xref: /illumos-gate/usr/src/uts/common/fs/zfs/zfs_ioctl.c (revision d8f839f9)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
24  */
25 
26 /*
27  * Copyright (c) 2011-2012 Pawel Jakub Dawidek. All rights reserved.
28  * Portions Copyright 2011 Martin Matuska
29  * Copyright 2015, OmniTI Computer Consulting, Inc. All rights reserved.
30  * Copyright 2018 Nexenta Systems, Inc.  All rights reserved.
31  * Copyright 2019 Joyent, Inc.
32  * Copyright (c) 2011, 2017 by Delphix. All rights reserved.
33  * Copyright (c) 2013 by Saso Kiselkov. All rights reserved.
34  * Copyright (c) 2013 Steven Hartland. All rights reserved.
35  * Copyright (c) 2014 Integros [integros.com]
36  * Copyright 2016 Toomas Soome <tsoome@me.com>
37  * Copyright (c) 2017, loli10K <ezomori.nozomu@gmail.com>. All rights reserved.
38  * Copyright 2017 RackTop Systems.
39  * Copyright (c) 2017, Datto, Inc. All rights reserved.
40  * Copyright 2021 The University of Queensland
41  */
42 
43 /*
44  * ZFS ioctls.
45  *
46  * This file handles the ioctls to /dev/zfs, used for configuring ZFS storage
47  * pools and filesystems, e.g. with /sbin/zfs and /sbin/zpool.
48  *
49  * There are two ways that we handle ioctls: the legacy way where almost
50  * all of the logic is in the ioctl callback, and the new way where most
51  * of the marshalling is handled in the common entry point, zfsdev_ioctl().
52  *
53  * Non-legacy ioctls should be registered by calling
54  * zfs_ioctl_register() from zfs_ioctl_init().  The ioctl is invoked
55  * from userland by lzc_ioctl().
56  *
57  * The registration arguments are as follows:
58  *
59  * const char *name
60  *   The name of the ioctl.  This is used for history logging.  If the
61  *   ioctl returns successfully (the callback returns 0), and allow_log
62  *   is true, then a history log entry will be recorded with the input &
63  *   output nvlists.  The log entry can be printed with "zpool history -i".
64  *
65  * zfs_ioc_t ioc
66  *   The ioctl request number, which userland will pass to ioctl(2).
67  *   We want newer versions of libzfs and libzfs_core to run against
68  *   existing zfs kernel modules (i.e. a deferred reboot after an update).
69  *   Therefore the ioctl numbers cannot change from release to release.
70  *
71  * zfs_secpolicy_func_t *secpolicy
72  *   This function will be called before the zfs_ioc_func_t, to
73  *   determine if this operation is permitted.  It should return EPERM
74  *   on failure, and 0 on success.  Checks include determining if the
75  *   dataset is visible in this zone, and if the user has either all
76  *   zfs privileges in the zone (SYS_MOUNT), or has been granted permission
77  *   to do this operation on this dataset with "zfs allow".
78  *
79  * zfs_ioc_namecheck_t namecheck
80  *   This specifies what to expect in the zfs_cmd_t:zc_name -- a pool
81  *   name, a dataset name, or nothing.  If the name is not well-formed,
82  *   the ioctl will fail and the callback will not be called.
83  *   Therefore, the callback can assume that the name is well-formed
84  *   (e.g. is null-terminated, doesn't have more than one '@' character,
85  *   doesn't have invalid characters).
86  *
87  * zfs_ioc_poolcheck_t pool_check
88  *   This specifies requirements on the pool state.  If the pool does
89  *   not meet them (is suspended or is readonly), the ioctl will fail
90  *   and the callback will not be called.  If any checks are specified
91  *   (i.e. it is not POOL_CHECK_NONE), namecheck must not be NO_NAME.
92  *   Multiple checks can be or-ed together (e.g. POOL_CHECK_SUSPENDED |
93  *   POOL_CHECK_READONLY).
94  *
95  * zfs_ioc_key_t *nvl_keys
96  *  The list of expected/allowable innvl input keys. This list is used
97  *  to validate the nvlist input to the ioctl.
98  *
99  * boolean_t smush_outnvlist
100  *   If smush_outnvlist is true, then the output is presumed to be a
101  *   list of errors, and it will be "smushed" down to fit into the
102  *   caller's buffer, by removing some entries and replacing them with a
103  *   single "N_MORE_ERRORS" entry indicating how many were removed.  See
104  *   nvlist_smush() for details.  If smush_outnvlist is false, and the
105  *   outnvlist does not fit into the userland-provided buffer, then the
106  *   ioctl will fail with ENOMEM.
107  *
108  * zfs_ioc_func_t *func
109  *   The callback function that will perform the operation.
110  *
111  *   The callback should return 0 on success, or an error number on
112  *   failure.  If the function fails, the userland ioctl will return -1,
113  *   and errno will be set to the callback's return value.  The callback
114  *   will be called with the following arguments:
115  *
116  *   const char *name
117  *     The name of the pool or dataset to operate on, from
118  *     zfs_cmd_t:zc_name.  The 'namecheck' argument specifies the
119  *     expected type (pool, dataset, or none).
120  *
121  *   nvlist_t *innvl
122  *     The input nvlist, deserialized from zfs_cmd_t:zc_nvlist_src.  Or
123  *     NULL if no input nvlist was provided.  Changes to this nvlist are
124  *     ignored.  If the input nvlist could not be deserialized, the
125  *     ioctl will fail and the callback will not be called.
126  *
127  *   nvlist_t *outnvl
128  *     The output nvlist, initially empty.  The callback can fill it in,
129  *     and it will be returned to userland by serializing it into
130  *     zfs_cmd_t:zc_nvlist_dst.  If it is non-empty, and serialization
131  *     fails (e.g. because the caller didn't supply a large enough
132  *     buffer), then the overall ioctl will fail.  See the
133  *     'smush_nvlist' argument above for additional behaviors.
134  *
135  *     There are two typical uses of the output nvlist:
136  *       - To return state, e.g. property values.  In this case,
137  *         smush_outnvlist should be false.  If the buffer was not large
138  *         enough, the caller will reallocate a larger buffer and try
139  *         the ioctl again.
140  *
141  *       - To return multiple errors from an ioctl which makes on-disk
142  *         changes.  In this case, smush_outnvlist should be true.
143  *         Ioctls which make on-disk modifications should generally not
144  *         use the outnvl if they succeed, because the caller can not
145  *         distinguish between the operation failing, and
146  *         deserialization failing.
147  *
148  * IOCTL Interface Errors
149  *
150  * The following ioctl input errors can be returned:
151  *   ZFS_ERR_IOC_CMD_UNAVAIL	the ioctl number is not supported by kernel
152  *   ZFS_ERR_IOC_ARG_UNAVAIL	an input argument is not supported by kernel
153  *   ZFS_ERR_IOC_ARG_REQUIRED	a required input argument is missing
154  *   ZFS_ERR_IOC_ARG_BADTYPE	an input argument has an invalid type
155  */
156 
157 #include <sys/types.h>
158 #include <sys/param.h>
159 #include <sys/errno.h>
160 #include <sys/uio.h>
161 #include <sys/buf.h>
162 #include <sys/modctl.h>
163 #include <sys/open.h>
164 #include <sys/file.h>
165 #include <sys/kmem.h>
166 #include <sys/conf.h>
167 #include <sys/cmn_err.h>
168 #include <sys/stat.h>
169 #include <sys/zfs_ioctl.h>
170 #include <sys/zfs_vfsops.h>
171 #include <sys/zfs_znode.h>
172 #include <sys/zap.h>
173 #include <sys/spa.h>
174 #include <sys/spa_impl.h>
175 #include <sys/vdev.h>
176 #include <sys/priv_impl.h>
177 #include <sys/dmu.h>
178 #include <sys/dsl_dir.h>
179 #include <sys/dsl_dataset.h>
180 #include <sys/dsl_prop.h>
181 #include <sys/dsl_deleg.h>
182 #include <sys/dmu_objset.h>
183 #include <sys/dmu_impl.h>
184 #include <sys/dmu_tx.h>
185 #include <sys/ddi.h>
186 #include <sys/sunddi.h>
187 #include <sys/sunldi.h>
188 #include <sys/policy.h>
189 #include <sys/zone.h>
190 #include <sys/nvpair.h>
191 #include <sys/pathname.h>
192 #include <sys/mount.h>
193 #include <sys/sdt.h>
194 #include <sys/fs/zfs.h>
195 #include <sys/zfs_ctldir.h>
196 #include <sys/zfs_dir.h>
197 #include <sys/zfs_onexit.h>
198 #include <sys/zvol.h>
199 #include <sys/dsl_scan.h>
200 #include <sharefs/share.h>
201 #include <sys/dmu_objset.h>
202 #include <sys/dmu_recv.h>
203 #include <sys/dmu_send.h>
204 #include <sys/dsl_destroy.h>
205 #include <sys/dsl_bookmark.h>
206 #include <sys/dsl_userhold.h>
207 #include <sys/zfeature.h>
208 #include <sys/zcp.h>
209 #include <sys/zio_checksum.h>
210 #include <sys/vdev_removal.h>
211 #include <sys/vdev_impl.h>
212 #include <sys/vdev_initialize.h>
213 #include <sys/vdev_trim.h>
214 #include <sys/dsl_crypt.h>
215 
216 #include "zfs_namecheck.h"
217 #include "zfs_prop.h"
218 #include "zfs_deleg.h"
219 #include "zfs_comutil.h"
220 
221 #include "lua.h"
222 #include "lauxlib.h"
223 
224 extern struct modlfs zfs_modlfs;
225 
226 extern void zfs_init(void);
227 extern void zfs_fini(void);
228 
229 ldi_ident_t zfs_li = NULL;
230 dev_info_t *zfs_dip;
231 
232 uint_t zfs_fsyncer_key;
233 extern uint_t rrw_tsd_key;
234 static uint_t zfs_allow_log_key;
235 
236 typedef int zfs_ioc_legacy_func_t(zfs_cmd_t *);
237 typedef int zfs_ioc_func_t(const char *, nvlist_t *, nvlist_t *);
238 typedef int zfs_secpolicy_func_t(zfs_cmd_t *, nvlist_t *, cred_t *);
239 
240 /*
241  * IOC Keys are used to document and validate user->kernel interface inputs.
242  * See zfs_keys_recv_new for an example declaration. Any key name that is not
243  * listed will be rejected as input.
244  *
245  * The keyname 'optional' is always allowed, and must be an nvlist if present.
246  * Arguments which older kernels can safely ignore can be placed under the
247  * "optional" key.
248  *
249  * When adding new keys to an existing ioc for new functionality, consider:
250  *	- adding an entry into zfs_sysfs.c zfs_features[] list
251  *	- updating the libzfs_input_check.c test utility
252  *
253  * Note: in the ZK_WILDCARDLIST case, the name serves as documentation
254  * for the expected name (bookmark, snapshot, property, etc) but there
255  * is no validation in the preflight zfs_check_input_nvpairs() check.
256  */
257 typedef enum {
258 	ZK_OPTIONAL = 1 << 0,		/* pair is optional */
259 	ZK_WILDCARDLIST = 1 << 1,	/* one or more unspecified key names */
260 } ioc_key_flag_t;
261 
262 /* DATA_TYPE_ANY is used when zkey_type can vary. */
263 #define	DATA_TYPE_ANY	DATA_TYPE_UNKNOWN
264 
265 typedef struct zfs_ioc_key {
266 	const char	*zkey_name;
267 	data_type_t	zkey_type;
268 	ioc_key_flag_t	zkey_flags;
269 } zfs_ioc_key_t;
270 
271 typedef enum {
272 	NO_NAME,
273 	POOL_NAME,
274 	DATASET_NAME
275 } zfs_ioc_namecheck_t;
276 
277 typedef enum {
278 	POOL_CHECK_NONE		= 1 << 0,
279 	POOL_CHECK_SUSPENDED	= 1 << 1,
280 	POOL_CHECK_READONLY	= 1 << 2,
281 } zfs_ioc_poolcheck_t;
282 
283 typedef struct zfs_ioc_vec {
284 	zfs_ioc_legacy_func_t	*zvec_legacy_func;
285 	zfs_ioc_func_t		*zvec_func;
286 	zfs_secpolicy_func_t	*zvec_secpolicy;
287 	zfs_ioc_namecheck_t	zvec_namecheck;
288 	boolean_t		zvec_allow_log;
289 	zfs_ioc_poolcheck_t	zvec_pool_check;
290 	boolean_t		zvec_smush_outnvlist;
291 	const char		*zvec_name;
292 	const zfs_ioc_key_t	*zvec_nvl_keys;
293 	size_t			zvec_nvl_key_count;
294 } zfs_ioc_vec_t;
295 
296 /* This array is indexed by zfs_userquota_prop_t */
297 static const char *userquota_perms[] = {
298 	ZFS_DELEG_PERM_USERUSED,
299 	ZFS_DELEG_PERM_USERQUOTA,
300 	ZFS_DELEG_PERM_GROUPUSED,
301 	ZFS_DELEG_PERM_GROUPQUOTA,
302 	ZFS_DELEG_PERM_USEROBJUSED,
303 	ZFS_DELEG_PERM_USEROBJQUOTA,
304 	ZFS_DELEG_PERM_GROUPOBJUSED,
305 	ZFS_DELEG_PERM_GROUPOBJQUOTA,
306 	ZFS_DELEG_PERM_PROJECTUSED,
307 	ZFS_DELEG_PERM_PROJECTQUOTA,
308 	ZFS_DELEG_PERM_PROJECTOBJUSED,
309 	ZFS_DELEG_PERM_PROJECTOBJQUOTA,
310 };
311 
312 static int zfs_ioc_userspace_upgrade(zfs_cmd_t *zc);
313 static int zfs_ioc_id_quota_upgrade(zfs_cmd_t *zc);
314 static int zfs_check_settable(const char *name, nvpair_t *property,
315     cred_t *cr);
316 static int zfs_check_clearable(char *dataset, nvlist_t *props,
317     nvlist_t **errors);
318 static int zfs_fill_zplprops_root(uint64_t, nvlist_t *, nvlist_t *,
319     boolean_t *);
320 int zfs_set_prop_nvlist(const char *, zprop_source_t, nvlist_t *, nvlist_t *);
321 static int get_nvlist(uint64_t nvl, uint64_t size, int iflag, nvlist_t **nvp);
322 
323 static int zfs_prop_activate_feature(spa_t *spa, spa_feature_t feature);
324 
325 /* _NOTE(PRINTFLIKE(4)) - this is printf-like, but lint is too whiney */
326 void
__dprintf(const char * file,const char * func,int line,const char * fmt,...)327 __dprintf(const char *file, const char *func, int line, const char *fmt, ...)
328 {
329 	const char *newfile;
330 	char buf[512];
331 	va_list adx;
332 
333 	/*
334 	 * Get rid of annoying "../common/" prefix to filename.
335 	 */
336 	newfile = strrchr(file, '/');
337 	if (newfile != NULL) {
338 		newfile = newfile + 1; /* Get rid of leading / */
339 	} else {
340 		newfile = file;
341 	}
342 
343 	va_start(adx, fmt);
344 	(void) vsnprintf(buf, sizeof (buf), fmt, adx);
345 	va_end(adx);
346 
347 	/*
348 	 * To get this data, use the zfs-dprintf probe as so:
349 	 * dtrace -q -n 'zfs-dprintf \
350 	 *	/stringof(arg0) == "dbuf.c"/ \
351 	 *	{printf("%s: %s", stringof(arg1), stringof(arg3))}'
352 	 * arg0 = file name
353 	 * arg1 = function name
354 	 * arg2 = line number
355 	 * arg3 = message
356 	 */
357 	DTRACE_PROBE4(zfs__dprintf,
358 	    char *, newfile, char *, func, int, line, char *, buf);
359 }
360 
361 static void
history_str_free(char * buf)362 history_str_free(char *buf)
363 {
364 	kmem_free(buf, HIS_MAX_RECORD_LEN);
365 }
366 
367 static char *
history_str_get(zfs_cmd_t * zc)368 history_str_get(zfs_cmd_t *zc)
369 {
370 	char *buf;
371 
372 	if (zc->zc_history == 0)
373 		return (NULL);
374 
375 	buf = kmem_alloc(HIS_MAX_RECORD_LEN, KM_SLEEP);
376 	if (copyinstr((void *)(uintptr_t)zc->zc_history,
377 	    buf, HIS_MAX_RECORD_LEN, NULL) != 0) {
378 		history_str_free(buf);
379 		return (NULL);
380 	}
381 
382 	buf[HIS_MAX_RECORD_LEN -1] = '\0';
383 
384 	return (buf);
385 }
386 
387 /*
388  * Check to see if the named dataset is currently defined as bootable
389  */
390 static boolean_t
zfs_is_bootfs(const char * name)391 zfs_is_bootfs(const char *name)
392 {
393 	objset_t *os;
394 
395 	if (dmu_objset_hold(name, FTAG, &os) == 0) {
396 		boolean_t ret;
397 		ret = (dmu_objset_id(os) == spa_bootfs(dmu_objset_spa(os)));
398 		dmu_objset_rele(os, FTAG);
399 		return (ret);
400 	}
401 	return (B_FALSE);
402 }
403 
404 /*
405  * Return non-zero if the spa version is less than requested version.
