1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved. 23 * Copyright (c) 2013 by Delphix. All rights reserved. 24 * Copyright 2017 Nexenta Systems, Inc. All rights reserved. 25 */ 26 27 #include <sys/types.h> 28 #include <sys/param.h> 29 #include <sys/time.h> 30 #include <sys/systm.h> 31 #include <sys/sysmacros.h> 32 #include <sys/resource.h> 33 #include <sys/vfs.h> 34 #include <sys/vnode.h> 35 #include <sys/file.h> 36 #include <sys/stat.h> 37 #include <sys/kmem.h> 38 #include <sys/cmn_err.h> 39 #include <sys/errno.h> 40 #include <sys/unistd.h> 41 #include <sys/sdt.h> 42 #include <sys/fs/zfs.h> 43 #include <sys/policy.h> 44 #include <sys/zfs_znode.h> 45 #include <sys/zfs_fuid.h> 46 #include <sys/zfs_acl.h> 47 #include <sys/zfs_dir.h> 48 #include <sys/zfs_quota.h> 49 #include <sys/zfs_vfsops.h> 50 #include <sys/dmu.h> 51 #include <sys/dnode.h> 52 #include <sys/zap.h> 53 #include <sys/sa.h> 54 #include <acl/acl_common.h> 55 56 57 #define ALLOW ACE_ACCESS_ALLOWED_ACE_TYPE 58 #define DENY ACE_ACCESS_DENIED_ACE_TYPE 59 #define MAX_ACE_TYPE ACE_SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE 60 #define MIN_ACE_TYPE ALLOW 61 62 #define OWNING_GROUP (ACE_GROUP|ACE_IDENTIFIER_GROUP) 63 #define EVERYONE_ALLOW_MASK (ACE_READ_ACL|ACE_READ_ATTRIBUTES | \ 64 ACE_READ_NAMED_ATTRS|ACE_SYNCHRONIZE) 65 #define EVERYONE_DENY_MASK (ACE_WRITE_ACL|ACE_WRITE_OWNER | \ 66 ACE_WRITE_ATTRIBUTES|ACE_WRITE_NAMED_ATTRS) 67 #define OWNER_ALLOW_MASK (ACE_WRITE_ACL | ACE_WRITE_OWNER | \ 68 ACE_WRITE_ATTRIBUTES|ACE_WRITE_NAMED_ATTRS) 69 70 #define ZFS_CHECKED_MASKS (ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_READ_DATA| \ 71 ACE_READ_NAMED_ATTRS|ACE_WRITE_DATA|ACE_WRITE_ATTRIBUTES| \ 72 ACE_WRITE_NAMED_ATTRS|ACE_APPEND_DATA|ACE_EXECUTE|ACE_WRITE_OWNER| \ 73 ACE_WRITE_ACL|ACE_DELETE|ACE_DELETE_CHILD|ACE_SYNCHRONIZE) 74 75 #define WRITE_MASK_DATA (ACE_WRITE_DATA|ACE_APPEND_DATA|ACE_WRITE_NAMED_ATTRS) 76 #define WRITE_MASK_ATTRS (ACE_WRITE_ACL|ACE_WRITE_OWNER|ACE_WRITE_ATTRIBUTES| \ 77 ACE_DELETE|ACE_DELETE_CHILD) 78 #define WRITE_MASK (WRITE_MASK_DATA|WRITE_MASK_ATTRS) 79 80 #define OGE_CLEAR (ACE_READ_DATA|ACE_LIST_DIRECTORY|ACE_WRITE_DATA| \ 81 ACE_ADD_FILE|ACE_APPEND_DATA|ACE_ADD_SUBDIRECTORY|ACE_EXECUTE) 82 83 #define OKAY_MASK_BITS (ACE_READ_DATA|ACE_LIST_DIRECTORY|ACE_WRITE_DATA| \ 84 ACE_ADD_FILE|ACE_APPEND_DATA|ACE_ADD_SUBDIRECTORY|ACE_EXECUTE) 85 86 #define ALL_INHERIT (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE | \ 87 ACE_NO_PROPAGATE_INHERIT_ACE|ACE_INHERIT_ONLY_ACE|ACE_INHERITED_ACE) 88 89 #define RESTRICTED_CLEAR (ACE_WRITE_ACL|ACE_WRITE_OWNER) 90 91 #define V4_ACL_WIDE_FLAGS (ZFS_ACL_AUTO_INHERIT|ZFS_ACL_DEFAULTED|\ 92 ZFS_ACL_PROTECTED) 93 94 #define ZFS_ACL_WIDE_FLAGS (V4_ACL_WIDE_FLAGS|ZFS_ACL_TRIVIAL|ZFS_INHERIT_ACE|\ 95 ZFS_ACL_OBJ_ACE) 96 97 #define ALL_MODE_EXECS (S_IXUSR | S_IXGRP | S_IXOTH) 98 99 static uint16_t 100 zfs_ace_v0_get_type(void *acep) 101 { 102 return (((zfs_oldace_t *)acep)->z_type); 103 } 104 105 static uint16_t 106 zfs_ace_v0_get_flags(void *acep) 107 { 108 return (((zfs_oldace_t *)acep)->z_flags); 109 } 110 111 static uint32_t 112 zfs_ace_v0_get_mask(void *acep) 113 { 114 return (((zfs_oldace_t *)acep)->z_access_mask); 115 } 116 117 static uint64_t 118 zfs_ace_v0_get_who(void *acep) 119 { 120 return (((zfs_oldace_t *)acep)->z_fuid); 121 } 122 123 static void 124 zfs_ace_v0_set_type(void *acep, uint16_t type) 125 { 126 ((zfs_oldace_t *)acep)->z_type = type; 127 } 128 129 static void 130 zfs_ace_v0_set_flags(void *acep, uint16_t flags) 131 { 132 ((zfs_oldace_t *)acep)->z_flags = flags; 133 } 134 135 static void 136 zfs_ace_v0_set_mask(void *acep, uint32_t mask) 137 { 138 ((zfs_oldace_t *)acep)->z_access_mask = mask; 139 } 140 141 static void 142 zfs_ace_v0_set_who(void *acep, uint64_t who) 143 { 144 ((zfs_oldace_t *)acep)->z_fuid = who; 145 } 146 147 /*ARGSUSED*/ 148 static size_t 149 zfs_ace_v0_size(void *acep) 150 { 151 return (sizeof (zfs_oldace_t)); 152 } 153 154 static size_t 155 zfs_ace_v0_abstract_size(void) 156 { 157 return (sizeof (zfs_oldace_t)); 158 } 159 160 static int 161 zfs_ace_v0_mask_off(void) 162 { 163 return (offsetof(zfs_oldace_t, z_access_mask)); 164 } 165 166 /*ARGSUSED*/ 167 static int 168 zfs_ace_v0_data(void *acep, void **datap) 169 { 170 *datap = NULL; 171 return (0); 172 } 173 174 static acl_ops_t zfs_acl_v0_ops = { 175 zfs_ace_v0_get_mask, 176 zfs_ace_v0_set_mask, 177 zfs_ace_v0_get_flags, 178 zfs_ace_v0_set_flags, 179 zfs_ace_v0_get_type, 180 zfs_ace_v0_set_type, 181 zfs_ace_v0_get_who, 182 zfs_ace_v0_set_who, 183 zfs_ace_v0_size, 184 zfs_ace_v0_abstract_size, 185 zfs_ace_v0_mask_off, 186 zfs_ace_v0_data 187 }; 188 189 static uint16_t 190 zfs_ace_fuid_get_type(void *acep) 191 { 192 return (((zfs_ace_hdr_t *)acep)->z_type); 193 } 194 195 static uint16_t 196 zfs_ace_fuid_get_flags(void *acep) 197 { 198 return (((zfs_ace_hdr_t *)acep)->z_flags); 199 } 200 201 static uint32_t 202 zfs_ace_fuid_get_mask(void *acep) 203 { 204 return (((zfs_ace_hdr_t *)acep)->z_access_mask); 205 } 206 207 static uint64_t 208 zfs_ace_fuid_get_who(void *args) 209 { 210 uint16_t entry_type; 211 zfs_ace_t *acep = args; 212 213 entry_type = acep->z_hdr.z_flags & ACE_TYPE_FLAGS; 214 215 if (entry_type == ACE_OWNER || entry_type == OWNING_GROUP || 216 entry_type == ACE_EVERYONE) 217 return (-1); 218 return (((zfs_ace_t *)acep)->z_fuid); 219 } 220 221 static void 222 zfs_ace_fuid_set_type(void *acep, uint16_t type) 223 { 224 ((zfs_ace_hdr_t *)acep)->z_type = type; 225 } 226 227 static void 228 zfs_ace_fuid_set_flags(void *acep, uint16_t flags) 229 { 230 ((zfs_ace_hdr_t *)acep)->z_flags = flags; 231 } 232 233 static void 234 zfs_ace_fuid_set_mask(void *acep, uint32_t mask) 235 { 236 ((zfs_ace_hdr_t *)acep)->z_access_mask = mask; 237 } 238 239 static void 240 zfs_ace_fuid_set_who(void *arg, uint64_t who) 241 { 242 zfs_ace_t *acep = arg; 243 244 uint16_t entry_type = acep->z_hdr.z_flags & ACE_TYPE_FLAGS; 245 246 if (entry_type == ACE_OWNER || entry_type == OWNING_GROUP || 247 entry_type == ACE_EVERYONE) 248 return; 249 acep->z_fuid = who; 250 } 251 252 static size_t 253 zfs_ace_fuid_size(void *acep) 254 { 255 zfs_ace_hdr_t *zacep = acep; 256 uint16_t entry_type; 257 258 switch (zacep->z_type) { 259 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 260 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 261 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 262 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 263 return (sizeof (zfs_object_ace_t)); 264 case ALLOW: 265 case DENY: 266 entry_type = 267 (((zfs_ace_hdr_t *)acep)->z_flags & ACE_TYPE_FLAGS); 268 if (entry_type == ACE_OWNER || 269 entry_type == OWNING_GROUP || 270 entry_type == ACE_EVERYONE) 271 return (sizeof (zfs_ace_hdr_t)); 272 /*FALLTHROUGH*/ 273 default: 274 return (sizeof (zfs_ace_t)); 275 } 276 } 277 278 static size_t 279 zfs_ace_fuid_abstract_size(void) 280 { 281 return (sizeof (zfs_ace_hdr_t)); 282 } 283 284 static int 285 zfs_ace_fuid_mask_off(void) 286 { 287 return (offsetof(zfs_ace_hdr_t, z_access_mask)); 288 } 289 290 static int 291 zfs_ace_fuid_data(void *acep, void **datap) 292 { 293 zfs_ace_t *zacep = acep; 294 zfs_object_ace_t *zobjp; 295 296 switch (zacep->z_hdr.z_type) { 297 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 298 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 299 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 300 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 301 zobjp = acep; 302 *datap = (caddr_t)zobjp + sizeof (zfs_ace_t); 303 return (sizeof (zfs_object_ace_t) - sizeof (zfs_ace_t)); 304 default: 305 *datap = NULL; 306 return (0); 307 } 308 } 309 310 static acl_ops_t zfs_acl_fuid_ops = { 311 zfs_ace_fuid_get_mask, 312 zfs_ace_fuid_set_mask, 313 zfs_ace_fuid_get_flags, 314 zfs_ace_fuid_set_flags, 315 zfs_ace_fuid_get_type, 316 zfs_ace_fuid_set_type, 317 zfs_ace_fuid_get_who, 318 zfs_ace_fuid_set_who, 319 zfs_ace_fuid_size, 320 zfs_ace_fuid_abstract_size, 321 zfs_ace_fuid_mask_off, 322 zfs_ace_fuid_data 323 }; 324 325 /* 326 * The following three functions are provided for compatibility with 327 * older ZPL version in order to determine if the file use to have 328 * an external ACL and what version of ACL previously existed on the 329 * file. Would really be nice to not need this, sigh. 330 */ 331 uint64_t 332 zfs_external_acl(znode_t *zp) 333 { 334 zfs_acl_phys_t acl_phys; 335 int error; 336 337 if (zp->z_is_sa) 338 return (0); 339 340 /* 341 * Need to deal with a potential 342 * race where zfs_sa_upgrade could cause 343 * z_isa_sa to change. 344 * 345 * If the lookup fails then the state of z_is_sa should have 346 * changed. 