1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved. 23 */ 24 25 #include <sys/types.h> 26 #include <sys/param.h> 27 #include <sys/time.h> 28 #include <sys/systm.h> 29 #include <sys/sysmacros.h> 30 #include <sys/resource.h> 31 #include <sys/vfs.h> 32 #include <sys/vnode.h> 33 #include <sys/sid.h> 34 #include <sys/file.h> 35 #include <sys/stat.h> 36 #include <sys/kmem.h> 37 #include <sys/cmn_err.h> 38 #include <sys/errno.h> 39 #include <sys/unistd.h> 40 #include <sys/sdt.h> 41 #include <sys/fs/zfs.h> 42 #include <sys/mode.h> 43 #include <sys/policy.h> 44 #include <sys/zfs_znode.h> 45 #include <sys/zfs_fuid.h> 46 #include <sys/zfs_acl.h> 47 #include <sys/zfs_dir.h> 48 #include <sys/zfs_vfsops.h> 49 #include <sys/dmu.h> 50 #include <sys/dnode.h> 51 #include <sys/zap.h> 52 #include <sys/sa.h> 53 #include "fs/fs_subr.h" 54 #include <acl/acl_common.h> 55 56 #define ALLOW ACE_ACCESS_ALLOWED_ACE_TYPE 57 #define DENY ACE_ACCESS_DENIED_ACE_TYPE 58 #define MAX_ACE_TYPE ACE_SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE 59 #define MIN_ACE_TYPE ALLOW 60 61 #define OWNING_GROUP (ACE_GROUP|ACE_IDENTIFIER_GROUP) 62 #define EVERYONE_ALLOW_MASK (ACE_READ_ACL|ACE_READ_ATTRIBUTES | \ 63 ACE_READ_NAMED_ATTRS|ACE_SYNCHRONIZE) 64 #define EVERYONE_DENY_MASK (ACE_WRITE_ACL|ACE_WRITE_OWNER | \ 65 ACE_WRITE_ATTRIBUTES|ACE_WRITE_NAMED_ATTRS) 66 #define OWNER_ALLOW_MASK (ACE_WRITE_ACL | ACE_WRITE_OWNER | \ 67 ACE_WRITE_ATTRIBUTES|ACE_WRITE_NAMED_ATTRS) 68 69 #define ZFS_CHECKED_MASKS (ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_READ_DATA| \ 70 ACE_READ_NAMED_ATTRS|ACE_WRITE_DATA|ACE_WRITE_ATTRIBUTES| \ 71 ACE_WRITE_NAMED_ATTRS|ACE_APPEND_DATA|ACE_EXECUTE|ACE_WRITE_OWNER| \ 72 ACE_WRITE_ACL|ACE_DELETE|ACE_DELETE_CHILD|ACE_SYNCHRONIZE) 73 74 #define WRITE_MASK_DATA (ACE_WRITE_DATA|ACE_APPEND_DATA|ACE_WRITE_NAMED_ATTRS) 75 #define WRITE_MASK_ATTRS (ACE_WRITE_ACL|ACE_WRITE_OWNER|ACE_WRITE_ATTRIBUTES| \ 76 ACE_DELETE|ACE_DELETE_CHILD) 77 #define WRITE_MASK (WRITE_MASK_DATA|WRITE_MASK_ATTRS) 78 79 #define OGE_CLEAR (ACE_READ_DATA|ACE_LIST_DIRECTORY|ACE_WRITE_DATA| \ 80 ACE_ADD_FILE|ACE_APPEND_DATA|ACE_ADD_SUBDIRECTORY|ACE_EXECUTE) 81 82 #define OKAY_MASK_BITS (ACE_READ_DATA|ACE_LIST_DIRECTORY|ACE_WRITE_DATA| \ 83 ACE_ADD_FILE|ACE_APPEND_DATA|ACE_ADD_SUBDIRECTORY|ACE_EXECUTE) 84 85 #define ALL_INHERIT (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE | \ 86 ACE_NO_PROPAGATE_INHERIT_ACE|ACE_INHERIT_ONLY_ACE|ACE_INHERITED_ACE) 87 88 #define RESTRICTED_CLEAR (ACE_WRITE_ACL|ACE_WRITE_OWNER) 89 90 #define V4_ACL_WIDE_FLAGS (ZFS_ACL_AUTO_INHERIT|ZFS_ACL_DEFAULTED|\ 91 ZFS_ACL_PROTECTED) 92 93 #define ZFS_ACL_WIDE_FLAGS (V4_ACL_WIDE_FLAGS|ZFS_ACL_TRIVIAL|ZFS_INHERIT_ACE|\ 94 ZFS_ACL_OBJ_ACE) 95 96 #define ALL_MODE_EXECS (S_IXUSR | S_IXGRP | S_IXOTH) 97 98 static uint16_t 99 zfs_ace_v0_get_type(void *acep) 100 { 101 return (((zfs_oldace_t *)acep)->z_type); 102 } 103 104 static uint16_t 105 zfs_ace_v0_get_flags(void *acep) 106 { 107 return (((zfs_oldace_t *)acep)->z_flags); 108 } 109 110 static uint32_t 111 zfs_ace_v0_get_mask(void *acep) 112 { 113 return (((zfs_oldace_t *)acep)->z_access_mask); 114 } 115 116 static uint64_t 117 zfs_ace_v0_get_who(void *acep) 118 { 119 return (((zfs_oldace_t *)acep)->z_fuid); 120 } 121 122 static void 123 zfs_ace_v0_set_type(void *acep, uint16_t type) 124 { 125 ((zfs_oldace_t *)acep)->z_type = type; 126 } 127 128 static void 129 zfs_ace_v0_set_flags(void *acep, uint16_t flags) 130 { 131 ((zfs_oldace_t *)acep)->z_flags = flags; 132 } 133 134 static void 135 zfs_ace_v0_set_mask(void *acep, uint32_t mask) 136 { 137 ((zfs_oldace_t *)acep)->z_access_mask = mask; 138 } 139 140 static void 141 zfs_ace_v0_set_who(void *acep, uint64_t who) 142 { 143 ((zfs_oldace_t *)acep)->z_fuid = who; 144 } 145 146 /*ARGSUSED*/ 147 static size_t 148 zfs_ace_v0_size(void *acep) 149 { 150 return (sizeof (zfs_oldace_t)); 151 } 152 153 static size_t 154 zfs_ace_v0_abstract_size(void) 155 { 156 return (sizeof (zfs_oldace_t)); 157 } 158 159 static int 160 zfs_ace_v0_mask_off(void) 161 { 162 return (offsetof(zfs_oldace_t, z_access_mask)); 163 } 164 165 /*ARGSUSED*/ 166 static int 167 zfs_ace_v0_data(void *acep, void **datap) 168 { 169 *datap = NULL; 170 return (0); 171 } 172 173 static acl_ops_t zfs_acl_v0_ops = { 174 zfs_ace_v0_get_mask, 175 zfs_ace_v0_set_mask, 176 zfs_ace_v0_get_flags, 177 zfs_ace_v0_set_flags, 178 zfs_ace_v0_get_type, 179 zfs_ace_v0_set_type, 180 zfs_ace_v0_get_who, 181 zfs_ace_v0_set_who, 182 zfs_ace_v0_size, 183 zfs_ace_v0_abstract_size, 184 zfs_ace_v0_mask_off, 185 zfs_ace_v0_data 186 }; 187 188 static uint16_t 189 zfs_ace_fuid_get_type(void *acep) 190 { 191 return (((zfs_ace_hdr_t *)acep)->z_type); 192 } 193 194 static uint16_t 195 zfs_ace_fuid_get_flags(void *acep) 196 { 197 return (((zfs_ace_hdr_t *)acep)->z_flags); 198 } 199 200 static uint32_t 201 zfs_ace_fuid_get_mask(void *acep) 202 { 203 return (((zfs_ace_hdr_t *)acep)->z_access_mask); 204 } 205 206 static uint64_t 207 zfs_ace_fuid_get_who(void *args) 208 { 209 uint16_t entry_type; 210 zfs_ace_t *acep = args; 211 212 entry_type = acep->z_hdr.z_flags & ACE_TYPE_FLAGS; 213 214 if (entry_type == ACE_OWNER || entry_type == OWNING_GROUP || 215 entry_type == ACE_EVERYONE) 216 return (-1); 217 return (((zfs_ace_t *)acep)->z_fuid); 218 } 219 220 static void 221 zfs_ace_fuid_set_type(void *acep, uint16_t type) 222 { 223 ((zfs_ace_hdr_t *)acep)->z_type = type; 224 } 225 226 static void 227 zfs_ace_fuid_set_flags(void *acep, uint16_t flags) 228 { 229 ((zfs_ace_hdr_t *)acep)->z_flags = flags; 230 } 231 232 static void 233 zfs_ace_fuid_set_mask(void *acep, uint32_t mask) 234 { 235 ((zfs_ace_hdr_t *)acep)->z_access_mask = mask; 236 } 237 238 static void 239 zfs_ace_fuid_set_who(void *arg, uint64_t who) 240 { 241 zfs_ace_t *acep = arg; 242 243 uint16_t entry_type = acep->z_hdr.z_flags & ACE_TYPE_FLAGS; 244 245 if (entry_type == ACE_OWNER || entry_type == OWNING_GROUP || 246 entry_type == ACE_EVERYONE) 247 return; 248 acep->z_fuid = who; 249 } 250 251 static size_t 252 zfs_ace_fuid_size(void *acep) 253 { 254 zfs_ace_hdr_t *zacep = acep; 255 uint16_t entry_type; 256 257 switch (zacep->z_type) { 258 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 259 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 260 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 261 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 262 return (sizeof (zfs_object_ace_t)); 263 case ALLOW: 264 case DENY: 265 entry_type = 266 (((zfs_ace_hdr_t *)acep)->z_flags & ACE_TYPE_FLAGS); 267 if (entry_type == ACE_OWNER || 268 entry_type == OWNING_GROUP || 269 entry_type == ACE_EVERYONE) 270 return (sizeof (zfs_ace_hdr_t)); 271 /*FALLTHROUGH*/ 272 default: 273 return (sizeof (zfs_ace_t)); 274 } 275 } 276 277 static size_t 278 zfs_ace_fuid_abstract_size(void) 279 { 280 return (sizeof (zfs_ace_hdr_t)); 281 } 282 283 static int 284 zfs_ace_fuid_mask_off(void) 285 { 286 return (offsetof(zfs_ace_hdr_t, z_access_mask)); 287 } 288 289 static int 290 zfs_ace_fuid_data(void *acep, void **datap) 291 { 292 zfs_ace_t *zacep = acep; 293 zfs_object_ace_t *zobjp; 294 295 switch (zacep->z_hdr.z_type) { 296 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 297 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 298 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 299 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 300 zobjp = acep; 301 *datap = (caddr_t)zobjp + sizeof (zfs_ace_t); 302 return (sizeof (zfs_object_ace_t) - sizeof (zfs_ace_t)); 303 default: 304 *datap = NULL; 305 return (0); 306 } 307 } 308 309 static acl_ops_t zfs_acl_fuid_ops = { 310 zfs_ace_fuid_get_mask, 311 zfs_ace_fuid_set_mask, 312 zfs_ace_fuid_get_flags, 313 zfs_ace_fuid_set_flags, 314 zfs_ace_fuid_get_type, 315 zfs_ace_fuid_set_type, 316 zfs_ace_fuid_get_who, 317 zfs_ace_fuid_set_who, 318 zfs_ace_fuid_size, 319 zfs_ace_fuid_abstract_size, 320 zfs_ace_fuid_mask_off, 321 zfs_ace_fuid_data 322 }; 323 324 /* 325 * The following three functions are provided for compatibility with 326 * older ZPL version in order to determine if the file use to have 327 * an external ACL and what version of ACL previously existed on the 328 * file. Would really be nice to not need this, sigh. 329 */ 330 uint64_t 331 zfs_external_acl(znode_t *zp) 332 { 333 zfs_acl_phys_t acl_phys; 334 int error; 335 336 if (zp->z_is_sa) 337 return (0); 338 339 /* 340 * Need to deal with a potential 341 * race where zfs_sa_upgrade could cause 342 * z_isa_sa to change. 343 * 344 * If the lookup fails then the state of z_is_sa should have 345 * changed. 346 */ 347 348 if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_ZNODE_ACL(zp->z_zfsvfs), 349 &acl_phys, sizeof (acl_phys))) == 0) 350 return (acl_phys.z_acl_extern_obj); 351 else { 352 /* 353 * after upgrade the SA_ZPL_ZNODE_ACL should have been 354 * removed 355 */ 356 VERIFY(zp->z_is_sa && error == ENOENT); 357 return (0); 358 } 359 } 360 361 /* 362 * Determine size of ACL in bytes 363 * 364 * This is more complicated than it should be since we have to deal 365 * with old external ACLs. 366 */ 367 static int 368 zfs_acl_znode_info(znode_t *zp, int *aclsize, int *aclcount, 369 zfs_acl_phys_t *aclphys) 370 { 371 zfsvfs_t *zfsvfs = zp->z_zfsvfs; 372 uint64_t acl_count; 373 int size; 374 int error; 375 376 ASSERT(MUTEX_HELD(&zp->z_acl_lock)); 377 if (zp->z_is_sa) { 378 if ((error = sa_size(zp->z_sa_hdl, SA_ZPL_DACL_ACES(zfsvfs), 379 &size)) != 0) 380 return (error); 381 *aclsize = size; 382 if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_DACL_COUNT(zfsvfs), 383 &acl_count, sizeof (acl_count))) != 0) 384 return (error); 385 *aclcount = acl_count; 386 } else { 387 if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_ZNODE_ACL(zfsvfs), 388 aclphys, sizeof (*aclphys))) != 0) 389 return (error); 390 391 if (aclphys->z_acl_version == ZFS_ACL_VERSION_INITIAL) { 392 *aclsize = ZFS_ACL_SIZE(aclphys->z_acl_size); 393 *aclcount = aclphys->z_acl_size; 394 } else { 395 *aclsize = aclphys->z_acl_size; 396 *aclcount = aclphys->z_acl_count; 397 } 398 } 399 return (0); 400 } 401 402 int 403 zfs_znode_acl_version(znode_t *zp) 404 { 405 zfs_acl_phys_t acl_phys; 406 407 if (zp->z_is_sa) 408 return (ZFS_ACL_VERSION_FUID); 409 else { 410 int error; 411 412 /* 413 * Need to deal with a potential 414 * race where zfs_sa_upgrade could cause 415 * z_isa_sa to change. 