xref: /dragonfly/sys/kern/vfs_nlookup.c (revision c3762235)
1 /*
2  * Copyright (c) 2004 The DragonFly Project.  All rights reserved.
3  *
4  * This code is derived from software contributed to The DragonFly Project
5  * by Matthew Dillon <dillon@backplane.com>
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  *
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in
15  *    the documentation and/or other materials provided with the
16  *    distribution.
17  * 3. Neither the name of The DragonFly Project nor the names of its
18  *    contributors may be used to endorse or promote products derived
19  *    from this software without specific, prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
22  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
23  * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
24  * FOR A PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE
25  * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,
26  * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING,
27  * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
28  * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED
29  * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
30  * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
31  * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
32  * SUCH DAMAGE.
33  */
34 /*
35  * nlookup() is the 'new' namei interface.  Rather then return directory and
36  * leaf vnodes (in various lock states) the new interface instead deals in
37  * namecache records.  Namecache records may represent both a positive or
38  * a negative hit.  The namespace is locked via the namecache record instead
39  * of via the vnode, and only the leaf namecache record (representing the
40  * filename) needs to be locked.
41  *
42  * This greatly improves filesystem parallelism and is a huge simplification
43  * of the API verses the old vnode locking / namei scheme.
44  *
45  * Filesystems must actively control the caching aspects of the namecache,
46  * and since namecache pointers are used as handles they are non-optional
47  * even for filesystems which do not generally wish to cache things.  It is
48  * intended that a separate cache coherency API will be constructed to handle
49  * these issues.
50  */
51 
52 #include "opt_ktrace.h"
53 
54 #include <sys/param.h>
55 #include <sys/systm.h>
56 #include <sys/kernel.h>
57 #include <sys/vnode.h>
58 #include <sys/mount.h>
59 #include <sys/filedesc.h>
60 #include <sys/proc.h>
61 #include <sys/namei.h>
62 #include <sys/nlookup.h>
63 #include <sys/malloc.h>
64 #include <sys/stat.h>
65 #include <sys/objcache.h>
66 #include <sys/file.h>
67 
68 #ifdef KTRACE
69 #include <sys/ktrace.h>
70 #endif
71 
72 static int naccess(struct nchandle *nch, int vmode, struct ucred *cred,
73 		int *stickyp);
74 
75 /*
76  * Initialize a nlookup() structure, early error return for copyin faults
77  * or a degenerate empty string (which is not allowed).
78  *
79  * The first process proc0's credentials are used if the calling thread
80  * is not associated with a process context.
81  *
82  * MPSAFE
83  */
84 int
85 nlookup_init(struct nlookupdata *nd,
86 	     const char *path, enum uio_seg seg, int flags)
87 {
88     size_t pathlen;
89     struct proc *p;
90     thread_t td;
91     int error;
92 
93     td = curthread;
94     p = td->td_proc;
95 
96     /*
97      * note: the pathlen set by copy*str() includes the terminating \0.
98      */
99     bzero(nd, sizeof(struct nlookupdata));
100     nd->nl_path = objcache_get(namei_oc, M_WAITOK);
101     nd->nl_flags |= NLC_HASBUF;
102     if (seg == UIO_SYSSPACE)
103 	error = copystr(path, nd->nl_path, MAXPATHLEN, &pathlen);
104     else
105 	error = copyinstr(path, nd->nl_path, MAXPATHLEN, &pathlen);
106 
107     /*
108      * Don't allow empty pathnames.
109      * POSIX.1 requirement: "" is not a vaild file name.
110      */
111     if (error == 0 && pathlen <= 1)
112 	error = ENOENT;
113 
114     if (error == 0) {
115 	if (p && p->p_fd) {
116 	    cache_copy(&p->p_fd->fd_ncdir, &nd->nl_nch);
117 	    cache_copy(&p->p_fd->fd_nrdir, &nd->nl_rootnch);
118 	    if (p->p_fd->fd_njdir.ncp)
119 		cache_copy(&p->p_fd->fd_njdir, &nd->nl_jailnch);
120 	    nd->nl_cred = crhold(p->p_ucred);
121 	} else {
122 	    cache_copy(&rootnch, &nd->nl_nch);
123 	    cache_copy(&nd->nl_nch, &nd->nl_rootnch);
124 	    cache_copy(&nd->nl_nch, &nd->nl_jailnch);
125 	    nd->nl_cred = crhold(proc0.p_ucred);
126 	}
127 	nd->nl_td = td;
128 	nd->nl_flags |= flags;
129     } else {
130 	nlookup_done(nd);
131     }
132     return(error);
133 }
134 
135 
136 /*
137  * nlookup_init() for "at" family of syscalls.
138  *
139  * Works similarly to nlookup_init() but if path is relative and fd is not
140  * AT_FDCWD, path is interpreted relative to the directory pointed to by fd.
141  * In this case, the file entry pointed to by fd is ref'ed and returned in
142  * *fpp.
143  *
144  * If the call succeeds, nlookup_done_at() must be called to clean-up the nd
145  * and release the ref to the file entry.
146  */
147 int
148 nlookup_init_at(struct nlookupdata *nd, struct file **fpp, int fd,
149 		const char *path, enum uio_seg seg, int flags)
150 {
151 	struct thread *td = curthread;
152 	struct proc *p = td->td_proc;
153 	struct file* fp;
154 	struct vnode *vp;
155 	int error;
156 
157 	*fpp = NULL;
158 
159 	if  ((error = nlookup_init(nd, path, seg, flags)) != 0) {
160 		return (error);
161 	}
162 
163 	if (nd->nl_path[0] != '/' && fd != AT_FDCWD) {
164 		if ((error = holdvnode(p->p_fd, fd, &fp)) != 0)
165 			goto done;
166 		vp = (struct vnode*)fp->f_data;
167 		if (vp->v_type != VDIR || fp->f_nchandle.ncp == NULL) {
168 			fdrop(fp);
169 			fp = NULL;
170 			error = ENOTDIR;
171 			goto done;
172 		}
173 		cache_drop(&nd->nl_nch);
174 		cache_copy(&fp->f_nchandle, &nd->nl_nch);
175 		*fpp = fp;
176 	}
177 
178 
179 done:
180 	if (error)
181 		nlookup_done(nd);
182 	return (error);
183 
184 }
185 
186 /*
187  * This works similarly to nlookup_init() but does not assume a process
188  * context.  rootnch is always chosen for the root directory and the cred
189  * and starting directory are supplied in arguments.
