191f37dcbSRobert Watson /*- 248be932aSRobert Watson * Copyright (c) 1999-2001 Robert N. M. Watson 391f37dcbSRobert Watson * All rights reserved. 491f37dcbSRobert Watson * 56d878543SRobert Watson * This software was developed by Robert Watson for the TrustedBSD Project. 66d878543SRobert Watson * 791f37dcbSRobert Watson * Redistribution and use in source and binary forms, with or without 891f37dcbSRobert Watson * modification, are permitted provided that the following conditions 991f37dcbSRobert Watson * are met: 1091f37dcbSRobert Watson * 1. Redistributions of source code must retain the above copyright 1191f37dcbSRobert Watson * notice, this list of conditions and the following disclaimer. 1291f37dcbSRobert Watson * 2. Redistributions in binary form must reproduce the above copyright 1391f37dcbSRobert Watson * notice, this list of conditions and the following disclaimer in the 1491f37dcbSRobert Watson * documentation and/or other materials provided with the distribution. 1591f37dcbSRobert Watson * 1691f37dcbSRobert Watson * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 1791f37dcbSRobert Watson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 1891f37dcbSRobert Watson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 1991f37dcbSRobert Watson * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 2091f37dcbSRobert Watson * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 2191f37dcbSRobert Watson * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 2291f37dcbSRobert Watson * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 2391f37dcbSRobert Watson * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 2491f37dcbSRobert Watson * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 2591f37dcbSRobert Watson * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 2691f37dcbSRobert Watson * SUCH DAMAGE. 2791f37dcbSRobert Watson * 2891f37dcbSRobert Watson * $FreeBSD$ 2991f37dcbSRobert Watson */ 3091f37dcbSRobert Watson /* 315293465fSRobert Watson * Developed by the TrustedBSD Project. 325293465fSRobert Watson * Support for POSIX.1e access control lists. 3391f37dcbSRobert Watson */ 3491f37dcbSRobert Watson 35a76789e7SRobert Watson #include "opt_cap.h" 36a76789e7SRobert Watson 3791f37dcbSRobert Watson #include <sys/param.h> 3891f37dcbSRobert Watson #include <sys/systm.h> 3991f37dcbSRobert Watson #include <sys/sysproto.h> 4091f37dcbSRobert Watson #include <sys/kernel.h> 4191f37dcbSRobert Watson #include <sys/malloc.h> 4291f37dcbSRobert Watson #include <sys/vnode.h> 4391f37dcbSRobert Watson #include <sys/lock.h> 44f708f4d1SMatthew Dillon #include <sys/mutex.h> 4591f37dcbSRobert Watson #include <sys/namei.h> 4691f37dcbSRobert Watson #include <sys/file.h> 4791f37dcbSRobert Watson #include <sys/proc.h> 4891f37dcbSRobert Watson #include <sys/sysent.h> 4991f37dcbSRobert Watson #include <sys/errno.h> 5091f37dcbSRobert Watson #include <sys/stat.h> 5191f37dcbSRobert Watson #include <sys/acl.h> 5291f37dcbSRobert Watson 535293465fSRobert Watson MALLOC_DEFINE(M_ACL, "acl", "access control list"); 5491f37dcbSRobert Watson 55b40ce416SJulian Elischer static int vacl_set_acl(struct thread *td, struct vnode *vp, acl_type_t type, 5691f37dcbSRobert Watson struct acl *aclp); 57b40ce416SJulian Elischer static int vacl_get_acl(struct thread *td, struct vnode *vp, acl_type_t type, 5891f37dcbSRobert Watson struct acl *aclp); 59b40ce416SJulian Elischer static int vacl_aclcheck(struct thread *td, struct vnode *vp, 60b114e127SRobert Watson acl_type_t type, struct acl *aclp); 6191f37dcbSRobert Watson 6291f37dcbSRobert Watson /* 635293465fSRobert Watson * Implement a version of vaccess() that understands POSIX.1e ACL semantics. 645293465fSRobert Watson * Return 0 on success, else an errno value. Should be merged into 655293465fSRobert Watson * vaccess() eventually. 665293465fSRobert Watson */ 675293465fSRobert Watson int 68b114e127SRobert Watson vaccess_acl_posix1e(enum vtype type, uid_t file_uid, gid_t file_gid, 69b114e127SRobert Watson struct acl *acl, mode_t acc_mode, struct ucred *cred, int *privused) 705293465fSRobert Watson { 715293465fSRobert Watson struct acl_entry *acl_other, *acl_mask; 725293465fSRobert Watson mode_t dac_granted; 735293465fSRobert Watson mode_t cap_granted; 745293465fSRobert Watson mode_t acl_mask_granted; 755293465fSRobert Watson int group_matched, i; 765293465fSRobert Watson 775293465fSRobert Watson /* 785293465fSRobert Watson * Look for a normal, non-privileged way to access the file/directory 795293465fSRobert Watson * as requested. If it exists, go with that. Otherwise, attempt 805293465fSRobert Watson * to use privileges granted via cap_granted. In some cases, 815293465fSRobert Watson * which privileges to use may be ambiguous due to "best match", 825293465fSRobert Watson * in which case fall back on first match for the time being. 