1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright (c) 2007, 2010, Oracle and/or its affiliates. All rights reserved.
23 * Copyright 2010 Nexenta Systems, Inc. All rights reserved.
24 * Copyright (c) 2013, 2015 by Delphix. All rights reserved.
25 * Copyright 2016 Igor Kozhukhov <ikozhukhov@gmail.com>
26 */
27
28 #include <sys/zfs_context.h>
29
30 #if defined(_KERNEL)
31 #include <sys/systm.h>
32 #include <sys/sunddi.h>
33 #include <sys/ctype.h>
34 #else
35 #include <stdio.h>
36 #include <unistd.h>
37 #include <strings.h>
38 #include <libnvpair.h>
39 #include <ctype.h>
40 #endif
41 #include <sys/dsl_deleg.h>
42 #include "zfs_prop.h"
43 #include "zfs_deleg.h"
44 #include "zfs_namecheck.h"
45
46 zfs_deleg_perm_tab_t zfs_deleg_perm_tab[] = {
47 {ZFS_DELEG_PERM_ALLOW},
48 {ZFS_DELEG_PERM_BOOKMARK},
49 {ZFS_DELEG_PERM_CLONE},
50 {ZFS_DELEG_PERM_CREATE},
51 {ZFS_DELEG_PERM_DESTROY},
52 {ZFS_DELEG_PERM_DIFF},
53 {ZFS_DELEG_PERM_MOUNT},
54 {ZFS_DELEG_PERM_PROMOTE},
55 {ZFS_DELEG_PERM_RECEIVE},
56 {ZFS_DELEG_PERM_REMAP},
57 {ZFS_DELEG_PERM_RENAME},
58 {ZFS_DELEG_PERM_ROLLBACK},
59 {ZFS_DELEG_PERM_SNAPSHOT},
60 {ZFS_DELEG_PERM_SHARE},
61 {ZFS_DELEG_PERM_SEND},
62 {ZFS_DELEG_PERM_USERPROP},
63 {ZFS_DELEG_PERM_USERQUOTA},
64 {ZFS_DELEG_PERM_GROUPQUOTA},
65 {ZFS_DELEG_PERM_USERUSED},
66 {ZFS_DELEG_PERM_GROUPUSED},
67 {ZFS_DELEG_PERM_USEROBJQUOTA},
68 {ZFS_DELEG_PERM_GROUPOBJQUOTA},
69 {ZFS_DELEG_PERM_USEROBJUSED},
70 {ZFS_DELEG_PERM_GROUPOBJUSED},
71 {ZFS_DELEG_PERM_HOLD},
72 {ZFS_DELEG_PERM_RELEASE},
73 {ZFS_DELEG_PERM_LOAD_KEY},
74 {ZFS_DELEG_PERM_CHANGE_KEY},
75 {ZFS_DELEG_PERM_PROJECTUSED},
76 {ZFS_DELEG_PERM_PROJECTQUOTA},
77 {ZFS_DELEG_PERM_PROJECTOBJUSED},
78 {ZFS_DELEG_PERM_PROJECTOBJQUOTA},
79 {NULL}
80 };
81
82 static int
zfs_valid_permission_name(const char * perm)83 zfs_valid_permission_name(const char *perm)
84 {
85 if (zfs_deleg_canonicalize_perm(perm))
86 return (0);
87
88 return (permset_namecheck(perm, NULL, NULL));
89 }
90
91 const char *
zfs_deleg_canonicalize_perm(const char * perm)92 zfs_deleg_canonicalize_perm(const char *perm)
93 {
94 int i;
95 zfs_prop_t prop;
96
97 for (i = 0; zfs_deleg_perm_tab[i].z_perm != NULL; i++) {
98 if (strcmp(perm, zfs_deleg_perm_tab[i].z_perm) == 0)
99 return (perm);
100 }
101
102 prop = zfs_name_to_prop(perm);
103 if (prop != ZPROP_INVAL && zfs_prop_delegatable(prop))
104 return (zfs_prop_to_name(prop));
105 return (NULL);
106
107 }
108
109 static int
zfs_validate_who(char * who)110 zfs_validate_who(char *who)
111 {
112 char *p;
113
114 if (who[2] != ZFS_DELEG_FIELD_SEP_CHR)
115 return (-1);
116
117 switch (who[0]) {
118 case ZFS_DELEG_USER:
119 case ZFS_DELEG_GROUP:
120 case ZFS_DELEG_USER_SETS:
121 case ZFS_DELEG_GROUP_SETS:
122 if (who[1] != ZFS_DELEG_LOCAL && who[1] != ZFS_DELEG_DESCENDENT)
123 return (-1);
124 for (p = &who[3]; *p; p++)
125 if (!isdigit(*p))
126 return (-1);
127 break;
128
129 case ZFS_DELEG_NAMED_SET:
130 case ZFS_DELEG_NAMED_SET_SETS:
131 if (who[1] != ZFS_DELEG_NA)
132 return (-1);
133 return (permset_namecheck(&who[3], NULL, NULL));
