xref: /illumos-gate/usr/src/uts/common/fs/zfs/zfs_ioctl.c (revision 4dfe7477)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
24  */
25 
26 /*
27  * Copyright (c) 2011-2012 Pawel Jakub Dawidek. All rights reserved.
28  * Portions Copyright 2011 Martin Matuska
29  * Copyright 2015, OmniTI Computer Consulting, Inc. All rights reserved.
30  * Copyright 2018 Nexenta Systems, Inc.  All rights reserved.
31  * Copyright 2019 Joyent, Inc.
32  * Copyright (c) 2011, 2017 by Delphix. All rights reserved.
33  * Copyright (c) 2013 by Saso Kiselkov. All rights reserved.
34  * Copyright (c) 2013 Steven Hartland. All rights reserved.
35  * Copyright (c) 2014 Integros [integros.com]
36  * Copyright 2016 Toomas Soome <tsoome@me.com>
37  * Copyright (c) 2017, loli10K <ezomori.nozomu@gmail.com>. All rights reserved.
38  * Copyright 2017 RackTop Systems.
39  * Copyright (c) 2017, Datto, Inc. All rights reserved.
40  * Copyright 2021 The University of Queensland
41  * Copyright 2024 Oxide Computer Company
42  */
43 
44 /*
45  * ZFS ioctls.
46  *
47  * This file handles the ioctls to /dev/zfs, used for configuring ZFS storage
48  * pools and filesystems, e.g. with /sbin/zfs and /sbin/zpool.
49  *
50  * There are two ways that we handle ioctls: the legacy way where almost
51  * all of the logic is in the ioctl callback, and the new way where most
52  * of the marshalling is handled in the common entry point, zfsdev_ioctl().
53  *
54  * Non-legacy ioctls should be registered by calling
55  * zfs_ioctl_register() from zfs_ioctl_init().  The ioctl is invoked
56  * from userland by lzc_ioctl().
57  *
58  * The registration arguments are as follows:
59  *
60  * const char *name
61  *   The name of the ioctl.  This is used for history logging.  If the
62  *   ioctl returns successfully (the callback returns 0), and allow_log
63  *   is true, then a history log entry will be recorded with the input &
64  *   output nvlists.  The log entry can be printed with "zpool history -i".
65  *
66  * zfs_ioc_t ioc
67  *   The ioctl request number, which userland will pass to ioctl(2).
68  *   We want newer versions of libzfs and libzfs_core to run against
69  *   existing zfs kernel modules (i.e. a deferred reboot after an update).
70  *   Therefore the ioctl numbers cannot change from release to release.
71  *
72  * zfs_secpolicy_func_t *secpolicy
73  *   This function will be called before the zfs_ioc_func_t, to
74  *   determine if this operation is permitted.  It should return EPERM
75  *   on failure, and 0 on success.  Checks include determining if the
76  *   dataset is visible in this zone, and if the user has either all
77  *   zfs privileges in the zone (SYS_MOUNT), or has been granted permission
78  *   to do this operation on this dataset with "zfs allow".
79  *
80  * zfs_ioc_namecheck_t namecheck
81  *   This specifies what to expect in the zfs_cmd_t:zc_name -- a pool
82  *   name, a dataset name, or nothing.  If the name is not well-formed,
83  *   the ioctl will fail and the callback will not be called.
84  *   Therefore, the callback can assume that the name is well-formed
85  *   (e.g. is null-terminated, doesn't have more than one '@' character,
86  *   doesn't have invalid characters).
87  *
88  * zfs_ioc_poolcheck_t pool_check
89  *   This specifies requirements on the pool state.  If the pool does
90  *   not meet them (is suspended or is readonly), the ioctl will fail
91  *   and the callback will not be called.  If any checks are specified
92  *   (i.e. it is not POOL_CHECK_NONE), namecheck must not be NO_NAME.
93  *   Multiple checks can be or-ed together (e.g. POOL_CHECK_SUSPENDED |
94  *   POOL_CHECK_READONLY).
95  *
96  * zfs_ioc_key_t *nvl_keys
97  *  The list of expected/allowable innvl input keys. This list is used
98  *  to validate the nvlist input to the ioctl.
99  *
100  * boolean_t smush_outnvlist
101  *   If smush_outnvlist is true, then the output is presumed to be a
102  *   list of errors, and it will be "smushed" down to fit into the
103  *   caller's buffer, by removing some entries and replacing them with a
104  *   single "N_MORE_ERRORS" entry indicating how many were removed.  See
105  *   nvlist_smush() for details.  If smush_outnvlist is false, and the
106  *   outnvlist does not fit into the userland-provided buffer, then the
107  *   ioctl will fail with ENOMEM.
108  *
109  * zfs_ioc_func_t *func
110  *   The callback function that will perform the operation.
111  *
112  *   The callback should return 0 on success, or an error number on
113  *   failure.  If the function fails, the userland ioctl will return -1,
114  *   and errno will be set to the callback's return value.  The callback
115  *   will be called with the following arguments:
116  *
117  *   const char *name
118  *     The name of the pool or dataset to operate on, from
119  *     zfs_cmd_t:zc_name.  The 'namecheck' argument specifies the
120  *     expected type (pool, dataset, or none).
121  *
122  *   nvlist_t *innvl
123  *     The input nvlist, deserialized from zfs_cmd_t:zc_nvlist_src.  Or
124  *     NULL if no input nvlist was provided.  Changes to this nvlist are
125  *     ignored.  If the input nvlist could not be deserialized, the
126  *     ioctl will fail and the callback will not be called.
127  *
128  *   nvlist_t *outnvl
129  *     The output nvlist, initially empty.  The callback can fill it in,
130  *     and it will be returned to userland by serializing it into
131  *     zfs_cmd_t:zc_nvlist_dst.  If it is non-empty, and serialization
132  *     fails (e.g. because the caller didn't supply a large enough
133  *     buffer), then the overall ioctl will fail.  See the
134  *     'smush_nvlist' argument above for additional behaviors.
135  *
136  *     There are two typical uses of the output nvlist:
137  *       - To return state, e.g. property values.  In this case,
138  *         smush_outnvlist should be false.  If the buffer was not large
139  *         enough, the caller will reallocate a larger buffer and try
140  *         the ioctl again.
141  *
142  *       - To return multiple errors from an ioctl which makes on-disk
143  *         changes.  In this case, smush_outnvlist should be true.
144  *         Ioctls which make on-disk modifications should generally not
145  *         use the outnvl if they succeed, because the caller can not
146  *         distinguish between the operation failing, and
147  *         deserialization failing.
148  *
149  * IOCTL Interface Errors
150  *
151  * The following ioctl input errors can be returned:
152  *   ZFS_ERR_IOC_CMD_UNAVAIL	the ioctl number is not supported by kernel
153  *   ZFS_ERR_IOC_ARG_UNAVAIL	an input argument is not supported by kernel
154  *   ZFS_ERR_IOC_ARG_REQUIRED	a required input argument is missing
155  *   ZFS_ERR_IOC_ARG_BADTYPE	an input argument has an invalid type
156  */
157 
158 #include <sys/types.h>
159 #include <sys/param.h>
160 #include <sys/errno.h>
161 #include <sys/uio.h>
162 #include <sys/buf.h>
163 #include <sys/modctl.h>
164 #include <sys/open.h>
165 #include <sys/file.h>
166 #include <sys/kmem.h>
167 #include <sys/conf.h>
168 #include <sys/cmn_err.h>
169 #include <sys/stat.h>
170 #include <sys/zfs_ioctl.h>
171 #include <sys/zfs_vfsops.h>
172 #include <sys/zfs_znode.h>
173 #include <sys/zap.h>
174 #include <sys/spa.h>
175 #include <sys/spa_impl.h>
176 #include <sys/vdev.h>
177 #include <sys/priv_impl.h>
178 #include <sys/dmu.h>
179 #include <sys/dsl_dir.h>
180 #include <sys/dsl_dataset.h>
181 #include <sys/dsl_prop.h>
182 #include <sys/dsl_deleg.h>
183 #include <sys/dmu_objset.h>
184 #include <sys/dmu_impl.h>
185 #include <sys/dmu_tx.h>
186 #include <sys/ddi.h>
187 #include <sys/sunddi.h>
188 #include <sys/sunldi.h>
189 #include <sys/policy.h>
190 #include <sys/zone.h>
191 #include <sys/nvpair.h>
192 #include <sys/pathname.h>
193 #include <sys/mount.h>
194 #include <sys/sdt.h>
195 #include <sys/fs/zfs.h>
196 #include <sys/zfs_ctldir.h>
197 #include <sys/zfs_dir.h>
198 #include <sys/zfs_onexit.h>
199 #include <sys/zvol.h>
200 #include <sys/dsl_scan.h>
201 #include <sharefs/share.h>
202 #include <sys/dmu_objset.h>
203 #include <sys/dmu_recv.h>
204 #include <sys/dmu_send.h>
205 #include <sys/dsl_destroy.h>
206 #include <sys/dsl_bookmark.h>
207 #include <sys/dsl_userhold.h>
208 #include <sys/zfeature.h>
209 #include <sys/zcp.h>
210 #include <sys/zio_checksum.h>
211 #include <sys/vdev_removal.h>
212 #include <sys/vdev_impl.h>
213 #include <sys/vdev_initialize.h>
214 #include <sys/vdev_trim.h>
215 #include <sys/dsl_crypt.h>
216 
217 #include "zfs_namecheck.h"
218 #include "zfs_prop.h"
219 #include "zfs_deleg.h"
220 #include "zfs_comutil.h"
221 
222 #include "lua.h"
223 #include "lauxlib.h"
224 
225 extern struct modlfs zfs_modlfs;
226 
227 extern void zfs_init(void);
228 extern void zfs_fini(void);
229 
230 ldi_ident_t zfs_li = NULL;
231 dev_info_t *zfs_dip;
232 
233 uint_t zfs_fsyncer_key;
234 extern uint_t rrw_tsd_key;
235 static uint_t zfs_allow_log_key;
236 
237 typedef int zfs_ioc_legacy_func_t(zfs_cmd_t *);
238 typedef int zfs_ioc_func_t(const char *, nvlist_t *, nvlist_t *);
239 typedef int zfs_secpolicy_func_t(zfs_cmd_t *, nvlist_t *, cred_t *);
240 
241 /*
242  * IOC Keys are used to document and validate user->kernel interface inputs.
243  * See zfs_keys_recv_new for an example declaration. Any key name that is not
244  * listed will be rejected as input.
245  *
246  * The keyname 'optional' is always allowed, and must be an nvlist if present.
247  * Arguments which older kernels can safely ignore can be placed under the
248  * "optional" key.
249  *
250  * When adding new keys to an existing ioc for new functionality, consider:
251  *	- adding an entry into zfs_sysfs.c zfs_features[] list
252  *	- updating the libzfs_input_check.c test utility
253  *
254  * Note: in the ZK_WILDCARDLIST case, the name serves as documentation
255  * for the expected name (bookmark, snapshot, property, etc) but there
256  * is no validation in the preflight zfs_check_input_nvpairs() check.
257  */
258 typedef enum {
259 	ZK_OPTIONAL = 1 << 0,		/* pair is optional */
260 	ZK_WILDCARDLIST = 1 << 1,	/* one or more unspecified key names */
261 } ioc_key_flag_t;
262 
263 /* DATA_TYPE_ANY is used when zkey_type can vary. */
264 #define	DATA_TYPE_ANY	DATA_TYPE_UNKNOWN
265 
266 typedef struct zfs_ioc_key {
267 	const char	*zkey_name;
268 	data_type_t	zkey_type;
269 	ioc_key_flag_t	zkey_flags;
270 } zfs_ioc_key_t;
271 
272 typedef enum {
273 	NO_NAME,
274 	POOL_NAME,
275 	DATASET_NAME
276 } zfs_ioc_namecheck_t;
277 
278 typedef enum {
279 	POOL_CHECK_NONE		= 1 << 0,
280 	POOL_CHECK_SUSPENDED	= 1 << 1,
281 	POOL_CHECK_READONLY	= 1 << 2,
282 } zfs_ioc_poolcheck_t;
283 
284 typedef struct zfs_ioc_vec {
285 	zfs_ioc_legacy_func_t	*zvec_legacy_func;
286 	zfs_ioc_func_t		*zvec_func;
287 	zfs_secpolicy_func_t	*zvec_secpolicy;
288 	zfs_ioc_namecheck_t	zvec_namecheck;
289 	boolean_t		zvec_allow_log;
290 	zfs_ioc_poolcheck_t	zvec_pool_check;
291 	boolean_t		zvec_smush_outnvlist;
292 	const char		*zvec_name;
293 	const zfs_ioc_key_t	*zvec_nvl_keys;
294 	size_t			zvec_nvl_key_count;
295 } zfs_ioc_vec_t;
296 
297 /* This array is indexed by zfs_userquota_prop_t */
298 static const char *userquota_perms[] = {
299 	ZFS_DELEG_PERM_USERUSED,
300 	ZFS_DELEG_PERM_USERQUOTA,
301 	ZFS_DELEG_PERM_GROUPUSED,
302 	ZFS_DELEG_PERM_GROUPQUOTA,
303 	ZFS_DELEG_PERM_USEROBJUSED,
304 	ZFS_DELEG_PERM_USEROBJQUOTA,
305 	ZFS_DELEG_PERM_GROUPOBJUSED,
306 	ZFS_DELEG_PERM_GROUPOBJQUOTA,
307 	ZFS_DELEG_PERM_PROJECTUSED,
308 	ZFS_DELEG_PERM_PROJECTQUOTA,
309 	ZFS_DELEG_PERM_PROJECTOBJUSED,
310 	ZFS_DELEG_PERM_PROJECTOBJQUOTA,
311 };
312 
313 static int zfs_ioc_userspace_upgrade(zfs_cmd_t *zc);
314 static int zfs_ioc_id_quota_upgrade(zfs_cmd_t *zc);
315 static int zfs_check_settable(const char *name, nvpair_t *property,
316     cred_t *cr);
317 static int zfs_check_clearable(char *dataset, nvlist_t *props,
318     nvlist_t **errors);
319 static int zfs_fill_zplprops_root(uint64_t, nvlist_t *, nvlist_t *,
320     boolean_t *);
321 int zfs_set_prop_nvlist(const char *, zprop_source_t, nvlist_t *, nvlist_t *);
322 static int get_nvlist(uint64_t nvl, uint64_t size, int iflag, nvlist_t **nvp);
323 
324 static int zfs_prop_activate_feature(spa_t *spa, spa_feature_t feature);
325 
326 /* _NOTE(PRINTFLIKE(4)) - this is printf-like, but lint is too whiney */
327 void
__dprintf(const char * file,const char * func,int line,const char * fmt,...)328 __dprintf(const char *file, const char *func, int line, const char *fmt, ...)
329 {
330 	const char *newfile;
331 	char buf[512];
332 	va_list adx;
333 
334 	/*
335 	 * Get rid of annoying "../common/" prefix to filename.
336 	 */
337 	newfile = strrchr(file, '/');
338 	if (newfile != NULL) {
339 		newfile = newfile + 1; /* Get rid of leading / */
340 	} else {
341 		newfile = file;
342 	}
343 
344 	va_start(adx, fmt);
345 	(void) vsnprintf(buf, sizeof (buf), fmt, adx);
346 	va_end(adx);
347 
348 	/*
349 	 * To get this data, use the zfs-dprintf probe as so:
350 	 * dtrace -q -n 'zfs-dprintf \
351 	 *	/stringof(arg0) == "dbuf.c"/ \
352 	 *	{printf("%s: %s", stringof(arg1), stringof(arg3))}'
353 	 * arg0 = file name
354 	 * arg1 = function name
355 	 * arg2 = line number
356 	 * arg3 = message
357 	 */
358 	DTRACE_PROBE4(zfs__dprintf,
359 	    char *, newfile, char *, func, int, line, char *, buf);
360 }
361 
362 static void
history_str_free(char * buf)363 history_str_free(char *buf)
364 {
365 	kmem_free(buf, HIS_MAX_RECORD_LEN);
366 }
367 
368 static char *
history_str_get(zfs_cmd_t * zc)369 history_str_get(zfs_cmd_t *zc)
370 {
371 	char *buf;
372 
373 	if (zc->zc_history == 0)
374 		return (NULL);
375 
376 	buf = kmem_alloc(HIS_MAX_RECORD_LEN, KM_SLEEP);
377 	if (copyinstr((void *)(uintptr_t)zc->zc_history,
378 	    buf, HIS_MAX_RECORD_LEN, NULL) != 0) {
379 		history_str_free(buf);
380 		return (NULL);
381 	}
382 
383 	buf[HIS_MAX_RECORD_LEN -1] = '\0';
384 
385 	return (buf);
386 }
387 
388 /*
389  * Check to see if the named dataset is currently defined as bootable
390  */
391 static boolean_t
zfs_is_bootfs(const char * name)392 zfs_is_bootfs(const char *name)
393 {
394 	objset_t *os;
395 
396 	if (dmu_objset_hold(name, FTAG, &os) == 0) {
397 		boolean_t ret;
398 		ret = (dmu_objset_id(os) == spa_bootfs(dmu_objset_spa(os)));
399 		dmu_objset_rele(os, FTAG);
400 		return (ret);
401 	}
402 	return (B_FALSE);
403 }
404 
405 /*
406  * Return non-zero if the spa version is less than requested version.