835293465fSRobert Watson */ 845293465fSRobert Watson if (privused != NULL) 855293465fSRobert Watson *privused = 0; 865293465fSRobert Watson 875293465fSRobert Watson /* 885293465fSRobert Watson * Determine privileges now, but don't apply until we've found 89670f6b2fSRobert Watson * a DAC entry that matches but has failed to allow access. 905293465fSRobert Watson */ 915293465fSRobert Watson #ifndef CAPABILITIES 925293465fSRobert Watson if (suser_xxx(cred, NULL, PRISON_ROOT) == 0) 935293465fSRobert Watson cap_granted = (VEXEC | VREAD | VWRITE | VADMIN); 945293465fSRobert Watson else 955293465fSRobert Watson cap_granted = 0; 965293465fSRobert Watson #else 975293465fSRobert Watson cap_granted = 0; 985293465fSRobert Watson 995293465fSRobert Watson if (type == VDIR) { 1005293465fSRobert Watson if ((acc_mode & VEXEC) && !cap_check(cred, NULL, 1015293465fSRobert Watson CAP_DAC_READ_SEARCH, PRISON_ROOT)) 1025293465fSRobert Watson cap_granted |= VEXEC; 1035293465fSRobert Watson } else { 1045293465fSRobert Watson if ((acc_mode & VEXEC) && !cap_check(cred, NULL, 1055293465fSRobert Watson CAP_DAC_EXECUTE, PRISON_ROOT)) 1065293465fSRobert Watson cap_granted |= VEXEC; 1075293465fSRobert Watson } 1085293465fSRobert Watson 1095293465fSRobert Watson if ((acc_mode & VREAD) && !cap_check(cred, NULL, CAP_DAC_READ_SEARCH, 1105293465fSRobert Watson PRISON_ROOT)) 1115293465fSRobert Watson cap_granted |= VREAD; 1125293465fSRobert Watson 1135293465fSRobert Watson if ((acc_mode & VWRITE) && !cap_check(cred, NULL, CAP_DAC_WRITE, 1145293465fSRobert Watson PRISON_ROOT)) 1155293465fSRobert Watson cap_granted |= VWRITE; 1165293465fSRobert Watson 1175293465fSRobert Watson if ((acc_mode & VADMIN) && !cap_check(cred, NULL, CAP_FOWNER, 1185293465fSRobert Watson PRISON_ROOT)) 1195293465fSRobert Watson cap_granted |= VADMIN; 1205293465fSRobert Watson #endif /* CAPABILITIES */ 1215293465fSRobert Watson 1225293465fSRobert Watson /* 123670f6b2fSRobert Watson * The owner matches if the effective uid associated with the 124670f6b2fSRobert Watson * credential matches that of the ACL_USER_OBJ entry. While we're 125670f6b2fSRobert Watson * doing the first scan, also cache the location of the ACL_MASK 126670f6b2fSRobert Watson * and ACL_OTHER entries, preventing some future iterations. 1275293465fSRobert Watson */ 1285293465fSRobert Watson acl_mask = acl_other = NULL; 1295293465fSRobert Watson for (i = 0; i < acl->acl_cnt; i++) { 1305293465fSRobert Watson switch (acl->acl_entry[i].ae_tag) { 1315293465fSRobert Watson case ACL_USER_OBJ: 132b114e127SRobert Watson if (file_uid != cred->cr_uid) 1335293465fSRobert Watson break; 1345293465fSRobert Watson dac_granted = 0; 1355293465fSRobert Watson dac_granted |= VADMIN; 136fb1af1f2SChris D. Faulhaber if (acl->acl_entry[i].ae_perm & ACL_EXECUTE) 1375293465fSRobert Watson dac_granted |= VEXEC; 138fb1af1f2SChris D. Faulhaber if (acl->acl_entry[i].ae_perm & ACL_READ) 1395293465fSRobert Watson dac_granted |= VREAD; 140fb1af1f2SChris D. Faulhaber if (acl->acl_entry[i].ae_perm & ACL_WRITE) 1415293465fSRobert Watson dac_granted |= VWRITE; 1425293465fSRobert Watson if ((acc_mode & dac_granted) == acc_mode) 1435293465fSRobert Watson return (0); 1445293465fSRobert Watson if ((acc_mode & (dac_granted | cap_granted)) == 1455293465fSRobert Watson acc_mode) { 1465293465fSRobert Watson if (privused != NULL) 1475293465fSRobert Watson *privused = 1; 1485293465fSRobert Watson return (0); 1495293465fSRobert Watson } 1505293465fSRobert Watson goto error; 1515293465fSRobert Watson 1525293465fSRobert Watson case ACL_MASK: 1535293465fSRobert Watson acl_mask = &acl->acl_entry[i]; 1545293465fSRobert Watson break; 1555293465fSRobert Watson 1565293465fSRobert Watson case ACL_OTHER: 1575293465fSRobert Watson acl_other = &acl->acl_entry[i]; 1585293465fSRobert Watson break; 1595293465fSRobert Watson 1605293465fSRobert Watson default: 1615293465fSRobert Watson } 1625293465fSRobert Watson } 1635293465fSRobert Watson 1645293465fSRobert Watson /* 165670f6b2fSRobert Watson * An ACL_OTHER entry should always exist in a valid access 166670f6b2fSRobert Watson * ACL. If it doesn't, then generate a serious failure. For now, 167670f6b2fSRobert Watson * this means a debugging message and EPERM, but in the future 168670f6b2fSRobert Watson * should probably be a panic. 