27c478bdstevel@tonic-gate * CDDL HEADER START
37c478bdstevel@tonic-gate *
47c478bdstevel@tonic-gate * The contents of this file are subject to the terms of the
5b923897th * Common Development and Distribution License (the "License").
6b923897th * You may not use this file except in compliance with the License.
77c478bdstevel@tonic-gate *
87c478bdstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
97c478bdstevel@tonic-gate * or http://www.opensolaris.org/os/licensing.
107c478bdstevel@tonic-gate * See the License for the specific language governing permissions
117c478bdstevel@tonic-gate * and limitations under the License.
127c478bdstevel@tonic-gate *
137c478bdstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each
147c478bdstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
157c478bdstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the
167c478bdstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying
177c478bdstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner]
187c478bdstevel@tonic-gate *
197c478bdstevel@tonic-gate * CDDL HEADER END
207c478bdstevel@tonic-gate */
218fd04b8Roger A. Faulkner
238fd04b8Roger A. Faulkner * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
247c478bdstevel@tonic-gate * Use is subject to license terms.
257c478bdstevel@tonic-gate */
277c478bdstevel@tonic-gate/*	Copyright (c) 1983, 1984, 1985, 1986, 1987, 1988, 1989 AT&T	*/
287c478bdstevel@tonic-gate/*	  All Rights Reserved  	*/
317c478bdstevel@tonic-gate * Portions of this source code were derived from Berkeley 4.3 BSD
327c478bdstevel@tonic-gate * under license from the Regents of the University of California.
337c478bdstevel@tonic-gate */
357c478bdstevel@tonic-gate#include <sys/types.h>
367c478bdstevel@tonic-gate#include <sys/t_lock.h>
377c478bdstevel@tonic-gate#include <sys/param.h>
387c478bdstevel@tonic-gate#include <sys/errno.h>
397c478bdstevel@tonic-gate#include <sys/fstyp.h>
407c478bdstevel@tonic-gate#include <sys/kmem.h>
417c478bdstevel@tonic-gate#include <sys/systm.h>
427c478bdstevel@tonic-gate#include <sys/mount.h>
437c478bdstevel@tonic-gate#include <sys/vfs.h>
447c478bdstevel@tonic-gate#include <sys/cred.h>
457c478bdstevel@tonic-gate#include <sys/vnode.h>
467c478bdstevel@tonic-gate#include <sys/cmn_err.h>
477c478bdstevel@tonic-gate#include <sys/debug.h>
487c478bdstevel@tonic-gate#include <sys/pathname.h>
497c478bdstevel@tonic-gate#include <sys/policy.h>
507c478bdstevel@tonic-gate#include <sys/zone.h>
52b923897th#define	UMOUNT2_SET_ERRNO(e, is_syscall) ((is_syscall) ? set_errno((e)) : (e))
55b923897th * The heart of the umount2 call - it is pulled out to allow kernel
56b923897th * level particpation when the only reference is the vfs pointer.
57b923897th *
58b923897th * Note that some of the callers may not be in the context of a
59b923897th * syscall (created by zthread_create() for example) and as such
60b923897th * may not have an associated curthread->t_lwp. This is handled
61b923897th * by is_syscall.
62b923897th */
64b923897thumount2_engine(vfs_t *vfsp, int flag, cred_t *cr, int is_syscall)
66b923897th	int	error;
68b923897th	/*
69b923897th	 * Protect the call to vn_vfswlock() with the vfs reflock.  This
70b923897th	 * ensures vfs_vnodecovered will either be NULL (because someone
71b923897th	 * beat us to the umount) or valid (because vfs_lock() prevents
72b923897th	 * another umount from getting through here until we've called
73b923897th	 * vn_vfswlock() on the covered vnode).
74b923897th	 *
75b923897th	 * At one point, we did the non-blocking version (vfs_lock()),
76b923897th	 * and if it failed, bailed out with EBUSY.  However, dounmount()
77b923897th	 * calls vfs_lock_wait() and we drop the vfs lock before calling
78b923897th	 * dounmount(), so there's no difference between waiting here
79b923897th	 * for the lock or waiting there because grabbed it as soon as
80b923897th	 * we drop it below.  No returning with EBUSY at this point
81b923897th	 * reduces the number of spurious unmount failures that happen
82b923897th	 * as a side-effect of fsflush() and other mount and unmount
83b923897th	 * operations that might be going on simultaneously.
84b923897th	 */
85b923897th	vfs_lock_wait(vfsp);
87b923897th	/*
88b923897th	 * Call vn_vfswlock() on the covered vnode so that dounmount()
89b923897th	 * can do its thing.  It will call the corresponding vn_vfsunlock().
90b923897th	 * Note that vfsp->vfs_vnodecovered can be NULL here, either because
91b923897th	 * someone did umount on "/" or because someone beat us to the umount
92b923897th	 * before we did the vfs_lock() above.  In these cases, vn_vfswlock()
93b923897th	 * returns EBUSY and we just pass that up.  Also note that we're
94b923897th	 * looking at a vnode without doing a VN_HOLD() on it.  This is
95b923897th	 * safe because it can't go away while something is mounted on it
96b923897th	 * and we're locking out other umounts at this point.
97b923897th	 */
98b923897th	if (vn_vfswlock(vfsp->vfs_vnodecovered)) {
99b923897th		vfs_unlock(vfsp);
100b923897th		VFS_RELE(vfsp);
101b923897th		return (UMOUNT2_SET_ERRNO(EBUSY, is_syscall));
102b923897th	}
104b923897th	/*
105b923897th	 * Now that the VVFSLOCK in the covered vnode is protecting this
106b923897th	 * path, we don't need the vfs reflock or the hold on the vfs anymore.