406  */
407 static int
zfs_earlier_version(const char * name,int version)408 zfs_earlier_version(const char *name, int version)
409 {
410 	spa_t *spa;
411 
412 	if (spa_open(name, &spa, FTAG) == 0) {
413 		if (spa_version(spa) < version) {
414 			spa_close(spa, FTAG);
415 			return (1);
416 		}
417 		spa_close(spa, FTAG);
418 	}
419 	return (0);
420 }
421 
422 /*
423  * Return TRUE if the ZPL version is less than requested version.
424  */
425 static boolean_t
zpl_earlier_version(const char * name,int version)426 zpl_earlier_version(const char *name, int version)
427 {
428 	objset_t *os;
429 	boolean_t rc = B_TRUE;
430 
431 	if (dmu_objset_hold(name, FTAG, &os) == 0) {
432 		uint64_t zplversion;
433 
434 		if (dmu_objset_type(os) != DMU_OST_ZFS) {
435 			dmu_objset_rele(os, FTAG);
436 			return (B_TRUE);
437 		}
438 		/* XXX reading from non-owned objset */
439 		if (zfs_get_zplprop(os, ZFS_PROP_VERSION, &zplversion) == 0)
440 			rc = zplversion < version;
441 		dmu_objset_rele(os, FTAG);
442 	}
443 	return (rc);
444 }
445 
446 static void
zfs_log_history(zfs_cmd_t * zc)447 zfs_log_history(zfs_cmd_t *zc)
448 {
449 	spa_t *spa;
450 	char *buf;
451 
452 	if ((buf = history_str_get(zc)) == NULL)
453 		return;
454 
455 	if (spa_open(zc->zc_name, &spa, FTAG) == 0) {
456 		if (spa_version(spa) >= SPA_VERSION_ZPOOL_HISTORY)
457 			(void) spa_history_log(spa, buf);
458 		spa_close(spa, FTAG);
459 	}
460 	history_str_free(buf);
461 }
462 
463 /*
464  * Policy for top-level read operations (list pools).  Requires no privileges,
465  * and can be used in the local zone, as there is no associated dataset.
466  */
467 /* ARGSUSED */
468 static int
zfs_secpolicy_none(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)469 zfs_secpolicy_none(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
470 {
471 	return (0);
472 }
473 
474 /*
475  * Policy for dataset read operations (list children, get statistics).  Requires
476  * no privileges, but must be visible in the local zone.
477  */
478 /* ARGSUSED */
479 static int
zfs_secpolicy_read(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)480 zfs_secpolicy_read(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
481 {
482 	if (INGLOBALZONE(curproc) ||
483 	    zone_dataset_visible(zc->zc_name, NULL))
484 		return (0);
485 
486 	return (SET_ERROR(ENOENT));
487 }
488 
489 static int
zfs_dozonecheck_impl(const char * dataset,uint64_t zoned,cred_t * cr)490 zfs_dozonecheck_impl(const char *dataset, uint64_t zoned, cred_t *cr)
491 {
492 	int writable = 1;
493 
494 	/*
495 	 * The dataset must be visible by this zone -- check this first
496 	 * so they don't see EPERM on something they shouldn't know about.
497 	 */
498 	if (!INGLOBALZONE(curproc) &&
499 	    !zone_dataset_visible(dataset, &writable))
500 		return (SET_ERROR(ENOENT));
501 
502 	if (INGLOBALZONE(curproc)) {
503 		/*
504 		 * If the fs is zoned, only root can access it from the
505 		 * global zone.
506 		 */
507 		if (secpolicy_zfs(cr) && zoned)
508 			return (SET_ERROR(EPERM));
509 	} else {
510 		/*
511 		 * If we are in a local zone, the 'zoned' property must be set.
512 		 */
513 		if (!zoned)
514 			return (SET_ERROR(EPERM));
515 
516 		/* must be writable by this zone */
517 		if (!writable)
518 			return (SET_ERROR(EPERM));
519 	}
520 	return (0);
521 }
522 
523 static int
zfs_dozonecheck(const char * dataset,cred_t * cr)524 zfs_dozonecheck(const char *dataset, cred_t *cr)
525 {
526 	uint64_t zoned;
527 
528 	if (dsl_prop_get_integer(dataset, "zoned", &zoned, NULL))
529 		return (SET_ERROR(ENOENT));
530 
531 	return (zfs_dozonecheck_impl(dataset, zoned, cr));
532 }
533 
534 static int
zfs_dozonecheck_ds(const char * dataset,dsl_dataset_t * ds,cred_t * cr)535 zfs_dozonecheck_ds(const char *dataset, dsl_dataset_t *ds, cred_t *cr)
536 {
537 	uint64_t zoned;
538 
539 	if (dsl_prop_get_int_ds(ds, "zoned", &zoned))
540 		return (SET_ERROR(ENOENT));
541 
542 	return (zfs_dozonecheck_impl(dataset, zoned, cr));
543 }
544 
545 static int
zfs_secpolicy_write_perms_ds(const char * name,dsl_dataset_t * ds,const char * perm,cred_t * cr)546 zfs_secpolicy_write_perms_ds(const char *name, dsl_dataset_t *ds,
547     const char *perm, cred_t *cr)
548 {
549 	int error;
550 
551 	error = zfs_dozonecheck_ds(name, ds, cr);
552 	if (error == 0) {
553 		error = secpolicy_zfs(cr);
554 		if (error != 0)
555 			error = dsl_deleg_access_impl(ds, perm, cr);
556 	}
557 	return (error);
558 }
559 
560 static int
zfs_secpolicy_write_perms(const char * name,const char * perm,cred_t * cr)561 zfs_secpolicy_write_perms(const char *name, const char *perm, cred_t *cr)
562 {
563 	int error;
564 	dsl_dataset_t *ds;
565 	dsl_pool_t *dp;
566 
567 	/*
568 	 * First do a quick check for root in the global zone, which
569 	 * is allowed to do all write_perms.  This ensures that zfs_ioc_*
570 	 * will get to handle nonexistent datasets.
571 	 */
572 	if (INGLOBALZONE(curproc) && secpolicy_zfs(cr) == 0)
573 		return (0);
574 
575 	error = dsl_pool_hold(name, FTAG, &dp);
576 	if (error != 0)
577 		return (error);
578 
579 	error = dsl_dataset_hold(dp, name, FTAG, &ds);
580 	if (error != 0) {
581 		dsl_pool_rele(dp, FTAG);
582 		return (error);
583 	}
584 
585 	error = zfs_secpolicy_write_perms_ds(name, ds, perm, cr);
586 
587 	dsl_dataset_rele(ds, FTAG);
588 	dsl_pool_rele(dp, FTAG);
589 	return (error);
590 }
591 
592 /*
593  * Policy for setting the security label property.
594  *
595  * Returns 0 for success, non-zero for access and other errors.
596  */
597 static int
zfs_set_slabel_policy(const char * name,char * strval,cred_t * cr)598 zfs_set_slabel_policy(const char *name, char *strval, cred_t *cr)
599 {
600 	char		ds_hexsl[MAXNAMELEN];
601 	bslabel_t	ds_sl, new_sl;
602 	boolean_t	new_default = FALSE;
603 	uint64_t	zoned;
604 	int		needed_priv = -1;
605 	int		error;
606 
607 	/* First get the existing dataset label. */
608 	error = dsl_prop_get(name, zfs_prop_to_name(ZFS_PROP_MLSLABEL),
609 	    1, sizeof (ds_hexsl), &ds_hexsl, NULL);
610 	if (error != 0)
611 		return (SET_ERROR(EPERM));
612 
613 	if (strcasecmp(strval, ZFS_MLSLABEL_DEFAULT) == 0)
614 		new_default = TRUE;
615 
616 	/* The label must be translatable */
617 	if (!new_default && (hexstr_to_label(strval, &new_sl) != 0))
618 		return (SET_ERROR(EINVAL));
619 
620 	/*
621 	 * In a non-global zone, disallow attempts to set a label that
622 	 * doesn't match that of the zone; otherwise no other checks
623 	 * are needed.
624 	 */
625 	if (!INGLOBALZONE(curproc)) {
626 		if (new_default || !blequal(&new_sl, CR_SL(CRED())))
627 			return (SET_ERROR(EPERM));
628 		return (0);
629 	}
630 
631 	/*
632 	 * For global-zone datasets (i.e., those whose zoned property is
633 	 * "off", verify that the specified new label is valid for the
634 	 * global zone.
635 	 */
636 	if (dsl_prop_get_integer(name,
637 	    zfs_prop_to_name(ZFS_PROP_ZONED), &zoned, NULL))
638 		return (SET_ERROR(EPERM));
639 	if (!zoned) {
640 		if (zfs_check_global_label(name, strval) != 0)
641 			return (SET_ERROR(EPERM));
642 	}
643 
644 	/*
645 	 * If the existing dataset label is nondefault, check if the
646 	 * dataset is mounted (label cannot be changed while mounted).
647 	 * Get the zfsvfs; if there isn't one, then the dataset isn't
648 	 * mounted (or isn't a dataset, doesn't exist, ...).
649 	 */
650 	if (strcasecmp(ds_hexsl, ZFS_MLSLABEL_DEFAULT) != 0) {
651 		objset_t *os;
652 		static char *setsl_tag = "setsl_tag";
653 
654 		/*
655 		 * Try to own the dataset; abort if there is any error,
656 		 * (e.g., already mounted, in use, or other error).
657 		 */
658 		error = dmu_objset_own(name, DMU_OST_ZFS, B_TRUE, B_TRUE,
659 		    setsl_tag, &os);
660 		if (error != 0)
661 			return (SET_ERROR(EPERM));
662 
663 		dmu_objset_disown(os, B_TRUE, setsl_tag);
664 
665 		if (new_default) {
666 			needed_priv = PRIV_FILE_DOWNGRADE_SL;
667 			goto out_check;
668 		}
669 
670 		if (hexstr_to_label(strval, &new_sl) != 0)
671 			return (SET_ERROR(EPERM));
672 
673 		if (blstrictdom(&ds_sl, &new_sl))
674 			needed_priv = PRIV_FILE_DOWNGRADE_SL;
675 		else if (blstrictdom(&new_sl, &ds_sl))
676 			needed_priv = PRIV_FILE_UPGRADE_SL;
677 	} else {
678 		/* dataset currently has a default label */
679 		if (!new_default)
680 			needed_priv = PRIV_FILE_UPGRADE_SL;
681 	}
682 
683 out_check:
684 	if (needed_priv != -1)
685 		return (PRIV_POLICY(cr, needed_priv, B_FALSE, EPERM, NULL));
686 	return (0);
687 }
688 
689 static int
zfs_secpolicy_setprop(const char * dsname,zfs_prop_t prop,nvpair_t * propval,cred_t * cr)690 zfs_secpolicy_setprop(const char *dsname, zfs_prop_t prop, nvpair_t *propval,
691     cred_t *cr)
692 {
693 	char *strval;
694 
695 	/*
696 	 * Check permissions for special properties.
697 	 */
698 	switch (prop) {
699 	case ZFS_PROP_ZONED:
700 		/*
701 		 * Disallow setting of 'zoned' from within a local zone.
702 		 */
703 		if (!INGLOBALZONE(curproc))
704 			return (SET_ERROR(EPERM));
705 		break;
706 
707 	case ZFS_PROP_QUOTA:
708 	case ZFS_PROP_FILESYSTEM_LIMIT:
709 	case ZFS_PROP_SNAPSHOT_LIMIT:
710 		if (!INGLOBALZONE(curproc)) {
711 			uint64_t zoned;
712 			char setpoint[ZFS_MAX_DATASET_NAME_LEN];
713 			/*
714 			 * Unprivileged users are allowed to modify the
715 			 * limit on things *under* (ie. contained by)
716 			 * the thing they own.
717 			 */
718 			if (dsl_prop_get_integer(dsname, "zoned", &zoned,
719 			    setpoint))
720 				return (SET_ERROR(EPERM));
721 			if (!zoned || strlen(dsname) <= strlen(setpoint))
722 				return (SET_ERROR(EPERM));
723 		}
724 		break;
725 
726 	case ZFS_PROP_MLSLABEL:
727 		if (!is_system_labeled())
728 			return (SET_ERROR(EPERM));
729 
730 		if (nvpair_value_string(propval, &strval) == 0) {
731 			int err;
732 
733 			err = zfs_set_slabel_policy(dsname, strval, CRED());
734 			if (err != 0)
735 				return (err);
736 		}
737 		break;
738 	}
739 
740 	return (zfs_secpolicy_write_perms(dsname, zfs_prop_to_name(prop), cr));
741 }
742 
743 /* ARGSUSED */
744 static int
zfs_secpolicy_set_fsacl(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)745 zfs_secpolicy_set_fsacl(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
746 {
747 	int error;
748 
749 	error = zfs_dozonecheck(zc->zc_name, cr);
750 	if (error != 0)
751 		return (error);
752 
753 	/*
754 	 * permission to set permissions will be evaluated later in
755 	 * dsl_deleg_can_allow()
756 	 */
757 	return (0);
758 }
759 
760 /* ARGSUSED */
761 static int
zfs_secpolicy_rollback(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)762 zfs_secpolicy_rollback(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
763 {
764 	return (zfs_secpolicy_write_perms(zc->zc_name,
765 	    ZFS_DELEG_PERM_ROLLBACK, cr));
766 }
767 
768 /* ARGSUSED */
769 static int
zfs_secpolicy_send(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)770 zfs_secpolicy_send(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
771 {
772 	dsl_pool_t *dp;
773 	dsl_dataset_t *ds;
774 	char *cp;
775 	int error;
776 
777 	/*
778 	 * Generate the current snapshot name from the given objsetid, then
779 	 * use that name for the secpolicy/zone checks.
780 	 */
781 	cp = strchr(zc->zc_name, '@');
782 	if (cp == NULL)
783 		return (SET_ERROR(EINVAL));
784 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
785 	if (error != 0)
786 		return (error);
787 
788 	error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &ds);
789 	if (error != 0) {
790 		dsl_pool_rele(dp, FTAG);
791 		return (error);
792 	}
793 
794 	dsl_dataset_name(ds, zc->zc_name);
795 
796 	error = zfs_secpolicy_write_perms_ds(zc->zc_name, ds,
797 	    ZFS_DELEG_PERM_SEND, cr);
798 	dsl_dataset_rele(ds, FTAG);
799 	dsl_pool_rele(dp, FTAG);
800 
801 	return (error);
802 }
803 
804 /* ARGSUSED */
805 static int
zfs_secpolicy_send_new(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)806 zfs_secpolicy_send_new(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
807 {
808 	return (zfs_secpolicy_write_perms(zc->zc_name,
809 	    ZFS_DELEG_PERM_SEND, cr));
810 }
811 
812 /* ARGSUSED */
813 static int
zfs_secpolicy_deleg_share(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)814 zfs_secpolicy_deleg_share(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
815 {
816 	vnode_t *vp;
817 	int error;
818 
819 	if ((error = lookupname(zc->zc_value, UIO_SYSSPACE,
820 	    NO_FOLLOW, NULL, &vp)) != 0)
821 		return (error);
822 
823 	/* Now make sure mntpnt and dataset are ZFS */
824 
825 	if (vp->v_vfsp->vfs_fstype != zfsfstype ||
826 	    (strcmp((char *)refstr_value(vp->v_vfsp->vfs_resource),
827 	    zc->zc_name) != 0)) {
828 		VN_RELE(vp);
829 		return (SET_ERROR(EPERM));
830 	}
831 
832 	VN_RELE(vp);
833 	return (dsl_deleg_access(zc->zc_name,
834 	    ZFS_DELEG_PERM_SHARE, cr));
835 }
836 
837 int
zfs_secpolicy_share(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)838 zfs_secpolicy_share(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
839 {
840 	if (secpolicy_nfs(cr) == 0) {
841 		return (0);
842 	} else {
843 		return (zfs_secpolicy_deleg_share(zc, innvl, cr));
844 	}
845 }
846 
847 int
zfs_secpolicy_smb_acl(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)848 zfs_secpolicy_smb_acl(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
849 {
850 	if (secpolicy_smb(cr) == 0) {
851 		return (0);
852 	} else {
853 		return (zfs_secpolicy_deleg_share(zc, innvl, cr));
854 	}
855 }
856 
857 static int
zfs_get_parent(const char * datasetname,char * parent,int parentsize)858 zfs_get_parent(const char *datasetname, char *parent, int parentsize)
859 {
860 	char *cp;
861 
862 	/*
863 	 * Remove the @bla or /bla from the end of the name to get the parent.
