1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21 /*
22 * Copyright 2010 Sun Microsystems, Inc. All rights reserved.
23 * Use is subject to license terms.
24 */
25
26 #include <sys/zfs_context.h>
27 #include <sys/dmu.h>
28 #include <sys/avl.h>
29 #include <sys/zap.h>
30 #include <sys/refcount.h>
31 #include <sys/nvpair.h>
32 #ifdef _KERNEL
33 #include <sys/kidmap.h>
34 #include <sys/sid.h>
35 #include <sys/zfs_vfsops.h>
36 #include <sys/zfs_znode.h>
37 #endif
38 #include <sys/zfs_fuid.h>
39
40 /*
41 * FUID Domain table(s).
42 *
43 * The FUID table is stored as a packed nvlist of an array
44 * of nvlists which contain an index, domain string and offset
45 *
46 * During file system initialization the nvlist(s) are read and
47 * two AVL trees are created. One tree is keyed by the index number
48 * and the other by the domain string. Nodes are never removed from
49 * trees, but new entries may be added. If a new entry is added then
50 * the zfsvfs->z_fuid_dirty flag is set to true and the caller will then
51 * be responsible for calling zfs_fuid_sync() to sync the changes to disk.
52 *
53 */
54
55 #define FUID_IDX "fuid_idx"
56 #define FUID_DOMAIN "fuid_domain"
57 #define FUID_OFFSET "fuid_offset"
58 #define FUID_NVP_ARRAY "fuid_nvlist"
59
60 typedef struct fuid_domain {
61 avl_node_t f_domnode;
62 avl_node_t f_idxnode;
63 ksiddomain_t *f_ksid;
64 uint64_t f_idx;
65 } fuid_domain_t;
66
67 static char *nulldomain = "";
68
69 /*
70 * Compare two indexes.
71 */
72 static int
idx_compare(const void * arg1,const void * arg2)73 idx_compare(const void *arg1, const void *arg2)
74 {
75 const fuid_domain_t *node1 = arg1;
76 const fuid_domain_t *node2 = arg2;
77
78 if (node1->f_idx < node2->f_idx)
79 return (-1);
80 else if (node1->f_idx > node2->f_idx)
81 return (1);
82 return (0);
83 }
84
85 /*
86 * Compare two domain strings.
87 */
88 static int
domain_compare(const void * arg1,const void * arg2)89 domain_compare(const void *arg1, const void *arg2)
90 {
91 const fuid_domain_t *node1 = arg1;
92 const fuid_domain_t *node2 = arg2;
93 int val;
94
95 val = strcmp(node1->f_ksid->kd_name, node2->f_ksid->kd_name);
96 if (val == 0)
97 return (0);
98 return (val > 0 ? 1 : -1);
99 }
100
101 void
zfs_fuid_avl_tree_create(avl_tree_t * idx_tree,avl_tree_t * domain_tree)102 zfs_fuid_avl_tree_create(avl_tree_t *idx_tree, avl_tree_t *domain_tree)
103 {
104 avl_create(idx_tree, idx_compare,
105 sizeof (fuid_domain_t), offsetof(fuid_domain_t, f_idxnode));
106 avl_create(domain_tree, domain_compare,
107 sizeof (fuid_domain_t), offsetof(fuid_domain_t, f_domnode));
108 }
109
110 /*
111 * load initial fuid domain and idx trees. This function is used by
112 * both the kernel and zdb.