347 */ 348 349 if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_ZNODE_ACL(zp->z_zfsvfs), 350 &acl_phys, sizeof (acl_phys))) == 0) 351 return (acl_phys.z_acl_extern_obj); 352 else { 353 /* 354 * after upgrade the SA_ZPL_ZNODE_ACL should have been 355 * removed 356 */ 357 VERIFY(zp->z_is_sa && error == ENOENT); 358 return (0); 359 } 360 } 361 362 /* 363 * Determine size of ACL in bytes 364 * 365 * This is more complicated than it should be since we have to deal 366 * with old external ACLs. 367 */ 368 static int 369 zfs_acl_znode_info(znode_t *zp, int *aclsize, int *aclcount, 370 zfs_acl_phys_t *aclphys) 371 { 372 zfsvfs_t *zfsvfs = zp->z_zfsvfs; 373 uint64_t acl_count; 374 int size; 375 int error; 376 377 ASSERT(MUTEX_HELD(&zp->z_acl_lock)); 378 if (zp->z_is_sa) { 379 if ((error = sa_size(zp->z_sa_hdl, SA_ZPL_DACL_ACES(zfsvfs), 380 &size)) != 0) 381 return (error); 382 *aclsize = size; 383 if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_DACL_COUNT(zfsvfs), 384 &acl_count, sizeof (acl_count))) != 0) 385 return (error); 386 *aclcount = acl_count; 387 } else { 388 if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_ZNODE_ACL(zfsvfs), 389 aclphys, sizeof (*aclphys))) != 0) 390 return (error); 391 392 if (aclphys->z_acl_version == ZFS_ACL_VERSION_INITIAL) { 393 *aclsize = ZFS_ACL_SIZE(aclphys->z_acl_size); 394 *aclcount = aclphys->z_acl_size; 395 } else { 396 *aclsize = aclphys->z_acl_size; 397 *aclcount = aclphys->z_acl_count; 398 } 399 } 400 return (0); 401 } 402 403 int 404 zfs_znode_acl_version(znode_t *zp) 405 { 406 zfs_acl_phys_t acl_phys; 407 408 if (zp->z_is_sa) 409 return (ZFS_ACL_VERSION_FUID); 410 else { 411 int error; 412 413 /* 414 * Need to deal with a potential 415 * race where zfs_sa_upgrade could cause 416 * z_isa_sa to change. 417 * 418 * If the lookup fails then the state of z_is_sa should have 419 * changed. 420 */ 421 if ((error = sa_lookup(zp->z_sa_hdl, 422 SA_ZPL_ZNODE_ACL(zp->z_zfsvfs), 423 &acl_phys, sizeof (acl_phys))) == 0) 424 return (acl_phys.z_acl_version); 425 else { 426 /* 427 * After upgrade SA_ZPL_ZNODE_ACL should have 428 * been removed. 429 */ 430 VERIFY(zp->z_is_sa && error == ENOENT); 431 return (ZFS_ACL_VERSION_FUID); 432 } 433 } 434 } 435 436 static int 437 zfs_acl_version(int version) 438 { 439 if (version < ZPL_VERSION_FUID) 440 return (ZFS_ACL_VERSION_INITIAL); 441 else 442 return (ZFS_ACL_VERSION_FUID); 443 } 444 445 static int 446 zfs_acl_version_zp(znode_t *zp) 447 { 448 return (zfs_acl_version(zp->z_zfsvfs->z_version)); 449 } 450 451 zfs_acl_t * 452 zfs_acl_alloc(int vers) 453 { 454 zfs_acl_t *aclp; 455 456 aclp = kmem_zalloc(sizeof (zfs_acl_t), KM_SLEEP); 457 list_create(&aclp->z_acl, sizeof (zfs_acl_node_t), 458 offsetof(zfs_acl_node_t, z_next)); 459 aclp->z_version = vers; 460 if (vers == ZFS_ACL_VERSION_FUID) 461 aclp->z_ops = &zfs_acl_fuid_ops; 462 else 463 aclp->z_ops = &zfs_acl_v0_ops; 464 return (aclp); 465 } 466 467 zfs_acl_node_t * 468 zfs_acl_node_alloc(size_t bytes) 469 { 470 zfs_acl_node_t *aclnode; 471 472 aclnode = kmem_zalloc(sizeof (zfs_acl_node_t), KM_SLEEP); 473 if (bytes) { 474 aclnode->z_acldata = kmem_alloc(bytes, KM_SLEEP); 475 aclnode->z_allocdata = aclnode->z_acldata; 476 aclnode->z_allocsize = bytes; 477 aclnode->z_size = bytes; 478 } 479 480 return (aclnode); 481 } 482 483 static void 484 zfs_acl_node_free(zfs_acl_node_t *aclnode) 485 { 486 if (aclnode->z_allocsize) 487 kmem_free(aclnode->z_allocdata, aclnode->z_allocsize); 488 kmem_free(aclnode, sizeof (zfs_acl_node_t)); 489 } 490 491 static void 492 zfs_acl_release_nodes(zfs_acl_t *aclp) 493 { 494 zfs_acl_node_t *aclnode; 495 496 while ((aclnode = list_head(&aclp->z_acl))) { 497 list_remove(&aclp->z_acl, aclnode); 498 zfs_acl_node_free(aclnode); 499 } 500 aclp->z_acl_count = 0; 501 aclp->z_acl_bytes = 0; 502 } 503 504 void 505 zfs_acl_free(zfs_acl_t *aclp) 506 { 507 zfs_acl_release_nodes(aclp); 508 list_destroy(&aclp->z_acl); 509 kmem_free(aclp, sizeof (zfs_acl_t)); 510 } 511 512 static boolean_t 513 zfs_acl_valid_ace_type(uint_t type, uint_t flags) 514 { 515 uint16_t entry_type; 516 517 switch (type) { 518 case ALLOW: 519 case DENY: 520 case ACE_SYSTEM_AUDIT_ACE_TYPE: 521 case ACE_SYSTEM_ALARM_ACE_TYPE: 522 entry_type = flags & ACE_TYPE_FLAGS; 523 return (entry_type == ACE_OWNER || 524 entry_type == OWNING_GROUP || 525 entry_type == ACE_EVERYONE || entry_type == 0 || 526 entry_type == ACE_IDENTIFIER_GROUP); 527 default: 528 if (type >= MIN_ACE_TYPE && type <= MAX_ACE_TYPE) 529 return (B_TRUE); 530 } 531 return (B_FALSE); 532 } 533 534 static boolean_t 535 zfs_ace_valid(vtype_t obj_type, zfs_acl_t *aclp, uint16_t type, uint16_t iflags) 536 { 537 /* 538 * first check type of entry 539 */ 540 541 if (!zfs_acl_valid_ace_type(type, iflags)) 542 return (B_FALSE); 543 544 switch (type) { 545 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 546 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 547 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 548 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 549 if (aclp->z_version < ZFS_ACL_VERSION_FUID) 550 return (B_FALSE); 551 aclp->z_hints |= ZFS_ACL_OBJ_ACE; 552 } 553 554 /* 555 * next check inheritance level flags 556 */ 557 558 if (obj_type == VDIR && 559 (iflags & (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE))) 560 aclp->z_hints |= ZFS_INHERIT_ACE; 561 562 if (iflags & (ACE_INHERIT_ONLY_ACE|ACE_NO_PROPAGATE_INHERIT_ACE)) { 563 if ((iflags & (ACE_FILE_INHERIT_ACE| 564 ACE_DIRECTORY_INHERIT_ACE)) == 0) { 565 return (B_FALSE); 566 } 567 } 568 569 return (B_TRUE); 570 } 571 572 static void * 573 zfs_acl_next_ace(zfs_acl_t *aclp, void *start, uint64_t *who, 574 uint32_t *access_mask, uint16_t *iflags, uint16_t *type) 575 { 576 zfs_acl_node_t *aclnode; 577 578 ASSERT(aclp); 579 580 if (start == NULL) { 581 aclnode = list_head(&aclp->z_acl); 582 if (aclnode == NULL) 583 return (NULL); 584 585 aclp->z_next_ace = aclnode->z_acldata; 586 aclp->z_curr_node = aclnode; 587 aclnode->z_ace_idx = 0; 588 } 589 590 aclnode = aclp->z_curr_node; 591 592 if (aclnode == NULL) 593 return (NULL); 594 595 if (aclnode->z_ace_idx >= aclnode->z_ace_count) { 596 aclnode = list_next(&aclp->z_acl, aclnode); 597 if (aclnode == NULL) 598 return (NULL); 599 else { 600 aclp->z_curr_node = aclnode; 601 aclnode->z_ace_idx = 0; 602 aclp->z_next_ace = aclnode->z_acldata; 603 } 604 } 605 606 if (aclnode->z_ace_idx < aclnode->z_ace_count) { 607 void *acep = aclp->z_next_ace; 608 size_t ace_size; 609 610 /* 611 * Make sure we don't overstep our bounds 612 */ 613 ace_size = aclp->z_ops->ace_size(acep); 614 615 if (((caddr_t)acep + ace_size) > 616 ((caddr_t)aclnode->z_acldata + aclnode->z_size)) { 617 return (NULL); 618 } 619 620 *iflags = aclp->z_ops->ace_flags_get(acep); 621 *type = aclp->z_ops->ace_type_get(acep); 622 *access_mask = aclp->z_ops->ace_mask_get(acep); 623 *who = aclp->z_ops->ace_who_get(acep); 624 aclp->z_next_ace = (caddr_t)aclp->z_next_ace + ace_size; 625 aclnode->z_ace_idx++; 626 627 return ((void *)acep); 628 } 629 return (NULL); 630 } 631 632 /*ARGSUSED*/ 633 static uint64_t 634 zfs_ace_walk(void *datap, uint64_t cookie, int aclcnt, 635 uint16_t *flags, uint16_t *type, uint32_t *mask) 636 { 637 zfs_acl_t *aclp = datap; 638 zfs_ace_hdr_t *acep = (zfs_ace_hdr_t *)(uintptr_t)cookie; 639 uint64_t who; 640 641 acep = zfs_acl_next_ace(aclp, acep, &who, mask, 642 flags, type); 643 return ((uint64_t)(uintptr_t)acep); 644 } 645 646 /* 647 * Copy ACE to internal ZFS format. 648 * While processing the ACL each ACE will be validated for correctness. 649 * ACE FUIDs will be created later. 650 */ 651 static int 652 zfs_copy_ace_2_fuid(zfsvfs_t *zfsvfs, vtype_t obj_type, zfs_acl_t *aclp, 653 void *datap, zfs_ace_t *z_acl, uint64_t aclcnt, size_t *size, 654 zfs_fuid_info_t **fuidp, cred_t *cr) 655 { 656 int i; 657 uint16_t entry_type; 658 zfs_ace_t *aceptr = z_acl; 659 ace_t *acep = datap; 660 zfs_object_ace_t *zobjacep; 661 ace_object_t *aceobjp; 662 663 for (i = 0; i != aclcnt; i++) { 664 aceptr->z_hdr.z_access_mask = acep->a_access_mask; 665 aceptr->z_hdr.z_flags = acep->a_flags; 666 aceptr->z_hdr.z_type = acep->a_type; 667 entry_type = aceptr->z_hdr.z_flags & ACE_TYPE_FLAGS; 668 if (entry_type != ACE_OWNER && entry_type != OWNING_GROUP && 669 entry_type != ACE_EVERYONE) { 670 aceptr->z_fuid = zfs_fuid_create(zfsvfs, acep->a_who, 671 cr, (entry_type == 0) ? 672 ZFS_ACE_USER : ZFS_ACE_GROUP, fuidp); 673 } 674 675 /* 676 * Make sure ACE is valid 677 */ 678 if (zfs_ace_valid(obj_type, aclp, aceptr->z_hdr.z_type, 679 aceptr->z_hdr.z_flags) != B_TRUE) 680 return (SET_ERROR(EINVAL)); 681 682 switch (acep->a_type) { 683 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 684 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 685 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 686 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 687 zobjacep = (zfs_object_ace_t *)aceptr; 688 aceobjp = (ace_object_t *)acep; 689 690 bcopy(aceobjp->a_obj_type, zobjacep->z_object_type, 691 sizeof (aceobjp->a_obj_type)); 692 bcopy(aceobjp->a_inherit_obj_type, 693 zobjacep->z_inherit_type, 694 sizeof (aceobjp->a_inherit_obj_type)); 695 acep = (ace_t *)((caddr_t)acep + sizeof (ace_object_t)); 696 break; 697 default: 698 acep = (ace_t *)((caddr_t)acep + sizeof (ace_t)); 699 } 700 701 aceptr = (zfs_ace_t *)((caddr_t)aceptr + 702 aclp->z_ops->ace_size(aceptr)); 703 } 704 705 *size = (caddr_t)aceptr - (caddr_t)z_acl; 706 707 return (0); 708 } 709 710 /* 711 * Copy ZFS ACEs to fixed size ace_t layout 712 */ 713 static void 714 zfs_copy_fuid_2_ace(zfsvfs_t *zfsvfs, zfs_acl_t *aclp, cred_t *cr, 715 void *datap, int filter) 716 { 717 uint64_t who; 718 uint32_t access_mask; 719 uint16_t iflags, type; 720 zfs_ace_hdr_t *zacep = NULL; 721 ace_t *acep = datap; 722 ace_object_t *objacep; 723 zfs_object_ace_t *zobjacep; 724 size_t ace_size; 725 uint16_t entry_type; 726 727 while ((zacep = zfs_acl_next_ace(aclp, zacep, 728 &who, &access_mask, &iflags, &type))) { 729 730 switch (type) { 731 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 732 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 733 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 734 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 735 if (filter) { 736 continue; 737 } 738 zobjacep = (zfs_object_ace_t *)zacep; 739 objacep = (ace_object_t *)acep; 740 bcopy(zobjacep->z_object_type, 741 objacep->a_obj_type, 742 sizeof (zobjacep->z_object_type)); 743 bcopy(zobjacep->z_inherit_type, 744 objacep->a_inherit_obj_type, 745 sizeof (zobjacep->z_inherit_type)); 746 ace_size = sizeof (ace_object_t); 747 break; 748 default: 749 ace_size = sizeof (ace_t); 750 break; 751 } 752 753 entry_type = (iflags & ACE_TYPE_FLAGS); 754 if ((entry_type != ACE_OWNER && 755 entry_type != OWNING_GROUP && 756 entry_type != ACE_EVERYONE)) { 757 acep->a_who = zfs_fuid_map_id(zfsvfs, who, 758 cr, (entry_type & ACE_IDENTIFIER_GROUP) ? 