416 * 417 * If the lookup fails then the state of z_is_sa should have 418 * changed. 419 */ 420 if ((error = sa_lookup(zp->z_sa_hdl, 421 SA_ZPL_ZNODE_ACL(zp->z_zfsvfs), 422 &acl_phys, sizeof (acl_phys))) == 0) 423 return (acl_phys.z_acl_version); 424 else { 425 /* 426 * After upgrade SA_ZPL_ZNODE_ACL should have 427 * been removed. 428 */ 429 VERIFY(zp->z_is_sa && error == ENOENT); 430 return (ZFS_ACL_VERSION_FUID); 431 } 432 } 433 } 434 435 static int 436 zfs_acl_version(int version) 437 { 438 if (version < ZPL_VERSION_FUID) 439 return (ZFS_ACL_VERSION_INITIAL); 440 else 441 return (ZFS_ACL_VERSION_FUID); 442 } 443 444 static int 445 zfs_acl_version_zp(znode_t *zp) 446 { 447 return (zfs_acl_version(zp->z_zfsvfs->z_version)); 448 } 449 450 zfs_acl_t * 451 zfs_acl_alloc(int vers) 452 { 453 zfs_acl_t *aclp; 454 455 aclp = kmem_zalloc(sizeof (zfs_acl_t), KM_SLEEP); 456 list_create(&aclp->z_acl, sizeof (zfs_acl_node_t), 457 offsetof(zfs_acl_node_t, z_next)); 458 aclp->z_version = vers; 459 if (vers == ZFS_ACL_VERSION_FUID) 460 aclp->z_ops = zfs_acl_fuid_ops; 461 else 462 aclp->z_ops = zfs_acl_v0_ops; 463 return (aclp); 464 } 465 466 zfs_acl_node_t * 467 zfs_acl_node_alloc(size_t bytes) 468 { 469 zfs_acl_node_t *aclnode; 470 471 aclnode = kmem_zalloc(sizeof (zfs_acl_node_t), KM_SLEEP); 472 if (bytes) { 473 aclnode->z_acldata = kmem_alloc(bytes, KM_SLEEP); 474 aclnode->z_allocdata = aclnode->z_acldata; 475 aclnode->z_allocsize = bytes; 476 aclnode->z_size = bytes; 477 } 478 479 return (aclnode); 480 } 481 482 static void 483 zfs_acl_node_free(zfs_acl_node_t *aclnode) 484 { 485 if (aclnode->z_allocsize) 486 kmem_free(aclnode->z_allocdata, aclnode->z_allocsize); 487 kmem_free(aclnode, sizeof (zfs_acl_node_t)); 488 } 489 490 static void 491 zfs_acl_release_nodes(zfs_acl_t *aclp) 492 { 493 zfs_acl_node_t *aclnode; 494 495 while (aclnode = list_head(&aclp->z_acl)) { 496 list_remove(&aclp->z_acl, aclnode); 497 zfs_acl_node_free(aclnode); 498 } 499 aclp->z_acl_count = 0; 500 aclp->z_acl_bytes = 0; 501 } 502 503 void 504 zfs_acl_free(zfs_acl_t *aclp) 505 { 506 zfs_acl_release_nodes(aclp); 507 list_destroy(&aclp->z_acl); 508 kmem_free(aclp, sizeof (zfs_acl_t)); 509 } 510 511 static boolean_t 512 zfs_acl_valid_ace_type(uint_t type, uint_t flags) 513 { 514 uint16_t entry_type; 515 516 switch (type) { 517 case ALLOW: 518 case DENY: 519 case ACE_SYSTEM_AUDIT_ACE_TYPE: 520 case ACE_SYSTEM_ALARM_ACE_TYPE: 521 entry_type = flags & ACE_TYPE_FLAGS; 522 return (entry_type == ACE_OWNER || 523 entry_type == OWNING_GROUP || 524 entry_type == ACE_EVERYONE || entry_type == 0 || 525 entry_type == ACE_IDENTIFIER_GROUP); 526 default: 527 if (type >= MIN_ACE_TYPE && type <= MAX_ACE_TYPE) 528 return (B_TRUE); 529 } 530 return (B_FALSE); 531 } 532 533 static boolean_t 534 zfs_ace_valid(vtype_t obj_type, zfs_acl_t *aclp, uint16_t type, uint16_t iflags) 535 { 536 /* 537 * first check type of entry 538 */ 539 540 if (!zfs_acl_valid_ace_type(type, iflags)) 541 return (B_FALSE); 542 543 switch (type) { 544 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 545 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 546 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 547 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 548 if (aclp->z_version < ZFS_ACL_VERSION_FUID) 549 return (B_FALSE); 550 aclp->z_hints |= ZFS_ACL_OBJ_ACE; 551 } 552 553 /* 554 * next check inheritance level flags 555 */ 556 557 if (obj_type == VDIR && 558 (iflags & (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE))) 559 aclp->z_hints |= ZFS_INHERIT_ACE; 560 561 if (iflags & (ACE_INHERIT_ONLY_ACE|ACE_NO_PROPAGATE_INHERIT_ACE)) { 562 if ((iflags & (ACE_FILE_INHERIT_ACE| 563 ACE_DIRECTORY_INHERIT_ACE)) == 0) { 564 return (B_FALSE); 565 } 566 } 567 568 return (B_TRUE); 569 } 570 571 static void * 572 zfs_acl_next_ace(zfs_acl_t *aclp, void *start, uint64_t *who, 573 uint32_t *access_mask, uint16_t *iflags, uint16_t *type) 574 { 575 zfs_acl_node_t *aclnode; 576 577 ASSERT(aclp); 578 579 if (start == NULL) { 580 aclnode = list_head(&aclp->z_acl); 581 if (aclnode == NULL) 582 return (NULL); 583 584 aclp->z_next_ace = aclnode->z_acldata; 585 aclp->z_curr_node = aclnode; 586 aclnode->z_ace_idx = 0; 587 } 588 589 aclnode = aclp->z_curr_node; 590 591 if (aclnode == NULL) 592 return (NULL); 593 594 if (aclnode->z_ace_idx >= aclnode->z_ace_count) { 595 aclnode = list_next(&aclp->z_acl, aclnode); 596 if (aclnode == NULL) 597 return (NULL); 598 else { 599 aclp->z_curr_node = aclnode; 600 aclnode->z_ace_idx = 0; 601 aclp->z_next_ace = aclnode->z_acldata; 602 } 603 } 604 605 if (aclnode->z_ace_idx < aclnode->z_ace_count) { 606 void *acep = aclp->z_next_ace; 607 size_t ace_size; 608 609 /* 610 * Make sure we don't overstep our bounds 611 */ 612 ace_size = aclp->z_ops.ace_size(acep); 613 614 if (((caddr_t)acep + ace_size) > 615 ((caddr_t)aclnode->z_acldata + aclnode->z_size)) { 616 return (NULL); 617 } 618 619 *iflags = aclp->z_ops.ace_flags_get(acep); 620 *type = aclp->z_ops.ace_type_get(acep); 621 *access_mask = aclp->z_ops.ace_mask_get(acep); 622 *who = aclp->z_ops.ace_who_get(acep); 623 aclp->z_next_ace = (caddr_t)aclp->z_next_ace + ace_size; 624 aclnode->z_ace_idx++; 625 626 return ((void *)acep); 627 } 628 return (NULL); 629 } 630 631 /*ARGSUSED*/ 632 static uint64_t 633 zfs_ace_walk(void *datap, uint64_t cookie, int aclcnt, 634 uint16_t *flags, uint16_t *type, uint32_t *mask) 635 { 636 zfs_acl_t *aclp = datap; 637 zfs_ace_hdr_t *acep = (zfs_ace_hdr_t *)(uintptr_t)cookie; 638 uint64_t who; 639 640 acep = zfs_acl_next_ace(aclp, acep, &who, mask, 641 flags, type); 642 return ((uint64_t)(uintptr_t)acep); 643 } 644 645 static zfs_acl_node_t * 646 zfs_acl_curr_node(zfs_acl_t *aclp) 647 { 648 ASSERT(aclp->z_curr_node); 649 return (aclp->z_curr_node); 650 } 651 652 /* 653 * Copy ACE to internal ZFS format. 654 * While processing the ACL each ACE will be validated for correctness. 655 * ACE FUIDs will be created later. 656 */ 657 int 658 zfs_copy_ace_2_fuid(zfsvfs_t *zfsvfs, vtype_t obj_type, zfs_acl_t *aclp, 659 void *datap, zfs_ace_t *z_acl, uint64_t aclcnt, size_t *size, 660 zfs_fuid_info_t **fuidp, cred_t *cr) 661 { 662 int i; 663 uint16_t entry_type; 664 zfs_ace_t *aceptr = z_acl; 665 ace_t *acep = datap; 666 zfs_object_ace_t *zobjacep; 667 ace_object_t *aceobjp; 668 669 for (i = 0; i != aclcnt; i++) { 670 aceptr->z_hdr.z_access_mask = acep->a_access_mask; 671 aceptr->z_hdr.z_flags = acep->a_flags; 672 aceptr->z_hdr.z_type = acep->a_type; 673 entry_type = aceptr->z_hdr.z_flags & ACE_TYPE_FLAGS; 674 if (entry_type != ACE_OWNER && entry_type != OWNING_GROUP && 675 entry_type != ACE_EVERYONE) { 676 aceptr->z_fuid = zfs_fuid_create(zfsvfs, acep->a_who, 677 cr, (entry_type == 0) ? 678 ZFS_ACE_USER : ZFS_ACE_GROUP, fuidp); 679 } 680 681 /* 682 * Make sure ACE is valid 683 */ 684 if (zfs_ace_valid(obj_type, aclp, aceptr->z_hdr.z_type, 685 aceptr->z_hdr.z_flags) != B_TRUE) 686 return (EINVAL); 687 688 switch (acep->a_type) { 689 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 690 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 691 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 692 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 693 zobjacep = (zfs_object_ace_t *)aceptr; 694 aceobjp = (ace_object_t *)acep; 695 696 bcopy(aceobjp->a_obj_type, zobjacep->z_object_type, 697 sizeof (aceobjp->a_obj_type)); 698 bcopy(aceobjp->a_inherit_obj_type, 699 zobjacep->z_inherit_type, 700 sizeof (aceobjp->a_inherit_obj_type)); 701 acep = (ace_t *)((caddr_t)acep + sizeof (ace_object_t)); 702 break; 703 default: 704 acep = (ace_t *)((caddr_t)acep + sizeof (ace_t)); 705 } 706 707 aceptr = (zfs_ace_t *)((caddr_t)aceptr + 708 aclp->z_ops.ace_size(aceptr)); 709 } 710 711 *size = (caddr_t)aceptr - (caddr_t)z_acl; 712 713 return (0); 714 } 715 716 /* 717 * Copy ZFS ACEs to fixed size ace_t layout 718 */ 719 static void 720 zfs_copy_fuid_2_ace(zfsvfs_t *zfsvfs, zfs_acl_t *aclp, cred_t *cr, 721 void *datap, int filter) 722 { 723 uint64_t who; 724 uint32_t access_mask; 725 uint16_t iflags, type; 726 zfs_ace_hdr_t *zacep = NULL; 727 ace_t *acep = datap; 728 ace_object_t *objacep; 729 zfs_object_ace_t *zobjacep; 730 size_t ace_size; 731 uint16_t entry_type; 732 733 while (zacep = zfs_acl_next_ace(aclp, zacep, 734 &who, &access_mask, &iflags, &type)) { 735 736 switch (type) { 737 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 738 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 739 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 740 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 741 if (filter) { 742 continue; 743 } 744 zobjacep = (zfs_object_ace_t *)zacep; 745 objacep = (ace_object_t *)acep; 746 bcopy(zobjacep->z_object_type, 747 objacep->a_obj_type, 748 sizeof (zobjacep->z_object_type)); 749 bcopy(zobjacep->z_inherit_type, 750 objacep->a_inherit_obj_type, 751 sizeof (zobjacep->z_inherit_type)); 752 ace_size = sizeof (ace_object_t); 753 break; 754 default: 755 ace_size = sizeof (ace_t); 756 break; 757 } 758 759 entry_type = (iflags & ACE_TYPE_FLAGS); 760 if ((entry_type != ACE_OWNER && 761 entry_type != OWNING_GROUP && 762 entry_type != ACE_EVERYONE)) { 763 acep->a_who = zfs_fuid_map_id(zfsvfs, who, 764 cr, (entry_type & ACE_IDENTIFIER_GROUP) ? 