407  */
408 static int
zfs_earlier_version(const char * name,int version)409 zfs_earlier_version(const char *name, int version)
410 {
411 	spa_t *spa;
412 
413 	if (spa_open(name, &spa, FTAG) == 0) {
414 		if (spa_version(spa) < version) {
415 			spa_close(spa, FTAG);
416 			return (1);
417 		}
418 		spa_close(spa, FTAG);
419 	}
420 	return (0);
421 }
422 
423 /*
424  * Return TRUE if the ZPL version is less than requested version.
425  */
426 static boolean_t
zpl_earlier_version(const char * name,int version)427 zpl_earlier_version(const char *name, int version)
428 {
429 	objset_t *os;
430 	boolean_t rc = B_TRUE;
431 
432 	if (dmu_objset_hold(name, FTAG, &os) == 0) {
433 		uint64_t zplversion;
434 
435 		if (dmu_objset_type(os) != DMU_OST_ZFS) {
436 			dmu_objset_rele(os, FTAG);
437 			return (B_TRUE);
438 		}
439 		/* XXX reading from non-owned objset */
440 		if (zfs_get_zplprop(os, ZFS_PROP_VERSION, &zplversion) == 0)
441 			rc = zplversion < version;
442 		dmu_objset_rele(os, FTAG);
443 	}
444 	return (rc);
445 }
446 
447 static void
zfs_log_history(zfs_cmd_t * zc)448 zfs_log_history(zfs_cmd_t *zc)
449 {
450 	spa_t *spa;
451 	char *buf;
452 
453 	if ((buf = history_str_get(zc)) == NULL)
454 		return;
455 
456 	if (spa_open(zc->zc_name, &spa, FTAG) == 0) {
457 		if (spa_version(spa) >= SPA_VERSION_ZPOOL_HISTORY)
458 			(void) spa_history_log(spa, buf);
459 		spa_close(spa, FTAG);
460 	}
461 	history_str_free(buf);
462 }
463 
464 /*
465  * Policy for top-level read operations (list pools).  Requires no privileges,
466  * and can be used in the local zone, as there is no associated dataset.
467  */
468 /* ARGSUSED */
469 static int
zfs_secpolicy_none(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)470 zfs_secpolicy_none(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
471 {
472 	return (0);
473 }
474 
475 /*
476  * Policy for dataset read operations (list children, get statistics).  Requires
477  * no privileges, but must be visible in the local zone.
478  */
479 /* ARGSUSED */
480 static int
zfs_secpolicy_read(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)481 zfs_secpolicy_read(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
482 {
483 	if (INGLOBALZONE(curproc) ||
484 	    zone_dataset_visible(zc->zc_name, NULL))
485 		return (0);
486 
487 	return (SET_ERROR(ENOENT));
488 }
489 
490 static int
zfs_dozonecheck_impl(const char * dataset,uint64_t zoned,cred_t * cr)491 zfs_dozonecheck_impl(const char *dataset, uint64_t zoned, cred_t *cr)
492 {
493 	int writable = 1;
494 
495 	/*
496 	 * The dataset must be visible by this zone -- check this first
497 	 * so they don't see EPERM on something they shouldn't know about.
498 	 */
499 	if (!INGLOBALZONE(curproc) &&
500 	    !zone_dataset_visible(dataset, &writable))
501 		return (SET_ERROR(ENOENT));
502 
503 	if (INGLOBALZONE(curproc)) {
504 		/*
505 		 * If the fs is zoned, only root can access it from the
506 		 * global zone.
507 		 */
508 		if (secpolicy_zfs(cr) && zoned)
509 			return (SET_ERROR(EPERM));
510 	} else {
511 		/*
512 		 * If we are in a local zone, the 'zoned' property must be set.
513 		 */
514 		if (!zoned)
515 			return (SET_ERROR(EPERM));
516 
517 		/* must be writable by this zone */
518 		if (!writable)
519 			return (SET_ERROR(EPERM));
520 	}
521 	return (0);
522 }
523 
524 static int
zfs_dozonecheck(const char * dataset,cred_t * cr)525 zfs_dozonecheck(const char *dataset, cred_t *cr)
526 {
527 	uint64_t zoned;
528 
529 	if (dsl_prop_get_integer(dataset, "zoned", &zoned, NULL))
530 		return (SET_ERROR(ENOENT));
531 
532 	return (zfs_dozonecheck_impl(dataset, zoned, cr));
533 }
534 
535 static int
zfs_dozonecheck_ds(const char * dataset,dsl_dataset_t * ds,cred_t * cr)536 zfs_dozonecheck_ds(const char *dataset, dsl_dataset_t *ds, cred_t *cr)
537 {
538 	uint64_t zoned;
539 
540 	if (dsl_prop_get_int_ds(ds, "zoned", &zoned))
541 		return (SET_ERROR(ENOENT));
542 
543 	return (zfs_dozonecheck_impl(dataset, zoned, cr));
544 }
545 
546 static int
zfs_secpolicy_write_perms_ds(const char * name,dsl_dataset_t * ds,const char * perm,cred_t * cr)547 zfs_secpolicy_write_perms_ds(const char *name, dsl_dataset_t *ds,
548     const char *perm, cred_t *cr)
549 {
550 	int error;
551 
552 	error = zfs_dozonecheck_ds(name, ds, cr);
553 	if (error == 0) {
554 		error = secpolicy_zfs(cr);
555 		if (error != 0)
556 			error = dsl_deleg_access_impl(ds, perm, cr);
557 	}
558 	return (error);
559 }
560 
561 static int
zfs_secpolicy_write_perms(const char * name,const char * perm,cred_t * cr)562 zfs_secpolicy_write_perms(const char *name, const char *perm, cred_t *cr)
563 {
564 	int error;
565 	dsl_dataset_t *ds;
566 	dsl_pool_t *dp;
567 
568 	/*
569 	 * First do a quick check for root in the global zone, which
570 	 * is allowed to do all write_perms.  This ensures that zfs_ioc_*
571 	 * will get to handle nonexistent datasets.
572 	 */
573 	if (INGLOBALZONE(curproc) && secpolicy_zfs(cr) == 0)
574 		return (0);
575 
576 	error = dsl_pool_hold(name, FTAG, &dp);
577 	if (error != 0)
578 		return (error);
579 
580 	error = dsl_dataset_hold(dp, name, FTAG, &ds);
581 	if (error != 0) {
582 		dsl_pool_rele(dp, FTAG);
583 		return (error);
584 	}
585 
586 	error = zfs_secpolicy_write_perms_ds(name, ds, perm, cr);
587 
588 	dsl_dataset_rele(ds, FTAG);
589 	dsl_pool_rele(dp, FTAG);
590 	return (error);
591 }
592 
593 /*
594  * Policy for setting the security label property.
595  *
596  * Returns 0 for success, non-zero for access and other errors.
597  */
598 static int
zfs_set_slabel_policy(const char * name,char * strval,cred_t * cr)599 zfs_set_slabel_policy(const char *name, char *strval, cred_t *cr)
600 {
601 	char		ds_hexsl[MAXNAMELEN];
602 	bslabel_t	ds_sl, new_sl;
603 	boolean_t	new_default = FALSE;
604 	uint64_t	zoned;
605 	int		needed_priv = -1;
606 	int		error;
607 
608 	/* First get the existing dataset label. */
609 	error = dsl_prop_get(name, zfs_prop_to_name(ZFS_PROP_MLSLABEL),
610 	    1, sizeof (ds_hexsl), &ds_hexsl, NULL);
611 	if (error != 0)
612 		return (SET_ERROR(EPERM));
613 
614 	if (strcasecmp(strval, ZFS_MLSLABEL_DEFAULT) == 0)
615 		new_default = TRUE;
616 
617 	/* The label must be translatable */
618 	if (!new_default && (hexstr_to_label(strval, &new_sl) != 0))
619 		return (SET_ERROR(EINVAL));
620 
621 	/*
622 	 * In a non-global zone, disallow attempts to set a label that
623 	 * doesn't match that of the zone; otherwise no other checks
624 	 * are needed.
625 	 */
626 	if (!INGLOBALZONE(curproc)) {
627 		if (new_default || !blequal(&new_sl, CR_SL(CRED())))
628 			return (SET_ERROR(EPERM));
629 		return (0);
630 	}
631 
632 	/*
633 	 * For global-zone datasets (i.e., those whose zoned property is
634 	 * "off", verify that the specified new label is valid for the
635 	 * global zone.
636 	 */
637 	if (dsl_prop_get_integer(name,
638 	    zfs_prop_to_name(ZFS_PROP_ZONED), &zoned, NULL))
639 		return (SET_ERROR(EPERM));
640 	if (!zoned) {
641 		if (zfs_check_global_label(name, strval) != 0)
642 			return (SET_ERROR(EPERM));
643 	}
644 
645 	/*
646 	 * If the existing dataset label is nondefault, check if the
647 	 * dataset is mounted (label cannot be changed while mounted).
648 	 * Get the zfsvfs; if there isn't one, then the dataset isn't
649 	 * mounted (or isn't a dataset, doesn't exist, ...).
650 	 */
651 	if (strcasecmp(ds_hexsl, ZFS_MLSLABEL_DEFAULT) != 0) {
652 		objset_t *os;
653 		static char *setsl_tag = "setsl_tag";
654 
655 		/*
656 		 * Try to own the dataset; abort if there is any error,
657 		 * (e.g., already mounted, in use, or other error).
658 		 */
659 		error = dmu_objset_own(name, DMU_OST_ZFS, B_TRUE, B_TRUE,
660 		    setsl_tag, &os);
661 		if (error != 0)
662 			return (SET_ERROR(EPERM));
663 
664 		dmu_objset_disown(os, B_TRUE, setsl_tag);
665 
666 		if (new_default) {
667 			needed_priv = PRIV_FILE_DOWNGRADE_SL;
668 			goto out_check;
669 		}
670 
671 		if (hexstr_to_label(strval, &new_sl) != 0)
672 			return (SET_ERROR(EPERM));
673 
674 		if (blstrictdom(&ds_sl, &new_sl))
675 			needed_priv = PRIV_FILE_DOWNGRADE_SL;
676 		else if (blstrictdom(&new_sl, &ds_sl))
677 			needed_priv = PRIV_FILE_UPGRADE_SL;
678 	} else {
679 		/* dataset currently has a default label */
680 		if (!new_default)
681 			needed_priv = PRIV_FILE_UPGRADE_SL;
682 	}
683 
684 out_check:
685 	if (needed_priv != -1)
686 		return (PRIV_POLICY(cr, needed_priv, B_FALSE, EPERM, NULL));
687 	return (0);
688 }
689 
690 static int
zfs_secpolicy_setprop(const char * dsname,zfs_prop_t prop,nvpair_t * propval,cred_t * cr)691 zfs_secpolicy_setprop(const char *dsname, zfs_prop_t prop, nvpair_t *propval,
692     cred_t *cr)
693 {
694 	char *strval;
695 
696 	/*
697 	 * Check permissions for special properties.
698 	 */
699 	switch (prop) {
700 	case ZFS_PROP_ZONED:
701 		/*
702 		 * Disallow setting of 'zoned' from within a local zone.
703 		 */
704 		if (!INGLOBALZONE(curproc))
705 			return (SET_ERROR(EPERM));
706 		break;
707 
708 	case ZFS_PROP_QUOTA:
709 	case ZFS_PROP_FILESYSTEM_LIMIT:
710 	case ZFS_PROP_SNAPSHOT_LIMIT:
711 		if (!INGLOBALZONE(curproc)) {
712 			uint64_t zoned;
713 			char setpoint[ZFS_MAX_DATASET_NAME_LEN];
714 			/*
715 			 * Unprivileged users are allowed to modify the
716 			 * limit on things *under* (ie. contained by)
717 			 * the thing they own.
718 			 */
719 			if (dsl_prop_get_integer(dsname, "zoned", &zoned,
720 			    setpoint))
721 				return (SET_ERROR(EPERM));
722 			if (!zoned || strlen(dsname) <= strlen(setpoint))
723 				return (SET_ERROR(EPERM));
724 		}
725 		break;
726 
727 	case ZFS_PROP_MLSLABEL:
728 		if (!is_system_labeled())
729 			return (SET_ERROR(EPERM));
730 
731 		if (nvpair_value_string(propval, &strval) == 0) {
732 			int err;
733 
734 			err = zfs_set_slabel_policy(dsname, strval, CRED());
735 			if (err != 0)
736 				return (err);
737 		}
738 		break;
739 	}
740 
741 	return (zfs_secpolicy_write_perms(dsname, zfs_prop_to_name(prop), cr));
742 }
743 
744 /* ARGSUSED */
745 static int
zfs_secpolicy_set_fsacl(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)746 zfs_secpolicy_set_fsacl(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
747 {
748 	int error;
749 
750 	error = zfs_dozonecheck(zc->zc_name, cr);
751 	if (error != 0)
752 		return (error);
753 
754 	/*
755 	 * permission to set permissions will be evaluated later in
756 	 * dsl_deleg_can_allow()
757 	 */
758 	return (0);
759 }
760 
761 /* ARGSUSED */
762 static int
zfs_secpolicy_rollback(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)763 zfs_secpolicy_rollback(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
764 {
765 	return (zfs_secpolicy_write_perms(zc->zc_name,
766 	    ZFS_DELEG_PERM_ROLLBACK, cr));
767 }
768 
769 /* ARGSUSED */
770 static int
zfs_secpolicy_send(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)771 zfs_secpolicy_send(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
772 {
773 	dsl_pool_t *dp;
774 	dsl_dataset_t *ds;
775 	char *cp;
776 	int error;
777 
778 	/*
779 	 * Generate the current snapshot name from the given objsetid, then
780 	 * use that name for the secpolicy/zone checks.
781 	 */
782 	cp = strchr(zc->zc_name, '@');
783 	if (cp == NULL)
784 		return (SET_ERROR(EINVAL));
785 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
786 	if (error != 0)
787 		return (error);
788 
789 	error = dsl_dataset_hold_obj(dp, zc->zc_sendobj, FTAG, &ds);
790 	if (error != 0) {
791 		dsl_pool_rele(dp, FTAG);
792 		return (error);
793 	}
794 
795 	dsl_dataset_name(ds, zc->zc_name);
796 
797 	error = zfs_secpolicy_write_perms_ds(zc->zc_name, ds,
798 	    ZFS_DELEG_PERM_SEND, cr);
799 	dsl_dataset_rele(ds, FTAG);
800 	dsl_pool_rele(dp, FTAG);
801 
802 	return (error);
803 }
804 
805 /* ARGSUSED */
806 static int
zfs_secpolicy_send_new(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)807 zfs_secpolicy_send_new(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
808 {
809 	return (zfs_secpolicy_write_perms(zc->zc_name,
810 	    ZFS_DELEG_PERM_SEND, cr));
811 }
812 
813 /* ARGSUSED */
814 static int
zfs_secpolicy_deleg_share(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)815 zfs_secpolicy_deleg_share(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
816 {
817 	vnode_t *vp;
818 	int error;
819 
820 	if ((error = lookupname(zc->zc_value, UIO_SYSSPACE,
821 	    NO_FOLLOW, NULL, &vp)) != 0)
822 		return (error);
823 
824 	/* Now make sure mntpnt and dataset are ZFS */
825 
826 	if (vp->v_vfsp->vfs_fstype != zfsfstype ||
827 	    (strcmp((char *)refstr_value(vp->v_vfsp->vfs_resource),
828 	    zc->zc_name) != 0)) {
829 		VN_RELE(vp);
830 		return (SET_ERROR(EPERM));
831 	}
832 
833 	VN_RELE(vp);
834 	return (dsl_deleg_access(zc->zc_name,
835 	    ZFS_DELEG_PERM_SHARE, cr));
836 }
837 
838 int
zfs_secpolicy_share(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)839 zfs_secpolicy_share(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
840 {
841 	if (secpolicy_nfs(cr) == 0) {
842 		return (0);
843 	} else {
844 		return (zfs_secpolicy_deleg_share(zc, innvl, cr));
845 	}
846 }
847 
848 int
zfs_secpolicy_smb_acl(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)849 zfs_secpolicy_smb_acl(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
850 {
851 	if (secpolicy_smb(cr) == 0) {
852 		return (0);
853 	} else {
854 		return (zfs_secpolicy_deleg_share(zc, innvl, cr));
855 	}
856 }
857 
858 static int
zfs_get_parent(const char * datasetname,char * parent,int parentsize)859 zfs_get_parent(const char *datasetname, char *parent, int parentsize)
860 {
861 	char *cp;
862 
863 	/*
864 	 * Remove the @bla or /bla from the end of the name to get the parent.
