1fa9e406ahrens/*
2fa9e406ahrens * CDDL HEADER START
3fa9e406ahrens *
4fa9e406ahrens * The contents of this file are subject to the terms of the
5ea8dc4beschrock * Common Development and Distribution License (the "License").
6ea8dc4beschrock * You may not use this file except in compliance with the License.
7fa9e406ahrens *
8fa9e406ahrens * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9fa9e406ahrens * or http://www.opensolaris.org/os/licensing.
10fa9e406ahrens * See the License for the specific language governing permissions
11fa9e406ahrens * and limitations under the License.
12fa9e406ahrens *
13fa9e406ahrens * When distributing Covered Code, include this CDDL HEADER in each
14fa9e406ahrens * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15fa9e406ahrens * If applicable, add the following below this CDDL HEADER, with the
16fa9e406ahrens * fields enclosed by brackets "[]" replaced with your own identifying
17fa9e406ahrens * information: Portions Copyright [yyyy] [name of copyright owner]
18fa9e406ahrens *
19fa9e406ahrens * CDDL HEADER END
20fa9e406ahrens */
21fa9e406ahrens/*
2227dd1e8Mark Shellenbaum * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
23be6fd75Matthew Ahrens * Copyright (c) 2013 by Delphix. All rights reserved.
242889ec4Gordon Ross * Copyright 2017 Nexenta Systems, Inc.  All rights reserved.
25fa9e406ahrens */
26fa9e406ahrens
27fa9e406ahrens#include <sys/types.h>
28fa9e406ahrens#include <sys/param.h>
29fa9e406ahrens#include <sys/time.h>
30fa9e406ahrens#include <sys/systm.h>
31fa9e406ahrens#include <sys/sysmacros.h>
32fa9e406ahrens#include <sys/resource.h>
33fa9e406ahrens#include <sys/vfs.h>
34fa9e406ahrens#include <sys/vnode.h>
35da6c28aamw#include <sys/sid.h>
36fa9e406ahrens#include <sys/file.h>
37fa9e406ahrens#include <sys/stat.h>
38fa9e406ahrens#include <sys/kmem.h>
39fa9e406ahrens#include <sys/cmn_err.h>
40fa9e406ahrens#include <sys/errno.h>
41fa9e406ahrens#include <sys/unistd.h>
42169cdaemarks#include <sys/sdt.h>
43fa9e406ahrens#include <sys/fs/zfs.h>
44fa9e406ahrens#include <sys/mode.h>
45fa9e406ahrens#include <sys/policy.h>
46fa9e406ahrens#include <sys/zfs_znode.h>
47da6c28aamw#include <sys/zfs_fuid.h>
48fa9e406ahrens#include <sys/zfs_acl.h>
49fa9e406ahrens#include <sys/zfs_dir.h>
50fa9e406ahrens#include <sys/zfs_vfsops.h>
51fa9e406ahrens#include <sys/dmu.h>
52da6c28aamw#include <sys/dnode.h>
53fa9e406ahrens#include <sys/zap.h>
540a586ceMark Shellenbaum#include <sys/sa.h>
55fa9e406ahrens#include "fs/fs_subr.h"
56fa9e406ahrens#include <acl/acl_common.h>
57fa9e406ahrens
58fa9e406ahrens#define	ALLOW	ACE_ACCESS_ALLOWED_ACE_TYPE
59fa9e406ahrens#define	DENY	ACE_ACCESS_DENIED_ACE_TYPE
60da6c28aamw#define	MAX_ACE_TYPE	ACE_SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE
61003c258Mark Shellenbaum#define	MIN_ACE_TYPE	ALLOW
62fa9e406ahrens
63fa9e406ahrens#define	OWNING_GROUP		(ACE_GROUP|ACE_IDENTIFIER_GROUP)
64fa9e406ahrens#define	EVERYONE_ALLOW_MASK (ACE_READ_ACL|ACE_READ_ATTRIBUTES | \