169670f6b2fSRobert Watson */ 170670f6b2fSRobert Watson if (acl_other == NULL) { 171670f6b2fSRobert Watson /* 172670f6b2fSRobert Watson * XXX This should never happen 173670f6b2fSRobert Watson */ 174670f6b2fSRobert Watson printf("vaccess_acl_posix1e: ACL_OTHER missing\n"); 175670f6b2fSRobert Watson return (EPERM); 176670f6b2fSRobert Watson } 177670f6b2fSRobert Watson 178670f6b2fSRobert Watson /* 1795293465fSRobert Watson * Checks against ACL_USER, ACL_GROUP_OBJ, and ACL_GROUP fields 1805293465fSRobert Watson * are masked by an ACL_MASK entry, if any. As such, first identify 1815293465fSRobert Watson * the ACL_MASK field, then iterate through identifying potential 1825293465fSRobert Watson * user matches, then group matches. If there is no ACL_MASK, 1835293465fSRobert Watson * assume that the mask allows all requests to succeed. 1845293465fSRobert Watson */ 1855293465fSRobert Watson if (acl_mask != NULL) { 1865293465fSRobert Watson acl_mask_granted = 0; 187fb1af1f2SChris D. Faulhaber if (acl_mask->ae_perm & ACL_EXECUTE) 1885293465fSRobert Watson acl_mask_granted |= VEXEC; 189fb1af1f2SChris D. Faulhaber if (acl_mask->ae_perm & ACL_READ) 1905293465fSRobert Watson acl_mask_granted |= VREAD; 191fb1af1f2SChris D. Faulhaber if (acl_mask->ae_perm & ACL_WRITE) 1925293465fSRobert Watson acl_mask_granted |= VWRITE; 1935293465fSRobert Watson } else 1945293465fSRobert Watson acl_mask_granted = VEXEC | VREAD | VWRITE; 1955293465fSRobert Watson 1965293465fSRobert Watson /* 197670f6b2fSRobert Watson * Iterate through user ACL entries. Do checks twice, first 198670f6b2fSRobert Watson * without privilege, and then if a match is found but failed, 199670f6b2fSRobert Watson * a second time with privilege. 2005293465fSRobert Watson */ 2015293465fSRobert Watson 2025293465fSRobert Watson /* 2035293465fSRobert Watson * Check ACL_USER ACL entries. 2045293465fSRobert Watson */ 2055293465fSRobert Watson for (i = 0; i < acl->acl_cnt; i++) { 2065293465fSRobert Watson switch (acl->acl_entry[i].ae_tag) { 2075293465fSRobert Watson case ACL_USER: 2085293465fSRobert Watson if (acl->acl_entry[i].ae_id != cred->cr_uid) 2095293465fSRobert Watson break; 2105293465fSRobert Watson dac_granted = 0; 211fb1af1f2SChris D. Faulhaber if (acl->acl_entry[i].ae_perm & ACL_EXECUTE) 2125293465fSRobert Watson dac_granted |= VEXEC; 213fb1af1f2SChris D. Faulhaber if (acl->acl_entry[i].ae_perm & ACL_READ) 2145293465fSRobert Watson dac_granted |= VREAD; 215fb1af1f2SChris D. Faulhaber if (acl->acl_entry[i].ae_perm & ACL_WRITE) 2165293465fSRobert Watson dac_granted |= VWRITE; 2175293465fSRobert Watson dac_granted &= acl_mask_granted; 2185293465fSRobert Watson if ((acc_mode & dac_granted) == acc_mode) 2195293465fSRobert Watson return (0); 220b114e127SRobert Watson if ((acc_mode & (dac_granted | cap_granted)) != 221b114e127SRobert Watson acc_mode) 222b114e127SRobert Watson goto error; 223b114e127SRobert Watson 2245293465fSRobert Watson if (privused != NULL) 2255293465fSRobert Watson *privused = 1; 2265293465fSRobert Watson return (0); 2275293465fSRobert Watson } 2285293465fSRobert Watson } 2295293465fSRobert Watson 2305293465fSRobert Watson /* 2315293465fSRobert Watson * Group match is best-match, not first-match, so find a 2325293465fSRobert Watson * "best" match. Iterate across, testing each potential group 2335293465fSRobert Watson * match. Make sure we keep track of whether we found a match 234670f6b2fSRobert Watson * or not, so that we know if we should try again with any 235670f6b2fSRobert Watson * available privilege, or if we should move on to ACL_OTHER. 