759 ZFS_ACE_GROUP : ZFS_ACE_USER); 760 } else { 761 acep->a_who = (uid_t)(int64_t)who; 762 } 763 acep->a_access_mask = access_mask; 764 acep->a_flags = iflags; 765 acep->a_type = type; 766 acep = (ace_t *)((caddr_t)acep + ace_size); 767 } 768 } 769 770 static int 771 zfs_copy_ace_2_oldace(vtype_t obj_type, zfs_acl_t *aclp, ace_t *acep, 772 zfs_oldace_t *z_acl, int aclcnt, size_t *size) 773 { 774 int i; 775 zfs_oldace_t *aceptr = z_acl; 776 777 for (i = 0; i != aclcnt; i++, aceptr++) { 778 aceptr->z_access_mask = acep[i].a_access_mask; 779 aceptr->z_type = acep[i].a_type; 780 aceptr->z_flags = acep[i].a_flags; 781 aceptr->z_fuid = acep[i].a_who; 782 /* 783 * Make sure ACE is valid 784 */ 785 if (zfs_ace_valid(obj_type, aclp, aceptr->z_type, 786 aceptr->z_flags) != B_TRUE) 787 return (SET_ERROR(EINVAL)); 788 } 789 *size = (caddr_t)aceptr - (caddr_t)z_acl; 790 return (0); 791 } 792 793 /* 794 * convert old ACL format to new 795 */ 796 void 797 zfs_acl_xform(znode_t *zp, zfs_acl_t *aclp, cred_t *cr) 798 { 799 zfs_oldace_t *oldaclp; 800 int i; 801 uint16_t type, iflags; 802 uint32_t access_mask; 803 uint64_t who; 804 void *cookie = NULL; 805 zfs_acl_node_t *newaclnode; 806 807 ASSERT(aclp->z_version == ZFS_ACL_VERSION_INITIAL); 808 /* 809 * First create the ACE in a contiguous piece of memory 810 * for zfs_copy_ace_2_fuid(). 811 * 812 * We only convert an ACL once, so this won't happen 813 * everytime. 814 */ 815 oldaclp = kmem_alloc(sizeof (zfs_oldace_t) * aclp->z_acl_count, 816 KM_SLEEP); 817 i = 0; 818 while ((cookie = zfs_acl_next_ace(aclp, cookie, &who, 819 &access_mask, &iflags, &type))) { 820 oldaclp[i].z_flags = iflags; 821 oldaclp[i].z_type = type; 822 oldaclp[i].z_fuid = who; 823 oldaclp[i++].z_access_mask = access_mask; 824 } 825 826 newaclnode = zfs_acl_node_alloc(aclp->z_acl_count * 827 sizeof (zfs_object_ace_t)); 828 aclp->z_ops = &zfs_acl_fuid_ops; 829 VERIFY(zfs_copy_ace_2_fuid(zp->z_zfsvfs, ZTOV(zp)->v_type, aclp, 830 oldaclp, newaclnode->z_acldata, aclp->z_acl_count, 831 &newaclnode->z_size, NULL, cr) == 0); 832 newaclnode->z_ace_count = aclp->z_acl_count; 833 aclp->z_version = ZFS_ACL_VERSION; 834 kmem_free(oldaclp, aclp->z_acl_count * sizeof (zfs_oldace_t)); 835 836 /* 837 * Release all previous ACL nodes 838 */ 839 840 zfs_acl_release_nodes(aclp); 841 842 list_insert_head(&aclp->z_acl, newaclnode); 843 844 aclp->z_acl_bytes = newaclnode->z_size; 845 aclp->z_acl_count = newaclnode->z_ace_count; 846 847 } 848 849 /* 850 * Convert unix access mask to v4 access mask 851 */ 852 static uint32_t 853 zfs_unix_to_v4(uint32_t access_mask) 854 { 855 uint32_t new_mask = 0; 856 857 if (access_mask & S_IXOTH) 858 new_mask |= ACE_EXECUTE; 859 if (access_mask & S_IWOTH) 860 new_mask |= ACE_WRITE_DATA; 861 if (access_mask & S_IROTH) 862 new_mask |= ACE_READ_DATA; 863 return (new_mask); 864 } 865 866 static void 867 zfs_set_ace(zfs_acl_t *aclp, void *acep, uint32_t access_mask, 868 uint16_t access_type, uint64_t fuid, uint16_t entry_type) 869 { 870 uint16_t type = entry_type & ACE_TYPE_FLAGS; 871 872 aclp->z_ops->ace_mask_set(acep, access_mask); 873 aclp->z_ops->ace_type_set(acep, access_type); 874 aclp->z_ops->ace_flags_set(acep, entry_type); 875 if ((type != ACE_OWNER && type != OWNING_GROUP && 876 type != ACE_EVERYONE)) 877 aclp->z_ops->ace_who_set(acep, fuid); 878 } 879 880 /* 881 * Determine mode of file based on ACL. 882 */ 883 uint64_t 884 zfs_mode_compute(uint64_t fmode, zfs_acl_t *aclp, 885 uint64_t *pflags, uint64_t fuid, uint64_t fgid) 886 { 887 int entry_type; 888 mode_t mode; 889 mode_t seen = 0; 890 zfs_ace_hdr_t *acep = NULL; 891 uint64_t who; 892 uint16_t iflags, type; 893 uint32_t access_mask; 894 boolean_t an_exec_denied = B_FALSE; 895 896 mode = (fmode & (S_IFMT | S_ISUID | S_ISGID | S_ISVTX)); 897 898 while ((acep = zfs_acl_next_ace(aclp, acep, &who, 899 &access_mask, &iflags, &type))) { 900 901 if (!zfs_acl_valid_ace_type(type, iflags)) 902 continue; 903 904 entry_type = (iflags & ACE_TYPE_FLAGS); 905 906 /* 907 * Skip over any inherit_only ACEs 908 */ 909 if (iflags & ACE_INHERIT_ONLY_ACE) 910 continue; 911 912 if (entry_type == ACE_OWNER || (entry_type == 0 && 913 who == fuid)) { 914 if ((access_mask & ACE_READ_DATA) && 915 (!(seen & S_IRUSR))) { 916 seen |= S_IRUSR; 917 if (type == ALLOW) { 918 mode |= S_IRUSR; 919 } 920 } 921 if ((access_mask & ACE_WRITE_DATA) && 922 (!(seen & S_IWUSR))) { 923 seen |= S_IWUSR; 924 if (type == ALLOW) { 925 mode |= S_IWUSR; 926 } 927 } 928 if ((access_mask & ACE_EXECUTE) && 929 (!(seen & S_IXUSR))) { 930 seen |= S_IXUSR; 931 if (type == ALLOW) { 932 mode |= S_IXUSR; 933 } 934 } 935 } else if (entry_type == OWNING_GROUP || 936 (entry_type == ACE_IDENTIFIER_GROUP && who == fgid)) { 937 if ((access_mask & ACE_READ_DATA) && 938 (!(seen & S_IRGRP))) { 939 seen |= S_IRGRP; 940 if (type == ALLOW) { 941 mode |= S_IRGRP; 942 } 943 } 944 if ((access_mask & ACE_WRITE_DATA) && 945 (!(seen & S_IWGRP))) { 946 seen |= S_IWGRP; 947 if (type == ALLOW) { 948 mode |= S_IWGRP; 949 } 950 } 951 if ((access_mask & ACE_EXECUTE) && 952 (!(seen & S_IXGRP))) { 953 seen |= S_IXGRP; 954 if (type == ALLOW) { 955 mode |= S_IXGRP; 956 } 957 } 958 } else if (entry_type == ACE_EVERYONE) { 959 if ((access_mask & ACE_READ_DATA)) { 960 if (!(seen & S_IRUSR)) { 961 seen |= S_IRUSR; 962 if (type == ALLOW) { 963 mode |= S_IRUSR; 964 } 965 } 966 if (!(seen & S_IRGRP)) { 967 seen |= S_IRGRP; 968 if (type == ALLOW) { 969 mode |= S_IRGRP; 970 } 971 } 972 if (!(seen & S_IROTH)) { 973 seen |= S_IROTH; 974 if (type == ALLOW) { 975 mode |= S_IROTH; 976 } 977 } 978 } 979 if ((access_mask & ACE_WRITE_DATA)) { 980 if (!(seen & S_IWUSR)) { 981 seen |= S_IWUSR; 982 if (type == ALLOW) { 983 mode |= S_IWUSR; 984 } 985 } 986 if (!(seen & S_IWGRP)) { 987 seen |= S_IWGRP; 988 if (type == ALLOW) { 989 mode |= S_IWGRP; 990 } 991 } 992 if (!(seen & S_IWOTH)) { 993 seen |= S_IWOTH; 994 if (type == ALLOW) { 995 mode |= S_IWOTH; 996 } 997 } 998 } 999 if ((access_mask & ACE_EXECUTE)) { 1000 if (!(seen & S_IXUSR)) { 1001 seen |= S_IXUSR; 1002 if (type == ALLOW) { 1003 mode |= S_IXUSR; 1004 } 1005 } 1006 if (!(seen & S_IXGRP)) { 1007 seen |= S_IXGRP; 1008 if (type == ALLOW) { 1009 mode |= S_IXGRP; 1010 } 1011 } 1012 if (!(seen & S_IXOTH)) { 1013 seen |= S_IXOTH; 1014 if (type == ALLOW) { 1015 mode |= S_IXOTH; 1016 } 1017 } 1018 } 1019 } else { 1020 /* 1021 * Only care if this IDENTIFIER_GROUP or 1022 * USER ACE denies execute access to someone, 1023 * mode is not affected 1024 */ 1025 if ((access_mask & ACE_EXECUTE) && type == DENY) 1026 an_exec_denied = B_TRUE; 1027 } 1028 } 1029 1030 /* 1031 * Failure to allow is effectively a deny, so execute permission 1032 * is denied if it was never mentioned or if we explicitly 1033 * weren't allowed it. 1034 */ 1035 if (!an_exec_denied && 1036 ((seen & ALL_MODE_EXECS) != ALL_MODE_EXECS || 1037 (mode & ALL_MODE_EXECS) != ALL_MODE_EXECS)) 1038 an_exec_denied = B_TRUE; 1039 1040 if (an_exec_denied) 1041 *pflags &= ~ZFS_NO_EXECS_DENIED; 1042 else 1043 *pflags |= ZFS_NO_EXECS_DENIED; 1044 1045 return (mode); 1046 } 1047 1048 /* 1049 * Read an external acl object. If the intent is to modify, always 1050 * create a new acl and leave any cached acl in place. 1051 */ 1052 int 1053 zfs_acl_node_read(znode_t *zp, boolean_t have_lock, zfs_acl_t **aclpp, 1054 boolean_t will_modify) 1055 { 1056 zfs_acl_t *aclp; 1057 int aclsize; 1058 int acl_count; 1059 zfs_acl_node_t *aclnode; 1060 zfs_acl_phys_t znode_acl; 1061 int version; 1062 int error; 1063 1064 ASSERT(MUTEX_HELD(&zp->z_acl_lock)); 1065 if (zp->z_zfsvfs->z_replay == B_FALSE) 1066 ASSERT_VOP_LOCKED(ZTOV(zp), __func__); 1067 1068 if (zp->z_acl_cached && !will_modify) { 1069 *aclpp = zp->z_acl_cached; 1070 return (0); 1071 } 1072 1073 version = zfs_znode_acl_version(zp); 1074 1075 if ((error = zfs_acl_znode_info(zp, &aclsize, 1076 &acl_count, &znode_acl)) != 0) { 1077 goto done; 1078 } 1079 1080 aclp = zfs_acl_alloc(version); 1081 1082 aclp->z_acl_count = acl_count; 1083 aclp->z_acl_bytes = aclsize; 1084 1085 aclnode = zfs_acl_node_alloc(aclsize); 1086 aclnode->z_ace_count = aclp->z_acl_count; 1087 aclnode->z_size = aclsize; 1088 1089 if (!zp->z_is_sa) { 1090 if (znode_acl.z_acl_extern_obj) { 1091 error = dmu_read(zp->z_zfsvfs->z_os, 1092 znode_acl.z_acl_extern_obj, 0, aclnode->z_size, 1093 aclnode->z_acldata, DMU_READ_PREFETCH); 1094 } else { 1095 bcopy(znode_acl.z_ace_data, aclnode->z_acldata, 1096 aclnode->z_size); 1097 } 1098 } else { 1099 error = sa_lookup(zp->z_sa_hdl, SA_ZPL_DACL_ACES(zp->z_zfsvfs), 1100 aclnode->z_acldata, aclnode->z_size); 1101 } 1102 1103 if (error != 0) { 1104 zfs_acl_free(aclp); 1105 zfs_acl_node_free(aclnode); 1106 /* convert checksum errors into IO errors */ 1107 if (error == ECKSUM) 1108 error = SET_ERROR(EIO); 1109 goto done; 1110 } 1111 1112 list_insert_head(&aclp->z_acl, aclnode); 1113 1114 *aclpp = aclp; 1115 if (!will_modify) 1116 zp->z_acl_cached = aclp; 1117 done: 1118 return (error); 1119 } 1120 1121 /*ARGSUSED*/ 1122 void 1123 zfs_acl_data_locator(void **dataptr, uint32_t *length, uint32_t buflen, 1124 boolean_t start, void *userdata) 1125 { 1126 zfs_acl_locator_cb_t *cb = (zfs_acl_locator_cb_t *)userdata; 1127 1128 if (start) { 1129 cb->cb_acl_node = list_head(&cb->cb_aclp->z_acl); 1130 } else { 1131 cb->cb_acl_node = list_next(&cb->cb_aclp->z_acl, 1132 cb->cb_acl_node); 1133 } 1134 *dataptr = cb->cb_acl_node->z_acldata; 1135 *length = cb->cb_acl_node->z_size; 1136 } 1137 1138 int 1139 zfs_acl_chown_setattr(znode_t *zp) 1140 { 1141 int error; 1142 zfs_acl_t *aclp; 1143 1144 if (zp->z_zfsvfs->z_replay == B_FALSE) 1145 ASSERT_VOP_ELOCKED(ZTOV(zp), __func__); 1146 ASSERT(MUTEX_HELD(&zp->z_acl_lock)); 1147 ASSERT_VOP_IN_SEQC(ZTOV(zp)); 1148 1149 if ((error = zfs_acl_node_read(zp, B_TRUE, &aclp, B_FALSE)) == 0) 1150 zp->z_mode = zfs_mode_compute(zp->z_mode, aclp, 1151 &zp->z_pflags, zp->z_uid, zp->z_gid); 1152 return (error); 1153 } 1154 1155 /* 1156 * common code for setting ACLs. 1157 * 1158 * This function is called from zfs_mode_update, zfs_perm_init, and zfs_setacl. 