65fa9e406ahrens    ACE_READ_NAMED_ATTRS|ACE_SYNCHRONIZE)
66fa9e406ahrens#define	EVERYONE_DENY_MASK (ACE_WRITE_ACL|ACE_WRITE_OWNER | \
67fa9e406ahrens    ACE_WRITE_ATTRIBUTES|ACE_WRITE_NAMED_ATTRS)
68fa9e406ahrens#define	OWNER_ALLOW_MASK (ACE_WRITE_ACL | ACE_WRITE_OWNER | \
69fa9e406ahrens    ACE_WRITE_ATTRIBUTES|ACE_WRITE_NAMED_ATTRS)
70da6c28aamw
71da6c28aamw#define	ZFS_CHECKED_MASKS (ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_READ_DATA| \
72da6c28aamw    ACE_READ_NAMED_ATTRS|ACE_WRITE_DATA|ACE_WRITE_ATTRIBUTES| \
73da6c28aamw    ACE_WRITE_NAMED_ATTRS|ACE_APPEND_DATA|ACE_EXECUTE|ACE_WRITE_OWNER| \
74da6c28aamw    ACE_WRITE_ACL|ACE_DELETE|ACE_DELETE_CHILD|ACE_SYNCHRONIZE)
75da6c28aamw
76f52e0e2Mark Shellenbaum#define	WRITE_MASK_DATA (ACE_WRITE_DATA|ACE_APPEND_DATA|ACE_WRITE_NAMED_ATTRS)
77f52e0e2Mark Shellenbaum#define	WRITE_MASK_ATTRS (ACE_WRITE_ACL|ACE_WRITE_OWNER|ACE_WRITE_ATTRIBUTES| \
78f52e0e2Mark Shellenbaum    ACE_DELETE|ACE_DELETE_CHILD)
79f52e0e2Mark Shellenbaum#define	WRITE_MASK (WRITE_MASK_DATA|WRITE_MASK_ATTRS)
80fa9e406ahrens
81fa9e406ahrens#define	OGE_CLEAR	(ACE_READ_DATA|ACE_LIST_DIRECTORY|ACE_WRITE_DATA| \
82fa9e406ahrens    ACE_ADD_FILE|ACE_APPEND_DATA|ACE_ADD_SUBDIRECTORY|ACE_EXECUTE)
83fa9e406ahrens
84fa9e406ahrens#define	OKAY_MASK_BITS (ACE_READ_DATA|ACE_LIST_DIRECTORY|ACE_WRITE_DATA| \
85fa9e406ahrens    ACE_ADD_FILE|ACE_APPEND_DATA|ACE_ADD_SUBDIRECTORY|ACE_EXECUTE)
86fa9e406ahrens
87fa9e406ahrens#define	ALL_INHERIT	(ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE | \
88da6c28aamw    ACE_NO_PROPAGATE_INHERIT_ACE|ACE_INHERIT_ONLY_ACE|ACE_INHERITED_ACE)
89fa9e406ahrens
90b3d141fmarks#define	RESTRICTED_CLEAR	(ACE_WRITE_ACL|ACE_WRITE_OWNER)
91fa9e406ahrens
92da6c28aamw#define	V4_ACL_WIDE_FLAGS (ZFS_ACL_AUTO_INHERIT|ZFS_ACL_DEFAULTED|\
93da6c28aamw    ZFS_ACL_PROTECTED)
94da6c28aamw
95da6c28aamw#define	ZFS_ACL_WIDE_FLAGS (V4_ACL_WIDE_FLAGS|ZFS_ACL_TRIVIAL|ZFS_INHERIT_ACE|\
96da6c28aamw    ZFS_ACL_OBJ_ACE)
97da6c28aamw
984929fd5Tim Haley#define	ALL_MODE_EXECS (S_IXUSR | S_IXGRP | S_IXOTH)
994929fd5Tim Haley
100da6c28aamwstatic uint16_t
101da6c28aamwzfs_ace_v0_get_type(void *acep)
102da6c28aamw{
103da6c28aamw	return (((zfs_oldace_t *)acep)->z_type);
104da6c28aamw}
105da6c28aamw
106da6c28aamwstatic uint16_t
107da6c28aamwzfs_ace_v0_get_flags(void *acep)
108da6c28aamw{
109da6c28aamw	return (((zfs_oldace_t *)acep)->z_flags);
110da6c28aamw}
111fa9e406ahrens
112da6c28aamwstatic uint32_t
113da6c28aamwzfs_ace_v0_get_mask(void *acep)
114da6c28aamw{
115da6c28aamw	return (((zfs_oldace_t *)acep)->z_access_mask);
116da6c28aamw}
117da6c28aamw
118da6c28aamwstatic uint64_t
119da6c28aamwzfs_ace_v0_get_who(void *acep)
120da6c28aamw{
121da6c28aamw	return (((zfs_oldace_t *)acep)->z_fuid);
122da6c28aamw}
123da6c28aamw
124da6c28aamwstatic void
125da6c28aamwzfs_ace_v0_set_type(void *acep, uint16_t type)
126da6c28aamw{
127da6c28aamw	((zfs_oldace_t *)acep)->z_type = type;
128da6c28aamw}
129da6c28aamw
130da6c28aamwstatic void
