1/* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or https://opensource.org/licenses/CDDL-1.0. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21/* 22 * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved. 23 * Copyright (c) 2013 by Delphix. All rights reserved. 24 * Copyright 2017 Nexenta Systems, Inc. All rights reserved. 25 */ 26 27#include <sys/types.h> 28#include <sys/param.h> 29#include <sys/time.h> 30#include <sys/systm.h> 31#include <sys/sysmacros.h> 32#include <sys/resource.h> 33#include <sys/vfs.h> 34#include <sys/vnode.h> 35#include <sys/file.h> 36#include <sys/stat.h> 37#include <sys/kmem.h> 38#include <sys/cmn_err.h> 39#include <sys/errno.h> 40#include <sys/unistd.h> 41#include <sys/sdt.h> 42#include <sys/fs/zfs.h> 43#include <sys/policy.h> 44#include <sys/zfs_znode.h> 45#include <sys/zfs_fuid.h> 46#include <sys/zfs_acl.h> 47#include <sys/zfs_dir.h> 48#include <sys/zfs_quota.h> 49#include <sys/zfs_vfsops.h> 50#include <sys/dmu.h> 51#include <sys/dnode.h> 52#include <sys/zap.h> 53#include <sys/sa.h> 54#include <acl/acl_common.h> 55 56 57#define ALLOW ACE_ACCESS_ALLOWED_ACE_TYPE 58#define DENY ACE_ACCESS_DENIED_ACE_TYPE 59#define MAX_ACE_TYPE ACE_SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE 60#define MIN_ACE_TYPE ALLOW 61 62#define OWNING_GROUP (ACE_GROUP|ACE_IDENTIFIER_GROUP) 63#define EVERYONE_ALLOW_MASK (ACE_READ_ACL|ACE_READ_ATTRIBUTES | \ 64 ACE_READ_NAMED_ATTRS|ACE_SYNCHRONIZE) 65#define EVERYONE_DENY_MASK (ACE_WRITE_ACL|ACE_WRITE_OWNER | \ 66 ACE_WRITE_ATTRIBUTES|ACE_WRITE_NAMED_ATTRS) 67#define OWNER_ALLOW_MASK (ACE_WRITE_ACL | ACE_WRITE_OWNER | \ 68 ACE_WRITE_ATTRIBUTES|ACE_WRITE_NAMED_ATTRS) 69 70#define ZFS_CHECKED_MASKS (ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_READ_DATA| \ 71 ACE_READ_NAMED_ATTRS|ACE_WRITE_DATA|ACE_WRITE_ATTRIBUTES| \ 72 ACE_WRITE_NAMED_ATTRS|ACE_APPEND_DATA|ACE_EXECUTE|ACE_WRITE_OWNER| \ 73 ACE_WRITE_ACL|ACE_DELETE|ACE_DELETE_CHILD|ACE_SYNCHRONIZE) 74 75#define WRITE_MASK_DATA (ACE_WRITE_DATA|ACE_APPEND_DATA|ACE_WRITE_NAMED_ATTRS) 76#define WRITE_MASK_ATTRS (ACE_WRITE_ACL|ACE_WRITE_OWNER|ACE_WRITE_ATTRIBUTES| \ 77 ACE_DELETE|ACE_DELETE_CHILD) 78#define WRITE_MASK (WRITE_MASK_DATA|WRITE_MASK_ATTRS) 79 80#define OGE_CLEAR (ACE_READ_DATA|ACE_LIST_DIRECTORY|ACE_WRITE_DATA| \ 81 ACE_ADD_FILE|ACE_APPEND_DATA|ACE_ADD_SUBDIRECTORY|ACE_EXECUTE) 82 83#define OKAY_MASK_BITS (ACE_READ_DATA|ACE_LIST_DIRECTORY|ACE_WRITE_DATA| \ 84 ACE_ADD_FILE|ACE_APPEND_DATA|ACE_ADD_SUBDIRECTORY|ACE_EXECUTE) 85 86#define ALL_INHERIT (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE | \ 87 ACE_NO_PROPAGATE_INHERIT_ACE|ACE_INHERIT_ONLY_ACE|ACE_INHERITED_ACE) 88 89#define RESTRICTED_CLEAR (ACE_WRITE_ACL|ACE_WRITE_OWNER) 90 91#define V4_ACL_WIDE_FLAGS (ZFS_ACL_AUTO_INHERIT|ZFS_ACL_DEFAULTED|\ 92 ZFS_ACL_PROTECTED) 93 94#define ZFS_ACL_WIDE_FLAGS (V4_ACL_WIDE_FLAGS|ZFS_ACL_TRIVIAL|ZFS_INHERIT_ACE|\ 95 ZFS_ACL_OBJ_ACE) 96 97#define ALL_MODE_EXECS (S_IXUSR | S_IXGRP | S_IXOTH) 98 99static uint16_t 100zfs_ace_v0_get_type(void *acep) 101{ 102 return (((zfs_oldace_t *)acep)->z_type); 103} 104 105static uint16_t 106zfs_ace_v0_get_flags(void *acep) 107{ 108 return (((zfs_oldace_t *)acep)->z_flags); 109} 110 111static uint32_t 112zfs_ace_v0_get_mask(void *acep) 113{ 114 return (((zfs_oldace_t *)acep)->z_access_mask); 115} 116 117static uint64_t 118zfs_ace_v0_get_who(void *acep) 119{ 120 return (((zfs_oldace_t *)acep)->z_fuid); 121} 122 123static void 124zfs_ace_v0_set_type(void *acep, uint16_t type) 125{ 126 ((zfs_oldace_t *)acep)->z_type = type; 127} 128 129static void 130zfs_ace_v0_set_flags(void *acep, uint16_t flags) 131{ 132 ((zfs_oldace_t *)acep)->z_flags = flags; 133} 134 135static void 136zfs_ace_v0_set_mask(void *acep, uint32_t mask) 137{ 138 ((zfs_oldace_t *)acep)->z_access_mask = mask; 139} 140 141static void 142zfs_ace_v0_set_who(void *acep, uint64_t who) 143{ 144 ((zfs_oldace_t *)acep)->z_fuid = who; 145} 146 147static size_t 148zfs_ace_v0_size(void *acep) 149{ 150 (void) acep; 151 return (sizeof (zfs_oldace_t)); 152} 153 154static size_t 155zfs_ace_v0_abstract_size(void) 156{ 157 return (sizeof (zfs_oldace_t)); 158} 159 160static int 161zfs_ace_v0_mask_off(void) 162{ 163 return (offsetof(zfs_oldace_t, z_access_mask)); 164} 165 166static int 167zfs_ace_v0_data(void *acep, void **datap) 168{ 169 (void) acep; 170 *datap = NULL; 171 return (0); 172} 173 174static const acl_ops_t zfs_acl_v0_ops = { 175 zfs_ace_v0_get_mask, 176 zfs_ace_v0_set_mask, 177 zfs_ace_v0_get_flags, 178 zfs_ace_v0_set_flags, 179 zfs_ace_v0_get_type, 180 zfs_ace_v0_set_type, 181 zfs_ace_v0_get_who, 182 zfs_ace_v0_set_who, 183 zfs_ace_v0_size, 184 zfs_ace_v0_abstract_size, 185 zfs_ace_v0_mask_off, 186 zfs_ace_v0_data 187}; 188 189static uint16_t 190zfs_ace_fuid_get_type(void *acep) 191{ 192 return (((zfs_ace_hdr_t *)acep)->z_type); 193} 194 195static uint16_t 196zfs_ace_fuid_get_flags(void *acep) 197{ 198 return (((zfs_ace_hdr_t *)acep)->z_flags); 199} 200 201static uint32_t 202zfs_ace_fuid_get_mask(void *acep) 203{ 204 return (((zfs_ace_hdr_t *)acep)->z_access_mask); 205} 206 207static uint64_t 208zfs_ace_fuid_get_who(void *args) 209{ 210 uint16_t entry_type; 211 zfs_ace_t *acep = args; 212 213 entry_type = acep->z_hdr.z_flags & ACE_TYPE_FLAGS; 214 215 if (entry_type == ACE_OWNER || entry_type == OWNING_GROUP || 216 entry_type == ACE_EVERYONE) 217 return (-1); 218 return (((zfs_ace_t *)acep)->z_fuid); 219} 220 221static void 222zfs_ace_fuid_set_type(void *acep, uint16_t type) 223{ 224 ((zfs_ace_hdr_t *)acep)->z_type = type; 225} 226 227static void 228zfs_ace_fuid_set_flags(void *acep, uint16_t flags) 229{ 230 ((zfs_ace_hdr_t *)acep)->z_flags = flags; 231} 232 233static void 234zfs_ace_fuid_set_mask(void *acep, uint32_t mask) 235{ 236 ((zfs_ace_hdr_t *)acep)->z_access_mask = mask; 237} 238 239static void 240zfs_ace_fuid_set_who(void *arg, uint64_t who) 241{ 242 zfs_ace_t *acep = arg; 243 244 uint16_t entry_type = acep->z_hdr.z_flags & ACE_TYPE_FLAGS; 245 246 if (entry_type == ACE_OWNER || entry_type == OWNING_GROUP || 247 entry_type == ACE_EVERYONE) 248 return; 249 acep->z_fuid = who; 250} 251 252static size_t 253zfs_ace_fuid_size(void *acep) 254{ 255 zfs_ace_hdr_t *zacep = acep; 256 uint16_t entry_type; 257 258 switch (zacep->z_type) { 259 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 260 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 261 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 262 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 263 return (sizeof (zfs_object_ace_t)); 264 case ALLOW: 265 case DENY: 266 entry_type = 267 (((zfs_ace_hdr_t *)acep)->z_flags & ACE_TYPE_FLAGS); 268 if (entry_type == ACE_OWNER || 269 entry_type == OWNING_GROUP || 270 entry_type == ACE_EVERYONE) 271 return (sizeof (zfs_ace_hdr_t)); 272 zfs_fallthrough; 273 default: 274 return (sizeof (zfs_ace_t)); 275 } 276} 277 278static size_t 279zfs_ace_fuid_abstract_size(void) 280{ 281 return (sizeof (zfs_ace_hdr_t)); 282} 283 284static int 285zfs_ace_fuid_mask_off(void) 286{ 287 return (offsetof(zfs_ace_hdr_t, z_access_mask)); 288} 289 290static int 291zfs_ace_fuid_data(void *acep, void **datap) 292{ 293 zfs_ace_t *zacep = acep; 294 zfs_object_ace_t *zobjp; 295 296 switch (zacep->z_hdr.z_type) { 297 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 298 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 299 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 300 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 301 zobjp = acep; 302 *datap = (caddr_t)zobjp + sizeof (zfs_ace_t); 303 return (sizeof (zfs_object_ace_t) - sizeof (zfs_ace_t)); 304 default: 305 *datap = NULL; 306 return (0); 307 } 308} 309 310static const acl_ops_t zfs_acl_fuid_ops = { 311 zfs_ace_fuid_get_mask, 312 zfs_ace_fuid_set_mask, 313 zfs_ace_fuid_get_flags, 314 zfs_ace_fuid_set_flags, 315 zfs_ace_fuid_get_type, 316 zfs_ace_fuid_set_type, 317 zfs_ace_fuid_get_who, 318 zfs_ace_fuid_set_who, 319 zfs_ace_fuid_size, 320 zfs_ace_fuid_abstract_size, 321 zfs_ace_fuid_mask_off, 322 zfs_ace_fuid_data 323}; 324 325/* 326 * The following three functions are provided for compatibility with 327 * older ZPL version in order to determine if the file use to have 328 * an external ACL and what version of ACL previously existed on the 329 * file. Would really be nice to not need this, sigh. 330 */ 331uint64_t 332zfs_external_acl(znode_t *zp) 333{ 334 zfs_acl_phys_t acl_phys; 335 int error; 336 337 if (zp->z_is_sa) 338 return (0); 339 340 /* 341 * Need to deal with a potential 342 * race where zfs_sa_upgrade could cause 343 * z_isa_sa to change. 344 * 345 * If the lookup fails then the state of z_is_sa should have 346 * changed. 