1159 * zfs_setacl passes a non-NULL inherit pointer (ihp) to indicate that it's 1160 * already checked the acl and knows whether to inherit. 1161 */ 1162 int 1163 zfs_aclset_common(znode_t *zp, zfs_acl_t *aclp, cred_t *cr, dmu_tx_t *tx) 1164 { 1165 int error; 1166 zfsvfs_t *zfsvfs = zp->z_zfsvfs; 1167 dmu_object_type_t otype; 1168 zfs_acl_locator_cb_t locate = { 0 }; 1169 uint64_t mode; 1170 sa_bulk_attr_t bulk[5]; 1171 uint64_t ctime[2]; 1172 int count = 0; 1173 zfs_acl_phys_t acl_phys; 1174 1175 ASSERT_VOP_IN_SEQC(ZTOV(zp)); 1176 1177 mode = zp->z_mode; 1178 1179 mode = zfs_mode_compute(mode, aclp, &zp->z_pflags, 1180 zp->z_uid, zp->z_gid); 1181 1182 zp->z_mode = mode; 1183 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_MODE(zfsvfs), NULL, 1184 &mode, sizeof (mode)); 1185 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_FLAGS(zfsvfs), NULL, 1186 &zp->z_pflags, sizeof (zp->z_pflags)); 1187 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_CTIME(zfsvfs), NULL, 1188 &ctime, sizeof (ctime)); 1189 1190 if (zp->z_acl_cached) { 1191 zfs_acl_free(zp->z_acl_cached); 1192 zp->z_acl_cached = NULL; 1193 } 1194 1195 /* 1196 * Upgrade needed? 1197 */ 1198 if (!zfsvfs->z_use_fuids) { 1199 otype = DMU_OT_OLDACL; 1200 } else { 1201 if ((aclp->z_version == ZFS_ACL_VERSION_INITIAL) && 1202 (zfsvfs->z_version >= ZPL_VERSION_FUID)) 1203 zfs_acl_xform(zp, aclp, cr); 1204 ASSERT(aclp->z_version >= ZFS_ACL_VERSION_FUID); 1205 otype = DMU_OT_ACL; 1206 } 1207 1208 /* 1209 * Arrgh, we have to handle old on disk format 1210 * as well as newer (preferred) SA format. 1211 */ 1212 1213 if (zp->z_is_sa) { /* the easy case, just update the ACL attribute */ 1214 locate.cb_aclp = aclp; 1215 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_DACL_ACES(zfsvfs), 1216 zfs_acl_data_locator, &locate, aclp->z_acl_bytes); 1217 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_DACL_COUNT(zfsvfs), 1218 NULL, &aclp->z_acl_count, sizeof (uint64_t)); 1219 } else { /* Painful legacy way */ 1220 zfs_acl_node_t *aclnode; 1221 uint64_t off = 0; 1222 uint64_t aoid; 1223 1224 if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_ZNODE_ACL(zfsvfs), 1225 &acl_phys, sizeof (acl_phys))) != 0) 1226 return (error); 1227 1228 aoid = acl_phys.z_acl_extern_obj; 1229 1230 if (aclp->z_acl_bytes > ZFS_ACE_SPACE) { 1231 /* 1232 * If ACL was previously external and we are now 1233 * converting to new ACL format then release old 1234 * ACL object and create a new one. 1235 */ 1236 if (aoid && 1237 aclp->z_version != acl_phys.z_acl_version) { 1238 error = dmu_object_free(zfsvfs->z_os, aoid, tx); 1239 if (error) 1240 return (error); 1241 aoid = 0; 1242 } 1243 if (aoid == 0) { 1244 aoid = dmu_object_alloc(zfsvfs->z_os, 1245 otype, aclp->z_acl_bytes, 1246 otype == DMU_OT_ACL ? 1247 DMU_OT_SYSACL : DMU_OT_NONE, 1248 otype == DMU_OT_ACL ? 1249 DN_OLD_MAX_BONUSLEN : 0, tx); 1250 } else { 1251 (void) dmu_object_set_blocksize(zfsvfs->z_os, 1252 aoid, aclp->z_acl_bytes, 0, tx); 1253 } 1254 acl_phys.z_acl_extern_obj = aoid; 1255 for (aclnode = list_head(&aclp->z_acl); aclnode; 1256 aclnode = list_next(&aclp->z_acl, aclnode)) { 1257 if (aclnode->z_ace_count == 0) 1258 continue; 1259 dmu_write(zfsvfs->z_os, aoid, off, 1260 aclnode->z_size, aclnode->z_acldata, tx); 1261 off += aclnode->z_size; 1262 } 1263 } else { 1264 void *start = acl_phys.z_ace_data; 1265 /* 1266 * Migrating back embedded? 1267 */ 1268 if (acl_phys.z_acl_extern_obj) { 1269 error = dmu_object_free(zfsvfs->z_os, 1270 acl_phys.z_acl_extern_obj, tx); 1271 if (error) 1272 return (error); 1273 acl_phys.z_acl_extern_obj = 0; 1274 } 1275 1276 for (aclnode = list_head(&aclp->z_acl); aclnode; 1277 aclnode = list_next(&aclp->z_acl, aclnode)) { 1278 if (aclnode->z_ace_count == 0) 1279 continue; 1280 bcopy(aclnode->z_acldata, start, 1281 aclnode->z_size); 1282 start = (caddr_t)start + aclnode->z_size; 1283 } 1284 } 1285 /* 1286 * If Old version then swap count/bytes to match old 1287 * layout of znode_acl_phys_t. 1288 */ 1289 if (aclp->z_version == ZFS_ACL_VERSION_INITIAL) { 1290 acl_phys.z_acl_size = aclp->z_acl_count; 1291 acl_phys.z_acl_count = aclp->z_acl_bytes; 1292 } else { 1293 acl_phys.z_acl_size = aclp->z_acl_bytes; 1294 acl_phys.z_acl_count = aclp->z_acl_count; 1295 } 1296 acl_phys.z_acl_version = aclp->z_version; 1297 1298 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_ZNODE_ACL(zfsvfs), NULL, 1299 &acl_phys, sizeof (acl_phys)); 1300 } 1301 1302 /* 1303 * Replace ACL wide bits, but first clear them. 1304 */ 1305 zp->z_pflags &= ~ZFS_ACL_WIDE_FLAGS; 1306 1307 zp->z_pflags |= aclp->z_hints; 1308 1309 if (ace_trivial_common(aclp, 0, zfs_ace_walk) == 0) 1310 zp->z_pflags |= ZFS_ACL_TRIVIAL; 1311 1312 zfs_tstamp_update_setup(zp, STATE_CHANGED, NULL, ctime); 1313 return (sa_bulk_update(zp->z_sa_hdl, bulk, count, tx)); 1314 } 1315 1316 static void 1317 zfs_acl_chmod(vtype_t vtype, uint64_t mode, boolean_t split, boolean_t trim, 1318 zfs_acl_t *aclp) 1319 { 1320 void *acep = NULL; 1321 uint64_t who; 1322 int new_count, new_bytes; 1323 int ace_size; 1324 int entry_type; 1325 uint16_t iflags, type; 1326 uint32_t access_mask; 1327 zfs_acl_node_t *newnode; 1328 size_t abstract_size = aclp->z_ops->ace_abstract_size(); 1329 void *zacep; 1330 boolean_t isdir; 1331 trivial_acl_t masks; 1332 1333 new_count = new_bytes = 0; 1334 1335 isdir = (vtype == VDIR); 1336 1337 acl_trivial_access_masks((mode_t)mode, isdir, &masks); 1338 1339 newnode = zfs_acl_node_alloc((abstract_size * 6) + aclp->z_acl_bytes); 1340 1341 zacep = newnode->z_acldata; 1342 if (masks.allow0) { 1343 zfs_set_ace(aclp, zacep, masks.allow0, ALLOW, -1, ACE_OWNER); 1344 zacep = (void *)((uintptr_t)zacep + abstract_size); 1345 new_count++; 1346 new_bytes += abstract_size; 1347 } 1348 if (masks.deny1) { 1349 zfs_set_ace(aclp, zacep, masks.deny1, DENY, -1, ACE_OWNER); 1350 zacep = (void *)((uintptr_t)zacep + abstract_size); 1351 new_count++; 1352 new_bytes += abstract_size; 1353 } 1354 if (masks.deny2) { 1355 zfs_set_ace(aclp, zacep, masks.deny2, DENY, -1, OWNING_GROUP); 1356 zacep = (void *)((uintptr_t)zacep + abstract_size); 1357 new_count++; 1358 new_bytes += abstract_size; 1359 } 1360 1361 while ((acep = zfs_acl_next_ace(aclp, acep, &who, &access_mask, 1362 &iflags, &type))) { 1363 entry_type = (iflags & ACE_TYPE_FLAGS); 1364 /* 1365 * ACEs used to represent the file mode may be divided 1366 * into an equivalent pair of inherit-only and regular 1367 * ACEs, if they are inheritable. 1368 * Skip regular ACEs, which are replaced by the new mode. 1369 */ 1370 if (split && (entry_type == ACE_OWNER || 1371 entry_type == OWNING_GROUP || 1372 entry_type == ACE_EVERYONE)) { 1373 if (!isdir || !(iflags & 1374 (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE))) 1375 continue; 1376 /* 1377 * We preserve owner@, group@, or @everyone 1378 * permissions, if they are inheritable, by 1379 * copying them to inherit_only ACEs. This 1380 * prevents inheritable permissions from being 1381 * altered along with the file mode. 1382 */ 1383 iflags |= ACE_INHERIT_ONLY_ACE; 1384 } 1385 1386 /* 1387 * If this ACL has any inheritable ACEs, mark that in 1388 * the hints (which are later masked into the pflags) 1389 * so create knows to do inheritance. 1390 */ 1391 if (isdir && (iflags & 1392 (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE))) 1393 aclp->z_hints |= ZFS_INHERIT_ACE; 1394 1395 if ((type != ALLOW && type != DENY) || 1396 (iflags & ACE_INHERIT_ONLY_ACE)) { 1397 switch (type) { 1398 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 1399 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 1400 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 1401 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 1402 aclp->z_hints |= ZFS_ACL_OBJ_ACE; 1403 break; 1404 } 1405 } else { 1406 /* 1407 * Limit permissions granted by ACEs to be no greater 1408 * than permissions of the requested group mode. 1409 * Applies when the "aclmode" property is set to 1410 * "groupmask". 