2365293465fSRobert Watson */ 2375293465fSRobert Watson group_matched = 0; 2385293465fSRobert Watson for (i = 0; i < acl->acl_cnt; i++) { 2395293465fSRobert Watson switch (acl->acl_entry[i].ae_tag) { 2405293465fSRobert Watson case ACL_GROUP_OBJ: 241e15480f8SThomas Moestl if (!groupmember(file_gid, cred)) 242b114e127SRobert Watson break; 2435293465fSRobert Watson dac_granted = 0; 244fb1af1f2SChris D. Faulhaber if (acl->acl_entry[i].ae_perm & ACL_EXECUTE) 2455293465fSRobert Watson dac_granted |= VEXEC; 246fb1af1f2SChris D. Faulhaber if (acl->acl_entry[i].ae_perm & ACL_READ) 2475293465fSRobert Watson dac_granted |= VREAD; 248fb1af1f2SChris D. Faulhaber if (acl->acl_entry[i].ae_perm & ACL_WRITE) 2495293465fSRobert Watson dac_granted |= VWRITE; 2505293465fSRobert Watson dac_granted &= acl_mask_granted; 2515293465fSRobert Watson 2525293465fSRobert Watson if ((acc_mode & dac_granted) == acc_mode) 2535293465fSRobert Watson return (0); 2545293465fSRobert Watson 2555293465fSRobert Watson group_matched = 1; 256b114e127SRobert Watson break; 257b114e127SRobert Watson 258b114e127SRobert Watson case ACL_GROUP: 259b114e127SRobert Watson if (!groupmember(acl->acl_entry[i].ae_id, cred)) 260b114e127SRobert Watson break; 261b114e127SRobert Watson dac_granted = 0; 262b114e127SRobert Watson if (acl->acl_entry[i].ae_perm & ACL_EXECUTE) 263b114e127SRobert Watson dac_granted |= VEXEC; 264b114e127SRobert Watson if (acl->acl_entry[i].ae_perm & ACL_READ) 265b114e127SRobert Watson dac_granted |= VREAD; 266b114e127SRobert Watson if (acl->acl_entry[i].ae_perm & ACL_WRITE) 267b114e127SRobert Watson dac_granted |= VWRITE; 268b114e127SRobert Watson dac_granted &= acl_mask_granted; 269b114e127SRobert Watson 270b114e127SRobert Watson if ((acc_mode & dac_granted) == acc_mode) 271b114e127SRobert Watson return (0); 272b114e127SRobert Watson 273b114e127SRobert Watson group_matched = 1; 274b114e127SRobert Watson break; 275b114e127SRobert Watson 2765293465fSRobert Watson default: 2775293465fSRobert Watson } 2785293465fSRobert Watson } 2795293465fSRobert Watson 2805293465fSRobert Watson if (group_matched == 1) { 2815293465fSRobert Watson /* 2825293465fSRobert Watson * There was a match, but it did not grant rights via 2835293465fSRobert Watson * pure DAC. Try again, this time with privilege. 2845293465fSRobert Watson */ 2855293465fSRobert Watson for (i = 0; i < acl->acl_cnt; i++) { 2865293465fSRobert Watson switch (acl->acl_entry[i].ae_tag) { 2875293465fSRobert Watson case ACL_GROUP_OBJ: 28846157a65SRobert Watson if (!groupmember(file_gid, cred)) 289b114e127SRobert Watson break; 2905293465fSRobert Watson dac_granted = 0; 291b114e127SRobert Watson if (acl->acl_entry[i].ae_perm & ACL_EXECUTE) 2925293465fSRobert Watson dac_granted |= VEXEC; 293b114e127SRobert Watson if (acl->acl_entry[i].ae_perm & ACL_READ) 2945293465fSRobert Watson dac_granted |= VREAD; 295b114e127SRobert Watson if (acl->acl_entry[i].ae_perm & ACL_WRITE) 2965293465fSRobert Watson dac_granted |= VWRITE; 2975293465fSRobert Watson dac_granted &= acl_mask_granted; 298b114e127SRobert Watson 299b114e127SRobert Watson if ((acc_mode & (dac_granted | cap_granted)) != 300b114e127SRobert Watson acc_mode) 301b114e127SRobert Watson break; 302b114e127SRobert Watson 3035293465fSRobert Watson if (privused != NULL) 3045293465fSRobert Watson *privused = 1; 3055293465fSRobert Watson return (0); 306b114e127SRobert Watson 307b114e127SRobert Watson case ACL_GROUP: 308b114e127SRobert Watson if (!groupmember(acl->acl_entry[i].ae_id, 309b114e127SRobert Watson cred)) 310b114e127SRobert Watson break; 311b114e127SRobert Watson dac_granted = 0; 312b114e127SRobert Watson if (acl->acl_entry[i].ae_perm & ACL_EXECUTE) 313b114e127SRobert Watson dac_granted |= VEXEC; 314b114e127SRobert Watson if (acl->acl_entry[i].ae_perm & ACL_READ) 315b114e127SRobert Watson dac_granted |= VREAD; 316b114e127SRobert Watson if (acl->acl_entry[i].ae_perm & ACL_WRITE) 317b114e127SRobert Watson dac_granted |= VWRITE; 318b114e127SRobert Watson dac_granted &= acl_mask_granted; 319b114e127SRobert Watson 320b114e127SRobert Watson if ((acc_mode & (dac_granted | cap_granted)) != 321b114e127SRobert Watson acc_mode) 322b114e127SRobert Watson break; 323b114e127SRobert Watson 324b114e127SRobert Watson if (privused != NULL) 325b114e127SRobert Watson *privused = 1; 326b114e127SRobert Watson return (0); 327b114e127SRobert Watson 3285293465fSRobert Watson default: 3295293465fSRobert Watson } 3305293465fSRobert Watson } 3315293465fSRobert Watson /* 3325293465fSRobert Watson * Even with privilege, group membership was not sufficient. 3335293465fSRobert Watson * Return failure. 3345293465fSRobert Watson */ 3355293465fSRobert Watson goto error; 3365293465fSRobert Watson } 3375293465fSRobert Watson 3385293465fSRobert Watson /* 3395293465fSRobert Watson * Fall back on ACL_OTHER. ACL_MASK is not applied to ACL_OTHER. 