107b923897th	 */
108b923897th	vfs_unlock(vfsp);
109b923897th	VFS_RELE(vfsp);
111b923897th	/*
112b923897th	 * Perform the unmount.
113b923897th	 */
114b923897th	if ((error = dounmount(vfsp, flag, cr)) != 0)
115b923897th		return (UMOUNT2_SET_ERRNO(error, is_syscall));
116b923897th	return (0);
1207c478bdstevel@tonic-gate * New umount() system call (for force unmount flag and perhaps others later).
1217c478bdstevel@tonic-gate */
1237c478bdstevel@tonic-gateumount2(char *pathp, int flag)
1257c478bdstevel@tonic-gate	struct pathname pn;
1267c478bdstevel@tonic-gate	struct vfs *vfsp;
1277c478bdstevel@tonic-gate	int error;
1297c478bdstevel@tonic-gate	/*
1307c478bdstevel@tonic-gate	 * Some flags are disallowed through the system call interface.
1317c478bdstevel@tonic-gate	 */
1327c478bdstevel@tonic-gate	flag &= MS_UMOUNT_MASK;
1347c478bdstevel@tonic-gate	/*
1357c478bdstevel@tonic-gate	 * Lookup user-supplied name by trying to match it against the
1367c478bdstevel@tonic-gate	 * mount points recorded at mount time.  If no match is found
1377c478bdstevel@tonic-gate	 * (which can happen if the path to the mount point is specified
1387c478bdstevel@tonic-gate	 * differently between mount & umount, or if a block device were
1397c478bdstevel@tonic-gate	 * passed to umount) then we fall back to calling lookupname()
1407c478bdstevel@tonic-gate	 * to find the vfs.  Doing it this way prevents calling lookupname()
1417c478bdstevel@tonic-gate	 * in most cases and that allows forcible umount to work even if
1427c478bdstevel@tonic-gate	 * lookupname() would hang (i.e. because an NFS server is dead).
1437c478bdstevel@tonic-gate	 */
1457c478bdstevel@tonic-gate	if (error = pn_get(pathp, UIO_USERSPACE, &pn))
1467c478bdstevel@tonic-gate		return (set_errno(error));
1487c478bdstevel@tonic-gate	/*
1497c478bdstevel@tonic-gate	 * Only a privileged user is allowed to bypass the security
1507c478bdstevel@tonic-gate	 * checks done by lookupname() and use the results from
1517c478bdstevel@tonic-gate	 * vfs_mntpoint2vfsp() instead.  It could be argued that the
1527c478bdstevel@tonic-gate	 * proper check is FILE_DAC_SEARCH but we put it all
1537c478bdstevel@tonic-gate	 * under the mount privilege.  Also, make sure the caller
1547c478bdstevel@tonic-gate	 * isn't in an environment with an alternate root (to the zone's root)
1557c478bdstevel@tonic-gate	 * directory, i.e. chroot(2).
1567c478bdstevel@tonic-gate	 */
1577c478bdstevel@tonic-gate	if (secpolicy_fs_unmount(CRED(), NULL) != 0 ||
1587c478bdstevel@tonic-gate	    (PTOU(curproc)->u_rdir != NULL &&
1597c478bdstevel@tonic-gate	    PTOU(curproc)->u_rdir != curproc->p_zone->zone_rootvp) ||
1607c478bdstevel@tonic-gate	    (vfsp = vfs_mntpoint2vfsp(pn.pn_path)) == NULL) {
1617c478bdstevel@tonic-gate		vnode_t *fsrootvp;
1637c478bdstevel@tonic-gate		/* fall back to lookupname() on path given to us */
1647c478bdstevel@tonic-gate		if (error = lookupname(pn.pn_path, UIO_SYSSPACE, FOLLOW,
1657c478bdstevel@tonic-gate		    NULLVPP, &fsrootvp)) {
1667c478bdstevel@tonic-gate			pn_free(&pn);
1677c478bdstevel@tonic-gate			return (set_errno(error));
1687c478bdstevel@tonic-gate		}
1697c478bdstevel@tonic-gate		/*
1707c478bdstevel@tonic-gate		 * Find the vfs to be unmounted.  The caller may have specified
1717c478bdstevel@tonic-gate		 * either the directory mount point (preferred) or else (for a
1727c478bdstevel@tonic-gate		 * disk-based file system) the block device which was mounted.
1737c478bdstevel@tonic-gate		 * Check to see which it is; if it's the device, search the VFS
1747c478bdstevel@tonic-gate		 * list to find the associated vfs entry.
1757c478bdstevel@tonic-gate		 */
1767c478bdstevel@tonic-gate		if (fsrootvp->v_flag & VROOT) {
1777c478bdstevel@tonic-gate			vfsp = fsrootvp->v_vfsp;
1787c478bdstevel@tonic-gate			VFS_HOLD(vfsp);
1797c478bdstevel@tonic-gate		} else if (fsrootvp->v_type == VBLK)
1807c478bdstevel@tonic-gate			vfsp = vfs_dev2vfsp(fsrootvp->v_rdev);
1817c478bdstevel@tonic-gate		else
1827c478bdstevel@tonic-gate			vfsp = NULL;
1847c478bdstevel@tonic-gate		VN_RELE(fsrootvp);
1867c478bdstevel@tonic-gate		if (vfsp == NULL) {
1877c478bdstevel@tonic-gate			pn_free(&pn);
1887c478bdstevel@tonic-gate			return (set_errno(EINVAL));
1897c478bdstevel@tonic-gate		}
1907c478bdstevel@tonic-gate	}
1917c478bdstevel@tonic-gate	pn_free(&pn);
193b923897th	return (umount2_engine(vfsp, flag, CRED(), 1));