1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved. 23 * Copyright 2018 Nexenta Systems, Inc. All rights reserved. 24 */ 25 26 #include <sys/sid.h> 27 #include <sys/nbmlock.h> 28 #include <smbsrv/smb_fsops.h> 29 #include <smbsrv/smb_kproto.h> 30 #include <acl/acl_common.h> 31 #include <sys/fcntl.h> 32 #include <sys/flock.h> 33 #include <fs/fs_subr.h> 34 35 extern caller_context_t smb_ct; 36 37 static int smb_fsop_create_stream(smb_request_t *, cred_t *, smb_node_t *, 38 char *, char *, int, smb_attr_t *, smb_node_t **); 39 40 static int smb_fsop_create_file(smb_request_t *, cred_t *, smb_node_t *, 41 char *, int, smb_attr_t *, smb_node_t **); 42 43 #ifdef _KERNEL 44 static int smb_fsop_create_with_sd(smb_request_t *, cred_t *, smb_node_t *, 45 char *, smb_attr_t *, smb_node_t **, smb_fssd_t *); 46 static int smb_fsop_sdinherit(smb_request_t *, smb_node_t *, smb_fssd_t *); 47 #endif /* _KERNEL */ 48 49 /* 50 * The smb_fsop_* functions have knowledge of CIFS semantics. 51 * 52 * The smb_vop_* functions have minimal knowledge of CIFS semantics and 53 * serve as an interface to the VFS layer. 54 * 55 * Hence, smb_request_t and smb_node_t structures should not be passed 56 * from the smb_fsop_* layer to the smb_vop_* layer. 57 * 58 * In general, CIFS service code should only ever call smb_fsop_* 59 * functions directly, and never smb_vop_* functions directly. 60 * 61 * smb_fsop_* functions should call smb_vop_* functions where possible, instead 62 * of their smb_fsop_* counterparts. However, there are times when 63 * this cannot be avoided. 64 */ 65 66 /* 67 * Note: Stream names cannot be mangled. 68 */ 69 70 /* 71 * smb_fsop_amask_to_omode 72 * 73 * Convert the access mask to the open mode (for use 74 * with the VOP_OPEN call). 75 * 76 * Note that opening a file for attribute only access 77 * will also translate into an FREAD or FWRITE open mode 78 * (i.e., it's not just for data). 79 * 80 * This is needed so that opens are tracked appropriately 81 * for oplock processing. 82 */ 83 84 int 85 smb_fsop_amask_to_omode(uint32_t access) 86 { 87 int mode = 0; 88 89 if (access & (FILE_READ_DATA | FILE_EXECUTE | 90 FILE_READ_ATTRIBUTES | FILE_READ_EA)) 91 mode |= FREAD; 92 93 if (access & (FILE_WRITE_DATA | FILE_APPEND_DATA | 94 FILE_WRITE_ATTRIBUTES | FILE_WRITE_EA)) 95 mode |= FWRITE; 96 97 if (access & FILE_APPEND_DATA) 98 mode |= FAPPEND; 99 100 return (mode); 101 } 102 103 int 104 smb_fsop_open(smb_node_t *node, int mode, cred_t *cred) 105 { 106 /* 107 * Assuming that the same vnode is returned as we had before. 108 * (I.e., with certain types of files or file systems, a 109 * different vnode might be returned by VOP_OPEN) 110 */ 111 return (smb_vop_open(&node->vp, mode, cred)); 112 } 113 114 void 115 smb_fsop_close(smb_node_t *node, int mode, cred_t *cred) 116 { 117 smb_vop_close(node->vp, mode, cred); 118 } 119 120 #ifdef _KERNEL 121 static int 122 smb_fsop_create_with_sd(smb_request_t *sr, cred_t *cr, 123 smb_node_t *dnode, char *name, 124 smb_attr_t *attr, smb_node_t **ret_snode, smb_fssd_t *fs_sd) 125 { 126 vsecattr_t *vsap; 127 vsecattr_t vsecattr; 128 smb_attr_t set_attr; 129 acl_t *acl, *dacl, *sacl; 130 vnode_t *vp; 131 cred_t *kcr = zone_kcred(); 132 int aclbsize = 0; /* size of acl list in bytes */ 133 int flags = 0; 134 int rc; 135 boolean_t is_dir; 136 137 ASSERT(fs_sd); 138 139 if (SMB_TREE_IS_CASEINSENSITIVE(sr)) 140 flags = SMB_IGNORE_CASE; 141 if (SMB_TREE_SUPPORTS_CATIA(sr)) 142 flags |= SMB_CATIA; 143 144 ASSERT(cr); 145 146 is_dir = ((fs_sd->sd_flags & SMB_FSSD_FLAGS_DIR) != 0); 147 148 if (smb_tree_has_feature(sr->tid_tree, SMB_TREE_ACLONCREATE)) { 149 if (fs_sd->sd_secinfo & SMB_ACL_SECINFO) { 150 dacl = fs_sd->sd_zdacl; 151 sacl = fs_sd->sd_zsacl; 152 ASSERT(dacl || sacl); 153 if (dacl && sacl) { 154 acl = smb_fsacl_merge(dacl, sacl); 155 } else if (dacl) { 156 acl = dacl; 157 } else { 158 acl = sacl; 159 } 160 161 rc = smb_fsacl_to_vsa(acl, &vsecattr, &aclbsize); 162 163 if (dacl && sacl) 164 acl_free(acl); 165 166 if (rc != 0) 167 return (rc); 168 169 vsap = &vsecattr; 170 } else { 171 vsap = NULL; 172 } 173 174 /* The tree ACEs may prevent a create */ 175 rc = EACCES; 176 if (is_dir) { 177 if (SMB_TREE_HAS_ACCESS(sr, ACE_ADD_SUBDIRECTORY) != 0) 178 rc = smb_vop_mkdir(dnode->vp, name, attr, 179 &vp, flags, cr, vsap); 180 } else { 181 if (SMB_TREE_HAS_ACCESS(sr, ACE_ADD_FILE) != 0) 182 rc = smb_vop_create(dnode->vp, name, attr, 183 &vp, flags, cr, vsap); 184 } 185 186 if (vsap != NULL) 187 kmem_free(vsap->vsa_aclentp, aclbsize); 188 189 if (rc != 0) 190 return (rc); 191 192 set_attr.sa_mask = 0; 193 194 /* 195 * Ideally we should be able to specify the owner and owning 196 * group at create time along with the ACL. Since we cannot 197 * do that right now, kcred is passed to smb_vop_setattr so it 198 * doesn't fail due to lack of permission. 199 */ 200 if (fs_sd->sd_secinfo & SMB_OWNER_SECINFO) { 201 set_attr.sa_vattr.va_uid = fs_sd->sd_uid; 202 set_attr.sa_mask |= SMB_AT_UID; 203 } 204 205 if (fs_sd->sd_secinfo & SMB_GROUP_SECINFO) { 206 set_attr.sa_vattr.va_gid = fs_sd->sd_gid; 207 set_attr.sa_mask |= SMB_AT_GID; 208 } 209 210 if (set_attr.sa_mask) 211 rc = smb_vop_setattr(vp, NULL, &set_attr, 0, kcr); 212 213 if (rc == 0) { 214 *ret_snode = smb_node_lookup(sr, &sr->arg.open, cr, vp, 215 name, dnode, NULL); 216 217 if (*ret_snode == NULL) 218 rc = ENOMEM; 219 220 VN_RELE(vp); 221 } 222 } else { 223 /* 224 * For filesystems that don't support ACL-on-create, try 225 * to set the specified SD after create, which could actually 226 * fail because of conflicts between inherited security 227 * attributes upon creation and the specified SD. 228 * 229 * Passing kcred to smb_fsop_sdwrite() to overcome this issue. 230 */ 231 232 if (is_dir) { 233 rc = smb_vop_mkdir(dnode->vp, name, attr, &vp, 234 flags, cr, NULL); 235 } else { 236 rc = smb_vop_create(dnode->vp, name, attr, &vp, 237 flags, cr, NULL); 238 } 239 240 if (rc != 0) 241 return (rc); 242 243 *ret_snode = smb_node_lookup(sr, &sr->arg.open, cr, vp, 244 name, dnode, NULL); 245 246 if (*ret_snode != NULL) { 247 if (!smb_tree_has_feature(sr->tid_tree, 248 SMB_TREE_NFS_MOUNTED)) 249 rc = smb_fsop_sdwrite(sr, kcr, *ret_snode, 250 fs_sd, 1); 251 } else { 252 rc = ENOMEM; 253 } 254 255 VN_RELE(vp); 256 } 257 258 if (rc != 0) { 259 if (is_dir) 260 (void) smb_vop_rmdir(dnode->vp, name, flags, cr); 261 else 262 (void) smb_vop_remove(dnode->vp, name, flags, cr); 263 } 264 265 return (rc); 266 } 267 #endif /* _KERNEL */ 268 269 /* 270 * smb_fsop_create 271 * 272 * All SMB functions should use this wrapper to ensure that 273 * all the smb_vop_creates are performed with the appropriate credentials. 274 * Please document any direct calls to explain the reason for avoiding 275 * this wrapper. 276 * 277 * *ret_snode is returned with a reference upon success. No reference is 278 * taken if an error is returned. 279 */ 280 int 281 smb_fsop_create(smb_request_t *sr, cred_t *cr, smb_node_t *dnode, 282 char *name, smb_attr_t *attr, smb_node_t **ret_snode) 283 { 284 int rc = 0; 285 int flags = 0; 286 char *fname, *sname; 287 char *longname = NULL; 288 289 ASSERT(cr); 290 ASSERT(dnode); 291 ASSERT(dnode->n_magic == SMB_NODE_MAGIC); 292 ASSERT(dnode->n_state != SMB_NODE_STATE_DESTROYING); 293 294 ASSERT(ret_snode); 295 *ret_snode = 0; 296 297 ASSERT(name); 298 if (*name == 0) 299 return (EINVAL); 300 301 ASSERT(sr); 302 ASSERT(sr->tid_tree); 303 304 if (SMB_TREE_CONTAINS_NODE(sr, dnode) == 0) 305 return (EACCES); 306 307 if (SMB_TREE_IS_READONLY(sr)) 308 return (EROFS); 309 310 if (SMB_TREE_IS_CASEINSENSITIVE(sr)) 311 flags = SMB_IGNORE_CASE; 312 if (SMB_TREE_SUPPORTS_CATIA(sr)) 313 flags |= SMB_CATIA; 314 if (SMB_TREE_SUPPORTS_ABE(sr)) 315 flags |= SMB_ABE; 316 317 if (smb_is_stream_name(name)) { 318 fname = kmem_alloc(MAXNAMELEN, KM_SLEEP); 319 sname = kmem_alloc(MAXNAMELEN, KM_SLEEP); 320 smb_stream_parse_name(name, fname, sname); 321 322 rc = smb_fsop_create_stream(sr, cr, dnode, 323 fname, sname, flags, attr, ret_snode); 324 325 kmem_free(fname, MAXNAMELEN); 326 kmem_free(sname, MAXNAMELEN); 327 return (rc); 328 } 329 330 /* Not a named stream */ 331 332 if (SMB_TREE_SUPPORTS_SHORTNAMES(sr) && smb_maybe_mangled(name)) { 333 longname = kmem_alloc(MAXNAMELEN, KM_SLEEP); 334 rc = smb_unmangle(dnode, name, longname, MAXNAMELEN, flags); 335 kmem_free(longname, MAXNAMELEN); 336 337 if (rc == 0) 338 rc = EEXIST; 339 if (rc != ENOENT) 340 return (rc); 341 } 342 343 rc = smb_fsop_create_file(sr, cr, dnode, name, flags, 344 attr, ret_snode); 345 return (rc); 346 347 } 348 349 350 /* 351 * smb_fsop_create_stream 352 * 353 * Create NTFS named stream file (sname) on unnamed stream 354 * file (fname), creating the unnamed stream file if it 355 * doesn't exist. 356 * If we created the unnamed stream file and then creation 357 * of the named stream file fails, we delete the unnamed stream. 358 * Since we use the real file name for the smb_vop_remove we 359 * clear the SMB_IGNORE_CASE flag to ensure a case sensitive 360 * match. 