765 ZFS_ACE_GROUP : ZFS_ACE_USER); 766 } else { 767 acep->a_who = (uid_t)(int64_t)who; 768 } 769 acep->a_access_mask = access_mask; 770 acep->a_flags = iflags; 771 acep->a_type = type; 772 acep = (ace_t *)((caddr_t)acep + ace_size); 773 } 774 } 775 776 static int 777 zfs_copy_ace_2_oldace(vtype_t obj_type, zfs_acl_t *aclp, ace_t *acep, 778 zfs_oldace_t *z_acl, int aclcnt, size_t *size) 779 { 780 int i; 781 zfs_oldace_t *aceptr = z_acl; 782 783 for (i = 0; i != aclcnt; i++, aceptr++) { 784 aceptr->z_access_mask = acep[i].a_access_mask; 785 aceptr->z_type = acep[i].a_type; 786 aceptr->z_flags = acep[i].a_flags; 787 aceptr->z_fuid = acep[i].a_who; 788 /* 789 * Make sure ACE is valid 790 */ 791 if (zfs_ace_valid(obj_type, aclp, aceptr->z_type, 792 aceptr->z_flags) != B_TRUE) 793 return (EINVAL); 794 } 795 *size = (caddr_t)aceptr - (caddr_t)z_acl; 796 return (0); 797 } 798 799 /* 800 * convert old ACL format to new 801 */ 802 void 803 zfs_acl_xform(znode_t *zp, zfs_acl_t *aclp, cred_t *cr) 804 { 805 zfs_oldace_t *oldaclp; 806 int i; 807 uint16_t type, iflags; 808 uint32_t access_mask; 809 uint64_t who; 810 void *cookie = NULL; 811 zfs_acl_node_t *newaclnode; 812 813 ASSERT(aclp->z_version == ZFS_ACL_VERSION_INITIAL); 814 /* 815 * First create the ACE in a contiguous piece of memory 816 * for zfs_copy_ace_2_fuid(). 817 * 818 * We only convert an ACL once, so this won't happen 819 * everytime. 820 */ 821 oldaclp = kmem_alloc(sizeof (zfs_oldace_t) * aclp->z_acl_count, 822 KM_SLEEP); 823 i = 0; 824 while (cookie = zfs_acl_next_ace(aclp, cookie, &who, 825 &access_mask, &iflags, &type)) { 826 oldaclp[i].z_flags = iflags; 827 oldaclp[i].z_type = type; 828 oldaclp[i].z_fuid = who; 829 oldaclp[i++].z_access_mask = access_mask; 830 } 831 832 newaclnode = zfs_acl_node_alloc(aclp->z_acl_count * 833 sizeof (zfs_object_ace_t)); 834 aclp->z_ops = zfs_acl_fuid_ops; 835 VERIFY(zfs_copy_ace_2_fuid(zp->z_zfsvfs, ZTOV(zp)->v_type, aclp, 836 oldaclp, newaclnode->z_acldata, aclp->z_acl_count, 837 &newaclnode->z_size, NULL, cr) == 0); 838 newaclnode->z_ace_count = aclp->z_acl_count; 839 aclp->z_version = ZFS_ACL_VERSION; 840 kmem_free(oldaclp, aclp->z_acl_count * sizeof (zfs_oldace_t)); 841 842 /* 843 * Release all previous ACL nodes 844 */ 845 846 zfs_acl_release_nodes(aclp); 847 848 list_insert_head(&aclp->z_acl, newaclnode); 849 850 aclp->z_acl_bytes = newaclnode->z_size; 851 aclp->z_acl_count = newaclnode->z_ace_count; 852 853 } 854 855 /* 856 * Convert unix access mask to v4 access mask 857 */ 858 static uint32_t 859 zfs_unix_to_v4(uint32_t access_mask) 860 { 861 uint32_t new_mask = 0; 862 863 if (access_mask & S_IXOTH) 864 new_mask |= ACE_EXECUTE; 865 if (access_mask & S_IWOTH) 866 new_mask |= ACE_WRITE_DATA; 867 if (access_mask & S_IROTH) 868 new_mask |= ACE_READ_DATA; 869 return (new_mask); 870 } 871 872 static void 873 zfs_set_ace(zfs_acl_t *aclp, void *acep, uint32_t access_mask, 874 uint16_t access_type, uint64_t fuid, uint16_t entry_type) 875 { 876 uint16_t type = entry_type & ACE_TYPE_FLAGS; 877 878 aclp->z_ops.ace_mask_set(acep, access_mask); 879 aclp->z_ops.ace_type_set(acep, access_type); 880 aclp->z_ops.ace_flags_set(acep, entry_type); 881 if ((type != ACE_OWNER && type != OWNING_GROUP && 882 type != ACE_EVERYONE)) 883 aclp->z_ops.ace_who_set(acep, fuid); 884 } 885 886 /* 887 * Determine mode of file based on ACL. 888 * Also, create FUIDs for any User/Group ACEs 889 */ 890 uint64_t 891 zfs_mode_compute(uint64_t fmode, zfs_acl_t *aclp, 892 uint64_t *pflags, uint64_t fuid, uint64_t fgid) 893 { 894 int entry_type; 895 mode_t mode; 896 mode_t seen = 0; 897 zfs_ace_hdr_t *acep = NULL; 898 uint64_t who; 899 uint16_t iflags, type; 900 uint32_t access_mask; 901 boolean_t an_exec_denied = B_FALSE; 902 903 mode = (fmode & (S_IFMT | S_ISUID | S_ISGID | S_ISVTX)); 904 905 while (acep = zfs_acl_next_ace(aclp, acep, &who, 906 &access_mask, &iflags, &type)) { 907 908 if (!zfs_acl_valid_ace_type(type, iflags)) 909 continue; 910 911 entry_type = (iflags & ACE_TYPE_FLAGS); 912 913 /* 914 * Skip over owner@, group@ or everyone@ inherit only ACEs 915 */ 916 if ((iflags & ACE_INHERIT_ONLY_ACE) && 917 (entry_type == ACE_OWNER || entry_type == ACE_EVERYONE || 918 entry_type == OWNING_GROUP)) 919 continue; 920 921 if (entry_type == ACE_OWNER || (entry_type == 0 && 922 who == fuid)) { 923 if ((access_mask & ACE_READ_DATA) && 924 (!(seen & S_IRUSR))) { 925 seen |= S_IRUSR; 926 if (type == ALLOW) { 927 mode |= S_IRUSR; 928 } 929 } 930 if ((access_mask & ACE_WRITE_DATA) && 931 (!(seen & S_IWUSR))) { 932 seen |= S_IWUSR; 933 if (type == ALLOW) { 934 mode |= S_IWUSR; 935 } 936 } 937 if ((access_mask & ACE_EXECUTE) && 938 (!(seen & S_IXUSR))) { 939 seen |= S_IXUSR; 940 if (type == ALLOW) { 941 mode |= S_IXUSR; 942 } 943 } 944 } else if (entry_type == OWNING_GROUP || 945 (entry_type == ACE_IDENTIFIER_GROUP && who == fgid)) { 946 if ((access_mask & ACE_READ_DATA) && 947 (!(seen & S_IRGRP))) { 948 seen |= S_IRGRP; 949 if (type == ALLOW) { 950 mode |= S_IRGRP; 951 } 952 } 953 if ((access_mask & ACE_WRITE_DATA) && 954 (!(seen & S_IWGRP))) { 955 seen |= S_IWGRP; 956 if (type == ALLOW) { 957 mode |= S_IWGRP; 958 } 959 } 960 if ((access_mask & ACE_EXECUTE) && 961 (!(seen & S_IXGRP))) { 962 seen |= S_IXGRP; 963 if (type == ALLOW) { 964 mode |= S_IXGRP; 965 } 966 } 967 } else if (entry_type == ACE_EVERYONE) { 968 if ((access_mask & ACE_READ_DATA)) { 969 if (!(seen & S_IRUSR)) { 970 seen |= S_IRUSR; 971 if (type == ALLOW) { 972 mode |= S_IRUSR; 973 } 974 } 975 if (!(seen & S_IRGRP)) { 976 seen |= S_IRGRP; 977 if (type == ALLOW) { 978 mode |= S_IRGRP; 979 } 980 } 981 if (!(seen & S_IROTH)) { 982 seen |= S_IROTH; 983 if (type == ALLOW) { 984 mode |= S_IROTH; 985 } 986 } 987 } 988 if ((access_mask & ACE_WRITE_DATA)) { 989 if (!(seen & S_IWUSR)) { 990 seen |= S_IWUSR; 991 if (type == ALLOW) { 992 mode |= S_IWUSR; 993 } 994 } 995 if (!(seen & S_IWGRP)) { 996 seen |= S_IWGRP; 997 if (type == ALLOW) { 998 mode |= S_IWGRP; 999 } 1000 } 1001 if (!(seen & S_IWOTH)) { 1002 seen |= S_IWOTH; 1003 if (type == ALLOW) { 1004 mode |= S_IWOTH; 1005 } 1006 } 1007 } 1008 if ((access_mask & ACE_EXECUTE)) { 1009 if (!(seen & S_IXUSR)) { 1010 seen |= S_IXUSR; 1011 if (type == ALLOW) { 1012 mode |= S_IXUSR; 1013 } 1014 } 1015 if (!(seen & S_IXGRP)) { 1016 seen |= S_IXGRP; 1017 if (type == ALLOW) { 1018 mode |= S_IXGRP; 1019 } 1020 } 1021 if (!(seen & S_IXOTH)) { 1022 seen |= S_IXOTH; 1023 if (type == ALLOW) { 1024 mode |= S_IXOTH; 1025 } 1026 } 1027 } 1028 } else { 1029 /* 1030 * Only care if this IDENTIFIER_GROUP or 1031 * USER ACE denies execute access to someone, 1032 * mode is not affected 1033 */ 1034 if ((access_mask & ACE_EXECUTE) && type == DENY) 1035 an_exec_denied = B_TRUE; 1036 } 1037 } 1038 1039 /* 1040 * Failure to allow is effectively a deny, so execute permission 1041 * is denied if it was never mentioned or if we explicitly 1042 * weren't allowed it. 1043 */ 1044 if (!an_exec_denied && 1045 ((seen & ALL_MODE_EXECS) != ALL_MODE_EXECS || 1046 (mode & ALL_MODE_EXECS) != ALL_MODE_EXECS)) 1047 an_exec_denied = B_TRUE; 1048 1049 if (an_exec_denied) 1050 *pflags &= ~ZFS_NO_EXECS_DENIED; 1051 else 1052 *pflags |= ZFS_NO_EXECS_DENIED; 1053 1054 return (mode); 1055 } 1056 1057 /* 1058 * Read an external acl object. If the intent is to modify, always 1059 * create a new acl and leave any cached acl in place. 1060 */ 1061 static int 1062 zfs_acl_node_read(znode_t *zp, boolean_t have_lock, zfs_acl_t **aclpp, 1063 boolean_t will_modify) 1064 { 1065 zfs_acl_t *aclp; 1066 int aclsize; 1067 int acl_count; 1068 zfs_acl_node_t *aclnode; 1069 zfs_acl_phys_t znode_acl; 1070 int version; 1071 int error; 1072 boolean_t drop_lock = B_FALSE; 1073 1074 ASSERT(MUTEX_HELD(&zp->z_acl_lock)); 1075 1076 if (zp->z_acl_cached && !will_modify) { 1077 *aclpp = zp->z_acl_cached; 1078 return (0); 1079 } 1080 1081 /* 1082 * close race where znode could be upgrade while trying to 1083 * read the znode attributes. 