zfs_fuid.c revision 277300
1283625Sdim/* 2283625Sdim * CDDL HEADER START 3353358Sdim * 4353358Sdim * The contents of this file are subject to the terms of the 5353358Sdim * Common Development and Distribution License (the "License"). 6283625Sdim * You may not use this file except in compliance with the License. 7283625Sdim * 8283625Sdim * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9283625Sdim * or http://www.opensolaris.org/os/licensing. 10283625Sdim * See the License for the specific language governing permissions 11283625Sdim * and limitations under the License. 12283625Sdim * 13283625Sdim * When distributing Covered Code, include this CDDL HEADER in each 14283625Sdim * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15283625Sdim * If applicable, add the following below this CDDL HEADER, with the 16283625Sdim * fields enclosed by brackets "[]" replaced with your own identifying 17283625Sdim * information: Portions Copyright [yyyy] [name of copyright owner] 18283625Sdim * 19283625Sdim * CDDL HEADER END 20353358Sdim */ 21283625Sdim/* 22283625Sdim * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved. 23327952Sdim */ 24283625Sdim 25283625Sdim#include <sys/zfs_context.h> 26283625Sdim#include <sys/dmu.h> 27283625Sdim#include <sys/avl.h> 28283625Sdim#include <sys/zap.h> 29283625Sdim#include <sys/refcount.h> 30283625Sdim#include <sys/nvpair.h> 31283625Sdim#ifdef _KERNEL 32283625Sdim#include <sys/kidmap.h> 33283625Sdim#include <sys/sid.h> 34283625Sdim#include <sys/zfs_vfsops.h> 35283625Sdim#include <sys/zfs_znode.h> 36283625Sdim#endif 37283625Sdim#include <sys/zfs_fuid.h> 38283625Sdim 39286684Sdim/* 40286684Sdim * FUID Domain table(s). 41286684Sdim * 42283625Sdim * The FUID table is stored as a packed nvlist of an array 43283625Sdim * of nvlists which contain an index, domain string and offset 44283625Sdim * 45283625Sdim * During file system initialization the nvlist(s) are read and 46283625Sdim * two AVL trees are created. One tree is keyed by the index number 47321369Sdim * and the other by the domain string. Nodes are never removed from 48321369Sdim * trees, but new entries may be added. If a new entry is added then 49321369Sdim * the zfsvfs->z_fuid_dirty flag is set to true and the caller will then 50321369Sdim * be responsible for calling zfs_fuid_sync() to sync the changes to disk. 51344779Sdim * 52344779Sdim */ 53344779Sdim 54344779Sdim#define FUID_IDX "fuid_idx" 55344779Sdim#define FUID_DOMAIN "fuid_domain" 56344779Sdim#define FUID_OFFSET "fuid_offset" 57344779Sdim#define FUID_NVP_ARRAY "fuid_nvlist" 58344779Sdim 59344779Sdimtypedef struct fuid_domain { 60344779Sdim avl_node_t f_domnode; 61344779Sdim avl_node_t f_idxnode; 62344779Sdim ksiddomain_t *f_ksid; 63344779Sdim uint64_t f_idx; 64341825Sdim} fuid_domain_t; 65341825Sdim 66341825Sdimstatic char *nulldomain = ""; 67341825Sdim 68341825Sdim/* 69341825Sdim * Compare two indexes. 