361 * 362 * The second parameter of smb_vop_setattr() is set to 363 * NULL, even though an unnamed stream exists. This is 364 * because we want to set the UID and GID on the named 365 * stream in this case for consistency with the (unnamed 366 * stream) file (see comments for smb_vop_setattr()). 367 */ 368 static int 369 smb_fsop_create_stream(smb_request_t *sr, cred_t *cr, 370 smb_node_t *dnode, char *fname, char *sname, int flags, 371 smb_attr_t *attr, smb_node_t **ret_snode) 372 { 373 smb_attr_t fattr; 374 smb_node_t *fnode; 375 vnode_t *xattrdvp; 376 vnode_t *vp; 377 cred_t *kcr = zone_kcred(); 378 int rc = 0; 379 boolean_t fcreate = B_FALSE; 380 381 /* Look up / create the unnamed stream, fname */ 382 rc = smb_fsop_lookup(sr, cr, flags | SMB_FOLLOW_LINKS, 383 sr->tid_tree->t_snode, dnode, fname, &fnode); 384 if (rc == 0) { 385 if (smb_fsop_access(sr, sr->user_cr, fnode, 386 sr->sr_open.desired_access) != 0) 387 rc = EACCES; 388 } else if (rc == ENOENT) { 389 fcreate = B_TRUE; 390 rc = smb_fsop_create_file(sr, cr, dnode, fname, flags, 391 attr, &fnode); 392 } 393 if (rc != 0) 394 return (rc); 395 396 fattr.sa_mask = SMB_AT_UID | SMB_AT_GID; 397 rc = smb_vop_getattr(fnode->vp, NULL, &fattr, 0, kcr); 398 399 if (rc == 0) { 400 /* create the named stream, sname */ 401 rc = smb_vop_stream_create(fnode->vp, sname, attr, 402 &vp, &xattrdvp, flags, cr); 403 } 404 if (rc != 0) { 405 if (fcreate) { 406 flags &= ~SMB_IGNORE_CASE; 407 (void) smb_vop_remove(dnode->vp, 408 fnode->od_name, flags, cr); 409 } 410 smb_node_release(fnode); 411 return (rc); 412 } 413 414 attr->sa_vattr.va_uid = fattr.sa_vattr.va_uid; 415 attr->sa_vattr.va_gid = fattr.sa_vattr.va_gid; 416 attr->sa_mask = SMB_AT_UID | SMB_AT_GID; 417 418 rc = smb_vop_setattr(vp, NULL, attr, 0, kcr); 419 if (rc != 0) { 420 smb_node_release(fnode); 421 return (rc); 422 } 423 424 *ret_snode = smb_stream_node_lookup(sr, cr, fnode, xattrdvp, 425 vp, sname); 426 427 smb_node_release(fnode); 428 VN_RELE(xattrdvp); 429 VN_RELE(vp); 430 431 if (*ret_snode == NULL) 432 rc = ENOMEM; 433 434 /* notify change to the unnamed stream */ 435 if (rc == 0) 436 smb_node_notify_change(dnode, 437 FILE_ACTION_ADDED_STREAM, fname); 438 439 return (rc); 440 } 441 442 /* 443 * smb_fsop_create_file 444 */ 445 static int 446 smb_fsop_create_file(smb_request_t *sr, cred_t *cr, 447 smb_node_t *dnode, char *name, int flags, 448 smb_attr_t *attr, smb_node_t **ret_snode) 449 { 450 smb_arg_open_t *op = &sr->sr_open; 451 vnode_t *vp; 452 int rc; 453 454 #ifdef _KERNEL 455 smb_fssd_t fs_sd; 456 uint32_t secinfo; 457 uint32_t status; 458 459 if (op->sd) { 460 /* 461 * SD sent by client in Windows format. Needs to be 462 * converted to FS format. No inheritance. 463 */ 464 secinfo = smb_sd_get_secinfo(op->sd); 465 smb_fssd_init(&fs_sd, secinfo, 0); 466 467 status = smb_sd_tofs(op->sd, &fs_sd); 468 if (status == NT_STATUS_SUCCESS) { 469 rc = smb_fsop_create_with_sd(sr, cr, dnode, 470 name, attr, ret_snode, &fs_sd); 471 } else { 472 rc = EINVAL; 473 } 474 smb_fssd_term(&fs_sd); 475 } else if (sr->tid_tree->t_acltype == ACE_T) { 476 /* 477 * No incoming SD and filesystem is ZFS 478 * Server applies Windows inheritance rules, 479 * see smb_fsop_sdinherit() comments as to why. 480 */ 481 smb_fssd_init(&fs_sd, SMB_ACL_SECINFO, 0); 482 rc = smb_fsop_sdinherit(sr, dnode, &fs_sd); 483 if (rc == 0) { 484 rc = smb_fsop_create_with_sd(sr, cr, dnode, 485 name, attr, ret_snode, &fs_sd); 486 } 487 488 smb_fssd_term(&fs_sd); 489 } else 490 #endif /* _KERNEL */ 491 { 492 /* 493 * No incoming SD and filesystem is not ZFS 494 * let the filesystem handles the inheritance. 495 */ 496 rc = smb_vop_create(dnode->vp, name, attr, &vp, 497 flags, cr, NULL); 498 499 if (rc == 0) { 500 *ret_snode = smb_node_lookup(sr, op, cr, vp, 501 name, dnode, NULL); 502 503 if (*ret_snode == NULL) 504 rc = ENOMEM; 505 506 VN_RELE(vp); 507 } 508 509 } 510 511 if (rc == 0) 512 smb_node_notify_change(dnode, FILE_ACTION_ADDED, name); 513 514 return (rc); 515 } 516 517 /* 518 * smb_fsop_mkdir 519 * 520 * All SMB functions should use this wrapper to ensure that 521 * the the calls are performed with the appropriate credentials. 522 * Please document any direct call to explain the reason 523 * for avoiding this wrapper. 524 * 525 * It is assumed that a reference exists on snode coming into this routine. 526 * 527 * *ret_snode is returned with a reference upon success. No reference is 528 * taken if an error is returned. 529 */ 530 int 531 smb_fsop_mkdir( 532 smb_request_t *sr, 533 cred_t *cr, 534 smb_node_t *dnode, 535 char *name, 536 smb_attr_t *attr, 537 smb_node_t **ret_snode) 538 { 539 struct open_param *op = &sr->arg.open; 540 char *longname; 541 vnode_t *vp; 542 int flags = 0; 543 int rc; 544 545 #ifdef _KERNEL 546 smb_fssd_t fs_sd; 547 uint32_t secinfo; 548 uint32_t status; 549 #endif /* _KERNEL */ 550 551 ASSERT(cr); 552 ASSERT(dnode); 553 ASSERT(dnode->n_magic == SMB_NODE_MAGIC); 554 ASSERT(dnode->n_state != SMB_NODE_STATE_DESTROYING); 555 556 ASSERT(ret_snode); 557 *ret_snode = 0; 558 559 ASSERT(name); 560 if (*name == 0) 561 return (EINVAL); 562 563 ASSERT(sr); 564 ASSERT(sr->tid_tree); 565 566 if (SMB_TREE_CONTAINS_NODE(sr, dnode) == 0) 567 return (EACCES); 568 569 if (SMB_TREE_IS_READONLY(sr)) 570 return (EROFS); 571 if (SMB_TREE_SUPPORTS_CATIA(sr)) 572 flags |= SMB_CATIA; 573 if (SMB_TREE_SUPPORTS_ABE(sr)) 574 flags |= SMB_ABE; 575 576 if (SMB_TREE_SUPPORTS_SHORTNAMES(sr) && smb_maybe_mangled(name)) { 577 longname = kmem_alloc(MAXNAMELEN, KM_SLEEP); 578 rc = smb_unmangle(dnode, name, longname, MAXNAMELEN, flags); 579 kmem_free(longname, MAXNAMELEN); 580 581 /* 582 * If the name passed in by the client has an unmangled 583 * equivalent that is found in the specified directory, 584 * then the mkdir cannot succeed. Return EEXIST. 585 * 586 * Only if ENOENT is returned will a mkdir be attempted. 587 */ 588 589 if (rc == 0) 590 rc = EEXIST; 591 592 if (rc != ENOENT) 593 return (rc); 594 } 595 596 if (SMB_TREE_IS_CASEINSENSITIVE(sr)) 597 flags = SMB_IGNORE_CASE; 598 599 #ifdef _KERNEL 600 if (op->sd) { 601 /* 602 * SD sent by client in Windows format. Needs to be 603 * converted to FS format. No inheritance. 604 */ 605 secinfo = smb_sd_get_secinfo(op->sd); 606 smb_fssd_init(&fs_sd, secinfo, SMB_FSSD_FLAGS_DIR); 607 608 status = smb_sd_tofs(op->sd, &fs_sd); 609 if (status == NT_STATUS_SUCCESS) { 610 rc = smb_fsop_create_with_sd(sr, cr, dnode, 611 name, attr, ret_snode, &fs_sd); 612 } 613 else 614 rc = EINVAL; 615 smb_fssd_term(&fs_sd); 616 } else if (sr->tid_tree->t_acltype == ACE_T) { 617 /* 618 * No incoming SD and filesystem is ZFS 619 * Server applies Windows inheritance rules, 620 * see smb_fsop_sdinherit() comments as to why. 621 */ 622 smb_fssd_init(&fs_sd, SMB_ACL_SECINFO, SMB_FSSD_FLAGS_DIR); 623 rc = smb_fsop_sdinherit(sr, dnode, &fs_sd); 624 if (rc == 0) { 625 rc = smb_fsop_create_with_sd(sr, cr, dnode, 626 name, attr, ret_snode, &fs_sd); 627 } 628 629 smb_fssd_term(&fs_sd); 630 631 } else 632 #endif /* _KERNEL */ 633 { 634 rc = smb_vop_mkdir(dnode->vp, name, attr, &vp, flags, cr, 635 NULL); 636 637 if (rc == 0) { 638 *ret_snode = smb_node_lookup(sr, op, cr, vp, name, 639 dnode, NULL); 640 641 if (*ret_snode == NULL) 642 rc = ENOMEM; 643 644 VN_RELE(vp); 645 } 646 } 647 648 if (rc == 0) 649 smb_node_notify_change(dnode, FILE_ACTION_ADDED, name); 650 651 return (rc); 652 } 653 654 /* 655 * smb_fsop_remove 656 * 657 * All SMB functions should use this wrapper to ensure that 658 * the the calls are performed with the appropriate credentials. 659 * Please document any direct call to explain the reason 660 * for avoiding this wrapper. 661 * 662 * It is assumed that a reference exists on snode coming into this routine. 663 * 664 * A null smb_request might be passed to this function. 665 */ 666 int 667 smb_fsop_remove( 668 smb_request_t *sr, 669 cred_t *cr, 670 smb_node_t *dnode, 671 char *name, 672 uint32_t flags) 673 { 674 smb_node_t *fnode; 675 char *longname; 676 char *fname; 677 char *sname; 678 int rc; 679 680 ASSERT(cr); 681 /* 682 * The state of the node could be SMB_NODE_STATE_DESTROYING if this 683 * function is called during the deletion of the node (because of 684 * DELETE_ON_CLOSE). 685 */ 686 ASSERT(dnode); 687 ASSERT(dnode->n_magic == SMB_NODE_MAGIC); 688 689 if (SMB_TREE_CONTAINS_NODE(sr, dnode) == 0 || 690 SMB_TREE_HAS_ACCESS(sr, ACE_DELETE) == 0) 691 return (EACCES); 692 693 if (SMB_TREE_IS_READONLY(sr)) 694 return (EROFS); 695 696 fname = kmem_alloc(MAXNAMELEN, KM_SLEEP); 697 sname = kmem_alloc(MAXNAMELEN, KM_SLEEP); 698 699 if (dnode->flags & NODE_XATTR_DIR) { 700 fnode = dnode->n_dnode; 701 rc = smb_vop_stream_remove(fnode->vp, name, flags, cr); 702 703 /* notify change to the unnamed stream */ 704 if ((rc == 0) && fnode->n_dnode) { 705 smb_node_notify_change(fnode->n_dnode, 706 FILE_ACTION_REMOVED_STREAM, fnode->od_name); 707 } 708 } else if (smb_is_stream_name(name)) { 709 smb_stream_parse_name(name, fname, sname); 710 711 /* 712 * Look up the unnamed stream (i.e. fname). 713 * Unmangle processing will be done on fname 714 * as well as any link target. 715 */ 716 717 rc = smb_fsop_lookup(sr, cr, flags | SMB_FOLLOW_LINKS, 718 sr->tid_tree->t_snode, dnode, fname, &fnode); 719 720 if (rc != 0) { 721 kmem_free(fname, MAXNAMELEN); 722 kmem_free(sname, MAXNAMELEN); 723 return (rc); 724 } 725 726 /* 727 * XXX 728 * Need to find out what permission is required by NTFS 729 * to remove a stream. 