1084 * 1085 * But this could only happen if the file isn't already an SA 1086 * znode 1087 */ 1088 if (!zp->z_is_sa && !have_lock) { 1089 mutex_enter(&zp->z_lock); 1090 drop_lock = B_TRUE; 1091 } 1092 version = zfs_znode_acl_version(zp); 1093 1094 if ((error = zfs_acl_znode_info(zp, &aclsize, 1095 &acl_count, &znode_acl)) != 0) { 1096 goto done; 1097 } 1098 1099 aclp = zfs_acl_alloc(version); 1100 1101 aclp->z_acl_count = acl_count; 1102 aclp->z_acl_bytes = aclsize; 1103 1104 aclnode = zfs_acl_node_alloc(aclsize); 1105 aclnode->z_ace_count = aclp->z_acl_count; 1106 aclnode->z_size = aclsize; 1107 1108 if (!zp->z_is_sa) { 1109 if (znode_acl.z_acl_extern_obj) { 1110 error = dmu_read(zp->z_zfsvfs->z_os, 1111 znode_acl.z_acl_extern_obj, 0, aclnode->z_size, 1112 aclnode->z_acldata, DMU_READ_PREFETCH); 1113 } else { 1114 bcopy(znode_acl.z_ace_data, aclnode->z_acldata, 1115 aclnode->z_size); 1116 } 1117 } else { 1118 error = sa_lookup(zp->z_sa_hdl, SA_ZPL_DACL_ACES(zp->z_zfsvfs), 1119 aclnode->z_acldata, aclnode->z_size); 1120 } 1121 1122 if (error != 0) { 1123 zfs_acl_free(aclp); 1124 zfs_acl_node_free(aclnode); 1125 /* convert checksum errors into IO errors */ 1126 if (error == ECKSUM) 1127 error = EIO; 1128 goto done; 1129 } 1130 1131 list_insert_head(&aclp->z_acl, aclnode); 1132 1133 *aclpp = aclp; 1134 if (!will_modify) 1135 zp->z_acl_cached = aclp; 1136 done: 1137 if (drop_lock) 1138 mutex_exit(&zp->z_lock); 1139 return (error); 1140 } 1141 1142 /*ARGSUSED*/ 1143 void 1144 zfs_acl_data_locator(void **dataptr, uint32_t *length, uint32_t buflen, 1145 boolean_t start, void *userdata) 1146 { 1147 zfs_acl_locator_cb_t *cb = (zfs_acl_locator_cb_t *)userdata; 1148 1149 if (start) { 1150 cb->cb_acl_node = list_head(&cb->cb_aclp->z_acl); 1151 } else { 1152 cb->cb_acl_node = list_next(&cb->cb_aclp->z_acl, 1153 cb->cb_acl_node); 1154 } 1155 *dataptr = cb->cb_acl_node->z_acldata; 1156 *length = cb->cb_acl_node->z_size; 1157 } 1158 1159 1160 static int 1161 zfs_acl_get_owner_fuids(znode_t *zp, uint64_t *fuid, uint64_t *fgid) 1162 { 1163 int count = 0; 1164 sa_bulk_attr_t bulk[2]; 1165 int error; 1166 1167 if (IS_EPHEMERAL(zp->z_uid) || IS_EPHEMERAL(zp->z_gid)) { 1168 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_UID(zp->z_zfsvfs), NULL, 1169 &fuid, sizeof (fuid)); 1170 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_GID(zp->z_zfsvfs), NULL, 1171 &fgid, sizeof (fuid)); 1172 if ((error = sa_bulk_lookup(zp->z_sa_hdl, bulk, count)) != 0) { 1173 return (error); 1174 } 1175 } else { 1176 *fuid = zp->z_uid; 1177 *fgid = zp->z_gid; 1178 } 1179 return (0); 1180 } 1181 1182 int 1183 zfs_acl_chown_setattr(znode_t *zp) 1184 { 1185 int error; 1186 zfs_acl_t *aclp; 1187 uint64_t fuid, fgid; 1188 1189 ASSERT(MUTEX_HELD(&zp->z_lock)); 1190 ASSERT(MUTEX_HELD(&zp->z_acl_lock)); 1191 if ((error = zfs_acl_get_owner_fuids(zp, &fuid, &fgid)) != 0) 1192 return (error); 1193 1194 if ((error = zfs_acl_node_read(zp, B_TRUE, &aclp, B_FALSE)) == 0) 1195 zp->z_mode = zfs_mode_compute(zp->z_mode, aclp, 1196 &zp->z_pflags, fuid, fgid); 1197 return (error); 1198 } 1199 1200 /* 1201 * common code for setting ACLs. 1202 * 1203 * This function is called from zfs_mode_update, zfs_perm_init, and zfs_setacl. 1204 * zfs_setacl passes a non-NULL inherit pointer (ihp) to indicate that it's 1205 * already checked the acl and knows whether to inherit. 1206 */ 1207 int 1208 zfs_aclset_common(znode_t *zp, zfs_acl_t *aclp, cred_t *cr, dmu_tx_t *tx) 1209 { 1210 int error; 1211 zfsvfs_t *zfsvfs = zp->z_zfsvfs; 1212 dmu_object_type_t otype; 1213 zfs_acl_locator_cb_t locate = { 0 }; 1214 uint64_t mode; 1215 sa_bulk_attr_t bulk[5]; 1216 uint64_t ctime[2]; 1217 int count = 0; 1218 uint64_t fuid, fgid; 1219 1220 mode = zp->z_mode; 1221 1222 if ((error = zfs_acl_get_owner_fuids(zp, &fuid, &fgid)) != 0) 1223 return (error); 1224 1225 mode = zfs_mode_compute(mode, aclp, &zp->z_pflags, fuid, fgid); 1226 1227 zp->z_mode = mode; 1228 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_MODE(zfsvfs), NULL, 1229 &mode, sizeof (mode)); 1230 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_FLAGS(zfsvfs), NULL, 1231 &zp->z_pflags, sizeof (zp->z_pflags)); 1232 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_CTIME(zfsvfs), NULL, 1233 &ctime, sizeof (ctime)); 1234 1235 if (zp->z_acl_cached) { 1236 zfs_acl_free(zp->z_acl_cached); 1237 zp->z_acl_cached = NULL; 1238 } 1239 1240 /* 1241 * Upgrade needed? 1242 */ 1243 if (!zfsvfs->z_use_fuids) { 1244 otype = DMU_OT_OLDACL; 1245 } else { 1246 if ((aclp->z_version == ZFS_ACL_VERSION_INITIAL) && 1247 (zfsvfs->z_version >= ZPL_VERSION_FUID)) 1248 zfs_acl_xform(zp, aclp, cr); 1249 ASSERT(aclp->z_version >= ZFS_ACL_VERSION_FUID); 1250 otype = DMU_OT_ACL; 1251 } 1252 1253 /* 1254 * Arrgh, we have to handle old on disk format 1255 * as well as newer (preferred) SA format. 1256 */ 1257 1258 if (zp->z_is_sa) { /* the easy case, just update the ACL attribute */ 1259 locate.cb_aclp = aclp; 1260 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_DACL_ACES(zfsvfs), 1261 zfs_acl_data_locator, &locate, aclp->z_acl_bytes); 1262 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_DACL_COUNT(zfsvfs), 1263 NULL, &aclp->z_acl_count, sizeof (uint64_t)); 1264 } else { /* Painful legacy way */ 1265 zfs_acl_node_t *aclnode; 1266 uint64_t off = 0; 1267 zfs_acl_phys_t acl_phys; 1268 uint64_t aoid; 1269 1270 if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_ZNODE_ACL(zfsvfs), 1271 &acl_phys, sizeof (acl_phys))) != 0) 1272 return (error); 1273 1274 aoid = acl_phys.z_acl_extern_obj; 1275 1276 if (aclp->z_acl_bytes > ZFS_ACE_SPACE) { 1277 /* 1278 * If ACL was previously external and we are now 1279 * converting to new ACL format then release old 1280 * ACL object and create a new one. 1281 */ 1282 if (aoid && 1283 aclp->z_version != acl_phys.z_acl_version) { 1284 error = dmu_object_free(zfsvfs->z_os, aoid, tx); 1285 if (error) 1286 return (error); 1287 aoid = 0; 1288 } 1289 if (aoid == 0) { 1290 aoid = dmu_object_alloc(zfsvfs->z_os, 1291 otype, aclp->z_acl_bytes, 1292 otype == DMU_OT_ACL ? 1293 DMU_OT_SYSACL : DMU_OT_NONE, 1294 otype == DMU_OT_ACL ? 1295 DN_MAX_BONUSLEN : 0, tx); 1296 } else { 1297 (void) dmu_object_set_blocksize(zfsvfs->z_os, 1298 aoid, aclp->z_acl_bytes, 0, tx); 1299 } 1300 acl_phys.z_acl_extern_obj = aoid; 1301 for (aclnode = list_head(&aclp->z_acl); aclnode; 1302 aclnode = list_next(&aclp->z_acl, aclnode)) { 1303 if (aclnode->z_ace_count == 0) 1304 continue; 1305 dmu_write(zfsvfs->z_os, aoid, off, 1306 aclnode->z_size, aclnode->z_acldata, tx); 1307 off += aclnode->z_size; 1308 } 1309 } else { 1310 void *start = acl_phys.z_ace_data; 1311 /* 1312 * Migrating back embedded? 1313 */ 1314 if (acl_phys.z_acl_extern_obj) { 1315 error = dmu_object_free(zfsvfs->z_os, 1316 acl_phys.z_acl_extern_obj, tx); 1317 if (error) 1318 return (error); 1319 acl_phys.z_acl_extern_obj = 0; 1320 } 1321 1322 for (aclnode = list_head(&aclp->z_acl); aclnode; 1323 aclnode = list_next(&aclp->z_acl, aclnode)) { 1324 if (aclnode->z_ace_count == 0) 1325 continue; 1326 bcopy(aclnode->z_acldata, start, 1327 aclnode->z_size); 1328 start = (caddr_t)start + aclnode->z_size; 1329 } 1330 } 1331 /* 1332 * If Old version then swap count/bytes to match old 1333 * layout of znode_acl_phys_t. 1334 */ 1335 if (aclp->z_version == ZFS_ACL_VERSION_INITIAL) { 1336 acl_phys.z_acl_size = aclp->z_acl_count; 1337 acl_phys.z_acl_count = aclp->z_acl_bytes; 1338 } else { 1339 acl_phys.z_acl_size = aclp->z_acl_bytes; 1340 acl_phys.z_acl_count = aclp->z_acl_count; 1341 } 1342 acl_phys.z_acl_version = aclp->z_version; 1343 1344 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_ZNODE_ACL(zfsvfs), NULL, 1345 &acl_phys, sizeof (acl_phys)); 1346 } 1347 1348 /* 1349 * Replace ACL wide bits, but first clear them. 1350 */ 1351 zp->z_pflags &= ~ZFS_ACL_WIDE_FLAGS; 1352 1353 zp->z_pflags |= aclp->z_hints; 1354 1355 if (ace_trivial_common(aclp, 0, zfs_ace_walk) == 0) 1356 zp->z_pflags |= ZFS_ACL_TRIVIAL; 1357 1358 zfs_tstamp_update_setup(zp, STATE_CHANGED, NULL, ctime, B_TRUE); 1359 return (sa_bulk_update(zp->z_sa_hdl, bulk, count, tx)); 1360 } 1361 1362 /* 1363 * Update access mask for prepended ACE 1364 * 1365 * This applies the "groupmask" value for aclmode property. 1366 */ 1367 static void 1368 zfs_acl_prepend_fixup(zfs_acl_t *aclp, void *acep, void *origacep, 1369 mode_t mode, uint64_t owner) 1370 { 1371 int rmask, wmask, xmask; 1372 int user_ace; 1373 uint16_t aceflags; 1374 uint32_t origmask, acepmask; 1375 uint64_t fuid; 1376 1377 aceflags = aclp->z_ops.ace_flags_get(acep); 1378 fuid = aclp->z_ops.ace_who_get(acep); 1379 origmask = aclp->z_ops.ace_mask_get(origacep); 1380 acepmask = aclp->z_ops.ace_mask_get(acep); 1381 1382 user_ace = (!(aceflags & 1383 (ACE_OWNER|ACE_GROUP|ACE_IDENTIFIER_GROUP))); 1384 1385 if (user_ace && (fuid == owner)) { 1386 rmask = S_IRUSR; 1387 wmask = S_IWUSR; 1388 xmask = S_IXUSR; 1389 } else { 1390 rmask = S_IRGRP; 1391 wmask = S_IWGRP; 1392 xmask = S_IXGRP; 1393 } 1394 1395 if (origmask & ACE_READ_DATA) { 1396 if (mode & rmask) { 1397 acepmask &= ~ACE_READ_DATA; 1398 } else { 1399 acepmask |= ACE_READ_DATA; 1400 } 1401 } 1402 1403 if (origmask & ACE_WRITE_DATA) { 1404 if (mode & wmask) { 1405 acepmask &= ~ACE_WRITE_DATA; 1406 } else { 1407 acepmask |= ACE_WRITE_DATA; 1408 } 1409 } 1410 1411 if (origmask & ACE_APPEND_DATA) { 1412 if (mode & wmask) { 1413 acepmask &= ~ACE_APPEND_DATA; 1414 } else { 1415 acepmask |= ACE_APPEND_DATA; 1416 } 1417 } 1418 1419 if (origmask & ACE_EXECUTE) { 1420 if (mode & xmask) { 1421 acepmask &= ~ACE_EXECUTE; 1422 } else { 1423 acepmask |= ACE_EXECUTE; 1424 } 1425 } 1426 aclp->z_ops.ace_mask_set(acep, acepmask); 1427 } 1428 1429 static void 1430 zfs_acl_chmod(zfsvfs_t *zfsvfs, uint64_t mode, zfs_acl_t *aclp) 1431 { 1432 void *acep = NULL; 1433 uint64_t who; 1434 int new_count, new_bytes; 1435 int ace_size; 1436 int entry_type; 1437 uint16_t iflags, type; 1438 uint32_t access_mask; 1439 zfs_acl_node_t *newnode; 1440 size_t abstract_size = aclp->z_ops.ace_abstract_size(); 1441 void *zacep; 1442 uint32_t owner, group, everyone; 1443 uint32_t deny1, deny2, allow0; 1444 1445 new_count = new_bytes = 0; 1446 1447 acl_trivial_access_masks((mode_t)mode, &allow0, &deny1, &deny2, 1448 &owner, &group, &everyone); 1449 1450 newnode = zfs_acl_node_alloc((abstract_size * 6) + aclp->z_acl_bytes); 1451 1452 zacep = newnode->z_acldata; 1453 if (allow0) { 1454 zfs_set_ace(aclp, zacep, allow0, ALLOW, -1, ACE_OWNER); 1455 zacep = (void *)((uintptr_t)zacep + abstract_size); 1456 new_count++; 1457 new_bytes += abstract_size; 1458 } if (deny1) { 1459 zfs_set_ace(aclp, zacep, deny1, DENY, -1, ACE_OWNER); 1460 zacep = (void *)((uintptr_t)zacep + abstract_size); 1461 new_count++; 1462 new_bytes += abstract_size; 1463 } 1464 if (deny2) { 1465 zfs_set_ace(aclp, zacep, deny2, DENY, -1, OWNING_GROUP); 1466 zacep = (void *)((uintptr_t)zacep + abstract_size); 1467 new_count++; 1468 new_bytes += abstract_size; 1469 } 1470 1471 while (acep = zfs_acl_next_ace(aclp, acep, &who, &access_mask, 1472 &iflags, &type)) { 1473 uint16_t inherit_flags; 1474 1475 entry_type = (iflags & ACE_TYPE_FLAGS); 1476 inherit_flags = (iflags & ALL_INHERIT); 1477 1478 if ((entry_type == ACE_OWNER || entry_type == ACE_EVERYONE || 1479 (entry_type == OWNING_GROUP)) && 1480 ((inherit_flags & ACE_INHERIT_ONLY_ACE) == 0)) { 1481 continue; 1482 } 1483 1484 if ((type != ALLOW && type != DENY) || 1485 (inherit_flags & ACE_INHERIT_ONLY_ACE)) { 1486 if (inherit_flags) 1487 aclp->z_hints |= ZFS_INHERIT_ACE; 1488 switch (type) { 1489 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 1490 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 1491 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 1492 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 1493 aclp->z_hints |= ZFS_ACL_OBJ_ACE; 1494 break; 1495 } 1496 } else { 1497 1498 /* 1499 * Limit permissions to be no greater than 1500 * group permissions 1501 */ 1502 if (zfsvfs->z_acl_inherit == ZFS_ACL_RESTRICTED) { 1503 if (!(mode & S_IRGRP)) 1504 access_mask &= ~ACE_READ_DATA; 1505 if (!(mode & S_IWGRP)) 1506 access_mask &= 1507 ~(ACE_WRITE_DATA|ACE_APPEND_DATA); 1508 if (!(mode & S_IXGRP)) 1509 access_mask &= ~ACE_EXECUTE; 1510 access_mask &= 1511 ~(ACE_WRITE_OWNER|ACE_WRITE_ACL| 1512 ACE_WRITE_ATTRIBUTES|ACE_WRITE_NAMED_ATTRS); 1513 } 1514 } 1515 zfs_set_ace(aclp, zacep, access_mask, type, who, iflags); 1516 ace_size = aclp->z_ops.ace_size(acep); 1517 zacep = (void *)((uintptr_t)zacep + ace_size); 1518 new_count++; 1519 new_bytes += ace_size; 1520 } 1521 zfs_set_ace(aclp, zacep, owner, 0, -1, ACE_OWNER); 1522 zacep = (void *)((uintptr_t)zacep + abstract_size); 1523 zfs_set_ace(aclp, zacep, group, 0, -1, OWNING_GROUP); 1524 zacep = (void *)((uintptr_t)zacep + abstract_size); 1525 zfs_set_ace(aclp, zacep, everyone, 0, -1, ACE_EVERYONE); 1526 1527 new_count += 3; 1528 new_bytes += abstract_size * 3; 1529 zfs_acl_release_nodes(aclp); 1530 aclp->z_acl_count = new_count; 1531 aclp->z_acl_bytes = new_bytes; 1532 newnode->z_ace_count = new_count; 1533 newnode->z_size = new_bytes; 1534 list_insert_tail(&aclp->z_acl, newnode); 1535 } 1536 1537 int 1538 zfs_acl_chmod_setattr(znode_t *zp, zfs_acl_t **aclp, uint64_t mode) 1539 { 1540 mutex_enter(&zp->z_acl_lock); 1541 mutex_enter(&zp->z_lock); 1542 *aclp = zfs_acl_alloc(zfs_acl_version_zp(zp)); 1543 (*aclp)->z_hints = zp->z_pflags & V4_ACL_WIDE_FLAGS; 1544 zfs_acl_chmod(zp->z_zfsvfs, mode, *aclp); 1545 mutex_exit(&zp->z_lock); 1546 mutex_exit(&zp->z_acl_lock); 1547 ASSERT(*aclp); 1548 return (0); 1549 } 1550 1551 /* 1552 * strip off write_owner and write_acl 1553 */ 1554 static void 1555 zfs_restricted_update(zfsvfs_t *zfsvfs, zfs_acl_t *aclp, void *acep) 1556 { 1557 uint32_t mask = aclp->z_ops.ace_mask_get(acep); 1558 1559 if ((zfsvfs->z_acl_inherit == ZFS_ACL_RESTRICTED) && 1560 (aclp->z_ops.ace_type_get(acep) == ALLOW)) { 1561 mask &= ~RESTRICTED_CLEAR; 1562 aclp->z_ops.ace_mask_set(acep, mask); 1563 } 1564 } 1565 1566 /* 1567 * Should ACE be inherited? 1568 */ 1569 static int 1570 zfs_ace_can_use(vtype_t vtype, uint16_t acep_flags) 1571 { 1572 int iflags = (acep_flags & 0xf); 1573 1574 if ((vtype == VDIR) && (iflags & ACE_DIRECTORY_INHERIT_ACE)) 1575 return (1); 1576 else if (iflags & ACE_FILE_INHERIT_ACE) 1577 return (!((vtype == VDIR) && 1578 (iflags & ACE_NO_PROPAGATE_INHERIT_ACE))); 1579 return (0); 1580 } 1581 1582 /* 1583 * inherit inheritable ACEs from parent 1584 */ 1585 static zfs_acl_t * 1586 zfs_acl_inherit(zfsvfs_t *zfsvfs, vtype_t vtype, zfs_acl_t *paclp, 1587 uint64_t mode, boolean_t *need_chmod) 1588 { 1589 void *pacep; 1590 void *acep; 1591 zfs_acl_node_t *aclnode; 1592 zfs_acl_t *aclp = NULL; 1593 uint64_t who; 1594 uint32_t access_mask; 1595 uint16_t iflags, newflags, type; 1596 size_t ace_size; 1597 void *data1, *data2; 1598 size_t data1sz, data2sz; 1599 boolean_t vdir = vtype == VDIR; 1600 boolean_t vreg = vtype == VREG; 1601 boolean_t passthrough, passthrough_x, noallow; 1602 1603 passthrough_x = 1604 zfsvfs->z_acl_inherit == ZFS_ACL_PASSTHROUGH_X; 1605 passthrough = passthrough_x || 1606 zfsvfs->z_acl_inherit == ZFS_ACL_PASSTHROUGH; 1607 noallow = 1608 zfsvfs->z_acl_inherit == ZFS_ACL_NOALLOW; 1609 1610 *need_chmod = B_TRUE; 1611 pacep = NULL; 1612 aclp = zfs_acl_alloc(paclp->z_version); 1613 if (zfsvfs->z_acl_inherit == ZFS_ACL_DISCARD || vtype == VLNK) 1614 return (aclp); 1615 while (pacep = zfs_acl_next_ace(paclp, pacep, &who, 1616 &access_mask, &iflags, &type)) { 1617 1618 /* 1619 * don't inherit bogus ACEs 1620 */ 1621 if (!zfs_acl_valid_ace_type(type, iflags)) 1622 continue; 1623 1624 if (noallow && type == ALLOW) 1625 continue; 1626 1627 ace_size = aclp->z_ops.ace_size(pacep); 1628 1629 if (!zfs_ace_can_use(vtype, iflags)) 1630 continue; 1631 1632 /* 1633 * If owner@, group@, or everyone@ inheritable 1634 * then zfs_acl_chmod() isn't needed. 1635 */ 1636 if (passthrough && 1637 ((iflags & (ACE_OWNER|ACE_EVERYONE)) || 1638 ((iflags & OWNING_GROUP) == 1639 OWNING_GROUP)) && (vreg || (vdir && (iflags & 1640 ACE_DIRECTORY_INHERIT_ACE)))) { 1641 *need_chmod = B_FALSE; 1642 } 1643 1644 if (!vdir && passthrough_x && 1645 ((mode & (S_IXUSR | S_IXGRP | S_IXOTH)) == 0)) { 1646 access_mask &= ~ACE_EXECUTE; 1647 } 1648 1649 aclnode = zfs_acl_node_alloc(ace_size); 1650 list_insert_tail(&aclp->z_acl, aclnode); 1651 acep = aclnode->z_acldata; 1652 1653 zfs_set_ace(aclp, acep, access_mask, type, 1654 who, iflags|ACE_INHERITED_ACE); 1655 1656 /* 1657 * Copy special opaque data if any 1658 */ 1659 if ((data1sz = paclp->z_ops.ace_data(pacep, &data1)) != 0) { 1660 VERIFY((data2sz = aclp->z_ops.ace_data(acep, 1661 &data2)) == data1sz); 1662 bcopy(data1, data2, data2sz); 1663 } 1664 1665 aclp->z_acl_count++; 1666 aclnode->z_ace_count++; 1667 aclp->z_acl_bytes += aclnode->z_size; 1668 newflags = aclp->z_ops.ace_flags_get(acep); 1669 1670 if (vdir) 1671 aclp->z_hints |= ZFS_INHERIT_ACE; 1672 1673 if ((iflags & ACE_NO_PROPAGATE_INHERIT_ACE) || !vdir) { 1674 newflags &= ~ALL_INHERIT; 1675 aclp->z_ops.ace_flags_set(acep, 1676 newflags|ACE_INHERITED_ACE); 1677 zfs_restricted_update(zfsvfs, aclp, acep); 1678 continue; 1679 } 1680 1681 ASSERT(vdir); 1682 1683 /* 1684 * If only FILE_INHERIT is set then turn on 1685 * inherit_only 1686 */ 1687 if ((iflags & (ACE_FILE_INHERIT_ACE | 1688 ACE_DIRECTORY_INHERIT_ACE)) == ACE_FILE_INHERIT_ACE) { 1689 newflags |= ACE_INHERIT_ONLY_ACE; 1690 aclp->z_ops.ace_flags_set(acep, 1691 newflags|ACE_INHERITED_ACE); 1692 } else { 1693 newflags &= ~ACE_INHERIT_ONLY_ACE; 1694 aclp->z_ops.ace_flags_set(acep, 1695 newflags|ACE_INHERITED_ACE); 1696 } 1697 } 1698 return (aclp); 1699 } 1700 1701 /* 1702 * Create file system object initial permissions 1703 * including inheritable ACEs. 1704 */ 1705 int 1706 zfs_acl_ids_create(znode_t *dzp, int flag, vattr_t *vap, cred_t *cr, 1707 vsecattr_t *vsecp, zfs_acl_ids_t *acl_ids) 1708 { 1709 int error; 1710 zfsvfs_t *zfsvfs = dzp->z_zfsvfs; 1711 zfs_acl_t *paclp; 1712 gid_t gid; 1713 boolean_t need_chmod = B_TRUE; 1714 boolean_t inherited = B_FALSE; 1715 uint64_t parentgid; 1716 1717 bzero(acl_ids, sizeof (zfs_acl_ids_t)); 1718 acl_ids->z_mode = MAKEIMODE(vap->va_type, vap->va_mode); 1719 1720 if (vsecp) 1721 if ((error = zfs_vsec_2_aclp(zfsvfs, vap->va_type, vsecp, cr, 1722 &acl_ids->z_fuidp, &acl_ids->z_aclp)) != 0) 1723 return (error); 1724 /* 1725 * Determine uid and gid. 1726 */ 1727 if ((flag & IS_ROOT_NODE) || zfsvfs->z_replay || 1728 ((flag & IS_XATTR) && (vap->va_type == VDIR))) { 1729 acl_ids->z_fuid = zfs_fuid_create(zfsvfs, 1730 (uint64_t)vap->va_uid, cr, 1731 ZFS_OWNER, &acl_ids->z_fuidp); 1732 acl_ids->z_fgid = zfs_fuid_create(zfsvfs, 1733 (uint64_t)vap->va_gid, cr, 1734 ZFS_GROUP, &acl_ids->z_fuidp); 1735 gid = vap->va_gid; 1736 } else { 1737 if (IS_EPHEMERAL(dzp->z_gid)) 1738 VERIFY(0 == sa_lookup(dzp->z_sa_hdl, SA_ZPL_GID(zfsvfs), 1739 &parentgid, sizeof (parentgid))); 1740 else 1741 parentgid = (uint64_t)dzp->z_gid; 1742 1743 acl_ids->z_fuid = zfs_fuid_create_cred(zfsvfs, ZFS_OWNER, 1744 cr, &acl_ids->z_fuidp); 1745 acl_ids->z_fgid = 0; 1746 if (vap->va_mask & AT_GID) { 1747 acl_ids->z_fgid = zfs_fuid_create(zfsvfs, 1748 (uint64_t)vap->va_gid, 1749 cr, ZFS_GROUP, &acl_ids->z_fuidp); 1750 gid = vap->va_gid; 1751 if (acl_ids->z_fgid != parentgid && 1752 !groupmember(vap->va_gid, cr) && 1753 secpolicy_vnode_create_gid(cr) != 0) 1754 acl_ids->z_fgid = 0; 1755 } 1756 if (acl_ids->z_fgid == 0) { 1757 if (dzp->z_mode & S_ISGID) { 1758 char *domain; 1759 uint32_t rid; 1760 1761 acl_ids->z_fgid = parentgid; 1762 gid = zfs_fuid_map_id(zfsvfs, acl_ids->z_fgid, 1763 cr, ZFS_GROUP); 1764 1765 if (zfsvfs->z_use_fuids && 1766 IS_EPHEMERAL(acl_ids->z_fgid)) { 1767 domain = zfs_fuid_idx_domain( 1768 &zfsvfs->z_fuid_idx, 1769 FUID_INDEX(acl_ids->z_fgid)); 1770 rid = FUID_RID(acl_ids->z_fgid); 1771 zfs_fuid_node_add(&acl_ids->z_fuidp, 1772 domain, rid, 1773 FUID_INDEX(acl_ids->z_fgid), 1774 acl_ids->z_fgid, ZFS_GROUP); 1775 } 1776 } else { 1777 acl_ids->z_fgid = zfs_fuid_create_cred(zfsvfs, 1778 ZFS_GROUP, cr, &acl_ids->z_fuidp); 1779 gid = crgetgid(cr); 1780 } 1781 } 1782 } 1783 1784 /* 1785 * If we're creating a directory, and the parent directory has the 1786 * set-GID bit set, set in on the new directory. 