1411 */ 1412 if ((type == ALLOW) && trim) 1413 access_mask &= masks.group; 1414 } 1415 zfs_set_ace(aclp, zacep, access_mask, type, who, iflags); 1416 ace_size = aclp->z_ops->ace_size(acep); 1417 zacep = (void *)((uintptr_t)zacep + ace_size); 1418 new_count++; 1419 new_bytes += ace_size; 1420 } 1421 zfs_set_ace(aclp, zacep, masks.owner, ALLOW, -1, ACE_OWNER); 1422 zacep = (void *)((uintptr_t)zacep + abstract_size); 1423 zfs_set_ace(aclp, zacep, masks.group, ALLOW, -1, OWNING_GROUP); 1424 zacep = (void *)((uintptr_t)zacep + abstract_size); 1425 zfs_set_ace(aclp, zacep, masks.everyone, ALLOW, -1, ACE_EVERYONE); 1426 1427 new_count += 3; 1428 new_bytes += abstract_size * 3; 1429 zfs_acl_release_nodes(aclp); 1430 aclp->z_acl_count = new_count; 1431 aclp->z_acl_bytes = new_bytes; 1432 newnode->z_ace_count = new_count; 1433 newnode->z_size = new_bytes; 1434 list_insert_tail(&aclp->z_acl, newnode); 1435 } 1436 1437 int 1438 zfs_acl_chmod_setattr(znode_t *zp, zfs_acl_t **aclp, uint64_t mode) 1439 { 1440 int error = 0; 1441 1442 mutex_enter(&zp->z_acl_lock); 1443 if (zp->z_zfsvfs->z_replay == B_FALSE) 1444 ASSERT_VOP_ELOCKED(ZTOV(zp), __func__); 1445 if (zp->z_zfsvfs->z_acl_mode == ZFS_ACL_DISCARD) 1446 *aclp = zfs_acl_alloc(zfs_acl_version_zp(zp)); 1447 else 1448 error = zfs_acl_node_read(zp, B_TRUE, aclp, B_TRUE); 1449 1450 if (error == 0) { 1451 (*aclp)->z_hints = zp->z_pflags & V4_ACL_WIDE_FLAGS; 1452 zfs_acl_chmod(ZTOV(zp)->v_type, mode, B_TRUE, 1453 (zp->z_zfsvfs->z_acl_mode == ZFS_ACL_GROUPMASK), *aclp); 1454 } 1455 mutex_exit(&zp->z_acl_lock); 1456 1457 return (error); 1458 } 1459 1460 /* 1461 * Should ACE be inherited? 1462 */ 1463 static int 1464 zfs_ace_can_use(vtype_t vtype, uint16_t acep_flags) 1465 { 1466 int iflags = (acep_flags & 0xf); 1467 1468 if ((vtype == VDIR) && (iflags & ACE_DIRECTORY_INHERIT_ACE)) 1469 return (1); 1470 else if (iflags & ACE_FILE_INHERIT_ACE) 1471 return (!((vtype == VDIR) && 1472 (iflags & ACE_NO_PROPAGATE_INHERIT_ACE))); 1473 return (0); 1474 } 1475 1476 /* 1477 * inherit inheritable ACEs from parent 1478 */ 1479 static zfs_acl_t * 1480 zfs_acl_inherit(zfsvfs_t *zfsvfs, vtype_t vtype, zfs_acl_t *paclp, 1481 uint64_t mode, boolean_t *need_chmod) 1482 { 1483 void *pacep = NULL; 1484 void *acep; 1485 zfs_acl_node_t *aclnode; 1486 zfs_acl_t *aclp = NULL; 1487 uint64_t who; 1488 uint32_t access_mask; 1489 uint16_t iflags, newflags, type; 1490 size_t ace_size; 1491 void *data1, *data2; 1492 size_t data1sz, data2sz; 1493 uint_t aclinherit; 1494 boolean_t isdir = (vtype == VDIR); 1495 boolean_t isreg = (vtype == VREG); 1496 1497 *need_chmod = B_TRUE; 1498 1499 aclp = zfs_acl_alloc(paclp->z_version); 1500 aclinherit = zfsvfs->z_acl_inherit; 1501 if (aclinherit == ZFS_ACL_DISCARD || vtype == VLNK) 1502 return (aclp); 1503 1504 while ((pacep = zfs_acl_next_ace(paclp, pacep, &who, 1505 &access_mask, &iflags, &type))) { 1506 1507 /* 1508 * don't inherit bogus ACEs 1509 */ 1510 if (!zfs_acl_valid_ace_type(type, iflags)) 1511 continue; 1512 1513 /* 1514 * Check if ACE is inheritable by this vnode 1515 */ 1516 if ((aclinherit == ZFS_ACL_NOALLOW && type == ALLOW) || 1517 !zfs_ace_can_use(vtype, iflags)) 1518 continue; 1519 1520 /* 1521 * If owner@, group@, or everyone@ inheritable 1522 * then zfs_acl_chmod() isn't needed. 1523 */ 1524 if ((aclinherit == ZFS_ACL_PASSTHROUGH || 1525 aclinherit == ZFS_ACL_PASSTHROUGH_X) && 1526 ((iflags & (ACE_OWNER|ACE_EVERYONE)) || 1527 ((iflags & OWNING_GROUP) == OWNING_GROUP)) && 1528 (isreg || (isdir && (iflags & ACE_DIRECTORY_INHERIT_ACE)))) 1529 *need_chmod = B_FALSE; 1530 1531 /* 1532 * Strip inherited execute permission from file if 1533 * not in mode 1534 */ 1535 if (aclinherit == ZFS_ACL_PASSTHROUGH_X && type == ALLOW && 1536 !isdir && ((mode & (S_IXUSR|S_IXGRP|S_IXOTH)) == 0)) { 1537 access_mask &= ~ACE_EXECUTE; 1538 } 1539 1540 /* 1541 * Strip write_acl and write_owner from permissions 1542 * when inheriting an ACE 1543 */ 1544 if (aclinherit == ZFS_ACL_RESTRICTED && type == ALLOW) { 1545 access_mask &= ~RESTRICTED_CLEAR; 1546 } 1547 1548 ace_size = aclp->z_ops->ace_size(pacep); 1549 aclnode = zfs_acl_node_alloc(ace_size); 1550 list_insert_tail(&aclp->z_acl, aclnode); 1551 acep = aclnode->z_acldata; 1552 1553 zfs_set_ace(aclp, acep, access_mask, type, 1554 who, iflags|ACE_INHERITED_ACE); 1555 1556 /* 1557 * Copy special opaque data if any 1558 */ 1559 if ((data1sz = paclp->z_ops->ace_data(pacep, &data1)) != 0) { 1560 VERIFY((data2sz = aclp->z_ops->ace_data(acep, 1561 &data2)) == data1sz); 1562 bcopy(data1, data2, data2sz); 1563 } 1564 1565 aclp->z_acl_count++; 1566 aclnode->z_ace_count++; 1567 aclp->z_acl_bytes += aclnode->z_size; 1568 newflags = aclp->z_ops->ace_flags_get(acep); 1569 1570 /* 1571 * If ACE is not to be inherited further, or if the vnode is 1572 * not a directory, remove all inheritance flags 1573 */ 1574 if (!isdir || (iflags & ACE_NO_PROPAGATE_INHERIT_ACE)) { 1575 newflags &= ~ALL_INHERIT; 1576 aclp->z_ops->ace_flags_set(acep, 1577 newflags|ACE_INHERITED_ACE); 1578 continue; 1579 } 1580 1581 /* 1582 * This directory has an inheritable ACE 1583 */ 1584 aclp->z_hints |= ZFS_INHERIT_ACE; 1585 1586 /* 1587 * If only FILE_INHERIT is set then turn on 1588 * inherit_only 1589 */ 1590 if ((iflags & (ACE_FILE_INHERIT_ACE | 1591 ACE_DIRECTORY_INHERIT_ACE)) == ACE_FILE_INHERIT_ACE) { 1592 newflags |= ACE_INHERIT_ONLY_ACE; 1593 aclp->z_ops->ace_flags_set(acep, 1594 newflags|ACE_INHERITED_ACE); 1595 } else { 1596 newflags &= ~ACE_INHERIT_ONLY_ACE; 1597 aclp->z_ops->ace_flags_set(acep, 1598 newflags|ACE_INHERITED_ACE); 1599 } 1600 } 1601 if (zfsvfs->z_acl_mode == ZFS_ACL_RESTRICTED && 1602 aclp->z_acl_count != 0) { 1603 *need_chmod = B_FALSE; 1604 } 1605 1606 return (aclp); 1607 } 1608 1609 /* 1610 * Create file system object initial permissions 1611 * including inheritable ACEs. 1612 * Also, create FUIDs for owner and group. 1613 */ 1614 int 1615 zfs_acl_ids_create(znode_t *dzp, int flag, vattr_t *vap, cred_t *cr, 1616 vsecattr_t *vsecp, zfs_acl_ids_t *acl_ids) 1617 { 1618 int error; 1619 zfsvfs_t *zfsvfs = dzp->z_zfsvfs; 1620 zfs_acl_t *paclp; 1621 gid_t gid; 1622 boolean_t need_chmod = B_TRUE; 1623 boolean_t trim = B_FALSE; 1624 boolean_t inherited = B_FALSE; 1625 1626 if ((flag & IS_ROOT_NODE) == 0) { 1627 if (zfsvfs->z_replay == B_FALSE) 1628 ASSERT_VOP_ELOCKED(ZTOV(dzp), __func__); 1629 } else 1630 ASSERT(dzp->z_vnode == NULL); 1631 bzero(acl_ids, sizeof (zfs_acl_ids_t)); 1632 acl_ids->z_mode = MAKEIMODE(vap->va_type, vap->va_mode); 1633 1634 if (vsecp) 1635 if ((error = zfs_vsec_2_aclp(zfsvfs, vap->va_type, vsecp, cr, 1636 &acl_ids->z_fuidp, &acl_ids->z_aclp)) != 0) 1637 return (error); 1638 /* 1639 * Determine uid and gid. 1640 */ 1641 if ((flag & IS_ROOT_NODE) || zfsvfs->z_replay || 1642 ((flag & IS_XATTR) && (vap->va_type == VDIR))) { 1643 acl_ids->z_fuid = zfs_fuid_create(zfsvfs, 1644 (uint64_t)vap->va_uid, cr, 1645 ZFS_OWNER, &acl_ids->z_fuidp); 1646 acl_ids->z_fgid = zfs_fuid_create(zfsvfs, 1647 (uint64_t)vap->va_gid, cr, 1648 ZFS_GROUP, &acl_ids->z_fuidp); 1649 gid = vap->va_gid; 1650 } else { 1651 acl_ids->z_fuid = zfs_fuid_create_cred(zfsvfs, ZFS_OWNER, 1652 cr, &acl_ids->z_fuidp); 1653 acl_ids->z_fgid = 0; 1654 if (vap->va_mask & AT_GID) { 1655 acl_ids->z_fgid = zfs_fuid_create(zfsvfs, 1656 (uint64_t)vap->va_gid, 1657 cr, ZFS_GROUP, &acl_ids->z_fuidp); 1658 gid = vap->va_gid; 1659 if (acl_ids->z_fgid != dzp->z_gid && 1660 !groupmember(vap->va_gid, cr) && 1661 secpolicy_vnode_create_gid(cr) != 0) 1662 acl_ids->z_fgid = 0; 1663 } 1664 if (acl_ids->z_fgid == 0) { 1665 char *domain; 1666 uint32_t rid; 1667 1668 acl_ids->z_fgid = dzp->z_gid; 1669 gid = zfs_fuid_map_id(zfsvfs, acl_ids->z_fgid, 1670 cr, ZFS_GROUP); 1671 1672 if (zfsvfs->z_use_fuids && 1673 IS_EPHEMERAL(acl_ids->z_fgid)) { 1674 domain = 1675 zfs_fuid_idx_domain(&zfsvfs->z_fuid_idx, 1676 FUID_INDEX(acl_ids->z_fgid)); 1677 rid = FUID_RID(acl_ids->z_fgid); 1678 zfs_fuid_node_add(&acl_ids->z_fuidp, 1679 domain, rid, FUID_INDEX(acl_ids->z_fgid), 1680 acl_ids->z_fgid, ZFS_GROUP); 1681 } 1682 } 1683 } 1684 1685 /* 1686 * If we're creating a directory, and the parent directory has the 1687 * set-GID bit set, set in on the new directory. 1688 * Otherwise, if the user is neither privileged nor a member of the 1689 * file's new group, clear the file's set-GID bit. 1690 */ 1691 1692 if (!(flag & IS_ROOT_NODE) && (dzp->z_mode & S_ISGID) && 1693 (vap->va_type == VDIR)) { 1694 acl_ids->z_mode |= S_ISGID; 1695 } else { 1696 if ((acl_ids->z_mode & S_ISGID) && 1697 secpolicy_vnode_setids_setgids(ZTOV(dzp), cr, gid) != 0) 1698 acl_ids->z_mode &= ~S_ISGID; 1699 } 1700 1701 if (acl_ids->z_aclp == NULL) { 1702 mutex_enter(&dzp->z_acl_lock); 1703 if (!(flag & IS_ROOT_NODE) && 1704 (dzp->z_pflags & ZFS_INHERIT_ACE) && 1705 !