347 */ 348 349 if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_ZNODE_ACL(zp->z_zfsvfs), 350 &acl_phys, sizeof (acl_phys))) == 0) 351 return (acl_phys.z_acl_extern_obj); 352 else { 353 /* 354 * after upgrade the SA_ZPL_ZNODE_ACL should have been 355 * removed 356 */ 357 VERIFY(zp->z_is_sa); 358 VERIFY3S(error, ==, ENOENT); 359 return (0); 360 } 361} 362 363/* 364 * Determine size of ACL in bytes 365 * 366 * This is more complicated than it should be since we have to deal 367 * with old external ACLs. 368 */ 369static int 370zfs_acl_znode_info(znode_t *zp, int *aclsize, int *aclcount, 371 zfs_acl_phys_t *aclphys) 372{ 373 zfsvfs_t *zfsvfs = zp->z_zfsvfs; 374 uint64_t acl_count; 375 int size; 376 int error; 377 378 ASSERT(MUTEX_HELD(&zp->z_acl_lock)); 379 if (zp->z_is_sa) { 380 if ((error = sa_size(zp->z_sa_hdl, SA_ZPL_DACL_ACES(zfsvfs), 381 &size)) != 0) 382 return (error); 383 *aclsize = size; 384 if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_DACL_COUNT(zfsvfs), 385 &acl_count, sizeof (acl_count))) != 0) 386 return (error); 387 *aclcount = acl_count; 388 } else { 389 if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_ZNODE_ACL(zfsvfs), 390 aclphys, sizeof (*aclphys))) != 0) 391 return (error); 392 393 if (aclphys->z_acl_version == ZFS_ACL_VERSION_INITIAL) { 394 *aclsize = ZFS_ACL_SIZE(aclphys->z_acl_size); 395 *aclcount = aclphys->z_acl_size; 396 } else { 397 *aclsize = aclphys->z_acl_size; 398 *aclcount = aclphys->z_acl_count; 399 } 400 } 401 return (0); 402} 403 404int 405zfs_znode_acl_version(znode_t *zp) 406{ 407 zfs_acl_phys_t acl_phys; 408 409 if (zp->z_is_sa) 410 return (ZFS_ACL_VERSION_FUID); 411 else { 412 int error; 413 414 /* 415 * Need to deal with a potential 416 * race where zfs_sa_upgrade could cause 417 * z_isa_sa to change. 418 * 419 * If the lookup fails then the state of z_is_sa should have 420 * changed. 421 */ 422 if ((error = sa_lookup(zp->z_sa_hdl, 423 SA_ZPL_ZNODE_ACL(zp->z_zfsvfs), 424 &acl_phys, sizeof (acl_phys))) == 0) 425 return (acl_phys.z_acl_version); 426 else { 427 /* 428 * After upgrade SA_ZPL_ZNODE_ACL should have 429 * been removed. 430 */ 431 VERIFY(zp->z_is_sa); 432 VERIFY3S(error, ==, ENOENT); 433 return (ZFS_ACL_VERSION_FUID); 434 } 435 } 436} 437 438static int 439zfs_acl_version(int version) 440{ 441 if (version < ZPL_VERSION_FUID) 442 return (ZFS_ACL_VERSION_INITIAL); 443 else 444 return (ZFS_ACL_VERSION_FUID); 445} 446 447static int 448zfs_acl_version_zp(znode_t *zp) 449{ 450 return (zfs_acl_version(zp->z_zfsvfs->z_version)); 451} 452 453zfs_acl_t * 454zfs_acl_alloc(int vers) 455{ 456 zfs_acl_t *aclp; 457 458 aclp = kmem_zalloc(sizeof (zfs_acl_t), KM_SLEEP); 459 list_create(&aclp->z_acl, sizeof (zfs_acl_node_t), 460 offsetof(zfs_acl_node_t, z_next)); 461 aclp->z_version = vers; 462 if (vers == ZFS_ACL_VERSION_FUID) 463 aclp->z_ops = &zfs_acl_fuid_ops; 464 else 465 aclp->z_ops = &zfs_acl_v0_ops; 466 return (aclp); 467} 468 469zfs_acl_node_t * 470zfs_acl_node_alloc(size_t bytes) 471{ 472 zfs_acl_node_t *aclnode; 473 474 aclnode = kmem_zalloc(sizeof (zfs_acl_node_t), KM_SLEEP); 475 if (bytes) { 476 aclnode->z_acldata = kmem_alloc(bytes, KM_SLEEP); 477 aclnode->z_allocdata = aclnode->z_acldata; 478 aclnode->z_allocsize = bytes; 479 aclnode->z_size = bytes; 480 } 481 482 return (aclnode); 483} 484 485static void 486zfs_acl_node_free(zfs_acl_node_t *aclnode) 487{ 488 if (aclnode->z_allocsize) 489 kmem_free(aclnode->z_allocdata, aclnode->z_allocsize); 490 kmem_free(aclnode, sizeof (zfs_acl_node_t)); 491} 492 493static void 494zfs_acl_release_nodes(zfs_acl_t *aclp) 495{ 496 zfs_acl_node_t *aclnode; 497 498 while ((aclnode = list_remove_head(&aclp->z_acl))) 499 zfs_acl_node_free(aclnode); 500 aclp->z_acl_count = 0; 501 aclp->z_acl_bytes = 0; 502} 503 504void 505zfs_acl_free(zfs_acl_t *aclp) 506{ 507 zfs_acl_release_nodes(aclp); 508 list_destroy(&aclp->z_acl); 509 kmem_free(aclp, sizeof (zfs_acl_t)); 510} 511 512static boolean_t 513zfs_acl_valid_ace_type(uint_t type, uint_t flags) 514{ 515 uint16_t entry_type; 516 517 switch (type) { 518 case ALLOW: 519 case DENY: 520 case ACE_SYSTEM_AUDIT_ACE_TYPE: 521 case ACE_SYSTEM_ALARM_ACE_TYPE: 522 entry_type = flags & ACE_TYPE_FLAGS; 523 return (entry_type == ACE_OWNER || 524 entry_type == OWNING_GROUP || 525 entry_type == ACE_EVERYONE || entry_type == 0 || 526 entry_type == ACE_IDENTIFIER_GROUP); 527 default: 528 if (type <= MAX_ACE_TYPE) 529 return (B_TRUE); 530 } 531 return (B_FALSE); 532} 533 534static boolean_t 535zfs_ace_valid(vtype_t obj_type, zfs_acl_t *aclp, uint16_t type, uint16_t iflags) 536{ 537 /* 538 * first check type of entry 539 */ 540 541 if (!zfs_acl_valid_ace_type(type, iflags)) 542 return (B_FALSE); 543 544 switch (type) { 545 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 546 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 547 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 548 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 549 if (aclp->z_version < ZFS_ACL_VERSION_FUID) 550 return (B_FALSE); 551 aclp->z_hints |= ZFS_ACL_OBJ_ACE; 552 } 553 554 /* 555 * next check inheritance level flags 556 */ 557 558 if (obj_type == VDIR && 559 (iflags & (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE))) 560 aclp->z_hints |= ZFS_INHERIT_ACE; 561 562 if (iflags & (ACE_INHERIT_ONLY_ACE|ACE_NO_PROPAGATE_INHERIT_ACE)) { 563 if ((iflags & (ACE_FILE_INHERIT_ACE| 564 ACE_DIRECTORY_INHERIT_ACE)) == 0) { 565 return (B_FALSE); 566 } 567 } 568 569 return (B_TRUE); 570} 571 572static void * 573zfs_acl_next_ace(zfs_acl_t *aclp, void *start, uint64_t *who, 574 uint32_t *access_mask, uint16_t *iflags, uint16_t *type) 575{ 576 zfs_acl_node_t *aclnode; 577 578 ASSERT3P(aclp, !=, NULL); 579 580 if (start == NULL) { 581 aclnode = list_head(&aclp->z_acl); 582 if (aclnode == NULL) 583 return (NULL); 584 585 aclp->z_next_ace = aclnode->z_acldata; 586 aclp->z_curr_node = aclnode; 587 aclnode->z_ace_idx = 0; 588 } 589 590 aclnode = aclp->z_curr_node; 591 592 if (aclnode == NULL) 593 return (NULL); 594 595 if (aclnode->z_ace_idx >= aclnode->z_ace_count) { 596 aclnode = list_next(&aclp->z_acl, aclnode); 597 if (aclnode == NULL) 598 return (NULL); 599 else { 600 aclp->z_curr_node = aclnode; 601 aclnode->z_ace_idx = 0; 602 aclp->z_next_ace = aclnode->z_acldata; 603 } 604 } 605 606 if (aclnode->z_ace_idx < aclnode->z_ace_count) { 607 void *acep = aclp->z_next_ace; 608 size_t ace_size; 609 610 /* 611 * Make sure we don't overstep our bounds 612 */ 613 ace_size = aclp->z_ops->ace_size(acep); 614 615 if (((caddr_t)acep + ace_size) > 616 ((caddr_t)aclnode->z_acldata + aclnode->z_size)) { 617 return (NULL); 618 } 619 620 *iflags = aclp->z_ops->ace_flags_get(acep); 621 *type = aclp->z_ops->ace_type_get(acep); 622 *access_mask = aclp->z_ops->ace_mask_get(acep); 623 *who = aclp->z_ops->ace_who_get(acep); 624 aclp->z_next_ace = (caddr_t)aclp->z_next_ace + ace_size; 625 aclnode->z_ace_idx++; 626 627 return ((void *)acep); 628 } 629 return (NULL); 630} 631 632static uintptr_t 633zfs_ace_walk(void *datap, uintptr_t cookie, int aclcnt, 634 uint16_t *flags, uint16_t *type, uint32_t *mask) 635{ 636 (void) aclcnt; 637 zfs_acl_t *aclp = datap; 638 zfs_ace_hdr_t *acep = (zfs_ace_hdr_t *)(uintptr_t)cookie; 639 uint64_t who; 640 641 acep = zfs_acl_next_ace(aclp, acep, &who, mask, 642 flags, type); 643 return ((uintptr_t)acep); 644} 645 646/* 647 * Copy ACE to internal ZFS format. 648 * While processing the ACL each ACE will be validated for correctness. 649 * ACE FUIDs will be created later. 650 */ 651static int 652zfs_copy_ace_2_fuid(zfsvfs_t *zfsvfs, vtype_t obj_type, zfs_acl_t *aclp, 653 void *datap, zfs_ace_t *z_acl, uint64_t aclcnt, size_t *size, 654 zfs_fuid_info_t **fuidp, cred_t *cr) 655{ 656 int i; 657 uint16_t entry_type; 658 zfs_ace_t *aceptr = z_acl; 659 ace_t *acep = datap; 660 zfs_object_ace_t *zobjacep; 661 ace_object_t *aceobjp; 662 663 for (i = 0; i != aclcnt; i++) { 664 aceptr->z_hdr.z_access_mask = acep->a_access_mask; 665 aceptr->z_hdr.z_flags = acep->a_flags; 666 aceptr->z_hdr.z_type = acep->a_type; 667 entry_type = aceptr->z_hdr.z_flags & ACE_TYPE_FLAGS; 668 if (entry_type != ACE_OWNER && entry_type != OWNING_GROUP && 669 entry_type != ACE_EVERYONE) { 670 aceptr->z_fuid = zfs_fuid_create(zfsvfs, acep->a_who, 671 cr, (entry_type == 0) ? 672 ZFS_ACE_USER : ZFS_ACE_GROUP, fuidp); 673 } 674 675 /* 676 * Make sure ACE is valid 677 */ 678 if (zfs_ace_valid(obj_type, aclp, aceptr->z_hdr.z_type, 679 aceptr->z_hdr.z_flags) != B_TRUE) 680 return (SET_ERROR(EINVAL)); 681 682 switch (acep->a_type) { 683 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 684 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 685 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 686 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 687 zobjacep = (zfs_object_ace_t *)aceptr; 688 aceobjp = (ace_object_t *)acep; 689 690 memcpy(zobjacep->z_object_type, aceobjp->a_obj_type, 691 sizeof (aceobjp->a_obj_type)); 692 memcpy(zobjacep->z_inherit_type, 693 aceobjp->a_inherit_obj_type, 694 sizeof (aceobjp->a_inherit_obj_type)); 695 acep = (ace_t *)((caddr_t)acep + sizeof (ace_object_t)); 696 break; 697 default: 698 acep = (ace_t *)((caddr_t)acep + sizeof (ace_t)); 699 } 700 701 aceptr = (zfs_ace_t *)((caddr_t)aceptr + 702 aclp->z_ops->ace_size(aceptr)); 703 } 704 705 *size = (caddr_t)aceptr - (caddr_t)z_acl; 706 707 return (0); 708} 709 710/* 711 * Copy ZFS ACEs to fixed size ace_t layout 712 */ 713static void 714zfs_copy_fuid_2_ace(zfsvfs_t *zfsvfs, zfs_acl_t *aclp, cred_t *cr, 715 void *datap, int filter) 716{ 717 uint64_t who; 718 uint32_t access_mask; 719 uint16_t iflags, type; 720 zfs_ace_hdr_t *zacep = NULL; 721 ace_t *acep = datap; 722 ace_object_t *objacep; 723 zfs_object_ace_t *zobjacep; 724 size_t ace_size; 725 uint16_t entry_type; 726 727 while ((zacep = zfs_acl_next_ace(aclp, zacep, 728 &who, &access_mask, &iflags, &type))) { 729 730 switch (type) { 731 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 732 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 733 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 734 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 735 if (filter) { 736 continue; 737 } 738 zobjacep = (zfs_object_ace_t *)zacep; 739 objacep = (ace_object_t *)acep; 740 memcpy(objacep->a_obj_type, 741 zobjacep->z_object_type, 742 sizeof (zobjacep->z_object_type)); 743 memcpy(objacep->a_inherit_obj_type, 744 zobjacep->z_inherit_type, 745 sizeof (zobjacep->z_inherit_type)); 746 ace_size = sizeof (ace_object_t); 747 break; 748 default: 749 ace_size = sizeof (ace_t); 750 break; 751 } 752 753 entry_type = (iflags & ACE_TYPE_FLAGS); 754 if ((entry_type != ACE_OWNER && 755 entry_type != OWNING_GROUP && 756 entry_type != ACE_EVERYONE)) { 757 acep->a_who = zfs_fuid_map_id(zfsvfs, who, 758 cr, (entry_type & ACE_IDENTIFIER_GROUP) ? 