190  */
191 int
192 nlookup_init_raw(struct nlookupdata *nd,
193 	     const char *path, enum uio_seg seg, int flags,
194 	     struct ucred *cred, struct nchandle *ncstart)
195 {
196     size_t pathlen;
197     thread_t td;
198     int error;
199 
200     td = curthread;
201 
202     bzero(nd, sizeof(struct nlookupdata));
203     nd->nl_path = objcache_get(namei_oc, M_WAITOK);
204     nd->nl_flags |= NLC_HASBUF;
205     if (seg == UIO_SYSSPACE)
206 	error = copystr(path, nd->nl_path, MAXPATHLEN, &pathlen);
207     else
208 	error = copyinstr(path, nd->nl_path, MAXPATHLEN, &pathlen);
209 
210     /*
211      * Don't allow empty pathnames.
212      * POSIX.1 requirement: "" is not a vaild file name.
213      */
214     if (error == 0 && pathlen <= 1)
215 	error = ENOENT;
216 
217     if (error == 0) {
218 	cache_copy(ncstart, &nd->nl_nch);
219 	cache_copy(&rootnch, &nd->nl_rootnch);
220 	cache_copy(&rootnch, &nd->nl_jailnch);
221 	nd->nl_cred = crhold(cred);
222 	nd->nl_td = td;
223 	nd->nl_flags |= flags;
224     } else {
225 	nlookup_done(nd);
226     }
227     return(error);
228 }
229 
230 /*
231  * This works similarly to nlookup_init_raw() but does not rely
232  * on rootnch being initialized yet.
233  */
234 int
235 nlookup_init_root(struct nlookupdata *nd,
236 	     const char *path, enum uio_seg seg, int flags,
237 	     struct ucred *cred, struct nchandle *ncstart,
238 	     struct nchandle *ncroot)
239 {
240     size_t pathlen;
241     thread_t td;
242     int error;
243 
244     td = curthread;
245 
246     bzero(nd, sizeof(struct nlookupdata));
247     nd->nl_path = objcache_get(namei_oc, M_WAITOK);
248     nd->nl_flags |= NLC_HASBUF;
249     if (seg == UIO_SYSSPACE)
250 	error = copystr(path, nd->nl_path, MAXPATHLEN, &pathlen);
251     else
252 	error = copyinstr(path, nd->nl_path, MAXPATHLEN, &pathlen);
253 
254     /*
255      * Don't allow empty pathnames.
256      * POSIX.1 requirement: "" is not a vaild file name.
257      */
258     if (error == 0 && pathlen <= 1)
259 	error = ENOENT;
260 
261     if (error == 0) {
262 	cache_copy(ncstart, &nd->nl_nch);
263 	cache_copy(ncroot, &nd->nl_rootnch);
264 	cache_copy(ncroot, &nd->nl_jailnch);
265 	nd->nl_cred = crhold(cred);
266 	nd->nl_td = td;
267 	nd->nl_flags |= flags;
268     } else {
269 	nlookup_done(nd);
270     }
271     return(error);
272 }
273 
274 /*
275  * Set a different credential; this credential will be used by future
276  * operations performed on nd.nl_open_vp and nlookupdata structure.
277  */
278 void
279 nlookup_set_cred(struct nlookupdata *nd, struct ucred *cred)
280 {
281 	KKASSERT(nd->nl_cred != NULL);
282 
283 	if (nd->nl_cred != cred) {
284 		cred = crhold(cred);
285 		crfree(nd->nl_cred);
286 		nd->nl_cred = cred;
287 	}
288 }
289 
290 /*
291  * Cleanup a nlookupdata structure after we are through with it.  This may
292  * be called on any nlookupdata structure initialized with nlookup_init().
293  * Calling nlookup_done() is mandatory in all cases except where nlookup_init()
294  * returns an error, even if as a consumer you believe you have taken all
295  * dynamic elements out of the nlookupdata structure.
296  */
297 void
298 nlookup_done(struct nlookupdata *nd)
299 {
300     if (nd->nl_nch.ncp) {
301 	if (nd->nl_flags & NLC_NCPISLOCKED) {
302 	    nd->nl_flags &= ~NLC_NCPISLOCKED;
303 	    cache_unlock(&nd->nl_nch);
304 	}
305 	cache_drop(&nd->nl_nch);	/* NULL's out the nch */
306     }
307     if (nd->nl_rootnch.ncp)
308 	cache_drop(&nd->nl_rootnch);
309     if (nd->nl_jailnch.ncp)
310 	cache_drop(&nd->nl_jailnch);
311     if ((nd->nl_flags & NLC_HASBUF) && nd->nl_path) {
312 	objcache_put(namei_oc, nd->nl_path);
313 	nd->nl_path = NULL;
314     }
315     if (nd->nl_cred) {
316 	crfree(nd->nl_cred);
317 	nd->nl_cred = NULL;
318     }
319     if (nd->nl_open_vp) {
320 	if (nd->nl_flags & NLC_LOCKVP) {
321 		vn_unlock(nd->nl_open_vp);
322 		nd->nl_flags &= ~NLC_LOCKVP;
323 	}
324 	vn_close(nd->nl_open_vp, nd->nl_vp_fmode);
325 	nd->nl_open_vp = NULL;
326     }
327     if (nd->nl_dvp) {
328 	vrele(nd->nl_dvp);
329 	nd->nl_dvp = NULL;
330     }
331     nd->nl_flags = 0;	/* clear remaining flags (just clear everything) */
332 }
333 
334 /*
335  * Works similarly to nlookup_done() when nd initialized with
336  * nlookup_init_at().
337  */
338 void
339 nlookup_done_at(struct nlookupdata *nd, struct file *fp)
340 {
341 	nlookup_done(nd);
342 	if (fp != NULL)
343 		fdrop(fp);
344 }
345 
346 void
347 nlookup_zero(struct nlookupdata *nd)
348 {
349 	bzero(nd, sizeof(struct nlookupdata));
350 }
351 
352 /*
353  * Simple all-in-one nlookup.  Returns a locked namecache structure or NULL
354  * if an error occured.
355  *
356  * Note that the returned ncp is not checked for permissions, though VEXEC
357  * is checked on the directory path leading up to the result.  The caller
358  * must call naccess() to check the permissions of the returned leaf.