113 */
114 uint64_t
zfs_fuid_table_load(objset_t * os,uint64_t fuid_obj,avl_tree_t * idx_tree,avl_tree_t * domain_tree)115 zfs_fuid_table_load(objset_t *os, uint64_t fuid_obj, avl_tree_t *idx_tree,
116 avl_tree_t *domain_tree)
117 {
118 dmu_buf_t *db;
119 uint64_t fuid_size;
120
121 ASSERT(fuid_obj != 0);
122 VERIFY(0 == dmu_bonus_hold(os, fuid_obj,
123 FTAG, &db));
124 fuid_size = *(uint64_t *)db->db_data;
125 dmu_buf_rele(db, FTAG);
126
127 if (fuid_size) {
128 nvlist_t **fuidnvp;
129 nvlist_t *nvp = NULL;
130 uint_t count;
131 char *packed;
132 int i;
133
134 packed = kmem_alloc(fuid_size, KM_SLEEP);
135 VERIFY(dmu_read(os, fuid_obj, 0,
136 fuid_size, packed, DMU_READ_PREFETCH) == 0);
137 VERIFY(nvlist_unpack(packed, fuid_size,
138 &nvp, 0) == 0);
139 VERIFY(nvlist_lookup_nvlist_array(nvp, FUID_NVP_ARRAY,
140 &fuidnvp, &count) == 0);
141
142 for (i = 0; i != count; i++) {
143 fuid_domain_t *domnode;
144 char *domain;
145 uint64_t idx;
146
147 VERIFY(nvlist_lookup_string(fuidnvp[i], FUID_DOMAIN,
148 &domain) == 0);
149 VERIFY(nvlist_lookup_uint64(fuidnvp[i], FUID_IDX,
150 &idx) == 0);
151
152 domnode = kmem_alloc(sizeof (fuid_domain_t), KM_SLEEP);
153
154 domnode->f_idx = idx;
155 domnode->f_ksid = ksid_lookupdomain(domain);
156 avl_add(idx_tree, domnode);
157 avl_add(domain_tree, domnode);
158 }
159 nvlist_free(nvp);
160 kmem_free(packed, fuid_size);
161 }
162 return (fuid_size);
163 }
164
165 void
zfs_fuid_table_destroy(avl_tree_t * idx_tree,avl_tree_t * domain_tree)166 zfs_fuid_table_destroy(avl_tree_t *idx_tree, avl_tree_t *domain_tree)
167 {
168 fuid_domain_t *domnode;
169 void *cookie;
170
171 cookie = NULL;
172 while (domnode = avl_destroy_nodes(domain_tree, &cookie))
173 ksiddomain_rele(domnode->f_ksid);
174
175 avl_destroy(domain_tree);
176 cookie = NULL;
177 while (domnode = avl_destroy_nodes(idx_tree, &cookie))
178 kmem_free(domnode, sizeof (fuid_domain_t));
179 avl_destroy(idx_tree);
180 }
181
182 char *
zfs_fuid_idx_domain(avl_tree_t * idx_tree,uint32_t idx)183 zfs_fuid_idx_domain(avl_tree_t *idx_tree, uint32_t idx)
184 {
185 fuid_domain_t searchnode, *findnode;
186 avl_index_t loc;
187
188 searchnode.f_idx = idx;
189
190 findnode = avl_find(idx_tree, &searchnode, &loc);
191
192 return (findnode ? findnode->f_ksid->kd_name : nulldomain);
193 }
194
195 #ifdef _KERNEL
196 /*
197 * Load the fuid table(s) into memory.
198 */
199 static void
zfs_fuid_init(zfsvfs_t * zfsvfs)200 zfs_fuid_init(zfsvfs_t *zfsvfs)
201 {
202 rw_enter(&zfsvfs->z_fuid_lock, RW_WRITER);
203
204 if (zfsvfs->z_fuid_loaded) {
205 rw_exit(&zfsvfs->z_fuid_lock);
206 return;
207 }
208
209 zfs_fuid_avl_tree_create(&zfsvfs->z_fuid_idx, &zfsvfs->z_fuid_domain);
210
211 (void) zap_lookup(zfsvfs->z_os, MASTER_NODE_OBJ,
212 ZFS_FUID_TABLES, 8, 1, &zfsvfs->z_fuid_obj);
213 if (zfsvfs->z_fuid_obj != 0) {
214 zfsvfs->z_fuid_size = zfs_fuid_table_load(zfsvfs->z_os,
215 zfsvfs->z_fuid_obj, &zfsvfs->z_fuid_idx,
216 &zfsvfs->z_fuid_domain);
217 }
218
219 zfsvfs->z_fuid_loaded = B_TRUE;
220 rw_exit(&zfsvfs->z_fuid_lock);
221 }
222
223 /*
224 * sync out AVL trees to persistent storage.