759 ZFS_ACE_GROUP : ZFS_ACE_USER); 760 } else { 761 acep->a_who = (uid_t)(int64_t)who; 762 } 763 acep->a_access_mask = access_mask; 764 acep->a_flags = iflags; 765 acep->a_type = type; 766 acep = (ace_t *)((caddr_t)acep + ace_size); 767 } 768} 769 770static int 771zfs_copy_ace_2_oldace(vtype_t obj_type, zfs_acl_t *aclp, ace_t *acep, 772 zfs_oldace_t *z_acl, int aclcnt, size_t *size) 773{ 774 int i; 775 zfs_oldace_t *aceptr = z_acl; 776 777 for (i = 0; i != aclcnt; i++, aceptr++) { 778 aceptr->z_access_mask = acep[i].a_access_mask; 779 aceptr->z_type = acep[i].a_type; 780 aceptr->z_flags = acep[i].a_flags; 781 aceptr->z_fuid = acep[i].a_who; 782 /* 783 * Make sure ACE is valid 784 */ 785 if (zfs_ace_valid(obj_type, aclp, aceptr->z_type, 786 aceptr->z_flags) != B_TRUE) 787 return (SET_ERROR(EINVAL)); 788 } 789 *size = (caddr_t)aceptr - (caddr_t)z_acl; 790 return (0); 791} 792 793/* 794 * convert old ACL format to new 795 */ 796void 797zfs_acl_xform(znode_t *zp, zfs_acl_t *aclp, cred_t *cr) 798{ 799 zfs_oldace_t *oldaclp; 800 int i; 801 uint16_t type, iflags; 802 uint32_t access_mask; 803 uint64_t who; 804 void *cookie = NULL; 805 zfs_acl_node_t *newaclnode; 806 807 ASSERT3U(aclp->z_version, ==, ZFS_ACL_VERSION_INITIAL); 808 /* 809 * First create the ACE in a contiguous piece of memory 810 * for zfs_copy_ace_2_fuid(). 811 * 812 * We only convert an ACL once, so this won't happen 813 * everytime. 814 */ 815 oldaclp = kmem_alloc(sizeof (zfs_oldace_t) * aclp->z_acl_count, 816 KM_SLEEP); 817 i = 0; 818 while ((cookie = zfs_acl_next_ace(aclp, cookie, &who, 819 &access_mask, &iflags, &type))) { 820 oldaclp[i].z_flags = iflags; 821 oldaclp[i].z_type = type; 822 oldaclp[i].z_fuid = who; 823 oldaclp[i++].z_access_mask = access_mask; 824 } 825 826 newaclnode = zfs_acl_node_alloc(aclp->z_acl_count * 827 sizeof (zfs_object_ace_t)); 828 aclp->z_ops = &zfs_acl_fuid_ops; 829 VERIFY0(zfs_copy_ace_2_fuid(zp->z_zfsvfs, ZTOV(zp)->v_type, aclp, 830 oldaclp, newaclnode->z_acldata, aclp->z_acl_count, 831 &newaclnode->z_size, NULL, cr)); 832 newaclnode->z_ace_count = aclp->z_acl_count; 833 aclp->z_version = ZFS_ACL_VERSION; 834 kmem_free(oldaclp, aclp->z_acl_count * sizeof (zfs_oldace_t)); 835 836 /* 837 * Release all previous ACL nodes 838 */ 839 840 zfs_acl_release_nodes(aclp); 841 842 list_insert_head(&aclp->z_acl, newaclnode); 843 844 aclp->z_acl_bytes = newaclnode->z_size; 845 aclp->z_acl_count = newaclnode->z_ace_count; 846 847} 848 849/* 850 * Convert unix access mask to v4 access mask 851 */ 852static uint32_t 853zfs_unix_to_v4(uint32_t access_mask) 854{ 855 uint32_t new_mask = 0; 856 857 if (access_mask & S_IXOTH) 858 new_mask |= ACE_EXECUTE; 859 if (access_mask & S_IWOTH) 860 new_mask |= ACE_WRITE_DATA; 861 if (access_mask & S_IROTH) 862 new_mask |= ACE_READ_DATA; 863 return (new_mask); 864} 865 866static void 867zfs_set_ace(zfs_acl_t *aclp, void *acep, uint32_t access_mask, 868 uint16_t access_type, uint64_t fuid, uint16_t entry_type) 869{ 870 uint16_t type = entry_type & ACE_TYPE_FLAGS; 871 872 aclp->z_ops->ace_mask_set(acep, access_mask); 873 aclp->z_ops->ace_type_set(acep, access_type); 874 aclp->z_ops->ace_flags_set(acep, entry_type); 875 if ((type != ACE_OWNER && type != OWNING_GROUP && 876 type != ACE_EVERYONE)) 877 aclp->z_ops->ace_who_set(acep, fuid); 878} 879 880/* 881 * Determine mode of file based on ACL. 882 */ 883uint64_t 884zfs_mode_compute(uint64_t fmode, zfs_acl_t *aclp, 885 uint64_t *pflags, uint64_t fuid, uint64_t fgid) 886{ 887 int entry_type; 888 mode_t mode; 889 mode_t seen = 0; 890 zfs_ace_hdr_t *acep = NULL; 891 uint64_t who; 892 uint16_t iflags, type; 893 uint32_t access_mask; 894 boolean_t an_exec_denied = B_FALSE; 895 896 mode = (fmode & (S_IFMT | S_ISUID | S_ISGID | S_ISVTX)); 897 898 while ((acep = zfs_acl_next_ace(aclp, acep, &who, 899 &access_mask, &iflags, &type))) { 900 901 if (!zfs_acl_valid_ace_type(type, iflags)) 902 continue; 903 904 entry_type = (iflags & ACE_TYPE_FLAGS); 905 906 /* 907 * Skip over any inherit_only ACEs 908 */ 909 if (iflags & ACE_INHERIT_ONLY_ACE) 910 continue; 911 912 if (entry_type == ACE_OWNER || (entry_type == 0 && 913 who == fuid)) { 914 if ((access_mask & ACE_READ_DATA) && 915 (!(seen & S_IRUSR))) { 916 seen |= S_IRUSR; 917 if (type == ALLOW) { 918 mode |= S_IRUSR; 919 } 920 } 921 if ((access_mask & ACE_WRITE_DATA) && 922 (!(seen & S_IWUSR))) { 923 seen |= S_IWUSR; 924 if (type == ALLOW) { 925 mode |= S_IWUSR; 926 } 927 } 928 if ((access_mask & ACE_EXECUTE) && 929 (!(seen & S_IXUSR))) { 930 seen |= S_IXUSR; 931 if (type == ALLOW) { 932 mode |= S_IXUSR; 933 } 934 } 935 } else if (entry_type == OWNING_GROUP || 936 (entry_type == ACE_IDENTIFIER_GROUP && who == fgid)) { 937 if ((access_mask & ACE_READ_DATA) && 938 (!(seen & S_IRGRP))) { 939 seen |= S_IRGRP; 940 if (type == ALLOW) { 941 mode |= S_IRGRP; 942 } 943 } 944 if ((access_mask & ACE_WRITE_DATA) && 945 (!(seen & S_IWGRP))) { 946 seen |= S_IWGRP; 947 if (type == ALLOW) { 948 mode |= S_IWGRP; 949 } 950 } 951 if ((access_mask & ACE_EXECUTE) && 952 (!(seen & S_IXGRP))) { 953 seen |= S_IXGRP; 954 if (type == ALLOW) { 955 mode |= S_IXGRP; 956 } 957 } 958 } else if (entry_type == ACE_EVERYONE) { 959 if ((access_mask & ACE_READ_DATA)) { 960 if (!(seen & S_IRUSR)) { 961 seen |= S_IRUSR; 962 if (type == ALLOW) { 963 mode |= S_IRUSR; 964 } 965 } 966 if (!(seen & S_IRGRP)) { 967 seen |= S_IRGRP; 968 if (type == ALLOW) { 969 mode |= S_IRGRP; 970 } 971 } 972 if (!(seen & S_IROTH)) { 973 seen |= S_IROTH; 974 if (type == ALLOW) { 975 mode |= S_IROTH; 976 } 977 } 978 } 979 if ((access_mask & ACE_WRITE_DATA)) { 980 if (!(seen & S_IWUSR)) { 981 seen |= S_IWUSR; 982 if (type == ALLOW) { 983 mode |= S_IWUSR; 984 } 985 } 986 if (!(seen & S_IWGRP)) { 987 seen |= S_IWGRP; 988 if (type == ALLOW) { 989 mode |= S_IWGRP; 990 } 991 } 992 if (!(seen & S_IWOTH)) { 993 seen |= S_IWOTH; 994 if (type == ALLOW) { 995 mode |= S_IWOTH; 996 } 997 } 998 } 999 if ((access_mask & ACE_EXECUTE)) { 1000 if (!(seen & S_IXUSR)) { 1001 seen |= S_IXUSR; 1002 if (type == ALLOW) { 1003 mode |= S_IXUSR; 1004 } 1005 } 1006 if (!(seen & S_IXGRP)) { 1007 seen |= S_IXGRP; 1008 if (type == ALLOW) { 1009 mode |= S_IXGRP; 1010 } 1011 } 1012 if (!(seen & S_IXOTH)) { 1013 seen |= S_IXOTH; 1014 if (type == ALLOW) { 1015 mode |= S_IXOTH; 1016 } 1017 } 1018 } 1019 } else { 1020 /* 1021 * Only care if this IDENTIFIER_GROUP or 1022 * USER ACE denies execute access to someone, 1023 * mode is not affected 1024 */ 1025 if ((access_mask & ACE_EXECUTE) && type == DENY) 1026 an_exec_denied = B_TRUE; 1027 } 1028 } 1029 1030 /* 1031 * Failure to allow is effectively a deny, so execute permission 1032 * is denied if it was never mentioned or if we explicitly 1033 * weren't allowed it. 1034 */ 1035 if (!an_exec_denied && 1036 ((seen & ALL_MODE_EXECS) != ALL_MODE_EXECS || 1037 (mode & ALL_MODE_EXECS) != ALL_MODE_EXECS)) 1038 an_exec_denied = B_TRUE; 1039 1040 if (an_exec_denied) 1041 *pflags &= ~ZFS_NO_EXECS_DENIED; 1042 else 1043 *pflags |= ZFS_NO_EXECS_DENIED; 1044 1045 return (mode); 1046} 1047 1048/* 1049 * Read an external acl object. If the intent is to modify, always 1050 * create a new acl and leave any cached acl in place. 1051 */ 1052int 1053zfs_acl_node_read(znode_t *zp, boolean_t have_lock, zfs_acl_t **aclpp, 1054 boolean_t will_modify) 1055{ 1056 zfs_acl_t *aclp; 1057 int aclsize; 1058 int acl_count; 1059 zfs_acl_node_t *aclnode; 1060 zfs_acl_phys_t znode_acl; 1061 int version; 1062 int error; 1063 1064 ASSERT(MUTEX_HELD(&zp->z_acl_lock)); 1065 if (zp->z_zfsvfs->z_replay == B_FALSE) 1066 ASSERT_VOP_LOCKED(ZTOV(zp), __func__); 1067 1068 if (zp->z_acl_cached && !will_modify) { 1069 *aclpp = zp->z_acl_cached; 1070 return (0); 1071 } 1072 1073 version = zfs_znode_acl_version(zp); 1074 1075 if ((error = zfs_acl_znode_info(zp, &aclsize, 1076 &acl_count, &znode_acl)) != 0) { 1077 goto done; 1078 } 1079 1080 aclp = zfs_acl_alloc(version); 1081 1082 aclp->z_acl_count = acl_count; 1083 aclp->z_acl_bytes = aclsize; 1084 1085 aclnode = zfs_acl_node_alloc(aclsize); 1086 aclnode->z_ace_count = aclp->z_acl_count; 1087 aclnode->z_size = aclsize; 1088 1089 if (!zp->z_is_sa) { 1090 if (znode_acl.z_acl_extern_obj) { 1091 error = dmu_read(zp->z_zfsvfs->z_os, 1092 znode_acl.z_acl_extern_obj, 0, aclnode->z_size, 1093 aclnode->z_acldata, DMU_READ_PREFETCH); 1094 } else { 1095 memcpy(aclnode->z_acldata, znode_acl.z_ace_data, 1096 aclnode->z_size); 1097 } 1098 } else { 1099 error = sa_lookup(zp->z_sa_hdl, SA_ZPL_DACL_ACES(zp->z_zfsvfs), 1100 aclnode->z_acldata, aclnode->z_size); 1101 } 1102 1103 if (error != 0) { 1104 zfs_acl_free(aclp); 1105 zfs_acl_node_free(aclnode); 1106 /* convert checksum errors into IO errors */ 1107 if (error == ECKSUM) 1108 error = SET_ERROR(EIO); 1109 goto done; 1110 } 1111 1112 list_insert_head(&aclp->z_acl, aclnode); 1113 1114 *aclpp = aclp; 1115 if (!will_modify) 1116 zp->z_acl_cached = aclp; 1117done: 1118 return (error); 1119} 1120 1121void 1122zfs_acl_data_locator(void **dataptr, uint32_t *length, uint32_t buflen, 1123 boolean_t start, void *userdata) 1124{ 1125 (void) buflen; 1126 zfs_acl_locator_cb_t *cb = (zfs_acl_locator_cb_t *)userdata; 1127 1128 if (start) { 1129 cb->cb_acl_node = list_head(&cb->cb_aclp->z_acl); 1130 } else { 1131 cb->cb_acl_node = list_next(&cb->cb_aclp->z_acl, 1132 cb->cb_acl_node); 1133 } 1134 ASSERT3P(cb->cb_acl_node, !