359  */
360 struct nchandle
361 nlookup_simple(const char *str, enum uio_seg seg,
362 	       int niflags, int *error)
363 {
364     struct nlookupdata nd;
365     struct nchandle nch;
366 
367     *error = nlookup_init(&nd, str, seg, niflags);
368     if (*error == 0) {
369 	    if ((*error = nlookup(&nd)) == 0) {
370 		    nch = nd.nl_nch;	/* keep hold ref from structure */
371 		    cache_zero(&nd.nl_nch); /* and NULL out */
372 	    } else {
373 		    cache_zero(&nch);
374 	    }
375 	    nlookup_done(&nd);
376     } else {
377 	    cache_zero(&nch);
378     }
379     return(nch);
380 }
381 
382 /*
383  * Returns non-zero if the path element is the last element
384  */
385 static
386 int
387 islastelement(const char *ptr)
388 {
389 	while (*ptr == '/')
390 		++ptr;
391 	return (*ptr == 0);
392 }
393 
394 /*
395  * Returns non-zero if we need to lock the namecache element
396  * exclusively.  Unless otherwise requested by NLC_SHAREDLOCK,
397  * the last element of the namecache lookup will be locked
398  * exclusively.
399  *
400  * NOTE: Even if we return on-zero, an unresolved namecache record
401  *	 will always be locked exclusively.
402  */
403 static __inline
404 int
405 wantsexcllock(struct nlookupdata *nd, const char *ptr)
406 {
407 	if ((nd->nl_flags & NLC_SHAREDLOCK) == 0)
408 		return(islastelement(ptr));
409 	return(0);
410 }
411 
412 
413 /*
414  * Do a generic nlookup.  Note that the passed nd is not nlookup_done()'d
415  * on return, even if an error occurs.  If no error occurs or NLC_CREATE
416  * is flagged and ENOENT is returned, then the returned nl_nch is always
417  * referenced and locked exclusively.
418  *
419  * WARNING: For any general error other than ENOENT w/NLC_CREATE, the
420  *	    the resulting nl_nch may or may not be locked and if locked
421  *	    might be locked either shared or exclusive.
422  *
423  * Intermediate directory elements, including the current directory, require
424  * execute (search) permission.  nlookup does not examine the access
425  * permissions on the returned element.
426  *
427  * If NLC_CREATE is set the last directory must allow node creation,
428  * and an error code of 0 will be returned for a non-existant
429  * target (not ENOENT).
430  *
431  * If NLC_RENAME_DST is set the last directory mut allow node deletion,
432  * plus the sticky check is made, and an error code of 0 will be returned
433  * for a non-existant target (not ENOENT).
434  *
435  * If NLC_DELETE is set the last directory mut allow node deletion,
436  * plus the sticky check is made.
437  *
438  * If NLC_REFDVP is set nd->nl_dvp will be set to the directory vnode
439  * of the returned entry.  The vnode will be referenced, but not locked,
440  * and will be released by nlookup_done() along with everything else.
441  *
442  * NOTE: As an optimization we attempt to obtain a shared namecache lock
443  *	 on any intermediate elements.  On success, the returned element
444  *	 is ALWAYS locked exclusively.
445  */
446 int
447 nlookup(struct nlookupdata *nd)
448 {
449     globaldata_t gd = mycpu;
450     struct nlcomponent nlc;
451     struct nchandle nch;
452     struct nchandle par;
453     struct nchandle nctmp;
454     struct mount *mp;
455     struct vnode *hvp;		/* hold to prevent recyclement */
456     int wasdotordotdot;
457     char *ptr;
458     int error;
459     int len;
460     int dflags;
461     int hit = 1;
462 
463 #ifdef KTRACE
464     if (KTRPOINT(nd->nl_td, KTR_NAMEI))
465 	ktrnamei(nd->nl_td->td_lwp, nd->nl_path);
466 #endif
467     bzero(&nlc, sizeof(nlc));
468 
469     /*
470      * Setup for the loop.  The current working namecache element is
471      * always at least referenced.  We lock it as required, but always
472      * return a locked, resolved namecache entry.
473      */
474     nd->nl_loopcnt = 0;
475     if (nd->nl_dvp) {
476 	vrele(nd->nl_dvp);
477 	nd->nl_dvp = NULL;
478     }
479     ptr = nd->nl_path;
480 
481     /*
482      * Loop on the path components.  At the top of the loop nd->nl_nch
483      * is ref'd and unlocked and represents our current position.
484      */
485     for (;;) {
486 	/*
487 	 * Make sure nl_nch is locked so we can access the vnode, resolution
488 	 * state, etc.
489 	 */
490 	if ((nd->nl_flags & NLC_NCPISLOCKED) == 0) {
491 		nd->nl_flags |= NLC_NCPISLOCKED;
492 		cache_lock_maybe_shared(&nd->nl_nch, wantsexcllock(nd, ptr));
493 	}
494 
495 	/*
496 	 * Check if the root directory should replace the current
497 	 * directory.  This is done at the start of a translation
498 	 * or after a symbolic link has been found.  In other cases
499 	 * ptr will never be pointing at a '/'.
500 	 */
501 	if (*ptr == '/') {
502 	    do {
503 		++ptr;
504 	    } while (*ptr == '/');
505 	    cache_unlock(&nd->nl_nch);
506 	    cache_get_maybe_shared(&nd->nl_rootnch, &nch,
507 				   wantsexcllock(nd, ptr));
508 	    cache_drop(&nd->nl_nch);
509 	    nd->nl_nch = nch;		/* remains locked */
510 
511 	    /*
512 	     * Fast-track termination.  There is no parent directory of
513 	     * the root in the same mount from the point of view of
514 	     * the caller so return EACCES if NLC_REFDVP is specified,
515 	     * and EEXIST if NLC_CREATE is also specified.
516 	     * e.g. 'rmdir /' or 'mkdir /' are not allowed.
517 	     */
518 	    if (*ptr == 0) {
519 		if (nd->nl_flags & NLC_REFDVP)
520 			error = (nd->nl_flags & NLC_CREATE) ? EEXIST : EACCES;
521 		else
522 			error = 0;
523 		break;
524 	    }
525 	    continue;
526 	}
527 
528 	/*
529 	 * Check directory search permissions (nd->nl_nch is locked & refd)
530 	 */
531 	dflags = 0;
532 	error = naccess(&nd->nl_nch, NLC_EXEC, nd->nl_cred, &dflags);
533 	if (error)
534 	    break;
535 
536 	/*
537 	 * Extract the path component.  Path components are limited to
538 	 * 255 characters.
539 	 */
540 	nlc.nlc_nameptr = ptr;
541 	while (*ptr && *ptr != '/')
542 	    ++ptr;
543 	nlc.nlc_namelen = ptr - nlc.nlc_nameptr;
544 	if (nlc.nlc_namelen >= 256) {
545 	    error = ENAMETOOLONG;
546 	    break;
547 	}
548 
549 	/*
550 	 * Lookup the path component in the cache, creating an unresolved
551 	 * entry if necessary.  We have to handle "." and ".." as special
552 	 * cases.