1787 * Otherwise, if the user is neither privileged nor a member of the 1788 * file's new group, clear the file's set-GID bit. 1789 */ 1790 1791 if (!(flag & IS_ROOT_NODE) && (dzp->z_mode & S_ISGID) && 1792 (vap->va_type == VDIR)) { 1793 acl_ids->z_mode |= S_ISGID; 1794 } else { 1795 if ((acl_ids->z_mode & S_ISGID) && 1796 secpolicy_vnode_setids_setgids(cr, gid) != 0) 1797 acl_ids->z_mode &= ~S_ISGID; 1798 } 1799 1800 if (acl_ids->z_aclp == NULL) { 1801 mutex_enter(&dzp->z_acl_lock); 1802 mutex_enter(&dzp->z_lock); 1803 if (!(flag & IS_ROOT_NODE) && (ZTOV(dzp)->v_type == VDIR && 1804 (dzp->z_pflags & ZFS_INHERIT_ACE)) && 1805 !(dzp->z_pflags & ZFS_XATTR)) { 1806 VERIFY(0 == zfs_acl_node_read(dzp, B_TRUE, 1807 &paclp, B_FALSE)); 1808 acl_ids->z_aclp = zfs_acl_inherit(zfsvfs, 1809 vap->va_type, paclp, acl_ids->z_mode, &need_chmod); 1810 inherited = B_TRUE; 1811 } else { 1812 acl_ids->z_aclp = 1813 zfs_acl_alloc(zfs_acl_version_zp(dzp)); 1814 acl_ids->z_aclp->z_hints |= ZFS_ACL_TRIVIAL; 1815 } 1816 mutex_exit(&dzp->z_lock); 1817 mutex_exit(&dzp->z_acl_lock); 1818 if (need_chmod) { 1819 acl_ids->z_aclp->z_hints |= (vap->va_type == VDIR) ? 1820 ZFS_ACL_AUTO_INHERIT : 0; 1821 zfs_acl_chmod(zfsvfs, acl_ids->z_mode, acl_ids->z_aclp); 1822 } 1823 } 1824 1825 if (inherited || vsecp) { 1826 acl_ids->z_mode = zfs_mode_compute(acl_ids->z_mode, 1827 acl_ids->z_aclp, &acl_ids->z_aclp->z_hints, 1828 acl_ids->z_fuid, acl_ids->z_fgid); 1829 if (ace_trivial_common(acl_ids->z_aclp, 0, zfs_ace_walk) == 0) 1830 acl_ids->z_aclp->z_hints |= ZFS_ACL_TRIVIAL; 1831 } 1832 1833 return (0); 1834 } 1835 1836 /* 1837 * Free ACL and fuid_infop, but not the acl_ids structure 1838 */ 1839 void 1840 zfs_acl_ids_free(zfs_acl_ids_t *acl_ids) 1841 { 1842 if (acl_ids->z_aclp) 1843 zfs_acl_free(acl_ids->z_aclp); 1844 if (acl_ids->z_fuidp) 1845 zfs_fuid_info_free(acl_ids->z_fuidp); 1846 acl_ids->z_aclp = NULL; 1847 acl_ids->z_fuidp = NULL; 1848 } 1849 1850 boolean_t 1851 zfs_acl_ids_overquota(zfsvfs_t *zfsvfs, zfs_acl_ids_t *acl_ids) 1852 { 1853 return (zfs_fuid_overquota(zfsvfs, B_FALSE, acl_ids->z_fuid) || 1854 zfs_fuid_overquota(zfsvfs, B_TRUE, acl_ids->z_fgid)); 1855 } 1856 1857 /* 1858 * Retrieve a files ACL 1859 */ 1860 int 1861 zfs_getacl(znode_t *zp, vsecattr_t *vsecp, boolean_t skipaclchk, cred_t *cr) 1862 { 1863 zfs_acl_t *aclp; 1864 ulong_t mask; 1865 int error; 1866 int count = 0; 1867 int largeace = 0; 1868 1869 mask = vsecp->vsa_mask & (VSA_ACE | VSA_ACECNT | 1870 VSA_ACE_ACLFLAGS | VSA_ACE_ALLTYPES); 1871 1872 if (mask == 0) 1873 return (ENOSYS); 1874 1875 if (error = zfs_zaccess(zp, ACE_READ_ACL, 0, skipaclchk, cr)) 1876 return (error); 1877 1878 mutex_enter(&zp->z_acl_lock); 1879 1880 error = zfs_acl_node_read(zp, B_FALSE, &aclp, B_FALSE); 1881 if (error != 0) { 1882 mutex_exit(&zp->z_acl_lock); 1883 return (error); 1884 } 1885 1886 /* 1887 * Scan ACL to determine number of ACEs 1888 */ 1889 if ((zp->z_pflags & ZFS_ACL_OBJ_ACE) && !(mask & VSA_ACE_ALLTYPES)) { 1890 void *zacep = NULL; 1891 uint64_t who; 1892 uint32_t access_mask; 1893 uint16_t type, iflags; 1894 1895 while (zacep = zfs_acl_next_ace(aclp, zacep, 1896 &who, &access_mask, &iflags, &type)) { 1897 switch (type) { 1898 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 1899 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 1900 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 1901 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 1902 largeace++; 1903 continue; 1904 default: 1905 count++; 1906 } 1907 } 1908 vsecp->vsa_aclcnt = count; 1909 } else 1910 count = (int)aclp->z_acl_count; 1911 1912 if (mask & VSA_ACECNT) { 1913 vsecp->vsa_aclcnt = count; 1914 } 1915 1916 if (mask & VSA_ACE) { 1917 size_t aclsz; 1918 1919 aclsz = count * sizeof (ace_t) + 1920 sizeof (ace_object_t) * largeace; 1921 1922 vsecp->vsa_aclentp = kmem_alloc(aclsz, KM_SLEEP); 1923 vsecp->vsa_aclentsz = aclsz; 1924 1925 if (aclp->z_version == ZFS_ACL_VERSION_FUID) 1926 zfs_copy_fuid_2_ace(zp->z_zfsvfs, aclp, cr, 1927 vsecp->vsa_aclentp, !(mask & VSA_ACE_ALLTYPES)); 1928 else { 1929 zfs_acl_node_t *aclnode; 1930 void *start = vsecp->vsa_aclentp; 1931 1932 for (aclnode = list_head(&aclp->z_acl); aclnode; 1933 aclnode = list_next(&aclp->z_acl, aclnode)) { 1934 bcopy(aclnode->z_acldata, start, 1935 aclnode->z_size); 1936 start = (caddr_t)start + aclnode->z_size; 1937 } 1938 ASSERT((caddr_t)start - (caddr_t)vsecp->vsa_aclentp == 1939 aclp->z_acl_bytes); 1940 } 1941 } 1942 if (mask & VSA_ACE_ACLFLAGS) { 1943 vsecp->vsa_aclflags = 0; 1944 if (zp->z_pflags & ZFS_ACL_DEFAULTED) 1945 vsecp->vsa_aclflags |= ACL_DEFAULTED; 1946 if (zp->z_pflags & ZFS_ACL_PROTECTED) 1947 vsecp->vsa_aclflags |= ACL_PROTECTED; 1948 if (zp->z_pflags & ZFS_ACL_AUTO_INHERIT) 1949 vsecp->vsa_aclflags |= ACL_AUTO_INHERIT; 1950 } 1951 1952 mutex_exit(&zp->z_acl_lock); 1953 1954 return (0); 1955 } 1956 1957 int 1958 zfs_vsec_2_aclp(zfsvfs_t *zfsvfs, vtype_t obj_type, 1959 vsecattr_t *vsecp, cred_t *cr, zfs_fuid_info_t **fuidp, zfs_acl_t **zaclp) 1960 { 1961 zfs_acl_t *aclp; 1962 zfs_acl_node_t *aclnode; 1963 int aclcnt = vsecp->vsa_aclcnt; 1964 int error; 1965 1966 if (vsecp->vsa_aclcnt > MAX_ACL_ENTRIES || vsecp->vsa_aclcnt <= 0) 1967 return (EINVAL); 1968 1969 aclp = zfs_acl_alloc(zfs_acl_version(zfsvfs->z_version)); 1970 1971 aclp->z_hints = 0; 1972 aclnode = zfs_acl_node_alloc(aclcnt * sizeof (zfs_object_ace_t)); 1973 if (aclp->z_version == ZFS_ACL_VERSION_INITIAL) { 1974 if ((error = zfs_copy_ace_2_oldace(obj_type, aclp, 1975 (ace_t *)vsecp->vsa_aclentp, aclnode->z_acldata, 1976 aclcnt, &aclnode->z_size)) != 0) { 1977 zfs_acl_free(aclp); 1978 zfs_acl_node_free(aclnode); 1979 return (error); 1980 } 1981 } else { 1982 if ((error = zfs_copy_ace_2_fuid(zfsvfs, obj_type, aclp, 1983 vsecp->vsa_aclentp, aclnode->z_acldata, aclcnt, 1984 &aclnode->z_size, fuidp, cr)) != 0) { 1985 zfs_acl_free(aclp); 1986 zfs_acl_node_free(aclnode); 1987 return (error); 1988 } 1989 } 1990 aclp->z_acl_bytes = aclnode->z_size; 1991 aclnode->z_ace_count = aclcnt; 1992 aclp->z_acl_count = aclcnt; 1993 list_insert_head(&aclp->z_acl, aclnode); 1994 1995 /* 1996 * If flags are being set then add them to z_hints 1997 */ 1998 if (vsecp->vsa_mask & VSA_ACE_ACLFLAGS) { 1999 if (vsecp->vsa_aclflags & ACL_PROTECTED) 2000 aclp->z_hints |= ZFS_ACL_PROTECTED; 2001 if (vsecp->vsa_aclflags & ACL_DEFAULTED) 2002 aclp->z_hints |= ZFS_ACL_DEFAULTED; 2003 if (vsecp->vsa_aclflags & ACL_AUTO_INHERIT) 2004 aclp->z_hints |= ZFS_ACL_AUTO_INHERIT; 2005 } 2006 2007 *zaclp = aclp; 2008 2009 return (0); 2010 } 2011 2012 /* 2013 * Set a files ACL 2014 */ 2015 int 2016 zfs_setacl(znode_t *zp, vsecattr_t *vsecp, boolean_t skipaclchk, cred_t *cr) 2017 { 2018 zfsvfs_t *zfsvfs = zp->z_zfsvfs; 2019 zilog_t *zilog = zfsvfs->z_log; 2020 ulong_t mask = vsecp->vsa_mask & (VSA_ACE | VSA_ACECNT); 2021 dmu_tx_t *tx; 2022 int error; 2023 zfs_acl_t *aclp; 2024 zfs_fuid_info_t *fuidp = NULL; 2025 boolean_t fuid_dirtied; 2026 uint64_t acl_obj; 2027 2028 if (mask == 0) 2029 return (ENOSYS); 2030 2031 if (zp->z_pflags & ZFS_IMMUTABLE) 2032 return (EPERM); 2033 2034 if (error = zfs_zaccess(zp, ACE_WRITE_ACL, 0, skipaclchk, cr)) 2035 return (error); 2036 2037 error = zfs_vsec_2_aclp(zfsvfs, ZTOV(zp)->v_type, vsecp, cr, &fuidp, 2038 &aclp); 2039 if (error) 2040 return (error); 2041 2042 /* 2043 * If ACL wide flags aren't being set then preserve any 2044 * existing flags. 2045 */ 2046 if (!(vsecp->vsa_mask & VSA_ACE_ACLFLAGS)) { 2047 aclp->z_hints |= 2048 (zp->z_pflags & V4_ACL_WIDE_FLAGS); 2049 } 2050 top: 2051 mutex_enter(&zp->z_acl_lock); 2052 mutex_enter(&zp->z_lock); 2053 2054 tx = dmu_tx_create(zfsvfs->z_os); 2055 2056 dmu_tx_hold_sa(tx, zp->z_sa_hdl, B_TRUE); 2057 2058 fuid_dirtied = zfsvfs->z_fuid_dirty; 2059 if (fuid_dirtied) 2060 zfs_fuid_txhold(zfsvfs, tx); 2061 2062 /* 2063 * If old version and ACL won't fit in bonus and we aren't 2064 * upgrading then take out necessary DMU holds 2065 */ 2066 2067 if ((acl_obj = zfs_external_acl(zp)) != 0) { 2068 if (zfsvfs->z_version >= ZPL_VERSION_FUID && 2069 zfs_znode_acl_version(zp) <= ZFS_ACL_VERSION_INITIAL) { 2070 dmu_tx_hold_free(tx, acl_obj, 0, 2071 DMU_OBJECT_END); 2072 dmu_tx_hold_write(tx, DMU_NEW_OBJECT, 0, 2073 aclp->z_acl_bytes); 2074 } else { 2075 dmu_tx_hold_write(tx, acl_obj, 0, aclp->z_acl_bytes); 2076 } 2077 } else if (!zp->z_is_sa && aclp->z_acl_bytes > ZFS_ACE_SPACE) { 2078 dmu_tx_hold_write(tx, DMU_NEW_OBJECT, 0, aclp->z_acl_bytes); 2079 } 2080 2081 zfs_sa_upgrade_txholds(tx, zp); 2082 error = dmu_tx_assign(tx, TXG_NOWAIT); 2083 if (error) { 2084 mutex_exit(&zp->z_acl_lock); 2085 mutex_exit(&zp->z_lock); 2086 2087 if (error == ERESTART) { 2088 dmu_tx_wait(tx); 2089 dmu_tx_abort(tx); 2090 goto top; 2091 } 2092 dmu_tx_abort(tx); 2093 zfs_acl_free(aclp); 2094 return (error); 2095 } 2096 2097 error = zfs_aclset_common(zp, aclp, cr, tx); 2098 ASSERT(error == 0); 2099 zp->z_acl_cached = aclp; 2100 2101 if (fuid_dirtied) 2102 zfs_fuid_sync(zfsvfs, tx); 2103 2104 zfs_log_acl(zilog, tx, zp, vsecp, fuidp); 2105 2106 if (fuidp) 2107 zfs_fuid_info_free(fuidp); 2108 dmu_tx_commit(tx); 2109 done: 2110 mutex_exit(&zp->z_lock); 2111 mutex_exit(&zp->z_acl_lock); 2112 2113 return (error); 2114 } 2115 2116 /* 2117 * Check accesses of interest (AoI) against attributes of the dataset 2118 * such as read-only. Returns zero if no AoI conflict with dataset 2119 * attributes, otherwise an appropriate errno is returned. 