(dzp->z_pflags & ZFS_XATTR)) { 1706 VERIFY0(zfs_acl_node_read(dzp, B_TRUE, 1707 &paclp, B_FALSE)); 1708 acl_ids->z_aclp = zfs_acl_inherit(zfsvfs, 1709 vap->va_type, paclp, acl_ids->z_mode, &need_chmod); 1710 inherited = B_TRUE; 1711 } else { 1712 acl_ids->z_aclp = 1713 zfs_acl_alloc(zfs_acl_version_zp(dzp)); 1714 acl_ids->z_aclp->z_hints |= ZFS_ACL_TRIVIAL; 1715 } 1716 mutex_exit(&dzp->z_acl_lock); 1717 1718 if (need_chmod) { 1719 if (vap->va_type == VDIR) 1720 acl_ids->z_aclp->z_hints |= 1721 ZFS_ACL_AUTO_INHERIT; 1722 1723 if (zfsvfs->z_acl_mode == ZFS_ACL_GROUPMASK && 1724 zfsvfs->z_acl_inherit != ZFS_ACL_PASSTHROUGH && 1725 zfsvfs->z_acl_inherit != ZFS_ACL_PASSTHROUGH_X) 1726 trim = B_TRUE; 1727 zfs_acl_chmod(vap->va_type, acl_ids->z_mode, B_FALSE, 1728 trim, acl_ids->z_aclp); 1729 } 1730 } 1731 1732 if (inherited || vsecp) { 1733 acl_ids->z_mode = zfs_mode_compute(acl_ids->z_mode, 1734 acl_ids->z_aclp, &acl_ids->z_aclp->z_hints, 1735 acl_ids->z_fuid, acl_ids->z_fgid); 1736 if (ace_trivial_common(acl_ids->z_aclp, 0, zfs_ace_walk) == 0) 1737 acl_ids->z_aclp->z_hints |= ZFS_ACL_TRIVIAL; 1738 } 1739 1740 return (0); 1741 } 1742 1743 /* 1744 * Free ACL and fuid_infop, but not the acl_ids structure 1745 */ 1746 void 1747 zfs_acl_ids_free(zfs_acl_ids_t *acl_ids) 1748 { 1749 if (acl_ids->z_aclp) 1750 zfs_acl_free(acl_ids->z_aclp); 1751 if (acl_ids->z_fuidp) 1752 zfs_fuid_info_free(acl_ids->z_fuidp); 1753 acl_ids->z_aclp = NULL; 1754 acl_ids->z_fuidp = NULL; 1755 } 1756 1757 boolean_t 1758 zfs_acl_ids_overquota(zfsvfs_t *zv, zfs_acl_ids_t *acl_ids, uint64_t projid) 1759 { 1760 return (zfs_id_overquota(zv, DMU_USERUSED_OBJECT, acl_ids->z_fuid) || 1761 zfs_id_overquota(zv, DMU_GROUPUSED_OBJECT, acl_ids->z_fgid) || 1762 (projid != ZFS_DEFAULT_PROJID && projid != ZFS_INVALID_PROJID && 1763 zfs_id_overquota(zv, DMU_PROJECTUSED_OBJECT, projid))); 1764 } 1765 1766 /* 1767 * Retrieve a file's ACL 1768 */ 1769 int 1770 zfs_getacl(znode_t *zp, vsecattr_t *vsecp, boolean_t skipaclchk, cred_t *cr) 1771 { 1772 zfs_acl_t *aclp; 1773 ulong_t mask; 1774 int error; 1775 int count = 0; 1776 int largeace = 0; 1777 1778 mask = vsecp->vsa_mask & (VSA_ACE | VSA_ACECNT | 1779 VSA_ACE_ACLFLAGS | VSA_ACE_ALLTYPES); 1780 1781 if (mask == 0) 1782 return (SET_ERROR(ENOSYS)); 1783 1784 if ((error = zfs_zaccess(zp, ACE_READ_ACL, 0, skipaclchk, cr))) 1785 return (error); 1786 1787 mutex_enter(&zp->z_acl_lock); 1788 1789 if (zp->z_zfsvfs->z_replay == B_FALSE) 1790 ASSERT_VOP_LOCKED(ZTOV(zp), __func__); 1791 error = zfs_acl_node_read(zp, B_TRUE, &aclp, B_FALSE); 1792 if (error != 0) { 1793 mutex_exit(&zp->z_acl_lock); 1794 return (error); 1795 } 1796 1797 /* 1798 * Scan ACL to determine number of ACEs 1799 */ 1800 if ((zp->z_pflags & ZFS_ACL_OBJ_ACE) && !(mask & VSA_ACE_ALLTYPES)) { 1801 void *zacep = NULL; 1802 uint64_t who; 1803 uint32_t access_mask; 1804 uint16_t type, iflags; 1805 1806 while ((zacep = zfs_acl_next_ace(aclp, zacep, 1807 &who, &access_mask, &iflags, &type))) { 1808 switch (type) { 1809 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 1810 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 1811 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 1812 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 1813 largeace++; 1814 continue; 1815 default: 1816 count++; 1817 } 1818 } 1819 vsecp->vsa_aclcnt = count; 1820 } else 1821 count = (int)aclp->z_acl_count; 1822 1823 if (mask & VSA_ACECNT) { 1824 vsecp->vsa_aclcnt = count; 1825 } 1826 1827 if (mask & VSA_ACE) { 1828 size_t aclsz; 1829 1830 aclsz = count * sizeof (ace_t) + 1831 sizeof (ace_object_t) * largeace; 1832 1833 vsecp->vsa_aclentp = kmem_alloc(aclsz, KM_SLEEP); 1834 vsecp->vsa_aclentsz = aclsz; 1835 1836 if (aclp->z_version == ZFS_ACL_VERSION_FUID) 1837 zfs_copy_fuid_2_ace(zp->z_zfsvfs, aclp, cr, 1838 vsecp->vsa_aclentp, !(mask & VSA_ACE_ALLTYPES)); 1839 else { 1840 zfs_acl_node_t *aclnode; 1841 void *start = vsecp->vsa_aclentp; 1842 1843 for (aclnode = list_head(&aclp->z_acl); aclnode; 1844 aclnode = list_next(&aclp->z_acl, aclnode)) { 1845 bcopy(aclnode->z_acldata, start, 1846 aclnode->z_size); 1847 start = (caddr_t)start + aclnode->z_size; 1848 } 1849 ASSERT((caddr_t)start - (caddr_t)vsecp->vsa_aclentp == 1850 aclp->z_acl_bytes); 1851 } 1852 } 1853 if (mask & VSA_ACE_ACLFLAGS) { 1854 vsecp->vsa_aclflags = 0; 1855 if (zp->z_pflags & ZFS_ACL_DEFAULTED) 1856 vsecp->vsa_aclflags |= ACL_DEFAULTED; 1857 if (zp->z_pflags & ZFS_ACL_PROTECTED) 1858 vsecp->vsa_aclflags |= ACL_PROTECTED; 1859 if (zp->z_pflags & ZFS_ACL_AUTO_INHERIT) 1860 vsecp->vsa_aclflags |= ACL_AUTO_INHERIT; 1861 } 1862 1863 mutex_exit(&zp->z_acl_lock); 1864 1865 return (0); 1866 } 1867 1868 int 1869 zfs_vsec_2_aclp(zfsvfs_t *zfsvfs, umode_t obj_type, 1870 vsecattr_t *vsecp, cred_t *cr, zfs_fuid_info_t **fuidp, zfs_acl_t **zaclp) 1871 { 1872 zfs_acl_t *aclp; 1873 zfs_acl_node_t *aclnode; 1874 int aclcnt = vsecp->vsa_aclcnt; 1875 int error; 1876 1877 if (vsecp->vsa_aclcnt > MAX_ACL_ENTRIES || vsecp->vsa_aclcnt <= 0) 1878 return (SET_ERROR(EINVAL)); 1879 1880 aclp = zfs_acl_alloc(zfs_acl_version(zfsvfs->z_version)); 1881 1882 aclp->z_hints = 0; 1883 aclnode = zfs_acl_node_alloc(aclcnt * sizeof (zfs_object_ace_t)); 1884 if (aclp->z_version == ZFS_ACL_VERSION_INITIAL) { 1885 if ((error = zfs_copy_ace_2_oldace(obj_type, aclp, 1886 (ace_t *)vsecp->vsa_aclentp, aclnode->z_acldata, 1887 aclcnt, &aclnode->z_size)) != 0) { 1888 zfs_acl_free(aclp); 1889 zfs_acl_node_free(aclnode); 1890 return (error); 1891 } 1892 } else { 1893 if ((error = zfs_copy_ace_2_fuid(zfsvfs, obj_type, aclp, 1894 vsecp->vsa_aclentp, aclnode->z_acldata, aclcnt, 1895 &aclnode->z_size, fuidp, cr)) != 0) { 1896 zfs_acl_free(aclp); 1897 zfs_acl_node_free(aclnode); 1898 return (error); 1899 } 1900 } 1901 aclp->z_acl_bytes = aclnode->z_size; 1902 aclnode->z_ace_count = aclcnt; 1903 aclp->z_acl_count = aclcnt; 1904 list_insert_head(&aclp->z_acl, aclnode); 1905 1906 /* 1907 * If flags are being set then add them to z_hints 1908 */ 1909 if (vsecp->vsa_mask & VSA_ACE_ACLFLAGS) { 1910 if (vsecp->vsa_aclflags & ACL_PROTECTED) 1911 aclp->z_hints |= ZFS_ACL_PROTECTED; 1912 if (vsecp->vsa_aclflags & ACL_DEFAULTED) 1913 aclp->z_hints |= ZFS_ACL_DEFAULTED; 1914 if (vsecp->vsa_aclflags & ACL_AUTO_INHERIT) 1915 aclp->z_hints |= ZFS_ACL_AUTO_INHERIT; 1916 } 1917 1918 *zaclp = aclp; 1919 1920 return (0); 1921 } 1922 1923 /* 1924 * Set a file's ACL 1925 */ 1926 int 1927 zfs_setacl(znode_t *zp, vsecattr_t *vsecp, boolean_t skipaclchk, cred_t *cr) 1928 { 1929 zfsvfs_t *zfsvfs = zp->z_zfsvfs; 1930 zilog_t *zilog = zfsvfs->z_log; 1931 ulong_t mask = vsecp->vsa_mask & (VSA_ACE | VSA_ACECNT); 1932 dmu_tx_t *tx; 1933 int error; 1934 zfs_acl_t *aclp; 1935 zfs_fuid_info_t *fuidp = NULL; 1936 boolean_t fuid_dirtied; 1937 uint64_t acl_obj; 1938 1939 if (zp->z_zfsvfs->z_replay == B_FALSE) 1940 ASSERT_VOP_ELOCKED(ZTOV(zp), __func__); 1941 if (mask == 0) 1942 return (SET_ERROR(ENOSYS)); 1943 1944 if (zp->z_pflags & ZFS_IMMUTABLE) 1945 return (SET_ERROR(EPERM)); 1946 1947 if ((error = zfs_zaccess(zp, ACE_WRITE_ACL, 0, skipaclchk, cr))) 1948 return (error); 1949 1950 error = zfs_vsec_2_aclp(zfsvfs, ZTOV(zp)->v_type, vsecp, cr, &fuidp, 1951 &aclp); 1952 if (error) 1953 return (error); 1954 1955 /* 1956 * If ACL wide flags aren't being set then preserve any 1957 * existing flags. 1958 */ 1959 if (!(vsecp->vsa_mask & VSA_ACE_ACLFLAGS)) { 1960 aclp->z_hints |= 1961 (zp->z_pflags & V4_ACL_WIDE_FLAGS); 1962 } 1963 top: 1964 mutex_enter(&zp->z_acl_lock); 1965 1966 tx = dmu_tx_create(zfsvfs->z_os); 1967 1968 dmu_tx_hold_sa(tx, zp->z_sa_hdl, B_TRUE); 1969 1970 fuid_dirtied = zfsvfs->z_fuid_dirty; 1971 if (fuid_dirtied) 1972 zfs_fuid_txhold(zfsvfs, tx); 1973 1974 /* 1975 * If old version and ACL won't fit in bonus and we aren't 1976 * upgrading then take out necessary DMU holds 1977 */ 1978 1979 if ((acl_obj = zfs_external_acl(zp)) != 0) { 1980 if (zfsvfs->z_version >= ZPL_VERSION_FUID && 1981 zfs_znode_acl_version(zp) <= ZFS_ACL_VERSION_INITIAL) { 1982 dmu_tx_hold_free(tx, acl_obj, 0, 1983 DMU_OBJECT_END); 1984 dmu_tx_hold_write(tx, DMU_NEW_OBJECT, 0, 1985 aclp->z_acl_bytes); 1986 } else { 1987 dmu_tx_hold_write(tx, acl_obj, 0, aclp->z_acl_bytes); 1988 } 1989 } else if (!zp->z_is_sa && aclp->z_acl_bytes > ZFS_ACE_SPACE) { 1990 dmu_tx_hold_write(tx, DMU_NEW_OBJECT, 0, aclp->z_acl_bytes); 1991 } 1992 1993 zfs_sa_upgrade_txholds(tx, zp); 1994 error = dmu_tx_assign(tx, TXG_NOWAIT); 1995 if (error) { 1996 mutex_exit(&zp->z_acl_lock); 1997 1998 if (error == ERESTART) { 1999 dmu_tx_wait(tx); 2000 dmu_tx_abort(tx); 2001 goto top; 2002 } 2003 dmu_tx_abort(tx); 2004 zfs_acl_free(aclp); 2005 return (error); 2006 } 2007 2008 error = zfs_aclset_common(zp, aclp, cr, tx); 2009 ASSERT(error == 0); 2010 ASSERT(zp->z_acl_cached == NULL); 2011 zp->z_acl_cached = aclp; 2012 2013 if (fuid_dirtied) 2014 zfs_fuid_sync(zfsvfs, tx); 2015 2016 zfs_log_acl(zilog, tx, zp, vsecp, fuidp); 2017 2018 if (fuidp) 2019 zfs_fuid_info_free(fuidp); 2020 dmu_tx_commit(tx); 2021 mutex_exit(&zp->z_acl_lock); 2022 2023 return (error); 2024 } 2025 2026 /* 2027 * Check accesses of interest (AoI) against attributes of the dataset 2028 * such as read-only. Returns zero if no AoI conflict with dataset 2029 * attributes, otherwise an appropriate errno is returned. 2030 */ 2031 static int 2032 zfs_zaccess_dataset_check(znode_t *zp, uint32_t v4_mode) 2033 { 2034 if ((v4_mode & WRITE_MASK) && 2035 (zp->z_zfsvfs->z_vfs->vfs_flag & VFS_RDONLY) && 2036 (!IS_DEVVP(ZTOV(zp)) || 2037 (IS_DEVVP(ZTOV(zp)) && (v4_mode & WRITE_MASK_ATTRS)))) { 2038 return (SET_ERROR(EROFS)); 2039 } 2040 2041 /* 2042 * Intentionally allow ZFS_READONLY through here. 2043 * See zfs_zaccess_common(). 2044 */ 2045 if ((v4_mode & WRITE_MASK_DATA) && 2046 (zp->z_pflags & ZFS_IMMUTABLE)) { 2047 return (SET_ERROR(EPERM)); 2048 } 2049 2050 /* 2051 * In FreeBSD we allow to modify directory's content is ZFS_NOUNLINK 2052 * (sunlnk) is set. We just don't allow directory removal, which is 2053 * handled in zfs_zaccess_delete(). 