553 	 *
554 	 * When handling ".." we have to detect a traversal back through a
555 	 * mount point.   If we are at the root, ".." just returns the root.
556 	 *
557 	 * When handling "." or ".." we also have to recalculate dflags
558 	 * since our dflags will be for some sub-directory instead of the
559 	 * parent dir.
560 	 *
561 	 * This subsection returns a locked, refd 'nch' unless it errors out,
562 	 * and an unlocked but still ref'd nd->nl_nch.
563 	 *
564 	 * The namecache topology is not allowed to be disconnected, so
565 	 * encountering a NULL parent will generate EINVAL.  This typically
566 	 * occurs when a directory is removed out from under a process.
567 	 *
568 	 * WARNING! The unlocking of nd->nl_nch is sensitive code.
569 	 */
570 	KKASSERT(nd->nl_flags & NLC_NCPISLOCKED);
571 
572 	if (nlc.nlc_namelen == 1 && nlc.nlc_nameptr[0] == '.') {
573 	    cache_unlock(&nd->nl_nch);
574 	    nd->nl_flags &= ~NLC_NCPISLOCKED;
575 	    cache_get_maybe_shared(&nd->nl_nch, &nch, wantsexcllock(nd, ptr));
576 	    wasdotordotdot = 1;
577 	} else if (nlc.nlc_namelen == 2 &&
578 		   nlc.nlc_nameptr[0] == '.' && nlc.nlc_nameptr[1] == '.') {
579 	    if (nd->nl_nch.mount == nd->nl_rootnch.mount &&
580 		nd->nl_nch.ncp == nd->nl_rootnch.ncp
581 	    ) {
582 		/*
583 		 * ".." at the root returns the root
584 		 */
585 		cache_unlock(&nd->nl_nch);
586 		nd->nl_flags &= ~NLC_NCPISLOCKED;
587 		cache_get_maybe_shared(&nd->nl_nch, &nch,
588 				       wantsexcllock(nd, ptr));
589 	    } else {
590 		/*
591 		 * Locate the parent ncp.  If we are at the root of a
592 		 * filesystem mount we have to skip to the mounted-on
593 		 * point in the underlying filesystem.
594 		 *
595 		 * Expect the parent to always be good since the
596 		 * mountpoint doesn't go away.  XXX hack.  cache_get()
597 		 * requires the ncp to already have a ref as a safety.
598 		 */
599 		nctmp = nd->nl_nch;
600 		while (nctmp.ncp == nctmp.mount->mnt_ncmountpt.ncp)
601 			nctmp = nctmp.mount->mnt_ncmounton;
602 		nctmp.ncp = nctmp.ncp->nc_parent;
603 		KKASSERT(nctmp.ncp != NULL);
604 		cache_hold(&nctmp);
605 		cache_unlock(&nd->nl_nch);
606 		nd->nl_flags &= ~NLC_NCPISLOCKED;
607 		cache_get_maybe_shared(&nctmp, &nch, wantsexcllock(nd, ptr));
608 		cache_drop(&nctmp);		/* NOTE: zero's nctmp */
609 	    }
610 	    wasdotordotdot = 2;
611 	} else {
612 	    /*
613 	     * Must unlock nl_nch when traversing down the path.  However,
614 	     * the child ncp has not yet been found/created and the parent's
615 	     * child list might be empty.  Thus releasing the lock can
616 	     * allow a race whereby the parent ncp's vnode is recycled.
617 	     * This case can occur especially when maxvnodes is set very low.
618 	     *
619 	     * We need the parent's ncp to remain resolved for all normal
620 	     * filesystem activities, so we vhold() the vp during the lookup
621 	     * to prevent recyclement due to vnlru / maxvnodes.
622 	     *
623 	     * If we race an unlink or rename the ncp might be marked
624 	     * DESTROYED after resolution, requiring a retry.
625 	     */
626 	    if ((hvp = nd->nl_nch.ncp->nc_vp) != NULL)
627 		vhold(hvp);
628 	    cache_unlock(&nd->nl_nch);
629 	    nd->nl_flags &= ~NLC_NCPISLOCKED;
630 	    error = cache_nlookup_maybe_shared(&nd->nl_nch, &nlc,
631 					       wantsexcllock(nd, ptr), &nch);
632 	    if (error == EWOULDBLOCK) {
633 		    nch = cache_nlookup(&nd->nl_nch, &nlc);
634 		    if (nch.ncp->nc_flag & NCF_UNRESOLVED)
635 			hit = 0;
636 		    for (;;) {
637 			error = cache_resolve(&nch, nd->nl_cred);
638 			if (error != EAGAIN &&
639 			    (nch.ncp->nc_flag & NCF_DESTROYED) == 0) {
640 				break;
641 			}
642 			kprintf("[diagnostic] nlookup: relookup %*.*s\n",
643 				nch.ncp->nc_nlen, nch.ncp->nc_nlen,
644 				nch.ncp->nc_name);
645 			cache_put(&nch);
646 			nch = cache_nlookup(&nd->nl_nch, &nlc);
647 		    }
648 	    }
649 	    if (hvp)
650 		vdrop(hvp);
651 	    wasdotordotdot = 0;
652 	}
653 
654 	/*
655 	 * If the last component was "." or ".." our dflags no longer
656 	 * represents the parent directory and we have to explicitly
657 	 * look it up.
658 	 *
659 	 * Expect the parent to be good since nch is locked.
660 	 */
661 	if (wasdotordotdot && error == 0) {
662 	    dflags = 0;
663 	    if ((par.ncp = nch.ncp->nc_parent) != NULL) {
664 		par.mount = nch.mount;
665 		cache_hold(&par);
666 		cache_lock_maybe_shared(&par, wantsexcllock(nd, ptr));
667 		error = naccess(&par, 0, nd->nl_cred, &dflags);
668 		cache_put(&par);
669 	    }
670 	}
671 
672 	/*
673 	 * [end of subsection]
674 	 *
675 	 * nch is locked and referenced.
676 	 * nd->nl_nch is unlocked and referenced.
677 	 *
678 	 * nl_nch must be unlocked or we could chain lock to the root
679 	 * if a resolve gets stuck (e.g. in NFS).
680 	 */
681 	KKASSERT((nd->nl_flags & NLC_NCPISLOCKED) == 0);
682 
683 	/*
684 	 * Resolve the namespace if necessary.  The ncp returned by
685 	 * cache_nlookup() is referenced and locked.