=, NULL); 1135 *dataptr = cb->cb_acl_node->z_acldata; 1136 *length = cb->cb_acl_node->z_size; 1137} 1138 1139int 1140zfs_acl_chown_setattr(znode_t *zp) 1141{ 1142 int error; 1143 zfs_acl_t *aclp; 1144 1145 if (zp->z_zfsvfs->z_replay == B_FALSE) { 1146 ASSERT_VOP_ELOCKED(ZTOV(zp), __func__); 1147 ASSERT_VOP_IN_SEQC(ZTOV(zp)); 1148 } 1149 ASSERT(MUTEX_HELD(&zp->z_acl_lock)); 1150 1151 if ((error = zfs_acl_node_read(zp, B_TRUE, &aclp, B_FALSE)) == 0) 1152 zp->z_mode = zfs_mode_compute(zp->z_mode, aclp, 1153 &zp->z_pflags, zp->z_uid, zp->z_gid); 1154 return (error); 1155} 1156 1157/* 1158 * common code for setting ACLs. 1159 * 1160 * This function is called from zfs_mode_update, zfs_perm_init, and zfs_setacl. 1161 * zfs_setacl passes a non-NULL inherit pointer (ihp) to indicate that it's 1162 * already checked the acl and knows whether to inherit. 1163 */ 1164int 1165zfs_aclset_common(znode_t *zp, zfs_acl_t *aclp, cred_t *cr, dmu_tx_t *tx) 1166{ 1167 int error; 1168 zfsvfs_t *zfsvfs = zp->z_zfsvfs; 1169 dmu_object_type_t otype; 1170 zfs_acl_locator_cb_t locate = { 0 }; 1171 uint64_t mode; 1172 sa_bulk_attr_t bulk[5]; 1173 uint64_t ctime[2]; 1174 int count = 0; 1175 zfs_acl_phys_t acl_phys; 1176 1177 if (zp->z_zfsvfs->z_replay == B_FALSE) { 1178 ASSERT_VOP_IN_SEQC(ZTOV(zp)); 1179 } 1180 1181 mode = zp->z_mode; 1182 1183 mode = zfs_mode_compute(mode, aclp, &zp->z_pflags, 1184 zp->z_uid, zp->z_gid); 1185 1186 zp->z_mode = mode; 1187 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_MODE(zfsvfs), NULL, 1188 &mode, sizeof (mode)); 1189 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_FLAGS(zfsvfs), NULL, 1190 &zp->z_pflags, sizeof (zp->z_pflags)); 1191 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_CTIME(zfsvfs), NULL, 1192 &ctime, sizeof (ctime)); 1193 1194 if (zp->z_acl_cached) { 1195 zfs_acl_free(zp->z_acl_cached); 1196 zp->z_acl_cached = NULL; 1197 } 1198 1199 /* 1200 * Upgrade needed? 1201 */ 1202 if (!zfsvfs->z_use_fuids) { 1203 otype = DMU_OT_OLDACL; 1204 } else { 1205 if ((aclp->z_version == ZFS_ACL_VERSION_INITIAL) && 1206 (zfsvfs->z_version >= ZPL_VERSION_FUID)) 1207 zfs_acl_xform(zp, aclp, cr); 1208 ASSERT3U(aclp->z_version, >=, ZFS_ACL_VERSION_FUID); 1209 otype = DMU_OT_ACL; 1210 } 1211 1212 /* 1213 * Arrgh, we have to handle old on disk format 1214 * as well as newer (preferred) SA format. 1215 */ 1216 1217 if (zp->z_is_sa) { /* the easy case, just update the ACL attribute */ 1218 locate.cb_aclp = aclp; 1219 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_DACL_ACES(zfsvfs), 1220 zfs_acl_data_locator, &locate, aclp->z_acl_bytes); 1221 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_DACL_COUNT(zfsvfs), 1222 NULL, &aclp->z_acl_count, sizeof (uint64_t)); 1223 } else { /* Painful legacy way */ 1224 zfs_acl_node_t *aclnode; 1225 uint64_t off = 0; 1226 uint64_t aoid; 1227 1228 if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_ZNODE_ACL(zfsvfs), 1229 &acl_phys, sizeof (acl_phys))) != 0) 1230 return (error); 1231 1232 aoid = acl_phys.z_acl_extern_obj; 1233 1234 if (aclp->z_acl_bytes > ZFS_ACE_SPACE) { 1235 /* 1236 * If ACL was previously external and we are now 1237 * converting to new ACL format then release old 1238 * ACL object and create a new one. 1239 */ 1240 if (aoid && 1241 aclp->z_version != acl_phys.z_acl_version) { 1242 error = dmu_object_free(zfsvfs->z_os, aoid, tx); 1243 if (error) 1244 return (error); 1245 aoid = 0; 1246 } 1247 if (aoid == 0) { 1248 aoid = dmu_object_alloc(zfsvfs->z_os, 1249 otype, aclp->z_acl_bytes, 1250 otype == DMU_OT_ACL ? 1251 DMU_OT_SYSACL : DMU_OT_NONE, 1252 otype == DMU_OT_ACL ? 1253 DN_OLD_MAX_BONUSLEN : 0, tx); 1254 } else { 1255 (void) dmu_object_set_blocksize(zfsvfs->z_os, 1256 aoid, aclp->z_acl_bytes, 0, tx); 1257 } 1258 acl_phys.z_acl_extern_obj = aoid; 1259 for (aclnode = list_head(&aclp->z_acl); aclnode; 1260 aclnode = list_next(&aclp->z_acl, aclnode)) { 1261 if (aclnode->z_ace_count == 0) 1262 continue; 1263 dmu_write(zfsvfs->z_os, aoid, off, 1264 aclnode->z_size, aclnode->z_acldata, tx); 1265 off += aclnode->z_size; 1266 } 1267 } else { 1268 void *start = acl_phys.z_ace_data; 1269 /* 1270 * Migrating back embedded? 1271 */ 1272 if (acl_phys.z_acl_extern_obj) { 1273 error = dmu_object_free(zfsvfs->z_os, 1274 acl_phys.z_acl_extern_obj, tx); 1275 if (error) 1276 return (error); 1277 acl_phys.z_acl_extern_obj = 0; 1278 } 1279 1280 for (aclnode = list_head(&aclp->z_acl); aclnode; 1281 aclnode = list_next(&aclp->z_acl, aclnode)) { 1282 if (aclnode->z_ace_count == 0) 1283 continue; 1284 memcpy(start, aclnode->z_acldata, 1285 aclnode->z_size); 1286 start = (caddr_t)start + aclnode->z_size; 1287 } 1288 } 1289 /* 1290 * If Old version then swap count/bytes to match old 1291 * layout of znode_acl_phys_t. 1292 */ 1293 if (aclp->z_version == ZFS_ACL_VERSION_INITIAL) { 1294 acl_phys.z_acl_size = aclp->z_acl_count; 1295 acl_phys.z_acl_count = aclp->z_acl_bytes; 1296 } else { 1297 acl_phys.z_acl_size = aclp->z_acl_bytes; 1298 acl_phys.z_acl_count = aclp->z_acl_count; 1299 } 1300 acl_phys.z_acl_version = aclp->z_version; 1301 1302 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_ZNODE_ACL(zfsvfs), NULL, 1303 &acl_phys, sizeof (acl_phys)); 1304 } 1305 1306 /* 1307 * Replace ACL wide bits, but first clear them. 1308 */ 1309 zp->z_pflags &= ~ZFS_ACL_WIDE_FLAGS; 1310 1311 zp->z_pflags |= aclp->z_hints; 1312 1313 if (ace_trivial_common(aclp, 0, zfs_ace_walk) == 0) 1314 zp->z_pflags |= ZFS_ACL_TRIVIAL; 1315 1316 zfs_tstamp_update_setup(zp, STATE_CHANGED, NULL, ctime); 1317 return (sa_bulk_update(zp->z_sa_hdl, bulk, count, tx)); 1318} 1319 1320static void 1321zfs_acl_chmod(vtype_t vtype, uint64_t mode, boolean_t split, boolean_t trim, 1322 zfs_acl_t *aclp) 1323{ 1324 void *acep = NULL; 1325 uint64_t who; 1326 int new_count, new_bytes; 1327 int ace_size; 1328 int entry_type; 1329 uint16_t iflags, type; 1330 uint32_t access_mask; 1331 zfs_acl_node_t *newnode; 1332 size_t abstract_size = aclp->z_ops->ace_abstract_size(); 1333 void *zacep; 1334 boolean_t isdir; 1335 trivial_acl_t masks; 1336 1337 new_count = new_bytes = 0; 1338 1339 isdir = (vtype == VDIR); 1340 1341 acl_trivial_access_masks((mode_t)mode, isdir, &masks); 1342 1343 newnode = zfs_acl_node_alloc((abstract_size * 6) + aclp->z_acl_bytes); 1344 1345 zacep = newnode->z_acldata; 1346 if (masks.allow0) { 1347 zfs_set_ace(aclp, zacep, masks.allow0, ALLOW, -1, ACE_OWNER); 1348 zacep = (void *)((uintptr_t)zacep + abstract_size); 1349 new_count++; 1350 new_bytes += abstract_size; 1351 } 1352 if (masks.deny1) { 1353 zfs_set_ace(aclp, zacep, masks.deny1, DENY, -1, ACE_OWNER); 1354 zacep = (void *)((uintptr_t)zacep + abstract_size); 1355 new_count++; 1356 new_bytes += abstract_size; 1357 } 1358 if (masks.deny2) { 1359 zfs_set_ace(aclp, zacep, masks.deny2, DENY, -1, OWNING_GROUP); 1360 zacep = (void *)((uintptr_t)zacep + abstract_size); 1361 new_count++; 1362 new_bytes += abstract_size; 1363 } 1364 1365 while ((acep = zfs_acl_next_ace(aclp, acep, &who, &access_mask, 1366 &iflags, &type))) { 1367 entry_type = (iflags & ACE_TYPE_FLAGS); 1368 /* 1369 * ACEs used to represent the file mode may be divided 1370 * into an equivalent pair of inherit-only and regular 1371 * ACEs, if they are inheritable. 1372 * Skip regular ACEs, which are replaced by the new mode. 1373 */ 1374 if (split && (entry_type == ACE_OWNER || 1375 entry_type == OWNING_GROUP || 1376 entry_type == ACE_EVERYONE)) { 1377 if (!isdir || !(iflags & 1378 (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE))) 1379 continue; 1380 /* 1381 * We preserve owner@, group@, or @everyone 1382 * permissions, if they are inheritable, by 1383 * copying them to inherit_only ACEs. This 1384 * prevents inheritable permissions from being 1385 * altered along with the file mode. 1386 */ 1387 iflags |= ACE_INHERIT_ONLY_ACE; 1388 } 1389 1390 /* 1391 * If this ACL has any inheritable ACEs, mark that in 1392 * the hints (which are later masked into the pflags) 1393 * so create knows to do inheritance. 1394 */ 1395 if (isdir && (iflags & 1396 (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE))) 1397 aclp->z_hints |= ZFS_INHERIT_ACE; 1398 1399 if ((type != ALLOW && type != DENY) || 1400 (iflags & ACE_INHERIT_ONLY_ACE)) { 1401 switch (type) { 1402 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 1403 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 1404 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 1405 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 1406 aclp->z_hints |= ZFS_ACL_OBJ_ACE; 1407 break; 1408 } 1409 } else { 1410 /* 1411 * Limit permissions granted by ACEs to be no greater 1412 * than permissions of the requested group mode. 1413 * Applies when the "aclmode" property is set to 1414 * "groupmask". 