2120 */ 2121 static int 2122 zfs_zaccess_dataset_check(znode_t *zp, uint32_t v4_mode) 2123 { 2124 if ((v4_mode & WRITE_MASK) && 2125 (zp->z_zfsvfs->z_vfs->vfs_flag & VFS_RDONLY) && 2126 (!IS_DEVVP(ZTOV(zp)) || 2127 (IS_DEVVP(ZTOV(zp)) && (v4_mode & WRITE_MASK_ATTRS)))) { 2128 return (EROFS); 2129 } 2130 2131 /* 2132 * Only check for READONLY on non-directories. 2133 */ 2134 if ((v4_mode & WRITE_MASK_DATA) && 2135 (((ZTOV(zp)->v_type != VDIR) && 2136 (zp->z_pflags & (ZFS_READONLY | ZFS_IMMUTABLE))) || 2137 (ZTOV(zp)->v_type == VDIR && 2138 (zp->z_pflags & ZFS_IMMUTABLE)))) { 2139 return (EPERM); 2140 } 2141 2142 if ((v4_mode & (ACE_DELETE | ACE_DELETE_CHILD)) && 2143 (zp->z_pflags & ZFS_NOUNLINK)) { 2144 return (EPERM); 2145 } 2146 2147 if (((v4_mode & (ACE_READ_DATA|ACE_EXECUTE)) && 2148 (zp->z_pflags & ZFS_AV_QUARANTINED))) { 2149 return (EACCES); 2150 } 2151 2152 return (0); 2153 } 2154 2155 /* 2156 * The primary usage of this function is to loop through all of the 2157 * ACEs in the znode, determining what accesses of interest (AoI) to 2158 * the caller are allowed or denied. The AoI are expressed as bits in 2159 * the working_mode parameter. As each ACE is processed, bits covered 2160 * by that ACE are removed from the working_mode. This removal 2161 * facilitates two things. The first is that when the working mode is 2162 * empty (= 0), we know we've looked at all the AoI. The second is 2163 * that the ACE interpretation rules don't allow a later ACE to undo 2164 * something granted or denied by an earlier ACE. Removing the 2165 * discovered access or denial enforces this rule. At the end of 2166 * processing the ACEs, all AoI that were found to be denied are 2167 * placed into the working_mode, giving the caller a mask of denied 2168 * accesses. Returns: 2169 * 0 if all AoI granted 2170 * EACCESS if the denied mask is non-zero 2171 * other error if abnormal failure (e.g., IO error) 2172 * 2173 * A secondary usage of the function is to determine if any of the 2174 * AoI are granted. If an ACE grants any access in 2175 * the working_mode, we immediately short circuit out of the function. 2176 * This mode is chosen by setting anyaccess to B_TRUE. The 2177 * working_mode is not a denied access mask upon exit if the function 2178 * is used in this manner. 2179 */ 2180 static int 2181 zfs_zaccess_aces_check(znode_t *zp, uint32_t *working_mode, 2182 boolean_t anyaccess, cred_t *cr) 2183 { 2184 zfsvfs_t *zfsvfs = zp->z_zfsvfs; 2185 zfs_acl_t *aclp; 2186 int error; 2187 uid_t uid = crgetuid(cr); 2188 uint64_t who; 2189 uint16_t type, iflags; 2190 uint16_t entry_type; 2191 uint32_t access_mask; 2192 uint32_t deny_mask = 0; 2193 zfs_ace_hdr_t *acep = NULL; 2194 boolean_t checkit; 2195 uint64_t gowner; 2196 2197 mutex_enter(&zp->z_acl_lock); 2198 2199 error = zfs_acl_node_read(zp, B_FALSE, &aclp, B_FALSE); 2200 if (error != 0) { 2201 mutex_exit(&zp->z_acl_lock); 2202 return (error); 2203 } 2204 2205 ASSERT(zp->z_acl_cached); 2206 2207 if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_GID(zfsvfs), 2208 &gowner, sizeof (gowner))) != 0) { 2209 mutex_exit(&zp->z_acl_lock); 2210 return (error); 2211 } 2212 2213 while (acep = zfs_acl_next_ace(aclp, acep, &who, &access_mask, 2214 &iflags, &type)) { 2215 uint32_t mask_matched; 2216 2217 if (!zfs_acl_valid_ace_type(type, iflags)) 2218 continue; 2219 2220 if (ZTOV(zp)->v_type == VDIR && (iflags & ACE_INHERIT_ONLY_ACE)) 2221 continue; 2222 2223 /* Skip ACE if it does not affect any AoI */ 2224 mask_matched = (access_mask & *working_mode); 2225 if (!mask_matched) 2226 continue; 2227 2228 entry_type = (iflags & ACE_TYPE_FLAGS); 2229 2230 checkit = B_FALSE; 2231 2232 switch (entry_type) { 2233 case ACE_OWNER: 2234 if (uid == zp->z_uid) 2235 checkit = B_TRUE; 2236 break; 2237 case OWNING_GROUP: 2238 who = gowner; 2239 /*FALLTHROUGH*/ 2240 case ACE_IDENTIFIER_GROUP: 2241 checkit = zfs_groupmember(zfsvfs, who, cr); 2242 break; 2243 case ACE_EVERYONE: 2244 checkit = B_TRUE; 2245 break; 2246 2247 /* USER Entry */ 2248 default: 2249 if (entry_type == 0) { 2250 uid_t newid; 2251 2252 newid = zfs_fuid_map_id(zfsvfs, who, cr, 2253 ZFS_ACE_USER); 2254 if (newid != IDMAP_WK_CREATOR_OWNER_UID && 2255 uid == newid) 2256 checkit = B_TRUE; 2257 break; 2258 } else { 2259 mutex_exit(&zp->z_acl_lock); 2260 return (EIO); 2261 } 2262 } 2263 2264 if (checkit) { 2265 if (type == DENY) { 2266 DTRACE_PROBE3(zfs__ace__denies, 2267 znode_t *, zp, 2268 zfs_ace_hdr_t *, acep, 2269 uint32_t, mask_matched); 2270 deny_mask |= mask_matched; 2271 } else { 2272 DTRACE_PROBE3(zfs__ace__allows, 2273 znode_t *, zp, 2274 zfs_ace_hdr_t *, acep, 2275 uint32_t, mask_matched); 2276 if (anyaccess) { 2277 mutex_exit(&zp->z_acl_lock); 2278 return (0); 2279 } 2280 } 2281 *working_mode &= ~mask_matched; 2282 } 2283 2284 /* Are we done? */ 2285 if (*working_mode == 0) 2286 break; 2287 } 2288 2289 mutex_exit(&zp->z_acl_lock); 2290 2291 /* Put the found 'denies' back on the working mode */ 2292 if (deny_mask) { 2293 *working_mode |= deny_mask; 2294 return (EACCES); 2295 } else if (*working_mode) { 2296 return (-1); 2297 } 2298 2299 return (0); 2300 } 2301 2302 /* 2303 * Return true if any access whatsoever granted, we don't actually 2304 * care what access is granted. 2305 */ 2306 boolean_t 2307 zfs_has_access(znode_t *zp, cred_t *cr) 2308 { 2309 uint32_t have = ACE_ALL_PERMS; 2310 2311 if (zfs_zaccess_aces_check(zp, &have, B_TRUE, cr) != 0) { 2312 return (secpolicy_vnode_any_access(cr, ZTOV(zp), 2313 zp->z_uid) == 0); 2314 } 2315 return (B_TRUE); 2316 } 2317 2318 static int 2319 zfs_zaccess_common(znode_t *zp, uint32_t v4_mode, uint32_t *working_mode, 2320 boolean_t *check_privs, boolean_t skipaclchk, cred_t *cr) 2321 { 2322 zfsvfs_t *zfsvfs = zp->z_zfsvfs; 2323 int err; 2324 2325 *working_mode = v4_mode; 2326 *check_privs = B_TRUE; 2327 2328 /* 2329 * Short circuit empty requests 2330 */ 2331 if (v4_mode == 0 || zfsvfs->z_replay) { 2332 *working_mode = 0; 2333 return (0); 2334 } 2335 2336 if ((err = zfs_zaccess_dataset_check(zp, v4_mode)) != 0) { 2337 *check_privs = B_FALSE; 2338 return (err); 2339 } 2340 2341 /* 2342 * The caller requested that the ACL check be skipped. This 2343 * would only happen if the caller checked VOP_ACCESS() with a 2344 * 32 bit ACE mask and already had the appropriate permissions. 2345 */ 2346 if (skipaclchk) { 2347 *working_mode = 0; 2348 return (0); 2349 } 2350 2351 return (zfs_zaccess_aces_check(zp, working_mode, B_FALSE, cr)); 2352 } 2353 2354 static int 2355 zfs_zaccess_append(znode_t *zp, uint32_t *working_mode, boolean_t *check_privs, 2356 cred_t *cr) 2357 { 2358 if (*working_mode != ACE_WRITE_DATA) 2359 return (EACCES); 2360 2361 return (zfs_zaccess_common(zp, ACE_APPEND_DATA, working_mode, 2362 check_privs, B_FALSE, cr)); 2363 } 2364 2365 int 2366 zfs_fastaccesschk_execute(znode_t *zdp, cred_t *cr) 2367 { 2368 boolean_t owner = B_FALSE; 2369 boolean_t groupmbr = B_FALSE; 2370 boolean_t is_attr; 2371 uid_t uid = crgetuid(cr); 2372 int error; 2373 2374 if (zdp->z_pflags & ZFS_AV_QUARANTINED) 2375 return (EACCES); 2376 2377 is_attr = ((zdp->z_pflags & ZFS_XATTR) && 2378 (ZTOV(zdp)->v_type == VDIR)); 2379 if (is_attr) 2380 goto slow; 2381 2382 2383 mutex_enter(&zdp->z_acl_lock); 2384 2385 if (zdp->z_pflags & ZFS_NO_EXECS_DENIED) { 2386 mutex_exit(&zdp->z_acl_lock); 2387 return (0); 2388 } 2389 2390 if (IS_EPHEMERAL(zdp->z_uid) != 0 || IS_EPHEMERAL(zdp->z_gid) != 0) { 2391 mutex_exit(&zdp->z_acl_lock); 2392 goto slow; 2393 } 2394 2395 if (uid == zdp->z_uid) { 2396 owner = B_TRUE; 2397 if (zdp->z_mode & S_IXUSR) { 2398 mutex_exit(&zdp->z_acl_lock); 2399 return (0); 2400 } else { 2401 mutex_exit(&zdp->z_acl_lock); 2402 goto slow; 2403 } 2404 } 2405 if (groupmember(zdp->z_gid, cr)) { 2406 groupmbr = B_TRUE; 2407 if (zdp->z_mode & S_IXGRP) { 2408 mutex_exit(&zdp->z_acl_lock); 2409 return (0); 2410 } else { 2411 mutex_exit(&zdp->z_acl_lock); 2412 goto slow; 2413 } 2414 } 2415 if (!owner && !groupmbr) { 2416 if (zdp->z_mode & S_IXOTH) { 2417 mutex_exit(&zdp->z_acl_lock); 2418 return (0); 2419 } 2420 } 2421 2422 mutex_exit(&zdp->z_acl_lock); 2423 2424 slow: 2425 DTRACE_PROBE(zfs__fastpath__execute__access__miss); 2426 ZFS_ENTER(zdp->z_zfsvfs); 2427 error = zfs_zaccess(zdp, ACE_EXECUTE, 0, B_FALSE, cr); 2428 ZFS_EXIT(zdp->z_zfsvfs); 2429 return (error); 2430 } 2431 2432 /* 2433 * Determine whether Access should be granted/denied. 2434 * The least priv subsytem is always consulted as a basic privilege 2435 * can define any form of access. 