70341825Sdim */ 71341825Sdimstatic int 72341825Sdimidx_compare(const void *arg1, const void *arg2) 73341825Sdim{ 74341825Sdim const fuid_domain_t *node1 = arg1; 75341825Sdim const fuid_domain_t *node2 = arg2; 76341825Sdim 77341825Sdim if (node1->f_idx < node2->f_idx) 78341825Sdim return (-1); 79341825Sdim else if (node1->f_idx > node2->f_idx) 80341825Sdim return (1); 81341825Sdim return (0); 82341825Sdim} 83341825Sdim 84309124Sdim/* 85309124Sdim * Compare two domain strings. 86309124Sdim */ 87309124Sdimstatic int 88296417Sdimdomain_compare(const void *arg1, const void *arg2) 89283625Sdim{ 90283625Sdim const fuid_domain_t *node1 = arg1; 91283625Sdim const fuid_domain_t *node2 = arg2; 92283625Sdim int val; 93314564Sdim 94314564Sdim val = strcmp(node1->f_ksid->kd_name, node2->f_ksid->kd_name); 95286684Sdim if (val == 0) 96321369Sdim return (0); 97321369Sdim return (val > 0 ? 1 : -1); 98327952Sdim} 99327952Sdim 100327952Sdimvoid 101327952Sdimzfs_fuid_avl_tree_create(avl_tree_t *idx_tree, avl_tree_t *domain_tree) 102327952Sdim{ 103327952Sdim avl_create(idx_tree, idx_compare, 104327952Sdim sizeof (fuid_domain_t), offsetof(fuid_domain_t, f_idxnode)); 105327952Sdim avl_create(domain_tree, domain_compare, 106327952Sdim sizeof (fuid_domain_t), offsetof(fuid_domain_t, f_domnode)); 107327952Sdim} 108327952Sdim 109327952Sdim/* 110327952Sdim * load initial fuid domain and idx trees. This function is used by 111327952Sdim * both the kernel and zdb. 112327952Sdim */ 113327952Sdimuint64_t 114283625Sdimzfs_fuid_table_load(objset_t *os, uint64_t fuid_obj, avl_tree_t *idx_tree, 115283625Sdim avl_tree_t *domain_tree) 116283625Sdim{ 117283625Sdim dmu_buf_t *db; 118283625Sdim uint64_t fuid_size; 119 120 ASSERT(fuid_obj != 0); 121 VERIFY(0 == dmu_bonus_hold(os, fuid_obj, 122 FTAG, &db)); 123 fuid_size = *(uint64_t *)db->db_data; 124 dmu_buf_rele(db, FTAG); 125 126 if (fuid_size) { 127 nvlist_t **fuidnvp; 128 nvlist_t *nvp = NULL; 129 uint_t count; 130 char *packed; 131 int i; 132 133 packed = kmem_alloc(fuid_size, KM_SLEEP); 134 VERIFY(dmu_read(os, fuid_obj, 0, 135 fuid_size, packed, DMU_READ_PREFETCH) == 0); 136 VERIFY(nvlist_unpack(packed, fuid_size, 137 &nvp, 0) == 0); 138 VERIFY(nvlist_lookup_nvlist_array(nvp, FUID_NVP_ARRAY, 139 &fuidnvp, &count) == 0); 140 141 for (i = 0; i != count; i++) { 142 fuid_domain_t *domnode; 143 char *domain; 144 uint64_t idx; 145 146 VERIFY(nvlist_lookup_string(fuidnvp[i], FUID_DOMAIN, 147 &domain) == 0); 148 VERIFY(nvlist_lookup_uint64(fuidnvp[i], FUID_IDX, 149 &idx) == 0); 150 151 domnode = kmem_alloc(sizeof (fuid_domain_t), KM_SLEEP); 152 