865 	 */
866 	(void) strncpy(parent, datasetname, parentsize);
867 	cp = strrchr(parent, '@');
868 	if (cp != NULL) {
869 		cp[0] = '\0';
870 	} else {
871 		cp = strrchr(parent, '/');
872 		if (cp == NULL)
873 			return (SET_ERROR(ENOENT));
874 		cp[0] = '\0';
875 	}
876 
877 	return (0);
878 }
879 
880 int
zfs_secpolicy_destroy_perms(const char * name,cred_t * cr)881 zfs_secpolicy_destroy_perms(const char *name, cred_t *cr)
882 {
883 	int error;
884 
885 	if ((error = zfs_secpolicy_write_perms(name,
886 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
887 		return (error);
888 
889 	return (zfs_secpolicy_write_perms(name, ZFS_DELEG_PERM_DESTROY, cr));
890 }
891 
892 /* ARGSUSED */
893 static int
zfs_secpolicy_destroy(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)894 zfs_secpolicy_destroy(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
895 {
896 	return (zfs_secpolicy_destroy_perms(zc->zc_name, cr));
897 }
898 
899 /*
900  * Destroying snapshots with delegated permissions requires
901  * descendant mount and destroy permissions.
902  */
903 /* ARGSUSED */
904 static int
zfs_secpolicy_destroy_snaps(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)905 zfs_secpolicy_destroy_snaps(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
906 {
907 	nvlist_t *snaps;
908 	nvpair_t *pair, *nextpair;
909 	int error = 0;
910 
911 	snaps = fnvlist_lookup_nvlist(innvl, "snaps");
912 
913 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
914 	    pair = nextpair) {
915 		nextpair = nvlist_next_nvpair(snaps, pair);
916 		error = zfs_secpolicy_destroy_perms(nvpair_name(pair), cr);
917 		if (error == ENOENT) {
918 			/*
919 			 * Ignore any snapshots that don't exist (we consider
920 			 * them "already destroyed").  Remove the name from the
921 			 * nvl here in case the snapshot is created between
922 			 * now and when we try to destroy it (in which case
923 			 * we don't want to destroy it since we haven't
924 			 * checked for permission).
925 			 */
926 			fnvlist_remove_nvpair(snaps, pair);
927 			error = 0;
928 		}
929 		if (error != 0)
930 			break;
931 	}
932 
933 	return (error);
934 }
935 
936 int
zfs_secpolicy_rename_perms(const char * from,const char * to,cred_t * cr)937 zfs_secpolicy_rename_perms(const char *from, const char *to, cred_t *cr)
938 {
939 	char	parentname[ZFS_MAX_DATASET_NAME_LEN];
940 	int	error;
941 
942 	if ((error = zfs_secpolicy_write_perms(from,
943 	    ZFS_DELEG_PERM_RENAME, cr)) != 0)
944 		return (error);
945 
946 	if ((error = zfs_secpolicy_write_perms(from,
947 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
948 		return (error);
949 
950 	if ((error = zfs_get_parent(to, parentname,
951 	    sizeof (parentname))) != 0)
952 		return (error);
953 
954 	if ((error = zfs_secpolicy_write_perms(parentname,
955 	    ZFS_DELEG_PERM_CREATE, cr)) != 0)
956 		return (error);
957 
958 	if ((error = zfs_secpolicy_write_perms(parentname,
959 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
960 		return (error);
961 
962 	return (error);
963 }
964 
965 /* ARGSUSED */
966 static int
zfs_secpolicy_rename(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)967 zfs_secpolicy_rename(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
968 {
969 	return (zfs_secpolicy_rename_perms(zc->zc_name, zc->zc_value, cr));
970 }
971 
972 /* ARGSUSED */
973 static int
zfs_secpolicy_promote(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)974 zfs_secpolicy_promote(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
975 {
976 	dsl_pool_t *dp;
977 	dsl_dataset_t *clone;
978 	int error;
979 
980 	error = zfs_secpolicy_write_perms(zc->zc_name,
981 	    ZFS_DELEG_PERM_PROMOTE, cr);
982 	if (error != 0)
983 		return (error);
984 
985 	error = dsl_pool_hold(zc->zc_name, FTAG, &dp);
986 	if (error != 0)
987 		return (error);
988 
989 	error = dsl_dataset_hold(dp, zc->zc_name, FTAG, &clone);
990 
991 	if (error == 0) {
992 		char parentname[ZFS_MAX_DATASET_NAME_LEN];
993 		dsl_dataset_t *origin = NULL;
994 		dsl_dir_t *dd;
995 		dd = clone->ds_dir;
996 
997 		error = dsl_dataset_hold_obj(dd->dd_pool,
998 		    dsl_dir_phys(dd)->dd_origin_obj, FTAG, &origin);
999 		if (error != 0) {
1000 			dsl_dataset_rele(clone, FTAG);
1001 			dsl_pool_rele(dp, FTAG);
1002 			return (error);
1003 		}
1004 
1005 		error = zfs_secpolicy_write_perms_ds(zc->zc_name, clone,
1006 		    ZFS_DELEG_PERM_MOUNT, cr);
1007 
1008 		dsl_dataset_name(origin, parentname);
1009 		if (error == 0) {
1010 			error = zfs_secpolicy_write_perms_ds(parentname, origin,
1011 			    ZFS_DELEG_PERM_PROMOTE, cr);
1012 		}
1013 		dsl_dataset_rele(clone, FTAG);
1014 		dsl_dataset_rele(origin, FTAG);
1015 	}
1016 	dsl_pool_rele(dp, FTAG);
1017 	return (error);
1018 }
1019 
1020 /* ARGSUSED */
1021 static int
zfs_secpolicy_recv(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1022 zfs_secpolicy_recv(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1023 {
1024 	int error;
1025 
1026 	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
1027 	    ZFS_DELEG_PERM_RECEIVE, cr)) != 0)
1028 		return (error);
1029 
1030 	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
1031 	    ZFS_DELEG_PERM_MOUNT, cr)) != 0)
1032 		return (error);
1033 
1034 	return (zfs_secpolicy_write_perms(zc->zc_name,
1035 	    ZFS_DELEG_PERM_CREATE, cr));
1036 }
1037 
1038 int
zfs_secpolicy_snapshot_perms(const char * name,cred_t * cr)1039 zfs_secpolicy_snapshot_perms(const char *name, cred_t *cr)
1040 {
1041 	return (zfs_secpolicy_write_perms(name,
1042 	    ZFS_DELEG_PERM_SNAPSHOT, cr));
1043 }
1044 
1045 /*
1046  * Check for permission to create each snapshot in the nvlist.
1047  */
1048 /* ARGSUSED */
1049 static int
zfs_secpolicy_snapshot(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1050 zfs_secpolicy_snapshot(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1051 {
1052 	nvlist_t *snaps;
1053 	int error = 0;
1054 	nvpair_t *pair;
1055 
1056 	snaps = fnvlist_lookup_nvlist(innvl, "snaps");
1057 
1058 	for (pair = nvlist_next_nvpair(snaps, NULL); pair != NULL;
1059 	    pair = nvlist_next_nvpair(snaps, pair)) {
1060 		char *name = nvpair_name(pair);
1061 		char *atp = strchr(name, '@');
1062 
1063 		if (atp == NULL) {
1064 			error = SET_ERROR(EINVAL);
1065 			break;
1066 		}
1067 		*atp = '\0';
1068 		error = zfs_secpolicy_snapshot_perms(name, cr);
1069 		*atp = '@';
1070 		if (error != 0)
1071 			break;
1072 	}
1073 	return (error);
1074 }
1075 
1076 /*
1077  * Check for permission to create each bookmark in the nvlist.
1078  */
1079 /* ARGSUSED */
1080 static int
zfs_secpolicy_bookmark(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1081 zfs_secpolicy_bookmark(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1082 {
1083 	int error = 0;
1084 
1085 	for (nvpair_t *pair = nvlist_next_nvpair(innvl, NULL);
1086 	    pair != NULL; pair = nvlist_next_nvpair(innvl, pair)) {
1087 		char *name = nvpair_name(pair);
1088 		char *hashp = strchr(name, '#');
1089 
1090 		if (hashp == NULL) {
1091 			error = SET_ERROR(EINVAL);
1092 			break;
1093 		}
1094 		*hashp = '\0';
1095 		error = zfs_secpolicy_write_perms(name,
1096 		    ZFS_DELEG_PERM_BOOKMARK, cr);
1097 		*hashp = '#';
1098 		if (error != 0)
1099 			break;
1100 	}
1101 	return (error);
1102 }
1103 
1104 /* ARGSUSED */
1105 static int
zfs_secpolicy_remap(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1106 zfs_secpolicy_remap(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1107 {
1108 	return (zfs_secpolicy_write_perms(zc->zc_name,
1109 	    ZFS_DELEG_PERM_REMAP, cr));
1110 }
1111 
1112 /* ARGSUSED */
1113 static int
zfs_secpolicy_destroy_bookmarks(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1114 zfs_secpolicy_destroy_bookmarks(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1115 {
1116 	nvpair_t *pair, *nextpair;
1117 	int error = 0;
1118 
1119 	for (pair = nvlist_next_nvpair(innvl, NULL); pair != NULL;
1120 	    pair = nextpair) {
1121 		char *name = nvpair_name(pair);
1122 		char *hashp = strchr(name, '#');
1123 		nextpair = nvlist_next_nvpair(innvl, pair);
1124 
1125 		if (hashp == NULL) {
1126 			error = SET_ERROR(EINVAL);
1127 			break;
1128 		}
1129 
1130 		*hashp = '\0';
1131 		error = zfs_secpolicy_write_perms(name,
1132 		    ZFS_DELEG_PERM_DESTROY, cr);
1133 		*hashp = '#';
1134 		if (error == ENOENT) {
1135 			/*
1136 			 * Ignore any filesystems that don't exist (we consider
1137 			 * their bookmarks "already destroyed").  Remove
1138 			 * the name from the nvl here in case the filesystem
1139 			 * is created between now and when we try to destroy
1140 			 * the bookmark (in which case we don't want to
1141 			 * destroy it since we haven't checked for permission).
1142 			 */
1143 			fnvlist_remove_nvpair(innvl, pair);
1144 			error = 0;
1145 		}
1146 		if (error != 0)
1147 			break;
1148 	}
1149 
1150 	return (error);
1151 }
1152 
1153 /* ARGSUSED */
1154 static int
zfs_secpolicy_log_history(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1155 zfs_secpolicy_log_history(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1156 {
1157 	/*
1158 	 * Even root must have a proper TSD so that we know what pool
1159 	 * to log to.
1160 	 */
1161 	if (tsd_get(zfs_allow_log_key) == NULL)
1162 		return (SET_ERROR(EPERM));
1163 	return (0);
1164 }
1165 
1166 static int
zfs_secpolicy_create_clone(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1167 zfs_secpolicy_create_clone(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1168 {
1169 	char	parentname[ZFS_MAX_DATASET_NAME_LEN];
1170 	int	error;
1171 	char	*origin;
1172 
1173 	if ((error = zfs_get_parent(zc->zc_name, parentname,
1174 	    sizeof (parentname))) != 0)
1175 		return (error);
1176 
1177 	if (nvlist_lookup_string(innvl, "origin", &origin) == 0 &&
1178 	    (error = zfs_secpolicy_write_perms(origin,
1179 	    ZFS_DELEG_PERM_CLONE, cr)) != 0)
1180 		return (error);
1181 
1182 	if ((error = zfs_secpolicy_write_perms(parentname,
1183 	    ZFS_DELEG_PERM_CREATE, cr)) != 0)
1184 		return (error);
1185 
1186 	return (zfs_secpolicy_write_perms(parentname,
1187 	    ZFS_DELEG_PERM_MOUNT, cr));
1188 }
1189 
1190 /*
1191  * Policy for pool operations - create/destroy pools, add vdevs, etc.  Requires
1192  * SYS_CONFIG privilege, which is not available in a local zone.
1193  */
1194 /* ARGSUSED */
1195 static int
zfs_secpolicy_config(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1196 zfs_secpolicy_config(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1197 {
1198 	if (secpolicy_sys_config(cr, B_FALSE) != 0)
1199 		return (SET_ERROR(EPERM));
1200 
1201 	return (0);
1202 }
1203 
1204 /*
1205  * Policy for object to name lookups.
1206  */
1207 /* ARGSUSED */
1208 static int
zfs_secpolicy_diff(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1209 zfs_secpolicy_diff(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1210 {
1211 	int error;
1212 
1213 	if ((error = secpolicy_sys_config(cr, B_FALSE)) == 0)
1214 		return (0);
1215 
1216 	error = zfs_secpolicy_write_perms(zc->zc_name, ZFS_DELEG_PERM_DIFF, cr);
1217 	return (error);
1218 }
1219 
1220 /*
1221  * Policy for fault injection.  Requires all privileges.
1222  */
1223 /* ARGSUSED */
1224 static int
zfs_secpolicy_inject(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1225 zfs_secpolicy_inject(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1226 {
1227 	return (secpolicy_zinject(cr));
1228 }
1229 
1230 /* ARGSUSED */
1231 static int
zfs_secpolicy_inherit_prop(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1232 zfs_secpolicy_inherit_prop(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1233 {
1234 	zfs_prop_t prop = zfs_name_to_prop(zc->zc_value);
1235 
1236 	if (prop == ZPROP_INVAL) {
1237 		if (!zfs_prop_user(zc->zc_value))
1238 			return (SET_ERROR(EINVAL));
1239 		return (zfs_secpolicy_write_perms(zc->zc_name,
1240 		    ZFS_DELEG_PERM_USERPROP, cr));
1241 	} else {
1242 		return (zfs_secpolicy_setprop(zc->zc_name, prop,
1243 		    NULL, cr));
1244 	}
1245 }
1246 
1247 static int
zfs_secpolicy_userspace_one(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1248 zfs_secpolicy_userspace_one(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1249 {
1250 	int err = zfs_secpolicy_read(zc, innvl, cr);
1251 	if (err)
1252 		return (err);
1253 
1254 	if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
1255 		return (SET_ERROR(EINVAL));
1256 
1257 	if (zc->zc_value[0] == 0) {
1258 		/*
1259 		 * They are asking about a posix uid/gid.  If it's
1260 		 * themself, allow it.
1261 		 */
1262 		if (zc->zc_objset_type == ZFS_PROP_USERUSED ||
1263 		    zc->zc_objset_type == ZFS_PROP_USERQUOTA ||
1264 		    zc->zc_objset_type == ZFS_PROP_USEROBJUSED ||
1265 		    zc->zc_objset_type == ZFS_PROP_USEROBJQUOTA) {
1266 			if (zc->zc_guid == crgetuid(cr))
1267 				return (0);
1268 		} else if (zc->zc_objset_type == ZFS_PROP_GROUPUSED ||
1269 		    zc->zc_objset_type == ZFS_PROP_GROUPQUOTA ||
1270 		    zc->zc_objset_type == ZFS_PROP_GROUPOBJUSED ||
1271 		    zc->zc_objset_type == ZFS_PROP_GROUPOBJQUOTA) {
1272 			if (groupmember(zc->zc_guid, cr))
1273 				return (0);
1274 		}
1275 		/* else is for project quota/used */
1276 	}
1277 
1278 	return (zfs_secpolicy_write_perms(zc->zc_name,
1279 	    userquota_perms[zc->zc_objset_type], cr));
1280 }
1281 
1282 static int
zfs_secpolicy_userspace_many(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1283 zfs_secpolicy_userspace_many(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1284 {
1285 	int err = zfs_secpolicy_read(zc, innvl, cr);
1286 	if (err)
1287 		return (err);
1288 
1289 	if (zc->zc_objset_type >= ZFS_NUM_USERQUOTA_PROPS)
1290 		return (SET_ERROR(EINVAL));
1291 
1292 	return (zfs_secpolicy_write_perms(zc->zc_name,
1293 	    userquota_perms[zc->zc_objset_type], cr));
1294 }
1295 
1296 /* ARGSUSED */
1297 static int
zfs_secpolicy_userspace_upgrade(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1298 zfs_secpolicy_userspace_upgrade(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1299 {
1300 	return (zfs_secpolicy_setprop(zc->zc_name, ZFS_PROP_VERSION,
1301 	    NULL, cr));
1302 }
1303 
1304 /* ARGSUSED */
1305 static int
zfs_secpolicy_hold(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1306 zfs_secpolicy_hold(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1307 {
1308 	nvpair_t *pair;
1309 	nvlist_t *holds;
1310 	int error;
1311 
1312 	holds = fnvlist_lookup_nvlist(innvl, "holds");
1313 
1314 	for (pair = nvlist_next_nvpair(holds, NULL); pair != NULL;
1315 	    pair = nvlist_next_nvpair(holds, pair)) {
1316 		char fsname[ZFS_MAX_DATASET_NAME_LEN];
1317 		error = dmu_fsname(nvpair_name(pair), fsname);
1318 		if (error != 0)
1319 			return (error);
1320 		error = zfs_secpolicy_write_perms(fsname,
1321 		    ZFS_DELEG_PERM_HOLD, cr);
1322 		if (error != 0)
1323 			return (error);
1324 	}
1325 	return (0);
1326 }
1327 
1328 /* ARGSUSED */
1329 static int
zfs_secpolicy_release(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1330 zfs_secpolicy_release(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1331 {
1332 	nvpair_t *pair;
1333 	int error;
1334 
1335 	for (pair = nvlist_next_nvpair(innvl, NULL); pair != NULL;
1336 	    pair = nvlist_next_nvpair(innvl, pair)) {
1337 		char fsname[ZFS_MAX_DATASET_NAME_LEN];
1338 		error = dmu_fsname(nvpair_name(pair), fsname);
1339 		if (error != 0)
1340 			return (error);
1341 		error = zfs_secpolicy_write_perms(fsname,
1342 		    ZFS_DELEG_PERM_RELEASE, cr);
1343 		if (error != 0)
1344 			return (error);
1345 	}
1346 	return (0);
1347 }
1348 
1349 /* ARGSUSED */
1350 static int
zfs_secpolicy_load_key(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1351 zfs_secpolicy_load_key(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1352 {
1353 	return (zfs_secpolicy_write_perms(zc->zc_name,
1354 	    ZFS_DELEG_PERM_LOAD_KEY, cr));
1355 }
1356 
1357 /* ARGSUSED */
1358 static int
zfs_secpolicy_change_key(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1359 zfs_secpolicy_change_key(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1360 {
1361 	return (zfs_secpolicy_write_perms(zc->zc_name,
1362 	    ZFS_DELEG_PERM_CHANGE_KEY, cr));
1363 }
1364 
1365 /*
1366  * Policy for allowing temporary snapshots to be taken or released
1367  */
1368 static int
zfs_secpolicy_tmp_snapshot(zfs_cmd_t * zc,nvlist_t * innvl,cred_t * cr)1369 zfs_secpolicy_tmp_snapshot(zfs_cmd_t *zc, nvlist_t *innvl, cred_t *cr)
1370 {
1371 	/*
1372 	 * A temporary snapshot is the same as a snapshot,
1373 	 * hold, destroy and release all rolled into one.