730 */ 731 rc = smb_vop_stream_remove(fnode->vp, sname, flags, cr); 732 733 smb_node_release(fnode); 734 735 /* notify change to the unnamed stream */ 736 if (rc == 0) { 737 smb_node_notify_change(dnode, 738 FILE_ACTION_REMOVED_STREAM, fname); 739 } 740 } else { 741 rc = smb_vop_remove(dnode->vp, name, flags, cr); 742 743 if (rc == ENOENT) { 744 if (!SMB_TREE_SUPPORTS_SHORTNAMES(sr) || 745 !smb_maybe_mangled(name)) { 746 kmem_free(fname, MAXNAMELEN); 747 kmem_free(sname, MAXNAMELEN); 748 return (rc); 749 } 750 longname = kmem_alloc(MAXNAMELEN, KM_SLEEP); 751 752 if (SMB_TREE_SUPPORTS_ABE(sr)) 753 flags |= SMB_ABE; 754 755 rc = smb_unmangle(dnode, name, longname, MAXNAMELEN, 756 flags); 757 758 if (rc == 0) { 759 /* 760 * longname is the real (case-sensitive) 761 * on-disk name. 762 * We make sure we do a remove on this exact 763 * name, as the name was mangled and denotes 764 * a unique file. 765 */ 766 flags &= ~SMB_IGNORE_CASE; 767 rc = smb_vop_remove(dnode->vp, longname, 768 flags, cr); 769 } 770 kmem_free(longname, MAXNAMELEN); 771 } 772 if (rc == 0) { 773 smb_node_notify_change(dnode, 774 FILE_ACTION_REMOVED, name); 775 } 776 } 777 778 kmem_free(fname, MAXNAMELEN); 779 kmem_free(sname, MAXNAMELEN); 780 781 return (rc); 782 } 783 784 /* 785 * smb_fsop_remove_streams 786 * 787 * This function removes a file's streams without removing the 788 * file itself. 789 * 790 * It is assumed that fnode is not a link. 791 */ 792 uint32_t 793 smb_fsop_remove_streams(smb_request_t *sr, cred_t *cr, smb_node_t *fnode) 794 { 795 int rc, flags = 0; 796 smb_odir_t *od; 797 smb_odirent_t *odirent; 798 uint32_t status; 799 boolean_t eos; 800 801 ASSERT(sr); 802 ASSERT(cr); 803 ASSERT(fnode); 804 ASSERT(fnode->n_magic == SMB_NODE_MAGIC); 805 ASSERT(fnode->n_state != SMB_NODE_STATE_DESTROYING); 806 807 if (SMB_TREE_CONTAINS_NODE(sr, fnode) == 0) 808 return (NT_STATUS_ACCESS_DENIED); 809 810 if (SMB_TREE_IS_READONLY(sr)) 811 return (NT_STATUS_ACCESS_DENIED); 812 813 if (SMB_TREE_IS_CASEINSENSITIVE(sr)) 814 flags = SMB_IGNORE_CASE; 815 816 if (SMB_TREE_SUPPORTS_CATIA(sr)) 817 flags |= SMB_CATIA; 818 819 status = smb_odir_openat(sr, fnode, &od); 820 switch (status) { 821 case 0: 822 break; 823 case NT_STATUS_NO_SUCH_FILE: 824 case NT_STATUS_NOT_SUPPORTED: 825 /* No streams to remove. */ 826 return (0); 827 default: 828 return (status); 829 } 830 831 odirent = kmem_alloc(sizeof (smb_odirent_t), KM_SLEEP); 832 for (;;) { 833 rc = smb_odir_read(sr, od, odirent, &eos); 834 if ((rc != 0) || (eos)) 835 break; 836 (void) smb_vop_remove(od->d_dnode->vp, odirent->od_name, 837 flags, cr); 838 } 839 kmem_free(odirent, sizeof (smb_odirent_t)); 840 if (eos && rc == ENOENT) 841 rc = 0; 842 843 smb_odir_close(od); 844 smb_odir_release(od); 845 if (rc) 846 status = smb_errno2status(rc); 847 return (status); 848 } 849 850 /* 851 * smb_fsop_rmdir 852 * 853 * All SMB functions should use this wrapper to ensure that 854 * the the calls are performed with the appropriate credentials. 855 * Please document any direct call to explain the reason 856 * for avoiding this wrapper. 857 * 858 * It is assumed that a reference exists on snode coming into this routine. 859 */ 860 int 861 smb_fsop_rmdir( 862 smb_request_t *sr, 863 cred_t *cr, 864 smb_node_t *dnode, 865 char *name, 866 uint32_t flags) 867 { 868 int rc; 869 char *longname; 870 871 ASSERT(cr); 872 /* 873 * The state of the node could be SMB_NODE_STATE_DESTROYING if this 874 * function is called during the deletion of the node (because of 875 * DELETE_ON_CLOSE). 876 */ 877 ASSERT(dnode); 878 ASSERT(dnode->n_magic == SMB_NODE_MAGIC); 879 880 if (SMB_TREE_CONTAINS_NODE(sr, dnode) == 0 || 881 SMB_TREE_HAS_ACCESS(sr, ACE_DELETE_CHILD) == 0) 882 return (EACCES); 883 884 if (SMB_TREE_IS_READONLY(sr)) 885 return (EROFS); 886 887 rc = smb_vop_rmdir(dnode->vp, name, flags, cr); 888 889 if (rc == ENOENT) { 890 if (!SMB_TREE_SUPPORTS_SHORTNAMES(sr) || 891 !smb_maybe_mangled(name)) { 892 return (rc); 893 } 894 895 longname = kmem_alloc(MAXNAMELEN, KM_SLEEP); 896 897 if (SMB_TREE_SUPPORTS_ABE(sr)) 898 flags |= SMB_ABE; 899 rc = smb_unmangle(dnode, name, longname, MAXNAMELEN, flags); 900 901 if (rc == 0) { 902 /* 903 * longname is the real (case-sensitive) 904 * on-disk name. 905 * We make sure we do a rmdir on this exact 906 * name, as the name was mangled and denotes 907 * a unique directory. 908 */ 909 flags &= ~SMB_IGNORE_CASE; 910 rc = smb_vop_rmdir(dnode->vp, longname, flags, cr); 911 } 912 913 kmem_free(longname, MAXNAMELEN); 914 } 915 916 if (rc == 0) 917 smb_node_notify_change(dnode, FILE_ACTION_REMOVED, name); 918 919 return (rc); 920 } 921 922 /* 923 * smb_fsop_getattr 924 * 925 * All SMB functions should use this wrapper to ensure that 926 * the the calls are performed with the appropriate credentials. 927 * Please document any direct call to explain the reason 928 * for avoiding this wrapper. 929 * 930 * It is assumed that a reference exists on snode coming into this routine. 931 */ 932 int 933 smb_fsop_getattr(smb_request_t *sr, cred_t *cr, smb_node_t *snode, 934 smb_attr_t *attr) 935 { 936 smb_node_t *unnamed_node; 937 vnode_t *unnamed_vp = NULL; 938 uint32_t status; 939 uint32_t access = 0; 940 int flags = 0; 941 int rc; 942 943 ASSERT(cr); 944 ASSERT(snode); 945 ASSERT(snode->n_magic == SMB_NODE_MAGIC); 946 ASSERT(snode->n_state != SMB_NODE_STATE_DESTROYING); 947 948 if (SMB_TREE_CONTAINS_NODE(sr, snode) == 0 || 949 SMB_TREE_HAS_ACCESS(sr, ACE_READ_ATTRIBUTES) == 0) 950 return (EACCES); 951 952 /* sr could be NULL in some cases */ 953 if (sr && sr->fid_ofile) { 954 /* if uid and/or gid is requested */ 955 if (attr->sa_mask & (SMB_AT_UID|SMB_AT_GID)) 956 access |= READ_CONTROL; 957 958 /* if anything else is also requested */ 959 if (attr->sa_mask & ~(SMB_AT_UID|SMB_AT_GID)) 960 access |= FILE_READ_ATTRIBUTES; 961 962 status = smb_ofile_access(sr->fid_ofile, cr, access); 963 if (status != NT_STATUS_SUCCESS) 964 return (EACCES); 965 966 if (smb_tree_has_feature(sr->tid_tree, 967 SMB_TREE_ACEMASKONACCESS)) 968 flags = ATTR_NOACLCHECK; 969 } 970 971 unnamed_node = SMB_IS_STREAM(snode); 972 973 if (unnamed_node) { 974 ASSERT(unnamed_node->n_magic == SMB_NODE_MAGIC); 975 ASSERT(unnamed_node->n_state != SMB_NODE_STATE_DESTROYING); 976 unnamed_vp = unnamed_node->vp; 977 } 978 979 rc = smb_vop_getattr(snode->vp, unnamed_vp, attr, flags, cr); 980 981 if ((rc == 0) && smb_node_is_dfslink(snode)) { 982 /* a DFS link should be treated as a directory */ 983 attr->sa_dosattr |= FILE_ATTRIBUTE_DIRECTORY; 984 } 985 986 return (rc); 987 } 988 989 /* 990 * smb_fsop_link 991 * 992 * All SMB functions should use this smb_vop_link wrapper to ensure that 993 * the smb_vop_link is performed with the appropriate credentials. 994 * Please document any direct call to smb_vop_link to explain the reason 995 * for avoiding this wrapper. 996 * 997 * It is assumed that references exist on from_dnode and to_dnode coming 998 * into this routine. 999 */ 1000 int 1001 smb_fsop_link(smb_request_t *sr, cred_t *cr, smb_node_t *from_fnode, 1002 smb_node_t *to_dnode, char *to_name) 1003 { 1004 char *longname = NULL; 1005 int flags = 0; 1006 int rc; 1007 1008 ASSERT(sr); 1009 ASSERT(sr->tid_tree); 1010 ASSERT(cr); 1011 ASSERT(to_dnode); 1012 ASSERT(to_dnode->n_magic == SMB_NODE_MAGIC); 1013 ASSERT(to_dnode->n_state != SMB_NODE_STATE_DESTROYING); 1014 ASSERT(from_fnode); 1015 ASSERT(from_fnode->n_magic == SMB_NODE_MAGIC); 1016 ASSERT(from_fnode->n_state != SMB_NODE_STATE_DESTROYING); 1017 1018 if (SMB_TREE_CONTAINS_NODE(sr, from_fnode) == 0) 1019 return (EACCES); 1020 1021 if (SMB_TREE_CONTAINS_NODE(sr, to_dnode) == 0) 1022 return (EACCES); 1023 1024 if (SMB_TREE_IS_READONLY(sr)) 1025 return (EROFS); 1026 1027 if (SMB_TREE_IS_CASEINSENSITIVE(sr)) 1028 flags = SMB_IGNORE_CASE; 1029 if (SMB_TREE_SUPPORTS_CATIA(sr)) 1030 flags |= SMB_CATIA; 1031 if (SMB_TREE_SUPPORTS_ABE(sr)) 1032 flags |= SMB_ABE; 1033 1034 if (SMB_TREE_SUPPORTS_SHORTNAMES(sr) && smb_maybe_mangled(to_name)) { 1035 longname = kmem_alloc(MAXNAMELEN, KM_SLEEP); 1036 rc = smb_unmangle(to_dnode, to_name, longname, 1037 MAXNAMELEN, flags); 1038 kmem_free(longname, MAXNAMELEN); 1039 1040 if (rc == 0) 1041 rc = EEXIST; 1042 if (rc != ENOENT) 1043 return (rc); 1044 } 1045 1046 rc = smb_vop_link(to_dnode->vp, from_fnode->vp, to_name, flags, cr); 1047 1048 if (rc == 0) 1049 smb_node_notify_change(to_dnode, FILE_ACTION_ADDED, to_name); 1050 1051 return (rc); 1052 } 1053 1054 /* 1055 * smb_fsop_rename 1056 * 1057 * All SMB functions should use this smb_vop_rename wrapper to ensure that 1058 * the smb_vop_rename is performed with the appropriate credentials. 1059 * Please document any direct call to smb_vop_rename to explain the reason 1060 * for avoiding this wrapper. 1061 * 1062 * It is assumed that references exist on from_dnode and to_dnode coming 1063 * into this routine. 