153 domnode->f_idx = idx; 154 domnode->f_ksid = ksid_lookupdomain(domain); 155 avl_add(idx_tree, domnode); 156 avl_add(domain_tree, domnode); 157 } 158 nvlist_free(nvp); 159 kmem_free(packed, fuid_size); 160 } 161 return (fuid_size); 162} 163 164void 165zfs_fuid_table_destroy(avl_tree_t *idx_tree, avl_tree_t *domain_tree) 166{ 167 fuid_domain_t *domnode; 168 void *cookie; 169 170 cookie = NULL; 171 while (domnode = avl_destroy_nodes(domain_tree, &cookie)) 172 ksiddomain_rele(domnode->f_ksid); 173 174 avl_destroy(domain_tree); 175 cookie = NULL; 176 while (domnode = avl_destroy_nodes(idx_tree, &cookie)) 177 kmem_free(domnode, sizeof (fuid_domain_t)); 178 avl_destroy(idx_tree); 179} 180 181char * 182zfs_fuid_idx_domain(avl_tree_t *idx_tree, uint32_t idx) 183{ 184 fuid_domain_t searchnode, *findnode; 185 avl_index_t loc; 186 187 searchnode.f_idx = idx; 188 189 findnode = avl_find(idx_tree, &searchnode, &loc); 190 191 return (findnode ? findnode->f_ksid->kd_name : nulldomain); 192} 193 194#ifdef _KERNEL 195/* 196 * Load the fuid table(s) into memory. 197 */ 198static void 199zfs_fuid_init(zfsvfs_t *zfsvfs) 200{ 201 rw_enter(&zfsvfs->z_fuid_lock, RW_WRITER); 202 203 if (zfsvfs->z_fuid_loaded) { 204 rw_exit(&zfsvfs->z_fuid_lock); 205 return; 206 } 207 208 zfs_fuid_avl_tree_create(&zfsvfs->z_fuid_idx, &zfsvfs->z_fuid_domain); 209 210 (void) zap_lookup(zfsvfs->z_os, MASTER_NODE_OBJ, 211 ZFS_FUID_TABLES, 8, 1, &zfsvfs->z_fuid_obj); 212 if (zfsvfs->z_fuid_obj != 0) { 213 zfsvfs->z_fuid_size = zfs_fuid_table_load(zfsvfs->z_os, 214 zfsvfs->z_fuid_obj, &zfsvfs->z_fuid_idx, 215 &zfsvfs->z_fuid_domain); 216 } 217 218 zfsvfs->z_fuid_loaded = B_TRUE; 219 rw_exit(&zfsvfs->z_fuid_lock); 220} 221 222/* 223 * sync out AVL trees to persistent storage. 224 */ 225void 226zfs_fuid_sync(zfsvfs_t *zfsvfs, dmu_tx_t *tx) 227{ 228 nvlist_t *nvp; 229 nvlist_t **fuids; 230 size_t nvsize = 0; 231 char *packed; 232 dmu_buf_t *db; 233 fuid_domain_t *domnode; 234 int numnodes; 235 int i; 236 237 if (!zfsvfs->z_fuid_dirty) { 238 return; 239 } 240 241 rw_enter(&zfsvfs->z_fuid_lock, RW_WRITER); 242 243 /* 244 * First see if table needs to be created? 245 */ 246 if (zfsvfs->z_fuid_obj == 0) { 247 zfsvfs->z_fuid_obj = dmu_object_alloc(zfsvfs->z_os, 248 DMU_OT_FUID, 1 << 14, DMU_OT_FUID_SIZE, 249 sizeof (uint64_t), tx); 250 VERIFY(zap_add(zfsvfs->z_os, MASTER_NODE_OBJ, 251 ZFS_FUID_TABLES, sizeof (uint64_t), 1, 252 &zfsvfs->z_fuid_obj, tx) == 0); 253 } 254 255 VERIFY(nvlist_alloc(&nvp, NV_UNIQUE_NAME, KM_SLEEP) == 0); 256 257 numnodes = avl_numnodes(&zfsvfs->z_fuid_idx); 258 fuids = kmem_alloc(numnodes * sizeof (void *), KM_SLEEP); 259 for (i = 0, domnode = avl_first(&zfsvfs->z_fuid_domain); domnode; i++, 260 domnode = AVL_NEXT(&zfsvfs->z_fuid_domain, domnode)) { 261 VERIFY(nvlist_alloc(&fuids[i], NV_UNIQUE_NAME, KM_SLEEP) == 0); 262 VERIFY(nvlist_add_uint64(fuids[i], FUID_IDX, 263 domnode->f_idx) == 0); 264 VERIFY(nvlist_add_uint64(fuids[i], FUID_OFFSET, 0) == 0); 265 VERIFY(nvlist_add_string(fuids[i], FUID_DOMAIN, 266 domnode->f_ksid->kd_name) == 0); 267 } 268 VERIFY(nvlist_add_nvlist_array(nvp, FUID_NVP_ARRAY, 269 fuids, numnodes) == 0); 270 for (i = 0; i != numnodes; i++) 271 nvlist_free(fuids[i]); 272 kmem_free(fuids, numnodes * sizeof (void *)); 273 VERIFY(nvlist_size(nvp, &nvsize, NV_ENCODE_XDR) == 0); 274 packed = kmem_alloc(nvsize, KM_SLEEP); 275 VERIFY(nvlist_pack(nvp, &packed, &nvsize, 276 NV_ENCODE_XDR, KM_SLEEP) == 0); 277 nvlist_free(nvp); 278 zfsvfs->z_fuid_size = nvsize; 279 dmu_write(zfsvfs->z_os, zfsvfs->z_fuid_obj, 0, 280 zfsvfs->z_fuid_size, packed, tx); 281 kmem_free(packed, zfsvfs->z_fuid_size); 282 VERIFY(0 == dmu_bonus_hold(zfsvfs->z_os, zfsvfs->z_fuid_obj, 283 FTAG, &db)); 284 dmu_buf_will_dirty(db, tx); 285 *(uint64_t *)db->db_data = zfsvfs->z_fuid_size; 286 dmu_buf_rele(db, FTAG); 287 288 zfsvfs->z_fuid_dirty = B_FALSE; 289 rw_exit(&zfsvfs->z_fuid_lock); 290} 291 292/* 293 * Query domain table for a given domain. 294 * 295 * If domain isn't found and addok is set, it is added to AVL trees and 296 * the zfsvfs->z_fuid_dirty flag will be set to TRUE. It will then be 297 * necessary for the caller or another thread to detect the dirty table 298 * and sync out the changes. 299 */ 300int 301zfs_fuid_find_by_domain(zfsvfs_t *zfsvfs, const char *domain, 302 char **retdomain, boolean_t addok) 303{ 304 fuid_domain_t searchnode, *findnode; 305 avl_index_t loc; 306 krw_t rw = RW_READER; 307 308 /* 309 * If the dummy "nobody" domain then return an index of 0 310 * to cause the created FUID to be a standard POSIX id 311 * for the user nobody. 312 */ 313 if (domain[0] == '\0') { 314 if (retdomain) 315 *retdomain = nulldomain; 316 return (0); 317 } 318 319 searchnode.f_ksid = ksid_lookupdomain(domain); 320 if (retdomain) 321 *retdomain = searchnode.f_ksid->kd_name; 322 if (!zfsvfs->z_fuid_loaded) 323 zfs_fuid_init(zfsvfs); 324 325retry: 326 rw_enter(&zfsvfs->z_fuid_lock, rw); 327 findnode = avl_find(&zfsvfs->z_fuid_domain, &searchnode, &loc); 328 329 if (findnode) { 330 rw_exit(&zfsvfs->z_fuid_lock); 331 ksiddomain_rele(searchnode.f_ksid); 332 return (findnode->f_idx); 333 } else if (addok) { 334 fuid_domain_t *domnode; 335 uint64_t retidx; 336 337 if (rw == RW_READER && !rw_tryupgrade(&zfsvfs->z_fuid_lock)) { 338 rw_exit(&zfsvfs->z_fuid_lock); 339 rw = RW_WRITER; 340 goto retry; 341 } 342 343 domnode = kmem_alloc(sizeof (fuid_domain_t), KM_SLEEP); 344 domnode->f_ksid = searchnode.f_ksid; 345 346 retidx = domnode->f_idx = avl_numnodes(&zfsvfs->z_fuid_idx) + 1; 347 348 avl_add(&zfsvfs->z_fuid_domain, domnode); 349 avl_add(&zfsvfs->z_fuid_idx, domnode); 350 zfsvfs->z_fuid_dirty = B_TRUE; 351 rw_exit(&zfsvfs->z_fuid_lock); 352 return (retidx); 353 } else { 354 rw_exit(&zfsvfs->z_fuid_lock); 355 return (-1); 356 } 357} 358 359/* 360 * Query domain table by index, returning domain string 361 * 362 * Returns a pointer from an avl node of the domain string. 363 * 364 */ 365const char * 366zfs_fuid_find_by_idx(zfsvfs_t *zfsvfs, uint32_t idx) 367{ 368 char *domain; 369 370 if (idx == 0 || !zfsvfs->z_use_fuids) 371 return (NULL); 372 373 if (!zfsvfs->z_fuid_loaded) 374 zfs_fuid_init(zfsvfs); 375 376 rw_enter(&zfsvfs->z_fuid_lock, RW_READER); 377 378 if (zfsvfs->z_fuid_obj || zfsvfs->z_fuid_dirty) 379 domain = zfs_fuid_idx_domain(&zfsvfs->z_fuid_idx, idx); 380 else 381 domain = nulldomain; 382 rw_exit(&zfsvfs->z_fuid_lock); 383 384 ASSERT(domain); 385 return (domain); 386} 387 388void 389zfs_fuid_map_ids(znode_t *zp, cred_t *cr, uid_t *uidp, uid_t *gidp) 390{ 391 *uidp = zfs_fuid_map_id(zp->z_zfsvfs, zp->z_uid, cr, ZFS_OWNER); 392 *gidp = zfs_fuid_map_id(zp->z_zfsvfs, zp->z_gid, cr, ZFS_GROUP); 393} 394 395uid_t 396zfs_fuid_map_id(zfsvfs_t *zfsvfs, uint64_t fuid, 397 cred_t *cr, zfs_fuid_type_t type) 398{ 399 uint32_t index = FUID_INDEX(fuid); 400 const char *domain; 401 uid_t id; 402 403 if (index == 0) 404 return (fuid); 405 406 domain = zfs_fuid_find_by_idx(zfsvfs, index); 407 ASSERT(domain != NULL); 408 409#ifdef illumos 410 if (type == ZFS_OWNER || type == ZFS_ACE_USER) { 411 (void) kidmap_getuidbysid(crgetzone(cr), domain, 412 FUID_RID(fuid), &id); 413 } else { 414 (void) kidmap_getgidbysid(crgetzone(cr), domain, 415 FUID_RID(fuid), &id); 416 } 417#else 418 id = UID_NOBODY; 419#endif 420 return (id); 421} 422 423/* 424 * Add a FUID node to the list of fuid's being created for this 425 * ACL 426 * 427 * If ACL has multiple domains, then keep only one copy of each unique 428 * domain. 429 */ 430void 431zfs_fuid_node_add(zfs_fuid_info_t **fuidpp, const char *domain, uint32_t rid, 432 uint64_t idx, uint64_t id, zfs_fuid_type_t type) 433{ 434 zfs_fuid_t *fuid; 435 zfs_fuid_domain_t *fuid_domain; 436 zfs_fuid_info_t *fuidp; 437 uint64_t fuididx; 438 boolean_t found = B_FALSE; 439 440 if (*fuidpp == NULL) 441 *fuidpp = zfs_fuid_info_alloc(); 442 443 fuidp = *fuidpp; 444 /* 445 * First find fuid domain index in linked list 446 * 447 * If one isn't found then create an entry. 