1415 */ 1416 if ((type == ALLOW) && trim) 1417 access_mask &= masks.group; 1418 } 1419 zfs_set_ace(aclp, zacep, access_mask, type, who, iflags); 1420 ace_size = aclp->z_ops->ace_size(acep); 1421 zacep = (void *)((uintptr_t)zacep + ace_size); 1422 new_count++; 1423 new_bytes += ace_size; 1424 } 1425 zfs_set_ace(aclp, zacep, masks.owner, ALLOW, -1, ACE_OWNER); 1426 zacep = (void *)((uintptr_t)zacep + abstract_size); 1427 zfs_set_ace(aclp, zacep, masks.group, ALLOW, -1, OWNING_GROUP); 1428 zacep = (void *)((uintptr_t)zacep + abstract_size); 1429 zfs_set_ace(aclp, zacep, masks.everyone, ALLOW, -1, ACE_EVERYONE); 1430 1431 new_count += 3; 1432 new_bytes += abstract_size * 3; 1433 zfs_acl_release_nodes(aclp); 1434 aclp->z_acl_count = new_count; 1435 aclp->z_acl_bytes = new_bytes; 1436 newnode->z_ace_count = new_count; 1437 newnode->z_size = new_bytes; 1438 list_insert_tail(&aclp->z_acl, newnode); 1439} 1440 1441int 1442zfs_acl_chmod_setattr(znode_t *zp, zfs_acl_t **aclp, uint64_t mode) 1443{ 1444 int error = 0; 1445 1446 mutex_enter(&zp->z_acl_lock); 1447 if (zp->z_zfsvfs->z_replay == B_FALSE) 1448 ASSERT_VOP_ELOCKED(ZTOV(zp), __func__); 1449 if (zp->z_zfsvfs->z_acl_mode == ZFS_ACL_DISCARD) 1450 *aclp = zfs_acl_alloc(zfs_acl_version_zp(zp)); 1451 else 1452 error = zfs_acl_node_read(zp, B_TRUE, aclp, B_TRUE); 1453 1454 if (error == 0) { 1455 (*aclp)->z_hints = zp->z_pflags & V4_ACL_WIDE_FLAGS; 1456 zfs_acl_chmod(ZTOV(zp)->v_type, mode, B_TRUE, 1457 (zp->z_zfsvfs->z_acl_mode == ZFS_ACL_GROUPMASK), *aclp); 1458 } 1459 mutex_exit(&zp->z_acl_lock); 1460 1461 return (error); 1462} 1463 1464/* 1465 * Should ACE be inherited? 1466 */ 1467static int 1468zfs_ace_can_use(vtype_t vtype, uint16_t acep_flags) 1469{ 1470 int iflags = (acep_flags & 0xf); 1471 1472 if ((vtype == VDIR) && (iflags & ACE_DIRECTORY_INHERIT_ACE)) 1473 return (1); 1474 else if (iflags & ACE_FILE_INHERIT_ACE) 1475 return (!((vtype == VDIR) && 1476 (iflags & ACE_NO_PROPAGATE_INHERIT_ACE))); 1477 return (0); 1478} 1479 1480/* 1481 * inherit inheritable ACEs from parent 1482 */ 1483static zfs_acl_t * 1484zfs_acl_inherit(zfsvfs_t *zfsvfs, vtype_t vtype, zfs_acl_t *paclp, 1485 uint64_t mode, boolean_t *need_chmod) 1486{ 1487 void *pacep = NULL; 1488 void *acep; 1489 zfs_acl_node_t *aclnode; 1490 zfs_acl_t *aclp = NULL; 1491 uint64_t who; 1492 uint32_t access_mask; 1493 uint16_t iflags, newflags, type; 1494 size_t ace_size; 1495 void *data1, *data2; 1496 size_t data1sz, data2sz; 1497 uint_t aclinherit; 1498 boolean_t isdir = (vtype == VDIR); 1499 boolean_t isreg = (vtype == VREG); 1500 1501 *need_chmod = B_TRUE; 1502 1503 aclp = zfs_acl_alloc(paclp->z_version); 1504 aclinherit = zfsvfs->z_acl_inherit; 1505 if (aclinherit == ZFS_ACL_DISCARD || vtype == VLNK) 1506 return (aclp); 1507 1508 while ((pacep = zfs_acl_next_ace(paclp, pacep, &who, 1509 &access_mask, &iflags, &type))) { 1510 1511 /* 1512 * don't inherit bogus ACEs 1513 */ 1514 if (!zfs_acl_valid_ace_type(type, iflags)) 1515 continue; 1516 1517 /* 1518 * Check if ACE is inheritable by this vnode 1519 */ 1520 if ((aclinherit == ZFS_ACL_NOALLOW && type == ALLOW) || 1521 !zfs_ace_can_use(vtype, iflags)) 1522 continue; 1523 1524 /* 1525 * If owner@, group@, or everyone@ inheritable 1526 * then zfs_acl_chmod() isn't needed. 1527 */ 1528 if ((aclinherit == ZFS_ACL_PASSTHROUGH || 1529 aclinherit == ZFS_ACL_PASSTHROUGH_X) && 1530 ((iflags & (ACE_OWNER|ACE_EVERYONE)) || 1531 ((iflags & OWNING_GROUP) == OWNING_GROUP)) && 1532 (isreg || (isdir && (iflags & ACE_DIRECTORY_INHERIT_ACE)))) 1533 *need_chmod = B_FALSE; 1534 1535 /* 1536 * Strip inherited execute permission from file if 1537 * not in mode 1538 */ 1539 if (aclinherit == ZFS_ACL_PASSTHROUGH_X && type == ALLOW && 1540 !isdir && ((mode & (S_IXUSR|S_IXGRP|S_IXOTH)) == 0)) { 1541 access_mask &= ~ACE_EXECUTE; 1542 } 1543 1544 /* 1545 * Strip write_acl and write_owner from permissions 1546 * when inheriting an ACE 1547 */ 1548 if (aclinherit == ZFS_ACL_RESTRICTED && type == ALLOW) { 1549 access_mask &= ~RESTRICTED_CLEAR; 1550 } 1551 1552 ace_size = aclp->z_ops->ace_size(pacep); 1553 aclnode = zfs_acl_node_alloc(ace_size); 1554 list_insert_tail(&aclp->z_acl, aclnode); 1555 acep = aclnode->z_acldata; 1556 1557 zfs_set_ace(aclp, acep, access_mask, type, 1558 who, iflags|ACE_INHERITED_ACE); 1559 1560 /* 1561 * Copy special opaque data if any 1562 */ 1563 if ((data1sz = paclp->z_ops->ace_data(pacep, &data1)) != 0) { 1564 data2sz = aclp->z_ops->ace_data(acep, &data2); 1565 VERIFY3U(data2sz, ==, data1sz); 1566 memcpy(data2, data1, data2sz); 1567 } 1568 1569 aclp->z_acl_count++; 1570 aclnode->z_ace_count++; 1571 aclp->z_acl_bytes += aclnode->z_size; 1572 newflags = aclp->z_ops->ace_flags_get(acep); 1573 1574 /* 1575 * If ACE is not to be inherited further, or if the vnode is 1576 * not a directory, remove all inheritance flags 1577 */ 1578 if (!isdir || (iflags & ACE_NO_PROPAGATE_INHERIT_ACE)) { 1579 newflags &= ~ALL_INHERIT; 1580 aclp->z_ops->ace_flags_set(acep, 1581 newflags|ACE_INHERITED_ACE); 1582 continue; 1583 } 1584 1585 /* 1586 * This directory has an inheritable ACE 1587 */ 1588 aclp->z_hints |= ZFS_INHERIT_ACE; 1589 1590 /* 1591 * If only FILE_INHERIT is set then turn on 1592 * inherit_only 1593 */ 1594 if ((iflags & (ACE_FILE_INHERIT_ACE | 1595 ACE_DIRECTORY_INHERIT_ACE)) == ACE_FILE_INHERIT_ACE) { 1596 newflags |= ACE_INHERIT_ONLY_ACE; 1597 aclp->z_ops->ace_flags_set(acep, 1598 newflags|ACE_INHERITED_ACE); 1599 } else { 1600 newflags &= ~ACE_INHERIT_ONLY_ACE; 1601 aclp->z_ops->ace_flags_set(acep, 1602 newflags|ACE_INHERITED_ACE); 1603 } 1604 } 1605 if (zfsvfs->z_acl_mode == ZFS_ACL_RESTRICTED && 1606 aclp->z_acl_count != 0) { 1607 *need_chmod = B_FALSE; 1608 } 1609 1610 return (aclp); 1611} 1612 1613/* 1614 * Create file system object initial permissions 1615 * including inheritable ACEs. 1616 * Also, create FUIDs for owner and group. 1617 */ 1618int 1619zfs_acl_ids_create(znode_t *dzp, int flag, vattr_t *vap, cred_t *cr, 1620 vsecattr_t *vsecp, zfs_acl_ids_t *acl_ids, zidmap_t *mnt_ns) 1621{ 1622 int error; 1623 zfsvfs_t *zfsvfs = dzp->z_zfsvfs; 1624 zfs_acl_t *paclp; 1625 gid_t gid; 1626 boolean_t need_chmod = B_TRUE; 1627 boolean_t trim = B_FALSE; 1628 boolean_t inherited = B_FALSE; 1629 1630 if ((flag & IS_ROOT_NODE) == 0) { 1631 if (zfsvfs->z_replay == B_FALSE) 1632 ASSERT_VOP_ELOCKED(ZTOV(dzp), __func__); 1633 } else 1634 ASSERT3P(dzp->z_vnode, ==, NULL); 1635 memset(acl_ids, 0, sizeof (zfs_acl_ids_t)); 1636 acl_ids->z_mode = MAKEIMODE(vap->va_type, vap->va_mode); 1637 1638 if (vsecp) 1639 if ((error = zfs_vsec_2_aclp(zfsvfs, vap->va_type, vsecp, cr, 1640 &acl_ids->z_fuidp, &acl_ids->z_aclp)) != 0) 1641 return (error); 1642 /* 1643 * Determine uid and gid. 1644 */ 1645 if ((flag & IS_ROOT_NODE) || zfsvfs->z_replay || 1646 ((flag & IS_XATTR) && (vap->va_type == VDIR))) { 1647 acl_ids->z_fuid = zfs_fuid_create(zfsvfs, 1648 (uint64_t)vap->va_uid, cr, 1649 ZFS_OWNER, &acl_ids->z_fuidp); 1650 acl_ids->z_fgid = zfs_fuid_create(zfsvfs, 1651 (uint64_t)vap->va_gid, cr, 1652 ZFS_GROUP, &acl_ids->z_fuidp); 1653 gid = vap->va_gid; 1654 } else { 1655 uid_t id = crgetuid(cr); 1656 if (IS_EPHEMERAL(id)) 1657 id = UID_NOBODY; 1658 acl_ids->z_fuid = (uint64_t)id; 1659 acl_ids->z_fgid = 0; 1660 if (vap->va_mask & AT_GID) { 1661 acl_ids->z_fgid = zfs_fuid_create(zfsvfs, 1662 (uint64_t)vap->va_gid, 1663 cr, ZFS_GROUP, &acl_ids->z_fuidp); 1664 gid = vap->va_gid; 1665 if (acl_ids->z_fgid != dzp->z_gid && 1666 !groupmember(vap->va_gid, cr) && 1667 secpolicy_vnode_create_gid(cr) != 0) 1668 acl_ids->z_fgid = 0; 1669 } 1670 if (acl_ids->z_fgid == 0) { 1671 const char *domain; 1672 uint32_t rid; 1673 1674 acl_ids->z_fgid = dzp->z_gid; 1675 gid = zfs_fuid_map_id(zfsvfs, acl_ids->z_fgid, 1676 cr, ZFS_GROUP); 1677 1678 if (zfsvfs->z_use_fuids && 1679 IS_EPHEMERAL(acl_ids->z_fgid)) { 1680 domain = 1681 zfs_fuid_idx_domain(&zfsvfs->z_fuid_idx, 1682 FUID_INDEX(acl_ids->z_fgid)); 1683 rid = FUID_RID(acl_ids->z_fgid); 1684 zfs_fuid_node_add(&acl_ids->z_fuidp, 1685 domain, rid, FUID_INDEX(acl_ids->z_fgid), 1686 acl_ids->z_fgid, ZFS_GROUP); 1687 } 1688 } 1689 } 1690 1691 /* 1692 * If we're creating a directory, and the parent directory has the 1693 * set-GID bit set, set in on the new directory. 1694 * Otherwise, if the user is neither privileged nor a member of the 1695 * file's new group, clear the file's set-GID bit. 1696 */ 1697 1698 if (!(flag & IS_ROOT_NODE) && (dzp->z_mode & S_ISGID) && 1699 (vap->va_type == VDIR)) { 1700 acl_ids->z_mode |= S_ISGID; 1701 } else { 1702 if ((acl_ids->z_mode & S_ISGID) && 1703 secpolicy_vnode_setids_setgids(ZTOV(dzp), cr, gid) != 0) 1704 acl_ids->z_mode &= ~S_ISGID; 1705 } 1706 1707 if (acl_ids->z_aclp == NULL) { 1708 mutex_enter(&dzp->z_acl_lock); 1709 if (!(flag & IS_ROOT_NODE) && 1710 (dzp->z_pflags & ZFS_INHERIT_ACE) && 1711 !