1064 */ 1065 int 1066 smb_fsop_rename( 1067 smb_request_t *sr, 1068 cred_t *cr, 1069 smb_node_t *from_dnode, 1070 char *from_name, 1071 smb_node_t *to_dnode, 1072 char *to_name) 1073 { 1074 smb_node_t *from_snode; 1075 smb_attr_t from_attr; 1076 vnode_t *from_vp; 1077 int flags = 0, ret_flags; 1078 int rc; 1079 boolean_t isdir; 1080 1081 ASSERT(cr); 1082 ASSERT(from_dnode); 1083 ASSERT(from_dnode->n_magic == SMB_NODE_MAGIC); 1084 ASSERT(from_dnode->n_state != SMB_NODE_STATE_DESTROYING); 1085 1086 ASSERT(to_dnode); 1087 ASSERT(to_dnode->n_magic == SMB_NODE_MAGIC); 1088 ASSERT(to_dnode->n_state != SMB_NODE_STATE_DESTROYING); 1089 1090 if (SMB_TREE_CONTAINS_NODE(sr, from_dnode) == 0) 1091 return (EACCES); 1092 1093 if (SMB_TREE_CONTAINS_NODE(sr, to_dnode) == 0) 1094 return (EACCES); 1095 1096 ASSERT(sr); 1097 ASSERT(sr->tid_tree); 1098 if (SMB_TREE_IS_READONLY(sr)) 1099 return (EROFS); 1100 1101 /* 1102 * Note: There is no need to check SMB_TREE_IS_CASEINSENSITIVE 1103 * here. 1104 * 1105 * A case-sensitive rename is always done in this routine 1106 * because we are using the on-disk name from an earlier lookup. 1107 * If a mangled name was passed in by the caller (denoting a 1108 * deterministic lookup), then the exact file must be renamed 1109 * (i.e. SMB_IGNORE_CASE must not be passed to VOP_RENAME, or 1110 * else the underlying file system might return a "first-match" 1111 * on this on-disk name, possibly resulting in the wrong file). 1112 */ 1113 1114 if (SMB_TREE_SUPPORTS_CATIA(sr)) 1115 flags |= SMB_CATIA; 1116 1117 /* 1118 * XXX: Lock required through smb_node_release() below? 1119 */ 1120 1121 rc = smb_vop_lookup(from_dnode->vp, from_name, &from_vp, NULL, 1122 flags, &ret_flags, NULL, &from_attr, cr); 1123 1124 if (rc != 0) 1125 return (rc); 1126 1127 if (from_attr.sa_dosattr & FILE_ATTRIBUTE_REPARSE_POINT) { 1128 VN_RELE(from_vp); 1129 return (EACCES); 1130 } 1131 1132 isdir = ((from_attr.sa_dosattr & FILE_ATTRIBUTE_DIRECTORY) != 0); 1133 1134 if ((isdir && SMB_TREE_HAS_ACCESS(sr, 1135 ACE_DELETE_CHILD | ACE_ADD_SUBDIRECTORY) != 1136 (ACE_DELETE_CHILD | ACE_ADD_SUBDIRECTORY)) || 1137 (!isdir && SMB_TREE_HAS_ACCESS(sr, ACE_DELETE | ACE_ADD_FILE) != 1138 (ACE_DELETE | ACE_ADD_FILE))) { 1139 VN_RELE(from_vp); 1140 return (EACCES); 1141 } 1142 1143 /* 1144 * SMB checks access on open and retains an access granted 1145 * mask for use while the file is open. ACL changes should 1146 * not affect access to an open file. 1147 * 1148 * If the rename is being performed on an ofile: 1149 * - Check the ofile's access granted mask to see if the 1150 * rename is permitted - requires DELETE access. 1151 * - If the file system does access checking, set the 1152 * ATTR_NOACLCHECK flag to ensure that the file system 1153 * does not check permissions on subsequent calls. 1154 */ 1155 if (sr && sr->fid_ofile) { 1156 rc = smb_ofile_access(sr->fid_ofile, cr, DELETE); 1157 if (rc != NT_STATUS_SUCCESS) { 1158 VN_RELE(from_vp); 1159 return (EACCES); 1160 } 1161 1162 if (smb_tree_has_feature(sr->tid_tree, 1163 SMB_TREE_ACEMASKONACCESS)) 1164 flags = ATTR_NOACLCHECK; 1165 } 1166 1167 rc = smb_vop_rename(from_dnode->vp, from_name, to_dnode->vp, 1168 to_name, flags, cr); 1169 1170 if (rc == 0) { 1171 from_snode = smb_node_lookup(sr, NULL, cr, from_vp, from_name, 1172 from_dnode, NULL); 1173 1174 if (from_snode == NULL) { 1175 rc = ENOMEM; 1176 } else { 1177 smb_node_rename(from_dnode, from_snode, 1178 to_dnode, to_name); 1179 smb_node_release(from_snode); 1180 } 1181 } 1182 VN_RELE(from_vp); 1183 1184 if (rc == 0) { 1185 if (from_dnode == to_dnode) { 1186 smb_node_notify_change(from_dnode, 1187 FILE_ACTION_RENAMED_OLD_NAME, from_name); 1188 smb_node_notify_change(to_dnode, 1189 FILE_ACTION_RENAMED_NEW_NAME, to_name); 1190 } else { 1191 smb_node_notify_change(from_dnode, 1192 FILE_ACTION_REMOVED, from_name); 1193 smb_node_notify_change(to_dnode, 1194 FILE_ACTION_ADDED, to_name); 1195 } 1196 } 1197 1198 /* XXX: unlock */ 1199 1200 return (rc); 1201 } 1202 1203 /* 1204 * smb_fsop_setattr 1205 * 1206 * All SMB functions should use this wrapper to ensure that 1207 * the the calls are performed with the appropriate credentials. 1208 * Please document any direct call to explain the reason 1209 * for avoiding this wrapper. 1210 * 1211 * It is assumed that a reference exists on snode coming into 1212 * this function. 1213 * A null smb_request might be passed to this function. 1214 */ 1215 int 1216 smb_fsop_setattr( 1217 smb_request_t *sr, 1218 cred_t *cr, 1219 smb_node_t *snode, 1220 smb_attr_t *set_attr) 1221 { 1222 smb_node_t *unnamed_node; 1223 vnode_t *unnamed_vp = NULL; 1224 uint32_t status; 1225 uint32_t access; 1226 int rc = 0; 1227 int flags = 0; 1228 uint_t sa_mask; 1229 1230 ASSERT(cr); 1231 ASSERT(snode); 1232 ASSERT(snode->n_magic == SMB_NODE_MAGIC); 1233 ASSERT(snode->n_state != SMB_NODE_STATE_DESTROYING); 1234 1235 if (SMB_TREE_CONTAINS_NODE(sr, snode) == 0) 1236 return (EACCES); 1237 1238 if (SMB_TREE_IS_READONLY(sr)) 1239 return (EROFS); 1240 1241 if (SMB_TREE_HAS_ACCESS(sr, 1242 ACE_WRITE_ATTRIBUTES | ACE_WRITE_NAMED_ATTRS) == 0) 1243 return (EACCES); 1244 1245 /* 1246 * The file system cannot detect pending READDONLY 1247 * (i.e. if the file has been opened readonly but 1248 * not yet closed) so we need to test READONLY here. 1249 * 1250 * Note that file handle that were opened before the 1251 * READONLY flag was set in the node (or the FS) are 1252 * immune to that change, and remain writable. 1253 */ 1254 if (sr && (set_attr->sa_mask & SMB_AT_SIZE)) { 1255 if (sr->fid_ofile) { 1256 if (SMB_OFILE_IS_READONLY(sr->fid_ofile)) 1257 return (EACCES); 1258 } else { 1259 if (SMB_PATHFILE_IS_READONLY(sr, snode)) 1260 return (EACCES); 1261 } 1262 } 1263 1264 /* 1265 * SMB checks access on open and retains an access granted 1266 * mask for use while the file is open. ACL changes should 1267 * not affect access to an open file. 1268 * 1269 * If the setattr is being performed on an ofile: 1270 * - Check the ofile's access granted mask to see if the 1271 * setattr is permitted. 1272 * UID, GID - require WRITE_OWNER 1273 * SIZE, ALLOCSZ - require FILE_WRITE_DATA 1274 * all other attributes require FILE_WRITE_ATTRIBUTES 1275 * 1276 * - If the file system does access checking, set the 1277 * ATTR_NOACLCHECK flag to ensure that the file system 1278 * does not check permissions on subsequent calls. 1279 */ 1280 if (sr && sr->fid_ofile) { 1281 sa_mask = set_attr->sa_mask; 1282 access = 0; 1283 1284 if (sa_mask & (SMB_AT_SIZE | SMB_AT_ALLOCSZ)) { 1285 access |= FILE_WRITE_DATA; 1286 sa_mask &= ~(SMB_AT_SIZE | SMB_AT_ALLOCSZ); 1287 } 1288 1289 if (sa_mask & (SMB_AT_UID|SMB_AT_GID)) { 1290 access |= WRITE_OWNER; 1291 sa_mask &= ~(SMB_AT_UID|SMB_AT_GID); 1292 } 1293 1294 if (sa_mask) 1295 access |= FILE_WRITE_ATTRIBUTES; 1296 1297 status = smb_ofile_access(sr->fid_ofile, cr, access); 1298 if (status != NT_STATUS_SUCCESS) 1299 return (EACCES); 1300 1301 if (smb_tree_has_feature(sr->tid_tree, 1302 SMB_TREE_ACEMASKONACCESS)) 1303 flags = ATTR_NOACLCHECK; 1304 } 1305 1306 unnamed_node = SMB_IS_STREAM(snode); 1307 1308 if (unnamed_node) { 1309 ASSERT(unnamed_node->n_magic == SMB_NODE_MAGIC); 1310 ASSERT(unnamed_node->n_state != SMB_NODE_STATE_DESTROYING); 1311 unnamed_vp = unnamed_node->vp; 1312 } 1313 1314 rc = smb_vop_setattr(snode->vp, unnamed_vp, set_attr, flags, cr); 1315 return (rc); 1316 } 1317 1318 /* 1319 * Support for SMB2 setinfo FileValidDataLengthInformation. 1320 * Free data from the specified offset to EoF. 1321 * 1322 * This can effectively truncate data. It truncates the data 1323 * leaving the file size as it was, leaving zeros after the 1324 * offset specified here. That is effectively modifying the 1325 * file content, so for access control this is a write. 1326 */ 1327 int 1328 smb_fsop_set_data_length( 1329 smb_request_t *sr, 1330 cred_t *cr, 1331 smb_node_t *node, 1332 offset_t end_of_data) 1333 { 1334 flock64_t flk; 1335 uint32_t status; 1336 uint32_t access = FILE_WRITE_DATA; 1337 int rc; 1338 1339 ASSERT(cr); 1340 ASSERT(node); 1341 ASSERT(node->n_magic == SMB_NODE_MAGIC); 1342 ASSERT(node->n_state != SMB_NODE_STATE_DESTROYING); 1343 1344 if (SMB_TREE_CONTAINS_NODE(sr, node) == 0) 1345 return (EACCES); 1346 1347 if (SMB_TREE_IS_READONLY(sr)) 1348 return (EROFS); 1349 1350 if (SMB_TREE_HAS_ACCESS(sr, access) == 0) 1351 return (EACCES); 1352 1353 /* 1354 * The file system cannot detect pending READDONLY 1355 * (i.e. if the file has been opened readonly but 1356 * not yet closed) so we need to test READONLY here. 1357 * 1358 * Note that file handle that were opened before the 1359 * READONLY flag was set in the node (or the FS) are 1360 * immune to that change, and remain writable. 1361 */ 1362 if (sr->fid_ofile) { 1363 if (SMB_OFILE_IS_READONLY(sr->fid_ofile)) 1364 return (EACCES); 1365 } else { 1366 /* This requires an open file. */ 1367 return (EACCES); 1368 } 1369 1370 /* 1371 * SMB checks access on open and retains an access granted 1372 * mask for use while the file is open. ACL changes should 1373 * not affect access to an open file. 1374 * 1375 * If the setattr is being performed on an ofile: 1376 * - Check the ofile's access granted mask to see if this 1377 * modification should be permitted (FILE_WRITE_DATA) 1378 */ 1379 status = smb_ofile_access(sr->fid_ofile, cr, access); 1380 if (status != NT_STATUS_SUCCESS) 1381 return (EACCES); 1382 1383 bzero(&flk, sizeof (flk)); 1384 flk.l_start = end_of_data; 1385 1386 rc = smb_vop_space(node->vp, F_FREESP, &flk, FWRITE, 0LL, cr); 1387 return (rc); 1388 } 1389 1390 /* 1391 * smb_fsop_read 1392 * 1393 * All SMB functions should use this wrapper to ensure that 1394 * the the calls are performed with the appropriate credentials. 