864 	 */
865 	(void) strncpy(parent, datasetname, parentsize);
866 	cp = strrchr(parent, '@');
867 	if (cp != NULL) {
868 		cp[0] = '\0';
869 	} else {
870 		cp = strrchr(parent, '/');
871 		if (cp == NULL)
872 			return (SET_ERROR(ENOENT));
873 		cp[0] = '\0';
874 	}
875 
876 	return (0);
877 }
878 
879 int
zfs_secpolicy_destroy_perms(const char * name,cred_t * cr)880 zfs_secpolicy_destroy_perms(const char *name, cred_t *cr)
881 {
882 	int error;
883 
884 	if ((error = zfs_secpolicy_write_perms(name,
885 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
886 		return (error);
887 
888 	return (zfs_secpolicy_write_perms(name, ZFS_DELEG_PERM_DESTROY, cr));
889 }
890 
891 /* ARGSUSED */
892 static int
zfs_secpolicy_destroy(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)893 zfs_secpolicy_destroy(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
894 {
895 	return (zfs_secpolicy_destroy_perms(zc->zc_name, cr));
896 }
897 
898 /*
899  * Destroying snapshots with delegated permissions requires
900  * descendant mount and destroy permissions.
901  */
902 /* ARGSUSED */
903 static int
zfs_secpolicy_destroy_snaps(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)904 zfs_secpolicy_destroy_snaps(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
905 {
906 	nvlist_t *snaps;
907 	nvpair_t *pair, *nextpair;
908 	int error = 0;
909 
910 	snaps = fnvlist_lookup_nvlist(innvl, "snaps");
911 
912 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
913 	    pair = nextpair) {
914 		nextpair = nvlist_next_nvpair(snaps, pair);
915 		error = zfs_secpolicy_destroy_perms(nvpair_name(pair), cr);
916 		if (error == ENOENT) {
917 			/*
918 			 * Ignore any snapshots that don't exist (we consider
919 			 * them "already destroyed").  Remove the name from the
920 			 * nvl here in case the snapshot is created between
921 			 * now and when we try to destroy it (in which case
922 			 * we don't want to destroy it since we haven't
923 			 * checked for permission).
924 			 */
925 			fnvlist_remove_nvpair(snaps, pair);
926 			error = 0;
927 		}
928 		if (error != 0)
929 			break;
930 	}
931 
932 	return (error);
933 }
934 
935 int
zfs_secpolicy_rename_perms(const char * from,const char * to,cred_t * cr)936 zfs_secpolicy_rename_perms(const char *from, const char *to, cred_t *cr)
937 {
938 	char	parentname[ZFS_MAX_DATASET_NAME_LEN];
939 	int	error;
940 
941 	if ((error = zfs_secpolicy_write_perms(from,
942 	    ZFS_DELEG_PERM_RENAME, cr)) != 0)
943 		return (error);
944 
945 	if ((error = zfs_secpolicy_write_perms(from,
946 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
947 		return (error);
948 
949 	if ((error = zfs_get_parent(to, parentname,
950 	    sizeof (parentname))) != 0)
951 		return (error);
952 
953 	if ((error = zfs_secpolicy_write_perms(parentname,
954 	    ZFS_DELEG_PERM_CREATE, cr)) != 0)
955 		return (error);
956 
957 	if ((error = zfs_secpolicy_write_perms(parentname,
958 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
959 		return (error);
960 
961 	return (error);
962 }
963 
964 /* ARGSUSED */
965 static int
zfs_secpolicy_rename(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)966 zfs_secpolicy_rename(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
967 {
968 	return (zfs_secpolicy_rename_perms(zc->zc_name, zc->zc_value, cr));
969 }
970 
971 /* ARGSUSED */
972 static int
zfs_secpolicy_promote(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)973 zfs_secpolicy_promote(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
974 {
975 	dsl_pool_t *dp;
976 	dsl_dataset_t *clone;
977 	int error;
978 
979 	error = zfs_secpolicy_write_perms(zc->zc_name,
980 	    ZFS_DELEG_PERM_PROMOTE, cr);
981 	if (error != 0)
982 		return (error);
983 
984 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
985 	if (error != 0)
986 		return (error);
987 
988 	error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &clone);
989 
990 	if (error == 0) {
991 		char parentname[ZFS_MAX_DATASET_NAME_LEN];
992 		dsl_dataset_t *origin = NULL;
993 		dsl_dir_t *dd;
994 		dd = clone->ds_dir;
995 
996 		error = dsl_dataset_hold_obj(dd->dd_pool,
997 		    dsl_dir_phys(dd)->dd_origin_obj, FTAG, &origin);
998 		if (error != 0) {
999 			dsl_dataset_rele(clone, FTAG);
1000 			dsl_pool_rele(dp, FTAG);
1001 			return (error);
1002 		}
1003 
1004 		error = zfs_secpolicy_write_perms_ds(zc->zc_name, clone,
1005 		    ZFS_DELEG_PERM_MOUNT, cr);
1006 
1007 		dsl_dataset_name(origin, parentname);
1008 		if (error == 0) {
1009 			error = zfs_secpolicy_write_perms_ds(parentname, origin,
1010 			    ZFS_DELEG_PERM_PROMOTE, cr);
1011 		}
1012 		dsl_dataset_rele(clone, FTAG);
1013 		dsl_dataset_rele(origin, FTAG);
1014 	}
1015 	dsl_pool_rele(dp, FTAG);
1016 	return (error);
1017 }
1018 
1019 /* ARGSUSED */
1020 static int
zfs_secpolicy_recv(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1021 zfs_secpolicy_recv(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1022 {
1023 	int error;
1024 
1025 	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
1026 	    ZFS_DELEG_PERM_RECEIVE, cr)) != 0)
1027 		return (error);
1028 
1029 	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
1030 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
1031 		return (error);
1032 
1033 	return (zfs_secpolicy_write_perms(zc->zc_name,
1034 	    ZFS_DELEG_PERM_CREATE, cr));
1035 }
1036 
1037 int
zfs_secpolicy_snapshot_perms(const char * name,cred_t * cr)1038 zfs_secpolicy_snapshot_perms(const char *name, cred_t *cr)
1039 {
1040 	return (zfs_secpolicy_write_perms(name,
1041 	    ZFS_DELEG_PERM_SNAPSHOT, cr));
1042 }
1043 
1044 /*
1045  * Check for permission to create each snapshot in the nvlist.
1046  */
1047 /* ARGSUSED */
1048 static int
zfs_secpolicy_snapshot(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1049 zfs_secpolicy_snapshot(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1050 {
1051 	nvlist_t *snaps;
1052 	int error = 0;
1053 	nvpair_t *pair;
1054 
1055 	snaps = fnvlist_lookup_nvlist(innvl, "snaps");
1056 
1057 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
1058 	    pair = nvlist_next_nvpair(snaps, pair)) {
1059 		char *name = nvpair_name(pair);
1060 		char *atp = strchr(name, '@');
1061 
1062 		if (atp == NULL) {
1063 			error = SET_ERROR(EINVAL);
1064 			break;
1065 		}
1066 		*atp = '\0';
1067 		error = zfs_secpolicy_snapshot_perms(name, cr);
1068 		*atp = '@';
1069 		if (error != 0)
1070 			break;
1071 	}
1072 	return (error);
1073 }
1074 
1075 /*
1076  * Check for permission to create each bookmark in the nvlist.
1077  */
1078 /* ARGSUSED */
1079 static int
zfs_secpolicy_bookmark(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1080 zfs_secpolicy_bookmark(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1081 {
1082 	int error = 0;
1083 
1084 	for (nvpair_t *pair = nvlist_next_nvpair(innvl, NULL);
1085 	    pair != NULL; pair = nvlist_next_nvpair(innvl, pair)) {
1086 		char *name = nvpair_name(pair);
1087 		char *hashp = strchr(name, '#');
1088 
1089 		if (hashp == NULL) {
1090 			error = SET_ERROR(EINVAL);
1091 			break;
1092 		}
1093 		*hashp = '\0';
1094 		error = zfs_secpolicy_write_perms(name,
1095 		    ZFS_DELEG_PERM_BOOKMARK, cr);
1096 		*hashp = '#';
1097 		if (error != 0)
1098 			break;
1099 	}
1100 	return (error);
1101 }
1102 
1103 /* ARGSUSED */
1104 static int
zfs_secpolicy_remap(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1105 zfs_secpolicy_remap(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1106 {
1107 	return (zfs_secpolicy_write_perms(zc->zc_name,
1108 	    ZFS_DELEG_PERM_REMAP, cr));
1109 }
1110 
1111 /* ARGSUSED */
1112 static int
zfs_secpolicy_destroy_bookmarks(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1113 zfs_secpolicy_destroy_bookmarks(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1114 {
1115 	nvpair_t *pair, *nextpair;
1116 	int error = 0;
1117 
1118 	for (pair = nvlist_next_nvpair(innvl, NULL); pair != NULL;
1119 	    pair = nextpair) {
1120 		char *name = nvpair_name(pair);
1121 		char *hashp = strchr(name, '#');
1122 		nextpair = nvlist_next_nvpair(innvl, pair);
1123 
1124 		if (hashp == NULL) {
1125 			error = SET_ERROR(EINVAL);
1126 			break;
1127 		}
1128 
1129 		*hashp = '\0';
1130 		error = zfs_secpolicy_write_perms(name,
1131 		    ZFS_DELEG_PERM_DESTROY, cr);
1132 		*hashp = '#';
1133 		if (error == ENOENT) {
1134 			/*
1135 			 * Ignore any filesystems that don't exist (we consider
1136 			 * their bookmarks "already destroyed").  Remove
1137 			 * the name from the nvl here in case the filesystem
1138 			 * is created between now and when we try to destroy
1139 			 * the bookmark (in which case we don't want to
1140 			 * destroy it since we haven't checked for permission).
1141 			 */
1142 			fnvlist_remove_nvpair(innvl, pair);
1143 			error = 0;
1144 		}
1145 		if (error != 0)
1146 			break;
1147 	}
1148 
1149 	return (error);
1150 }
1151 
1152 /* ARGSUSED */
1153 static int
zfs_secpolicy_log_history(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1154 zfs_secpolicy_log_history(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1155 {
1156 	/*
1157 	 * Even root must have a proper TSD so that we know what pool
1158 	 * to log to.
1159 	 */
1160 	if (tsd_get(zfs_allow_log_key) == NULL)
1161 		return (SET_ERROR(EPERM));
1162 	return (0);
1163 }
1164 
1165 static int
zfs_secpolicy_create_clone(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1166 zfs_secpolicy_create_clone(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1167 {
1168 	char	parentname[ZFS_MAX_DATASET_NAME_LEN];
1169 	int	error;
1170 	char	*origin;
1171 
1172 	if ((error = zfs_get_parent(zc->zc_name, parentname,
1173 	    sizeof (parentname))) != 0)
1174 		return (error);
1175 
1176 	if (nvlist_lookup_string(innvl, "origin", &origin) == 0 &&
1177 	    (error = zfs_secpolicy_write_perms(origin,
1178 	    ZFS_DELEG_PERM_CLONE, cr)) != 0)
1179 		return (error);
1180 
1181 	if ((error = zfs_secpolicy_write_perms(parentname,
1182 	    ZFS_DELEG_PERM_CREATE, cr)) != 0)
1183 		return (error);
1184 
1185 	return (zfs_secpolicy_write_perms(parentname,
1186 	    ZFS_DELEG_PERM_MOUNT, cr));
1187 }
1188 
1189 /*
1190  * Policy for pool operations - create/destroy pools, add vdevs, etc.  Requires
1191  * SYS_CONFIG privilege, which is not available in a local zone.
1192  */
1193 /* ARGSUSED */
1194 static int
zfs_secpolicy_config(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1195 zfs_secpolicy_config(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1196 {
1197 	if (secpolicy_sys_config(cr, B_FALSE) != 0)
1198 		return (SET_ERROR(EPERM));
1199 
1200 	return (0);
1201 }
1202 
1203 /*
1204  * Policy for object to name lookups.
1205  */
1206 /* ARGSUSED */
1207 static int
zfs_secpolicy_diff(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1208 zfs_secpolicy_diff(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1209 {
1210 	int error;
1211 
1212 	if ((error = secpolicy_sys_config(cr, B_FALSE)) == 0)
1213 		return (0);
1214 
1215 	error = zfs_secpolicy_write_perms(zc->zc_name, ZFS_DELEG_PERM_DIFF, cr);
1216 	return (error);
1217 }
1218 
1219 /*
1220  * Policy for fault injection.  Requires all privileges.
1221  */
1222 /* ARGSUSED */
1223 static int
zfs_secpolicy_inject(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1224 zfs_secpolicy_inject(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1225 {
1226 	return (secpolicy_zinject(cr));
1227 }
1228 
1229 /* ARGSUSED */
1230 static int
zfs_secpolicy_inherit_prop(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1231 zfs_secpolicy_inherit_prop(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1232 {
1233 	zfs_prop_t prop = zfs_name_to_prop(zc->zc_value);
1234 
1235 	if (prop == ZPROP_INVAL) {
1236 		if (!zfs_prop_user(zc->zc_value))
1237 			return (SET_ERROR(EINVAL));
1238 		return (zfs_secpolicy_write_perms(zc->zc_name,
1239 		    ZFS_DELEG_PERM_USERPROP, cr));
1240 	} else {
1241 		return (zfs_secpolicy_setprop(zc->zc_name, prop,
1242 		    NULL, cr));
1243 	}
1244 }
1245 
1246 static int
zfs_secpolicy_userspace_one(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1247 zfs_secpolicy_userspace_one(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1248 {
1249 	int err = zfs_secpolicy_read(zc, innvl, cr);
1250 	if (err)
1251 		return (err);
1252 
1253 	if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
1254 		return (SET_ERROR(EINVAL));
1255 
1256 	if (zc->zc_value[0] == 0) {
1257 		/*
1258 		 * They are asking about a posix uid/gid.  If it's
1259 		 * themself, allow it.
1260 		 */
1261 		if (zc->zc_objset_type == ZFS_PROP_USERUSED ||
1262 		    zc->zc_objset_type == ZFS_PROP_USERQUOTA ||
1263 		    zc->zc_objset_type == ZFS_PROP_USEROBJUSED ||
1264 		    zc->zc_objset_type == ZFS_PROP_USEROBJQUOTA) {
1265 			if (zc->zc_guid == crgetuid(cr))
1266 				return (0);
1267 		} else if (zc->zc_objset_type == ZFS_PROP_GROUPUSED ||
1268 		    zc->zc_objset_type == ZFS_PROP_GROUPQUOTA ||
1269 		    zc->zc_objset_type == ZFS_PROP_GROUPOBJUSED ||
1270 		    zc->zc_objset_type == ZFS_PROP_GROUPOBJQUOTA) {
1271 			if (groupmember(zc->zc_guid, cr))
1272 				return (0);
1273 		}
1274 		/* else is for project quota/used */
1275 	}
1276 
1277 	return (zfs_secpolicy_write_perms(zc->zc_name,
1278 	    userquota_perms[zc->zc_objset_type], cr));
1279 }
1280 
1281 static int
zfs_secpolicy_userspace_many(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1282 zfs_secpolicy_userspace_many(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1283 {
1284 	int err = zfs_secpolicy_read(zc, innvl, cr);
1285 	if (err)
1286 		return (err);
1287 
1288 	if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
1289 		return (SET_ERROR(EINVAL));
1290 
1291 	return (zfs_secpolicy_write_perms(zc->zc_name,
1292 	    userquota_perms[zc->zc_objset_type], cr));
1293 }
1294 
1295 /* ARGSUSED */
1296 static int
zfs_secpolicy_userspace_upgrade(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1297 zfs_secpolicy_userspace_upgrade(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1298 {
1299 	return (zfs_secpolicy_setprop(zc->zc_name, ZFS_PROP_VERSION,
1300 	    NULL, cr));
1301 }
1302 
1303 /* ARGSUSED */
1304 static int
zfs_secpolicy_hold(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1305 zfs_secpolicy_hold(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1306 {
1307 	nvpair_t *pair;
1308 	nvlist_t *holds;
1309 	int error;
1310 
1311 	holds = fnvlist_lookup_nvlist(innvl, "holds");
1312 
1313 	for (pair = nvlist_next_nvpair(holds, NULL); pair != NULL;
1314 	    pair = nvlist_next_nvpair(holds, pair)) {
1315 		char fsname[ZFS_MAX_DATASET_NAME_LEN];
1316 		error = dmu_fsname(nvpair_name(pair), fsname);
1317 		if (error != 0)
1318 			return (error);
1319 		error = zfs_secpolicy_write_perms(fsname,
1320 		    ZFS_DELEG_PERM_HOLD, cr);
1321 		if (error != 0)
1322 			return (error);
1323 	}
1324 	return (0);
1325 }
1326 
1327 /* ARGSUSED */
1328 static int
zfs_secpolicy_release(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1329 zfs_secpolicy_release(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1330 {
1331 	nvpair_t *pair;
1332 	int error;
1333 
1334 	for (pair = nvlist_next_nvpair(innvl, NULL); pair != NULL;
1335 	    pair = nvlist_next_nvpair(innvl, pair)) {
1336 		char fsname[ZFS_MAX_DATASET_NAME_LEN];
1337 		error = dmu_fsname(nvpair_name(pair), fsname);
1338 		if (error != 0)
1339 			return (error);
1340 		error = zfs_secpolicy_write_perms(fsname,
1341 		    ZFS_DELEG_PERM_RELEASE, cr);
1342 		if (error != 0)
1343 			return (error);
1344 	}
1345 	return (0);
1346 }
1347 
1348 /* ARGSUSED */
1349 static int
zfs_secpolicy_load_key(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1350 zfs_secpolicy_load_key(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1351 {
1352 	return (zfs_secpolicy_write_perms(zc->zc_name,
1353 	    ZFS_DELEG_PERM_LOAD_KEY, cr));
1354 }
1355 
1356 /* ARGSUSED */
1357 static int
zfs_secpolicy_change_key(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1358 zfs_secpolicy_change_key(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1359 {
1360 	return (zfs_secpolicy_write_perms(zc->zc_name,
1361 	    ZFS_DELEG_PERM_CHANGE_KEY, cr));
1362 }
1363 
1364 /*
1365  * Policy for allowing temporary snapshots to be taken or released
1366  */
1367 static int
zfs_secpolicy_tmp_snapshot(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1368 zfs_secpolicy_tmp_snapshot(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1369 {
1370 	/*
1371 	 * A temporary snapshot is the same as a snapshot,
1372 	 * hold, destroy and release all rolled into one.