(dzp->z_pflags & ZFS_XATTR)) { 1712 VERIFY0(zfs_acl_node_read(dzp, B_TRUE, 1713 &paclp, B_FALSE)); 1714 acl_ids->z_aclp = zfs_acl_inherit(zfsvfs, 1715 vap->va_type, paclp, acl_ids->z_mode, &need_chmod); 1716 inherited = B_TRUE; 1717 } else { 1718 acl_ids->z_aclp = 1719 zfs_acl_alloc(zfs_acl_version_zp(dzp)); 1720 acl_ids->z_aclp->z_hints |= ZFS_ACL_TRIVIAL; 1721 } 1722 mutex_exit(&dzp->z_acl_lock); 1723 1724 if (need_chmod) { 1725 if (vap->va_type == VDIR) 1726 acl_ids->z_aclp->z_hints |= 1727 ZFS_ACL_AUTO_INHERIT; 1728 1729 if (zfsvfs->z_acl_mode == ZFS_ACL_GROUPMASK && 1730 zfsvfs->z_acl_inherit != ZFS_ACL_PASSTHROUGH && 1731 zfsvfs->z_acl_inherit != ZFS_ACL_PASSTHROUGH_X) 1732 trim = B_TRUE; 1733 zfs_acl_chmod(vap->va_type, acl_ids->z_mode, B_FALSE, 1734 trim, acl_ids->z_aclp); 1735 } 1736 } 1737 1738 if (inherited || vsecp) { 1739 acl_ids->z_mode = zfs_mode_compute(acl_ids->z_mode, 1740 acl_ids->z_aclp, &acl_ids->z_aclp->z_hints, 1741 acl_ids->z_fuid, acl_ids->z_fgid); 1742 if (ace_trivial_common(acl_ids->z_aclp, 0, zfs_ace_walk) == 0) 1743 acl_ids->z_aclp->z_hints |= ZFS_ACL_TRIVIAL; 1744 } 1745 1746 return (0); 1747} 1748 1749/* 1750 * Free ACL and fuid_infop, but not the acl_ids structure 1751 */ 1752void 1753zfs_acl_ids_free(zfs_acl_ids_t *acl_ids) 1754{ 1755 if (acl_ids->z_aclp) 1756 zfs_acl_free(acl_ids->z_aclp); 1757 if (acl_ids->z_fuidp) 1758 zfs_fuid_info_free(acl_ids->z_fuidp); 1759 acl_ids->z_aclp = NULL; 1760 acl_ids->z_fuidp = NULL; 1761} 1762 1763boolean_t 1764zfs_acl_ids_overquota(zfsvfs_t *zv, zfs_acl_ids_t *acl_ids, uint64_t projid) 1765{ 1766 return (zfs_id_overquota(zv, DMU_USERUSED_OBJECT, acl_ids->z_fuid) || 1767 zfs_id_overquota(zv, DMU_GROUPUSED_OBJECT, acl_ids->z_fgid) || 1768 (projid != ZFS_DEFAULT_PROJID && projid != ZFS_INVALID_PROJID && 1769 zfs_id_overquota(zv, DMU_PROJECTUSED_OBJECT, projid))); 1770} 1771 1772/* 1773 * Retrieve a file's ACL 1774 */ 1775int 1776zfs_getacl(znode_t *zp, vsecattr_t *vsecp, boolean_t skipaclchk, cred_t *cr) 1777{ 1778 zfs_acl_t *aclp; 1779 ulong_t mask; 1780 int error; 1781 int count = 0; 1782 int largeace = 0; 1783 1784 mask = vsecp->vsa_mask & (VSA_ACE | VSA_ACECNT | 1785 VSA_ACE_ACLFLAGS | VSA_ACE_ALLTYPES); 1786 1787 if (mask == 0) 1788 return (SET_ERROR(ENOSYS)); 1789 1790 if ((error = zfs_zaccess(zp, ACE_READ_ACL, 0, skipaclchk, cr, NULL))) 1791 return (error); 1792 1793 mutex_enter(&zp->z_acl_lock); 1794 1795 if (zp->z_zfsvfs->z_replay == B_FALSE) 1796 ASSERT_VOP_LOCKED(ZTOV(zp), __func__); 1797 error = zfs_acl_node_read(zp, B_TRUE, &aclp, B_FALSE); 1798 if (error != 0) { 1799 mutex_exit(&zp->z_acl_lock); 1800 return (error); 1801 } 1802 1803 /* 1804 * Scan ACL to determine number of ACEs 1805 */ 1806 if ((zp->z_pflags & ZFS_ACL_OBJ_ACE) && !(mask & VSA_ACE_ALLTYPES)) { 1807 void *zacep = NULL; 1808 uint64_t who; 1809 uint32_t access_mask; 1810 uint16_t type, iflags; 1811 1812 while ((zacep = zfs_acl_next_ace(aclp, zacep, 1813 &who, &access_mask, &iflags, &type))) { 1814 switch (type) { 1815 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 1816 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 1817 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 1818 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 1819 largeace++; 1820 continue; 1821 default: 1822 count++; 1823 } 1824 } 1825 vsecp->vsa_aclcnt = count; 1826 } else 1827 count = (int)aclp->z_acl_count; 1828 1829 if (mask & VSA_ACECNT) { 1830 vsecp->vsa_aclcnt = count; 1831 } 1832 1833 if (mask & VSA_ACE) { 1834 size_t aclsz; 1835 1836 aclsz = count * sizeof (ace_t) + 1837 sizeof (ace_object_t) * largeace; 1838 1839 vsecp->vsa_aclentp = kmem_alloc(aclsz, KM_SLEEP); 1840 vsecp->vsa_aclentsz = aclsz; 1841 1842 if (aclp->z_version == ZFS_ACL_VERSION_FUID) 1843 zfs_copy_fuid_2_ace(zp->z_zfsvfs, aclp, cr, 1844 vsecp->vsa_aclentp, !(mask & VSA_ACE_ALLTYPES)); 1845 else { 1846 zfs_acl_node_t *aclnode; 1847 void *start = vsecp->vsa_aclentp; 1848 1849 for (aclnode = list_head(&aclp->z_acl); aclnode; 1850 aclnode = list_next(&aclp->z_acl, aclnode)) { 1851 memcpy(start, aclnode->z_acldata, 1852 aclnode->z_size); 1853 start = (caddr_t)start + aclnode->z_size; 1854 } 1855 ASSERT3U((caddr_t)start - (caddr_t)vsecp->vsa_aclentp, 1856 ==, aclp->z_acl_bytes); 1857 } 1858 } 1859 if (mask & VSA_ACE_ACLFLAGS) { 1860 vsecp->vsa_aclflags = 0; 1861 if (zp->z_pflags & ZFS_ACL_DEFAULTED) 1862 vsecp->vsa_aclflags |= ACL_DEFAULTED; 1863 if (zp->z_pflags & ZFS_ACL_PROTECTED) 1864 vsecp->vsa_aclflags |= ACL_PROTECTED; 1865 if (zp->z_pflags & ZFS_ACL_AUTO_INHERIT) 1866 vsecp->vsa_aclflags |= ACL_AUTO_INHERIT; 1867 } 1868 1869 mutex_exit(&zp->z_acl_lock); 1870 1871 return (0); 1872} 1873 1874int 1875zfs_vsec_2_aclp(zfsvfs_t *zfsvfs, umode_t obj_type, 1876 vsecattr_t *vsecp, cred_t *cr, zfs_fuid_info_t **fuidp, zfs_acl_t **zaclp) 1877{ 1878 zfs_acl_t *aclp; 1879 zfs_acl_node_t *aclnode; 1880 int aclcnt = vsecp->vsa_aclcnt; 1881 int error; 1882 1883 if (vsecp->vsa_aclcnt > MAX_ACL_ENTRIES || vsecp->vsa_aclcnt <= 0) 1884 return (SET_ERROR(EINVAL)); 1885 1886 aclp = zfs_acl_alloc(zfs_acl_version(zfsvfs->z_version)); 1887 1888 aclp->z_hints = 0; 1889 aclnode = zfs_acl_node_alloc(aclcnt * sizeof (zfs_object_ace_t)); 1890 if (aclp->z_version == ZFS_ACL_VERSION_INITIAL) { 1891 if ((error = zfs_copy_ace_2_oldace(obj_type, aclp, 1892 (ace_t *)vsecp->vsa_aclentp, aclnode->z_acldata, 1893 aclcnt, &aclnode->z_size)) != 0) { 1894 zfs_acl_free(aclp); 1895 zfs_acl_node_free(aclnode); 1896 return (error); 1897 } 1898 } else { 1899 if ((error = zfs_copy_ace_2_fuid(zfsvfs, obj_type, aclp, 1900 vsecp->vsa_aclentp, aclnode->z_acldata, aclcnt, 1901 &aclnode->z_size, fuidp, cr)) != 0) { 1902 zfs_acl_free(aclp); 1903 zfs_acl_node_free(aclnode); 1904 return (error); 1905 } 1906 } 1907 aclp->z_acl_bytes = aclnode->z_size; 1908 aclnode->z_ace_count = aclcnt; 1909 aclp->z_acl_count = aclcnt; 1910 list_insert_head(&aclp->z_acl, aclnode); 1911 1912 /* 1913 * If flags are being set then add them to z_hints 1914 */ 1915 if (vsecp->vsa_mask & VSA_ACE_ACLFLAGS) { 1916 if (vsecp->vsa_aclflags & ACL_PROTECTED) 1917 aclp->z_hints |= ZFS_ACL_PROTECTED; 1918 if (vsecp->vsa_aclflags & ACL_DEFAULTED) 1919 aclp->z_hints |= ZFS_ACL_DEFAULTED; 1920 if (vsecp->vsa_aclflags & ACL_AUTO_INHERIT) 1921 aclp->z_hints |= ZFS_ACL_AUTO_INHERIT; 1922 } 1923 1924 *zaclp = aclp; 1925 1926 return (0); 1927} 1928 1929/* 1930 * Set a file's ACL 1931 */ 1932int 1933zfs_setacl(znode_t *zp, vsecattr_t *vsecp, boolean_t skipaclchk, cred_t *cr) 1934{ 1935 zfsvfs_t *zfsvfs = zp->z_zfsvfs; 1936 zilog_t *zilog = zfsvfs->z_log; 1937 ulong_t mask = vsecp->vsa_mask & (VSA_ACE | VSA_ACECNT); 1938 dmu_tx_t *tx; 1939 int error; 1940 zfs_acl_t *aclp; 1941 zfs_fuid_info_t *fuidp = NULL; 1942 boolean_t fuid_dirtied; 1943 uint64_t acl_obj; 1944 1945 if (zp->z_zfsvfs->z_replay == B_FALSE) 1946 ASSERT_VOP_ELOCKED(ZTOV(zp), __func__); 1947 if (mask == 0) 1948 return (SET_ERROR(ENOSYS)); 1949 1950 if (zp->z_pflags & ZFS_IMMUTABLE) 1951 return (SET_ERROR(EPERM)); 1952 1953 if ((error = zfs_zaccess(zp, ACE_WRITE_ACL, 0, skipaclchk, cr, NULL))) 1954 return (error); 1955 1956 error = zfs_vsec_2_aclp(zfsvfs, ZTOV(zp)->v_type, vsecp, cr, &fuidp, 1957 &aclp); 1958 if (error) 1959 return (error); 1960 1961 /* 1962 * If ACL wide flags aren't being set then preserve any 1963 * existing flags. 1964 */ 1965 if (!(vsecp->vsa_mask & VSA_ACE_ACLFLAGS)) { 1966 aclp->z_hints |= 1967 (zp->z_pflags & V4_ACL_WIDE_FLAGS); 1968 } 1969top: 1970 mutex_enter(&zp->z_acl_lock); 1971 1972 tx = dmu_tx_create(zfsvfs->z_os); 1973 1974 dmu_tx_hold_sa(tx, zp->z_sa_hdl, B_TRUE); 1975 1976 fuid_dirtied = zfsvfs->z_fuid_dirty; 1977 if (fuid_dirtied) 1978 zfs_fuid_txhold(zfsvfs, tx); 1979 1980 /* 1981 * If old version and ACL won't fit in bonus and we aren't 1982 * upgrading then take out necessary DMU holds 1983 */ 1984 1985 if ((acl_obj = zfs_external_acl(zp)) != 0) { 1986 if (zfsvfs->z_version >= ZPL_VERSION_FUID && 1987 zfs_znode_acl_version(zp) <= ZFS_ACL_VERSION_INITIAL) { 1988 dmu_tx_hold_free(tx, acl_obj, 0, 1989 DMU_OBJECT_END); 1990 dmu_tx_hold_write(tx, DMU_NEW_OBJECT, 0, 1991 aclp->z_acl_bytes); 1992 } else { 1993 dmu_tx_hold_write(tx, acl_obj, 0, aclp->z_acl_bytes); 1994 } 1995 } else if (!zp->z_is_sa && aclp->z_acl_bytes > ZFS_ACE_SPACE) { 1996 dmu_tx_hold_write(tx, DMU_NEW_OBJECT, 0, aclp->z_acl_bytes); 1997 } 1998 1999 zfs_sa_upgrade_txholds(tx, zp); 2000 error = dmu_tx_assign(tx, TXG_NOWAIT); 2001 if (error) { 2002 mutex_exit(&zp->z_acl_lock); 2003 2004 if (error == ERESTART) { 2005 dmu_tx_wait(tx); 2006 dmu_tx_abort(tx); 2007 goto top; 2008 } 2009 dmu_tx_abort(tx); 2010 zfs_acl_free(aclp); 2011 return (error); 2012 } 2013 2014 error = zfs_aclset_common(zp, aclp, cr, tx); 2015 ASSERT0(error); 2016 ASSERT3P(zp->z_acl_cached, ==, NULL); 2017 zp->z_acl_cached = aclp; 2018 2019 if (fuid_dirtied) 2020 zfs_fuid_sync(zfsvfs, tx); 2021 2022 zfs_log_acl(zilog, tx, zp, vsecp, fuidp); 2023 2024 if (fuidp) 2025 zfs_fuid_info_free(fuidp); 2026 dmu_tx_commit(tx); 2027 mutex_exit(&zp->z_acl_lock); 2028 2029 return (error); 2030} 2031 2032/* 2033 * Check accesses of interest (AoI) against attributes of the dataset 2034 * such as read-only. Returns zero if no AoI conflict with dataset 2035 * attributes, otherwise an appropriate errno is returned. 2036 */ 2037static int 2038zfs_zaccess_dataset_check(znode_t *zp, uint32_t v4_mode) 2039{ 2040 if ((v4_mode & WRITE_MASK) && 2041 (zp->z_zfsvfs->z_vfs->vfs_flag & VFS_RDONLY) && 2042 (!IS_DEVVP(ZTOV(zp)) || (v4_mode & WRITE_MASK_ATTRS))) { 2043 return (SET_ERROR(EROFS)); 2044 } 2045 2046 /* 2047 * Intentionally allow ZFS_READONLY through here. 2048 * See zfs_zaccess_common(). 