1395 * Please document any direct call to explain the reason 1396 * for avoiding this wrapper. 1397 * 1398 * It is assumed that a reference exists on snode coming into this routine. 1399 */ 1400 int 1401 smb_fsop_read(smb_request_t *sr, cred_t *cr, smb_node_t *snode, uio_t *uio) 1402 { 1403 caller_context_t ct; 1404 cred_t *kcr = zone_kcred(); 1405 int svmand; 1406 int rc; 1407 1408 ASSERT(cr); 1409 ASSERT(snode); 1410 ASSERT(snode->n_magic == SMB_NODE_MAGIC); 1411 ASSERT(snode->n_state != SMB_NODE_STATE_DESTROYING); 1412 1413 ASSERT(sr); 1414 ASSERT(sr->fid_ofile); 1415 1416 if (SMB_TREE_HAS_ACCESS(sr, ACE_READ_DATA) == 0) 1417 return (EACCES); 1418 1419 rc = smb_ofile_access(sr->fid_ofile, cr, FILE_READ_DATA); 1420 if ((rc != NT_STATUS_SUCCESS) && 1421 (sr->smb_flg2 & SMB_FLAGS2_READ_IF_EXECUTE)) 1422 rc = smb_ofile_access(sr->fid_ofile, cr, FILE_EXECUTE); 1423 1424 if (rc != NT_STATUS_SUCCESS) 1425 return (EACCES); 1426 1427 /* 1428 * Streams permission are checked against the unnamed stream, 1429 * but in FS level they have their own permissions. To avoid 1430 * rejection by FS due to lack of permission on the actual 1431 * extended attr kcred is passed for streams. 1432 */ 1433 if (SMB_IS_STREAM(snode)) 1434 cr = kcr; 1435 1436 smb_node_start_crit(snode, RW_READER); 1437 rc = nbl_svmand(snode->vp, kcr, &svmand); 1438 if (rc) { 1439 smb_node_end_crit(snode); 1440 return (rc); 1441 } 1442 1443 ct = smb_ct; 1444 ct.cc_pid = sr->fid_ofile->f_uniqid; 1445 rc = nbl_lock_conflict(snode->vp, NBL_READ, uio->uio_loffset, 1446 uio->uio_iov->iov_len, svmand, &ct); 1447 1448 if (rc) { 1449 smb_node_end_crit(snode); 1450 return (ERANGE); 1451 } 1452 1453 rc = smb_vop_read(snode->vp, uio, cr); 1454 smb_node_end_crit(snode); 1455 1456 return (rc); 1457 } 1458 1459 /* 1460 * smb_fsop_write 1461 * 1462 * This is a wrapper function used for smb_write and smb_write_raw operations. 1463 * 1464 * It is assumed that a reference exists on snode coming into this routine. 1465 */ 1466 int 1467 smb_fsop_write( 1468 smb_request_t *sr, 1469 cred_t *cr, 1470 smb_node_t *snode, 1471 uio_t *uio, 1472 uint32_t *lcount, 1473 int ioflag) 1474 { 1475 caller_context_t ct; 1476 smb_attr_t attr; 1477 smb_node_t *u_node; 1478 vnode_t *u_vp = NULL; 1479 smb_ofile_t *of; 1480 vnode_t *vp; 1481 cred_t *kcr = zone_kcred(); 1482 int svmand; 1483 int rc; 1484 1485 ASSERT(cr); 1486 ASSERT(snode); 1487 ASSERT(snode->n_magic == SMB_NODE_MAGIC); 1488 ASSERT(snode->n_state != SMB_NODE_STATE_DESTROYING); 1489 1490 ASSERT(sr); 1491 ASSERT(sr->tid_tree); 1492 of = sr->fid_ofile; 1493 vp = snode->vp; 1494 1495 if (SMB_TREE_IS_READONLY(sr)) 1496 return (EROFS); 1497 1498 if (SMB_OFILE_IS_READONLY(of) || 1499 SMB_TREE_HAS_ACCESS(sr, ACE_WRITE_DATA | ACE_APPEND_DATA) == 0) 1500 return (EACCES); 1501 1502 rc = smb_ofile_access(of, cr, FILE_WRITE_DATA); 1503 if (rc != NT_STATUS_SUCCESS) { 1504 rc = smb_ofile_access(of, cr, FILE_APPEND_DATA); 1505 if (rc != NT_STATUS_SUCCESS) 1506 return (EACCES); 1507 } 1508 1509 /* 1510 * Streams permission are checked against the unnamed stream, 1511 * but in FS level they have their own permissions. To avoid 1512 * rejection by FS due to lack of permission on the actual 1513 * extended attr kcred is passed for streams. 1514 */ 1515 u_node = SMB_IS_STREAM(snode); 1516 if (u_node != NULL) { 1517 ASSERT(u_node->n_magic == SMB_NODE_MAGIC); 1518 ASSERT(u_node->n_state != SMB_NODE_STATE_DESTROYING); 1519 u_vp = u_node->vp; 1520 cr = kcr; 1521 } 1522 1523 smb_node_start_crit(snode, RW_WRITER); 1524 rc = nbl_svmand(vp, kcr, &svmand); 1525 if (rc) { 1526 smb_node_end_crit(snode); 1527 return (rc); 1528 } 1529 1530 ct = smb_ct; 1531 ct.cc_pid = of->f_uniqid; 1532 rc = nbl_lock_conflict(vp, NBL_WRITE, uio->uio_loffset, 1533 uio->uio_iov->iov_len, svmand, &ct); 1534 1535 if (rc) { 1536 smb_node_end_crit(snode); 1537 return (ERANGE); 1538 } 1539 1540 rc = smb_vop_write(vp, uio, ioflag, lcount, cr); 1541 1542 /* 1543 * Once the mtime has been set via this ofile, the 1544 * automatic mtime changes from writes via this ofile 1545 * should cease, preserving the mtime that was set. 1546 * See: [MS-FSA] 2.1.5.14 and smb_node_setattr. 1547 * 1548 * The VFS interface does not offer a way to ask it to 1549 * skip the mtime updates, so we simulate the desired 1550 * behavior by re-setting the mtime after writes on a 1551 * handle where the mtime has been set. 1552 */ 1553 if (of->f_pending_attr.sa_mask & SMB_AT_MTIME) { 1554 bcopy(&of->f_pending_attr, &attr, sizeof (attr)); 1555 attr.sa_mask = SMB_AT_MTIME; 1556 (void) smb_vop_setattr(vp, u_vp, &attr, 0, kcr); 1557 } 1558 1559 smb_node_end_crit(snode); 1560 1561 return (rc); 1562 } 1563 1564 /* 1565 * smb_fsop_statfs 1566 * 1567 * This is a wrapper function used for stat operations. 1568 */ 1569 int 1570 smb_fsop_statfs( 1571 cred_t *cr, 1572 smb_node_t *snode, 1573 struct statvfs64 *statp) 1574 { 1575 ASSERT(cr); 1576 ASSERT(snode); 1577 ASSERT(snode->n_magic == SMB_NODE_MAGIC); 1578 ASSERT(snode->n_state != SMB_NODE_STATE_DESTROYING); 1579 1580 return (smb_vop_statfs(snode->vp, statp, cr)); 1581 } 1582 1583 /* 1584 * smb_fsop_access 1585 * 1586 * Named streams do not have separate permissions from the associated 1587 * unnamed stream. Thus, if node is a named stream, the permissions 1588 * check will be performed on the associated unnamed stream. 1589 * 1590 * However, our named streams do have their own quarantine attribute, 1591 * separate from that on the unnamed stream. If READ or EXECUTE 1592 * access has been requested on a named stream, an additional access 1593 * check is performed on the named stream in case it has been 1594 * quarantined. kcred is used to avoid issues with the permissions 1595 * set on the extended attribute file representing the named stream. 1596 */ 1597 int 1598 smb_fsop_access(smb_request_t *sr, cred_t *cr, smb_node_t *snode, 1599 uint32_t faccess) 1600 { 1601 int access = 0; 1602 int error; 1603 vnode_t *dir_vp; 1604 boolean_t acl_check = B_TRUE; 1605 smb_node_t *unnamed_node; 1606 1607 ASSERT(sr); 1608 ASSERT(cr); 1609 ASSERT(snode); 1610 ASSERT(snode->n_magic == SMB_NODE_MAGIC); 1611 ASSERT(snode->n_state != SMB_NODE_STATE_DESTROYING); 1612 1613 if (SMB_TREE_IS_READONLY(sr)) { 1614 if (faccess & (FILE_WRITE_DATA|FILE_APPEND_DATA| 1615 FILE_WRITE_EA|FILE_DELETE_CHILD|FILE_WRITE_ATTRIBUTES| 1616 DELETE|WRITE_DAC|WRITE_OWNER)) { 1617 return (NT_STATUS_ACCESS_DENIED); 1618 } 1619 } 1620 1621 if (smb_node_is_reparse(snode) && (faccess & DELETE)) 1622 return (NT_STATUS_ACCESS_DENIED); 1623 1624 unnamed_node = SMB_IS_STREAM(snode); 1625 if (unnamed_node) { 1626 ASSERT(unnamed_node->n_magic == SMB_NODE_MAGIC); 1627 ASSERT(unnamed_node->n_state != SMB_NODE_STATE_DESTROYING); 1628 1629 /* 1630 * Perform VREAD access check on the named stream in case it 1631 * is quarantined. kcred is passed to smb_vop_access so it 1632 * doesn't fail due to lack of permission. 1633 */ 1634 if (faccess & (FILE_READ_DATA | FILE_EXECUTE)) { 1635 error = smb_vop_access(snode->vp, VREAD, 1636 0, NULL, zone_kcred()); 1637 if (error) 1638 return (NT_STATUS_ACCESS_DENIED); 1639 } 1640 1641 /* 1642 * Streams authorization should be performed against the 1643 * unnamed stream. 1644 */ 1645 snode = unnamed_node; 1646 } 1647 1648 if (faccess & ACCESS_SYSTEM_SECURITY) { 1649 /* 1650 * This permission is required for reading/writing SACL and 1651 * it's not part of DACL. It's only granted via proper 1652 * privileges. 1653 */ 1654 if ((sr->uid_user->u_privileges & 1655 (SMB_USER_PRIV_BACKUP | 1656 SMB_USER_PRIV_RESTORE | 1657 SMB_USER_PRIV_SECURITY)) == 0) 1658 return (NT_STATUS_PRIVILEGE_NOT_HELD); 1659 1660 faccess &= ~ACCESS_SYSTEM_SECURITY; 1661 } 1662 1663 /* Links don't have ACL */ 1664 if ((!smb_tree_has_feature(sr->tid_tree, SMB_TREE_ACEMASKONACCESS)) || 1665 smb_node_is_symlink(snode)) 1666 acl_check = B_FALSE; 1667 1668 /* Deny access based on the share access mask */ 1669 1670 if ((faccess & ~sr->tid_tree->t_access) != 0) 1671 return (NT_STATUS_ACCESS_DENIED); 1672 1673 if (acl_check) { 1674 dir_vp = (snode->n_dnode) ? snode->n_dnode->vp : NULL; 1675 error = smb_vop_access(snode->vp, faccess, V_ACE_MASK, dir_vp, 1676 cr); 1677 } else { 1678 /* 1679 * FS doesn't understand 32-bit mask, need to map 1680 */ 1681 if (faccess & (FILE_WRITE_DATA | FILE_APPEND_DATA)) 1682 access |= VWRITE; 1683 1684 if (faccess & FILE_READ_DATA) 1685 access |= VREAD; 1686 1687 if (faccess & FILE_EXECUTE) 1688 access |= VEXEC; 1689 1690 error = smb_vop_access(snode->vp, access, 0, NULL, cr); 1691 } 1692 1693 return ((error) ? NT_STATUS_ACCESS_DENIED : NT_STATUS_SUCCESS); 1694 } 1695 1696 /* 1697 * smb_fsop_lookup_name() 1698 * 1699 * If name indicates that the file is a stream file, perform 1700 * stream specific lookup, otherwise call smb_fsop_lookup. 