3405293465fSRobert Watson */ 3415293465fSRobert Watson dac_granted = 0; 342fb1af1f2SChris D. Faulhaber if (acl_other->ae_perm & ACL_EXECUTE) 3435293465fSRobert Watson dac_granted |= VEXEC; 344fb1af1f2SChris D. Faulhaber if (acl_other->ae_perm & ACL_READ) 3455293465fSRobert Watson dac_granted |= VREAD; 346fb1af1f2SChris D. Faulhaber if (acl_other->ae_perm & ACL_WRITE) 3475293465fSRobert Watson dac_granted |= VWRITE; 3485293465fSRobert Watson 3495293465fSRobert Watson if ((acc_mode & dac_granted) == acc_mode) 3505293465fSRobert Watson return (0); 3515293465fSRobert Watson if ((acc_mode & (dac_granted | cap_granted)) == acc_mode) { 3525293465fSRobert Watson if (privused != NULL) 3535293465fSRobert Watson *privused = 1; 3545293465fSRobert Watson return (0); 3555293465fSRobert Watson } 3565293465fSRobert Watson 3575293465fSRobert Watson error: 3585293465fSRobert Watson return ((acc_mode & VADMIN) ? EPERM : EACCES); 3595293465fSRobert Watson } 3605293465fSRobert Watson 3615293465fSRobert Watson /* 3625293465fSRobert Watson * For the purposes of file systems maintaining the _OBJ entries in an 3635293465fSRobert Watson * inode with a mode_t field, this routine converts a mode_t entry 3645293465fSRobert Watson * to an acl_perm_t. 3655293465fSRobert Watson */ 3665293465fSRobert Watson acl_perm_t 3675293465fSRobert Watson acl_posix1e_mode_to_perm(acl_tag_t tag, mode_t mode) 3685293465fSRobert Watson { 3695293465fSRobert Watson acl_perm_t perm = 0; 3705293465fSRobert Watson 3715293465fSRobert Watson switch(tag) { 3725293465fSRobert Watson case ACL_USER_OBJ: 3735293465fSRobert Watson if (mode & S_IXUSR) 374fb1af1f2SChris D. Faulhaber perm |= ACL_EXECUTE; 3755293465fSRobert Watson if (mode & S_IRUSR) 376fb1af1f2SChris D. Faulhaber perm |= ACL_READ; 3775293465fSRobert Watson if (mode & S_IWUSR) 378fb1af1f2SChris D. Faulhaber perm |= ACL_WRITE; 3795293465fSRobert Watson return (perm); 3805293465fSRobert Watson 3815293465fSRobert Watson case ACL_GROUP_OBJ: 3825293465fSRobert Watson if (mode & S_IXGRP) 383fb1af1f2SChris D. Faulhaber perm |= ACL_EXECUTE; 3845293465fSRobert Watson if (mode & S_IRGRP) 385fb1af1f2SChris D. Faulhaber perm |= ACL_READ; 3865293465fSRobert Watson if (mode & S_IWGRP) 387fb1af1f2SChris D. Faulhaber perm |= ACL_WRITE; 3885293465fSRobert Watson return (perm); 3895293465fSRobert Watson 3905293465fSRobert Watson case ACL_OTHER: 3915293465fSRobert Watson if (mode & S_IXOTH) 392fb1af1f2SChris D. Faulhaber perm |= ACL_EXECUTE; 3935293465fSRobert Watson if (mode & S_IROTH) 394fb1af1f2SChris D. Faulhaber perm |= ACL_READ; 3955293465fSRobert Watson if (mode & S_IWOTH) 396fb1af1f2SChris D. Faulhaber perm |= ACL_WRITE; 3975293465fSRobert Watson return (perm); 3985293465fSRobert Watson 3995293465fSRobert Watson default: 4005293465fSRobert Watson printf("acl_posix1e_mode_to_perm: invalid tag (%d)\n", tag); 4015293465fSRobert Watson return (0); 4025293465fSRobert Watson } 4035293465fSRobert Watson } 4045293465fSRobert Watson 4055293465fSRobert Watson /* 4065293465fSRobert Watson * Given inode information (uid, gid, mode), return an acl entry of the 4075293465fSRobert Watson * appropriate type. 4085293465fSRobert Watson */ 4095293465fSRobert Watson struct acl_entry 4105293465fSRobert Watson acl_posix1e_mode_to_entry(acl_tag_t tag, uid_t uid, gid_t gid, mode_t mode) 4115293465fSRobert Watson { 4125293465fSRobert Watson struct acl_entry acl_entry; 4135293465fSRobert Watson 4145293465fSRobert Watson acl_entry.ae_tag = tag; 4155293465fSRobert Watson acl_entry.ae_perm = acl_posix1e_mode_to_perm(tag, mode); 4165293465fSRobert Watson switch(tag) { 4175293465fSRobert Watson case ACL_USER_OBJ: 4185293465fSRobert Watson acl_entry.ae_id = uid; 4195293465fSRobert Watson break; 4205293465fSRobert Watson 4215293465fSRobert Watson case ACL_GROUP_OBJ: 4225293465fSRobert Watson acl_entry.ae_id = gid; 4235293465fSRobert Watson break; 4245293465fSRobert Watson 4255293465fSRobert Watson case ACL_OTHER: 426dbb14f98SChris D. Faulhaber acl_entry.ae_id = ACL_UNDEFINED_ID; 4275293465fSRobert Watson break; 4285293465fSRobert Watson 4295293465fSRobert Watson default: 430dbb14f98SChris D. Faulhaber acl_entry.ae_id = ACL_UNDEFINED_ID; 4315293465fSRobert Watson printf("acl_posix1e_mode_to_entry: invalid tag (%d)\n", tag); 4325293465fSRobert Watson } 4335293465fSRobert Watson 4345293465fSRobert Watson return (acl_entry); 4355293465fSRobert Watson } 4365293465fSRobert Watson 4375293465fSRobert Watson /* 4385293465fSRobert Watson * Utility function to generate a file mode given appropriate ACL entries. 