686 	 *
687 	 * XXX neither '.' nor '..' should return EAGAIN since they were
688 	 * previously resolved and thus cannot be newly created ncp's.
689 	 */
690 	if (nch.ncp->nc_flag & NCF_UNRESOLVED) {
691 	    hit = 0;
692 	    error = cache_resolve(&nch, nd->nl_cred);
693 	    KKASSERT(error != EAGAIN);
694 	} else {
695 	    error = nch.ncp->nc_error;
696 	}
697 
698 	/*
699 	 * Early completion.  ENOENT is not an error if this is the last
700 	 * component and NLC_CREATE or NLC_RENAME (rename target) was
701 	 * requested.  Note that ncp->nc_error is left as ENOENT in that
702 	 * case, which we check later on.
703 	 *
704 	 * Also handle invalid '.' or '..' components terminating a path
705 	 * for a create/rename/delete.  The standard requires this and pax
706 	 * pretty stupidly depends on it.
707 	 */
708 	if (islastelement(ptr)) {
709 	    if (error == ENOENT &&
710 		(nd->nl_flags & (NLC_CREATE | NLC_RENAME_DST))
711 	    ) {
712 		if (nd->nl_flags & NLC_NFS_RDONLY) {
713 			error = EROFS;
714 		} else {
715 			error = naccess(&nch, nd->nl_flags | dflags,
716 					nd->nl_cred, NULL);
717 		}
718 	    }
719 	    if (error == 0 && wasdotordotdot &&
720 		(nd->nl_flags & (NLC_CREATE | NLC_DELETE |
721 				 NLC_RENAME_SRC | NLC_RENAME_DST))) {
722 		/*
723 		 * POSIX junk
724 		 */
725 		if (nd->nl_flags & NLC_CREATE)
726 			error = EEXIST;
727 		else if (nd->nl_flags & NLC_DELETE)
728 			error = (wasdotordotdot == 1) ? EINVAL : ENOTEMPTY;
729 		else
730 			error = EINVAL;
731 	    }
732 	}
733 
734 	/*
735 	 * Early completion on error.
736 	 */
737 	if (error) {
738 	    cache_put(&nch);
739 	    break;
740 	}
741 
742 	/*
743 	 * If the element is a symlink and it is either not the last
744 	 * element or it is the last element and we are allowed to
745 	 * follow symlinks, resolve the symlink.
746 	 */
747 	if ((nch.ncp->nc_flag & NCF_ISSYMLINK) &&
748 	    (*ptr || (nd->nl_flags & NLC_FOLLOW))
749 	) {
750 	    if (nd->nl_loopcnt++ >= MAXSYMLINKS) {
751 		error = ELOOP;
752 		cache_put(&nch);
753 		break;
754 	    }
755 	    error = nreadsymlink(nd, &nch, &nlc);
756 	    cache_put(&nch);
757 	    if (error)
758 		break;
759 
760 	    /*
761 	     * Concatenate trailing path elements onto the returned symlink.
762 	     * Note that if the path component (ptr) is not exhausted, it
763 	     * will being with a '/', so we do not have to add another one.
764 	     *
765 	     * The symlink may not be empty.
766 	     */
767 	    len = strlen(ptr);
768 	    if (nlc.nlc_namelen == 0 || nlc.nlc_namelen + len >= MAXPATHLEN) {
769 		error = nlc.nlc_namelen ? ENAMETOOLONG : ENOENT;
770 		objcache_put(namei_oc, nlc.nlc_nameptr);
771 		break;
772 	    }
773 	    bcopy(ptr, nlc.nlc_nameptr + nlc.nlc_namelen, len + 1);
774 	    if (nd->nl_flags & NLC_HASBUF)
775 		objcache_put(namei_oc, nd->nl_path);
776 	    nd->nl_path = nlc.nlc_nameptr;
777 	    nd->nl_flags |= NLC_HASBUF;
778 	    ptr = nd->nl_path;
779 
780 	    /*
781 	     * Go back up to the top to resolve any initial '/'s in the
782 	     * symlink.
783 	     */
784 	    continue;
785 	}
786 
787 	/*
788 	 * If the element is a directory and we are crossing a mount point,
789 	 * Locate the mount.
790 	 */
791 	while ((nch.ncp->nc_flag & NCF_ISMOUNTPT) &&
792 	    (nd->nl_flags & NLC_NOCROSSMOUNT) == 0 &&
793 	    (mp = cache_findmount(&nch)) != NULL
794 	) {
795 	    struct vnode *tdp;
796 	    int vfs_do_busy = 0;
797 
798 	    /*
799 	     * VFS must be busied before the namecache entry is locked,
800 	     * but we don't want to waste time calling vfs_busy() if the
801 	     * mount point is already resolved.
802 	     */
803 again:
804 	    cache_put(&nch);
805 	    if (vfs_do_busy) {
806 		while (vfs_busy(mp, 0)) {
807 		    if (mp->mnt_kern_flag & MNTK_UNMOUNT) {
808 			kprintf("nlookup: warning umount race avoided\n");
809 			cache_dropmount(mp);
810 			error = EBUSY;
811 			vfs_do_busy = 0;
812 			goto double_break;
813 		    }
814 		}
815 	    }
816 	    cache_get_maybe_shared(&mp->mnt_ncmountpt, &nch,
817 				   wantsexcllock(nd, ptr));
818 
819 	    if (nch.ncp->nc_flag & NCF_UNRESOLVED) {
820 		if (vfs_do_busy == 0) {
821 		    vfs_do_busy = 1;
822 		    goto again;
823 		}
824 		error = VFS_ROOT(mp, &tdp);
825 		vfs_unbusy(mp);
826 		vfs_do_busy = 0;
827 		if (error) {
828 		    cache_dropmount(mp);
829 		    break;
830 		}
831 		cache_setvp(&nch, tdp);
832 		vput(tdp);
833 	    }
834 	    if (vfs_do_busy)
835 		vfs_unbusy(mp);
836 	    cache_dropmount(mp);
837 	}
838 
839 	if (error) {
840 	    cache_put(&nch);
841 double_break:
842 	    break;
843 	}
844 
845 	/*
846 	 * Skip any slashes to get to the next element.  If there
847 	 * are any slashes at all the current element must be a
848 	 * directory or, in the create case, intended to become a directory.
849 	 * If it isn't we break without incrementing ptr and fall through
850 	 * to the failure case below.