1701 * 1702 * Return an error if the looked-up file is in outside the tree. 1703 * (Required when invoked from open path.) 1704 * 1705 * Case sensitivity flags (SMB_IGNORE_CASE, SMB_CASE_SENSITIVE): 1706 * if SMB_CASE_SENSITIVE is set, the SMB_IGNORE_CASE flag will NOT be set 1707 * based on the tree's case sensitivity. However, if the SMB_IGNORE_CASE 1708 * flag is set in the flags value passed as a parameter, a case insensitive 1709 * lookup WILL be done (regardless of whether SMB_CASE_SENSITIVE is set 1710 * or not). 1711 */ 1712 1713 int 1714 smb_fsop_lookup_name( 1715 smb_request_t *sr, 1716 cred_t *cr, 1717 int flags, 1718 smb_node_t *root_node, 1719 smb_node_t *dnode, 1720 char *name, 1721 smb_node_t **ret_snode) 1722 { 1723 smb_node_t *fnode; 1724 vnode_t *xattrdirvp; 1725 vnode_t *vp; 1726 char *od_name; 1727 char *fname; 1728 char *sname; 1729 int rc; 1730 1731 ASSERT(cr); 1732 ASSERT(dnode); 1733 ASSERT(dnode->n_magic == SMB_NODE_MAGIC); 1734 ASSERT(dnode->n_state != SMB_NODE_STATE_DESTROYING); 1735 1736 /* 1737 * The following check is required for streams processing, below 1738 */ 1739 1740 if (!(flags & SMB_CASE_SENSITIVE)) { 1741 if (SMB_TREE_IS_CASEINSENSITIVE(sr)) 1742 flags |= SMB_IGNORE_CASE; 1743 } 1744 1745 fname = kmem_alloc(MAXNAMELEN, KM_SLEEP); 1746 sname = kmem_alloc(MAXNAMELEN, KM_SLEEP); 1747 1748 if (smb_is_stream_name(name)) { 1749 smb_stream_parse_name(name, fname, sname); 1750 1751 /* 1752 * Look up the unnamed stream (i.e. fname). 1753 * Unmangle processing will be done on fname 1754 * as well as any link target. 1755 */ 1756 rc = smb_fsop_lookup(sr, cr, flags, root_node, dnode, 1757 fname, &fnode); 1758 1759 if (rc != 0) { 1760 kmem_free(fname, MAXNAMELEN); 1761 kmem_free(sname, MAXNAMELEN); 1762 return (rc); 1763 } 1764 1765 od_name = kmem_alloc(MAXNAMELEN, KM_SLEEP); 1766 1767 /* 1768 * od_name is the on-disk name of the stream, except 1769 * without the prepended stream prefix (SMB_STREAM_PREFIX) 1770 */ 1771 1772 /* 1773 * XXX 1774 * What permissions NTFS requires for stream lookup if any? 1775 */ 1776 rc = smb_vop_stream_lookup(fnode->vp, sname, &vp, od_name, 1777 &xattrdirvp, flags, root_node->vp, cr); 1778 1779 if (rc != 0) { 1780 smb_node_release(fnode); 1781 kmem_free(fname, MAXNAMELEN); 1782 kmem_free(sname, MAXNAMELEN); 1783 kmem_free(od_name, MAXNAMELEN); 1784 return (rc); 1785 } 1786 1787 *ret_snode = smb_stream_node_lookup(sr, cr, fnode, xattrdirvp, 1788 vp, od_name); 1789 1790 kmem_free(od_name, MAXNAMELEN); 1791 smb_node_release(fnode); 1792 VN_RELE(xattrdirvp); 1793 VN_RELE(vp); 1794 1795 if (*ret_snode == NULL) { 1796 kmem_free(fname, MAXNAMELEN); 1797 kmem_free(sname, MAXNAMELEN); 1798 return (ENOMEM); 1799 } 1800 } else { 1801 rc = smb_fsop_lookup(sr, cr, flags, root_node, dnode, name, 1802 ret_snode); 1803 } 1804 1805 if (rc == 0) { 1806 ASSERT(ret_snode); 1807 if (SMB_TREE_CONTAINS_NODE(sr, *ret_snode) == 0) { 1808 smb_node_release(*ret_snode); 1809 *ret_snode = NULL; 1810 rc = EACCES; 1811 } 1812 } 1813 1814 kmem_free(fname, MAXNAMELEN); 1815 kmem_free(sname, MAXNAMELEN); 1816 1817 return (rc); 1818 } 1819 1820 /* 1821 * smb_fsop_lookup 1822 * 1823 * All SMB functions should use this smb_vop_lookup wrapper to ensure that 1824 * the smb_vop_lookup is performed with the appropriate credentials and using 1825 * case insensitive compares. Please document any direct call to smb_vop_lookup 1826 * to explain the reason for avoiding this wrapper. 1827 * 1828 * It is assumed that a reference exists on dnode coming into this routine 1829 * (and that it is safe from deallocation). 1830 * 1831 * Same with the root_node. 1832 * 1833 * *ret_snode is returned with a reference upon success. No reference is 1834 * taken if an error is returned. 1835 * 1836 * Note: The returned ret_snode may be in a child mount. This is ok for 1837 * readdir. 1838 * 1839 * Other smb_fsop_* routines will call SMB_TREE_CONTAINS_NODE() to prevent 1840 * operations on files not in the parent mount. 1841 * 1842 * Case sensitivity flags (SMB_IGNORE_CASE, SMB_CASE_SENSITIVE): 1843 * if SMB_CASE_SENSITIVE is set, the SMB_IGNORE_CASE flag will NOT be set 1844 * based on the tree's case sensitivity. However, if the SMB_IGNORE_CASE 1845 * flag is set in the flags value passed as a parameter, a case insensitive 1846 * lookup WILL be done (regardless of whether SMB_CASE_SENSITIVE is set 1847 * or not). 1848 */ 1849 int 1850 smb_fsop_lookup( 1851 smb_request_t *sr, 1852 cred_t *cr, 1853 int flags, 1854 smb_node_t *root_node, 1855 smb_node_t *dnode, 1856 char *name, 1857 smb_node_t **ret_snode) 1858 { 1859 smb_node_t *lnk_target_node; 1860 smb_node_t *lnk_dnode; 1861 char *longname; 1862 char *od_name; 1863 vnode_t *vp; 1864 int rc; 1865 int ret_flags; 1866 smb_attr_t attr; 1867 1868 ASSERT(cr); 1869 ASSERT(dnode); 1870 ASSERT(dnode->n_magic == SMB_NODE_MAGIC); 1871 ASSERT(dnode->n_state != SMB_NODE_STATE_DESTROYING); 1872 1873 if (name == NULL) 1874 return (EINVAL); 1875 1876 if (SMB_TREE_CONTAINS_NODE(sr, dnode) == 0) 1877 return (EACCES); 1878 1879 if (!(flags & SMB_CASE_SENSITIVE)) { 1880 if (SMB_TREE_IS_CASEINSENSITIVE(sr)) 1881 flags |= SMB_IGNORE_CASE; 1882 } 1883 if (SMB_TREE_SUPPORTS_CATIA(sr)) 1884 flags |= SMB_CATIA; 1885 if (SMB_TREE_SUPPORTS_ABE(sr)) 1886 flags |= SMB_ABE; 1887 1888 od_name = kmem_alloc(MAXNAMELEN, KM_SLEEP); 1889 1890 rc = smb_vop_lookup(dnode->vp, name, &vp, od_name, flags, 1891 &ret_flags, root_node ? root_node->vp : NULL, &attr, cr); 1892 1893 if (rc != 0) { 1894 if (!SMB_TREE_SUPPORTS_SHORTNAMES(sr) || 1895 !smb_maybe_mangled(name)) { 1896 kmem_free(od_name, MAXNAMELEN); 1897 return (rc); 1898 } 1899 1900 longname = kmem_alloc(MAXNAMELEN, KM_SLEEP); 1901 rc = smb_unmangle(dnode, name, longname, MAXNAMELEN, flags); 1902 if (rc != 0) { 1903 kmem_free(od_name, MAXNAMELEN); 1904 kmem_free(longname, MAXNAMELEN); 1905 return (rc); 1906 } 1907 1908 /* 1909 * longname is the real (case-sensitive) 1910 * on-disk name. 1911 * We make sure we do a lookup on this exact 1912 * name, as the name was mangled and denotes 1913 * a unique file. 1914 */ 1915 1916 if (flags & SMB_IGNORE_CASE) 1917 flags &= ~SMB_IGNORE_CASE; 1918 1919 rc = smb_vop_lookup(dnode->vp, longname, &vp, od_name, 1920 flags, &ret_flags, root_node ? root_node->vp : NULL, &attr, 1921 cr); 1922 1923 kmem_free(longname, MAXNAMELEN); 1924 1925 if (rc != 0) { 1926 kmem_free(od_name, MAXNAMELEN); 1927 return (rc); 1928 } 1929 } 1930 1931 if ((flags & SMB_FOLLOW_LINKS) && (vp->v_type == VLNK) && 1932 ((attr.sa_dosattr & FILE_ATTRIBUTE_REPARSE_POINT) == 0)) { 1933 rc = smb_pathname(sr, od_name, FOLLOW, root_node, dnode, 1934 &lnk_dnode, &lnk_target_node, cr); 1935 1936 if (rc != 0) { 1937 /* 1938 * The link is assumed to be for the last component 1939 * of a path. Hence any ENOTDIR error will be returned 1940 * as ENOENT. 1941 */ 1942 if (rc == ENOTDIR) 1943 rc = ENOENT; 1944 1945 VN_RELE(vp); 1946 kmem_free(od_name, MAXNAMELEN); 1947 return (rc); 1948 } 1949 1950 /* 1951 * Release the original VLNK vnode 1952 */ 1953 1954 VN_RELE(vp); 1955 vp = lnk_target_node->vp; 1956 1957 rc = smb_vop_traverse_check(&vp); 1958 1959 if (rc != 0) { 1960 smb_node_release(lnk_dnode); 1961 smb_node_release(lnk_target_node); 1962 kmem_free(od_name, MAXNAMELEN); 1963 return (rc); 1964 } 1965 1966 /* 1967 * smb_vop_traverse_check() may have returned a different vnode 1968 */ 1969 1970 if (lnk_target_node->vp == vp) { 1971 *ret_snode = lnk_target_node; 1972 } else { 1973 *ret_snode = smb_node_lookup(sr, NULL, cr, vp, 1974 lnk_target_node->od_name, lnk_dnode, NULL); 1975 VN_RELE(vp); 1976 1977 if (*ret_snode == NULL) 1978 rc = ENOMEM; 1979 smb_node_release(lnk_target_node); 1980 } 1981 1982 smb_node_release(lnk_dnode); 1983 1984 } else { 1985 1986 rc = smb_vop_traverse_check(&vp); 1987 if (rc) { 1988 VN_RELE(vp); 1989 kmem_free(od_name, MAXNAMELEN); 1990 return (rc); 1991 } 1992 1993 *ret_snode = smb_node_lookup(sr, NULL, cr, vp, od_name, 1994 dnode, NULL); 1995 VN_RELE(vp); 1996 1997 if (*ret_snode == NULL) 1998 rc = ENOMEM; 1999 } 2000 2001 kmem_free(od_name, MAXNAMELEN); 2002 return (rc); 2003 } 2004 2005 int /*ARGSUSED*/ 2006 smb_fsop_commit(smb_request_t *sr, cred_t *cr, smb_node_t *snode) 2007 { 2008 ASSERT(cr); 2009 ASSERT(snode); 2010 ASSERT(snode->n_magic == SMB_NODE_MAGIC); 2011 ASSERT(snode->n_state != SMB_NODE_STATE_DESTROYING); 2012 2013 ASSERT(sr); 2014 ASSERT(sr->tid_tree); 2015 if (SMB_TREE_IS_READONLY(sr)) 2016 return (EROFS); 2017 2018 return (smb_vop_commit(snode->vp, cr)); 2019 } 2020 2021 /* 2022 * smb_fsop_aclread 2023 * 2024 * Retrieve filesystem ACL. Depends on requested ACLs in 2025 * fs_sd->sd_secinfo, it'll set DACL and SACL pointers in 2026 * fs_sd. Note that requesting a DACL/SACL doesn't mean that 2027 * the corresponding field in fs_sd should be non-NULL upon 2028 * return, since the target ACL might not contain that type of 2029 * entries. 2030 * 2031 * Returned ACL is always in ACE_T (aka ZFS) format. 