4395293465fSRobert Watson */ 4405293465fSRobert Watson mode_t 4415293465fSRobert Watson acl_posix1e_perms_to_mode(struct acl_entry *acl_user_obj_entry, 4425293465fSRobert Watson struct acl_entry *acl_group_obj_entry, struct acl_entry *acl_other_entry) 4435293465fSRobert Watson { 4445293465fSRobert Watson mode_t mode; 4455293465fSRobert Watson 4465293465fSRobert Watson mode = 0; 447fb1af1f2SChris D. Faulhaber if (acl_user_obj_entry->ae_perm & ACL_EXECUTE) 4485293465fSRobert Watson mode |= S_IXUSR; 449fb1af1f2SChris D. Faulhaber if (acl_user_obj_entry->ae_perm & ACL_READ) 4505293465fSRobert Watson mode |= S_IRUSR; 451fb1af1f2SChris D. Faulhaber if (acl_user_obj_entry->ae_perm & ACL_WRITE) 4525293465fSRobert Watson mode |= S_IWUSR; 453fb1af1f2SChris D. Faulhaber if (acl_group_obj_entry->ae_perm & ACL_EXECUTE) 4545293465fSRobert Watson mode |= S_IXGRP; 455fb1af1f2SChris D. Faulhaber if (acl_group_obj_entry->ae_perm & ACL_READ) 4565293465fSRobert Watson mode |= S_IRGRP; 457fb1af1f2SChris D. Faulhaber if (acl_group_obj_entry->ae_perm & ACL_WRITE) 4585293465fSRobert Watson mode |= S_IWGRP; 459fb1af1f2SChris D. Faulhaber if (acl_other_entry->ae_perm & ACL_EXECUTE) 4605293465fSRobert Watson mode |= S_IXOTH; 461fb1af1f2SChris D. Faulhaber if (acl_other_entry->ae_perm & ACL_READ) 4625293465fSRobert Watson mode |= S_IROTH; 463fb1af1f2SChris D. Faulhaber if (acl_other_entry->ae_perm & ACL_WRITE) 4645293465fSRobert Watson mode |= S_IWOTH; 4655293465fSRobert Watson 4665293465fSRobert Watson return (mode); 4675293465fSRobert Watson } 4685293465fSRobert Watson 4695293465fSRobert Watson /* 4705293465fSRobert Watson * Perform a syntactic check of the ACL, sufficient to allow an 4715293465fSRobert Watson * implementing file system to determine if it should accept this and 4725293465fSRobert Watson * rely on the POSIX.1e ACL properties. 4735293465fSRobert Watson */ 4745293465fSRobert Watson int 4755293465fSRobert Watson acl_posix1e_check(struct acl *acl) 4765293465fSRobert Watson { 4775293465fSRobert Watson int num_acl_user_obj, num_acl_user, num_acl_group_obj, num_acl_group; 4785293465fSRobert Watson int num_acl_mask, num_acl_other, i; 4795293465fSRobert Watson 4805293465fSRobert Watson /* 4815293465fSRobert Watson * Verify that the number of entries does not exceed the maximum 4825293465fSRobert Watson * defined for acl_t. 4835293465fSRobert Watson * Verify that the correct number of various sorts of ae_tags are 4845293465fSRobert Watson * present: 4855293465fSRobert Watson * Exactly one ACL_USER_OBJ 4865293465fSRobert Watson * Exactly one ACL_GROUP_OBJ 4875293465fSRobert Watson * Exactly one ACL_OTHER 4885293465fSRobert Watson * If any ACL_USER or ACL_GROUP entries appear, then exactly one 4895293465fSRobert Watson * ACL_MASK entry must also appear. 4905293465fSRobert Watson * Verify that all ae_perm entries are in ACL_PERM_BITS. 4915293465fSRobert Watson * Verify all ae_tag entries are understood by this implementation. 4925293465fSRobert Watson * Note: Does not check for uniqueness of qualifier (ae_id) field. 4935293465fSRobert Watson */ 4945293465fSRobert Watson num_acl_user_obj = num_acl_user = num_acl_group_obj = num_acl_group = 4955293465fSRobert Watson num_acl_mask = num_acl_other = 0; 4965293465fSRobert Watson if (acl->acl_cnt > ACL_MAX_ENTRIES || acl->acl_cnt < 0) 4975293465fSRobert Watson return (EINVAL); 4985293465fSRobert Watson for (i = 0; i < acl->acl_cnt; i++) { 4995293465fSRobert Watson /* 5005293465fSRobert Watson * Check for a valid tag. 5015293465fSRobert Watson */ 5025293465fSRobert Watson switch(acl->acl_entry[i].ae_tag) { 5035293465fSRobert Watson case ACL_USER_OBJ: 504b114e127SRobert Watson acl->acl_entry[i].ae_id = ACL_UNDEFINED_ID; /* XXX */ 505b114e127SRobert Watson if (acl->acl_entry[i].ae_id != ACL_UNDEFINED_ID) 506b114e127SRobert Watson return (EINVAL); 5075293465fSRobert Watson num_acl_user_obj++; 5085293465fSRobert Watson break; 5095293465fSRobert Watson case ACL_GROUP_OBJ: 510b114e127SRobert Watson acl->acl_entry[i].ae_id = ACL_UNDEFINED_ID; /* XXX */ 511b114e127SRobert Watson if (acl->acl_entry[i].ae_id != ACL_UNDEFINED_ID) 512b114e127SRobert Watson return (EINVAL); 5135293465fSRobert Watson num_acl_group_obj++; 5145293465fSRobert Watson break; 5155293465fSRobert Watson case ACL_USER: 516b114e127SRobert Watson if (acl->acl_entry[i].ae_id == ACL_UNDEFINED_ID) 