1374 	 * Delegated diff alone is sufficient that we allow this.
1375 	 */
1376 	int error;
1377 
1378 	if ((error = zfs_secpolicy_write_perms(zc->zc_name,
1379 	    ZFS_DELEG_PERM_DIFF, cr)) == 0)
1380 		return (0);
1381 
1382 	error = zfs_secpolicy_snapshot_perms(zc->zc_name, cr);
1383 
1384 	if (innvl != NULL) {
1385 		if (error == 0)
1386 			error = zfs_secpolicy_hold(zc, innvl, cr);
1387 		if (error == 0)
1388 			error = zfs_secpolicy_release(zc, innvl, cr);
1389 		if (error == 0)
1390 			error = zfs_secpolicy_destroy(zc, innvl, cr);
1391 	}
1392 	return (error);
1393 }
1394 
1395 /*
1396  * Returns the nvlist as specified by the user in the zfs_cmd_t.
1397  */
1398 static int
get_nvlist(uint64_t nvl,uint64_t size,int iflag,nvlist_t ** nvp)1399 get_nvlist(uint64_t nvl, uint64_t size, int iflag, nvlist_t **nvp)
1400 {
1401 	char *packed;
1402 	int error;
1403 	nvlist_t *list = NULL;
1404 
1405 	/*
1406 	 * Read in and unpack the user-supplied nvlist.
1407 	 */
1408 	if (size == 0)
1409 		return (SET_ERROR(EINVAL));
1410 
1411 	packed = kmem_alloc(size, KM_SLEEP);
1412 
1413 	if ((error = ddi_copyin((void *)(uintptr_t)nvl, packed, size,
1414 	    iflag)) != 0) {
1415 		kmem_free(packed, size);
1416 		return (SET_ERROR(EFAULT));
1417 	}
1418 
1419 	if ((error = nvlist_unpack(packed, size, &list, 0)) != 0) {
1420 		kmem_free(packed, size);
1421 		return (error);
1422 	}
1423 
1424 	kmem_free(packed, size);
1425 
1426 	*nvp = list;
1427 	return (0);
1428 }
1429 
1430 /*
1431  * Reduce the size of this nvlist until it can be serialized in 'max' bytes.
1432  * Entries will be removed from the end of the nvlist, and one int32 entry
1433  * named "N_MORE_ERRORS" will be added indicating how many entries were
1434  * removed.
1435  */
1436 static int
nvlist_smush(nvlist_t * errors,size_t max)1437 nvlist_smush(nvlist_t *errors, size_t max)
1438 {
1439 	size_t size;
1440 
1441 	size = fnvlist_size(errors);
1442 
1443 	if (size > max) {
1444 		nvpair_t *more_errors;
1445 		int n = 0;
1446 
1447 		if (max < 1024)
1448 			return (SET_ERROR(ENOMEM));
1449 
1450 		fnvlist_add_int32(errors, ZPROP_N_MORE_ERRORS, 0);
1451 		more_errors = nvlist_prev_nvpair(errors, NULL);
1452 
1453 		do {
1454 			nvpair_t *pair = nvlist_prev_nvpair(errors,
1455 			    more_errors);
1456 			fnvlist_remove_nvpair(errors, pair);
1457 			n++;
1458 			size = fnvlist_size(errors);
1459 		} while (size > max);
1460 
1461 		fnvlist_remove_nvpair(errors, more_errors);
1462 		fnvlist_add_int32(errors, ZPROP_N_MORE_ERRORS, n);
1463 		ASSERT3U(fnvlist_size(errors), <=, max);
1464 	}
1465 
1466 	return (0);
1467 }
1468 
1469 static int
put_nvlist(zfs_cmd_t * zc,nvlist_t * nvl)1470 put_nvlist(zfs_cmd_t *zc, nvlist_t *nvl)
1471 {
1472 	char *packed = NULL;
1473 	int error = 0;
1474 	size_t size;
1475 
1476 	size = fnvlist_size(nvl);
1477 
1478 	if (size > zc->zc_nvlist_dst_size) {
1479 		error = SET_ERROR(ENOMEM);
1480 	} else {
1481 		packed = fnvlist_pack(nvl, &size);
1482 		if (ddi_copyout(packed, (void *)(uintptr_t)zc->zc_nvlist_dst,
1483 		    size, zc->zc_iflags) != 0)
1484 			error = SET_ERROR(EFAULT);
1485 		fnvlist_pack_free(packed, size);
1486 	}
1487 
1488 	zc->zc_nvlist_dst_size = size;
1489 	zc->zc_nvlist_dst_filled = B_TRUE;
1490 	return (error);
1491 }
1492 
1493 int
getzfsvfs_impl(objset_t * os,zfsvfs_t ** zfvp)1494 getzfsvfs_impl(objset_t *os, zfsvfs_t **zfvp)
1495 {
1496 	int error = 0;
1497 	if (dmu_objset_type(os) != DMU_OST_ZFS) {
1498 		return (SET_ERROR(EINVAL));
1499 	}
1500 
1501 	mutex_enter(&os->os_user_ptr_lock);
1502 	*zfvp = dmu_objset_get_user(os);
1503 	if (*zfvp) {
1504 		VFS_HOLD((*zfvp)->z_vfs);
1505 	} else {
1506 		error = SET_ERROR(ESRCH);
1507 	}
1508 	mutex_exit(&os->os_user_ptr_lock);
1509 	return (error);
1510 }
1511 
1512 int
getzfsvfs(const char * dsname,zfsvfs_t ** zfvp)1513 getzfsvfs(const char *dsname, zfsvfs_t **zfvp)
1514 {
1515 	objset_t *os;
1516 	int error;
1517 
1518 	error = dmu_objset_hold(dsname, FTAG, &os);
1519 	if (error != 0)
1520 		return (error);
1521 
1522 	error = getzfsvfs_impl(os, zfvp);
1523 	dmu_objset_rele(os, FTAG);
1524 	return (error);
1525 }
1526 
1527 /*
1528  * Find a zfsvfs_t for a mounted filesystem, or create our own, in which
1529  * case its z_vfs will be NULL, and it will be opened as the owner.
1530  * If 'writer' is set, the z_teardown_lock will be held for RW_WRITER,
1531  * which prevents all vnode ops from running.
1532  */
1533 static int
zfsvfs_hold(const char * name,void * tag,zfsvfs_t ** zfvp,boolean_t writer)1534 zfsvfs_hold(const char *name, void *tag, zfsvfs_t **zfvp, boolean_t writer)
1535 {
1536 	int error = 0;
1537 
1538 	if (getzfsvfs(name, zfvp) != 0)
1539 		error = zfsvfs_create(name, B_FALSE, zfvp);
1540 	if (error == 0) {
1541 		rrm_enter(&(*zfvp)->z_teardown_lock, (writer) ? RW_WRITER :
1542 		    RW_READER, tag);
1543 		if ((*zfvp)->z_unmounted) {
1544 			/*
1545 			 * XXX we could probably try again, since the unmounting
1546 			 * thread should be just about to disassociate the
1547 			 * objset from the zfsvfs.
1548 			 */
1549 			rrm_exit(&(*zfvp)->z_teardown_lock, tag);
1550 			return (SET_ERROR(EBUSY));
1551 		}
1552 	}
1553 	return (error);
1554 }
1555 
1556 static void
zfsvfs_rele(zfsvfs_t * zfsvfs,void * tag)1557 zfsvfs_rele(zfsvfs_t *zfsvfs, void *tag)
1558 {
1559 	rrm_exit(&zfsvfs->z_teardown_lock, tag);
1560 
1561 	if (zfsvfs->z_vfs) {
1562 		VFS_RELE(zfsvfs->z_vfs);
1563 	} else {
1564 		dmu_objset_disown(zfsvfs->z_os, B_TRUE, zfsvfs);
1565 		zfsvfs_free(zfsvfs);
1566 	}
1567 }
1568 
1569 static int
zfs_ioc_pool_create(zfs_cmd_t * zc)1570 zfs_ioc_pool_create(zfs_cmd_t *zc)
1571 {
1572 	int error;
1573 	nvlist_t *config, *props = NULL;
1574 	nvlist_t *rootprops = NULL;
1575 	nvlist_t *zplprops = NULL;
1576 	char *spa_name = zc->zc_name;
1577 	dsl_crypto_params_t *dcp = NULL;
1578 
1579 	if (error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1580 	    zc->zc_iflags, &config))
1581 		return (error);
1582 
1583 	if (zc->zc_nvlist_src_size != 0 && (error =
1584 	    get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
1585 	    zc->zc_iflags, &props))) {
1586 		nvlist_free(config);
1587 		return (error);
1588 	}
1589 
1590 	if (props) {
1591 		nvlist_t *nvl = NULL;
1592 		nvlist_t *hidden_args = NULL;
1593 		uint64_t version = SPA_VERSION;
1594 		char *tname;
1595 
1596 		(void) nvlist_lookup_uint64(props,
1597 		    zpool_prop_to_name(ZPOOL_PROP_VERSION), &version);
1598 		if (!SPA_VERSION_IS_SUPPORTED(version)) {
1599 			error = SET_ERROR(EINVAL);
1600 			goto pool_props_bad;
1601 		}
1602 		(void) nvlist_lookup_nvlist(props, ZPOOL_ROOTFS_PROPS, &nvl);
1603 		if (nvl) {
1604 			error = nvlist_dup(nvl, &rootprops, KM_SLEEP);
1605 			if (error != 0) {
1606 				nvlist_free(config);
1607 				nvlist_free(props);
1608 				return (error);
1609 			}
1610 			(void) nvlist_remove_all(props, ZPOOL_ROOTFS_PROPS);
1611 		}
1612 
1613 		(void) nvlist_lookup_nvlist(props, ZPOOL_HIDDEN_ARGS,
1614 		    &hidden_args);
1615 		error = dsl_crypto_params_create_nvlist(DCP_CMD_NONE,
1616 		    rootprops, hidden_args, &dcp);
1617 		if (error != 0) {
1618 			nvlist_free(config);
1619 			nvlist_free(props);
1620 			return (error);
1621 		}
1622 		(void) nvlist_remove_all(props, ZPOOL_HIDDEN_ARGS);
1623 
1624 		VERIFY(nvlist_alloc(&zplprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
1625 		error = zfs_fill_zplprops_root(version, rootprops,
1626 		    zplprops, NULL);
1627 		if (error != 0)
1628 			goto pool_props_bad;
1629 
1630 		if (nvlist_lookup_string(props,
1631 		    zpool_prop_to_name(ZPOOL_PROP_TNAME), &tname) == 0)
1632 			spa_name = tname;
1633 	}
1634 
1635 	error = spa_create(zc->zc_name, config, props, zplprops, dcp);
1636 
1637 	/*
1638 	 * Set the remaining root properties
1639 	 */
1640 	if (!error && (error = zfs_set_prop_nvlist(spa_name,
1641 	    ZPROP_SRC_LOCAL, rootprops, NULL)) != 0)
1642 		(void) spa_destroy(spa_name);
1643 
1644 pool_props_bad:
1645 	nvlist_free(rootprops);
1646 	nvlist_free(zplprops);
1647 	nvlist_free(config);
1648 	nvlist_free(props);
1649 	dsl_crypto_params_free(dcp, !!error);
1650 
1651 	return (error);
1652 }
1653 
1654 static int
zfs_ioc_pool_destroy(zfs_cmd_t * zc)1655 zfs_ioc_pool_destroy(zfs_cmd_t *zc)
1656 {
1657 	int error;
1658 	zfs_log_history(zc);
1659 	error = spa_destroy(zc->zc_name);
1660 	if (error == 0)
1661 		zvol_remove_minors(zc->zc_name);
1662 	return (error);
1663 }
1664 
1665 static int
zfs_ioc_pool_import(zfs_cmd_t * zc)1666 zfs_ioc_pool_import(zfs_cmd_t *zc)
1667 {
1668 	nvlist_t *config, *props = NULL;
1669 	uint64_t guid;
1670 	int error;
1671 
1672 	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1673 	    zc->zc_iflags, &config)) != 0)
1674 		return (error);
1675 
1676 	if (zc->zc_nvlist_src_size != 0 && (error =
1677 	    get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
1678 	    zc->zc_iflags, &props))) {
1679 		nvlist_free(config);
1680 		return (error);
1681 	}
1682 
1683 	if (nvlist_lookup_uint64(config, ZPOOL_CONFIG_POOL_GUID, &guid) != 0 ||
1684 	    guid != zc->zc_guid)
1685 		error = SET_ERROR(EINVAL);
1686 	else
1687 		error = spa_import(zc->zc_name, config, props, zc->zc_cookie);
1688 
1689 	if (zc->zc_nvlist_dst != 0) {
1690 		int err;
1691 
1692 		if ((err = put_nvlist(zc, config)) != 0)
1693 			error = err;
1694 	}
1695 
1696 	nvlist_free(config);
1697 
1698 	nvlist_free(props);
1699 
1700 	return (error);
1701 }
1702 
1703 static int
zfs_ioc_pool_export(zfs_cmd_t * zc)1704 zfs_ioc_pool_export(zfs_cmd_t *zc)
1705 {
1706 	int error;
1707 	boolean_t force = (boolean_t)zc->zc_cookie;
1708 	boolean_t hardforce = (boolean_t)zc->zc_guid;
1709 
1710 	zfs_log_history(zc);
1711 	error = spa_export(zc->zc_name, NULL, force, hardforce);
1712 	if (error == 0)
1713 		zvol_remove_minors(zc->zc_name);
1714 	return (error);
1715 }
1716 
1717 static int
zfs_ioc_pool_configs(zfs_cmd_t * zc)1718 zfs_ioc_pool_configs(zfs_cmd_t *zc)
1719 {
1720 	nvlist_t *configs;
1721 	int error;
1722 
1723 	if ((configs = spa_all_configs(&zc->zc_cookie)) == NULL)
1724 		return (SET_ERROR(EEXIST));
1725 
1726 	error = put_nvlist(zc, configs);
1727 
1728 	nvlist_free(configs);
1729 
1730 	return (error);
1731 }
1732 
1733 /*
1734  * inputs:
1735  * zc_name		name of the pool
1736  *
1737  * outputs:
1738  * zc_cookie		real errno
1739  * zc_nvlist_dst	config nvlist
1740  * zc_nvlist_dst_size	size of config nvlist
1741  */
1742 static int
zfs_ioc_pool_stats(zfs_cmd_t * zc)1743 zfs_ioc_pool_stats(zfs_cmd_t *zc)
1744 {
1745 	nvlist_t *config;
1746 	int error;
1747 	int ret = 0;
1748 
1749 	error = spa_get_stats(zc->zc_name, &config, zc->zc_value,
1750 	    sizeof (zc->zc_value));
1751 
1752 	if (config != NULL) {
1753 		ret = put_nvlist(zc, config);
1754 		nvlist_free(config);
1755 
1756 		/*
1757 		 * The config may be present even if 'error' is non-zero.
1758 		 * In this case we return success, and preserve the real errno
1759 		 * in 'zc_cookie'.