2054 */ 2055 if ((v4_mode & ACE_DELETE) && 2056 (zp->z_pflags & ZFS_NOUNLINK)) { 2057 return (EPERM); 2058 } 2059 2060 if (((v4_mode & (ACE_READ_DATA|ACE_EXECUTE)) && 2061 (zp->z_pflags & ZFS_AV_QUARANTINED))) { 2062 return (SET_ERROR(EACCES)); 2063 } 2064 2065 return (0); 2066 } 2067 2068 /* 2069 * The primary usage of this function is to loop through all of the 2070 * ACEs in the znode, determining what accesses of interest (AoI) to 2071 * the caller are allowed or denied. The AoI are expressed as bits in 2072 * the working_mode parameter. As each ACE is processed, bits covered 2073 * by that ACE are removed from the working_mode. This removal 2074 * facilitates two things. The first is that when the working mode is 2075 * empty (= 0), we know we've looked at all the AoI. The second is 2076 * that the ACE interpretation rules don't allow a later ACE to undo 2077 * something granted or denied by an earlier ACE. Removing the 2078 * discovered access or denial enforces this rule. At the end of 2079 * processing the ACEs, all AoI that were found to be denied are 2080 * placed into the working_mode, giving the caller a mask of denied 2081 * accesses. Returns: 2082 * 0 if all AoI granted 2083 * EACCESS if the denied mask is non-zero 2084 * other error if abnormal failure (e.g., IO error) 2085 * 2086 * A secondary usage of the function is to determine if any of the 2087 * AoI are granted. If an ACE grants any access in 2088 * the working_mode, we immediately short circuit out of the function. 2089 * This mode is chosen by setting anyaccess to B_TRUE. The 2090 * working_mode is not a denied access mask upon exit if the function 2091 * is used in this manner. 2092 */ 2093 static int 2094 zfs_zaccess_aces_check(znode_t *zp, uint32_t *working_mode, 2095 boolean_t anyaccess, cred_t *cr) 2096 { 2097 zfsvfs_t *zfsvfs = zp->z_zfsvfs; 2098 zfs_acl_t *aclp; 2099 int error; 2100 uid_t uid = crgetuid(cr); 2101 uint64_t who; 2102 uint16_t type, iflags; 2103 uint16_t entry_type; 2104 uint32_t access_mask; 2105 uint32_t deny_mask = 0; 2106 zfs_ace_hdr_t *acep = NULL; 2107 boolean_t checkit; 2108 uid_t gowner; 2109 uid_t fowner; 2110 2111 zfs_fuid_map_ids(zp, cr, &fowner, &gowner); 2112 2113 mutex_enter(&zp->z_acl_lock); 2114 2115 if (zp->z_zfsvfs->z_replay == B_FALSE) 2116 ASSERT_VOP_LOCKED(ZTOV(zp), __func__); 2117 error = zfs_acl_node_read(zp, B_TRUE, &aclp, B_FALSE); 2118 if (error != 0) { 2119 mutex_exit(&zp->z_acl_lock); 2120 return (error); 2121 } 2122 2123 ASSERT(zp->z_acl_cached); 2124 2125 while ((acep = zfs_acl_next_ace(aclp, acep, &who, &access_mask, 2126 &iflags, &type))) { 2127 uint32_t mask_matched; 2128 2129 if (!zfs_acl_valid_ace_type(type, iflags)) 2130 continue; 2131 2132 if (ZTOV(zp)->v_type == VDIR && (iflags & ACE_INHERIT_ONLY_ACE)) 2133 continue; 2134 2135 /* Skip ACE if it does not affect any AoI */ 2136 mask_matched = (access_mask & *working_mode); 2137 if (!mask_matched) 2138 continue; 2139 2140 entry_type = (iflags & ACE_TYPE_FLAGS); 2141 2142 checkit = B_FALSE; 2143 2144 switch (entry_type) { 2145 case ACE_OWNER: 2146 if (uid == fowner) 2147 checkit = B_TRUE; 2148 break; 2149 case OWNING_GROUP: 2150 who = gowner; 2151 /*FALLTHROUGH*/ 2152 case ACE_IDENTIFIER_GROUP: 2153 checkit = zfs_groupmember(zfsvfs, who, cr); 2154 break; 2155 case ACE_EVERYONE: 2156 checkit = B_TRUE; 2157 break; 2158 2159 /* USER Entry */ 2160 default: 2161 if (entry_type == 0) { 2162 uid_t newid; 2163 2164 newid = zfs_fuid_map_id(zfsvfs, who, cr, 2165 ZFS_ACE_USER); 2166 if (newid != UID_NOBODY && 2167 uid == newid) 2168 checkit = B_TRUE; 2169 break; 2170 } else { 2171 mutex_exit(&zp->z_acl_lock); 2172 return (SET_ERROR(EIO)); 2173 } 2174 } 2175 2176 if (checkit) { 2177 if (type == DENY) { 2178 DTRACE_PROBE3(zfs__ace__denies, 2179 znode_t *, zp, 2180 zfs_ace_hdr_t *, acep, 2181 uint32_t, mask_matched); 2182 deny_mask |= mask_matched; 2183 } else { 2184 DTRACE_PROBE3(zfs__ace__allows, 2185 znode_t *, zp, 2186 zfs_ace_hdr_t *, acep, 2187 uint32_t, mask_matched); 2188 if (anyaccess) { 2189 mutex_exit(&zp->z_acl_lock); 2190 return (0); 2191 } 2192 } 2193 *working_mode &= ~mask_matched; 2194 } 2195 2196 /* Are we done? */ 2197 if (*working_mode == 0) 2198 break; 2199 } 2200 2201 mutex_exit(&zp->z_acl_lock); 2202 2203 /* Put the found 'denies' back on the working mode */ 2204 if (deny_mask) { 2205 *working_mode |= deny_mask; 2206 return (SET_ERROR(EACCES)); 2207 } else if (*working_mode) { 2208 return (-1); 2209 } 2210 2211 return (0); 2212 } 2213 2214 /* 2215 * Return true if any access whatsoever granted, we don't actually 2216 * care what access is granted. 2217 */ 2218 boolean_t 2219 zfs_has_access(znode_t *zp, cred_t *cr) 2220 { 2221 uint32_t have = ACE_ALL_PERMS; 2222 2223 if (zfs_zaccess_aces_check(zp, &have, B_TRUE, cr) != 0) { 2224 uid_t owner; 2225 2226 owner = zfs_fuid_map_id(zp->z_zfsvfs, zp->z_uid, cr, ZFS_OWNER); 2227 return (secpolicy_vnode_any_access(cr, ZTOV(zp), owner) == 0); 2228 } 2229 return (B_TRUE); 2230 } 2231 2232 static int 2233 zfs_zaccess_common(znode_t *zp, uint32_t v4_mode, uint32_t *working_mode, 2234 boolean_t *check_privs, boolean_t skipaclchk, cred_t *cr) 2235 { 2236 zfsvfs_t *zfsvfs = zp->z_zfsvfs; 2237 int err; 2238 2239 *working_mode = v4_mode; 2240 *check_privs = B_TRUE; 2241 2242 /* 2243 * Short circuit empty requests 2244 */ 2245 if (v4_mode == 0 || zfsvfs->z_replay) { 2246 *working_mode = 0; 2247 return (0); 2248 } 2249 2250 if ((err = zfs_zaccess_dataset_check(zp, v4_mode)) != 0) { 2251 *check_privs = B_FALSE; 2252 return (err); 2253 } 2254 2255 /* 2256 * The caller requested that the ACL check be skipped. This 2257 * would only happen if the caller checked VOP_ACCESS() with a 2258 * 32 bit ACE mask and already had the appropriate permissions. 2259 */ 2260 if (skipaclchk) { 2261 *working_mode = 0; 2262 return (0); 2263 } 2264 2265 /* 2266 * Note: ZFS_READONLY represents the "DOS R/O" attribute. 2267 * When that flag is set, we should behave as if write access 2268 * were not granted by anything in the ACL. In particular: 2269 * We _must_ allow writes after opening the file r/w, then 2270 * setting the DOS R/O attribute, and writing some more. 2271 * (Similar to how you can write after fchmod(fd, 0444).) 2272 * 2273 * Therefore ZFS_READONLY is ignored in the dataset check 2274 * above, and checked here as if part of the ACL check. 2275 * Also note: DOS R/O is ignored for directories. 2276 */ 2277 if ((v4_mode & WRITE_MASK_DATA) && 2278 (ZTOV(zp)->v_type != VDIR) && 2279 (zp->z_pflags & ZFS_READONLY)) { 2280 return (SET_ERROR(EPERM)); 2281 } 2282 2283 return (zfs_zaccess_aces_check(zp, working_mode, B_FALSE, cr)); 2284 } 2285 2286 static int 2287 zfs_zaccess_append(znode_t *zp, uint32_t *working_mode, boolean_t *check_privs, 2288 cred_t *cr) 2289 { 2290 if (*working_mode != ACE_WRITE_DATA) 2291 return (SET_ERROR(EACCES)); 2292 2293 return (zfs_zaccess_common(zp, ACE_APPEND_DATA, working_mode, 2294 check_privs, B_FALSE, cr)); 2295 } 2296 2297 /* 2298 * Check if VEXEC is allowed. 2299 * 2300 * This routine is based on zfs_fastaccesschk_execute which has slowpath 2301 * calling zfs_zaccess. This would be incorrect on FreeBSD (see 2302 * zfs_freebsd_access for the difference). Thus this variant let's the 2303 * caller handle the slowpath (if necessary). 2304 * 2305 * On top of that we perform a lockless check for ZFS_NO_EXECS_DENIED. 2306 * 2307 * Safe access to znode_t is provided by the vnode lock. 2308 */ 2309 int 2310 zfs_fastaccesschk_execute(znode_t *zdp, cred_t *cr) 2311 { 2312 boolean_t is_attr; 2313 2314 if (zdp->z_pflags & ZFS_AV_QUARANTINED) 2315 return (1); 2316 2317 is_attr = ((zdp->z_pflags & ZFS_XATTR) && 2318 (ZTOV(zdp)->v_type == VDIR)); 2319 if (is_attr) 2320 return (1); 2321 2322 if (zdp->z_pflags & ZFS_NO_EXECS_DENIED) 2323 return (0); 2324 2325 return (1); 2326 } 2327 2328 2329 /* 2330 * Determine whether Access should be granted/denied. 2331 * 2332 * The least priv subsystem is always consulted as a basic privilege 2333 * can define any form of access. 2334 */ 2335 int 2336 zfs_zaccess(znode_t *zp, int mode, int flags, boolean_t skipaclchk, cred_t *cr) 2337 { 2338 uint32_t working_mode; 2339 int error; 2340 int is_attr; 2341 boolean_t check_privs; 2342 znode_t *xzp = NULL; 2343 znode_t *check_zp = zp; 2344 mode_t needed_bits; 2345 uid_t owner; 2346 2347 is_attr = ((zp->z_pflags & ZFS_XATTR) && (ZTOV(zp)->v_type == VDIR)); 2348 2349 #ifdef __FreeBSD_kernel__ 2350 /* 2351 * In FreeBSD, we don't care about permissions of individual ADS. 2352 * Note that not checking them is not just an optimization - without 2353 * this shortcut, EA operations may bogusly fail with EACCES. 