517b114e127SRobert Watson return (EINVAL); 5185293465fSRobert Watson num_acl_user++; 5195293465fSRobert Watson break; 5205293465fSRobert Watson case ACL_GROUP: 521b114e127SRobert Watson if (acl->acl_entry[i].ae_id == ACL_UNDEFINED_ID) 522b114e127SRobert Watson return (EINVAL); 5235293465fSRobert Watson num_acl_group++; 5245293465fSRobert Watson break; 5255293465fSRobert Watson case ACL_OTHER: 526b114e127SRobert Watson acl->acl_entry[i].ae_id = ACL_UNDEFINED_ID; /* XXX */ 527b114e127SRobert Watson if (acl->acl_entry[i].ae_id != ACL_UNDEFINED_ID) 528b114e127SRobert Watson return (EINVAL); 5295293465fSRobert Watson num_acl_other++; 5305293465fSRobert Watson break; 5315293465fSRobert Watson case ACL_MASK: 532b114e127SRobert Watson acl->acl_entry[i].ae_id = ACL_UNDEFINED_ID; /* XXX */ 533b114e127SRobert Watson if (acl->acl_entry[i].ae_id != ACL_UNDEFINED_ID) 534b114e127SRobert Watson return (EINVAL); 5355293465fSRobert Watson num_acl_mask++; 5365293465fSRobert Watson break; 5375293465fSRobert Watson default: 5385293465fSRobert Watson return (EINVAL); 5395293465fSRobert Watson } 5405293465fSRobert Watson /* 5415293465fSRobert Watson * Check for valid perm entries. 5425293465fSRobert Watson */ 5435293465fSRobert Watson if ((acl->acl_entry[i].ae_perm | ACL_PERM_BITS) != 5445293465fSRobert Watson ACL_PERM_BITS) 5455293465fSRobert Watson return (EINVAL); 5465293465fSRobert Watson } 5475293465fSRobert Watson if ((num_acl_user_obj != 1) || (num_acl_group_obj != 1) || 5485293465fSRobert Watson (num_acl_other != 1) || (num_acl_mask != 0 && num_acl_mask != 1)) 5495293465fSRobert Watson return (EINVAL); 5505293465fSRobert Watson if (((num_acl_group != 0) || (num_acl_user != 0)) && 5515293465fSRobert Watson (num_acl_mask != 1)) 5525293465fSRobert Watson return (EINVAL); 5535293465fSRobert Watson return (0); 5545293465fSRobert Watson } 5555293465fSRobert Watson 5565293465fSRobert Watson /* 55791f37dcbSRobert Watson * These calls wrap the real vnode operations, and are called by the 55891f37dcbSRobert Watson * syscall code once the syscall has converted the path or file 55991f37dcbSRobert Watson * descriptor to a vnode (unlocked). The aclp pointer is assumed 56091f37dcbSRobert Watson * still to point to userland, so this should not be consumed within 56191f37dcbSRobert Watson * the kernel except by syscall code. Other code should directly 56291f37dcbSRobert Watson * invoke VOP_{SET,GET}ACL. 56391f37dcbSRobert Watson */ 56491f37dcbSRobert Watson 56591f37dcbSRobert Watson /* 56691f37dcbSRobert Watson * Given a vnode, set its ACL. 56791f37dcbSRobert Watson */ 56891f37dcbSRobert Watson static int 569b40ce416SJulian Elischer vacl_set_acl(struct thread *td, struct vnode *vp, acl_type_t type, 57091f37dcbSRobert Watson struct acl *aclp) 57191f37dcbSRobert Watson { 57291f37dcbSRobert Watson struct acl inkernacl; 57391f37dcbSRobert Watson int error; 57491f37dcbSRobert Watson 57591f37dcbSRobert Watson error = copyin(aclp, &inkernacl, sizeof(struct acl)); 57691f37dcbSRobert Watson if (error) 57791f37dcbSRobert Watson return(error); 578b40ce416SJulian Elischer VOP_LEASE(vp, td, td->td_proc->p_ucred, LEASE_WRITE); 579b40ce416SJulian Elischer vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); 580b40ce416SJulian Elischer error = VOP_SETACL(vp, type, &inkernacl, td->td_proc->p_ucred, td); 581b40ce416SJulian Elischer VOP_UNLOCK(vp, 0, td); 58291f37dcbSRobert Watson return(error); 58391f37dcbSRobert Watson } 58491f37dcbSRobert Watson 58591f37dcbSRobert Watson /* 58691f37dcbSRobert Watson * Given a vnode, get its ACL. 58791f37dcbSRobert Watson */ 58891f37dcbSRobert Watson static int 589b40ce416SJulian Elischer vacl_get_acl(struct thread *td, struct vnode *vp, acl_type_t type, 59091f37dcbSRobert Watson struct acl *aclp) 59191f37dcbSRobert Watson { 59291f37dcbSRobert Watson struct acl inkernelacl; 59391f37dcbSRobert Watson int error; 59491f37dcbSRobert Watson 595b40ce416SJulian Elischer VOP_LEASE(vp, td, td->td_proc->p_ucred, LEASE_WRITE); 596b40ce416SJulian Elischer vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); 597b40ce416SJulian Elischer error = VOP_GETACL(vp, type, &inkernelacl, td->td_proc->p_ucred, td); 598b40ce416SJulian Elischer VOP_UNLOCK(vp, 0, td); 59991f37dcbSRobert Watson if (error == 0) 60091f37dcbSRobert Watson error = copyout(&inkernelacl, aclp, sizeof(struct acl)); 60191f37dcbSRobert Watson return (error); 60291f37dcbSRobert Watson } 60391f37dcbSRobert