1373 	 * Delegated diff alone is sufficient that we allow this.
1374 	 */
1375 	int error;
1376 
1377 	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
1378 	    ZFS_DELEG_PERM_DIFF, cr)) == 0)
1379 		return (0);
1380 
1381 	error = zfs_secpolicy_snapshot_perms(zc->zc_name, cr);
1382 
1383 	if (innvl != NULL) {
1384 		if (error == 0)
1385 			error = zfs_secpolicy_hold(zc, innvl, cr);
1386 		if (error == 0)
1387 			error = zfs_secpolicy_release(zc, innvl, cr);
1388 		if (error == 0)
1389 			error = zfs_secpolicy_destroy(zc, innvl, cr);
1390 	}
1391 	return (error);
1392 }
1393 
1394 /*
1395  * Returns the nvlist as specified by the user in the zfs_cmd_t.
1396  */
1397 static int
get_nvlist(uint64_t nvl,uint64_t size,int iflag,nvlist_t ** nvp)1398 get_nvlist(uint64_t nvl, uint64_t size, int iflag, nvlist_t **nvp)
1399 {
1400 	char *packed;
1401 	int error;
1402 	nvlist_t *list = NULL;
1403 
1404 	/*
1405 	 * Read in and unpack the user-supplied nvlist.
1406 	 */
1407 	if (size == 0)
1408 		return (SET_ERROR(EINVAL));
1409 
1410 	packed = kmem_alloc(size, KM_SLEEP);
1411 
1412 	if ((error = ddi_copyin((void *)(uintptr_t)nvl, packed, size,
1413 	    iflag)) != 0) {
1414 		kmem_free(packed, size);
1415 		return (SET_ERROR(EFAULT));
1416 	}
1417 
1418 	if ((error = nvlist_unpack(packed, size, &list, 0)) != 0) {
1419 		kmem_free(packed, size);
1420 		return (error);
1421 	}
1422 
1423 	kmem_free(packed, size);
1424 
1425 	*nvp = list;
1426 	return (0);
1427 }
1428 
1429 /*
1430  * Reduce the size of this nvlist until it can be serialized in 'max' bytes.
1431  * Entries will be removed from the end of the nvlist, and one int32 entry
1432  * named "N_MORE_ERRORS" will be added indicating how many entries were
1433  * removed.
1434  */
1435 static int
nvlist_smush(nvlist_t * errors,size_t max)1436 nvlist_smush(nvlist_t *errors, size_t max)
1437 {
1438 	size_t size;
1439 
1440 	size = fnvlist_size(errors);
1441 
1442 	if (size > max) {
1443 		nvpair_t *more_errors;
1444 		int n = 0;
1445 
1446 		if (max < 1024)
1447 			return (SET_ERROR(ENOMEM));
1448 
1449 		fnvlist_add_int32(errors, ZPROP_N_MORE_ERRORS, 0);
1450 		more_errors = nvlist_prev_nvpair(errors, NULL);
1451 
1452 		do {
1453 			nvpair_t *pair = nvlist_prev_nvpair(errors,
1454 			    more_errors);
1455 			fnvlist_remove_nvpair(errors, pair);
1456 			n++;
1457 			size = fnvlist_size(errors);
1458 		} while (size > max);
1459 
1460 		fnvlist_remove_nvpair(errors, more_errors);
1461 		fnvlist_add_int32(errors, ZPROP_N_MORE_ERRORS, n);
1462 		ASSERT3U(fnvlist_size(errors), <=, max);
1463 	}
1464 
1465 	return (0);
1466 }
1467 
1468 static int
put_nvlist(zfs_cmd_t * zc,nvlist_t * nvl)1469 put_nvlist(zfs_cmd_t *zc, nvlist_t *nvl)
1470 {
1471 	char *packed = NULL;
1472 	int error = 0;
1473 	size_t size;
1474 
1475 	size = fnvlist_size(nvl);
1476 
1477 	if (size > zc->zc_nvlist_dst_size) {
1478 		error = SET_ERROR(ENOMEM);
1479 	} else {
1480 		packed = fnvlist_pack(nvl, &size);
1481 		if (ddi_copyout(packed, (void *)(uintptr_t)zc->zc_nvlist_dst,
1482 		    size, zc->zc_iflags) != 0)
1483 			error = SET_ERROR(EFAULT);
1484 		fnvlist_pack_free(packed, size);
1485 	}
1486 
1487 	zc->zc_nvlist_dst_size = size;
1488 	zc->zc_nvlist_dst_filled = B_TRUE;
1489 	return (error);
1490 }
1491 
1492 int
getzfsvfs_impl(objset_t * os,zfsvfs_t ** zfvp)1493 getzfsvfs_impl(objset_t *os, zfsvfs_t **zfvp)
1494 {
1495 	int error = 0;
1496 	if (dmu_objset_type(os) != DMU_OST_ZFS) {
1497 		return (SET_ERROR(EINVAL));
1498 	}
1499 
1500 	mutex_enter(&os->os_user_ptr_lock);
1501 	*zfvp = dmu_objset_get_user(os);
1502 	if (*zfvp) {
1503 		VFS_HOLD((*zfvp)->z_vfs);
1504 	} else {
1505 		error = SET_ERROR(ESRCH);
1506 	}
1507 	mutex_exit(&os->os_user_ptr_lock);
1508 	return (error);
1509 }
1510 
1511 int
getzfsvfs(const char * dsname,zfsvfs_t ** zfvp)1512 getzfsvfs(const char *dsname, zfsvfs_t **zfvp)
1513 {
1514 	objset_t *os;
1515 	int error;
1516 
1517 	error = dmu_objset_hold(dsname, FTAG, &os);
1518 	if (error != 0)
1519 		return (error);
1520 
1521 	error = getzfsvfs_impl(os, zfvp);
1522 	dmu_objset_rele(os, FTAG);
1523 	return (error);
1524 }
1525 
1526 /*
1527  * Find a zfsvfs_t for a mounted filesystem, or create our own, in which
1528  * case its z_vfs will be NULL, and it will be opened as the owner.
1529  * If 'writer' is set, the z_teardown_lock will be held for RW_WRITER,
1530  * which prevents all vnode ops from running.
1531  */
1532 static int
zfsvfs_hold(const char * name,void * tag,zfsvfs_t ** zfvp,boolean_t writer)1533 zfsvfs_hold(const char *name, void *tag, zfsvfs_t **zfvp, boolean_t writer)
1534 {
1535 	int error = 0;
1536 
1537 	if (getzfsvfs(name, zfvp) != 0)
1538 		error = zfsvfs_create(name, B_FALSE, zfvp);
1539 	if (error == 0) {
1540 		rrm_enter(&(*zfvp)->z_teardown_lock, (writer) ? RW_WRITER :
1541 		    RW_READER, tag);
1542 		if ((*zfvp)->z_unmounted) {
1543 			/*
1544 			 * XXX we could probably try again, since the unmounting
1545 			 * thread should be just about to disassociate the
1546 			 * objset from the zfsvfs.
1547 			 */
1548 			rrm_exit(&(*zfvp)->z_teardown_lock, tag);
1549 			return (SET_ERROR(EBUSY));
1550 		}
1551 	}
1552 	return (error);
1553 }
1554 
1555 static void
zfsvfs_rele(zfsvfs_t * zfsvfs,void * tag)1556 zfsvfs_rele(zfsvfs_t *zfsvfs, void *tag)
1557 {
1558 	rrm_exit(&zfsvfs->z_teardown_lock, tag);
1559 
1560 	if (zfsvfs->z_vfs) {
1561 		VFS_RELE(zfsvfs->z_vfs);
1562 	} else {
1563 		dmu_objset_disown(zfsvfs->z_os, B_TRUE, zfsvfs);
1564 		zfsvfs_free(zfsvfs);
1565 	}
1566 }
1567 
1568 static int
zfs_ioc_pool_create(zfs_cmd_t * zc)1569 zfs_ioc_pool_create(zfs_cmd_t *zc)
1570 {
1571 	int error;
1572 	nvlist_t *config, *props = NULL;
1573 	nvlist_t *rootprops = NULL;
1574 	nvlist_t *zplprops = NULL;
1575 	char *spa_name = zc->zc_name;
1576 	dsl_crypto_params_t *dcp = NULL;
1577 
1578 	if (error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1579 	    zc->zc_iflags, &config))
1580 		return (error);
1581 
1582 	if (zc->zc_nvlist_src_size != 0 && (error =
1583 	    get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
1584 	    zc->zc_iflags, &props))) {
1585 		nvlist_free(config);
1586 		return (error);
1587 	}
1588 
1589 	if (props) {
1590 		nvlist_t *nvl = NULL;
1591 		nvlist_t *hidden_args = NULL;
1592 		uint64_t version = SPA_VERSION;
1593 		char *tname;
1594 
1595 		(void) nvlist_lookup_uint64(props,
1596 		    zpool_prop_to_name(ZPOOL_PROP_VERSION), &version);
1597 		if (!SPA_VERSION_IS_SUPPORTED(version)) {
1598 			error = SET_ERROR(EINVAL);
1599 			goto pool_props_bad;
1600 		}
1601 		(void) nvlist_lookup_nvlist(props, ZPOOL_ROOTFS_PROPS, &nvl);
1602 		if (nvl) {
1603 			error = nvlist_dup(nvl, &rootprops, KM_SLEEP);
1604 			if (error != 0) {
1605 				nvlist_free(config);
1606 				nvlist_free(props);
1607 				return (error);
1608 			}
1609 			(void) nvlist_remove_all(props, ZPOOL_ROOTFS_PROPS);
1610 		}
1611 
1612 		(void) nvlist_lookup_nvlist(props, ZPOOL_HIDDEN_ARGS,
1613 		    &hidden_args);
1614 		error = dsl_crypto_params_create_nvlist(DCP_CMD_NONE,
1615 		    rootprops, hidden_args, &dcp);
1616 		if (error != 0) {
1617 			nvlist_free(config);
1618 			nvlist_free(props);
1619 			return (error);
1620 		}
1621 		(void) nvlist_remove_all(props, ZPOOL_HIDDEN_ARGS);
1622 
1623 		VERIFY(nvlist_alloc(&zplprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
1624 		error = zfs_fill_zplprops_root(version, rootprops,
1625 		    zplprops, NULL);
1626 		if (error != 0)
1627 			goto pool_props_bad;
1628 
1629 		if (nvlist_lookup_string(props,
1630 		    zpool_prop_to_name(ZPOOL_PROP_TNAME), &tname) == 0)
1631 			spa_name = tname;
1632 	}
1633 
1634 	error = spa_create(zc->zc_name, config, props, zplprops, dcp);
1635 
1636 	/*
1637 	 * Set the remaining root properties
1638 	 */
1639 	if (!error && (error = zfs_set_prop_nvlist(spa_name,
1640 	    ZPROP_SRC_LOCAL, rootprops, NULL)) != 0)
1641 		(void) spa_destroy(spa_name);
1642 
1643 pool_props_bad:
1644 	nvlist_free(rootprops);
1645 	nvlist_free(zplprops);
1646 	nvlist_free(config);
1647 	nvlist_free(props);
1648 	dsl_crypto_params_free(dcp, !!error);
1649 
1650 	return (error);
1651 }
1652 
1653 static int
zfs_ioc_pool_destroy(zfs_cmd_t * zc)1654 zfs_ioc_pool_destroy(zfs_cmd_t *zc)
1655 {
1656 	int error;
1657 	zfs_log_history(zc);
1658 	error = spa_destroy(zc->zc_name);
1659 	if (error == 0)
1660 		zvol_remove_minors(zc->zc_name);
1661 	return (error);
1662 }
1663 
1664 static int
zfs_ioc_pool_import(zfs_cmd_t * zc)1665 zfs_ioc_pool_import(zfs_cmd_t *zc)
1666 {
1667 	nvlist_t *config, *props = NULL;
1668 	uint64_t guid;
1669 	int error;
1670 
1671 	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1672 	    zc->zc_iflags, &config)) != 0)
1673 		return (error);
1674 
1675 	if (zc->zc_nvlist_src_size != 0 && (error =
1676 	    get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
1677 	    zc->zc_iflags, &props))) {
1678 		nvlist_free(config);
1679 		return (error);
1680 	}
1681 
1682 	if (nvlist_lookup_uint64(config, ZPOOL_CONFIG_POOL_GUID, &guid) != 0 ||
1683 	    guid != zc->zc_guid)
1684 		error = SET_ERROR(EINVAL);
1685 	else
1686 		error = spa_import(zc->zc_name, config, props, zc->zc_cookie);
1687 
1688 	if (zc->zc_nvlist_dst != 0) {
1689 		int err;
1690 
1691 		if ((err = put_nvlist(zc, config)) != 0)
1692 			error = err;
1693 	}
1694 
1695 	nvlist_free(config);
1696 
1697 	nvlist_free(props);
1698 
1699 	return (error);
1700 }
1701 
1702 static int
zfs_ioc_pool_export(zfs_cmd_t * zc)1703 zfs_ioc_pool_export(zfs_cmd_t *zc)
1704 {
1705 	int error;
1706 	boolean_t force = (boolean_t)zc->zc_cookie;
1707 	boolean_t hardforce = (boolean_t)zc->zc_guid;
1708 
1709 	zfs_log_history(zc);
1710 	error = spa_export(zc->zc_name, NULL, force, hardforce);
1711 	if (error == 0)
1712 		zvol_remove_minors(zc->zc_name);
1713 	return (error);
1714 }
1715 
1716 static int
zfs_ioc_pool_configs(zfs_cmd_t * zc)1717 zfs_ioc_pool_configs(zfs_cmd_t *zc)
1718 {
1719 	nvlist_t *configs;
1720 	int error;
1721 
1722 	if ((configs = spa_all_configs(&zc->zc_cookie)) == NULL)
1723 		return (SET_ERROR(EEXIST));
1724 
1725 	error = put_nvlist(zc, configs);
1726 
1727 	nvlist_free(configs);
1728 
1729 	return (error);
1730 }
1731 
1732 /*
1733  * inputs:
1734  * zc_name		name of the pool
1735  *
1736  * outputs:
1737  * zc_cookie		real errno
1738  * zc_nvlist_dst	config nvlist
1739  * zc_nvlist_dst_size	size of config nvlist
1740  */
1741 static int
zfs_ioc_pool_stats(zfs_cmd_t * zc)1742 zfs_ioc_pool_stats(zfs_cmd_t *zc)
1743 {
1744 	nvlist_t *config;
1745 	int error;
1746 	int ret = 0;
1747 
1748 	error = spa_get_stats(zc->zc_name, &config, zc->zc_value,
1749 	    sizeof (zc->zc_value));
1750 
1751 	if (config != NULL) {
1752 		ret = put_nvlist(zc, config);
1753 		nvlist_free(config);
1754 
1755 		/*
1756 		 * The config may be present even if 'error' is non-zero.
1757 		 * In this case we return success, and preserve the real errno
1758 		 * in 'zc_cookie'.