225 */
226 void
zfs_fuid_sync(zfsvfs_t * zfsvfs,dmu_tx_t * tx)227 zfs_fuid_sync(zfsvfs_t *zfsvfs, dmu_tx_t *tx)
228 {
229 nvlist_t *nvp;
230 nvlist_t **fuids;
231 size_t nvsize = 0;
232 char *packed;
233 dmu_buf_t *db;
234 fuid_domain_t *domnode;
235 int numnodes;
236 int i;
237
238 if (!zfsvfs->z_fuid_dirty) {
239 return;
240 }
241
242 rw_enter(&zfsvfs->z_fuid_lock, RW_WRITER);
243
244 /*
245 * First see if table needs to be created?
246 */
247 if (zfsvfs->z_fuid_obj == 0) {
248 zfsvfs->z_fuid_obj = dmu_object_alloc(zfsvfs->z_os,
249 DMU_OT_FUID, 1 << 14, DMU_OT_FUID_SIZE,
250 sizeof (uint64_t), tx);
251 VERIFY(zap_add(zfsvfs->z_os, MASTER_NODE_OBJ,
252 ZFS_FUID_TABLES, sizeof (uint64_t), 1,
253 &zfsvfs->z_fuid_obj, tx) == 0);
254 }
255
256 VERIFY(nvlist_alloc(&nvp, NV_UNIQUE_NAME, KM_SLEEP) == 0);
257
258 numnodes = avl_numnodes(&zfsvfs->z_fuid_idx);
259 fuids = kmem_alloc(numnodes * sizeof (void *), KM_SLEEP);
260 for (i = 0, domnode = avl_first(&zfsvfs->z_fuid_domain); domnode; i++,
261 domnode = AVL_NEXT(&zfsvfs->z_fuid_domain, domnode)) {
262 VERIFY(nvlist_alloc(&fuids[i], NV_UNIQUE_NAME, KM_SLEEP) == 0);
263 VERIFY(nvlist_add_uint64(fuids[i], FUID_IDX,
264 domnode->f_idx) == 0);
265 VERIFY(nvlist_add_uint64(fuids[i], FUID_OFFSET, 0) == 0);
266 VERIFY(nvlist_add_string(fuids[i], FUID_DOMAIN,
267 domnode->f_ksid->kd_name) == 0);
268 }
269 VERIFY(nvlist_add_nvlist_array(nvp, FUID_NVP_ARRAY,
270 fuids, numnodes) == 0);
271 for (i = 0; i != numnodes; i++)
272 nvlist_free(fuids[i]);
273 kmem_free(fuids, numnodes * sizeof (void *));
274 VERIFY(nvlist_size(nvp, &nvsize, NV_ENCODE_XDR) == 0);
275 packed = kmem_alloc(nvsize, KM_SLEEP);
276 VERIFY(nvlist_pack(nvp, &packed, &nvsize,
277 NV_ENCODE_XDR, KM_SLEEP) == 0);
278 nvlist_free(nvp);
279 zfsvfs->z_fuid_size = nvsize;
280 dmu_write(zfsvfs->z_os, zfsvfs->z_fuid_obj, 0,
281 zfsvfs->z_fuid_size, packed, tx);
282 kmem_free(packed, zfsvfs->z_fuid_size);
283 VERIFY(0 == dmu_bonus_hold(zfsvfs->z_os, zfsvfs->z_fuid_obj,
284 FTAG, &db));
285 dmu_buf_will_dirty(db, tx);
286 *(uint64_t *)db->db_data = zfsvfs->z_fuid_size;
287 dmu_buf_rele(db, FTAG);
288
289 zfsvfs->z_fuid_dirty = B_FALSE;
290 rw_exit(&zfsvfs->z_fuid_lock);
291 }
292
293 /*
294 * Query domain table for a given domain.