851 	 */
852 	while (*ptr == '/') {
853 	    if ((nch.ncp->nc_flag & NCF_ISDIR) == 0 &&
854 		!(nd->nl_flags & NLC_WILLBEDIR)
855 	    ) {
856 		break;
857 	    }
858 	    ++ptr;
859 	}
860 
861 	/*
862 	 * Continuation case: additional elements and the current
863 	 * element is a directory.
864 	 */
865 	if (*ptr && (nch.ncp->nc_flag & NCF_ISDIR)) {
866 	    cache_drop(&nd->nl_nch);
867 	    cache_unlock(&nch);
868 	    KKASSERT((nd->nl_flags & NLC_NCPISLOCKED) == 0);
869 	    nd->nl_nch = nch;
870 	    continue;
871 	}
872 
873 	/*
874 	 * Failure case: additional elements and the current element
875 	 * is not a directory
876 	 */
877 	if (*ptr) {
878 	    cache_put(&nch);
879 	    error = ENOTDIR;
880 	    break;
881 	}
882 
883 	/*
884 	 * Successful lookup of last element.
885 	 *
886 	 * Check permissions if the target exists.  If the target does not
887 	 * exist directory permissions were already tested in the early
888 	 * completion code above.
889 	 *
890 	 * nd->nl_flags will be adjusted on return with NLC_APPENDONLY
891 	 * if the file is marked append-only, and NLC_STICKY if the directory
892 	 * containing the file is sticky.
893 	 */
894 	if (nch.ncp->nc_vp && (nd->nl_flags & NLC_ALLCHKS)) {
895 	    error = naccess(&nch, nd->nl_flags | dflags,
896 			    nd->nl_cred, NULL);
897 	    if (error) {
898 		cache_put(&nch);
899 		break;
900 	    }
901 	}
902 
903 	/*
904 	 * Termination: no more elements.
905 	 *
906 	 * If NLC_REFDVP is set acquire a referenced parent dvp.
907 	 */
908 	if (nd->nl_flags & NLC_REFDVP) {
909 		cache_lock(&nd->nl_nch);
910 		error = cache_vref(&nd->nl_nch, nd->nl_cred, &nd->nl_dvp);
911 		cache_unlock(&nd->nl_nch);
912 		if (error) {
913 			kprintf("NLC_REFDVP: Cannot ref dvp of %p\n", nch.ncp);
914 			cache_put(&nch);
915 			break;
916 		}
917 	}
918 	cache_drop(&nd->nl_nch);
919 	nd->nl_nch = nch;
920 	nd->nl_flags |= NLC_NCPISLOCKED;
921 	error = 0;
922 	break;
923     }
924 
925     if (hit)
926 	++gd->gd_nchstats->ncs_longhits;
927     else
928 	++gd->gd_nchstats->ncs_longmiss;
929 
930     if (nd->nl_flags & NLC_NCPISLOCKED)
931 	KKASSERT(cache_lockstatus(&nd->nl_nch) > 0);
932 
933     /*
934      * NOTE: If NLC_CREATE was set the ncp may represent a negative hit
935      * (ncp->nc_error will be ENOENT), but we will still return an error
936      * code of 0.
937      */
938     return(error);
939 }
940 
941 /*
942  * Resolve a mount point's glue ncp.  This ncp connects creates the illusion
943  * of continuity in the namecache tree by connecting the ncp related to the
944  * vnode under the mount to the ncp related to the mount's root vnode.
945  *
946  * If no error occured a locked, ref'd ncp is stored in *ncpp.
947  */
948 int
949 nlookup_mp(struct mount *mp, struct nchandle *nch)
950 {
951     struct vnode *vp;
952     int error;
953 
954     error = 0;
955     cache_get(&mp->mnt_ncmountpt, nch);
956     if (nch->ncp->nc_flag & NCF_UNRESOLVED) {
957 	while (vfs_busy(mp, 0))
958 	    ;
959 	error = VFS_ROOT(mp, &vp);
960 	vfs_unbusy(mp);
961 	if (error) {
962 	    cache_put(nch);
963 	} else {
964 	    cache_setvp(nch, vp);
965 	    vput(vp);
966 	}
967     }
968     return(error);
969 }
970 
971 /*
972  * Read the contents of a symlink, allocate a path buffer out of the
973  * namei_oc and initialize the supplied nlcomponent with the result.
974  *
975  * If an error occurs no buffer will be allocated or returned in the nlc.
976  */
977 int
978 nreadsymlink(struct nlookupdata *nd, struct nchandle *nch,
979 		struct nlcomponent *nlc)
980 {
981     struct vnode *vp;
982     struct iovec aiov;
983     struct uio auio;
984     int linklen;
985     int error;
986     char *cp;
987 
988     nlc->nlc_nameptr = NULL;
989     nlc->nlc_namelen = 0;
990     if (nch->ncp->nc_vp == NULL)
991 	return(ENOENT);
992     if ((error = cache_vget(nch, nd->nl_cred, LK_SHARED, &vp)) != 0)
993 	return(error);
994     cp = objcache_get(namei_oc, M_WAITOK);
995     aiov.iov_base = cp;
996     aiov.iov_len = MAXPATHLEN;
997     auio.uio_iov = &aiov;
998     auio.uio_iovcnt = 1;
999     auio.uio_offset = 0;
1000     auio.uio_rw = UIO_READ;
1001     auio.uio_segflg = UIO_SYSSPACE;
1002     auio.uio_td = nd->nl_td;
1003     auio.uio_resid = MAXPATHLEN - 1;
1004     error = VOP_READLINK(vp, &auio, nd->nl_cred);
1005     if (error)
1006 	goto fail;
1007     linklen = MAXPATHLEN - 1 - auio.uio_resid;
1008     if (varsym_enable) {
1009 	linklen = varsymreplace(cp, linklen, MAXPATHLEN - 1);
1010 	if (linklen < 0) {
1011 	    error = ENAMETOOLONG;
1012 	    goto fail;
1013 	}
1014     }
1015     cp[linklen] = 0;
1016     nlc->nlc_nameptr = cp;
1017     nlc->nlc_namelen = linklen;
1018     vput(vp);
1019     return(0);
1020 fail:
1021     objcache_put(namei_oc, cp);
1022     vput(vp);
1023     return(error);
1024 }
1025 
1026 /*
1027  * Check access [XXX cache vattr!] [XXX quota]
1028  *
1029  * Generally check the NLC_* access bits.   All specified bits must pass
1030  * for this function to return 0.
1031  *
1032  * The file does not have to exist when checking NLC_CREATE or NLC_RENAME_DST
1033  * access, otherwise it must exist.  No error is returned in this case.
1034  *
1035  * The file must not exist if NLC_EXCL is specified.