1759 		 */
1760 		zc->zc_cookie = error;
1761 	} else {
1762 		ret = error;
1763 	}
1764 
1765 	return (ret);
1766 }
1767 
1768 /*
1769  * Try to import the given pool, returning pool stats as appropriate so that
1770  * user land knows which devices are available and overall pool health.
1771  */
1772 static int
zfs_ioc_pool_tryimport(zfs_cmd_t * zc)1773 zfs_ioc_pool_tryimport(zfs_cmd_t *zc)
1774 {
1775 	nvlist_t *tryconfig, *config;
1776 	int error;
1777 
1778 	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1779 	    zc->zc_iflags, &tryconfig)) != 0)
1780 		return (error);
1781 
1782 	config = spa_tryimport(tryconfig);
1783 
1784 	nvlist_free(tryconfig);
1785 
1786 	if (config == NULL)
1787 		return (SET_ERROR(EINVAL));
1788 
1789 	error = put_nvlist(zc, config);
1790 	nvlist_free(config);
1791 
1792 	return (error);
1793 }
1794 
1795 /*
1796  * inputs:
1797  * zc_name              name of the pool
1798  * zc_cookie            scan func (pool_scan_func_t)
1799  * zc_flags             scrub pause/resume flag (pool_scrub_cmd_t)
1800  */
1801 static int
zfs_ioc_pool_scan(zfs_cmd_t * zc)1802 zfs_ioc_pool_scan(zfs_cmd_t *zc)
1803 {
1804 	spa_t *spa;
1805 	int error;
1806 
1807 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1808 		return (error);
1809 
1810 	if (zc->zc_flags >= POOL_SCRUB_FLAGS_END)
1811 		return (SET_ERROR(EINVAL));
1812 
1813 	if (zc->zc_flags == POOL_SCRUB_PAUSE)
1814 		error = spa_scrub_pause_resume(spa, POOL_SCRUB_PAUSE);
1815 	else if (zc->zc_cookie == POOL_SCAN_NONE)
1816 		error = spa_scan_stop(spa);
1817 	else
1818 		error = spa_scan(spa, zc->zc_cookie);
1819 
1820 	spa_close(spa, FTAG);
1821 
1822 	return (error);
1823 }
1824 
1825 static int
zfs_ioc_pool_freeze(zfs_cmd_t * zc)1826 zfs_ioc_pool_freeze(zfs_cmd_t *zc)
1827 {
1828 	spa_t *spa;
1829 	int error;
1830 
1831 	error = spa_open(zc->zc_name, &spa, FTAG);
1832 	if (error == 0) {
1833 		spa_freeze(spa);
1834 		spa_close(spa, FTAG);
1835 	}
1836 	return (error);
1837 }
1838 
1839 static int
zfs_ioc_pool_upgrade(zfs_cmd_t * zc)1840 zfs_ioc_pool_upgrade(zfs_cmd_t *zc)
1841 {
1842 	spa_t *spa;
1843 	int error;
1844 
1845 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1846 		return (error);
1847 
1848 	if (zc->zc_cookie < spa_version(spa) ||
1849 	    !SPA_VERSION_IS_SUPPORTED(zc->zc_cookie)) {
1850 		spa_close(spa, FTAG);
1851 		return (SET_ERROR(EINVAL));
1852 	}
1853 
1854 	spa_upgrade(spa, zc->zc_cookie);
1855 	spa_close(spa, FTAG);
1856 
1857 	return (error);
1858 }
1859 
1860 static int
zfs_ioc_pool_get_history(zfs_cmd_t * zc)1861 zfs_ioc_pool_get_history(zfs_cmd_t *zc)
1862 {
1863 	spa_t *spa;
1864 	char *hist_buf;
1865 	uint64_t size;
1866 	int error;
1867 
1868 	if ((size = zc->zc_history_len) == 0)
1869 		return (SET_ERROR(EINVAL));
1870 
1871 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1872 		return (error);
1873 
1874 	if (spa_version(spa) < SPA_VERSION_ZPOOL_HISTORY) {
1875 		spa_close(spa, FTAG);
1876 		return (SET_ERROR(ENOTSUP));
1877 	}
1878 
1879 	hist_buf = kmem_alloc(size, KM_SLEEP);
1880 	if ((error = spa_history_get(spa, &zc->zc_history_offset,
1881 	    &zc->zc_history_len, hist_buf)) == 0) {
1882 		error = ddi_copyout(hist_buf,
1883 		    (void *)(uintptr_t)zc->zc_history,
1884 		    zc->zc_history_len, zc->zc_iflags);
1885 	}
1886 
1887 	spa_close(spa, FTAG);
1888 	kmem_free(hist_buf, size);
1889 	return (error);
1890 }
1891 
1892 static int
zfs_ioc_pool_reguid(zfs_cmd_t * zc)1893 zfs_ioc_pool_reguid(zfs_cmd_t *zc)
1894 {
1895 	spa_t *spa;
1896 	int error;
1897 
1898 	error = spa_open(zc->zc_name, &spa, FTAG);
1899 	if (error == 0) {
1900 		error = spa_change_guid(spa);
1901 		spa_close(spa, FTAG);
1902 	}
1903 	return (error);
1904 }
1905 
1906 static int
zfs_ioc_dsobj_to_dsname(zfs_cmd_t * zc)1907 zfs_ioc_dsobj_to_dsname(zfs_cmd_t *zc)
1908 {
1909 	return (dsl_dsobj_to_dsname(zc->zc_name, zc->zc_obj, zc->zc_value));
1910 }
1911 
1912 /*
1913  * inputs:
1914  * zc_name		name of filesystem
1915  * zc_obj		object to find
1916  *
1917  * outputs:
1918  * zc_value		name of object
1919  */
1920 static int
zfs_ioc_obj_to_path(zfs_cmd_t * zc)1921 zfs_ioc_obj_to_path(zfs_cmd_t *zc)
1922 {
1923 	objset_t *os;
1924 	int error;
1925 
1926 	/* XXX reading from objset not owned */
1927 	if ((error = dmu_objset_hold_flags(zc->zc_name, B_TRUE,
1928 	    FTAG, &os)) != 0)
1929 		return (error);
1930 	if (dmu_objset_type(os) != DMU_OST_ZFS) {
1931 		dmu_objset_rele_flags(os, B_TRUE, FTAG);
1932 		return (SET_ERROR(EINVAL));
1933 	}
1934 	error = zfs_obj_to_path(os, zc->zc_obj, zc->zc_value,
1935 	    sizeof (zc->zc_value));
1936 	dmu_objset_rele_flags(os, B_TRUE, FTAG);
1937 
1938 	return (error);
1939 }
1940 
1941 /*
1942  * inputs:
1943  * zc_name		name of filesystem
1944  * zc_obj		object to find
1945  *
1946  * outputs:
1947  * zc_stat		stats on object
1948  * zc_value		path to object
1949  */
1950 static int
zfs_ioc_obj_to_stats(zfs_cmd_t * zc)1951 zfs_ioc_obj_to_stats(zfs_cmd_t *zc)
1952 {
1953 	objset_t *os;
1954 	int error;
1955 
1956 	/* XXX reading from objset not owned */
1957 	if ((error = dmu_objset_hold_flags(zc->zc_name, B_TRUE,
1958 	    FTAG, &os)) != 0)
1959 		return (error);
1960 	if (dmu_objset_type(os) != DMU_OST_ZFS) {
1961 		dmu_objset_rele_flags(os, B_TRUE, FTAG);
1962 		return (SET_ERROR(EINVAL));
1963 	}
1964 	error = zfs_obj_to_stats(os, zc->zc_obj, &zc->zc_stat, zc->zc_value,
1965 	    sizeof (zc->zc_value));
1966 	dmu_objset_rele_flags(os, B_TRUE, FTAG);
1967 
1968 	return (error);
1969 }
1970 
1971 static int
zfs_ioc_vdev_add(zfs_cmd_t * zc)1972 zfs_ioc_vdev_add(zfs_cmd_t *zc)
1973 {
1974 	spa_t *spa;
1975 	int error;
1976 	nvlist_t *config;
1977 
1978 	error = spa_open(zc->zc_name, &spa, FTAG);
1979 	if (error != 0)
1980 		return (error);
1981 
1982 	error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1983 	    zc->zc_iflags, &config);
1984 
1985 	if (error == 0) {
1986 		error = spa_vdev_add(spa, config);
1987 		nvlist_free(config);
1988 	}
1989 	spa_close(spa, FTAG);
1990 	return (error);
1991 }
1992 
1993 /*
1994  * inputs:
1995  * zc_name		name of the pool
1996  * zc_guid		guid of vdev to remove
1997  * zc_cookie		cancel removal
1998  */
1999 static int
zfs_ioc_vdev_remove(zfs_cmd_t * zc)2000 zfs_ioc_vdev_remove(zfs_cmd_t *zc)
2001 {
2002 	spa_t *spa;
2003 	int error;
2004 
2005 	error = spa_open(zc->zc_name, &spa, FTAG);
2006 	if (error != 0)
2007 		return (error);
2008 	if (zc->zc_cookie != 0) {
2009 		error = spa_vdev_remove_cancel(spa);
2010 	} else {
2011 		error = spa_vdev_remove(spa, zc->zc_guid, B_FALSE);
2012 	}
2013 	spa_close(spa, FTAG);
2014 	return (error);
2015 }
2016 
2017 static int
zfs_ioc_vdev_set_state(zfs_cmd_t * zc)2018 zfs_ioc_vdev_set_state(zfs_cmd_t *zc)
2019 {
2020 	spa_t *spa;
2021 	int error;
2022 	vdev_state_t newstate = VDEV_STATE_UNKNOWN;
2023 
2024 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
2025 		return (error);
2026 	switch (zc->zc_cookie) {
2027 	case VDEV_STATE_ONLINE:
2028 		error = vdev_online(spa, zc->zc_guid, zc->zc_obj, &newstate);
2029 		break;
2030 
2031 	case VDEV_STATE_OFFLINE:
2032 		error = vdev_offline(spa, zc->zc_guid, zc->zc_obj);
2033 		break;
2034 
2035 	case VDEV_STATE_FAULTED:
2036 		if (zc->zc_obj != VDEV_AUX_ERR_EXCEEDED &&
2037 		    zc->zc_obj != VDEV_AUX_EXTERNAL)
2038 			zc->zc_obj = VDEV_AUX_ERR_EXCEEDED;
2039 
2040 		error = vdev_fault(spa, zc->zc_guid, zc->zc_obj);
2041 		break;
2042 
2043 	case VDEV_STATE_DEGRADED:
2044 		if (zc->zc_obj != VDEV_AUX_ERR_EXCEEDED &&
2045 		    zc->zc_obj != VDEV_AUX_EXTERNAL)
2046 			zc->zc_obj = VDEV_AUX_ERR_EXCEEDED;
2047 
2048 		error = vdev_degrade(spa, zc->zc_guid, zc->zc_obj);
2049 		break;
2050 
2051 	default:
2052 		error = SET_ERROR(EINVAL);
2053 	}
2054 	zc->zc_cookie = newstate;
2055 	spa_close(spa, FTAG);
2056 	return (error);
2057 }
2058 
2059 static int
zfs_ioc_vdev_attach(zfs_cmd_t * zc)2060 zfs_ioc_vdev_attach(zfs_cmd_t *zc)
2061 {
2062 	spa_t *spa;
2063 	int replacing = zc->zc_cookie;
2064 	nvlist_t *config;
2065 	int error;
2066 
2067 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
2068 		return (error);
2069 
2070 	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
2071 	    zc->zc_iflags, &config)) == 0) {
2072 		error = spa_vdev_attach(spa, zc->zc_guid, config, replacing);
2073 		nvlist_free(config);
2074 	}
2075 
2076 	spa_close(spa, FTAG);
2077 	return (error);
2078 }
2079 
2080 static int
zfs_ioc_vdev_detach(zfs_cmd_t * zc)2081 zfs_ioc_vdev_detach(zfs_cmd_t *zc)
2082 {
2083 	spa_t *spa;
2084 	int error;
2085 
2086 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
2087 		return (error);
2088 
2089 	error = spa_vdev_detach(spa, zc->zc_guid, 0, B_FALSE);
2090 
2091 	spa_close(spa, FTAG);
2092 	return (error);
2093 }
2094 
2095 static int
zfs_ioc_vdev_split(zfs_cmd_t * zc)2096 zfs_ioc_vdev_split(zfs_cmd_t *zc)
2097 {
2098 	spa_t *spa;
2099 	nvlist_t *config, *props = NULL;
2100 	int error;
2101 	boolean_t exp = !!(zc->zc_cookie & ZPOOL_EXPORT_AFTER_SPLIT);
2102 
2103 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
2104 		return (error);
2105 
2106 	if (error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
2107 	    zc->zc_iflags, &config)) {
2108 		spa_close(spa, FTAG);
2109 		return (error);
2110 	}
2111 
2112 	if (zc->zc_nvlist_src_size != 0 && (error =
2113 	    get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2114 	    zc->zc_iflags, &props))) {
2115 		spa_close(spa, FTAG);
2116 		nvlist_free(config);
2117 		return (error);
2118 	}
2119 
2120 	error = spa_vdev_split_mirror(spa, zc->zc_string, config, props, exp);
2121 
2122 	spa_close(spa, FTAG);
2123 
2124 	nvlist_free(config);
2125 	nvlist_free(props);
2126 
2127 	return (error);
2128 }
2129 
2130 static int
zfs_ioc_vdev_setpath(zfs_cmd_t * zc)2131 zfs_ioc_vdev_setpath(zfs_cmd_t *zc)
2132 {
2133 	spa_t *spa;
2134 	char *path = zc->zc_value;
2135 	uint64_t guid = zc->zc_guid;
2136 	int error;
2137 
2138 	error = spa_open(zc->zc_name, &spa, FTAG);
2139 	if (error != 0)
2140 		return (error);
2141 
2142 	error = spa_vdev_setpath(spa, guid, path);
2143 	spa_close(spa, FTAG);
2144 	return (error);
2145 }
2146 
2147 static int
zfs_ioc_vdev_setfru(zfs_cmd_t * zc)2148 zfs_ioc_vdev_setfru(zfs_cmd_t *zc)
2149 {
2150 	spa_t *spa;
2151 	char *fru = zc->zc_value;
2152 	uint64_t guid = zc->zc_guid;
2153 	int error;
2154 
2155 	error = spa_open(zc->zc_name, &spa, FTAG);
2156 	if (error != 0)
2157 		return (error);
2158 
2159 	error = spa_vdev_setfru(spa, guid, fru);
2160 	spa_close(spa, FTAG);
2161 	return (error);
2162 }
2163 
2164 static int
zfs_ioc_objset_stats_impl(zfs_cmd_t * zc,objset_t * os)2165 zfs_ioc_objset_stats_impl(zfs_cmd_t *zc, objset_t *os)
2166 {
2167 	int error = 0;
2168 	nvlist_t *nv;
2169 
2170 	dmu_objset_fast_stat(os, &zc->zc_objset_stats);
2171 
2172 	if (zc->zc_nvlist_dst != 0 &&
2173 	    (error = dsl_prop_get_all(os, &nv)) == 0) {
2174 		dmu_objset_stats(os, nv);
2175 		/*
2176 		 * NB: zvol_get_stats() will read the objset contents,
2177 		 * which we aren't supposed to do with a
2178 		 * DS_MODE_USER hold, because it could be
2179 		 * inconsistent.  So this is a bit of a workaround...
2180 		 * XXX reading with out owning
2181 		 */
2182 		if (!zc->zc_objset_stats.dds_inconsistent &&
2183 		    dmu_objset_type(os) == DMU_OST_ZVOL) {
2184 			error = zvol_get_stats(os, nv);
2185 			if (error == EIO)
2186 				return (error);
2187 			VERIFY0(error);
2188 		}
2189 		error = put_nvlist(zc, nv);
2190 		nvlist_free(nv);
2191 	}
2192 
2193 	return (error);
2194 }
2195 
2196 /*
2197  * inputs:
2198  * zc_name		name of filesystem
2199  * zc_nvlist_dst_size	size of buffer for property nvlist
2200  *
2201  * outputs:
2202  * zc_objset_stats	stats
2203  * zc_nvlist_dst	property nvlist
2204  * zc_nvlist_dst_size	size of property nvlist
2205  */
2206 static int
zfs_ioc_objset_stats(zfs_cmd_t * zc)2207 zfs_ioc_objset_stats(zfs_cmd_t *zc)
2208 {
2209 	objset_t *os;
2210 	int error;
2211 
2212 	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
2213 	if (error == 0) {
2214 		error = zfs_ioc_objset_stats_impl(zc, os);
2215 		dmu_objset_rele(os, FTAG);
2216 	}
2217 
2218 	return (error);
2219 }
2220 
2221 /*
2222  * inputs:
2223  * zc_name		name of filesystem
2224  * zc_nvlist_dst_size	size of buffer for property nvlist
2225  *
2226  * outputs:
2227  * zc_nvlist_dst	received property nvlist
2228  * zc_nvlist_dst_size	size of received property nvlist
2229  *
2230  * Gets received properties (distinct from local properties on or after
2231  * SPA_VERSION_RECVD_PROPS) for callers who want to differentiate received from
2232  * local property values.