295 *
296 * If domain isn't found and addok is set, it is added to AVL trees and
297 * the zfsvfs->z_fuid_dirty flag will be set to TRUE. It will then be
298 * necessary for the caller or another thread to detect the dirty table
299 * and sync out the changes.
300 */
301 int
zfs_fuid_find_by_domain(zfsvfs_t * zfsvfs,const char * domain,char ** retdomain,boolean_t addok)302 zfs_fuid_find_by_domain(zfsvfs_t *zfsvfs, const char *domain,
303 char **retdomain, boolean_t addok)
304 {
305 fuid_domain_t searchnode, *findnode;
306 avl_index_t loc;
307 krw_t rw = RW_READER;
308
309 /*
310 * If the dummy "nobody" domain then return an index of 0
311 * to cause the created FUID to be a standard POSIX id
312 * for the user nobody.
313 */
314 if (domain[0] == '\0') {
315 if (retdomain)
316 *retdomain = nulldomain;
317 return (0);
318 }
319
320 searchnode.f_ksid = ksid_lookupdomain(domain);
321 if (retdomain)
322 *retdomain = searchnode.f_ksid->kd_name;
323 if (!zfsvfs->z_fuid_loaded)
324 zfs_fuid_init(zfsvfs);
325
326 retry:
327 rw_enter(&zfsvfs->z_fuid_lock, rw);
328 findnode = avl_find(&zfsvfs->z_fuid_domain, &searchnode, &loc);
329
330 if (findnode) {
331 rw_exit(&zfsvfs->z_fuid_lock);
332 ksiddomain_rele(searchnode.f_ksid);
333 return (findnode->f_idx);
334 } else if (addok) {
335 fuid_domain_t *domnode;
336 uint64_t retidx;
337
338 if (rw == RW_READER && !rw_tryupgrade(&zfsvfs->z_fuid_lock)) {
339 rw_exit(&zfsvfs->z_fuid_lock);
340 rw = RW_WRITER;
341 goto retry;
342 }
343
344 domnode = kmem_alloc(sizeof (fuid_domain_t), KM_SLEEP);
345 domnode->f_ksid = searchnode.f_ksid;
346
347 retidx = domnode->f_idx = avl_numnodes(&zfsvfs->z_fuid_idx) + 1;
348
349 avl_add(&zfsvfs->z_fuid_domain, domnode);
350 avl_add(&zfsvfs->z_fuid_idx, domnode);
351 zfsvfs->z_fuid_dirty = B_TRUE;
352 rw_exit(&zfsvfs->z_fuid_lock);
353 return (retidx);
354 } else {
355 rw_exit(&zfsvfs->z_fuid_lock);
356 return (-1);
357 }
358 }
359
360 /*
361 * Query domain table by index, returning domain string
362 *
363 * Returns a pointer from an avl node of the domain string.