1760 		 */
1761 		zc->zc_cookie = error;
1762 	} else {
1763 		ret = error;
1764 	}
1765 
1766 	return (ret);
1767 }
1768 
1769 /*
1770  * Try to import the given pool, returning pool stats as appropriate so that
1771  * user land knows which devices are available and overall pool health.
1772  */
1773 static int
zfs_ioc_pool_tryimport(zfs_cmd_t * zc)1774 zfs_ioc_pool_tryimport(zfs_cmd_t *zc)
1775 {
1776 	nvlist_t *tryconfig, *config;
1777 	int error;
1778 
1779 	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1780 	    zc->zc_iflags, &tryconfig)) != 0)
1781 		return (error);
1782 
1783 	config = spa_tryimport(tryconfig);
1784 
1785 	nvlist_free(tryconfig);
1786 
1787 	if (config == NULL)
1788 		return (SET_ERROR(EINVAL));
1789 
1790 	error = put_nvlist(zc, config);
1791 	nvlist_free(config);
1792 
1793 	return (error);
1794 }
1795 
1796 /*
1797  * inputs:
1798  * zc_name              name of the pool
1799  * zc_cookie            scan func (pool_scan_func_t)
1800  * zc_flags             scrub pause/resume flag (pool_scrub_cmd_t)
1801  */
1802 static int
zfs_ioc_pool_scan(zfs_cmd_t * zc)1803 zfs_ioc_pool_scan(zfs_cmd_t *zc)
1804 {
1805 	spa_t *spa;
1806 	int error;
1807 
1808 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1809 		return (error);
1810 
1811 	if (zc->zc_flags >= POOL_SCRUB_FLAGS_END)
1812 		return (SET_ERROR(EINVAL));
1813 
1814 	if (zc->zc_flags == POOL_SCRUB_PAUSE)
1815 		error = spa_scrub_pause_resume(spa, POOL_SCRUB_PAUSE);
1816 	else if (zc->zc_cookie == POOL_SCAN_NONE)
1817 		error = spa_scan_stop(spa);
1818 	else
1819 		error = spa_scan(spa, zc->zc_cookie);
1820 
1821 	spa_close(spa, FTAG);
1822 
1823 	return (error);
1824 }
1825 
1826 static int
zfs_ioc_pool_freeze(zfs_cmd_t * zc)1827 zfs_ioc_pool_freeze(zfs_cmd_t *zc)
1828 {
1829 	spa_t *spa;
1830 	int error;
1831 
1832 	error = spa_open(zc->zc_name, &spa, FTAG);
1833 	if (error == 0) {
1834 		spa_freeze(spa);
1835 		spa_close(spa, FTAG);
1836 	}
1837 	return (error);
1838 }
1839 
1840 static int
zfs_ioc_pool_upgrade(zfs_cmd_t * zc)1841 zfs_ioc_pool_upgrade(zfs_cmd_t *zc)
1842 {
1843 	spa_t *spa;
1844 	int error;
1845 
1846 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1847 		return (error);
1848 
1849 	if (zc->zc_cookie < spa_version(spa) ||
1850 	    !SPA_VERSION_IS_SUPPORTED(zc->zc_cookie)) {
1851 		spa_close(spa, FTAG);
1852 		return (SET_ERROR(EINVAL));
1853 	}
1854 
1855 	spa_upgrade(spa, zc->zc_cookie);
1856 	spa_close(spa, FTAG);
1857 
1858 	return (error);
1859 }
1860 
1861 static int
zfs_ioc_pool_get_history(zfs_cmd_t * zc)1862 zfs_ioc_pool_get_history(zfs_cmd_t *zc)
1863 {
1864 	spa_t *spa;
1865 	char *hist_buf;
1866 	uint64_t size;
1867 	int error;
1868 
1869 	if ((size = zc->zc_history_len) == 0)
1870 		return (SET_ERROR(EINVAL));
1871 
1872 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
1873 		return (error);
1874 
1875 	if (spa_version(spa) < SPA_VERSION_ZPOOL_HISTORY) {
1876 		spa_close(spa, FTAG);
1877 		return (SET_ERROR(ENOTSUP));
1878 	}
1879 
1880 	hist_buf = kmem_alloc(size, KM_SLEEP);
1881 	if ((error = spa_history_get(spa, &zc->zc_history_offset,
1882 	    &zc->zc_history_len, hist_buf)) == 0) {
1883 		error = ddi_copyout(hist_buf,
1884 		    (void *)(uintptr_t)zc->zc_history,
1885 		    zc->zc_history_len, zc->zc_iflags);
1886 	}
1887 
1888 	spa_close(spa, FTAG);
1889 	kmem_free(hist_buf, size);
1890 	return (error);
1891 }
1892 
1893 static int
zfs_ioc_pool_reguid(zfs_cmd_t * zc)1894 zfs_ioc_pool_reguid(zfs_cmd_t *zc)
1895 {
1896 	spa_t *spa;
1897 	int error;
1898 
1899 	error = spa_open(zc->zc_name, &spa, FTAG);
1900 	if (error == 0) {
1901 		error = spa_change_guid(spa);
1902 		spa_close(spa, FTAG);
1903 	}
1904 	return (error);
1905 }
1906 
1907 static int
zfs_ioc_dsobj_to_dsname(zfs_cmd_t * zc)1908 zfs_ioc_dsobj_to_dsname(zfs_cmd_t *zc)
1909 {
1910 	return (dsl_dsobj_to_dsname(zc->zc_name, zc->zc_obj, zc->zc_value));
1911 }
1912 
1913 /*
1914  * inputs:
1915  * zc_name		name of filesystem
1916  * zc_obj		object to find
1917  *
1918  * outputs:
1919  * zc_value		name of object
1920  */
1921 static int
zfs_ioc_obj_to_path(zfs_cmd_t * zc)1922 zfs_ioc_obj_to_path(zfs_cmd_t *zc)
1923 {
1924 	objset_t *os;
1925 	int error;
1926 
1927 	/* XXX reading from objset not owned */
1928 	if ((error = dmu_objset_hold_flags(zc->zc_name, B_TRUE,
1929 	    FTAG, &os)) != 0)
1930 		return (error);
1931 	if (dmu_objset_type(os) != DMU_OST_ZFS) {
1932 		dmu_objset_rele_flags(os, B_TRUE, FTAG);
1933 		return (SET_ERROR(EINVAL));
1934 	}
1935 	error = zfs_obj_to_path(os, zc->zc_obj, zc->zc_value,
1936 	    sizeof (zc->zc_value));
1937 	dmu_objset_rele_flags(os, B_TRUE, FTAG);
1938 
1939 	return (error);
1940 }
1941 
1942 /*
1943  * inputs:
1944  * zc_name		name of filesystem
1945  * zc_obj		object to find
1946  *
1947  * outputs:
1948  * zc_stat		stats on object
1949  * zc_value		path to object
1950  */
1951 static int
zfs_ioc_obj_to_stats(zfs_cmd_t * zc)1952 zfs_ioc_obj_to_stats(zfs_cmd_t *zc)
1953 {
1954 	objset_t *os;
1955 	int error;
1956 
1957 	/* XXX reading from objset not owned */
1958 	if ((error = dmu_objset_hold_flags(zc->zc_name, B_TRUE,
1959 	    FTAG, &os)) != 0)
1960 		return (error);
1961 	if (dmu_objset_type(os) != DMU_OST_ZFS) {
1962 		dmu_objset_rele_flags(os, B_TRUE, FTAG);
1963 		return (SET_ERROR(EINVAL));
1964 	}
1965 	error = zfs_obj_to_stats(os, zc->zc_obj, &zc->zc_stat, zc->zc_value,
1966 	    sizeof (zc->zc_value));
1967 	dmu_objset_rele_flags(os, B_TRUE, FTAG);
1968 
1969 	return (error);
1970 }
1971 
1972 static int
zfs_ioc_vdev_add(zfs_cmd_t * zc)1973 zfs_ioc_vdev_add(zfs_cmd_t *zc)
1974 {
1975 	spa_t *spa;
1976 	int error;
1977 	nvlist_t *config;
1978 
1979 	error = spa_open(zc->zc_name, &spa, FTAG);
1980 	if (error != 0)
1981 		return (error);
1982 
1983 	error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
1984 	    zc->zc_iflags, &config);
1985 
1986 	if (error == 0) {
1987 		error = spa_vdev_add(spa, config);
1988 		nvlist_free(config);
1989 	}
1990 	spa_close(spa, FTAG);
1991 	return (error);
1992 }
1993 
1994 /*
1995  * inputs:
1996  * zc_name		name of the pool
1997  * zc_guid		guid of vdev to remove
1998  * zc_cookie		cancel removal
1999  */
2000 static int
zfs_ioc_vdev_remove(zfs_cmd_t * zc)2001 zfs_ioc_vdev_remove(zfs_cmd_t *zc)
2002 {
2003 	spa_t *spa;
2004 	int error;
2005 
2006 	error = spa_open(zc->zc_name, &spa, FTAG);
2007 	if (error != 0)
2008 		return (error);
2009 	if (zc->zc_cookie != 0) {
2010 		error = spa_vdev_remove_cancel(spa);
2011 	} else {
2012 		error = spa_vdev_remove(spa, zc->zc_guid, B_FALSE);
2013 	}
2014 	spa_close(spa, FTAG);
2015 	return (error);
2016 }
2017 
2018 static int
zfs_ioc_vdev_set_state(zfs_cmd_t * zc)2019 zfs_ioc_vdev_set_state(zfs_cmd_t *zc)
2020 {
2021 	spa_t *spa;
2022 	int error;
2023 	vdev_state_t newstate = VDEV_STATE_UNKNOWN;
2024 
2025 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
2026 		return (error);
2027 	switch (zc->zc_cookie) {
2028 	case VDEV_STATE_ONLINE:
2029 		error = vdev_online(spa, zc->zc_guid, zc->zc_obj, &newstate);
2030 		break;
2031 
2032 	case VDEV_STATE_OFFLINE:
2033 		error = vdev_offline(spa, zc->zc_guid, zc->zc_obj);
2034 		break;
2035 
2036 	case VDEV_STATE_FAULTED:
2037 		if (zc->zc_obj != VDEV_AUX_ERR_EXCEEDED &&
2038 		    zc->zc_obj != VDEV_AUX_EXTERNAL)
2039 			zc->zc_obj = VDEV_AUX_ERR_EXCEEDED;
2040 
2041 		error = vdev_fault(spa, zc->zc_guid, zc->zc_obj);
2042 		break;
2043 
2044 	case VDEV_STATE_DEGRADED:
2045 		if (zc->zc_obj != VDEV_AUX_ERR_EXCEEDED &&
2046 		    zc->zc_obj != VDEV_AUX_EXTERNAL)
2047 			zc->zc_obj = VDEV_AUX_ERR_EXCEEDED;
2048 
2049 		error = vdev_degrade(spa, zc->zc_guid, zc->zc_obj);
2050 		break;
2051 
2052 	default:
2053 		error = SET_ERROR(EINVAL);
2054 	}
2055 	zc->zc_cookie = newstate;
2056 	spa_close(spa, FTAG);
2057 	return (error);
2058 }
2059 
2060 static int
zfs_ioc_vdev_attach(zfs_cmd_t * zc)2061 zfs_ioc_vdev_attach(zfs_cmd_t *zc)
2062 {
2063 	spa_t *spa;
2064 	int replacing = zc->zc_cookie;
2065 	nvlist_t *config;
2066 	int error;
2067 
2068 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
2069 		return (error);
2070 
2071 	if ((error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
2072 	    zc->zc_iflags, &config)) == 0) {
2073 		error = spa_vdev_attach(spa, zc->zc_guid, config, replacing);
2074 		nvlist_free(config);
2075 	}
2076 
2077 	spa_close(spa, FTAG);
2078 	return (error);
2079 }
2080 
2081 static int
zfs_ioc_vdev_detach(zfs_cmd_t * zc)2082 zfs_ioc_vdev_detach(zfs_cmd_t *zc)
2083 {
2084 	spa_t *spa;
2085 	int error;
2086 
2087 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
2088 		return (error);
2089 
2090 	error = spa_vdev_detach(spa, zc->zc_guid, 0, B_FALSE);
2091 
2092 	spa_close(spa, FTAG);
2093 	return (error);
2094 }
2095 
2096 static int
zfs_ioc_vdev_split(zfs_cmd_t * zc)2097 zfs_ioc_vdev_split(zfs_cmd_t *zc)
2098 {
2099 	spa_t *spa;
2100 	nvlist_t *config, *props = NULL;
2101 	int error;
2102 	boolean_t exp = !!(zc->zc_cookie & ZPOOL_EXPORT_AFTER_SPLIT);
2103 
2104 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0)
2105 		return (error);
2106 
2107 	if (error = get_nvlist(zc->zc_nvlist_conf, zc->zc_nvlist_conf_size,
2108 	    zc->zc_iflags, &config)) {
2109 		spa_close(spa, FTAG);
2110 		return (error);
2111 	}
2112 
2113 	if (zc->zc_nvlist_src_size != 0 && (error =
2114 	    get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2115 	    zc->zc_iflags, &props))) {
2116 		spa_close(spa, FTAG);
2117 		nvlist_free(config);
2118 		return (error);
2119 	}
2120 
2121 	error = spa_vdev_split_mirror(spa, zc->zc_string, config, props, exp);
2122 
2123 	spa_close(spa, FTAG);
2124 
2125 	nvlist_free(config);
2126 	nvlist_free(props);
2127 
2128 	return (error);
2129 }
2130 
2131 static int
zfs_ioc_vdev_setpath(zfs_cmd_t * zc)2132 zfs_ioc_vdev_setpath(zfs_cmd_t *zc)
2133 {
2134 	spa_t *spa;
2135 	char *path = zc->zc_value;
2136 	uint64_t guid = zc->zc_guid;
2137 	int error;
2138 
2139 	error = spa_open(zc->zc_name, &spa, FTAG);
2140 	if (error != 0)
2141 		return (error);
2142 
2143 	error = spa_vdev_setpath(spa, guid, path);
2144 	spa_close(spa, FTAG);
2145 	return (error);
2146 }
2147 
2148 static int
zfs_ioc_vdev_setfru(zfs_cmd_t * zc)2149 zfs_ioc_vdev_setfru(zfs_cmd_t *zc)
2150 {
2151 	spa_t *spa;
2152 	char *fru = zc->zc_value;
2153 	uint64_t guid = zc->zc_guid;
2154 	int error;
2155 
2156 	error = spa_open(zc->zc_name, &spa, FTAG);
2157 	if (error != 0)
2158 		return (error);
2159 
2160 	error = spa_vdev_setfru(spa, guid, fru);
2161 	spa_close(spa, FTAG);
2162 	return (error);
2163 }
2164 
2165 static int
zfs_ioc_objset_stats_impl(zfs_cmd_t * zc,objset_t * os)2166 zfs_ioc_objset_stats_impl(zfs_cmd_t *zc, objset_t *os)
2167 {
2168 	int error = 0;
2169 	nvlist_t *nv;
2170 
2171 	dmu_objset_fast_stat(os, &zc->zc_objset_stats);
2172 
2173 	if (zc->zc_nvlist_dst != 0 &&
2174 	    (error = dsl_prop_get_all(os, &nv)) == 0) {
2175 		dmu_objset_stats(os, nv);
2176 		/*
2177 		 * NB: zvol_get_stats() will read the objset contents,
2178 		 * which we aren't supposed to do with a
2179 		 * DS_MODE_USER hold, because it could be
2180 		 * inconsistent.  So this is a bit of a workaround...
2181 		 * XXX reading with out owning
2182 		 */
2183 		if (!zc->zc_objset_stats.dds_inconsistent &&
2184 		    dmu_objset_type(os) == DMU_OST_ZVOL) {
2185 			error = zvol_get_stats(os, nv);
2186 			if (error == EIO)
2187 				return (error);
2188 			VERIFY0(error);
2189 		}
2190 		error = put_nvlist(zc, nv);
2191 		nvlist_free(nv);
2192 	}
2193 
2194 	return (error);
2195 }
2196 
2197 /*
2198  * inputs:
2199  * zc_name		name of filesystem
2200  * zc_nvlist_dst_size	size of buffer for property nvlist
2201  *
2202  * outputs:
2203  * zc_objset_stats	stats
2204  * zc_nvlist_dst	property nvlist
2205  * zc_nvlist_dst_size	size of property nvlist
2206  */
2207 static int
zfs_ioc_objset_stats(zfs_cmd_t * zc)2208 zfs_ioc_objset_stats(zfs_cmd_t *zc)
2209 {
2210 	objset_t *os;
2211 	int error;
2212 
2213 	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
2214 	if (error == 0) {
2215 		error = zfs_ioc_objset_stats_impl(zc, os);
2216 		dmu_objset_rele(os, FTAG);
2217 	}
2218 
2219 	return (error);
2220 }
2221 
2222 /*
2223  * inputs:
2224  * zc_name		name of filesystem
2225  * zc_nvlist_dst_size	size of buffer for property nvlist
2226  *
2227  * outputs:
2228  * zc_nvlist_dst	received property nvlist
2229  * zc_nvlist_dst_size	size of received property nvlist
2230  *
2231  * Gets received properties (distinct from local properties on or after
2232  * SPA_VERSION_RECVD_PROPS) for callers who want to differentiate received from
2233  * local property values.