2032 * If successful the allocated memory for the ACL should be freed 2033 * using smb_fsacl_free() or smb_fssd_term() 2034 */ 2035 int 2036 smb_fsop_aclread(smb_request_t *sr, cred_t *cr, smb_node_t *snode, 2037 smb_fssd_t *fs_sd) 2038 { 2039 int error = 0; 2040 int flags = 0; 2041 int access = 0; 2042 acl_t *acl; 2043 2044 ASSERT(cr); 2045 2046 /* Can't query security on named streams */ 2047 if (SMB_IS_STREAM(snode) != NULL) 2048 return (EINVAL); 2049 2050 if (SMB_TREE_HAS_ACCESS(sr, ACE_READ_ACL) == 0) 2051 return (EACCES); 2052 2053 if (sr->fid_ofile) { 2054 if (fs_sd->sd_secinfo & SMB_DACL_SECINFO) 2055 access = READ_CONTROL; 2056 2057 if (fs_sd->sd_secinfo & SMB_SACL_SECINFO) 2058 access |= ACCESS_SYSTEM_SECURITY; 2059 2060 error = smb_ofile_access(sr->fid_ofile, cr, access); 2061 if (error != NT_STATUS_SUCCESS) { 2062 return (EACCES); 2063 } 2064 } 2065 2066 2067 if (smb_tree_has_feature(sr->tid_tree, SMB_TREE_ACEMASKONACCESS)) 2068 flags = ATTR_NOACLCHECK; 2069 2070 error = smb_vop_acl_read(snode->vp, &acl, flags, 2071 sr->tid_tree->t_acltype, cr); 2072 if (error != 0) { 2073 return (error); 2074 } 2075 2076 error = acl_translate(acl, _ACL_ACE_ENABLED, 2077 smb_node_is_dir(snode), fs_sd->sd_uid, fs_sd->sd_gid); 2078 2079 if (error == 0) { 2080 smb_fsacl_split(acl, &fs_sd->sd_zdacl, &fs_sd->sd_zsacl, 2081 fs_sd->sd_secinfo); 2082 } 2083 2084 acl_free(acl); 2085 return (error); 2086 } 2087 2088 /* 2089 * smb_fsop_aclwrite 2090 * 2091 * Stores the filesystem ACL provided in fs_sd->sd_acl. 2092 */ 2093 int 2094 smb_fsop_aclwrite(smb_request_t *sr, cred_t *cr, smb_node_t *snode, 2095 smb_fssd_t *fs_sd) 2096 { 2097 int target_flavor; 2098 int error = 0; 2099 int flags = 0; 2100 int access = 0; 2101 acl_t *acl, *dacl, *sacl; 2102 2103 ASSERT(cr); 2104 2105 ASSERT(sr); 2106 ASSERT(sr->tid_tree); 2107 if (SMB_TREE_IS_READONLY(sr)) 2108 return (EROFS); 2109 2110 /* Can't set security on named streams */ 2111 if (SMB_IS_STREAM(snode) != NULL) 2112 return (EINVAL); 2113 2114 if (SMB_TREE_HAS_ACCESS(sr, ACE_WRITE_ACL) == 0) 2115 return (EACCES); 2116 2117 if (sr->fid_ofile) { 2118 if (fs_sd->sd_secinfo & SMB_DACL_SECINFO) 2119 access = WRITE_DAC; 2120 2121 if (fs_sd->sd_secinfo & SMB_SACL_SECINFO) 2122 access |= ACCESS_SYSTEM_SECURITY; 2123 2124 error = smb_ofile_access(sr->fid_ofile, cr, access); 2125 if (error != NT_STATUS_SUCCESS) 2126 return (EACCES); 2127 } 2128 2129 switch (sr->tid_tree->t_acltype) { 2130 case ACLENT_T: 2131 target_flavor = _ACL_ACLENT_ENABLED; 2132 break; 2133 2134 case ACE_T: 2135 target_flavor = _ACL_ACE_ENABLED; 2136 break; 2137 default: 2138 return (EINVAL); 2139 } 2140 2141 dacl = fs_sd->sd_zdacl; 2142 sacl = fs_sd->sd_zsacl; 2143 2144 ASSERT(dacl || sacl); 2145 if ((dacl == NULL) && (sacl == NULL)) 2146 return (EINVAL); 2147 2148 if (dacl && sacl) 2149 acl = smb_fsacl_merge(dacl, sacl); 2150 else if (dacl) 2151 acl = dacl; 2152 else 2153 acl = sacl; 2154 2155 error = acl_translate(acl, target_flavor, smb_node_is_dir(snode), 2156 fs_sd->sd_uid, fs_sd->sd_gid); 2157 if (error == 0) { 2158 if (smb_tree_has_feature(sr->tid_tree, 2159 SMB_TREE_ACEMASKONACCESS)) 2160 flags = ATTR_NOACLCHECK; 2161 2162 error = smb_vop_acl_write(snode->vp, acl, flags, cr); 2163 } 2164 2165 if (dacl && sacl) 2166 acl_free(acl); 2167 2168 return (error); 2169 } 2170 2171 acl_type_t 2172 smb_fsop_acltype(smb_node_t *snode) 2173 { 2174 return (smb_vop_acl_type(snode->vp)); 2175 } 2176 2177 /* 2178 * smb_fsop_sdread 2179 * 2180 * Read the requested security descriptor items from filesystem. 2181 * The items are specified in fs_sd->sd_secinfo. 2182 */ 2183 int 2184 smb_fsop_sdread(smb_request_t *sr, cred_t *cr, smb_node_t *snode, 2185 smb_fssd_t *fs_sd) 2186 { 2187 int error = 0; 2188 int getowner = 0; 2189 cred_t *ga_cred; 2190 smb_attr_t attr; 2191 2192 ASSERT(cr); 2193 ASSERT(fs_sd); 2194 2195 /* Can't query security on named streams */ 2196 if (SMB_IS_STREAM(snode) != NULL) 2197 return (EINVAL); 2198 2199 /* 2200 * File's uid/gid is fetched in two cases: 2201 * 2202 * 1. it's explicitly requested 2203 * 2204 * 2. target ACL is ACE_T (ZFS ACL). They're needed for 2205 * owner@/group@ entries. In this case kcred should be used 2206 * because uid/gid are fetched on behalf of smb server. 2207 */ 2208 if (fs_sd->sd_secinfo & (SMB_OWNER_SECINFO | SMB_GROUP_SECINFO)) { 2209 getowner = 1; 2210 ga_cred = cr; 2211 } else if (sr->tid_tree->t_acltype == ACE_T) { 2212 getowner = 1; 2213 ga_cred = zone_kcred(); 2214 } 2215 2216 if (getowner) { 2217 /* 2218 * Windows require READ_CONTROL to read owner/group SID since 2219 * they're part of Security Descriptor. 2220 * ZFS only requires read_attribute. Need to have a explicit 2221 * access check here. 2222 */ 2223 if (sr->fid_ofile == NULL) { 2224 error = smb_fsop_access(sr, ga_cred, snode, 2225 READ_CONTROL); 2226 if (error) 2227 return (EACCES); 2228 } 2229 2230 attr.sa_mask = SMB_AT_UID | SMB_AT_GID; 2231 error = smb_fsop_getattr(sr, ga_cred, snode, &attr); 2232 if (error == 0) { 2233 fs_sd->sd_uid = attr.sa_vattr.va_uid; 2234 fs_sd->sd_gid = attr.sa_vattr.va_gid; 2235 } else { 2236 return (error); 2237 } 2238 } 2239 2240 if (fs_sd->sd_secinfo & SMB_ACL_SECINFO) { 2241 error = smb_fsop_aclread(sr, cr, snode, fs_sd); 2242 } 2243 2244 return (error); 2245 } 2246 2247 /* 2248 * smb_fsop_sdmerge 2249 * 2250 * From SMB point of view DACL and SACL are two separate list 2251 * which can be manipulated independently without one affecting 2252 * the other, but entries for both DACL and SACL will end up 2253 * in the same ACL if target filesystem supports ACE_T ACLs. 2254 * 2255 * So, if either DACL or SACL is present in the client set request 2256 * the entries corresponding to the non-present ACL shouldn't 2257 * be touched in the FS ACL. 2258 * 2259 * fs_sd parameter contains DACL and SACL specified by SMB 2260 * client to be set on a file/directory. The client could 2261 * specify both or one of these ACLs (if none is specified 2262 * we don't get this far). When both DACL and SACL are given 2263 * by client the existing ACL should be overwritten. If only 2264 * one of them is specified the entries corresponding to the other 2265 * ACL should not be touched. For example, if only DACL 2266 * is specified in input fs_sd, the function reads audit entries 2267 * of the existing ACL of the file and point fs_sd->sd_zsdacl 2268 * pointer to the fetched SACL, this way when smb_fsop_sdwrite() 2269 * function is called the passed fs_sd would point to the specified 2270 * DACL by client and fetched SACL from filesystem, so the file 2271 * will end up with correct ACL. 2272 */ 2273 static int 2274 smb_fsop_sdmerge(smb_request_t *sr, smb_node_t *snode, smb_fssd_t *fs_sd) 2275 { 2276 smb_fssd_t cur_sd; 2277 cred_t *kcr = zone_kcred(); 2278 int error = 0; 2279 2280 if (sr->tid_tree->t_acltype != ACE_T) 2281 /* Don't bother if target FS doesn't support ACE_T */ 2282 return (0); 2283 2284 if ((fs_sd->sd_secinfo & SMB_ACL_SECINFO) != SMB_ACL_SECINFO) { 2285 if (fs_sd->sd_secinfo & SMB_DACL_SECINFO) { 2286 /* 2287 * Don't overwrite existing audit entries 2288 */ 2289 smb_fssd_init(&cur_sd, SMB_SACL_SECINFO, 2290 fs_sd->sd_flags); 2291 2292 error = smb_fsop_sdread(sr, kcr, snode, &cur_sd); 2293 if (error == 0) { 2294 ASSERT(fs_sd->sd_zsacl == NULL); 2295 fs_sd->sd_zsacl = cur_sd.sd_zsacl; 2296 if (fs_sd->sd_zsacl && fs_sd->sd_zdacl) 2297 fs_sd->sd_zsacl->acl_flags = 2298 fs_sd->sd_zdacl->acl_flags; 2299 } 2300 } else { 2301 /* 2302 * Don't overwrite existing access entries 2303 */ 2304 smb_fssd_init(&cur_sd, SMB_DACL_SECINFO, 2305 fs_sd->sd_flags); 2306 2307 error = smb_fsop_sdread(sr, kcr, snode, &cur_sd); 2308 if (error == 0) { 2309 ASSERT(fs_sd->sd_zdacl == NULL); 2310 fs_sd->sd_zdacl = cur_sd.sd_zdacl; 2311 if (fs_sd->sd_zdacl && fs_sd->sd_zsacl) 2312 fs_sd->sd_zdacl->acl_flags = 2313 fs_sd->sd_zsacl->acl_flags; 2314 } 2315 } 2316 2317 if (error) 2318 smb_fssd_term(&cur_sd); 2319 } 2320 2321 return (error); 2322 } 2323 2324 /* 2325 * smb_fsop_sdwrite 2326 * 2327 * Stores the given uid, gid and acl in filesystem. 2328 * Provided items in fs_sd are specified by fs_sd->sd_secinfo. 2329 * 2330 * A SMB security descriptor could contain owner, primary group, 2331 * DACL and SACL. Setting an SD should be atomic but here it has to 2332 * be done via two separate FS operations: VOP_SETATTR and 2333 * VOP_SETSECATTR. Therefore, this function has to simulate the 2334 * atomicity as well as it can. 2335 * 2336 * Get the current uid, gid before setting the new uid/gid 2337 * so if smb_fsop_aclwrite fails they can be restored. root cred is 2338 * used to get currend uid/gid since this operation is performed on 2339 * behalf of the server not the user. 2340 * 2341 * If setting uid/gid fails with EPERM it means that and invalid 2342 * owner has been specified. Callers should translate this to 2343 * STATUS_INVALID_OWNER which is not the normal mapping for EPERM 2344 * in upper layers, so EPERM is mapped to EBADE. 