1036  *
1037  * Directory permissions in general are tested for NLC_CREATE if the file
1038  * does not exist, NLC_DELETE if the file does exist, and NLC_RENAME_DST
1039  * whether the file exists or not.
1040  *
1041  * The directory sticky bit is tested for NLC_DELETE and NLC_RENAME_DST,
1042  * the latter is only tested if the target exists.
1043  *
1044  * The passed ncp must be referenced and locked.  If it is already resolved
1045  * it may be locked shared but otherwise should be locked exclusively.
1046  */
1047 static int
1048 naccess(struct nchandle *nch, int nflags, struct ucred *cred, int *nflagsp)
1049 {
1050     struct vnode *vp;
1051     struct vattr va;
1052     struct namecache *ncp;
1053     int error;
1054     int cflags;
1055 
1056     KKASSERT(cache_lockstatus(nch) > 0);
1057 
1058     ncp = nch->ncp;
1059     if (ncp->nc_flag & NCF_UNRESOLVED) {
1060 	cache_resolve(nch, cred);
1061 	ncp = nch->ncp;
1062     }
1063     error = ncp->nc_error;
1064 
1065     /*
1066      * Directory permissions checks.  Silently ignore ENOENT if these
1067      * tests pass.  It isn't an error.
1068      *
1069      * We can safely resolve ncp->nc_parent because ncp is currently
1070      * locked.
1071      */
1072     if (nflags & (NLC_CREATE | NLC_DELETE | NLC_RENAME_SRC | NLC_RENAME_DST)) {
1073 	if (((nflags & NLC_CREATE) && ncp->nc_vp == NULL) ||
1074 	    ((nflags & NLC_DELETE) && ncp->nc_vp != NULL) ||
1075 	    ((nflags & NLC_RENAME_SRC) && ncp->nc_vp != NULL) ||
1076 	    (nflags & NLC_RENAME_DST)
1077 	) {
1078 	    struct nchandle par;
1079 
1080 	    if ((par.ncp = ncp->nc_parent) == NULL) {
1081 		if (error != EAGAIN)
1082 			error = EINVAL;
1083 	    } else if (error == 0 || error == ENOENT) {
1084 		par.mount = nch->mount;
1085 		cache_hold(&par);
1086 		cache_lock_maybe_shared(&par, 0);
1087 		error = naccess(&par, NLC_WRITE, cred, NULL);
1088 		cache_put(&par);
1089 	    }
1090 	}
1091     }
1092 
1093     /*
1094      * NLC_EXCL check.  Target file must not exist.
1095      */
1096     if (error == 0 && (nflags & NLC_EXCL) && ncp->nc_vp != NULL)
1097 	error = EEXIST;
1098 
1099     /*
1100      * Get the vnode attributes so we can do the rest of our checks.
1101      *
1102      * NOTE: We only call naccess_va() if the target exists.
1103      */
1104     if (error == 0) {
1105 	error = cache_vget(nch, cred, LK_SHARED, &vp);
1106 	if (error == ENOENT) {
1107 	    /*
1108 	     * Silently zero-out ENOENT if creating or renaming
1109 	     * (rename target).  It isn't an error.
1110 	     */
1111 	    if (nflags & (NLC_CREATE | NLC_RENAME_DST))
1112 		error = 0;
1113 	} else if (error == 0) {
1114 	    /*
1115 	     * Get the vnode attributes and check for illegal O_TRUNC
1116 	     * requests and read-only mounts.
1117 	     *
1118 	     * NOTE: You can still open devices on read-only mounts for
1119 	     * 	     writing.
1120 	     *
1121 	     * NOTE: creates/deletes/renames are handled by the NLC_WRITE
1122 	     *	     check on the parent directory above.
1123 	     *
1124 	     * XXX cache the va in the namecache or in the vnode
1125 	     */
1126 	    error = VOP_GETATTR(vp, &va);
1127 	    if (error == 0 && (nflags & NLC_TRUNCATE)) {
1128 		switch(va.va_type) {
1129 		case VREG:
1130 		case VDATABASE:
1131 		case VCHR:
1132 		case VBLK:
1133 		case VFIFO:
1134 		    break;
1135 		case VDIR:
1136 		    error = EISDIR;
1137 		    break;
1138 		default:
1139 		    error = EINVAL;
1140 		    break;
1141 		}
1142 	    }
1143 	    if (error == 0 && (nflags & NLC_WRITE) && vp->v_mount &&
1144 		(vp->v_mount->mnt_flag & MNT_RDONLY)
1145 	    ) {
1146 		switch(va.va_type) {
1147 		case VDIR:
1148 		case VLNK:
1149 		case VREG:
1150 		case VDATABASE:
1151 		    error = EROFS;
1152 		    break;
1153 		default:
1154 		    break;
1155 		}
1156 	    }
1157 	    vput(vp);
1158 
1159 	    /*
1160 	     * Check permissions based on file attributes.  The passed
1161 	     * flags (*nflagsp) are modified with feedback based on
1162 	     * special attributes and requirements.
1163 	     */
1164 	    if (error == 0) {
1165 		/*
1166 		 * Adjust the returned (*nflagsp) if non-NULL.
1167 		 */
1168 		if (nflagsp) {
1169 		    if ((va.va_mode & VSVTX) && va.va_uid != cred->cr_uid)
1170 			*nflagsp |= NLC_STICKY;
1171 		    if (va.va_flags & APPEND)
1172 			*nflagsp |= NLC_APPENDONLY;
1173 		    if (va.va_flags & IMMUTABLE)
1174 			*nflagsp |= NLC_IMMUTABLE;
1175 		}
1176 
1177 		/*
1178 		 * Track swapcache management flags in the namecache.
1179 		 *
1180 		 * Calculate the flags based on the current vattr info
1181 		 * and recalculate the inherited flags from the parent
1182 		 * (the original cache linkage may have occurred without
1183 		 * getattrs and thus have stale flags).
1184 		 */
1185 		cflags = 0;
1186 		if (va.va_flags & SF_NOCACHE)
1187 			cflags |= NCF_SF_NOCACHE;
1188 		if (va.va_flags & UF_CACHE)
1189 			cflags |= NCF_UF_CACHE;
1190 		if (ncp->nc_parent) {
1191 			if (ncp->nc_parent->nc_flag &
1192 			    (NCF_SF_NOCACHE | NCF_SF_PNOCACHE)) {
1193 				cflags |= NCF_SF_PNOCACHE;
1194 			}
1195 			if (ncp->nc_parent->nc_flag &
1196 			    (NCF_UF_CACHE | NCF_UF_PCACHE)) {
1197 				cflags |= NCF_UF_PCACHE;
1198 			}
1199 		}
1200 
1201 		/*
1202 		 * XXX we're not supposed to update nc_flag when holding
1203 		 *     a shared lock.