2234  */
2235 static int
zfs_ioc_objset_recvd_props(zfs_cmd_t * zc)2236 zfs_ioc_objset_recvd_props(zfs_cmd_t *zc)
2237 {
2238 	int error = 0;
2239 	nvlist_t *nv;
2240 
2241 	/*
2242 	 * Without this check, we would return local property values if the
2243 	 * caller has not already received properties on or after
2244 	 * SPA_VERSION_RECVD_PROPS.
2245 	 */
2246 	if (!dsl_prop_get_hasrecvd(zc->zc_name))
2247 		return (SET_ERROR(ENOTSUP));
2248 
2249 	if (zc->zc_nvlist_dst != 0 &&
2250 	    (error = dsl_prop_get_received(zc->zc_name, &nv)) == 0) {
2251 		error = put_nvlist(zc, nv);
2252 		nvlist_free(nv);
2253 	}
2254 
2255 	return (error);
2256 }
2257 
2258 static int
nvl_add_zplprop(objset_t * os,nvlist_t * props,zfs_prop_t prop)2259 nvl_add_zplprop(objset_t *os, nvlist_t *props, zfs_prop_t prop)
2260 {
2261 	uint64_t value;
2262 	int error;
2263 
2264 	/*
2265 	 * zfs_get_zplprop() will either find a value or give us
2266 	 * the default value (if there is one).
2267 	 */
2268 	if ((error = zfs_get_zplprop(os, prop, &value)) != 0)
2269 		return (error);
2270 	VERIFY(nvlist_add_uint64(props, zfs_prop_to_name(prop), value) == 0);
2271 	return (0);
2272 }
2273 
2274 /*
2275  * inputs:
2276  * zc_name		name of filesystem
2277  * zc_nvlist_dst_size	size of buffer for zpl property nvlist
2278  *
2279  * outputs:
2280  * zc_nvlist_dst	zpl property nvlist
2281  * zc_nvlist_dst_size	size of zpl property nvlist
2282  */
2283 static int
zfs_ioc_objset_zplprops(zfs_cmd_t * zc)2284 zfs_ioc_objset_zplprops(zfs_cmd_t *zc)
2285 {
2286 	objset_t *os;
2287 	int err;
2288 
2289 	/* XXX reading without owning */
2290 	if (err = dmu_objset_hold(zc->zc_name, FTAG, &os))
2291 		return (err);
2292 
2293 	dmu_objset_fast_stat(os, &zc->zc_objset_stats);
2294 
2295 	/*
2296 	 * NB: nvl_add_zplprop() will read the objset contents,
2297 	 * which we aren't supposed to do with a DS_MODE_USER
2298 	 * hold, because it could be inconsistent.
2299 	 */
2300 	if (zc->zc_nvlist_dst != 0 &&
2301 	    !zc->zc_objset_stats.dds_inconsistent &&
2302 	    dmu_objset_type(os) == DMU_OST_ZFS) {
2303 		nvlist_t *nv;
2304 
2305 		VERIFY(nvlist_alloc(&nv, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2306 		if ((err = nvl_add_zplprop(os, nv, ZFS_PROP_VERSION)) == 0 &&
2307 		    (err = nvl_add_zplprop(os, nv, ZFS_PROP_NORMALIZE)) == 0 &&
2308 		    (err = nvl_add_zplprop(os, nv, ZFS_PROP_UTF8ONLY)) == 0 &&
2309 		    (err = nvl_add_zplprop(os, nv, ZFS_PROP_CASE)) == 0)
2310 			err = put_nvlist(zc, nv);
2311 		nvlist_free(nv);
2312 	} else {
2313 		err = SET_ERROR(ENOENT);
2314 	}
2315 	dmu_objset_rele(os, FTAG);
2316 	return (err);
2317 }
2318 
2319 static boolean_t
dataset_name_hidden(const char * name)2320 dataset_name_hidden(const char *name)
2321 {
2322 	/*
2323 	 * Skip over datasets that are not visible in this zone,
2324 	 * internal datasets (which have a $ in their name), and
2325 	 * temporary datasets (which have a % in their name).
2326 	 */
2327 	if (strchr(name, '$') != NULL)
2328 		return (B_TRUE);
2329 	if (strchr(name, '%') != NULL)
2330 		return (B_TRUE);
2331 	if (!INGLOBALZONE(curproc) && !zone_dataset_visible(name, NULL))
2332 		return (B_TRUE);
2333 	return (B_FALSE);
2334 }
2335 
2336 /*
2337  * inputs:
2338  * zc_name		name of filesystem
2339  * zc_cookie		zap cursor
2340  * zc_nvlist_dst_size	size of buffer for property nvlist
2341  *
2342  * outputs:
2343  * zc_name		name of next filesystem
2344  * zc_cookie		zap cursor
2345  * zc_objset_stats	stats
2346  * zc_nvlist_dst	property nvlist
2347  * zc_nvlist_dst_size	size of property nvlist
2348  */
2349 static int
zfs_ioc_dataset_list_next(zfs_cmd_t * zc)2350 zfs_ioc_dataset_list_next(zfs_cmd_t *zc)
2351 {
2352 	objset_t *os;
2353 	int error;
2354 	char *p;
2355 	size_t orig_len = strlen(zc->zc_name);
2356 
2357 top:
2358 	if (error = dmu_objset_hold(zc->zc_name, FTAG, &os)) {
2359 		if (error == ENOENT)
2360 			error = SET_ERROR(ESRCH);
2361 		return (error);
2362 	}
2363 
2364 	p = strrchr(zc->zc_name, '/');
2365 	if (p == NULL || p[1] != '\0')
2366 		(void) strlcat(zc->zc_name, "/", sizeof (zc->zc_name));
2367 	p = zc->zc_name + strlen(zc->zc_name);
2368 
2369 	do {
2370 		error = dmu_dir_list_next(os,
2371 		    sizeof (zc->zc_name) - (p - zc->zc_name), p,
2372 		    NULL, &zc->zc_cookie);
2373 		if (error == ENOENT)
2374 			error = SET_ERROR(ESRCH);
2375 	} while (error == 0 && dataset_name_hidden(zc->zc_name));
2376 	dmu_objset_rele(os, FTAG);
2377 
2378 	/*
2379 	 * If it's an internal dataset (ie. with a '$' in its name),
2380 	 * don't try to get stats for it, otherwise we'll return ENOENT.
2381 	 */
2382 	if (error == 0 && strchr(zc->zc_name, '$') == NULL) {
2383 		error = zfs_ioc_objset_stats(zc); /* fill in the stats */
2384 		if (error == ENOENT) {
2385 			/* We lost a race with destroy, get the next one. */
2386 			zc->zc_name[orig_len] = '\0';
2387 			goto top;
2388 		}
2389 	}
2390 	return (error);
2391 }
2392 
2393 /*
2394  * inputs:
2395  * zc_name		name of filesystem
2396  * zc_cookie		zap cursor
2397  * zc_nvlist_dst_size	size of buffer for property nvlist
2398  * zc_simple		when set, only name is requested
2399  *
2400  * outputs:
2401  * zc_name		name of next snapshot
2402  * zc_objset_stats	stats
2403  * zc_nvlist_dst	property nvlist
2404  * zc_nvlist_dst_size	size of property nvlist
2405  */
2406 static int
zfs_ioc_snapshot_list_next(zfs_cmd_t * zc)2407 zfs_ioc_snapshot_list_next(zfs_cmd_t *zc)
2408 {
2409 	objset_t *os;
2410 	int error;
2411 
2412 	error = dmu_objset_hold(zc->zc_name, FTAG, &os);
2413 	if (error != 0) {
2414 		return (error == ENOENT ? ESRCH : error);
2415 	}
2416 
2417 	/*
2418 	 * A dataset name of maximum length cannot have any snapshots,
2419 	 * so exit immediately.
2420 	 */
2421 	if (strlcat(zc->zc_name, "@", sizeof (zc->zc_name)) >=
2422 	    ZFS_MAX_DATASET_NAME_LEN) {
2423 		dmu_objset_rele(os, FTAG);
2424 		return (SET_ERROR(ESRCH));
2425 	}
2426 
2427 	error = dmu_snapshot_list_next(os,
2428 	    sizeof (zc->zc_name) - strlen(zc->zc_name),
2429 	    zc->zc_name + strlen(zc->zc_name), &zc->zc_obj, &zc->zc_cookie,
2430 	    NULL);
2431 
2432 	if (error == 0 && !zc->zc_simple) {
2433 		dsl_dataset_t *ds;
2434 		dsl_pool_t *dp = os->os_dsl_dataset->ds_dir->dd_pool;
2435 
2436 		error = dsl_dataset_hold_obj(dp, zc->zc_obj, FTAG, &ds);
2437 		if (error == 0) {
2438 			objset_t *ossnap;
2439 
2440 			error = dmu_objset_from_ds(ds, &ossnap);
2441 			if (error == 0)
2442 				error = zfs_ioc_objset_stats_impl(zc, ossnap);
2443 			dsl_dataset_rele(ds, FTAG);
2444 		}
2445 	} else if (error == ENOENT) {
2446 		error = SET_ERROR(ESRCH);
2447 	}
2448 
2449 	dmu_objset_rele(os, FTAG);
2450 	/* if we failed, undo the @ that we tacked on to zc_name */
2451 	if (error != 0)
2452 		*strchr(zc->zc_name, '@') = '\0';
2453 	return (error);
2454 }
2455 
2456 static int
zfs_prop_set_userquota(const char * dsname,nvpair_t * pair)2457 zfs_prop_set_userquota(const char *dsname, nvpair_t *pair)
2458 {
2459 	const char *propname = nvpair_name(pair);
2460 	uint64_t *valary;
2461 	unsigned int vallen;
2462 	const char *domain;
2463 	char *dash;
2464 	zfs_userquota_prop_t type;
2465 	uint64_t rid;
2466 	uint64_t quota;
2467 	zfsvfs_t *zfsvfs;
2468 	int err;
2469 
2470 	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2471 		nvlist_t *attrs;
2472 		VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
2473 		if (nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2474 		    &pair) != 0)
2475 			return (SET_ERROR(EINVAL));
2476 	}
2477 
2478 	/*
2479 	 * A correctly constructed propname is encoded as
2480 	 * userquota@<rid>-<domain>.
2481 	 */
2482 	if ((dash = strchr(propname, '-')) == NULL ||
2483 	    nvpair_value_uint64_array(pair, &valary, &vallen) != 0 ||
2484 	    vallen != 3)
2485 		return (SET_ERROR(EINVAL));
2486 
2487 	domain = dash + 1;
2488 	type = valary[0];
2489 	rid = valary[1];
2490 	quota = valary[2];
2491 
2492 	err = zfsvfs_hold(dsname, FTAG, &zfsvfs, B_FALSE);
2493 	if (err == 0) {
2494 		err = zfs_set_userquota(zfsvfs, type, domain, rid, quota);
2495 		zfsvfs_rele(zfsvfs, FTAG);
2496 	}
2497 
2498 	return (err);
2499 }
2500 
2501 /*
2502  * If the named property is one that has a special function to set its value,
2503  * return 0 on success and a positive error code on failure; otherwise if it is
2504  * not one of the special properties handled by this function, return -1.
2505  *
2506  * XXX: It would be better for callers of the property interface if we handled
2507  * these special cases in dsl_prop.c (in the dsl layer).
2508  */
2509 static int
zfs_prop_set_special(const char * dsname,zprop_source_t source,nvpair_t * pair)2510 zfs_prop_set_special(const char *dsname, zprop_source_t source,
2511     nvpair_t *pair)
2512 {
2513 	const char *propname = nvpair_name(pair);
2514 	zfs_prop_t prop = zfs_name_to_prop(propname);
2515 	uint64_t intval = 0;
2516 	char *strval = NULL;
2517 	int err = -1;
2518 
2519 	if (prop == ZPROP_INVAL) {
2520 		if (zfs_prop_userquota(propname))
2521 			return (zfs_prop_set_userquota(dsname, pair));
2522 		return (-1);
2523 	}
2524 
2525 	if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2526 		nvlist_t *attrs;
2527 		VERIFY(nvpair_value_nvlist(pair, &attrs) == 0);
2528 		VERIFY(nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2529 		    &pair) == 0);
2530 	}
2531 
2532 	/* all special properties are numeric except for keylocation */
2533 	if (zfs_prop_get_type(prop) == PROP_TYPE_STRING) {
2534 		strval = fnvpair_value_string(pair);
2535 	} else {
2536 		intval = fnvpair_value_uint64(pair);
2537 	}
2538 
2539 	switch (prop) {
2540 	case ZFS_PROP_QUOTA:
2541 		err = dsl_dir_set_quota(dsname, source, intval);
2542 		break;
2543 	case ZFS_PROP_REFQUOTA:
2544 		err = dsl_dataset_set_refquota(dsname, source, intval);
2545 		break;
2546 	case ZFS_PROP_FILESYSTEM_LIMIT:
2547 	case ZFS_PROP_SNAPSHOT_LIMIT:
2548 		if (intval == UINT64_MAX) {
2549 			/* clearing the limit, just do it */
2550 			err = 0;
2551 		} else {
2552 			err = dsl_dir_activate_fs_ss_limit(dsname);
2553 		}
2554 		/*
2555 		 * Set err to -1 to force the zfs_set_prop_nvlist code down the
2556 		 * default path to set the value in the nvlist.
2557 		 */
2558 		if (err == 0)
2559 			err = -1;
2560 		break;
2561 	case ZFS_PROP_KEYLOCATION:
2562 		err = dsl_crypto_can_set_keylocation(dsname, strval);
2563 
2564 		/*
2565 		 * Set err to -1 to force the zfs_set_prop_nvlist code down the
2566 		 * default path to set the value in the nvlist.
2567 		 */
2568 		if (err == 0)
2569 			err = -1;
2570 		break;
2571 	case ZFS_PROP_RESERVATION:
2572 		err = dsl_dir_set_reservation(dsname, source, intval);
2573 		break;
2574 	case ZFS_PROP_REFRESERVATION:
2575 		err = dsl_dataset_set_refreservation(dsname, source, intval);
2576 		break;
2577 	case ZFS_PROP_VOLSIZE:
2578 		err = zvol_set_volsize(dsname, intval);
2579 		break;
2580 	case ZFS_PROP_VERSION:
2581 	{
2582 		zfsvfs_t *zfsvfs;
2583 
2584 		if ((err = zfsvfs_hold(dsname, FTAG, &zfsvfs, B_TRUE)) != 0)
2585 			break;
2586 
2587 		err = zfs_set_version(zfsvfs, intval);
2588 		zfsvfs_rele(zfsvfs, FTAG);
2589 
2590 		if (err == 0 && intval >= ZPL_VERSION_USERSPACE) {
2591 			zfs_cmd_t *zc;
2592 
2593 			zc = kmem_zalloc(sizeof (zfs_cmd_t), KM_SLEEP);
2594 			(void) strcpy(zc->zc_name, dsname);
2595 			(void) zfs_ioc_userspace_upgrade(zc);
2596 			(void) zfs_ioc_id_quota_upgrade(zc);
2597 			kmem_free(zc, sizeof (zfs_cmd_t));
2598 		}
2599 		break;
2600 	}
2601 	default:
2602 		err = -1;
2603 	}
2604 
2605 	return (err);
2606 }
2607 
2608 /*
2609  * This function is best effort. If it fails to set any of the given properties,
2610  * it continues to set as many as it can and returns the last error
2611  * encountered. If the caller provides a non-NULL errlist, it will be filled in
2612  * with the list of names of all the properties that failed along with the
2613  * corresponding error numbers.
2614  *
2615  * If every property is set successfully, zero is returned and errlist is not
2616  * modified.