364 *
365 */
366 const char *
zfs_fuid_find_by_idx(zfsvfs_t * zfsvfs,uint32_t idx)367 zfs_fuid_find_by_idx(zfsvfs_t *zfsvfs, uint32_t idx)
368 {
369 char *domain;
370
371 if (idx == 0 || !zfsvfs->z_use_fuids)
372 return (NULL);
373
374 if (!zfsvfs->z_fuid_loaded)
375 zfs_fuid_init(zfsvfs);
376
377 rw_enter(&zfsvfs->z_fuid_lock, RW_READER);
378
379 if (zfsvfs->z_fuid_obj)
380 domain = zfs_fuid_idx_domain(&zfsvfs->z_fuid_idx, idx);
381 else
382 domain = nulldomain;
383 rw_exit(&zfsvfs->z_fuid_lock);
384
385 ASSERT(domain);
386 return (domain);
387 }
388
389 void
zfs_fuid_map_ids(znode_t * zp,cred_t * cr,uid_t * uidp,uid_t * gidp)390 zfs_fuid_map_ids(znode_t *zp, cred_t *cr, uid_t *uidp, uid_t *gidp)
391 {
392 *uidp = zfs_fuid_map_id(zp->z_zfsvfs, zp->z_phys->zp_uid,
393 cr, ZFS_OWNER);
394 *gidp = zfs_fuid_map_id(zp->z_zfsvfs, zp->z_phys->zp_gid,
395 cr, ZFS_GROUP);
396 }
397
398 uid_t
zfs_fuid_map_id(zfsvfs_t * zfsvfs,uint64_t fuid,cred_t * cr,zfs_fuid_type_t type)399 zfs_fuid_map_id(zfsvfs_t *zfsvfs, uint64_t fuid,
400 cred_t *cr, zfs_fuid_type_t type)
401 {
402 uint32_t index = FUID_INDEX(fuid);
403 const char *domain;
404 uid_t id;
405
406 if (index == 0)
407 return (fuid);
408
409 domain = zfs_fuid_find_by_idx(zfsvfs, index);
410 ASSERT(domain != NULL);
411
412 if (type == ZFS_OWNER || type == ZFS_ACE_USER) {
413 (void) kidmap_getuidbysid(crgetzone(cr), domain,
414 FUID_RID(fuid), &id);
415 } else {
416 (void) kidmap_getgidbysid(crgetzone(cr), domain,
417 FUID_RID(fuid), &id);
418 }
419 return (id);
420 }
421
422 /*
423 * Add a FUID node to the list of fuid's being created for this
424 * ACL
425 *
426 * If ACL has multiple domains, then keep only one copy of each unique
427 * domain.
428 */
429 void
zfs_fuid_node_add(zfs_fuid_info_t ** fuidpp,const char * domain,uint32_t rid,uint64_t idx,uint64_t id,zfs_fuid_type_t type)430 zfs_fuid_node_add(zfs_fuid_info_t **fuidpp, const char *domain, uint32_t rid,
431 uint64_t idx, uint64_t id, zfs_fuid_type_t type)
432 {
433 zfs_fuid_t *fuid;
434 zfs_fuid_domain_t *fuid_domain;
435 zfs_fuid_info_t *fuidp;
436 uint64_t fuididx;
437 boolean_t found = B_FALSE;
438
439 if (*fuidpp == NULL)
440 *fuidpp = zfs_fuid_info_alloc();
441
442 fuidp = *fuidpp;
443 /*
444 * First find fuid domain index in linked list
445 *
446 * If one isn't found then create an entry.
447 */
448
449 for (fuididx = 1, fuid_domain = list_head(&fuidp->z_domains);
450 fuid_domain; fuid_domain = list_next(&fuidp->z_domains,
451 fuid_domain), fuididx++) {
452 if (idx == fuid_domain->z_domidx) {
453 found = B_TRUE;
454 break;
455 }
456 }
457
458 if (!found) {
459 fuid_domain = kmem_alloc(sizeof (zfs_fuid_domain_t), KM_SLEEP);
460 fuid_domain->z_domain = domain;
461 fuid_domain->z_domidx = idx;
462 list_insert_tail(&fuidp->z_domains, fuid_domain);
463 fuidp->z_domain_str_sz += strlen(domain) + 1;
464 fuidp->z_domain_cnt++;
465 }
466