2354 */ 2355 if (zp->z_pflags & ZFS_XATTR) 2356 return (0); 2357 #else 2358 /* 2359 * If attribute then validate against base file 2360 */ 2361 if (is_attr) { 2362 uint64_t parent; 2363 2364 if ((error = sa_lookup(zp->z_sa_hdl, 2365 SA_ZPL_PARENT(zp->z_zfsvfs), &parent, 2366 sizeof (parent))) != 0) 2367 return (error); 2368 2369 if ((error = zfs_zget(zp->z_zfsvfs, 2370 parent, &xzp)) != 0) { 2371 return (error); 2372 } 2373 2374 check_zp = xzp; 2375 2376 /* 2377 * fixup mode to map to xattr perms 2378 */ 2379 2380 if (mode & (ACE_WRITE_DATA|ACE_APPEND_DATA)) { 2381 mode &= ~(ACE_WRITE_DATA|ACE_APPEND_DATA); 2382 mode |= ACE_WRITE_NAMED_ATTRS; 2383 } 2384 2385 if (mode & (ACE_READ_DATA|ACE_EXECUTE)) { 2386 mode &= ~(ACE_READ_DATA|ACE_EXECUTE); 2387 mode |= ACE_READ_NAMED_ATTRS; 2388 } 2389 } 2390 #endif 2391 2392 owner = zfs_fuid_map_id(zp->z_zfsvfs, zp->z_uid, cr, ZFS_OWNER); 2393 /* 2394 * Map the bits required to the standard vnode flags VREAD|VWRITE|VEXEC 2395 * in needed_bits. Map the bits mapped by working_mode (currently 2396 * missing) in missing_bits. 2397 * Call secpolicy_vnode_access2() with (needed_bits & ~checkmode), 2398 * needed_bits. 2399 */ 2400 needed_bits = 0; 2401 2402 working_mode = mode; 2403 if ((working_mode & (ACE_READ_ACL|ACE_READ_ATTRIBUTES)) && 2404 owner == crgetuid(cr)) 2405 working_mode &= ~(ACE_READ_ACL|ACE_READ_ATTRIBUTES); 2406 2407 if (working_mode & (ACE_READ_DATA|ACE_READ_NAMED_ATTRS| 2408 ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_SYNCHRONIZE)) 2409 needed_bits |= VREAD; 2410 if (working_mode & (ACE_WRITE_DATA|ACE_WRITE_NAMED_ATTRS| 2411 ACE_APPEND_DATA|ACE_WRITE_ATTRIBUTES|ACE_SYNCHRONIZE)) 2412 needed_bits |= VWRITE; 2413 if (working_mode & ACE_EXECUTE) 2414 needed_bits |= VEXEC; 2415 2416 if ((error = zfs_zaccess_common(check_zp, mode, &working_mode, 2417 &check_privs, skipaclchk, cr)) == 0) { 2418 if (is_attr) 2419 VN_RELE(ZTOV(xzp)); 2420 return (secpolicy_vnode_access2(cr, ZTOV(zp), owner, 2421 needed_bits, needed_bits)); 2422 } 2423 2424 if (error && !check_privs) { 2425 if (is_attr) 2426 VN_RELE(ZTOV(xzp)); 2427 return (error); 2428 } 2429 2430 if (error && (flags & V_APPEND)) { 2431 error = zfs_zaccess_append(zp, &working_mode, &check_privs, cr); 2432 } 2433 2434 if (error && check_privs) { 2435 mode_t checkmode = 0; 2436 vnode_t *check_vp = ZTOV(check_zp); 2437 2438 /* 2439 * First check for implicit owner permission on 2440 * read_acl/read_attributes 2441 */ 2442 2443 error = 0; 2444 ASSERT(working_mode != 0); 2445 2446 if ((working_mode & (ACE_READ_ACL|ACE_READ_ATTRIBUTES) && 2447 owner == crgetuid(cr))) 2448 working_mode &= ~(ACE_READ_ACL|ACE_READ_ATTRIBUTES); 2449 2450 if (working_mode & (ACE_READ_DATA|ACE_READ_NAMED_ATTRS| 2451 ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_SYNCHRONIZE)) 2452 checkmode |= VREAD; 2453 if (working_mode & (ACE_WRITE_DATA|ACE_WRITE_NAMED_ATTRS| 2454 ACE_APPEND_DATA|ACE_WRITE_ATTRIBUTES|ACE_SYNCHRONIZE)) 2455 checkmode |= VWRITE; 2456 if (working_mode & ACE_EXECUTE) 2457 checkmode |= VEXEC; 2458 2459 error = secpolicy_vnode_access2(cr, check_vp, owner, 2460 needed_bits & ~checkmode, needed_bits); 2461 2462 if (error == 0 && (working_mode & ACE_WRITE_OWNER)) 2463 error = secpolicy_vnode_chown(check_vp, cr, owner); 2464 if (error == 0 && (working_mode & ACE_WRITE_ACL)) 2465 error = secpolicy_vnode_setdac(check_vp, cr, owner); 2466 2467 if (error == 0 && (working_mode & 2468 (ACE_DELETE|ACE_DELETE_CHILD))) 2469 error = secpolicy_vnode_remove(check_vp, cr); 2470 2471 if (error == 0 && (working_mode & ACE_SYNCHRONIZE)) { 2472 error = secpolicy_vnode_chown(check_vp, cr, owner); 2473 } 2474 if (error == 0) { 2475 /* 2476 * See if any bits other than those already checked 2477 * for are still present. If so then return EACCES 2478 */ 2479 if (working_mode & ~(ZFS_CHECKED_MASKS)) { 2480 error = SET_ERROR(EACCES); 2481 } 2482 } 2483 } else if (error == 0) { 2484 error = secpolicy_vnode_access2(cr, ZTOV(zp), owner, 2485 needed_bits, needed_bits); 2486 } 2487 2488 2489 if (is_attr) 2490 VN_RELE(ZTOV(xzp)); 2491 2492 return (error); 2493 } 2494 2495 /* 2496 * Translate traditional unix VREAD/VWRITE/VEXEC mode into 2497 * NFSv4-style ZFS ACL format and call zfs_zaccess() 2498 */ 2499 int 2500 zfs_zaccess_rwx(znode_t *zp, mode_t mode, int flags, cred_t *cr) 2501 { 2502 return (zfs_zaccess(zp, zfs_unix_to_v4(mode >> 6), flags, B_FALSE, cr)); 2503 } 2504 2505 /* 2506 * Access function for secpolicy_vnode_setattr 2507 */ 2508 int 2509 zfs_zaccess_unix(znode_t *zp, mode_t mode, cred_t *cr) 2510 { 2511 int v4_mode = zfs_unix_to_v4(mode >> 6); 2512 2513 return (zfs_zaccess(zp, v4_mode, 0, B_FALSE, cr)); 2514 } 2515 2516 static int 2517 zfs_delete_final_check(znode_t *zp, znode_t *dzp, 2518 mode_t available_perms, cred_t *cr) 2519 { 2520 int error; 2521 uid_t downer; 2522 2523 downer = zfs_fuid_map_id(dzp->z_zfsvfs, dzp->z_uid, cr, ZFS_OWNER); 2524 2525 error = secpolicy_vnode_access2(cr, ZTOV(dzp), 2526 downer, available_perms, VWRITE|VEXEC); 2527 2528 if (error == 0) 2529 error = zfs_sticky_remove_access(dzp, zp, cr); 2530 2531 return (error); 2532 } 2533 2534 /* 2535 * Determine whether Access should be granted/deny, without 2536 * consulting least priv subsystem. 2537 * 2538 * The following chart is the recommended NFSv4 enforcement for 2539 * ability to delete an object. 2540 * 2541 * ------------------------------------------------------- 2542 * | Parent Dir | Target Object Permissions | 2543 * | permissions | | 2544 * ------------------------------------------------------- 2545 * | | ACL Allows | ACL Denies| Delete | 2546 * | | Delete | Delete | unspecified| 2547 * ------------------------------------------------------- 2548 * | ACL Allows | Permit | Permit | Permit | 2549 * | DELETE_CHILD | | 2550 * ------------------------------------------------------- 2551 * | ACL Denies | Permit | Deny | Deny | 2552 * | DELETE_CHILD | | | | 2553 * ------------------------------------------------------- 2554 * | ACL specifies | | | | 2555 * | only allow | Permit | Permit | Permit | 2556 * | write and | | | | 2557 * | execute | | | | 2558 * ------------------------------------------------------- 2559 * | ACL denies | | | | 2560 * | write and | Permit | Deny | Deny | 2561 * | execute | | | | 2562 * ------------------------------------------------------- 2563 * ^ 2564 * | 2565 * No search privilege, can't even look up file? 2566 * 2567 */ 2568 int 2569 zfs_zaccess_delete(znode_t *dzp, znode_t *zp, cred_t *cr) 2570 { 2571 uint32_t dzp_working_mode = 0; 2572 uint32_t zp_working_mode = 0; 2573 int dzp_error, zp_error; 2574 mode_t available_perms; 2575 boolean_t dzpcheck_privs = B_TRUE; 2576 boolean_t zpcheck_privs = B_TRUE; 2577 2578 /* 2579 * We want specific DELETE permissions to 2580 * take precedence over WRITE/EXECUTE. We don't 2581 * want an ACL such as this to mess us up. 2582 * user:joe:write_data:deny,user:joe:delete:allow 2583 * 2584 * However, deny permissions may ultimately be overridden 2585 * by secpolicy_vnode_access(). 2586 * 2587 * We will ask for all of the necessary permissions and then 2588 * look at the working modes from the directory and target object 2589 * to determine what was found. 2590 */ 2591 2592 if (zp->z_pflags & (ZFS_IMMUTABLE | ZFS_NOUNLINK)) 2593 return (SET_ERROR(EPERM)); 2594 2595 /* 2596 * First row 2597 * If the directory permissions allow the delete, we are done. 2598 */ 2599 if ((dzp_error = zfs_zaccess_common(dzp, ACE_DELETE_CHILD, 2600 &dzp_working_mode, &dzpcheck_privs, B_FALSE, cr)) == 0) 2601 return (0); 2602 2603 /* 2604 * If target object has delete permission then we are done 2605 */ 2606 if ((zp_error = zfs_zaccess_common(zp, ACE_DELETE, &zp_working_mode, 2607 &zpcheck_privs, B_FALSE, cr)) == 0) 2608 return (0); 2609 2610 ASSERT(dzp_error && zp_error); 2611 2612 if (!dzpcheck_privs) 2613 return (dzp_error); 2614 if (!zpcheck_privs) 2615 return (zp_error); 2616 2617 /* 2618 * Second row 2619 * 2620 * If directory returns EACCES then delete_child was denied 2621 * due to deny delete_child. In this case send the request through 2622 * secpolicy_vnode_remove(). We don't use zfs_delete_final_check() 2623 * since that *could* allow the delete based on write/execute permission 2624 * and we want delete permissions to override write/execute. 2625 */ 2626 2627 if (dzp_error == EACCES) { 2628 /* XXXPJD: s/dzp/zp/ ? */ 2629 return (secpolicy_vnode_remove(ZTOV(dzp), cr)); 2630 } 2631 /* 2632 * Third Row 2633 * only need to see if we have write/execute on directory. 2634 */ 2635 2636 dzp_error = zfs_zaccess_common(dzp, ACE_EXECUTE|ACE_WRITE_DATA, 2637 &dzp_working_mode, &dzpcheck_privs, B_FALSE, cr); 2638 2639 if (dzp_error != 0 && !dzpcheck_privs) 2640 return (dzp_error); 2641 2642 /* 2643 * Fourth row 2644 */ 2645 2646 available_perms = (dzp_working_mode & ACE_WRITE_DATA) ? 0 : VWRITE; 2647 available_perms |= (dzp_working_mode & ACE_EXECUTE) ? 0 : VEXEC; 2648 2649 return (zfs_delete_final_check(zp, dzp, available_perms, cr)); 2650 2651 } 2652 2653 int 2654 zfs_zaccess_rename(znode_t *sdzp, znode_t *szp, znode_t *tdzp, 2655 znode_t *tzp, cred_t *cr) 2656 { 2657 int add_perm; 2658 int error; 2659 2660 if (szp->z_pflags & ZFS_AV_QUARANTINED) 2661 return (SET_ERROR(EACCES)); 2662 2663 add_perm = (ZTOV(szp)->v_type == VDIR) ? 2664 ACE_ADD_SUBDIRECTORY : ACE_ADD_FILE; 2665 2666 /* 2667 * Rename permissions are combination of delete permission + 2668 * add file/subdir permission. 2669 * 2670 * BSD operating systems also require write permission 2671 * on the directory being moved from one parent directory 2672 * to another. 2673 */ 2674 if (ZTOV(szp)->v_type == VDIR && ZTOV(sdzp) != ZTOV(tdzp)) { 2675 if ((error = zfs_zaccess(szp, ACE_WRITE_DATA, 0, B_FALSE, cr))) 2676 return (error); 2677 } 2678 2679 /* 2680 * first make sure we do the delete portion. 2681 * 2682 * If that succeeds then check for add_file/add_subdir permissions 2683 */ 2684 2685 if ((error = zfs_zaccess_delete(sdzp, szp, cr))) 2686 return (error); 2687 2688 /* 2689 * If we have a tzp, see if we can delete it? 2690 */ 2691 if (tzp && (error = zfs_zaccess_delete(tdzp, tzp, cr))) 2692 return (error); 2693 2694 /* 2695 * Now check for add permissions 2696 */ 2697 error = zfs_zaccess(tdzp, add_perm, 0, B_FALSE, cr); 2698 2699 return (error); 2700 } 2701