2233  */
2234 static int
zfs_ioc_objset_recvd_props(zfs_cmd_t * zc)2235 zfs_ioc_objset_recvd_props(zfs_cmd_t *zc)
2236 {
2237 	int error = 0;
2238 	nvlist_t *nv;
2239 
2240 	/*
2241 	 * Without this check, we would return local property values if the
2242 	 * caller has not already received properties on or after
2243 	 * SPA_VERSION_RECVD_PROPS.
2244 	 */
2245 	if (!dsl_prop_get_hasrecvd(zc->zc_name))
2246 		return (SET_ERROR(ENOTSUP));
2247 
2248 	if (zc->zc_nvlist_dst != 0 &&
2249 	    (error = dsl_prop_get_received(zc->zc_name, &nv)) == 0) {
2250 		error = put_nvlist(zc, nv);
2251 		nvlist_free(nv);
2252 	}
2253 
2254 	return (error);
2255 }
2256 
2257 static int
nvl_add_zplprop(objset_t * os,nvlist_t * props,zfs_prop_t prop)2258 nvl_add_zplprop(objset_t *os, nvlist_t *props, zfs_prop_t prop)
2259 {
2260 	uint64_t value;
2261 	int error;
2262 
2263 	/*
2264 	 * zfs_get_zplprop() will either find a value or give us
2265 	 * the default value (if there is one).
2266 	 */
2267 	if ((error = zfs_get_zplprop(os, prop, &value)) != 0)
2268 		return (error);
2269 	VERIFY(nvlist_add_uint64(props, zfs_prop_to_name(prop), value) == 0);
2270 	return (0);
2271 }
2272 
2273 /*
2274  * inputs:
2275  * zc_name		name of filesystem
2276  * zc_nvlist_dst_size	size of buffer for zpl property nvlist
2277  *
2278  * outputs:
2279  * zc_nvlist_dst	zpl property nvlist
2280  * zc_nvlist_dst_size	size of zpl property nvlist
2281  */
2282 static int
zfs_ioc_objset_zplprops(zfs_cmd_t * zc)2283 zfs_ioc_objset_zplprops(zfs_cmd_t *zc)
2284 {
2285 	objset_t *os;
2286 	int err;
2287 
2288 	/* XXX reading without owning */
2289 	if (err = dmu_objset_hold(zc->zc_name, FTAG, &os))
2290 		return (err);
2291 
2292 	dmu_objset_fast_stat(os, &zc->zc_objset_stats);
2293 
2294 	/*
2295 	 * NB: nvl_add_zplprop() will read the objset contents,
2296 	 * which we aren't supposed to do with a DS_MODE_USER
2297 	 * hold, because it could be inconsistent.
2298 	 */
2299 	if (zc->zc_nvlist_dst != 0 &&
2300 	    !zc->zc_objset_stats.dds_inconsistent &&
2301 	    dmu_objset_type(os) == DMU_OST_ZFS) {
2302 		nvlist_t *nv;
2303 
2304 		VERIFY(nvlist_alloc(&nv, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2305 		if ((err = nvl_add_zplprop(os, nv, ZFS_PROP_VERSION)) == 0 &&
2306 		    (err = nvl_add_zplprop(os, nv, ZFS_PROP_NORMALIZE)) == 0 &&
2307 		    (err = nvl_add_zplprop(os, nv, ZFS_PROP_UTF8ONLY)) == 0 &&
2308 		    (err = nvl_add_zplprop(os, nv, ZFS_PROP_CASE)) == 0)
2309 			err = put_nvlist(zc, nv);
2310 		nvlist_free(nv);
2311 	} else {
2312 		err = SET_ERROR(ENOENT);
2313 	}
2314 	dmu_objset_rele(os, FTAG);
2315 	return (err);
2316 }
2317 
2318 static boolean_t
dataset_name_hidden(const char * name)2319 dataset_name_hidden(const char *name)
2320 {
2321 	/*
2322 	 * Skip over datasets that are not visible in this zone,
2323 	 * internal datasets (which have a $ in their name), and
2324 	 * temporary datasets (which have a % in their name).
2325 	 */
2326 	if (strchr(name, '$') != NULL)
2327 		return (B_TRUE);
2328 	if (strchr(name, '%') != NULL)
2329 		return (B_TRUE);
2330 	if (!INGLOBALZONE(curproc) && !zone_dataset_visible(name, NULL))
2331 		return (B_TRUE);
2332 	return (B_FALSE);
2333 }
2334 
2335 /*
2336  * inputs:
2337  * zc_name		name of filesystem
2338  * zc_cookie		zap cursor
2339  * zc_nvlist_dst_size	size of buffer for property nvlist
2340  *
2341  * outputs:
2342  * zc_name		name of next filesystem
2343  * zc_cookie		zap cursor
2344  * zc_objset_stats	stats
2345  * zc_nvlist_dst	property nvlist
2346  * zc_nvlist_dst_size	size of property nvlist
2347  */
2348 static int
zfs_ioc_dataset_list_next(zfs_cmd_t * zc)2349 zfs_ioc_dataset_list_next(zfs_cmd_t *zc)
2350 {
2351 	objset_t *os;
2352 	int error;
2353 	char *p;
2354 	size_t orig_len = strlen(zc->zc_name);
2355 
2356 top:
2357 	if (error = dmu_objset_hold(zc->zc_name, FTAG, &os)) {
2358 		if (error == ENOENT)
2359 			error = SET_ERROR(ESRCH);
2360 		return (error);
2361 	}
2362 
2363 	p = strrchr(zc->zc_name, '/');
2364 	if (p == NULL || p[1] != '\0')
2365 		(void) strlcat(zc->zc_name, "/", sizeof (zc->zc_name));
2366 	p = zc->zc_name + strlen(zc->zc_name);
2367 
2368 	do {
2369 		error = dmu_dir_list_next(os,
2370 		    sizeof (zc->zc_name) - (p - zc->zc_name), p,
2371 		    NULL, &zc->zc_cookie);
2372 		if (error == ENOENT)
2373 			error = SET_ERROR(ESRCH);
2374 	} while (error == 0 && dataset_name_hidden(zc->zc_name));
2375 	dmu_objset_rele(os, FTAG);
2376 
2377 	/*
2378 	 * If it's an internal dataset (ie. with a '$' in its name),
2379 	 * don't try to get stats for it, otherwise we'll return ENOENT.
2380 	 */
2381 	if (error == 0 && strchr(zc->zc_name, '$') == NULL) {
2382 		error = zfs_ioc_objset_stats(zc); /* fill in the stats */
2383 		if (error == ENOENT) {
2384 			/* We lost a race with destroy, get the next one. */
2385 			zc->zc_name[orig_len] = '\0';
2386 			goto top;
2387 		}
2388 	}
2389 	return (error);
2390 }
2391 
2392 /*
2393  * inputs:
2394  * zc_name		name of filesystem
2395  * zc_cookie		zap cursor
2396  * zc_nvlist_dst_size	size of buffer for property nvlist
2397  * zc_simple		when set, only name is requested
2398  *
2399  * outputs:
2400  * zc_name		name of next snapshot
2401  * zc_objset_stats	stats
2402  * zc_nvlist_dst	property nvlist
2403  * zc_nvlist_dst_size	size of property nvlist
2404  */
2405 static int
zfs_ioc_snapshot_list_next(zfs_cmd_t * zc)2406 zfs_ioc_snapshot_list_next(zfs_cmd_t *zc)
2407 {
2408 	objset_t *os;
2409 	int error;
2410 
2411 	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
2412 	if (error != 0) {
2413 		return (error == ENOENT ? ESRCH : error);
2414 	}
2415 
2416 	/*
2417 	 * A dataset name of maximum length cannot have any snapshots,
2418 	 * so exit immediately.
2419 	 */
2420 	if (strlcat(zc->zc_name, "@", sizeof (zc->zc_name)) >=
2421 	    ZFS_MAX_DATASET_NAME_LEN) {
2422 		dmu_objset_rele(os, FTAG);
2423 		return (SET_ERROR(ESRCH));
2424 	}
2425 
2426 	error = dmu_snapshot_list_next(os,
2427 	    sizeof (zc->zc_name) - strlen(zc->zc_name),
2428 	    zc->zc_name + strlen(zc->zc_name), &zc->zc_obj, &zc->zc_cookie,
2429 	    NULL);
2430 
2431 	if (error == 0 && !zc->zc_simple) {
2432 		dsl_dataset_t *ds;
2433 		dsl_pool_t *dp = os->os_dsl_dataset->ds_dir->dd_pool;
2434 
2435 		error = dsl_dataset_hold_obj(dp, zc->zc_obj, FTAG, &ds);
2436 		if (error == 0) {
2437 			objset_t *ossnap;
2438 
2439 			error = dmu_objset_from_ds(ds, &ossnap);
2440 			if (error == 0)
2441 				error = zfs_ioc_objset_stats_impl(zc, ossnap);
2442 			dsl_dataset_rele(ds, FTAG);
2443 		}
2444 	} else if (error == ENOENT) {
2445 		error = SET_ERROR(ESRCH);
2446 	}
2447 
2448 	dmu_objset_rele(os, FTAG);
2449 	/* if we failed, undo the @ that we tacked on to zc_name */
2450 	if (error != 0)
2451 		*strchr(zc->zc_name, '@') = '\0';
2452 	return (error);
2453 }
2454 
2455 static int
zfs_prop_set_userquota(const char * dsname,nvpair_t * pair)2456 zfs_prop_set_userquota(const char *dsname, nvpair_t *pair)
2457 {
2458 	const char *propname = nvpair_name(pair);
2459 	uint64_t *valary;
2460 	unsigned int vallen;
2461 	const char *domain;
2462 	char *dash;
2463 	zfs_userquota_prop_t type;
2464 	uint64_t rid;
2465 	uint64_t quota;
2466 	zfsvfs_t *zfsvfs;
2467 	int err;
2468 
2469 	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2470 		nvlist_t *attrs;
2471 		VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
2472 		if (nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2473 		    &pair) != 0)
2474 			return (SET_ERROR(EINVAL));
2475 	}
2476 
2477 	/*
2478 	 * A correctly constructed propname is encoded as
2479 	 * userquota@<rid>-<domain>.
2480 	 */
2481 	if ((dash = strchr(propname, '-')) == NULL ||
2482 	    nvpair_value_uint64_array(pair, &valary, &vallen) != 0 ||
2483 	    vallen != 3)
2484 		return (SET_ERROR(EINVAL));
2485 
2486 	domain = dash + 1;
2487 	type = valary[0];
2488 	rid = valary[1];
2489 	quota = valary[2];
2490 
2491 	err = zfsvfs_hold(dsname, FTAG, &zfsvfs, B_FALSE);
2492 	if (err == 0) {
2493 		err = zfs_set_userquota(zfsvfs, type, domain, rid, quota);
2494 		zfsvfs_rele(zfsvfs, FTAG);
2495 	}
2496 
2497 	return (err);
2498 }
2499 
2500 /*
2501  * If the named property is one that has a special function to set its value,
2502  * return 0 on success and a positive error code on failure; otherwise if it is
2503  * not one of the special properties handled by this function, return -1.
2504  *
2505  * XXX: It would be better for callers of the property interface if we handled
2506  * these special cases in dsl_prop.c (in the dsl layer).
2507  */
2508 static int
zfs_prop_set_special(const char * dsname,zprop_source_t source,nvpair_t * pair)2509 zfs_prop_set_special(const char *dsname, zprop_source_t source,
2510     nvpair_t *pair)
2511 {
2512 	const char *propname = nvpair_name(pair);
2513 	zfs_prop_t prop = zfs_name_to_prop(propname);
2514 	uint64_t intval = 0;
2515 	char *strval = NULL;
2516 	int err = -1;
2517 
2518 	if (prop == ZPROP_INVAL) {
2519 		if (zfs_prop_userquota(propname))
2520 			return (zfs_prop_set_userquota(dsname, pair));
2521 		return (-1);
2522 	}
2523 
2524 	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2525 		nvlist_t *attrs;
2526 		VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
2527 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2528 		    &pair) == 0);
2529 	}
2530 
2531 	/* all special properties are numeric except for keylocation */
2532 	if (zfs_prop_get_type(prop) == PROP_TYPE_STRING) {
2533 		strval = fnvpair_value_string(pair);
2534 	} else {
2535 		intval = fnvpair_value_uint64(pair);
2536 	}
2537 
2538 	switch (prop) {
2539 	case ZFS_PROP_QUOTA:
2540 		err = dsl_dir_set_quota(dsname, source, intval);
2541 		break;
2542 	case ZFS_PROP_REFQUOTA:
2543 		err = dsl_dataset_set_refquota(dsname, source, intval);
2544 		break;
2545 	case ZFS_PROP_FILESYSTEM_LIMIT:
2546 	case ZFS_PROP_SNAPSHOT_LIMIT:
2547 		if (intval == UINT64_MAX) {
2548 			/* clearing the limit, just do it */
2549 			err = 0;
2550 		} else {
2551 			err = dsl_dir_activate_fs_ss_limit(dsname);
2552 		}
2553 		/*
2554 		 * Set err to -1 to force the zfs_set_prop_nvlist code down the
2555 		 * default path to set the value in the nvlist.
2556 		 */
2557 		if (err == 0)
2558 			err = -1;
2559 		break;
2560 	case ZFS_PROP_KEYLOCATION:
2561 		err = dsl_crypto_can_set_keylocation(dsname, strval);
2562 
2563 		/*
2564 		 * Set err to -1 to force the zfs_set_prop_nvlist code down the
2565 		 * default path to set the value in the nvlist.
2566 		 */
2567 		if (err == 0)
2568 			err = -1;
2569 		break;
2570 	case ZFS_PROP_RESERVATION:
2571 		err = dsl_dir_set_reservation(dsname, source, intval);
2572 		break;
2573 	case ZFS_PROP_REFRESERVATION:
2574 		err = dsl_dataset_set_refreservation(dsname, source, intval);
2575 		break;
2576 	case ZFS_PROP_VOLSIZE:
2577 		err = zvol_set_volsize(dsname, intval);
2578 		break;
2579 	case ZFS_PROP_VERSION:
2580 	{
2581 		zfsvfs_t *zfsvfs;
2582 
2583 		if ((err = zfsvfs_hold(dsname, FTAG, &zfsvfs, B_TRUE)) != 0)
2584 			break;
2585 
2586 		err = zfs_set_version(zfsvfs, intval);
2587 		zfsvfs_rele(zfsvfs, FTAG);
2588 
2589 		if (err == 0 && intval >= ZPL_VERSION_USERSPACE) {
2590 			zfs_cmd_t *zc;
2591 
2592 			zc = kmem_zalloc(sizeof (zfs_cmd_t), KM_SLEEP);
2593 			(void) strcpy(zc->zc_name, dsname);
2594 			(void) zfs_ioc_userspace_upgrade(zc);
2595 			(void) zfs_ioc_id_quota_upgrade(zc);
2596 			kmem_free(zc, sizeof (zfs_cmd_t));
2597 		}
2598 		break;
2599 	}
2600 	default:
2601 		err = -1;
2602 	}
2603 
2604 	return (err);
2605 }
2606 
2607 /*
2608  * This function is best effort. If it fails to set any of the given properties,
2609  * it continues to set as many as it can and returns the last error
2610  * encountered. If the caller provides a non-NULL errlist, it will be filled in
2611  * with the list of names of all the properties that failed along with the
2612  * corresponding error numbers.
2613  *
2614  * If every property is set successfully, zero is returned and errlist is not
2615  * modified.