467 if (type == ZFS_ACE_USER || type == ZFS_ACE_GROUP) {
468
469 /*
470 * Now allocate fuid entry and add it on the end of the list
471 */
472
473 fuid = kmem_alloc(sizeof (zfs_fuid_t), KM_SLEEP);
474 fuid->z_id = id;
475 fuid->z_domidx = idx;
476 fuid->z_logfuid = FUID_ENCODE(fuididx, rid);
477
478 list_insert_tail(&fuidp->z_fuids, fuid);
479 fuidp->z_fuid_cnt++;
480 } else {
481 if (type == ZFS_OWNER)
482 fuidp->z_fuid_owner = FUID_ENCODE(fuididx, rid);
483 else
484 fuidp->z_fuid_group = FUID_ENCODE(fuididx, rid);
485 }
486 }
487
488 /*
489 * Create a file system FUID, based on information in the users cred
490 */
491 uint64_t
zfs_fuid_create_cred(zfsvfs_t * zfsvfs,zfs_fuid_type_t type,cred_t * cr,zfs_fuid_info_t ** fuidp)492 zfs_fuid_create_cred(zfsvfs_t *zfsvfs, zfs_fuid_type_t type,
493 cred_t *cr, zfs_fuid_info_t **fuidp)
494 {
495 uint64_t idx;
496 ksid_t *ksid;
497 uint32_t rid;
498 char *kdomain;
499 const char *domain;
500 uid_t id;
501
502 VERIFY(type == ZFS_OWNER || type == ZFS_GROUP);
503
504 if (type == ZFS_OWNER)
505 id = crgetuid(cr);
506 else
507 id = crgetgid(cr);
508
509 #ifdef PORT_SOLARIS
510 ksid = crgetsid(cr, (type == ZFS_OWNER) ? KSID_OWNER : KSID_GROUP);
511 if (ksid) {
512 id = ksid_getid(ksid);
513 } else {
514 if (type == ZFS_OWNER)
515 id = crgetuid(cr);
516 else
517 id = crgetgid(cr);
518
519 if (IS_EPHEMERAL(id)) {
520 return ((uint64_t)(type == ZFS_OWNER ?
521 UID_NOBODY : GID_NOBODY));
522 }
523 }
524 #endif
525
526 if (!zfsvfs->z_use_fuids || (!IS_EPHEMERAL(id)))
527 return ((uint64_t)id);
528
529 #ifdef PORT_SOLARIS
530 rid = ksid_getrid(ksid);
531 domain = ksid_getdomain(ksid);
532
533 idx = zfs_fuid_find_by_domain(zfsvfs, domain, &kdomain, B_TRUE);
534
535 zfs_fuid_node_add(fuidp, kdomain, rid, idx, id, type);
536
537 return (FUID_ENCODE(idx, rid));
538 #else
539 panic(__func__);
540 #endif
541 }
542
543 /*
544 * Create a file system FUID for an ACL ace
545 * or a chown/chgrp of the file.
546 * This is similar to zfs_fuid_create_cred, except that
547 * we can't find the domain + rid information in the
548 * cred. Instead we have to query Winchester for the
549 * domain and rid.
550 *
551 * During replay operations the domain+rid information is
552 * found in the zfs_fuid_info_t that the replay code has
553 * attached to the zfsvfs of the file system.
554 */
555 uint64_t
zfs_fuid_create(zfsvfs_t * zfsvfs,uint64_t id,cred_t * cr,zfs_fuid_type_t type,zfs_fuid_info_t ** fuidpp)556 zfs_fuid_create(zfsvfs_t *zfsvfs, uint64_t id, cred_t *cr,
557 zfs_fuid_type_t type, zfs_fuid_info_t **fuidpp)
558 {
559 const char *domain;
560 char *kdomain;
561 uint32_t fuid_idx = FUID_INDEX(id);
562 uint32_t rid;
563 idmap_stat status;
564 uint64_t idx;
565 zfs_fuid_t *zfuid = NULL;
566 zfs_fuid_info_t *fuidp;
567
568 /*
569 * If POSIX ID, or entry is already a FUID then
570 * just return the id
571 *
572 * We may also be handed an already FUID'ized id via
573 * chmod.