2617  */
2618 int
zfs_set_prop_nvlist(const char * dsname,zprop_source_t source,nvlist_t * nvl,nvlist_t * errlist)2619 zfs_set_prop_nvlist(const char *dsname, zprop_source_t source, nvlist_t *nvl,
2620     nvlist_t *errlist)
2621 {
2622 	nvpair_t *pair;
2623 	nvpair_t *propval;
2624 	int rv = 0;
2625 	uint64_t intval;
2626 	char *strval;
2627 	nvlist_t *genericnvl = fnvlist_alloc();
2628 	nvlist_t *retrynvl = fnvlist_alloc();
2629 
2630 retry:
2631 	pair = NULL;
2632 	while ((pair = nvlist_next_nvpair(nvl, pair)) != NULL) {
2633 		const char *propname = nvpair_name(pair);
2634 		zfs_prop_t prop = zfs_name_to_prop(propname);
2635 		int err = 0;
2636 
2637 		/* decode the property value */
2638 		propval = pair;
2639 		if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2640 			nvlist_t *attrs;
2641 			attrs = fnvpair_value_nvlist(pair);
2642 			if (nvlist_lookup_nvpair(attrs, ZPROP_VALUE,
2643 			    &propval) != 0)
2644 				err = SET_ERROR(EINVAL);
2645 		}
2646 
2647 		/* Validate value type */
2648 		if (err == 0 && source == ZPROP_SRC_INHERITED) {
2649 			/* inherited properties are expected to be booleans */
2650 			if (nvpair_type(propval) != DATA_TYPE_BOOLEAN)
2651 				err = SET_ERROR(EINVAL);
2652 		} else if (err == 0 && prop == ZPROP_INVAL) {
2653 			if (zfs_prop_user(propname)) {
2654 				if (nvpair_type(propval) != DATA_TYPE_STRING)
2655 					err = SET_ERROR(EINVAL);
2656 			} else if (zfs_prop_userquota(propname)) {
2657 				if (nvpair_type(propval) !=
2658 				    DATA_TYPE_UINT64_ARRAY)
2659 					err = SET_ERROR(EINVAL);
2660 			} else {
2661 				err = SET_ERROR(EINVAL);
2662 			}
2663 		} else if (err == 0) {
2664 			if (nvpair_type(propval) == DATA_TYPE_STRING) {
2665 				if (zfs_prop_get_type(prop) != PROP_TYPE_STRING)
2666 					err = SET_ERROR(EINVAL);
2667 			} else if (nvpair_type(propval) == DATA_TYPE_UINT64) {
2668 				const char *unused;
2669 
2670 				intval = fnvpair_value_uint64(propval);
2671 
2672 				switch (zfs_prop_get_type(prop)) {
2673 				case PROP_TYPE_NUMBER:
2674 					break;
2675 				case PROP_TYPE_STRING:
2676 					err = SET_ERROR(EINVAL);
2677 					break;
2678 				case PROP_TYPE_INDEX:
2679 					if (zfs_prop_index_to_string(prop,
2680 					    intval, &unused) != 0)
2681 						err = SET_ERROR(EINVAL);
2682 					break;
2683 				default:
2684 					cmn_err(CE_PANIC,
2685 					    "unknown property type");
2686 				}
2687 			} else {
2688 				err = SET_ERROR(EINVAL);
2689 			}
2690 		}
2691 
2692 		/* Validate permissions */
2693 		if (err == 0)
2694 			err = zfs_check_settable(dsname, pair, CRED());
2695 
2696 		if (err == 0) {
2697 			if (source == ZPROP_SRC_INHERITED)
2698 				err = -1; /* does not need special handling */
2699 			else
2700 				err = zfs_prop_set_special(dsname, source,
2701 				    pair);
2702 			if (err == -1) {
2703 				/*
2704 				 * For better performance we build up a list of
2705 				 * properties to set in a single transaction.
2706 				 */
2707 				err = nvlist_add_nvpair(genericnvl, pair);
2708 			} else if (err != 0 && nvl != retrynvl) {
2709 				/*
2710 				 * This may be a spurious error caused by
2711 				 * receiving quota and reservation out of order.
2712 				 * Try again in a second pass.
2713 				 */
2714 				err = nvlist_add_nvpair(retrynvl, pair);
2715 			}
2716 		}
2717 
2718 		if (err != 0) {
2719 			if (errlist != NULL)
2720 				fnvlist_add_int32(errlist, propname, err);
2721 			rv = err;
2722 		}
2723 	}
2724 
2725 	if (nvl != retrynvl && !nvlist_empty(retrynvl)) {
2726 		nvl = retrynvl;
2727 		goto retry;
2728 	}
2729 
2730 	if (!nvlist_empty(genericnvl) &&
2731 	    dsl_props_set(dsname, source, genericnvl) != 0) {
2732 		/*
2733 		 * If this fails, we still want to set as many properties as we
2734 		 * can, so try setting them individually.
2735 		 */
2736 		pair = NULL;
2737 		while ((pair = nvlist_next_nvpair(genericnvl, pair)) != NULL) {
2738 			const char *propname = nvpair_name(pair);
2739 			int err = 0;
2740 
2741 			propval = pair;
2742 			if (nvpair_type(pair) == DATA_TYPE_NVLIST) {
2743 				nvlist_t *attrs;
2744 				attrs = fnvpair_value_nvlist(pair);
2745 				propval = fnvlist_lookup_nvpair(attrs,
2746 				    ZPROP_VALUE);
2747 			}
2748 
2749 			if (nvpair_type(propval) == DATA_TYPE_STRING) {
2750 				strval = fnvpair_value_string(propval);
2751 				err = dsl_prop_set_string(dsname, propname,
2752 				    source, strval);
2753 			} else if (nvpair_type(propval) == DATA_TYPE_BOOLEAN) {
2754 				err = dsl_prop_inherit(dsname, propname,
2755 				    source);
2756 			} else {
2757 				intval = fnvpair_value_uint64(propval);
2758 				err = dsl_prop_set_int(dsname, propname, source,
2759 				    intval);
2760 			}
2761 
2762 			if (err != 0) {
2763 				if (errlist != NULL) {
2764 					fnvlist_add_int32(errlist, propname,
2765 					    err);
2766 				}
2767 				rv = err;
2768 			}
2769 		}
2770 	}
2771 	nvlist_free(genericnvl);
2772 	nvlist_free(retrynvl);
2773 
2774 	return (rv);
2775 }
2776 
2777 /*
2778  * Check that all the properties are valid user properties.
2779  */
2780 static int
zfs_check_userprops(const char * fsname,nvlist_t * nvl)2781 zfs_check_userprops(const char *fsname, nvlist_t *nvl)
2782 {
2783 	nvpair_t *pair = NULL;
2784 	int error = 0;
2785 
2786 	while ((pair = nvlist_next_nvpair(nvl, pair)) != NULL) {
2787 		const char *propname = nvpair_name(pair);
2788 
2789 		if (!zfs_prop_user(propname) ||
2790 		    nvpair_type(pair) != DATA_TYPE_STRING)
2791 			return (SET_ERROR(EINVAL));
2792 
2793 		if (error = zfs_secpolicy_write_perms(fsname,
2794 		    ZFS_DELEG_PERM_USERPROP, CRED()))
2795 			return (error);
2796 
2797 		if (strlen(propname) >= ZAP_MAXNAMELEN)
2798 			return (SET_ERROR(ENAMETOOLONG));
2799 
2800 		if (strlen(fnvpair_value_string(pair)) >= ZAP_MAXVALUELEN)
2801 			return (E2BIG);
2802 	}
2803 	return (0);
2804 }
2805 
2806 static void
props_skip(nvlist_t * props,nvlist_t * skipped,nvlist_t ** newprops)2807 props_skip(nvlist_t *props, nvlist_t *skipped, nvlist_t **newprops)
2808 {
2809 	nvpair_t *pair;
2810 
2811 	VERIFY(nvlist_alloc(newprops, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2812 
2813 	pair = NULL;
2814 	while ((pair = nvlist_next_nvpair(props, pair)) != NULL) {
2815 		if (nvlist_exists(skipped, nvpair_name(pair)))
2816 			continue;
2817 
2818 		VERIFY(nvlist_add_nvpair(*newprops, pair) == 0);
2819 	}
2820 }
2821 
2822 static int
clear_received_props(const char * dsname,nvlist_t * props,nvlist_t * skipped)2823 clear_received_props(const char *dsname, nvlist_t *props,
2824     nvlist_t *skipped)
2825 {
2826 	int err = 0;
2827 	nvlist_t *cleared_props = NULL;
2828 	props_skip(props, skipped, &cleared_props);
2829 	if (!nvlist_empty(cleared_props)) {
2830 		/*
2831 		 * Acts on local properties until the dataset has received
2832 		 * properties at least once on or after SPA_VERSION_RECVD_PROPS.
2833 		 */
2834 		zprop_source_t flags = (ZPROP_SRC_NONE |
2835 		    (dsl_prop_get_hasrecvd(dsname) ? ZPROP_SRC_RECEIVED : 0));
2836 		err = zfs_set_prop_nvlist(dsname, flags, cleared_props, NULL);
2837 	}
2838 	nvlist_free(cleared_props);
2839 	return (err);
2840 }
2841 
2842 /*
2843  * inputs:
2844  * zc_name		name of filesystem
2845  * zc_value		name of property to set
2846  * zc_nvlist_src{_size}	nvlist of properties to apply
2847  * zc_cookie		received properties flag
2848  *
2849  * outputs:
2850  * zc_nvlist_dst{_size} error for each unapplied received property
2851  */
2852 static int
zfs_ioc_set_prop(zfs_cmd_t * zc)2853 zfs_ioc_set_prop(zfs_cmd_t *zc)
2854 {
2855 	nvlist_t *nvl;
2856 	boolean_t received = zc->zc_cookie;
2857 	zprop_source_t source = (received ? ZPROP_SRC_RECEIVED :
2858 	    ZPROP_SRC_LOCAL);
2859 	nvlist_t *errors;
2860 	int error;
2861 
2862 	if ((error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2863 	    zc->zc_iflags, &nvl)) != 0)
2864 		return (error);
2865 
2866 	if (received) {
2867 		nvlist_t *origprops;
2868 
2869 		if (dsl_prop_get_received(zc->zc_name, &origprops) == 0) {
2870 			(void) clear_received_props(zc->zc_name,
2871 			    origprops, nvl);
2872 			nvlist_free(origprops);
2873 		}
2874 
2875 		error = dsl_prop_set_hasrecvd(zc->zc_name);
2876 	}
2877 
2878 	errors = fnvlist_alloc();
2879 	if (error == 0)
2880 		error = zfs_set_prop_nvlist(zc->zc_name, source, nvl, errors);
2881 
2882 	if (zc->zc_nvlist_dst != 0 && errors != NULL) {
2883 		(void) put_nvlist(zc, errors);
2884 	}
2885 
2886 	nvlist_free(errors);
2887 	nvlist_free(nvl);
2888 	return (error);
2889 }
2890 
2891 /*
2892  * inputs:
2893  * zc_name		name of filesystem
2894  * zc_value		name of property to inherit
2895  * zc_cookie		revert to received value if TRUE
2896  *
2897  * outputs:		none
2898  */
2899 static int
zfs_ioc_inherit_prop(zfs_cmd_t * zc)2900 zfs_ioc_inherit_prop(zfs_cmd_t *zc)
2901 {
2902 	const char *propname = zc->zc_value;
2903 	zfs_prop_t prop = zfs_name_to_prop(propname);
2904 	boolean_t received = zc->zc_cookie;
2905 	zprop_source_t source = (received
2906 	    ? ZPROP_SRC_NONE		/* revert to received value, if any */
2907 	    : ZPROP_SRC_INHERITED);	/* explicitly inherit */
2908 
2909 	if (received) {
2910 		nvlist_t *dummy;
2911 		nvpair_t *pair;
2912 		zprop_type_t type;
2913 		int err;
2914 
2915 		/*
2916 		 * zfs_prop_set_special() expects properties in the form of an
2917 		 * nvpair with type info.
2918 		 */
2919 		if (prop == ZPROP_INVAL) {
2920 			if (!zfs_prop_user(propname))
2921 				return (SET_ERROR(EINVAL));
2922 
2923 			type = PROP_TYPE_STRING;
2924 		} else if (prop == ZFS_PROP_VOLSIZE ||
2925 		    prop == ZFS_PROP_VERSION) {
2926 			return (SET_ERROR(EINVAL));
2927 		} else {
2928 			type = zfs_prop_get_type(prop);
2929 		}
2930 
2931 		VERIFY(nvlist_alloc(&dummy, NV_UNIQUE_NAME, KM_SLEEP) == 0);
2932 
2933 		switch (type) {
2934 		case PROP_TYPE_STRING:
2935 			VERIFY(0 == nvlist_add_string(dummy, propname, ""));
2936 			break;
2937 		case PROP_TYPE_NUMBER:
2938 		case PROP_TYPE_INDEX:
2939 			VERIFY(0 == nvlist_add_uint64(dummy, propname, 0));
2940 			break;
2941 		default:
2942 			nvlist_free(dummy);
2943 			return (SET_ERROR(EINVAL));
2944 		}
2945 
2946 		pair = nvlist_next_nvpair(dummy, NULL);
2947 		err = zfs_prop_set_special(zc->zc_name, source, pair);
2948 		nvlist_free(dummy);
2949 		if (err != -1)
2950 			return (err); /* special property already handled */
2951 	} else {
2952 		/*
2953 		 * Only check this in the non-received case. We want to allow
2954 		 * 'inherit -S' to revert non-inheritable properties like quota
2955 		 * and reservation to the received or default values even though
2956 		 * they are not considered inheritable.
2957 		 */
2958 		if (prop != ZPROP_INVAL && !zfs_prop_inheritable(prop))
2959 			return (SET_ERROR(EINVAL));
2960 	}
2961 
2962 	/* property name has been validated by zfs_secpolicy_inherit_prop() */
2963 	return (dsl_prop_inherit(zc->zc_name, zc->zc_value, source));
2964 }
2965 
2966 static int
zfs_ioc_pool_set_props(zfs_cmd_t * zc)2967 zfs_ioc_pool_set_props(zfs_cmd_t *zc)
2968 {
2969 	nvlist_t *props;
2970 	spa_t *spa;
2971 	int error;
2972 	nvpair_t *pair;
2973 
2974 	if (error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
2975 	    zc->zc_iflags, &props))
2976 		return (error);
2977 
2978 	/*
2979 	 * If the only property is the configfile, then just do a spa_lookup()
2980 	 * to handle the faulted case.
2981 	 */
2982 	pair = nvlist_next_nvpair(props, NULL);
2983 	if (pair != NULL && strcmp(nvpair_name(pair),
2984 	    zpool_prop_to_name(ZPOOL_PROP_CACHEFILE)) == 0 &&
2985 	    nvlist_next_nvpair(props, pair) == NULL) {
2986 		mutex_enter(&spa_namespace_lock);
2987 		if ((spa = spa_lookup(zc->zc_name)) != NULL) {
2988 			spa_configfile_set(spa, props, B_FALSE);
2989 			spa_write_cachefile(spa, B_FALSE, B_TRUE);
2990 		}
2991 		mutex_exit(&spa_namespace_lock);
2992 		if (spa != NULL) {
2993 			nvlist_free(props);
2994 			return (0);
2995 		}
2996 	}
2997 
2998 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0) {
2999 		nvlist_free(props);
3000 		return (error);
3001 	}
3002 
3003 	error = spa_prop_set(spa, props);
3004 
3005 	nvlist_free(props);
3006 	spa_close(spa, FTAG);
3007 
3008 	return (error);
3009 }
3010 
3011 static int
zfs_ioc_pool_get_props(zfs_cmd_t * zc)3012 zfs_ioc_pool_get_props(zfs_cmd_t *zc)
3013 {
3014 	spa_t *spa;
3015 	int error;
3016 	nvlist_t *nvp = NULL;
3017 
3018 	if ((error = spa_open(zc->zc_name, &spa, FTAG)) != 0) {
3019 		/*
3020 		 * If the pool is faulted, there may be properties we can still
3021 		 * get (such as altroot and cachefile), so attempt to get them
3022 		 * anyway.