2049 */ 2050 if ((v4_mode & WRITE_MASK_DATA) && 2051 (zp->z_pflags & ZFS_IMMUTABLE)) { 2052 return (SET_ERROR(EPERM)); 2053 } 2054 2055 /* 2056 * In FreeBSD we allow to modify directory's content is ZFS_NOUNLINK 2057 * (sunlnk) is set. We just don't allow directory removal, which is 2058 * handled in zfs_zaccess_delete(). 2059 */ 2060 if ((v4_mode & ACE_DELETE) && 2061 (zp->z_pflags & ZFS_NOUNLINK)) { 2062 return (EPERM); 2063 } 2064 2065 if (((v4_mode & (ACE_READ_DATA|ACE_EXECUTE)) && 2066 (zp->z_pflags & ZFS_AV_QUARANTINED))) { 2067 return (SET_ERROR(EACCES)); 2068 } 2069 2070 return (0); 2071} 2072 2073/* 2074 * The primary usage of this function is to loop through all of the 2075 * ACEs in the znode, determining what accesses of interest (AoI) to 2076 * the caller are allowed or denied. The AoI are expressed as bits in 2077 * the working_mode parameter. As each ACE is processed, bits covered 2078 * by that ACE are removed from the working_mode. This removal 2079 * facilitates two things. The first is that when the working mode is 2080 * empty (= 0), we know we've looked at all the AoI. The second is 2081 * that the ACE interpretation rules don't allow a later ACE to undo 2082 * something granted or denied by an earlier ACE. Removing the 2083 * discovered access or denial enforces this rule. At the end of 2084 * processing the ACEs, all AoI that were found to be denied are 2085 * placed into the working_mode, giving the caller a mask of denied 2086 * accesses. Returns: 2087 * 0 if all AoI granted 2088 * EACCESS if the denied mask is non-zero 2089 * other error if abnormal failure (e.g., IO error) 2090 * 2091 * A secondary usage of the function is to determine if any of the 2092 * AoI are granted. If an ACE grants any access in 2093 * the working_mode, we immediately short circuit out of the function. 2094 * This mode is chosen by setting anyaccess to B_TRUE. The 2095 * working_mode is not a denied access mask upon exit if the function 2096 * is used in this manner. 2097 */ 2098static int 2099zfs_zaccess_aces_check(znode_t *zp, uint32_t *working_mode, 2100 boolean_t anyaccess, cred_t *cr) 2101{ 2102 zfsvfs_t *zfsvfs = zp->z_zfsvfs; 2103 zfs_acl_t *aclp; 2104 int error; 2105 uid_t uid = crgetuid(cr); 2106 uint64_t who; 2107 uint16_t type, iflags; 2108 uint16_t entry_type; 2109 uint32_t access_mask; 2110 uint32_t deny_mask = 0; 2111 zfs_ace_hdr_t *acep = NULL; 2112 boolean_t checkit; 2113 uid_t gowner; 2114 uid_t fowner; 2115 2116 zfs_fuid_map_ids(zp, cr, &fowner, &gowner); 2117 2118 mutex_enter(&zp->z_acl_lock); 2119 2120 if (zp->z_zfsvfs->z_replay == B_FALSE) 2121 ASSERT_VOP_LOCKED(ZTOV(zp), __func__); 2122 error = zfs_acl_node_read(zp, B_TRUE, &aclp, B_FALSE); 2123 if (error != 0) { 2124 mutex_exit(&zp->z_acl_lock); 2125 return (error); 2126 } 2127 2128 ASSERT3P(zp->z_acl_cached, !=, NULL); 2129 2130 while ((acep = zfs_acl_next_ace(aclp, acep, &who, &access_mask, 2131 &iflags, &type))) { 2132 uint32_t mask_matched; 2133 2134 if (!zfs_acl_valid_ace_type(type, iflags)) 2135 continue; 2136 2137 if (ZTOV(zp)->v_type == VDIR && (iflags & ACE_INHERIT_ONLY_ACE)) 2138 continue; 2139 2140 /* Skip ACE if it does not affect any AoI */ 2141 mask_matched = (access_mask & *working_mode); 2142 if (!mask_matched) 2143 continue; 2144 2145 entry_type = (iflags & ACE_TYPE_FLAGS); 2146 2147 checkit = B_FALSE; 2148 2149 switch (entry_type) { 2150 case ACE_OWNER: 2151 if (uid == fowner) 2152 checkit = B_TRUE; 2153 break; 2154 case OWNING_GROUP: 2155 who = gowner; 2156 zfs_fallthrough; 2157 case ACE_IDENTIFIER_GROUP: 2158 checkit = zfs_groupmember(zfsvfs, who, cr); 2159 break; 2160 case ACE_EVERYONE: 2161 checkit = B_TRUE; 2162 break; 2163 2164 /* USER Entry */ 2165 default: 2166 if (entry_type == 0) { 2167 uid_t newid; 2168 2169 newid = zfs_fuid_map_id(zfsvfs, who, cr, 2170 ZFS_ACE_USER); 2171 if (newid != UID_NOBODY && 2172 uid == newid) 2173 checkit = B_TRUE; 2174 break; 2175 } else { 2176 mutex_exit(&zp->z_acl_lock); 2177 return (SET_ERROR(EIO)); 2178 } 2179 } 2180 2181 if (checkit) { 2182 if (type == DENY) { 2183 DTRACE_PROBE3(zfs__ace__denies, 2184 znode_t *, zp, 2185 zfs_ace_hdr_t *, acep, 2186 uint32_t, mask_matched); 2187 deny_mask |= mask_matched; 2188 } else { 2189 DTRACE_PROBE3(zfs__ace__allows, 2190 znode_t *, zp, 2191 zfs_ace_hdr_t *, acep, 2192 uint32_t, mask_matched); 2193 if (anyaccess) { 2194 mutex_exit(&zp->z_acl_lock); 2195 return (0); 2196 } 2197 } 2198 *working_mode &= ~mask_matched; 2199 } 2200 2201 /* Are we done? */ 2202 if (*working_mode == 0) 2203 break; 2204 } 2205 2206 mutex_exit(&zp->z_acl_lock); 2207 2208 /* Put the found 'denies' back on the working mode */ 2209 if (deny_mask) { 2210 *working_mode |= deny_mask; 2211 return (SET_ERROR(EACCES)); 2212 } else if (*working_mode) { 2213 return (-1); 2214 } 2215 2216 return (0); 2217} 2218 2219/* 2220 * Return true if any access whatsoever granted, we don't actually 2221 * care what access is granted. 2222 */ 2223boolean_t 2224zfs_has_access(znode_t *zp, cred_t *cr) 2225{ 2226 uint32_t have = ACE_ALL_PERMS; 2227 2228 if (zfs_zaccess_aces_check(zp, &have, B_TRUE, cr) != 0) { 2229 uid_t owner; 2230 2231 owner = zfs_fuid_map_id(zp->z_zfsvfs, zp->z_uid, cr, ZFS_OWNER); 2232 return (secpolicy_vnode_any_access(cr, ZTOV(zp), owner) == 0); 2233 } 2234 return (B_TRUE); 2235} 2236 2237static int 2238zfs_zaccess_common(znode_t *zp, uint32_t v4_mode, uint32_t *working_mode, 2239 boolean_t *check_privs, boolean_t skipaclchk, cred_t *cr) 2240{ 2241 zfsvfs_t *zfsvfs = zp->z_zfsvfs; 2242 int err; 2243 2244 *working_mode = v4_mode; 2245 *check_privs = B_TRUE; 2246 2247 /* 2248 * Short circuit empty requests 2249 */ 2250 if (v4_mode == 0 || zfsvfs->z_replay) { 2251 *working_mode = 0; 2252 return (0); 2253 } 2254 2255 if ((err = zfs_zaccess_dataset_check(zp, v4_mode)) != 0) { 2256 *check_privs = B_FALSE; 2257 return (err); 2258 } 2259 2260 /* 2261 * The caller requested that the ACL check be skipped. This 2262 * would only happen if the caller checked VOP_ACCESS() with a 2263 * 32 bit ACE mask and already had the appropriate permissions. 2264 */ 2265 if (skipaclchk) { 2266 *working_mode = 0; 2267 return (0); 2268 } 2269 2270 /* 2271 * Note: ZFS_READONLY represents the "DOS R/O" attribute. 2272 * When that flag is set, we should behave as if write access 2273 * were not granted by anything in the ACL. In particular: 2274 * We _must_ allow writes after opening the file r/w, then 2275 * setting the DOS R/O attribute, and writing some more. 2276 * (Similar to how you can write after fchmod(fd, 0444).) 2277 * 2278 * Therefore ZFS_READONLY is ignored in the dataset check 2279 * above, and checked here as if part of the ACL check. 2280 * Also note: DOS R/O is ignored for directories. 2281 */ 2282 if ((v4_mode & WRITE_MASK_DATA) && 2283 (ZTOV(zp)->v_type != VDIR) && 2284 (zp->z_pflags & ZFS_READONLY)) { 2285 return (SET_ERROR(EPERM)); 2286 } 2287 2288 return (zfs_zaccess_aces_check(zp, working_mode, B_FALSE, cr)); 2289} 2290 2291static int 2292zfs_zaccess_append(znode_t *zp, uint32_t *working_mode, boolean_t *check_privs, 2293 cred_t *cr) 2294{ 2295 if (*working_mode != ACE_WRITE_DATA) 2296 return (SET_ERROR(EACCES)); 2297 2298 return (zfs_zaccess_common(zp, ACE_APPEND_DATA, working_mode, 2299 check_privs, B_FALSE, cr)); 2300} 2301 2302/* 2303 * Check if VEXEC is allowed. 2304 * 2305 * This routine is based on zfs_fastaccesschk_execute which has slowpath 2306 * calling zfs_zaccess. This would be incorrect on FreeBSD (see 2307 * zfs_freebsd_access for the difference). Thus this variant let's the 2308 * caller handle the slowpath (if necessary). 2309 * 2310 * On top of that we perform a lockless check for ZFS_NO_EXECS_DENIED. 2311 * 2312 * Safe access to znode_t is provided by the vnode lock. 2313 */ 2314int 2315zfs_fastaccesschk_execute(znode_t *zdp, cred_t *cr) 2316{ 2317 boolean_t is_attr; 2318 2319 if (zdp->z_pflags & ZFS_AV_QUARANTINED) 2320 return (1); 2321 2322 is_attr = ((zdp->z_pflags & ZFS_XATTR) && 2323 (ZTOV(zdp)->v_type == VDIR)); 2324 if (is_attr) 2325 return (1); 2326 2327 if (zdp->z_pflags & ZFS_NO_EXECS_DENIED) 2328 return (0); 2329 2330 return (1); 2331} 2332 2333 2334/* 2335 * Determine whether Access should be granted/denied. 2336 * 2337 * The least priv subsystem is always consulted as a basic privilege 2338 * can define any form of access. 2339 */ 2340int 2341zfs_zaccess(znode_t *zp, int mode, int flags, boolean_t skipaclchk, cred_t *cr, 2342 zidmap_t *mnt_ns) 2343{ 2344 uint32_t working_mode; 2345 int error; 2346 int is_attr; 2347 boolean_t check_privs; 2348 znode_t *xzp = NULL; 2349 znode_t *check_zp = zp; 2350 mode_t needed_bits; 2351 uid_t owner; 2352 2353 is_attr = ((zp->z_pflags & ZFS_XATTR) && (ZTOV(zp)->v_type == VDIR)); 2354 2355 /* 2356 * In FreeBSD, we don't care about permissions of individual ADS. 2357 * Note that not checking them is not just an optimization - without 2358 * this shortcut, EA operations may bogusly fail with EACCES. 