574 */
575
576 if (!zfsvfs->z_use_fuids || !IS_EPHEMERAL(id) || fuid_idx != 0)
577 return (id);
578
579 if (zfsvfs->z_replay) {
580 fuidp = zfsvfs->z_fuid_replay;
581
582 /*
583 * If we are passed an ephemeral id, but no
584 * fuid_info was logged then return NOBODY.
585 * This is most likely a result of idmap service
586 * not being available.
587 */
588 /* XXX NetBSD we need to define UID_NOBODY in
589 kernel sources otherwise */
590 if (fuidp == NULL)
591 return (crgetuid(cr));
592
593 switch (type) {
594 case ZFS_ACE_USER:
595 case ZFS_ACE_GROUP:
596 zfuid = list_head(&fuidp->z_fuids);
597 rid = FUID_RID(zfuid->z_logfuid);
598 idx = FUID_INDEX(zfuid->z_logfuid);
599 break;
600 case ZFS_OWNER:
601 rid = FUID_RID(fuidp->z_fuid_owner);
602 idx = FUID_INDEX(fuidp->z_fuid_owner);
603 break;
604 case ZFS_GROUP:
605 rid = FUID_RID(fuidp->z_fuid_group);
606 idx = FUID_INDEX(fuidp->z_fuid_group);
607 break;
608 };
609 domain = fuidp->z_domain_table[idx -1];
610 } else {
611 #ifdef PORT_SOLARIS
612 if (type == ZFS_OWNER || type == ZFS_ACE_USER)
613 status = kidmap_getsidbyuid(crgetzone(cr), id,
614 &domain, &rid);
615 else
616 status = kidmap_getsidbygid(crgetzone(cr), id,
617 &domain, &rid);
618
619 if (status != 0) {
620 /*
621 * When returning nobody we will need to
622 * make a dummy fuid table entry for logging
623 * purposes.
624 */
625 rid = UID_NOBODY;
626 domain = nulldomain;
627 }
628 #else
629 panic(__func__);
630 #endif
631 }
632
633 idx = zfs_fuid_find_by_domain(zfsvfs, domain, &kdomain, B_TRUE);
634
635 if (!zfsvfs->z_replay)
636 zfs_fuid_node_add(fuidpp, kdomain,
637 rid, idx, id, type);
638 else if (zfuid != NULL) {
639 list_remove(&fuidp->z_fuids, zfuid);
640 kmem_free(zfuid, sizeof (zfs_fuid_t));
641 }
642 return (FUID_ENCODE(idx, rid));
643 }
644
645 void
zfs_fuid_destroy(zfsvfs_t * zfsvfs)646 zfs_fuid_destroy(zfsvfs_t *zfsvfs)
647 {
648 rw_enter(&zfsvfs->z_fuid_lock, RW_WRITER);
649 if (!zfsvfs->z_fuid_loaded) {
650 rw_exit(&zfsvfs->z_fuid_lock);
651 return;
652 }
653 zfs_fuid_table_destroy(&zfsvfs->z_fuid_idx, &zfsvfs->z_fuid_domain);
654 rw_exit(&zfsvfs->z_fuid_lock);
655 }
656
657 /*
658 * Allocate zfs_fuid_info for tracking FUIDs created during
659 * zfs_mknode, VOP_SETATTR() or VOP_SETSECATTR()
660 */
661 zfs_fuid_info_t *
zfs_fuid_info_alloc(void)662 zfs_fuid_info_alloc(void)
663 {
664 zfs_fuid_info_t *fuidp;
665
666 fuidp = kmem_zalloc(sizeof (zfs_fuid_info_t), KM_SLEEP);
667 list_create(&fuidp->z_domains, sizeof (zfs_fuid_domain_t),
668 offsetof(zfs_fuid_domain_t, z_next));
669 list_create(&fuidp->z_fuids, sizeof (zfs_fuid_t),
670 offsetof(zfs_fuid_t, z_next));
671 return (fuidp);
