flags != entryb->ae_flags) 1253 return (0); 1254 } 1255 1256 return (1); 1257} 1258 1259/* 1260 * This routine is used to determine whether to remove extended attribute 1261 * that stores ACL contents. 1262 */ 1263int 1264acl_nfs4_is_trivial(const struct acl *aclp, int file_owner_id) 1265{ 1266 int trivial; 1267 mode_t tmpmode = 0; 1268 struct acl *tmpaclp; 1269 1270 if (aclp->acl_cnt > 6) 1271 return (0); 1272 1273 /* 1274 * Compute the mode from the ACL, then compute new ACL from that mode. 1275 * If the ACLs are identical, then the ACL is trivial. 1276 * 1277 * XXX: I guess there is a faster way to do this. However, even 1278 * this slow implementation significantly speeds things up 1279 * for files that don't have non-trivial ACLs - it's critical 1280 * for performance to not use EA when they are not needed. 1281 * 1282 * First try the PSARC/2010/029 semantics. 1283 */ 1284 tmpaclp = acl_alloc(M_WAITOK | M_ZERO); 1285 acl_nfs4_sync_mode_from_acl(&tmpmode, aclp); 1286 acl_nfs4_trivial_from_mode(tmpaclp, tmpmode); 1287 trivial = _acls_are_equal(aclp, tmpaclp); 1288 if (trivial) { 1289 acl_free(tmpaclp); 1290 return (trivial); 1291 } 1292 1293 /* 1294 * Check if it's a draft-ietf-nfsv4-minorversion1-03.txt trivial ACL. 1295 */ 1296 tmpaclp->acl_cnt = 0; 1297 acl_nfs4_sync_acl_from_mode_draft(tmpaclp, tmpmode, file_owner_id); 1298 trivial = _acls_are_equal(aclp, tmpaclp); 1299 acl_free(tmpaclp); 1300 1301 return (trivial); 1302} 1303#endif /* _KERNEL */ 1304 1305int 1306acl_nfs4_check(const struct acl *aclp, int is_directory) 1307{ 1308 int i; 1309 const struct acl_entry *entry; 1310 1311 /* 1312 * The spec doesn't seem to say anything about ACL validity. 1313 * It seems there is not much to do here. There is even no need 1314 * to count "owner@" or "everyone@" (ACL_USER_OBJ and ACL_EVERYONE) 1315 * entries, as there can be several of them and that's perfectly 1316 * valid. There can be none of them too. Really. 1317 */ 1318 1319 if (aclp->acl_cnt > ACL_MAX_ENTRIES || aclp->acl_cnt <= 0) 1320 return (EINVAL); 1321 1322 for (i = 0; i < aclp->acl_cnt; i++) { 1323 entry = &(aclp->acl_entry[i]); 1324 1325 switch (entry->ae_tag) { 1326 case ACL_USER_OBJ: 1327 case ACL_GROUP_OBJ: 1328 case ACL_EVERYONE: 1329 if (entry->ae_id != ACL_UNDEFINED_ID) 1330 return (EINVAL); 1331 break; 1332 1333 case ACL_USER: 1334 case ACL_GROUP: 1335 if (entry->ae_id == ACL_UNDEFINED_ID) 1336 return (EINVAL); 1337 break; 1338 1339 default: 1340 return (EINVAL); 1341 } 1342 1343 if ((entry->ae_perm | ACL_NFS4_PERM_BITS) != ACL_NFS4_PERM_BITS) 1344 return (EINVAL); 1345 1346 /* 1347 * Disallow ACL_ENTRY_TYPE_AUDIT and ACL_ENTRY_TYPE_ALARM for now. 1348 */ 1349 if (entry->ae_entry_type != ACL_ENTRY_TYPE_ALLOW && 1350 entry->ae_entry_type != ACL_ENTRY_TYPE_DENY) 1351 return (EINVAL); 1352 1353 if ((entry->ae_flags | ACL_FLAGS_BITS) != ACL_FLAGS_BITS) 1354 return (EINVAL); 1355 1356 /* Disallow unimplemented flags. */ 1357 if (entry->ae_flags & (ACL_ENTRY_SUCCESSFUL_ACCESS | 1358 ACL_ENTRY_FAILED_ACCESS)) 1359 return (EINVAL); 1360 1361 /* Disallow flags not allowed for ordinary files. */ 1362 if (!is_directory) { 1363 if (entry->ae_flags & (ACL_ENTRY_FILE_INHERIT | 1364 ACL_ENTRY_DIRECTORY_INHERIT | 1365 ACL_ENTRY_NO_PROPAGATE_INHERIT | ACL_ENTRY_INHERIT_ONLY)) 1366 return (EINVAL); 1367 } 1368 } 1369 1370 return (0); 1371} 1372 1373#ifdef _KERNEL 1374static int 1375acl_nfs4_modload(module_t module, int what, void *arg) 1376{ 1377 int ret; 1378 1379 ret = 0; 1380 1381 switch (what) { 1382 case MOD_LOAD: 1383 case MOD_SHUTDOWN: 1384 break; 1385 1386 case MOD_QUIESCE: 1387 /* XXX TODO */ 1388 ret = 0; 1389 break; 1390 1391 case MOD_UNLOAD: 1392 /* XXX TODO */ 1393 ret = 0; 1394 break; 1395 default: 1396 ret = EINVAL; 1397 break; 1398 } 1399 1400 return (ret); 1401} 1402 1403static moduledata_t acl_nfs4_mod = { 1404 "acl_nfs4", 1405 acl_nfs4_modload, 1406 NULL 1407}; 1408 1409/* 1410 * XXX TODO: which subsystem, order? 1411 */ 1412DECLARE_MODULE(acl_nfs4, acl_nfs4_mod, SI_SUB_VFS, SI_ORDER_FIRST); 1413MODULE_VERSION(acl_nfs4, 1); 1414#endif /* _KERNEL */ 1415