2359 */ 2360 if (zp->z_pflags & ZFS_XATTR) 2361 return (0); 2362 2363 owner = zfs_fuid_map_id(zp->z_zfsvfs, zp->z_uid, cr, ZFS_OWNER); 2364 2365 /* 2366 * Map the bits required to the standard vnode flags VREAD|VWRITE|VEXEC 2367 * in needed_bits. Map the bits mapped by working_mode (currently 2368 * missing) in missing_bits. 2369 * Call secpolicy_vnode_access2() with (needed_bits & ~checkmode), 2370 * needed_bits. 2371 */ 2372 needed_bits = 0; 2373 2374 working_mode = mode; 2375 if ((working_mode & (ACE_READ_ACL|ACE_READ_ATTRIBUTES)) && 2376 owner == crgetuid(cr)) 2377 working_mode &= ~(ACE_READ_ACL|ACE_READ_ATTRIBUTES); 2378 2379 if (working_mode & (ACE_READ_DATA|ACE_READ_NAMED_ATTRS| 2380 ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_SYNCHRONIZE)) 2381 needed_bits |= VREAD; 2382 if (working_mode & (ACE_WRITE_DATA|ACE_WRITE_NAMED_ATTRS| 2383 ACE_APPEND_DATA|ACE_WRITE_ATTRIBUTES|ACE_SYNCHRONIZE)) 2384 needed_bits |= VWRITE; 2385 if (working_mode & ACE_EXECUTE) 2386 needed_bits |= VEXEC; 2387 2388 if ((error = zfs_zaccess_common(check_zp, mode, &working_mode, 2389 &check_privs, skipaclchk, cr)) == 0) { 2390 if (is_attr) 2391 VN_RELE(ZTOV(xzp)); 2392 return (secpolicy_vnode_access2(cr, ZTOV(zp), owner, 2393 needed_bits, needed_bits)); 2394 } 2395 2396 if (error && !check_privs) { 2397 if (is_attr) 2398 VN_RELE(ZTOV(xzp)); 2399 return (error); 2400 } 2401 2402 if (error && (flags & V_APPEND)) { 2403 error = zfs_zaccess_append(zp, &working_mode, &check_privs, cr); 2404 } 2405 2406 if (error && check_privs) { 2407 mode_t checkmode = 0; 2408 vnode_t *check_vp = ZTOV(check_zp); 2409 2410 /* 2411 * First check for implicit owner permission on 2412 * read_acl/read_attributes 2413 */ 2414 2415 ASSERT3U(working_mode, !=, 0); 2416 2417 if ((working_mode & (ACE_READ_ACL|ACE_READ_ATTRIBUTES) && 2418 owner == crgetuid(cr))) 2419 working_mode &= ~(ACE_READ_ACL|ACE_READ_ATTRIBUTES); 2420 2421 if (working_mode & (ACE_READ_DATA|ACE_READ_NAMED_ATTRS| 2422 ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_SYNCHRONIZE)) 2423 checkmode |= VREAD; 2424 if (working_mode & (ACE_WRITE_DATA|ACE_WRITE_NAMED_ATTRS| 2425 ACE_APPEND_DATA|ACE_WRITE_ATTRIBUTES|ACE_SYNCHRONIZE)) 2426 checkmode |= VWRITE; 2427 if (working_mode & ACE_EXECUTE) 2428 checkmode |= VEXEC; 2429 2430 error = secpolicy_vnode_access2(cr, check_vp, owner, 2431 needed_bits & ~checkmode, needed_bits); 2432 2433 if (error == 0 && (working_mode & ACE_WRITE_OWNER)) 2434 error = secpolicy_vnode_chown(check_vp, cr, owner); 2435 if (error == 0 && (working_mode & ACE_WRITE_ACL)) 2436 error = secpolicy_vnode_setdac(check_vp, cr, owner); 2437 2438 if (error == 0 && (working_mode & 2439 (ACE_DELETE|ACE_DELETE_CHILD))) 2440 error = secpolicy_vnode_remove(check_vp, cr); 2441 2442 if (error == 0 && (working_mode & ACE_SYNCHRONIZE)) { 2443 error = secpolicy_vnode_chown(check_vp, cr, owner); 2444 } 2445 if (error == 0) { 2446 /* 2447 * See if any bits other than those already checked 2448 * for are still present. If so then return EACCES 2449 */ 2450 if (working_mode & ~(ZFS_CHECKED_MASKS)) { 2451 error = SET_ERROR(EACCES); 2452 } 2453 } 2454 } else if (error == 0) { 2455 error = secpolicy_vnode_access2(cr, ZTOV(zp), owner, 2456 needed_bits, needed_bits); 2457 } 2458 2459 2460 if (is_attr) 2461 VN_RELE(ZTOV(xzp)); 2462 2463 return (error); 2464} 2465 2466/* 2467 * Translate traditional unix VREAD/VWRITE/VEXEC mode into 2468 * NFSv4-style ZFS ACL format and call zfs_zaccess() 2469 */ 2470int 2471zfs_zaccess_rwx(znode_t *zp, mode_t mode, int flags, cred_t *cr, 2472 zidmap_t *mnt_ns) 2473{ 2474 return (zfs_zaccess(zp, zfs_unix_to_v4(mode >> 6), flags, B_FALSE, cr, 2475 mnt_ns)); 2476} 2477 2478/* 2479 * Access function for secpolicy_vnode_setattr 2480 */ 2481int 2482zfs_zaccess_unix(void *zp, int mode, cred_t *cr) 2483{ 2484 int v4_mode = zfs_unix_to_v4(mode >> 6); 2485 2486 return (zfs_zaccess(zp, v4_mode, 0, B_FALSE, cr, NULL)); 2487} 2488 2489static int 2490zfs_delete_final_check(znode_t *zp, znode_t *dzp, 2491 mode_t available_perms, cred_t *cr) 2492{ 2493 int error; 2494 uid_t downer; 2495 2496 downer = zfs_fuid_map_id(dzp->z_zfsvfs, dzp->z_uid, cr, ZFS_OWNER); 2497 2498 error = secpolicy_vnode_access2(cr, ZTOV(dzp), 2499 downer, available_perms, VWRITE|VEXEC); 2500 2501 if (error == 0) 2502 error = zfs_sticky_remove_access(dzp, zp, cr); 2503 2504 return (error); 2505} 2506 2507/* 2508 * Determine whether Access should be granted/deny, without 2509 * consulting least priv subsystem. 2510 * 2511 * The following chart is the recommended NFSv4 enforcement for 2512 * ability to delete an object. 2513 * 2514 * ------------------------------------------------------- 2515 * | Parent Dir | Target Object Permissions | 2516 * | permissions | | 2517 * ------------------------------------------------------- 2518 * | | ACL Allows | ACL Denies| Delete | 2519 * | | Delete | Delete | unspecified| 2520 * ------------------------------------------------------- 2521 * | ACL Allows | Permit | Permit | Permit | 2522 * | DELETE_CHILD | | 2523 * ------------------------------------------------------- 2524 * | ACL Denies | Permit | Deny | Deny | 2525 * | DELETE_CHILD | | | | 2526 * ------------------------------------------------------- 2527 * | ACL specifies | | | | 2528 * | only allow | Permit | Permit | Permit | 2529 * | write and | | | | 2530 * | execute | | | | 2531 * ------------------------------------------------------- 2532 * | ACL denies | | | | 2533 * | write and | Permit | Deny | Deny | 2534 * | execute | | | | 2535 * ------------------------------------------------------- 2536 * ^ 2537 * | 2538 * No search privilege, can't even look up file? 2539 * 2540 */ 2541int 2542zfs_zaccess_delete(znode_t *dzp, znode_t *zp, cred_t *cr, zidmap_t *mnt_ns) 2543{ 2544 uint32_t dzp_working_mode = 0; 2545 uint32_t zp_working_mode = 0; 2546 int dzp_error, zp_error; 2547 mode_t available_perms; 2548 boolean_t dzpcheck_privs = B_TRUE; 2549 boolean_t zpcheck_privs = B_TRUE; 2550 2551 /* 2552 * We want specific DELETE permissions to 2553 * take precedence over WRITE/EXECUTE. We don't 2554 * want an ACL such as this to mess us up. 2555 * user:joe:write_data:deny,user:joe:delete:allow 2556 * 2557 * However, deny permissions may ultimately be overridden 2558 * by secpolicy_vnode_access(). 2559 * 2560 * We will ask for all of the necessary permissions and then 2561 * look at the working modes from the directory and target object 2562 * to determine what was found. 2563 */ 2564 2565 if (zp->z_pflags & (ZFS_IMMUTABLE | ZFS_NOUNLINK)) 2566 return (SET_ERROR(EPERM)); 2567 2568 /* 2569 * First row 2570 * If the directory permissions allow the delete, we are done. 2571 */ 2572 if ((dzp_error = zfs_zaccess_common(dzp, ACE_DELETE_CHILD, 2573 &dzp_working_mode, &dzpcheck_privs, B_FALSE, cr)) == 0) 2574 return (0); 2575 2576 /* 2577 * If target object has delete permission then we are done 2578 */ 2579 if ((zp_error = zfs_zaccess_common(zp, ACE_DELETE, &zp_working_mode, 2580 &zpcheck_privs, B_FALSE, cr)) == 0) 2581 return (0); 2582 2583 ASSERT(dzp_error); 2584 ASSERT(zp_error); 2585 2586 if (!dzpcheck_privs) 2587 return (dzp_error); 2588 if (!zpcheck_privs) 2589 return (zp_error); 2590 2591 /* 2592 * Second row 2593 * 2594 * If directory returns EACCES then delete_child was denied 2595 * due to deny delete_child. In this case send the request through 2596 * secpolicy_vnode_remove(). We don't use zfs_delete_final_check() 2597 * since that *could* allow the delete based on write/execute permission 2598 * and we want delete permissions to override write/execute. 2599 */ 2600 2601 if (dzp_error == EACCES) { 2602 /* XXXPJD: s/dzp/zp/ ? */ 2603 return (secpolicy_vnode_remove(ZTOV(dzp), cr)); 2604 } 2605 /* 2606 * Third Row 2607 * only need to see if we have write/execute on directory. 2608 */ 2609 2610 dzp_error = zfs_zaccess_common(dzp, ACE_EXECUTE|ACE_WRITE_DATA, 2611 &dzp_working_mode, &dzpcheck_privs, B_FALSE, cr); 2612 2613 if (dzp_error != 0 && !dzpcheck_privs) 2614 return (dzp_error); 2615 2616 /* 2617 * Fourth row 2618 */ 2619 2620 available_perms = (dzp_working_mode & ACE_WRITE_DATA) ? 0 : VWRITE; 2621 available_perms |= (dzp_working_mode & ACE_EXECUTE) ? 0 : VEXEC; 2622 2623 return (zfs_delete_final_check(zp, dzp, available_perms, cr)); 2624 2625} 2626 2627int 2628zfs_zaccess_rename(znode_t *sdzp, znode_t *szp, znode_t *tdzp, 2629 znode_t *tzp, cred_t *cr, zidmap_t *mnt_ns) 2630{ 2631 int add_perm; 2632 int error; 2633 2634 if (szp->z_pflags & ZFS_AV_QUARANTINED) 2635 return (SET_ERROR(EACCES)); 2636 2637 add_perm = (ZTOV(szp)->v_type == VDIR) ? 2638 ACE_ADD_SUBDIRECTORY : ACE_ADD_FILE; 2639 2640 /* 2641 * Rename permissions are combination of delete permission + 2642 * add file/subdir permission. 2643 * 2644 * BSD operating systems also require write permission 2645 * on the directory being moved from one parent directory 2646 * to another. 2647 */ 2648 if (ZTOV(szp)->v_type == VDIR && ZTOV(sdzp) != ZTOV(tdzp)) { 2649 if ((error = zfs_zaccess(szp, ACE_WRITE_DATA, 0, B_FALSE, cr, 2650 mnt_ns))) 2651 return (error); 2652 } 2653 2654 /* 2655 * first make sure we do the delete portion. 2656 * 2657 * If that succeeds then check for add_file/add_subdir permissions 2658 */ 2659 2660 if ((error = zfs_zaccess_delete(sdzp, szp, cr, mnt_ns))) 2661 return (error); 2662 2663 /* 2664 * If we have a tzp, see if we can delete it? 2665 */ 2666 if (tzp && (error = zfs_zaccess_delete(tdzp, tzp, cr, mnt_ns))) 2667 return (error); 2668 2669 /* 2670 * Now check for add permissions 2671 */ 2672 error = zfs_zaccess(tdzp, add_perm, 0, B_FALSE, cr, mnt_ns); 2673 2674 return (error); 2675} 2676