2616  */
2617 int
zfs_set_prop_nvlist(const char * dsname,zprop_source_t source,nvlist_t * nvl,nvlist_t * errlist)2618 zfs_set_prop_nvlist(const char *dsname, zprop_source_t source, nvlist_t *nvl,
2619     nvlist_t *errlist)
2620 {
2621 	nvpair_t *pair;
2622 	nvpair_t *propval;
2623 	int rv = 0;
2624 	uint64_t intval;
2625 	char *strval;
2626 	nvlist_t *genericnvl = fnvlist_alloc();
2627 	nvlist_t *retrynvl = fnvlist_alloc();
2628 
2629 retry:
2630 	pair = NULL;
2631 	while ((pair = nvlist_next_nvpair(nvl, pair)) != NULL) {
2632 		const char *propname = nvpair_name(pair);
2633 		zfs_prop_t prop = zfs_name_to_prop(propname);
2634 		int err = 0;
2635 
2636 		/* decode the property value */
2637 		propval = pair;
2638 		if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2639 			nvlist_t *attrs;
2640 			attrs = fnvpair_value_nvlist(pair);
2641 			if (nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2642 			    &propval) != 0)
2643 				err = SET_ERROR(EINVAL);
2644 		}
2645 
2646 		/* Validate value type */
2647 		if (err == 0 && source == ZPROP_SRC_INHERITED) {
2648 			/* inherited properties are expected to be booleans */
2649 			if (nvpair_type(propval) != DATA_TYPE_BOOLEAN)
2650 				err = SET_ERROR(EINVAL);
2651 		} else if (err == 0 && prop == ZPROP_INVAL) {
2652 			if (zfs_prop_user(propname)) {
2653 				if (nvpair_type(propval) != DATA_TYPE_STRING)
2654 					err = SET_ERROR(EINVAL);
2655 			} else if (zfs_prop_userquota(propname)) {
2656 				if (nvpair_type(propval) !=
2657 				    DATA_TYPE_UINT64_ARRAY)
2658 					err = SET_ERROR(EINVAL);
2659 			} else {
2660 				err = SET_ERROR(EINVAL);
2661 			}
2662 		} else if (err == 0) {
2663 			if (nvpair_type(propval) == DATA_TYPE_STRING) {
2664 				if (zfs_prop_get_type(prop) != PROP_TYPE_STRING)
2665 					err = SET_ERROR(EINVAL);
2666 			} else if (nvpair_type(propval) == DATA_TYPE_UINT64) {
2667 				const char *unused;
2668 
2669 				intval = fnvpair_value_uint64(propval);
2670 
2671 				switch (zfs_prop_get_type(prop)) {
2672 				case PROP_TYPE_NUMBER:
2673 					break;
2674 				case PROP_TYPE_STRING:
2675 					err = SET_ERROR(EINVAL);
2676 					break;
2677 				case PROP_TYPE_INDEX:
2678 					if (zfs_prop_index_to_string(prop,
2679 					    intval, &unused) != 0)
2680 						err = SET_ERROR(EINVAL);
2681 					break;
2682 				default:
2683 					cmn_err(CE_PANIC,
2684 					    "unknown property type");
2685 				}
2686 			} else {
2687 				err = SET_ERROR(EINVAL);
2688 			}
2689 		}
2690 
2691 		/* Validate permissions */
2692 		if (err == 0)
2693 			err = zfs_check_settable(dsname, pair, CRED());
2694 
2695 		if (err == 0) {
2696 			if (source == ZPROP_SRC_INHERITED)
2697 				err = -1; /* does not need special handling */
2698 			else
2699 				err = zfs_prop_set_special(dsname, source,
2700 				    pair);
2701 			if (err == -1) {
2702 				/*
2703 				 * For better performance we build up a list of
2704 				 * properties to set in a single transaction.
2705 				 */
2706 				err = nvlist_add_nvpair(genericnvl, pair);
2707 			} else if (err != 0 && nvl != retrynvl) {
2708 				/*
2709 				 * This may be a spurious error caused by
2710 				 * receiving quota and reservation out of order.
2711 				 * Try again in a second pass.
2712 				 */
2713 				err = nvlist_add_nvpair(retrynvl, pair);
2714 			}
2715 		}
2716 
2717 		if (err != 0) {
2718 			if (errlist != NULL)
2719 				fnvlist_add_int32(errlist, propname, err);
2720 			rv = err;
2721 		}
2722 	}
2723 
2724 	if (nvl != retrynvl && !nvlist_empty(retrynvl)) {
2725 		nvl = retrynvl;
2726 		goto retry;
2727 	}
2728 
2729 	if (!nvlist_empty(genericnvl) &&
2730 	    dsl_props_set(dsname, source, genericnvl) != 0) {
2731 		/*
2732 		 * If this fails, we still want to set as many properties as we
2733 		 * can, so try setting them individually.
2734 		 */
2735 		pair = NULL;
2736 		while ((pair = nvlist_next_nvpair(genericnvl, pair)) != NULL) {
2737 			const char *propname = nvpair_name(pair);
2738 			int err = 0;
2739 
2740 			propval = pair;
2741 			if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2742 				nvlist_t *attrs;
2743 				attrs = fnvpair_value_nvlist(pair);
2744 				propval = fnvlist_lookup_nvpair(attrs,
2745 				    ZPROP_VALUE);
2746 			}
2747 
2748 			if (nvpair_type(propval) == DATA_TYPE_STRING) {
2749 				strval = fnvpair_value_string(propval);
2750 				err = dsl_prop_set_string(dsname, propname,
2751 				    source, strval);
2752 			} else if (nvpair_type(propval) == DATA_TYPE_BOOLEAN) {
2753 				err = dsl_prop_inherit(dsname, propname,
2754 				    source);
2755 			} else {
2756 				intval = fnvpair_value_uint64(propval);
2757 				err = dsl_prop_set_int(dsname, propname, source,
2758 				    intval);
2759 			}
2760 
2761 			if (err != 0) {
2762 				if (errlist != NULL) {
2763 					fnvlist_add_int32(errlist, propname,
2764 					    err);
2765 				}
2766 				rv = err;
2767 			}
2768 		}
2769 	}
2770 	nvlist_free(genericnvl);
2771 	nvlist_free(retrynvl);
2772 
2773 	return (rv);
2774 }
2775 
2776 /*
2777  * Check that all the properties are valid user properties.
2778  */
2779 static int
zfs_check_userprops(const char * fsname,nvlist_t * nvl)2780 zfs_check_userprops(const char *fsname, nvlist_t *nvl)
2781 {
2782 	nvpair_t *pair = NULL;
2783 	int error = 0;
2784 
2785 	while ((pair = nvlist_next_nvpair(nvl, pair)) != NULL) {
2786 		const char *propname = nvpair_name(pair);
2787 
2788 		if (!zfs_prop_user(propname) ||
2789 		    nvpair_type(pair) != DATA_TYPE_STRING)
2790 			return (SET_ERROR(EINVAL));
2791 
2792 		if (error = zfs_secpolicy_write_perms(fsname,
2793 		    ZFS_DELEG_PERM_USERPROP, CRED()))
2794 			return (error);
2795 
2796 		if (strlen(propname) >= ZAP_MAXNAMELEN)
2797 			return (SET_ERROR(ENAMETOOLONG));
2798 
2799 		if (strlen(fnvpair_value_string(pair)) >= ZAP_MAXVALUELEN)
2800 			return (E2BIG);
2801 	}
2802 	return (0);
2803 }
2804 
2805 static void
props_skip(nvlist_t * props,nvlist_t * skipped,nvlist_t ** newprops)2806 props_skip(nvlist_t *props, nvlist_t *skipped, nvlist_t **newprops)
2807 {
2808 	nvpair_t *pair;
2809 
2810 	VERIFY(nvlist_alloc(newprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2811 
2812 	pair = NULL;
2813 	while ((pair = nvlist_next_nvpair(props, pair)) != NULL) {
2814 		if (nvlist_exists(skipped, nvpair_name(pair)))
2815 			continue;
2816 
2817 		VERIFY(nvlist_add_nvpair(*newprops, pair) == 0);
2818 	}
2819 }
2820 
2821 static int
clear_received_props(const char * dsname,nvlist_t * props,nvlist_t * skipped)2822 clear_received_props(const char *dsname, nvlist_t *props,
2823     nvlist_t *skipped)
2824 {
2825 	int err = 0;
2826 	nvlist_t *cleared_props = NULL;
2827 	props_skip(props, skipped, &cleared_props);
2828 	if (!nvlist_empty(cleared_props)) {
2829 		/*
2830 		 * Acts on local properties until the dataset has received
2831 		 * properties at least once on or after SPA_VERSION_RECVD_PROPS.
2832 		 */
2833 		zprop_source_t flags = (ZPROP_SRC_NONE |
2834 		    (dsl_prop_get_hasrecvd(dsname) ? ZPROP_SRC_RECEIVED : 0));
2835 		err = zfs_set_prop_nvlist(dsname, flags, cleared_props, NULL);
2836 	}
2837 	nvlist_free(cleared_props);
2838 	return (err);
2839 }
2840 
2841 /*
2842  * inputs:
2843  * zc_name		name of filesystem
2844  * zc_value		name of property to set
2845  * zc_nvlist_src{_size}	nvlist of properties to apply
2846  * zc_cookie		received properties flag
2847  *
2848  * outputs:
2849  * zc_nvlist_dst{_size} error for each unapplied received property
2850  */
2851 static int
zfs_ioc_set_prop(zfs_cmd_t * zc)2852 zfs_ioc_set_prop(zfs_cmd_t *zc)
2853 {
2854 	nvlist_t *nvl;
2855 	boolean_t received = zc->zc_cookie;
2856 	zprop_source_t source = (received ? ZPROP_SRC_RECEIVED :
2857 	    ZPROP_SRC_LOCAL);
2858 	nvlist_t *errors;
2859 	int error;
2860 
2861 	if ((error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2862 	    zc->zc_iflags, &nvl)) != 0)
2863 		return (error);
2864 
2865 	if (received) {
2866 		nvlist_t *origprops;
2867 
2868 		if (dsl_prop_get_received(zc->zc_name, &origprops) == 0) {
2869 			(void) clear_received_props(zc->zc_name,
2870 			    origprops, nvl);
2871 			nvlist_free(origprops);
2872 		}
2873 
2874 		error = dsl_prop_set_hasrecvd(zc->zc_name);
2875 	}
2876 
2877 	errors = fnvlist_alloc();
2878 	if (error == 0)
2879 		error = zfs_set_prop_nvlist(zc->zc_name, source, nvl, errors);
2880 
2881 	if (zc->zc_nvlist_dst != 0 && errors != NULL) {
2882 		(void) put_nvlist(zc, errors);
2883 	}
2884 
2885 	nvlist_free(errors);
2886 	nvlist_free(nvl);
2887 	return (error);
2888 }
2889 
2890 /*
2891  * inputs:
2892  * zc_name		name of filesystem
2893  * zc_value		name of property to inherit
2894  * zc_cookie		revert to received value if TRUE
2895  *
2896  * outputs:		none
2897  */
2898 static int
zfs_ioc_inherit_prop(zfs_cmd_t * zc)2899 zfs_ioc_inherit_prop(zfs_cmd_t *zc)
2900 {
2901 	const char *propname = zc->zc_value;
2902 	zfs_prop_t prop = zfs_name_to_prop(propname);
2903 	boolean_t received = zc->zc_cookie;
2904 	zprop_source_t source = (received
2905 	    ? ZPROP_SRC_NONE		/* revert to received value, if any */
2906 	    : ZPROP_SRC_INHERITED);	/* explicitly inherit */
2907 
2908 	if (received) {
2909 		nvlist_t *dummy;
2910 		nvpair_t *pair;
2911 		zprop_type_t type;
2912 		int err;
2913 
2914 		/*
2915 		 * zfs_prop_set_special() expects properties in the form of an
2916 		 * nvpair with type info.
2917 		 */
2918 		if (prop == ZPROP_INVAL) {
2919 			if (!zfs_prop_user(propname))
2920 				return (SET_ERROR(EINVAL));
2921 
2922 			type = PROP_TYPE_STRING;
2923 		} else if (prop == ZFS_PROP_VOLSIZE ||
2924 		    prop == ZFS_PROP_VERSION) {
2925 			return (SET_ERROR(EINVAL));
2926 		} else {
2927 			type = zfs_prop_get_type(prop);
2928 		}
2929 
2930 		VERIFY(nvlist_alloc(&dummy, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2931 
2932 		switch (type) {
2933 		case PROP_TYPE_STRING:
2934 			VERIFY(0 == nvlist_add_string(dummy, propname, ""));
2935 			break;
2936 		case PROP_TYPE_NUMBER:
2937 		case PROP_TYPE_INDEX:
2938 			VERIFY(0 == nvlist_add_uint64(dummy, propname, 0));
2939 			break;
2940 		default:
2941 			nvlist_free(dummy);
2942 			return (SET_ERROR(EINVAL));
2943 		}
2944 
2945 		pair = nvlist_next_nvpair(dummy, NULL);
2946 		err = zfs_prop_set_special(zc->zc_name, source, pair);
2947 		nvlist_free(dummy);
2948 		if (err != -1)
2949 			return (err); /* special property already handled */
2950 	} else {
2951 		/*
2952 		 * Only check this in the non-received case. We want to allow
2953 		 * 'inherit -S' to revert non-inheritable properties like quota
2954 		 * and reservation to the received or default values even though
2955 		 * they are not considered inheritable.
2956 		 */
2957 		if (prop != ZPROP_INVAL && !zfs_prop_inheritable(prop))
2958 			return (SET_ERROR(EINVAL));
2959 	}
2960 
2961 	/* property name has been validated by zfs_secpolicy_inherit_prop() */
2962 	return (dsl_prop_inherit(zc->zc_name, zc->zc_value, source));
2963 }
2964 
2965 static int
zfs_ioc_pool_set_props(zfs_cmd_t * zc)2966 zfs_ioc_pool_set_props(zfs_cmd_t *zc)
2967 {
2968 	nvlist_t *props;
2969 	spa_t *spa;
2970 	int error;
2971 	nvpair_t *pair;
2972 
2973 	if (error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2974 	    zc->zc_iflags, &props))
2975 		return (error);
2976 
2977 	/*
2978 	 * If the only property is the configfile, then just do a spa_lookup()
2979 	 * to handle the faulted case.
2980 	 */
2981 	pair = nvlist_next_nvpair(props, NULL);
2982 	if (pair != NULL && strcmp(nvpair_name(pair),
2983 	    zpool_prop_to_name(ZPOOL_PROP_CACHEFILE)) == 0 &&
2984 	    nvlist_next_nvpair(props, pair) == NULL) {
2985 		mutex_enter(&spa_namespace_lock);
2986 		if ((spa = spa_lookup(zc->zc_name)) != NULL) {
2987 			spa_configfile_set(spa, props, B_FALSE);
2988 			spa_write_cachefile(spa, B_FALSE, B_TRUE);
2989 		}
2990 		mutex_exit(&spa_namespace_lock);
2991 		if (spa != NULL) {
2992 			nvlist_free(props);
2993 			return (0);
2994 		}
2995 	}
2996 
2997 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0) {
2998 		nvlist_free(props);
2999 		return (error);
3000 	}
3001 
3002 	error = spa_prop_set(spa, props);
3003 
3004 	nvlist_free(props);
3005 	spa_close(spa, FTAG);
3006 
3007 	return (error);
3008 }
3009 
3010 static int
zfs_ioc_pool_get_props(zfs_cmd_t * zc)3011 zfs_ioc_pool_get_props(zfs_cmd_t *zc)
3012 {
3013 	spa_t *spa;
3014 	int error;
3015 	nvlist_t *nvp = NULL;
3016 
3017 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0) {
3018 		/*
3019 		 * If the pool is faulted, there may be properties we can still
3020 		 * get (such as altroot and cachefile), so attempt to get them
3021 		 * anyway.
3022 		 */
3023 		mutex_enter(&spa_namespace_lock);
3024 		if ((spa = spa_lookup(zc->zc_name)) != NULL)
3025 			error = spa_prop_get(spa, &nvp);
3026 		mutex_exit(&spa_namespace_lock);
3027 	} else {
3028 		error = spa_prop_get(spa, &nvp);
3029 		spa_close(spa, FTAG);
3030 	}
3031 
3032 	if (error == 0 && zc->zc_nvlist_dst != 0)
3033 		error = put_nvlist(zc, nvp);
3034 	else
3035 		error = SET_ERROR(EFAULT);
3036 
3037 	nvlist_free(nvp);
3038 	return (error);
3039 }
3040 
3041 /*
3042  * inputs:
3043  * zc_name		name of filesystem
3044  * zc_nvlist_src{_size}	nvlist of delegated permissions
3045  * zc_perm_action	allow/unallow flag
3046  *
3047  * outputs:		none
3048  */
3049 static int
zfs_ioc_set_fsacl(zfs_cmd_t * zc)3050 zfs_ioc_set_fsacl(zfs_cmd_t *zc)
3051 {
3052 	int error;
3053 	nvlist_t *fsaclnv = NULL;
3054 
3055 	if ((error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
3056 	    zc->zc_iflags, &fsaclnv)) != 0)
3057 		return (error);
3058 
3059 	/*
3060 	 * Verify nvlist is constructed correctly
3061 	 */
3062 	if ((error = zfs_deleg_verify_nvlist(fsaclnv)) != 0) {
3063 		nvlist_free(fsaclnv);
3064 		return (SET_ERROR(EINVAL));
3065 	}
3066 
3067 	/*
3068 	 * If we don't have PRIV_SYS_MOUNT, then validate
3069 	 * that user is allowed to hand out each permission in
3070 	 * the nvlist(s)
3071 	 */
3072 
3073 	error = secpolicy_zfs(CRED());
3074 	if (error != 0) {
3075 		if (zc->zc_perm_action == B_FALSE) {
3076 			error = dsl_deleg_can_allow(zc->zc_name,
3077 			    fsaclnv, CRED());
3078 		} else {
3079 			error = dsl_deleg_can_unallow(zc->zc_name,
3080 			    fsaclnv, CRED());
3081 		}
3082 	}
3083 
3084 	if (error == 0)
3085 		error = dsl_deleg_set(zc->zc_name, fsaclnv, zc->zc_perm_action);
3086 
3087 	nvlist_free(fsaclnv);
3088 	return (error);
3089 }
3090 
3091 /*
3092  * inputs:
3093  * zc_name		name of filesystem
3094  *
3095  * outputs:
3096  * zc_nvlist_src{_size}	nvlist of delegated permissions
3097  */
3098 static int
zfs_ioc_get_fsacl(zfs_cmd_t * zc)3099 zfs_ioc_get_fsacl(zfs_cmd_t *zc)
3100 {
3101 	nvlist_t *nvp;
3102 	int error;
3103 
3104 	if ((error = dsl_deleg_get(zc->zc_name, &nvp)) == 0) {
3105 		error = put_nvlist(zc, nvp);
3106 		nvlist_free(nvp);
3107 	}
3108 
3109 	return (error);
3110 }
3111 
3112 /* ARGSUSED */
3113 static void
zfs_create_cb(objset_t * os,void * arg,cred_t * cr,dmu_tx_t * tx)3114 zfs_create_cb(objset_t *os, void *arg, cred_t *cr, dmu_tx_t *tx)
3115 {
3116 	zfs_creat_t *zct = arg;
3117 
3118 	zfs_create_fs(os, cr, zct->zct_zplprops, tx);
3119 }
3120 
3121 #define	ZFS_PROP_UNDEFINED	((uint64_t)-1)
3122 
3123 /*
3124  * inputs:
3125  * os			parent objset pointer (NULL if root fs)
3126  * fuids_ok		fuids allowed in this version of the spa?