2436 */ 2437 int 2438 zfs_zaccess(znode_t *zp, int mode, int flags, boolean_t skipaclchk, cred_t *cr) 2439 { 2440 uint32_t working_mode; 2441 int error; 2442 int is_attr; 2443 boolean_t check_privs; 2444 znode_t *xzp; 2445 znode_t *check_zp = zp; 2446 mode_t needed_bits; 2447 2448 is_attr = ((zp->z_pflags & ZFS_XATTR) && (ZTOV(zp)->v_type == VDIR)); 2449 2450 /* 2451 * If attribute then validate against base file 2452 */ 2453 if (is_attr) { 2454 uint64_t parent; 2455 2456 if ((error = sa_lookup(zp->z_sa_hdl, 2457 SA_ZPL_PARENT(zp->z_zfsvfs), &parent, 2458 sizeof (parent))) != 0) 2459 return (error); 2460 2461 if ((error = zfs_zget(zp->z_zfsvfs, 2462 parent, &xzp)) != 0) { 2463 return (error); 2464 } 2465 2466 check_zp = xzp; 2467 2468 /* 2469 * fixup mode to map to xattr perms 2470 */ 2471 2472 if (mode & (ACE_WRITE_DATA|ACE_APPEND_DATA)) { 2473 mode &= ~(ACE_WRITE_DATA|ACE_APPEND_DATA); 2474 mode |= ACE_WRITE_NAMED_ATTRS; 2475 } 2476 2477 if (mode & (ACE_READ_DATA|ACE_EXECUTE)) { 2478 mode &= ~(ACE_READ_DATA|ACE_EXECUTE); 2479 mode |= ACE_READ_NAMED_ATTRS; 2480 } 2481 } 2482 2483 /* 2484 * Map the bits required to the standard vnode flags VREAD|VWRITE|VEXEC 2485 * in needed_bits. Map the bits mapped by working_mode (currently 2486 * missing) in missing_bits. 2487 * Call secpolicy_vnode_access2() with (needed_bits & ~checkmode), 2488 * needed_bits. 2489 */ 2490 needed_bits = 0; 2491 2492 working_mode = mode; 2493 if ((working_mode & (ACE_READ_ACL|ACE_READ_ATTRIBUTES)) && 2494 zp->z_uid == crgetuid(cr)) 2495 working_mode &= ~(ACE_READ_ACL|ACE_READ_ATTRIBUTES); 2496 2497 if (working_mode & (ACE_READ_DATA|ACE_READ_NAMED_ATTRS| 2498 ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_SYNCHRONIZE)) 2499 needed_bits |= VREAD; 2500 if (working_mode & (ACE_WRITE_DATA|ACE_WRITE_NAMED_ATTRS| 2501 ACE_APPEND_DATA|ACE_WRITE_ATTRIBUTES|ACE_SYNCHRONIZE)) 2502 needed_bits |= VWRITE; 2503 if (working_mode & ACE_EXECUTE) 2504 needed_bits |= VEXEC; 2505 2506 if ((error = zfs_zaccess_common(check_zp, mode, &working_mode, 2507 &check_privs, skipaclchk, cr)) == 0) { 2508 if (is_attr) 2509 VN_RELE(ZTOV(xzp)); 2510 return (secpolicy_vnode_access2(cr, ZTOV(zp), zp->z_uid, 2511 needed_bits, needed_bits)); 2512 } 2513 2514 if (error && !check_privs) { 2515 if (is_attr) 2516 VN_RELE(ZTOV(xzp)); 2517 return (error); 2518 } 2519 2520 if (error && (flags & V_APPEND)) { 2521 error = zfs_zaccess_append(zp, &working_mode, &check_privs, cr); 2522 } 2523 2524 if (error && check_privs) { 2525 mode_t checkmode = 0; 2526 2527 /* 2528 * First check for implicit owner permission on 2529 * read_acl/read_attributes 2530 */ 2531 2532 error = 0; 2533 ASSERT(working_mode != 0); 2534 2535 if ((working_mode & (ACE_READ_ACL|ACE_READ_ATTRIBUTES) && 2536 zp->z_uid == crgetuid(cr))) 2537 working_mode &= ~(ACE_READ_ACL|ACE_READ_ATTRIBUTES); 2538 2539 if (working_mode & (ACE_READ_DATA|ACE_READ_NAMED_ATTRS| 2540 ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_SYNCHRONIZE)) 2541 checkmode |= VREAD; 2542 if (working_mode & (ACE_WRITE_DATA|ACE_WRITE_NAMED_ATTRS| 2543 ACE_APPEND_DATA|ACE_WRITE_ATTRIBUTES|ACE_SYNCHRONIZE)) 2544 checkmode |= VWRITE; 2545 if (working_mode & ACE_EXECUTE) 2546 checkmode |= VEXEC; 2547 2548 error = secpolicy_vnode_access2(cr, ZTOV(check_zp), zp->z_uid, 2549 needed_bits & ~checkmode, needed_bits); 2550 2551 if (error == 0 && (working_mode & ACE_WRITE_OWNER)) 2552 error = secpolicy_vnode_chown(cr, zp->z_uid); 2553 if (error == 0 && (working_mode & ACE_WRITE_ACL)) 2554 error = secpolicy_vnode_setdac(cr, zp->z_uid); 2555 2556 if (error == 0 && (working_mode & 2557 (ACE_DELETE|ACE_DELETE_CHILD))) 2558 error = secpolicy_vnode_remove(cr); 2559 2560 if (error == 0 && (working_mode & ACE_SYNCHRONIZE)) { 2561 error = secpolicy_vnode_chown(cr, zp->z_uid); 2562 } 2563 if (error == 0) { 2564 /* 2565 * See if any bits other than those already checked 2566 * for are still present. If so then return EACCES 2567 */ 2568 if (working_mode & ~(ZFS_CHECKED_MASKS)) { 2569 error = EACCES; 2570 } 2571 } 2572 } else if (error == 0) { 2573 error = secpolicy_vnode_access2(cr, ZTOV(zp), zp->z_uid, 2574 needed_bits, needed_bits); 2575 } 2576 2577 2578 if (is_attr) 2579 VN_RELE(ZTOV(xzp)); 2580 2581 return (error); 2582 } 2583 2584 /* 2585 * Translate traditional unix VREAD/VWRITE/VEXEC mode into 2586 * native ACL format and call zfs_zaccess() 2587 */ 2588 int 2589 zfs_zaccess_rwx(znode_t *zp, mode_t mode, int flags, cred_t *cr) 2590 { 2591 return (zfs_zaccess(zp, zfs_unix_to_v4(mode >> 6), flags, B_FALSE, cr)); 2592 } 2593 2594 /* 2595 * Access function for secpolicy_vnode_setattr 2596 */ 2597 int 2598 zfs_zaccess_unix(znode_t *zp, mode_t mode, cred_t *cr) 2599 { 2600 int v4_mode = zfs_unix_to_v4(mode >> 6); 2601 2602 return (zfs_zaccess(zp, v4_mode, 0, B_FALSE, cr)); 2603 } 2604 2605 static int 2606 zfs_delete_final_check(znode_t *zp, znode_t *dzp, 2607 mode_t available_perms, cred_t *cr) 2608 { 2609 int error; 2610 2611 error = secpolicy_vnode_access2(cr, ZTOV(dzp), 2612 dzp->z_uid, available_perms, VWRITE|VEXEC); 2613 2614 if (error == 0) 2615 error = zfs_sticky_remove_access(dzp, zp, cr); 2616 2617 return (error); 2618 } 2619 2620 /* 2621 * Determine whether Access should be granted/deny, without 2622 * consulting least priv subsystem. 2623 * 2624 * 2625 * The following chart is the recommended NFSv4 enforcement for 2626 * ability to delete an object. 2627 * 2628 * ------------------------------------------------------- 2629 * | Parent Dir | Target Object Permissions | 2630 * | permissions | | 2631 * ------------------------------------------------------- 2632 * | | ACL Allows | ACL Denies| Delete | 2633 * | | Delete | Delete | unspecified| 2634 * ------------------------------------------------------- 2635 * | ACL Allows | Permit | Permit | Permit | 2636 * | DELETE_CHILD | | 2637 * ------------------------------------------------------- 2638 * | ACL Denies | Permit | Deny | Deny | 2639 * | DELETE_CHILD | | | | 2640 * ------------------------------------------------------- 2641 * | ACL specifies | | | | 2642 * | only allow | Permit | Permit | Permit | 2643 * | write and | | | | 2644 * | execute | | | | 2645 * ------------------------------------------------------- 2646 * | ACL denies | | | | 2647 * | write and | Permit | Deny | Deny | 2648 * | execute | | | | 2649 * ------------------------------------------------------- 2650 * ^ 2651 * | 2652 * No search privilege, can't even look up file? 2653 * 2654 */ 2655 int 2656 zfs_zaccess_delete(znode_t *dzp, znode_t *zp, cred_t *cr) 2657 { 2658 uint32_t dzp_working_mode = 0; 2659 uint32_t zp_working_mode = 0; 2660 int dzp_error, zp_error; 2661 mode_t available_perms; 2662 boolean_t dzpcheck_privs = B_TRUE; 2663 boolean_t zpcheck_privs = B_TRUE; 2664 2665 /* 2666 * We want specific DELETE permissions to 2667 * take precedence over WRITE/EXECUTE. We don't 2668 * want an ACL such as this to mess us up. 2669 * user:joe:write_data:deny,user:joe:delete:allow 2670 * 2671 * However, deny permissions may ultimately be overridden 2672 * by secpolicy_vnode_access(). 2673 * 2674 * We will ask for all of the necessary permissions and then 2675 * look at the working modes from the directory and target object 2676 * to determine what was found. 2677 */ 2678 2679 if (zp->z_pflags & (ZFS_IMMUTABLE | ZFS_NOUNLINK)) 2680 return (EPERM); 2681 2682 /* 2683 * First row 2684 * If the directory permissions allow the delete, we are done. 2685 */ 2686 if ((dzp_error = zfs_zaccess_common(dzp, ACE_DELETE_CHILD, 2687 &dzp_working_mode, &dzpcheck_privs, B_FALSE, cr)) == 0) 2688 return (0); 2689 2690 /* 2691 * If target object has delete permission then we are done 2692 */ 2693 if ((zp_error = zfs_zaccess_common(zp, ACE_DELETE, &zp_working_mode, 2694 &zpcheck_privs, B_FALSE, cr)) == 0) 2695 return (0); 2696 2697 ASSERT(dzp_error && zp_error); 2698 2699 if (!dzpcheck_privs) 2700 return (dzp_error); 2701 if (!zpcheck_privs) 2702 return (zp_error); 2703 2704 /* 2705 * Second row 2706 * 2707 * If directory returns EACCES then delete_child was denied 2708 * due to deny delete_child. In this case send the request through 2709 * secpolicy_vnode_remove(). We don't use zfs_delete_final_check() 2710 * since that *could* allow the delete based on write/execute permission 2711 * and we want delete permissions to override write/execute. 2712 */ 2713 2714 if (dzp_error == EACCES) 2715 return (secpolicy_vnode_remove(cr)); 2716 2717 /* 2718 * Third Row 2719 * only need to see if we have write/execute on directory. 2720 */ 2721 2722 dzp_error = zfs_zaccess_common(dzp, ACE_EXECUTE|ACE_WRITE_DATA, 2723 &dzp_working_mode, &dzpcheck_privs, B_FALSE, cr); 2724 2725 if (dzp_error != 0 && !dzpcheck_privs) 2726 return (dzp_error); 2727 2728 /* 2729 * Fourth row 2730 */ 2731 2732 available_perms = (dzp_working_mode & ACE_WRITE_DATA) ? 0 : VWRITE; 2733 available_perms |= (dzp_working_mode & ACE_EXECUTE) ? 0 : VEXEC; 2734 2735 return (zfs_delete_final_check(zp, dzp, available_perms, cr)); 2736 2737 } 2738 2739 int 2740 zfs_zaccess_rename(znode_t *sdzp, znode_t *szp, znode_t *tdzp, 2741 znode_t *tzp, cred_t *cr) 2742 { 2743 int add_perm; 2744 int error; 2745 2746 if (szp->z_pflags & ZFS_AV_QUARANTINED) 2747 return (EACCES); 2748 2749 add_perm = (ZTOV(szp)->v_type == VDIR) ? 2750 ACE_ADD_SUBDIRECTORY : ACE_ADD_FILE; 2751 2752 /* 2753 * Rename permissions are combination of delete permission + 2754 * add file/subdir permission. 2755 */ 2756 2757 /* 2758 * first make sure we do the delete portion. 2759 * 2760 * If that succeeds then check for add_file/add_subdir permissions 2761 */ 2762 2763 if (error = zfs_zaccess_delete(sdzp, szp, cr)) 2764 return (error); 2765 2766 /* 2767 * If we have a tzp, see if we can delete it? 2768 */ 2769 if (tzp) { 2770 if (error = zfs_zaccess_delete(tdzp, tzp, cr)) 2771 return (error); 2772 } 2773 2774 /* 2775 * Now check for add permissions 2776 */ 2777 error = zfs_zaccess(tdzp, add_perm, 0, B_FALSE, cr); 2778 2779 return (error); 2780 } 2781