134
135 case ZFS_DELEG_CREATE:
136 case ZFS_DELEG_CREATE_SETS:
137 if (who[1] != ZFS_DELEG_NA)
138 return (-1);
139 if (who[3] != '\0')
140 return (-1);
141 break;
142
143 case ZFS_DELEG_EVERYONE:
144 case ZFS_DELEG_EVERYONE_SETS:
145 if (who[1] != ZFS_DELEG_LOCAL && who[1] != ZFS_DELEG_DESCENDENT)
146 return (-1);
147 if (who[3] != '\0')
148 return (-1);
149 break;
150
151 default:
152 return (-1);
153 }
154
155 return (0);
156 }
157
158 int
zfs_deleg_verify_nvlist(nvlist_t * nvp)159 zfs_deleg_verify_nvlist(nvlist_t *nvp)
160 {
161 nvpair_t *who, *perm_name;
162 nvlist_t *perms;
163 int error;
164
165 if (nvp == NULL)
166 return (-1);
167
168 who = nvlist_next_nvpair(nvp, NULL);
169 if (who == NULL)
170 return (-1);
171
172 do {
173 if (zfs_validate_who(nvpair_name(who)))
174 return (-1);
175
176 error = nvlist_lookup_nvlist(nvp, nvpair_name(who), &perms);
177
178 if (error && error != ENOENT)
179 return (-1);
180 if (error == ENOENT)
181 continue;
182
183 perm_name = nvlist_next_nvpair(perms, NULL);
184 if (perm_name == NULL) {
185 return (-1);
186 }
187 do {
188 error = zfs_valid_permission_name(
189 nvpair_name(perm_name));
190 if (error)
191 return (-1);
192 } while ((perm_name = nvlist_next_nvpair(perms, perm_name))
193 != NULL);
194 } while ((who = nvlist_next_nvpair(nvp, who)) != NULL);
195 return (0);
196 }
197
198 /*
199 * Construct the base attribute name. The base attribute names
200 * are the "key" to locate the jump objects which contain the actual
201 * permissions. The base attribute names are encoded based on
202 * type of entry and whether it is a local or descendent permission.
203 *
204 * Arguments:
205 * attr - attribute name return string, attribute is assumed to be
206 * ZFS_MAX_DELEG_NAME long.
207 * type - type of entry to construct
208 * inheritchr - inheritance type (local,descendent, or NA for create and
209 * permission set definitions
210 * data - is either a permission set name or a 64 bit uid/gid.
211 */
212 void
zfs_deleg_whokey(char * attr,zfs_deleg_who_type_t type,char inheritchr,void * data)213 zfs_deleg_whokey(char *attr, zfs_deleg_who_type_t type,
214 char inheritchr, void *data)
215 {
216 int len = ZFS_MAX_DELEG_NAME;
217 uint64_t *id = data;
218
219 switch (type) {
220 case ZFS_DELEG_USER:
221 case ZFS_DELEG_GROUP:
222 case ZFS_DELEG_USER_SETS:
223 case ZFS_DELEG_GROUP_SETS:
224 (void) snprintf(attr, len, "%c%c%c%lld", type, inheritchr,
225 ZFS_DELEG_FIELD_SEP_CHR, (longlong_t)*id);
226 break;
227 case ZFS_DELEG_NAMED_SET_SETS:
228 case ZFS_DELEG_NAMED_SET:
229 (void) snprintf(attr, len, "%c-%c%s", type,
230 ZFS_DELEG_FIELD_SEP_CHR, (char *)data);
231 break;
232 case ZFS_DELEG_CREATE:
233 case ZFS_DELEG_CREATE_SETS:
234 (void) snprintf(attr, len, "%c-%c", type,
235 ZFS_DELEG_FIELD_SEP_CHR);
236 break;
237 case ZFS_DELEG_EVERYONE:
238 case ZFS_DELEG_EVERYONE_SETS:
239 (void) snprintf(attr, len, "%c%c%c", type, inheritchr,
240 ZFS_DELEG_FIELD_SEP_CHR);
241 break;
242 default:
243 ASSERT(!"bad zfs_deleg_who_type_t");
244 }
245 }
246