448 */ 449 450 for (fuididx = 1, fuid_domain = list_head(&fuidp->z_domains); 451 fuid_domain; fuid_domain = list_next(&fuidp->z_domains, 452 fuid_domain), fuididx++) { 453 if (idx == fuid_domain->z_domidx) { 454 found = B_TRUE; 455 break; 456 } 457 } 458 459 if (!found) { 460 fuid_domain = kmem_alloc(sizeof (zfs_fuid_domain_t), KM_SLEEP); 461 fuid_domain->z_domain = domain; 462 fuid_domain->z_domidx = idx; 463 list_insert_tail(&fuidp->z_domains, fuid_domain); 464 fuidp->z_domain_str_sz += strlen(domain) + 1; 465 fuidp->z_domain_cnt++; 466 } 467 468 if (type == ZFS_ACE_USER || type == ZFS_ACE_GROUP) { 469 470 /* 471 * Now allocate fuid entry and add it on the end of the list 472 */ 473 474 fuid = kmem_alloc(sizeof (zfs_fuid_t), KM_SLEEP); 475 fuid->z_id = id; 476 fuid->z_domidx = idx; 477 fuid->z_logfuid = FUID_ENCODE(fuididx, rid); 478 479 list_insert_tail(&fuidp->z_fuids, fuid); 480 fuidp->z_fuid_cnt++; 481 } else { 482 if (type == ZFS_OWNER) 483 fuidp->z_fuid_owner = FUID_ENCODE(fuididx, rid); 484 else 485 fuidp->z_fuid_group = FUID_ENCODE(fuididx, rid); 486 } 487} 488 489/* 490 * Create a file system FUID, based on information in the users cred 491 * 492 * If cred contains KSID_OWNER then it should be used to determine 493 * the uid otherwise cred's uid will be used. By default cred's gid 494 * is used unless it's an ephemeral ID in which case KSID_GROUP will 495 * be used if it exists. 496 */ 497uint64_t 498zfs_fuid_create_cred(zfsvfs_t *zfsvfs, zfs_fuid_type_t type, 499 cred_t *cr, zfs_fuid_info_t **fuidp) 500{ 501 uint64_t idx; 502 ksid_t *ksid; 503 uint32_t rid; 504 char *kdomain; 505 const char *domain; 506 uid_t id; 507 508 VERIFY(type == ZFS_OWNER || type == ZFS_GROUP); 509 510 ksid = crgetsid(cr, (type == ZFS_OWNER) ? KSID_OWNER : KSID_GROUP); 511 512 if (!zfsvfs->z_use_fuids || (ksid == NULL)) { 513 id = (type == ZFS_OWNER) ? crgetuid(cr) : crgetgid(cr); 514 515 if (IS_EPHEMERAL(id)) 516 return ((type == ZFS_OWNER) ? UID_NOBODY : GID_NOBODY); 517 518 return ((uint64_t)id); 519 } 520 521 /* 522 * ksid is present and FUID is supported 523 */ 524 id = (type == ZFS_OWNER) ? ksid_getid(ksid) : crgetgid(cr); 525 526 if (!IS_EPHEMERAL(id)) 527 return ((uint64_t)id); 528 529 if (type == ZFS_GROUP) 530 id = ksid_getid(ksid); 531 532 rid = ksid_getrid(ksid); 533 domain = ksid_getdomain(ksid); 534 535 idx = zfs_fuid_find_by_domain(zfsvfs, domain, &kdomain, B_TRUE); 536 537 zfs_fuid_node_add(fuidp, kdomain, rid, idx, id, type); 538 539 return (FUID_ENCODE(idx, rid)); 540} 541 542/* 543 * Create a file system FUID for an ACL ace 544 * or a chown/chgrp of the file. 545 * This is similar to zfs_fuid_create_cred, except that 546 * we can't find the domain + rid information in the 547 * cred. Instead we have to query Winchester for the 548 * domain and rid. 549 * 550 * During replay operations the domain+rid information is 551 * found in the zfs_fuid_info_t that the replay code has 552 * attached to the zfsvfs of the file system. 