3127  * sa_ok		SAs allowed in this version of the spa?
3128  * createprops		list of properties requested by creator
3129  *
3130  * outputs:
3131  * zplprops	values for the zplprops we attach to the master node object
3132  * is_ci	true if requested file system will be purely case-insensitive
3133  *
3134  * Determine the settings for utf8only, normalization and
3135  * casesensitivity.  Specific values may have been requested by the
3136  * creator and/or we can inherit values from the parent dataset.  If
3137  * the file system is of too early a vintage, a creator can not
3138  * request settings for these properties, even if the requested
3139  * setting is the default value.  We don't actually want to create dsl
3140  * properties for these, so remove them from the source nvlist after
3141  * processing.
3142  */
3143 static int
zfs_fill_zplprops_impl(objset_t * os,uint64_t zplver,boolean_t fuids_ok,boolean_t sa_ok,nvlist_t * createprops,nvlist_t * zplprops,boolean_t * is_ci)3144 zfs_fill_zplprops_impl(objset_t *os, uint64_t zplver,
3145     boolean_t fuids_ok, boolean_t sa_ok, nvlist_t *createprops,
3146     nvlist_t *zplprops, boolean_t *is_ci)
3147 {
3148 	uint64_t sense = ZFS_PROP_UNDEFINED;
3149 	uint64_t norm = ZFS_PROP_UNDEFINED;
3150 	uint64_t u8 = ZFS_PROP_UNDEFINED;
3151 
3152 	ASSERT(zplprops != NULL);
3153 
3154 	if (os != NULL && os->os_phys->os_type != DMU_OST_ZFS)
3155 		return (SET_ERROR(EINVAL));
3156 
3157 	/*
3158 	 * Pull out creator prop choices, if any.
3159 	 */
3160 	if (createprops) {
3161 		(void) nvlist_lookup_uint64(createprops,
3162 		    zfs_prop_to_name(ZFS_PROP_VERSION), &zplver);
3163 		(void) nvlist_lookup_uint64(createprops,
3164 		    zfs_prop_to_name(ZFS_PROP_NORMALIZE), &norm);
3165 		(void) nvlist_remove_all(createprops,
3166 		    zfs_prop_to_name(ZFS_PROP_NORMALIZE));
3167 		(void) nvlist_lookup_uint64(createprops,
3168 		    zfs_prop_to_name(ZFS_PROP_UTF8ONLY), &u8);
3169 		(void) nvlist_remove_all(createprops,
3170 		    zfs_prop_to_name(ZFS_PROP_UTF8ONLY));
3171 		(void) nvlist_lookup_uint64(createprops,
3172 		    zfs_prop_to_name(ZFS_PROP_CASE), &sense);
3173 		(void) nvlist_remove_all(createprops,
3174 		    zfs_prop_to_name(ZFS_PROP_CASE));
3175 	}
3176 
3177 	/*
3178 	 * If the zpl version requested is whacky or the file system
3179 	 * or pool is version is too "young" to support normalization
3180 	 * and the creator tried to set a value for one of the props,
3181 	 * error out.
3182 	 */
3183 	if ((zplver < ZPL_VERSION_INITIAL || zplver > ZPL_VERSION) ||
3184 	    (zplver >= ZPL_VERSION_FUID && !fuids_ok) ||
3185 	    (zplver >= ZPL_VERSION_SA && !sa_ok) ||
3186 	    (zplver < ZPL_VERSION_NORMALIZATION &&
3187 	    (norm != ZFS_PROP_UNDEFINED || u8 != ZFS_PROP_UNDEFINED ||
3188 	    sense != ZFS_PROP_UNDEFINED)))
3189 		return (SET_ERROR(ENOTSUP));
3190 
3191 	/*
3192 	 * Put the version in the zplprops
3193 	 */
3194 	VERIFY(nvlist_add_uint64(zplprops,
3195 	    zfs_prop_to_name(ZFS_PROP_VERSION), zplver) == 0);
3196 
3197 	if (norm == ZFS_PROP_UNDEFINED)
3198 		VERIFY(zfs_get_zplprop(os, ZFS_PROP_NORMALIZE, &norm) == 0);
3199 	VERIFY(nvlist_add_uint64(zplprops,
3200 	    zfs_prop_to_name(ZFS_PROP_NORMALIZE), norm) == 0);
3201 
3202 	/*
3203 	 * If we're normalizing, names must always be valid UTF-8 strings.
3204 	 */
3205 	if (norm)
3206 		u8 = 1;
3207 	if (u8 == ZFS_PROP_UNDEFINED)
3208 		VERIFY(zfs_get_zplprop(os, ZFS_PROP_UTF8ONLY, &u8) == 0);
3209 	VERIFY(nvlist_add_uint64(zplprops,
3210 	    zfs_prop_to_name(ZFS_PROP_UTF8ONLY), u8) == 0);
3211 
3212 	if (sense == ZFS_PROP_UNDEFINED)
3213 		VERIFY(zfs_get_zplprop(os, ZFS_PROP_CASE, &sense) == 0);
3214 	VERIFY(nvlist_add_uint64(zplprops,
3215 	    zfs_prop_to_name(ZFS_PROP_CASE), sense) == 0);
3216 
3217 	if (is_ci)
3218 		*is_ci = (sense == ZFS_CASE_INSENSITIVE);
3219 
3220 	return (0);
3221 }
3222 
3223 static int
zfs_fill_zplprops(const char * dataset,nvlist_t * createprops,nvlist_t * zplprops,boolean_t * is_ci)3224 zfs_fill_zplprops(const char *dataset, nvlist_t *createprops,
3225     nvlist_t *zplprops, boolean_t *is_ci)
3226 {
3227 	boolean_t fuids_ok, sa_ok;
3228 	uint64_t zplver = ZPL_VERSION;
3229 	objset_t *os = NULL;
3230 	char parentname[ZFS_MAX_DATASET_NAME_LEN];
3231 	char *cp;
3232 	spa_t *spa;
3233 	uint64_t spa_vers;
3234 	int error;
3235 
3236 	(void) strlcpy(parentname, dataset, sizeof (parentname));
3237 	cp = strrchr(parentname, '/');
3238 	ASSERT(cp != NULL);
3239 	cp[0] = '\0';
3240 
3241 	if ((error = spa_open(dataset, &spa, FTAG)) != 0)
3242 		return (error);
3243 
3244 	spa_vers = spa_version(spa);
3245 	spa_close(spa, FTAG);
3246 
3247 	zplver = zfs_zpl_version_map(spa_vers);
3248 	fuids_ok = (zplver >= ZPL_VERSION_FUID);
3249 	sa_ok = (zplver >= ZPL_VERSION_SA);
3250 
3251 	/*
3252 	 * Open parent object set so we can inherit zplprop values.
3253 	 */
3254 	if ((error = dmu_objset_hold(parentname, FTAG, &os)) != 0)
3255 		return (error);
3256 
3257 	error = zfs_fill_zplprops_impl(os, zplver, fuids_ok, sa_ok, createprops,
3258 	    zplprops, is_ci);
3259 	dmu_objset_rele(os, FTAG);
3260 	return (error);
3261 }
3262 
3263 static int
zfs_fill_zplprops_root(uint64_t spa_vers,nvlist_t * createprops,nvlist_t * zplprops,boolean_t * is_ci)3264 zfs_fill_zplprops_root(uint64_t spa_vers, nvlist_t *createprops,
3265     nvlist_t *zplprops, boolean_t *is_ci)
3266 {
3267 	boolean_t fuids_ok;
3268 	boolean_t sa_ok;
3269 	uint64_t zplver = ZPL_VERSION;
3270 	int error;
3271 
3272 	zplver = zfs_zpl_version_map(spa_vers);
3273 	fuids_ok = (zplver >= ZPL_VERSION_FUID);
3274 	sa_ok = (zplver >= ZPL_VERSION_SA);
3275 
3276 	error = zfs_fill_zplprops_impl(NULL, zplver, fuids_ok, sa_ok,
3277 	    createprops, zplprops, is_ci);
3278 	return (error);
3279 }
3280 
3281 /*
3282  * innvl: {
3283  *     "type" -> dmu_objset_type_t (int32)
3284  *     (optional) "props" -> { prop -> value }
3285  *     (optional) "hidden_args" -> { "wkeydata" -> value }
3286  *         raw uint8_t array of encryption wrapping key data (32 bytes)
3287  * }
3288  *
3289  * outnvl: propname -> error code (int32)
3290  */
3291 
3292 static const zfs_ioc_key_t zfs_keys_create[] = {
3293 	{"type",	DATA_TYPE_INT32,	0},
3294 	{"props",	DATA_TYPE_NVLIST,	ZK_OPTIONAL},
3295 	{"hidden_args",	DATA_TYPE_NVLIST,	ZK_OPTIONAL},
3296 };
3297 
3298 static int
zfs_ioc_create(const char * fsname,nvlist_t * innvl,nvlist_t * outnvl)3299 zfs_ioc_create(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
3300 {
3301 	int error = 0;
3302 	zfs_creat_t zct = { 0 };
3303 	nvlist_t *nvprops = NULL;
3304 	nvlist_t *hidden_args = NULL;
3305 	void (*cbfunc)(objset_t *os, void *arg, cred_t *cr, dmu_tx_t *tx);
3306 	dmu_objset_type_t type;
3307 	boolean_t is_insensitive = B_FALSE;
3308 	dsl_crypto_params_t *dcp = NULL;
3309 
3310 	type = (dmu_objset_type_t)fnvlist_lookup_int32(innvl, "type");
3311 	(void) nvlist_lookup_nvlist(innvl, "props", &nvprops);
3312 	(void) nvlist_lookup_nvlist(innvl, ZPOOL_HIDDEN_ARGS, &hidden_args);
3313 
3314 	switch (type) {
3315 	case DMU_OST_ZFS:
3316 		cbfunc = zfs_create_cb;
3317 		break;
3318 
3319 	case DMU_OST_ZVOL:
3320 		cbfunc = zvol_create_cb;
3321 		break;
3322 
3323 	default:
3324 		cbfunc = NULL;
3325 		break;
3326 	}
3327 	if (strchr(fsname, '@') ||
3328 	    strchr(fsname, '%'))
3329 		return (SET_ERROR(EINVAL));
3330 
3331 	zct.zct_props = nvprops;
3332 
3333 	if (cbfunc == NULL)
3334 		return (SET_ERROR(EINVAL));
3335 
3336 	if (type == DMU_OST_ZVOL) {
3337 		uint64_t volsize, volblocksize;
3338 
3339 		if (nvprops == NULL)
3340 			return (SET_ERROR(EINVAL));
3341 		if (nvlist_lookup_uint64(nvprops,
3342 		    zfs_prop_to_name(ZFS_PROP_VOLSIZE), &volsize) != 0)
3343 			return (SET_ERROR(EINVAL));
3344 
3345 		if ((error = nvlist_lookup_uint64(nvprops,
3346 		    zfs_prop_to_name(ZFS_PROP_VOLBLOCKSIZE),
3347 		    &volblocksize)) != 0 && error != ENOENT)
3348 			return (SET_ERROR(EINVAL));
3349 
3350 		if (error != 0)
3351 			volblocksize = zfs_prop_default_numeric(
3352 			    ZFS_PROP_VOLBLOCKSIZE);
3353 
3354 		if ((error = zvol_check_volblocksize(
3355 		    volblocksize)) != 0 ||
3356 		    (error = zvol_check_volsize(volsize,
3357 		    volblocksize)) != 0)
3358 			return (error);
3359 	} else if (type == DMU_OST_ZFS) {
3360 		int error;
3361 
3362 		/*
3363 		 * We have to have normalization and
3364 		 * case-folding flags correct when we do the
3365 		 * file system creation, so go figure them out
3366 		 * now.
3367 		 */
3368 		VERIFY(nvlist_alloc(&zct.zct_zplprops,
3369 		    NV_UNIQUE_NAME, KM_SLEEP) == 0);
3370 		error = zfs_fill_zplprops(fsname, nvprops,
3371 		    zct.zct_zplprops, &is_insensitive);
3372 		if (error != 0) {
3373 			nvlist_free(zct.zct_zplprops);
3374 			return (error);
3375 		}
3376 	}
3377 
3378 	error = dsl_crypto_params_create_nvlist(DCP_CMD_NONE, nvprops,
3379 	    hidden_args, &dcp);
3380 	if (error != 0) {
3381 		nvlist_free(zct.zct_zplprops);
3382 		return (error);
3383 	}
3384 
3385 	error = dmu_objset_create(fsname, type,
3386 	    is_insensitive ? DS_FLAG_CI_DATASET : 0, dcp, cbfunc, &zct);
3387 
3388 	nvlist_free(zct.zct_zplprops);
3389 	dsl_crypto_params_free(dcp, !!error);
3390 
3391 	/*
3392 	 * It would be nice to do this atomically.
3393 	 */
3394 	if (error == 0) {
3395 		error = zfs_set_prop_nvlist(fsname, ZPROP_SRC_LOCAL,
3396 		    nvprops, outnvl);
3397 		if (error != 0)
3398 			(void) dsl_destroy_head(fsname);
3399 	}
3400 	return (error);
3401 }
3402 
3403 /*
3404  * innvl: {
3405  *     "origin" -> name of origin snapshot
3406  *     (optional) "props" -> { prop -> value }
3407  *     (optional) "hidden_args" -> { "wkeydata" -> value }
3408  *         raw uint8_t array of encryption wrapping key data (32 bytes)
3409  * }
3410  *
3411  * outnvl: propname -> error code (int32)
3412  */
3413 static const zfs_ioc_key_t zfs_keys_clone[] = {
3414 	{"origin",	DATA_TYPE_STRING,	0},
3415 	{"props",	DATA_TYPE_NVLIST,	ZK_OPTIONAL},
3416 	{"hidden_args",	DATA_TYPE_NVLIST,	ZK_OPTIONAL},
3417 };
3418 
3419 static int
zfs_ioc_clone(const char * fsname,nvlist_t * innvl,nvlist_t * outnvl)3420 zfs_ioc_clone(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
3421 {
3422 	int error = 0;
3423 	nvlist_t *nvprops = NULL;
3424 	char *origin_name;
3425 
3426 	if (nvlist_lookup_string(innvl, "origin", &origin_name) != 0)
3427 		return (SET_ERROR(EINVAL));
3428 	(void) nvlist_lookup_nvlist(innvl, "props", &nvprops);
3429 
3430 	if (strchr(fsname, '@') ||
3431 	    strchr(fsname, '%'))
3432 		return (SET_ERROR(EINVAL));
3433 
3434 	if (dataset_namecheck(origin_name, NULL, NULL) != 0)
3435 		return (SET_ERROR(EINVAL));
3436 
3437 	error = dmu_objset_clone(fsname, origin_name);
3438 
3439 	/*
3440 	 * It would be nice to do this atomically.
3441 	 */
3442 	if (error == 0) {
3443 		error = zfs_set_prop_nvlist(fsname, ZPROP_SRC_LOCAL,
3444 		    nvprops