1204 		 */
1205 		atomic_clear_short(&ncp->nc_flag,
1206 				   (NCF_SF_NOCACHE | NCF_UF_CACHE |
1207 				   NCF_SF_PNOCACHE | NCF_UF_PCACHE) & ~cflags);
1208 		atomic_set_short(&ncp->nc_flag, cflags);
1209 
1210 		/*
1211 		 * Process general access.
1212 		 */
1213 		error = naccess_va(&va, nflags, cred);
1214 	    }
1215 	}
1216     }
1217     return(error);
1218 }
1219 
1220 /*
1221  * Check the requested access against the given vattr using cred.
1222  */
1223 int
1224 naccess_va(struct vattr *va, int nflags, struct ucred *cred)
1225 {
1226     int i;
1227     int vmode;
1228 
1229     /*
1230      * Test the immutable bit.  Creations, deletions, renames (source
1231      * or destination) are not allowed.  chown/chmod/other is also not
1232      * allowed but is handled by SETATTR.  Hardlinks to the immutable
1233      * file are allowed.
1234      *
1235      * If the directory is set to immutable then creations, deletions,
1236      * renames (source or dest) and hardlinks to files within the directory
1237      * are not allowed, and regular files opened through the directory may
1238      * not be written to or truncated (unless a special device).
1239      *
1240      * NOTE!  New hardlinks to immutable files work but new hardlinks to
1241      * files, immutable or not, sitting inside an immutable directory are
1242      * not allowed.  As always if the file is hardlinked via some other
1243      * path additional hardlinks may be possible even if the file is marked
1244      * immutable.  The sysop needs to create a closure by checking the hard
1245      * link count.  Once closure is achieved you are good, and security
1246      * scripts should check link counts anyway.
1247      *
1248      * Writes and truncations are only allowed on special devices.
1249      */
1250     if ((va->va_flags & IMMUTABLE) || (nflags & NLC_IMMUTABLE)) {
1251 	if ((nflags & NLC_IMMUTABLE) && (nflags & NLC_HLINK))
1252 	    return (EPERM);
1253 	if (nflags & (NLC_CREATE | NLC_DELETE |
1254 		      NLC_RENAME_SRC | NLC_RENAME_DST)) {
1255 	    return (EPERM);
1256 	}
1257 	if (nflags & (NLC_WRITE | NLC_TRUNCATE)) {
1258 	    switch(va->va_type) {
1259 	    case VDIR:
1260 		return (EISDIR);
1261 	    case VLNK:
1262 	    case VREG:
1263 	    case VDATABASE:
1264 		return (EPERM);
1265 	    default:
1266 		break;
1267 	    }
1268 	}
1269     }
1270 
1271     /*
1272      * Test the no-unlink and append-only bits for opens, rename targets,
1273      * and deletions.  These bits are not tested for creations or
1274      * rename sources.
1275      *
1276      * Unlike FreeBSD we allow a file with APPEND set to be renamed.
1277      * If you do not wish this you must also set NOUNLINK.
1278      *
1279      * If the governing directory is marked APPEND-only it implies
1280      * NOUNLINK for all entries in the directory.
1281      */
1282     if (((va->va_flags & NOUNLINK) || (nflags & NLC_APPENDONLY)) &&
1283 	(nflags & (NLC_DELETE | NLC_RENAME_SRC | NLC_RENAME_DST))
1284     ) {
1285 	return (EPERM);
1286     }
1287 
1288     /*
1289      * A file marked append-only may not be deleted but can be renamed.
1290      */
1291     if ((va->va_flags & APPEND) &&
1292 	(nflags & (NLC_DELETE | NLC_RENAME_DST))
1293     ) {
1294 	return (EPERM);
1295     }
1296 
1297     /*
1298      * A file marked append-only which is opened for writing must also
1299      * be opened O_APPEND.
1300      */
1301     if ((va->va_flags & APPEND) && (nflags & (NLC_OPEN | NLC_TRUNCATE))) {
1302 	if (nflags & NLC_TRUNCATE)
1303 	    return (EPERM);
1304 	if ((nflags & (NLC_OPEN | NLC_WRITE)) == (NLC_OPEN | NLC_WRITE)) {
1305 	    if ((nflags & NLC_APPEND) == 0)
1306 		return (EPERM);
1307 	}
1308     }
1309 
1310     /*
1311      * root gets universal access
1312      */
1313     if (cred->cr_uid == 0)
1314 	return(0);
1315 
1316     /*
1317      * Check owner perms.
1318      *
1319      * If NLC_OWN is set the owner of the file is allowed no matter when
1320      * the owner-mode bits say (utimes).
1321      */
1322     vmode = 0;
1323     if (nflags & NLC_READ)
1324 	vmode |= S_IRUSR;
1325     if (nflags & NLC_WRITE)
1326 	vmode |= S_IWUSR;
1327     if (nflags & NLC_EXEC)
1328 	vmode |= S_IXUSR;
1329 
1330     if (cred->cr_uid == va->va_uid) {
1331 	if ((nflags & NLC_OWN) == 0) {
1332 	    if ((vmode & va->va_mode) != vmode)
1333 		return(EACCES);
1334 	}
1335 	return(0);
1336     }
1337 
1338     /*
1339      * If NLC_STICKY is set only the owner may delete or rename a file.
1340      * This bit is typically set on /tmp.
1341      *
1342      * Note that the NLC_READ/WRITE/EXEC bits are not typically set in
1343      * the specific delete or rename case.  For deletions and renames we
1344      * usually just care about directory permissions, not file permissions.
1345      */
1346     if ((nflags & NLC_STICKY) &&
1347 	(nflags & (NLC_RENAME_SRC | NLC_RENAME_DST | NLC_DELETE))) {
1348 	return(EACCES);
1349     }
1350 
1351     /*
1352      * Check group perms
1353      */
1354     vmode >>= 3;
1355     for (i = 0; i < cred->cr_ngroups; ++i) {
1356 	if (va->va_gid == cred->cr_groups[i]) {
1357 	    if ((vmode & va->va_mode) != vmode)
1358 		return(EACCES);
1359 	    return(0);
1360 	}
1361     }
1362 
1363     /*
1364      * Check world perms
1365      */
1366     vmode >>= 3;
1367     if ((vmode & va->va_mode) != vmode)
1368 	return(EACCES);
1369     return(0);
1370 }
1371 
1372