553 */ 554uint64_t 555zfs_fuid_create(zfsvfs_t *zfsvfs, uint64_t id, cred_t *cr, 556 zfs_fuid_type_t type, zfs_fuid_info_t **fuidpp) 557{ 558 const char *domain; 559 char *kdomain; 560 uint32_t fuid_idx = FUID_INDEX(id); 561 uint32_t rid; 562 idmap_stat status; 563 uint64_t idx = 0; 564 zfs_fuid_t *zfuid = NULL; 565 zfs_fuid_info_t *fuidp = NULL; 566 567 /* 568 * If POSIX ID, or entry is already a FUID then 569 * just return the id 570 * 571 * We may also be handed an already FUID'ized id via 572 * chmod. 573 */ 574 575 if (!zfsvfs->z_use_fuids || !IS_EPHEMERAL(id) || fuid_idx != 0) 576 return (id); 577 578 if (zfsvfs->z_replay) { 579 fuidp = zfsvfs->z_fuid_replay; 580 581 /* 582 * If we are passed an ephemeral id, but no 583 * fuid_info was logged then return NOBODY. 584 * This is most likely a result of idmap service 585 * not being available. 586 */ 587 if (fuidp == NULL) 588 return (UID_NOBODY); 589 590 VERIFY3U(type, >=, ZFS_OWNER); 591 VERIFY3U(type, <=, ZFS_ACE_GROUP); 592 593 switch (type) { 594 case ZFS_ACE_USER: 595 case ZFS_ACE_GROUP: 596 zfuid = list_head(&fuidp->z_fuids); 597 rid = FUID_RID(zfuid->z_logfuid); 598 idx = FUID_INDEX(zfuid->z_logfuid); 599 break; 600 case ZFS_OWNER: 601 rid = FUID_RID(fuidp->z_fuid_owner); 602 idx = FUID_INDEX(fuidp->z_fuid_owner); 603 break; 604 case ZFS_GROUP: 605 rid = FUID_RID(fuidp->z_fuid_group); 606 idx = FUID_INDEX(fuidp->z_fuid_group); 607 break; 608 }; 609 domain = fuidp->z_domain_table[idx - 1]; 610 } else { 611 if (type == ZFS_OWNER || type == ZFS_ACE_USER) 612 status = kidmap_getsidbyuid(crgetzone(cr), id, 613 &domain, &rid); 614 else 615 status = kidmap_getsidbygid(crgetzone(cr), id, 616 &domain, &rid); 617 618 if (status != 0) { 619 /* 620 * When returning nobody we will need to 621 * make a dummy fuid table entry for logging 622 * purposes. 623 */ 624 rid = UID_NOBODY; 625 domain = nulldomain; 626 } 627 } 628 629 idx = zfs_fuid_find_by_domain(zfsvfs, domain, &kdomain, B_TRUE); 630 631 if (!zfsvfs->z_replay) 632 zfs_fuid_node_add(fuidpp, kdomain, 633 rid, idx, id, type); 634 else if (zfuid != NULL) { 635 list_remove(&fuidp->z_fuids, zfuid); 636 kmem_free(zfuid, sizeof (zfs_fuid_t)); 637 } 638 return (FUID_ENCODE(idx, rid)); 639} 640 641void 642zfs_fuid_destroy(zfsvfs_t *zfsvfs) 643{ 644 rw_enter(&zfsvfs->z_fuid_lock, RW_WRITER); 645 if (!zfsvfs->z_fuid_loaded) { 646 rw_exit(&zfsvfs->z_fuid_lock); 647 return; 648 } 649 zfs_fuid_table_destroy(&zfsvfs->z_fuid_idx, &zfsvfs->z_fuid_domain); 650 rw_exit(&zfsvfs->z_fuid_lock); 651} 652 653/* 654 * Allocate zfs_fuid_info for tracking FUIDs created during 655 * zfs_mknode, VOP_SETATTR() or VOP_SETSECATTR() 656 */ 657zfs_fuid_info_t * 658zfs_fuid_info_alloc(void) 659{ 660 zfs_fuid_info_t *fuidp; 661 662 fuidp = kmem_zalloc(sizeof (zfs_fuid_info_t), KM_SLEEP); 663 list_create(&fuidp->z_domains, sizeof (zfs_fuid_domain_t), 664 offsetof(zfs_fuid_domain_t, z_next)); 665 list_create(&fuidp->z_fuids, sizeof (zfs_fuid_t), 666 offsetof(zfs_fuid_t, z_next)); 667 return (fuidp); 668} 669 670/* 671 * Release all memory associated with zfs_fuid_info_t 672 */ 673void 674zfs_fuid_info_free(zfs_fuid_info_t *fuidp) 675{ 676 zfs_fuid_t *zfuid; 677 zfs_fuid_domain_t *zdomain; 678 679 while ((zfuid = list_head(&fuidp->z_fuids)) != NULL) { 680 list_remove(&fuidp->z_fuids, zfuid); 681 kmem_free(zfuid, sizeof (zfs_fuid_t)); 682 } 683 684 if (fuidp->z_domain_table != NULL) 685 kmem_free(fuidp->z_domain_table, 686 (sizeof (char **)) * fuidp->z_domain_cnt); 687 688 while ((zdomain = list_head(&fuidp->z_domains)) != NULL) { 689 list_remove(&fuidp->z_domains, zdomain); 690 kmem_free(zdomain, sizeof (zfs_fuid_domain_t)); 691 } 692 693 kmem_free(fuidp, sizeof (zfs_fuid_info_t)); 694} 695 696/* 697 * Check to see if id is a groupmember. If cred 698 * has ksid info then sidlist is checked first 699 * and if still not found then POSIX groups are checked 700 * 701 * Will use a straight FUID compare when possible. 702 */ 703boolean_t 704zfs_groupmember(zfsvfs_t *zfsvfs, uint64_t id, cred_t *cr) 705{ 706#ifdef illumos 707 ksid_t *ksid = crgetsid(cr, KSID_GROUP); 708 ksidlist_t *ksidlist = crgetsidlist(cr); 709#endif 710 uid_t gid; 711 712#ifdef illumos 713 if (ksid && ksidlist) { 714 int i; 715 ksid_t *ksid_groups; 716 uint32_t idx = FUID_INDEX(id); 717 uint32_t rid = FUID_RID(id); 718 719 ksid_groups = ksidlist->ksl_sids; 720 721 for (i = 0; i != ksidlist->ksl_nsid; i++) { 722 if (idx == 0) { 723 if (id != IDMAP_WK_CREATOR_GROUP_GID && 724 id == ksid_groups[i].ks_id) { 725 return (B_TRUE); 726 } 727 } else { 728 const char *domain; 729 730 domain = zfs_fuid_find_by_idx(zfsvfs, idx); 731 ASSERT(domain != NULL); 732 733 if (strcmp(domain, 734 IDMAP_WK_CREATOR_SID_AUTHORITY) == 0) 735 return (B_FALSE); 736 737 if ((strcmp(domain, 738 ksid_groups[i].ks_domain->kd_name) == 0) && 739 rid == ksid_groups[i].ks_rid) 740 return (B_TRUE); 741 } 742 } 743 } 744#endif /* illumos */ 745 746 /* 747 * Not found in ksidlist, check posix groups 748 */ 749 gid = zfs_fuid_map_id(zfsvfs, id, cr, ZFS_GROUP); 750 return (groupmember(gid, cr)); 751} 752 753void 754zfs_fuid_txhold(zfsvfs_t *zfsvfs, dmu_tx_t *tx) 755{ 756 if (zfsvfs->z_fuid_obj == 0) { 757 dmu_tx_hold_bonus(tx, DMU_NEW_OBJECT); 758 dmu_tx_hold_write(tx, DMU_NEW_OBJECT, 0, 759 FUID_SIZE_ESTIMATE(zfsvfs)); 760 dmu_tx_hold_zap(tx, MASTER_NODE_OBJ, FALSE, NULL); 761 } else { 762 dmu_tx_hold_bonus(tx, zfsvfs->z_fuid_obj); 763 dmu_tx_hold_write(tx, zfsvfs->z_fuid_obj, 0, 764 FUID_SIZE_ESTIMATE(zfsvfs)); 765 } 766} 767#endif 768