131da6c28aamwzfs_ace_v0_set_flags(void *acep, uint16_t flags)
132da6c28aamw{
133da6c28aamw	((zfs_oldace_t *)acep)->z_flags = flags;
134da6c28aamw}
135da6c28aamw
136da6c28aamwstatic void
137da6c28aamwzfs_ace_v0_set_mask(void *acep, uint32_t mask)
138da6c28aamw{
139da6c28aamw	((zfs_oldace_t *)acep)->z_access_mask = mask;
140da6c28aamw}
141da6c28aamw
142da6c28aamwstatic void
143da6c28aamwzfs_ace_v0_set_who(void *acep, uint64_t who)
144da6c28aamw{
145da6c28aamw	((zfs_oldace_t *)acep)->z_fuid = who;
146da6c28aamw}
147da6c28aamw
148da6c28aamw/*ARGSUSED*/
149da6c28aamwstatic size_t
150da6c28aamwzfs_ace_v0_size(void *acep)
151da6c28aamw{
152da6c28aamw	return (sizeof (zfs_oldace_t));
153da6c28aamw}
154da6c28aamw
155da6c28aamwstatic size_t
156da6c28aamwzfs_ace_v0_abstract_size(void)
157da6c28aamw{
158da6c28aamw	return (sizeof (zfs_oldace_t));
159da6c28aamw}
160da6c28aamw
161da6c28aamwstatic int
162da6c28aamwzfs_ace_v0_mask_off(void)
163da6c28aamw{
164da6c28aamw	return (offsetof(zfs_oldace_t, z_access_mask));
165da6c28aamw}
166da6c28aamw
167da6c28aamw/*ARGSUSED*/
168da6c28aamwstatic int
169da6c28aamwzfs_ace_v0_data(void *acep, void **datap)
170da6c28aamw{
171da6c28aamw	*datap = NULL;
172da6c28aamw	return (0);
173da6c28aamw}
174da6c28aamw
175da6c28aamwstatic acl_ops_t zfs_acl_v0_ops = {
176da6c28aamw	zfs_ace_v0_get_mask,
177da6c28aamw	zfs_ace_v0_set_mask,
178da6c28aamw	zfs_ace_v0_get_flags,
179da6c28aamw	zfs_ace_v0_set_flags,
180da6c28aamw	zfs_ace_v0_get_type,
181da6c28aamw	zfs_ace_v0_set_type,
182da6c28aamw	zfs_ace_v0_get_who,
183da6c28aamw	zfs_ace_v0_set_who,
184da6c28aamw	zfs_ace_v0_size,
185da6c28aamw	zfs_ace_v0_abstract_size,
186da6c28aamw	zfs_ace_v0_mask_off,
187da6c28aamw	zfs_ace_v0_data
188da6c28aamw};
189da6c28aamw
190da6c28aamwstatic uint16_t
191da6c28aamwzfs_ace_fuid_get_type(void *acep)
192da6c28aamw{
193da6c28aamw	return (((zfs_ace_hdr_t *)acep)->z_type);
194da6c28aamw}
195da6c28aamw
196da6c28aamwstatic uint16_t
197da6c28aamwzfs_ace_fuid_get_flags(void *acep)
198da6c28aamw{
199da6c28aamw	return (((zfs_ace_hdr_t *)acep)->z_flags);
200da6c28aamw}
201da6c28aamw
202da6c28aamwstatic uint32_t
203da6c28aamwzfs_ace_fuid_get_mask(void *acep)
204da6c28aamw{
205da6c28aamw	return (((zfs_ace_hdr_t *)acep)->z_access_mask);
206da6c28aamw}
207da6c28aamw
208da6c28aamwstatic uint64_t
209da6c28aamwzfs_ace_fuid_get_who(void *args)
210da6c28aamw{
211da6c28aamw	uint16_t entry_type;
212da6c28aamw	zfs_ace_t *acep = args;
213da6c28aamw
214da6c28aamw	entry_type = acep->z_hdr.z_flags & ACE_TYPE_FLAGS;
215da6c28aamw
216da6c28aamw	if (entry_type == ACE_OWNER || entry_type == OWNING_GROUP ||
217da6c28aamw	    entry_type == ACE_EVERYONE)
218da6c28aamw		return (-1);
219da6c28aamw	return (((zfs_ace_t *)acep)->z_fuid);
220da6c28aamw}
221da6c28aamw
222da6c28aamwstatic void
223da6c28aamwzfs_ace_fuid_set_type(void *acep, uint16_t type)
224da6c28aamw{
225da6c28aamw	((zfs_ace_hdr_t *)acep)->z_type = type;
226da6c28aamw}
227da6c28aamw
228da6c28aamwstatic void
229