672 }
673
674 /*
675 * Release all memory associated with zfs_fuid_info_t
676 */
677 void
zfs_fuid_info_free(zfs_fuid_info_t * fuidp)678 zfs_fuid_info_free(zfs_fuid_info_t *fuidp)
679 {
680 zfs_fuid_t *zfuid;
681 zfs_fuid_domain_t *zdomain;
682
683 while ((zfuid = list_head(&fuidp->z_fuids)) != NULL) {
684 list_remove(&fuidp->z_fuids, zfuid);
685 kmem_free(zfuid, sizeof (zfs_fuid_t));
686 }
687
688 if (fuidp->z_domain_table != NULL)
689 kmem_free(fuidp->z_domain_table,
690 (sizeof (char **)) * fuidp->z_domain_cnt);
691
692 while ((zdomain = list_head(&fuidp->z_domains)) != NULL) {
693 list_remove(&fuidp->z_domains, zdomain);
694 kmem_free(zdomain, sizeof (zfs_fuid_domain_t));
695 }
696
697 kmem_free(fuidp, sizeof (zfs_fuid_info_t));
698 }
699
700 /*
701 * Check to see if id is a groupmember. If cred
702 * has ksid info then sidlist is checked first
703 * and if still not found then POSIX groups are checked
704 *
705 * Will use a straight FUID compare when possible.
706 */
707 boolean_t
zfs_groupmember(zfsvfs_t * zfsvfs,uint64_t id,cred_t * cr)708 zfs_groupmember(zfsvfs_t *zfsvfs, uint64_t id, cred_t *cr)
709 {
710 ksid_t *ksid = crgetsid(cr, KSID_GROUP);
711 uid_t gid;
712
713 #ifdef PORT_SOLARIS
714 ksidlist_t *ksidlist = crgetsidlist(cr);
715
716 if (ksid && ksidlist) {
717 int i;
718 ksid_t *ksid_groups;
719 uint32_t idx = FUID_INDEX(id);
720 uint32_t rid = FUID_RID(id);
721
722 ksid_groups = ksidlist->ksl_sids;
723
724 for (i = 0; i != ksidlist->ksl_nsid; i++) {
725 if (idx == 0) {
726 if (id != IDMAP_WK_CREATOR_GROUP_GID &&
727 id == ksid_groups[i].ks_id) {
728 return (B_TRUE);
729 }
730 } else {
731 const char *domain;
732
733 domain = zfs_fuid_find_by_idx(zfsvfs, idx);
734 ASSERT(domain != NULL);
735
736 if (strcmp(domain,
737 IDMAP_WK_CREATOR_SID_AUTHORITY) == 0)
738 return (B_FALSE);
739
740 if ((strcmp(domain,
741 ksid_groups[i].ks_domain->kd_name) == 0) &&
742 rid == ksid_groups[i].ks_rid)
743 return (B_TRUE);
744 }
745 }
746 }
747 #endif
748 /*
749 * Not found in ksidlist, check posix groups
750 */
751 gid = zfs_fuid_map_id(zfsvfs, id, cr, ZFS_GROUP);
752 return (groupmember(gid, cr));
753 }
754
755 void
zfs_fuid_txhold(zfsvfs_t * zfsvfs,dmu_tx_t * tx)756 zfs_fuid_txhold(zfsvfs_t *zfsvfs, dmu_tx_t *tx)
757 {
758 if (zfsvfs->z_fuid_obj == 0) {
759 dmu_tx_hold_bonus(tx, DMU_NEW_OBJECT);
760 dmu_tx_hold_write(tx, DMU_NEW_OBJECT, 0,
761 FUID_SIZE_ESTIMATE(zfsvfs));
762 dmu_tx_hold_zap(tx, MASTER_NODE_OBJ, FALSE, NULL);
763 } else {
764 dmu_tx_hold_bonus(tx, zfsvfs->z_fuid_obj);
765 dmu_tx_hold_write(tx, zfsvfs->z_fuid_obj, 0,
766 FUID_SIZE_ESTIMATE(zfsvfs));
767 }
768 }
769 #endif
770