3023 		 */
3024 		mutex_enter(&spa_namespace_lock);
3025 		if ((spa = spa_lookup(zc->zc_name)) != NULL)
3026 			error = spa_prop_get(spa, &nvp);
3027 		mutex_exit(&spa_namespace_lock);
3028 	} else {
3029 		error = spa_prop_get(spa, &nvp);
3030 		spa_close(spa, FTAG);
3031 	}
3032 
3033 	if (error == 0 && zc->zc_nvlist_dst != 0)
3034 		error = put_nvlist(zc, nvp);
3035 	else
3036 		error = SET_ERROR(EFAULT);
3037 
3038 	nvlist_free(nvp);
3039 	return (error);
3040 }
3041 
3042 /*
3043  * inputs:
3044  * zc_name		name of filesystem
3045  * zc_nvlist_src{_size}	nvlist of delegated permissions
3046  * zc_perm_action	allow/unallow flag
3047  *
3048  * outputs:		none
3049  */
3050 static int
zfs_ioc_set_fsacl(zfs_cmd_t * zc)3051 zfs_ioc_set_fsacl(zfs_cmd_t *zc)
3052 {
3053 	int error;
3054 	nvlist_t *fsaclnv = NULL;
3055 
3056 	if ((error = get_nvlist(zc->zc_nvlist_src, zc->zc_nvlist_src_size,
3057 	    zc->zc_iflags, &fsaclnv)) != 0)
3058 		return (error);
3059 
3060 	/*
3061 	 * Verify nvlist is constructed correctly
3062 	 */
3063 	if ((error = zfs_deleg_verify_nvlist(fsaclnv)) != 0) {
3064 		nvlist_free(fsaclnv);
3065 		return (SET_ERROR(EINVAL));
3066 	}
3067 
3068 	/*
3069 	 * If we don't have PRIV_SYS_MOUNT, then validate
3070 	 * that user is allowed to hand out each permission in
3071 	 * the nvlist(s)
3072 	 */
3073 
3074 	error = secpolicy_zfs(CRED());
3075 	if (error != 0) {
3076 		if (zc->zc_perm_action == B_FALSE) {
3077 			error = dsl_deleg_can_allow(zc->zc_name,
3078 			    fsaclnv, CRED());
3079 		} else {
3080 			error = dsl_deleg_can_unallow(zc->zc_name,
3081 			    fsaclnv, CRED());
3082 		}
3083 	}
3084 
3085 	if (error == 0)
3086 		error = dsl_deleg_set(zc->zc_name, fsaclnv, zc->zc_perm_action);
3087 
3088 	nvlist_free(fsaclnv);
3089 	return (error);
3090 }
3091 
3092 /*
3093  * inputs:
3094  * zc_name		name of filesystem
3095  *
3096  * outputs:
3097  * zc_nvlist_src{_size}	nvlist of delegated permissions
3098  */
3099 static int
zfs_ioc_get_fsacl(zfs_cmd_t * zc)3100 zfs_ioc_get_fsacl(zfs_cmd_t *zc)
3101 {
3102 	nvlist_t *nvp;
3103 	int error;
3104 
3105 	if ((error = dsl_deleg_get(zc->zc_name, &nvp)) == 0) {
3106 		error = put_nvlist(zc, nvp);
3107 		nvlist_free(nvp);
3108 	}
3109 
3110 	return (error);
3111 }
3112 
3113 /* ARGSUSED */
3114 static void
zfs_create_cb(objset_t * os,void * arg,cred_t * cr,dmu_tx_t * tx)3115 zfs_create_cb(objset_t *os, void *arg, cred_t *cr, dmu_tx_t *tx)
3116 {
3117 	zfs_creat_t *zct = arg;
3118 
3119 	zfs_create_fs(os, cr, zct->zct_zplprops, tx);
3120 }
3121 
3122 #define	ZFS_PROP_UNDEFINED	((uint64_t)-1)
3123 
3124 /*
3125  * inputs:
3126  * os			parent objset pointer (NULL if root fs)
3127  * fuids_ok		fuids allowed in this version of the spa?
3128  * sa_ok		SAs allowed in this version of the spa?
3129  * createprops		list of properties requested by creator
3130  *
3131  * outputs:
3132  * zplprops	values for the zplprops we attach to the master node object
3133  * is_ci	true if requested file system will be purely case-insensitive
3134  *
3135  * Determine the settings for utf8only, normalization and
3136  * casesensitivity.  Specific values may have been requested by the
3137  * creator and/or we can inherit values from the parent dataset.  If
3138  * the file system is of too early a vintage, a creator can not
3139  * request settings for these properties, even if the requested
3140  * setting is the default value.  We don't actually want to create dsl
3141  * properties for these, so remove them from the source nvlist after
3142  * processing.
3143  */
3144 static int
zfs_fill_zplprops_impl(objset_t * os,uint64_t zplver,boolean_t fuids_ok,boolean_t sa_ok,nvlist_t * createprops,nvlist_t * zplprops,boolean_t * is_ci)3145 zfs_fill_zplprops_impl(objset_t *os, uint64_t zplver,
3146     boolean_t fuids_ok, boolean_t sa_ok, nvlist_t *createprops,
3147     nvlist_t *zplprops, boolean_t *is_ci)
3148 {
3149 	uint64_t sense = ZFS_PROP_UNDEFINED;
3150 	uint64_t norm = ZFS_PROP_UNDEFINED;
3151 	uint64_t u8 = ZFS_PROP_UNDEFINED;
3152 
3153 	ASSERT(zplprops != NULL);
3154 
3155 	if (os != NULL && os->os_phys->os_type != DMU_OST_ZFS)
3156 		return (SET_ERROR(EINVAL));
3157 
3158 	/*
3159 	 * Pull out creator prop choices, if any.
3160 	 */
3161 	if (createprops) {
3162 		(void) nvlist_lookup_uint64(createprops,
3163 		    zfs_prop_to_name(ZFS_PROP_VERSION), &zplver);
3164 		(void) nvlist_lookup_uint64(createprops,
3165 		    zfs_prop_to_name(ZFS_PROP_NORMALIZE), &norm);
3166 		(void) nvlist_remove_all(createprops,
3167 		    zfs_prop_to_name(ZFS_PROP_NORMALIZE));
3168 		(void) nvlist_lookup_uint64(createprops,
3169 		    zfs_prop_to_name(ZFS_PROP_UTF8ONLY), &u8);
3170 		(void) nvlist_remove_all(createprops,
3171 		    zfs_prop_to_name(ZFS_PROP_UTF8ONLY));
3172 		(void) nvlist_lookup_uint64(createprops,
3173 		    zfs_prop_to_name(ZFS_PROP_CASE), &sense);
3174 		(void) nvlist_remove_all(createprops,
3175 		    zfs_prop_to_name(ZFS_PROP_CASE));
3176 	}
3177 
3178 	/*
3179 	 * If the zpl version requested is whacky or the file system
3180 	 * or pool is version is too "young" to support normalization
3181 	 * and the creator tried to set a value for one of the props,
3182 	 * error out.
3183 	 */
3184 	if ((zplver < ZPL_VERSION_INITIAL || zplver > ZPL_VERSION) ||
3185 	    (zplver >= ZPL_VERSION_FUID && !fuids_ok) ||
3186 	    (zplver >= ZPL_VERSION_SA && !sa_ok) ||
3187 	    (zplver < ZPL_VERSION_NORMALIZATION &&
3188 	    (norm != ZFS_PROP_UNDEFINED || u8 != ZFS_PROP_UNDEFINED ||
3189 	    sense != ZFS_PROP_UNDEFINED)))
3190 		return (SET_ERROR(ENOTSUP));
3191 
3192 	/*
3193 	 * Put the version in the zplprops
3194 	 */
3195 	VERIFY(nvlist_add_uint64(zplprops,
3196 	    zfs_prop_to_name(ZFS_PROP_VERSION), zplver) == 0);
3197 
3198 	if (norm == ZFS_PROP_UNDEFINED)
3199 		VERIFY(zfs_get_zplprop(os, ZFS_PROP_NORMALIZE, &norm) == 0);
3200 	VERIFY(nvlist_add_uint64(zplprops,
3201 	    zfs_prop_to_name(ZFS_PROP_NORMALIZE), norm) == 0);
3202 
3203 	/*
3204 	 * If we're normalizing, names must always be valid UTF-8 strings.
3205 	 */
3206 	if (norm)
3207 		u8 = 1;
3208 	if (u8 == ZFS_PROP_UNDEFINED)
3209 		VERIFY(zfs_get_zplprop(os, ZFS_PROP_UTF8ONLY, &u8) == 0);
3210 	VERIFY(nvlist_add_uint64(zplprops,
3211 	    zfs_prop_to_name(ZFS_PROP_UTF8ONLY), u8) == 0);
3212 
3213 	if (sense == ZFS_PROP_UNDEFINED)
3214 		VERIFY(zfs_get_zplprop(os, ZFS_PROP_CASE, &sense) == 0);
3215 	VERIFY(nvlist_add_uint64(zplprops,
3216 	    zfs_prop_to_name(ZFS_PROP_CASE), sense) == 0);
3217 
3218 	if (is_ci)
3219 		*is_ci = (sense == ZFS_CASE_INSENSITIVE);
3220 
3221 	return (0);
3222 }
3223 
3224 static int
zfs_fill_zplprops(const char * dataset,nvlist_t * createprops,nvlist_t * zplprops,boolean_t * is_ci)3225 zfs_fill_zplprops(const char *dataset, nvlist_t *createprops,
3226     nvlist_t *zplprops, boolean_t *is_ci)
3227 {
3228 	boolean_t fuids_ok, sa_ok;
3229 	uint64_t zplver = ZPL_VERSION;
3230 	objset_t *os = NULL;
3231 	char parentname[ZFS_MAX_DATASET_NAME_LEN];
3232 	char *cp;
3233 	spa_t *spa;
3234 	uint64_t spa_vers;
3235 	int error;
3236 
3237 	(void) strlcpy(parentname, dataset, sizeof (parentname));
3238 	cp = strrchr(parentname, '/');
3239 	ASSERT(cp != NULL);
3240 	cp[0] = '\0';
3241 
3242 	if ((error = spa_open(dataset, &spa, FTAG)) != 0)
3243 		return (error);
3244 
3245 	spa_vers = spa_version(spa);
3246 	spa_close(spa, FTAG);
3247 
3248 	zplver = zfs_zpl_version_map(spa_vers);
3249 	fuids_ok = (zplver >= ZPL_VERSION_FUID);
3250 	sa_ok = (zplver >= ZPL_VERSION_SA);
3251 
3252 	/*
3253 	 * Open parent object set so we can inherit zplprop values.
3254 	 */
3255 	if ((error = dmu_objset_hold(parentname, FTAG, &os)) != 0)
3256 		return (error);
3257 
3258 	error = zfs_fill_zplprops_impl(os, zplver, fuids_ok, sa_ok, createprops,
3259 	    zplprops, is_ci);
3260 	dmu_objset_rele(os, FTAG);
3261 	return (error);
3262 }
3263 
3264 static int
zfs_fill_zplprops_root(uint64_t spa_vers,nvlist_t * createprops,nvlist_t * zplprops,boolean_t * is_ci)3265 zfs_fill_zplprops_root(uint64_t spa_vers, nvlist_t *createprops,
3266     nvlist_t *zplprops, boolean_t *is_ci)
3267 {
3268 	boolean_t fuids_ok;
3269 	boolean_t sa_ok;
3270 	uint64_t zplver = ZPL_VERSION;
3271 	int error;
3272 
3273 	zplver = zfs_zpl_version_map(spa_vers);
3274 	fuids_ok = (zplver >= ZPL_VERSION_FUID);
3275 	sa_ok = (zplver >= ZPL_VERSION_SA);
3276 
3277 	error = zfs_fill_zplprops_impl(NULL, zplver, fuids_ok, sa_ok,
3278 	    createprops, zplprops, is_ci);
3279 	return (error);
3280 }
3281 
3282 /*
3283  * innvl: {
3284  *     "type" -> dmu_objset_type_t (int32)
3285  *     (optional) "props" -> { prop -> value }
3286  *     (optional) "hidden_args" -> { "wkeydata" -> value }
3287  *         raw uint8_t array of encryption wrapping key data (32 bytes)
3288  * }
3289  *
3290  * outnvl: propname -> error code (int32)
3291  */
3292 
3293 static const zfs_ioc_key_t zfs_keys_create[] = {
3294 	{"type",	DATA_TYPE_INT32,	0},
3295 	{"props",	DATA_TYPE_NVLIST,	ZK_OPTIONAL},
3296 	{"hidden_args",	DATA_TYPE_NVLIST,	ZK_OPTIONAL},
3297 };
3298 
3299 static int
zfs_ioc_create(const char * fsname,nvlist_t * innvl,nvlist_t * outnvl)3300 zfs_ioc_create(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
3301 {
3302 	int error = 0;
3303 	zfs_creat_t zct = { 0 };
3304 	nvlist_t *nvprops = NULL;
3305 	nvlist_t *hidden_args = NULL;
3306 	void (*cbfunc)(objset_t *os, void *arg, cred_t *cr, dmu_tx_t *tx);
3307 	dmu_objset_type_t type;
3308 	boolean_t is_insensitive = B_FALSE;
3309 	dsl_crypto_params_t *dcp = NULL;
3310 
3311 	type = (dmu_objset_type_t)fnvlist_lookup_int32(innvl, "type");
3312 	(void) nvlist_lookup_nvlist(innvl, "props", &nvprops);
3313 	(void) nvlist_lookup_nvlist(innvl, ZPOOL_HIDDEN_ARGS, &hidden_args);
3314 
3315 	switch (type) {
3316 	case DMU_OST_ZFS:
3317 		cbfunc = zfs_create_cb;
3318 		break;
3319 
3320 	case DMU_OST_ZVOL:
3321 		cbfunc = zvol_create_cb;
3322 		break;
3323 
3324 	default:
3325 		cbfunc = NULL;
3326 		break;
3327 	}
3328 	if (strchr(fsname, '@') ||
3329 	    strchr(fsname, '%'))
3330 		return (SET_ERROR(EINVAL));
3331 
3332 	zct.zct_props = nvprops;
3333 
3334 	if (cbfunc == NULL)
3335 		return (SET_ERROR(EINVAL));
3336 
3337 	if (type == DMU_OST_ZVOL) {
3338 		uint64_t volsize, volblocksize;
3339 
3340 		if (nvprops == NULL)
3341 			return (SET_ERROR(EINVAL));
3342 		if (nvlist_lookup_uint64(nvprops,
3343 		    zfs_prop_to_name(ZFS_PROP_VOLSIZE), &volsize) != 0)
3344 			return (SET_ERROR(EINVAL));
3345 
3346 		if ((error = nvlist_lookup_uint64(nvprops,
3347 		    zfs_prop_to_name(ZFS_PROP_VOLBLOCKSIZE),
3348 		    &volblocksize)) != 0 && error != ENOENT)
3349 			return (SET_ERROR(EINVAL));
3350 
3351 		if (error != 0)
3352 			volblocksize = zfs_prop_default_numeric(
3353 			    ZFS_PROP_VOLBLOCKSIZE);
3354 
3355 		if ((error = zvol_check_volblocksize(
3356 		    volblocksize)) != 0 ||
3357 		    (error = zvol_check_volsize(volsize,
3358 		    volblocksize)) != 0)
3359 			return (error);
3360 	} else if (type == DMU_OST_ZFS) {
3361 		int error;
3362 
3363 		/*
3364 		 * We have to have normalization and
3365 		 * case-folding flags correct when we do the
3366 		 * file system creation, so go figure them out
3367 		 * now.
3368 		 */
3369 		VERIFY(nvlist_alloc(&zct.zct_zplprops,
3370 		    NV_UNIQUE_NAME, KM_SLEEP) == 0);
3371 		error = zfs_fill_zplprops(fsname, nvprops,
3372 		    zct.zct_zplprops, &is_insensitive);
3373 		if (error != 0) {
3374 			nvlist_free(zct.zct_zplprops);
3375 			return (error);
3376 		}
3377 	}
3378 
3379 	error = dsl_crypto_params_create_nvlist(DCP_CMD_NONE, nvprops,
3380 	    hidden_args, &dcp);
3381 	if (error != 0) {
3382 		nvlist_free(zct.zct_zplprops);
3383 		return (error);
3384 	}
3385 
3386 	error = dmu_objset_create(fsname, type,
3387 	    is_insensitive ? DS_FLAG_CI_DATASET : 0, dcp, cbfunc, &zct);
3388 
3389 	nvlist_free(zct.zct_zplprops);
3390 	dsl_crypto_params_free(dcp, !!error);
3391 
3392 	/*
3393 	 * It would be nice to do this atomically.
3394 	 */
3395 	if (error == 0) {
3396 		error = zfs_set_prop_nvlist(fsname, ZPROP_SRC_LOCAL,
3397 		    nvprops, outnvl);
3398 		if (error != 0)
3399 			(void) dsl_destroy_head(fsname);
3400 	}
3401 	return (error);
3402 }
3403 
3404 /*
3405  * innvl: {
3406  *     "origin" -> name of origin snapshot
3407  *     (optional) "props" -> { prop -> value }
3408  *     (optional) "hidden_args" -> { "wkeydata" -> value }
3409  *         raw uint8_t array of encryption wrapping key data (32 bytes)
3410  * }
3411  *
3412  * outnvl: propname -> error code (int32)
3413  */
3414 static const zfs_ioc_key_t zfs_keys_clone[] = {
3415 	{"origin",	DATA_TYPE_STRING,	0},
3416 	{"props",	DATA_TYPE_NVLIST,	ZK_OPTIONAL},
3417 	{"hidden_args",	DATA_TYPE_NVLIST,	ZK_OPTIONAL},
3418 };
3419 
3420 static int
zfs_ioc_clone(const char * fsname,nvlist_t * innvl,nvlist_t * outnvl)3421 zfs_ioc_clone(const char *fsname, nvlist_t *innvl, nvlist_t *outnvl)
3422 {
3423 	int error = 0;
3424 	nvlist_t *nvprops = NULL;
3425 	char *origin_name;
3426 
3427 	if (nvlist_lookup_string(innvl, "origin", &origin_name) != 0)
3428 		return (SET_ERROR(EINVAL));
3429 	(void) nvlist_lookup_nvlist(innvl, "props", &nvprops);
3430 
3431 	if (strchr(fsname, '@') ||
3432 	    strchr(fsname, '%'))
3433 		return (SET_ERROR(EINVAL));
3434 
3435 	if (dataset_namecheck(origin_name, NULL, NULL) != 0)
3436 		return (SET_ERROR(EINVAL));
3437 
3438 	error = dmu_objset_clone(fsname, origin_name);
3439 
3440 	/*
3441 	 * It would be nice to do this atomically.
3442 	 */
3443 	if (error == 0) {
3444 		error = zfs_set_prop_nvlist(fsname, ZPROP_SRC_LOCAL,
3445