2345 */ 2346 int 2347 smb_fsop_sdwrite(smb_request_t *sr, cred_t *cr, smb_node_t *snode, 2348 smb_fssd_t *fs_sd, int overwrite) 2349 { 2350 smb_attr_t set_attr; 2351 smb_attr_t orig_attr; 2352 cred_t *kcr = zone_kcred(); 2353 int error = 0; 2354 int access = 0; 2355 2356 ASSERT(cr); 2357 ASSERT(fs_sd); 2358 2359 ASSERT(sr); 2360 ASSERT(sr->tid_tree); 2361 if (SMB_TREE_IS_READONLY(sr)) 2362 return (EROFS); 2363 2364 /* Can't set security on named streams */ 2365 if (SMB_IS_STREAM(snode) != NULL) 2366 return (EINVAL); 2367 2368 bzero(&set_attr, sizeof (smb_attr_t)); 2369 2370 if (fs_sd->sd_secinfo & SMB_OWNER_SECINFO) { 2371 set_attr.sa_vattr.va_uid = fs_sd->sd_uid; 2372 set_attr.sa_mask |= SMB_AT_UID; 2373 access |= WRITE_OWNER; 2374 } 2375 2376 if (fs_sd->sd_secinfo & SMB_GROUP_SECINFO) { 2377 set_attr.sa_vattr.va_gid = fs_sd->sd_gid; 2378 set_attr.sa_mask |= SMB_AT_GID; 2379 access |= WRITE_OWNER; 2380 } 2381 2382 if (fs_sd->sd_secinfo & SMB_DACL_SECINFO) 2383 access |= WRITE_DAC; 2384 2385 if (fs_sd->sd_secinfo & SMB_SACL_SECINFO) 2386 access |= ACCESS_SYSTEM_SECURITY; 2387 2388 if (sr->fid_ofile) 2389 error = smb_ofile_access(sr->fid_ofile, cr, access); 2390 else 2391 error = smb_fsop_access(sr, cr, snode, access); 2392 2393 if (error) 2394 return (EACCES); 2395 2396 if (set_attr.sa_mask) { 2397 orig_attr.sa_mask = SMB_AT_UID | SMB_AT_GID; 2398 error = smb_fsop_getattr(sr, kcr, snode, &orig_attr); 2399 if (error == 0) { 2400 error = smb_fsop_setattr(sr, cr, snode, &set_attr); 2401 if (error == EPERM) 2402 error = EBADE; 2403 } 2404 2405 if (error) 2406 return (error); 2407 } 2408 2409 if (fs_sd->sd_secinfo & SMB_ACL_SECINFO) { 2410 if (overwrite == 0) { 2411 error = smb_fsop_sdmerge(sr, snode, fs_sd); 2412 if (error) 2413 return (error); 2414 } 2415 2416 error = smb_fsop_aclwrite(sr, cr, snode, fs_sd); 2417 if (error) { 2418 /* 2419 * Revert uid/gid changes if required. 2420 */ 2421 if (set_attr.sa_mask) { 2422 orig_attr.sa_mask = set_attr.sa_mask; 2423 (void) smb_fsop_setattr(sr, kcr, snode, 2424 &orig_attr); 2425 } 2426 } 2427 } 2428 2429 return (error); 2430 } 2431 2432 #ifdef _KERNEL 2433 /* 2434 * smb_fsop_sdinherit 2435 * 2436 * Inherit the security descriptor from the parent container. 2437 * This function is called after FS has created the file/folder 2438 * so if this doesn't do anything it means FS inheritance is 2439 * in place. 2440 * 2441 * Do inheritance for ZFS internally. 2442 * 2443 * If we want to let ZFS does the inheritance the 2444 * following setting should be true: 2445 * 2446 * - aclinherit = passthrough 2447 * - aclmode = passthrough 2448 * - smbd umask = 0777 2449 * 2450 * This will result in right effective permissions but 2451 * ZFS will always add 6 ACEs for owner, owning group 2452 * and others to be POSIX compliant. This is not what 2453 * Windows clients/users expect, so we decided that CIFS 2454 * implements Windows rules and overwrite whatever ZFS 2455 * comes up with. This way we also don't have to care 2456 * about ZFS aclinherit and aclmode settings. 2457 */ 2458 static int 2459 smb_fsop_sdinherit(smb_request_t *sr, smb_node_t *dnode, smb_fssd_t *fs_sd) 2460 { 2461 acl_t *dacl = NULL; 2462 acl_t *sacl = NULL; 2463 int is_dir; 2464 int error; 2465 2466 ASSERT(fs_sd); 2467 2468 if (sr->tid_tree->t_acltype != ACE_T) { 2469 /* 2470 * No forced inheritance for non-ZFS filesystems. 2471 */ 2472 fs_sd->sd_secinfo = 0; 2473 return (0); 2474 } 2475 2476 2477 /* Fetch parent directory's ACL */ 2478 error = smb_fsop_sdread(sr, zone_kcred(), dnode, fs_sd); 2479 if (error) { 2480 return (error); 2481 } 2482 2483 is_dir = (fs_sd->sd_flags & SMB_FSSD_FLAGS_DIR); 2484 dacl = smb_fsacl_inherit(fs_sd->sd_zdacl, is_dir, SMB_DACL_SECINFO, 2485 sr->user_cr); 2486 sacl = smb_fsacl_inherit(fs_sd->sd_zsacl, is_dir, SMB_SACL_SECINFO, 2487 sr->user_cr); 2488 2489 if (sacl == NULL) 2490 fs_sd->sd_secinfo &= ~SMB_SACL_SECINFO; 2491 2492 smb_fsacl_free(fs_sd->sd_zdacl); 2493 smb_fsacl_free(fs_sd->sd_zsacl); 2494 2495 fs_sd->sd_zdacl = dacl; 2496 fs_sd->sd_zsacl = sacl; 2497 2498 return (0); 2499 } 2500 #endif /* _KERNEL */ 2501 2502 /* 2503 * smb_fsop_eaccess 2504 * 2505 * Returns the effective permission of the given credential for the 2506 * specified object. 2507 * 2508 * This is just a workaround. We need VFS/FS support for this. 2509 */ 2510 void 2511 smb_fsop_eaccess(smb_request_t *sr, cred_t *cr, smb_node_t *snode, 2512 uint32_t *eaccess) 2513 { 2514 int access = 0; 2515 vnode_t *dir_vp; 2516 smb_node_t *unnamed_node; 2517 2518 ASSERT(cr); 2519 ASSERT(snode); 2520 ASSERT(snode->n_magic == SMB_NODE_MAGIC); 2521 ASSERT(snode->n_state != SMB_NODE_STATE_DESTROYING); 2522 2523 unnamed_node = SMB_IS_STREAM(snode); 2524 if (unnamed_node) { 2525 ASSERT(unnamed_node->n_magic == SMB_NODE_MAGIC); 2526 ASSERT(unnamed_node->n_state != SMB_NODE_STATE_DESTROYING); 2527 /* 2528 * Streams authorization should be performed against the 2529 * unnamed stream. 2530 */ 2531 snode = unnamed_node; 2532 } 2533 2534 if (smb_tree_has_feature(sr->tid_tree, SMB_TREE_ACEMASKONACCESS)) { 2535 dir_vp = (snode->n_dnode) ? snode->n_dnode->vp : NULL; 2536 smb_vop_eaccess(snode->vp, (int *)eaccess, V_ACE_MASK, dir_vp, 2537 cr); 2538 return; 2539 } 2540 2541 /* 2542 * FS doesn't understand 32-bit mask 2543 */ 2544 smb_vop_eaccess(snode->vp, &access, 0, NULL, cr); 2545 access &= sr->tid_tree->t_access; 2546 2547 *eaccess = READ_CONTROL | FILE_READ_EA | FILE_READ_ATTRIBUTES; 2548 2549 if (access & VREAD) 2550 *eaccess |= FILE_READ_DATA; 2551 2552 if (access & VEXEC) 2553 *eaccess |= FILE_EXECUTE; 2554 2555 if (access & VWRITE) 2556 *eaccess |= FILE_WRITE_DATA | FILE_WRITE_ATTRIBUTES | 2557 FILE_WRITE_EA | FILE_APPEND_DATA | FILE_DELETE_CHILD; 2558 } 2559 2560 /* 2561 * smb_fsop_shrlock 2562 * 2563 * For the current open request, check file sharing rules 2564 * against existing opens. 2565 * 2566 * Returns NT_STATUS_SHARING_VIOLATION if there is any 2567 * sharing conflict. Returns NT_STATUS_SUCCESS otherwise. 2568 * 2569 * Full system-wide share reservation synchronization is available 2570 * when the nbmand (non-blocking mandatory) mount option is set 2571 * (i.e. nbl_need_crit() is true) and nbmand critical regions are used. 2572 * This provides synchronization with NFS and local processes. The 2573 * critical regions are entered in VOP_SHRLOCK()/fs_shrlock() (called 2574 * from smb_open_subr()/smb_fsop_shrlock()/smb_vop_shrlock()) as well 2575 * as the CIFS rename and delete paths. 2576 * 2577 * The CIFS server will also enter the nbl critical region in the open, 2578 * rename, and delete paths when nbmand is not set. There is limited 2579 * coordination with local and VFS share reservations in this case. 2580 * Note that when the nbmand mount option is not set, the VFS layer 2581 * only processes advisory reservations and the delete mode is not checked. 2582 * 2583 * Whether or not the nbmand mount option is set, intra-CIFS share 2584 * checking is done in the open, delete, and rename paths using a CIFS 2585 * critical region (node->n_share_lock). 2586 */ 2587 uint32_t 2588 smb_fsop_shrlock(cred_t *cr, smb_node_t *node, uint32_t uniq_fid, 2589 uint32_t desired_access, uint32_t share_access) 2590 { 2591 int rc; 2592 2593 /* Allow access if the request is just for meta data */ 2594 if ((desired_access & FILE_DATA_ALL) == 0) 2595 return (NT_STATUS_SUCCESS); 2596 2597 rc = smb_node_open_check(node, desired_access, share_access); 2598 if (rc) 2599 return (NT_STATUS_SHARING_VIOLATION); 2600 2601 rc = smb_vop_shrlock(node->vp, uniq_fid, desired_access, share_access, 2602 cr); 2603 if (rc) 2604 return (NT_STATUS_SHARING_VIOLATION); 2605 2606 return (NT_STATUS_SUCCESS); 2607 } 2608 2609 void 2610 smb_fsop_unshrlock(cred_t *cr, smb_node_t *node, uint32_t uniq_fid) 2611 { 2612 (void) smb_vop_unshrlock(node->vp, uniq_fid, cr); 2613 } 2614 2615 int 2616 smb_fsop_frlock(smb_node_t *node, smb_lock_t *lock, boolean_t unlock, 2617 cred_t *cr) 2618 { 2619 flock64_t bf; 2620 int flag = F_REMOTELOCK; 2621 2622 /* 2623 * VOP_FRLOCK() will not be called if: 2624 * 2625 * 1) The lock has a range of zero bytes. The semantics of Windows and 2626 * POSIX are different. In the case of POSIX it asks for the locking 2627 * of all the bytes from the offset provided until the end of the 2628 * file. In the case of Windows a range of zero locks nothing and 2629 * doesn't conflict with any other lock. 2630 * 2631 * 2) The lock rolls over (start + lenght < start). Solaris will assert 2632 * if such a request is submitted. This will not create 2633 * incompatibilities between POSIX and Windows. In the Windows world, 2634 * if a client submits such a lock, the server will not lock any 2635 * bytes. Interestingly if the same lock (same offset and length) is 2636 * resubmitted Windows will consider that there is an overlap and 2637 * the granting rules will then apply. 2638 */ 2639 if ((lock->l_length == 0) || 2640 ((lock->l_start + lock->l_length - 1) < lock->l_start)) 2641 return (0); 2642 2643 bzero(&bf, sizeof (bf)); 2644 2645 if (unlock) { 2646 bf.l_type = F_UNLCK; 2647 } else if (lock->l_type == SMB_LOCK_TYPE_READONLY) { 2648 bf.l_type = F_RDLCK; 2649 flag |= FREAD; 2650 } else if (lock->l_type == SMB_LOCK_TYPE_READWRITE) { 2651 bf.l_type = F_WRLCK; 2652 flag |= FWRITE; 2653 } 2654 2655 bf.l_start = lock->l_start; 2656 bf.l_len = lock->l_length; 2657 bf.l_pid = lock->l_file->f_uniqid; 2658 bf.l_sysid = smb_ct.cc_sysid; 2659 2660 return (smb_vop_frlock(node->vp, cr, flag, &bf)); 2661 } 2662