Watson 60491f37dcbSRobert Watson /* 60591f37dcbSRobert Watson * Given a vnode, delete its ACL. 60691f37dcbSRobert Watson */ 60791f37dcbSRobert Watson static int 608b40ce416SJulian Elischer vacl_delete(struct thread *td, struct vnode *vp, acl_type_t type) 60991f37dcbSRobert Watson { 61091f37dcbSRobert Watson int error; 61191f37dcbSRobert Watson 612b40ce416SJulian Elischer VOP_LEASE(vp, td, td->td_proc->p_ucred, LEASE_WRITE); 613b40ce416SJulian Elischer vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, td); 614fdba6d3aSRobert Watson error = VOP_SETACL(vp, ACL_TYPE_DEFAULT, 0, td->td_proc->p_ucred, 615fdba6d3aSRobert Watson td); 616b40ce416SJulian Elischer VOP_UNLOCK(vp, 0, td); 61791f37dcbSRobert Watson return (error); 61891f37dcbSRobert Watson } 61991f37dcbSRobert Watson 62091f37dcbSRobert Watson /* 62191f37dcbSRobert Watson * Given a vnode, check whether an ACL is appropriate for it 62291f37dcbSRobert Watson */ 62391f37dcbSRobert Watson static int 624b40ce416SJulian Elischer vacl_aclcheck(struct thread *td, struct vnode *vp, acl_type_t type, 62591f37dcbSRobert Watson struct acl *aclp) 62691f37dcbSRobert Watson { 62791f37dcbSRobert Watson struct acl inkernelacl; 62891f37dcbSRobert Watson int error; 62991f37dcbSRobert Watson 63091f37dcbSRobert Watson error = copyin(aclp, &inkernelacl, sizeof(struct acl)); 63191f37dcbSRobert Watson if (error) 63291f37dcbSRobert Watson return(error); 633fdba6d3aSRobert Watson error = VOP_ACLCHECK(vp, type, &inkernelacl, td->td_proc->p_ucred, 634fdba6d3aSRobert Watson td); 63591f37dcbSRobert Watson return (error); 63691f37dcbSRobert Watson } 63791f37dcbSRobert Watson 63891f37dcbSRobert Watson /* 63991f37dcbSRobert Watson * syscalls -- convert the path/fd to a vnode, and call vacl_whatever. 64091f37dcbSRobert Watson * Don't need to lock, as the vacl_ code will get/release any locks 64191f37dcbSRobert Watson * required. 64291f37dcbSRobert Watson */ 64391f37dcbSRobert Watson 64491f37dcbSRobert Watson /* 64591f37dcbSRobert Watson * Given a file path, get an ACL for it 646f708f4d1SMatthew Dillon * 647f708f4d1SMatthew Dillon * MPSAFE 64891f37dcbSRobert Watson */ 64991f37dcbSRobert Watson int 650b40ce416SJulian Elischer __acl_get_file(struct thread *td, struct __acl_get_file_args *uap) 65191f37dcbSRobert Watson { 65291f37dcbSRobert Watson struct nameidata nd; 65391f37dcbSRobert Watson int error; 65491f37dcbSRobert Watson 655f708f4d1SMatthew Dillon mtx_lock(&Giant); 656b40ce416SJulian Elischer NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, SCARG(uap, path), td); 65791f37dcbSRobert Watson error = namei(&nd); 658f708f4d1SMatthew Dillon if (error == 0) { 659b40ce416SJulian Elischer error = vacl_get_acl(td, nd.ni_vp, SCARG(uap, type), 660f708f4d1SMatthew Dillon SCARG(uap, aclp)); 66191f37dcbSRobert Watson NDFREE(&nd, 0); 662f708f4d1SMatthew Dillon } 663f708f4d1SMatthew Dillon mtx_unlock(&Giant); 66491f37dcbSRobert Watson return (error); 66591f37dcbSRobert Watson } 66691f37dcbSRobert Watson 66791f37dcbSRobert Watson /* 66891f37dcbSRobert Watson * Given a file path, set an ACL for it 669f708f4d1SMatthew Dillon * 670f708f4d1SMatthew Dillon * MPSAFE 67191f37dcbSRobert Watson */ 67291f37dcbSRobert Watson int 673b40ce416SJulian Elischer __acl_set_file(struct thread *td, struct __acl_set_file_args *uap) 67491f37dcbSRobert Watson { 67591f37dcbSRobert Watson struct nameidata nd; 67691f37dcbSRobert Watson int error; 67791f37dcbSRobert Watson 678f708f4d1SMatthew Dillon mtx_lock(&Giant); 679b40ce416SJulian Elischer NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, SCARG(uap, path), td); 68091f37dcbSRobert Watson error = namei(&nd); 681f708f4d1SMatthew Dillon if (error == 0) { 682b40ce416SJulian Elischer error = vacl_set_acl(td, nd.ni_vp, SCARG(uap, type), 683f708f4d1SMatthew Dillon SCARG(uap, aclp)); 68491f37dcbSRobert Watson NDFREE(&nd, 0); 685f708f4d1SMatthew Dillon } 686f708f4d1SMatthew Dillon mtx_unlock(&Giant); 68791f37dcbSRobert Watson return (error); 68891f37dcbSRobert Watson } 68991f37dcbSRobert Watson 69091f37dcbSRobert Watson /* 69191f37dcbSRobert Watson * Given a file descriptor, get an ACL for it 692f708f4d1SMatthew Dillon * 693f708f4d1SMatthew Dillon * MPSAFE 69491f37dcbSRobert Watson */ 69591f37dcbSRobert Watson int 696b40ce416SJulian Elischer __acl_get_fd(struct thread *td, struct __acl_get_fd_args *uap) 69791f37dcbSRobert Watson { 69891f37dcbSRobert Watson struct file *fp; 69991f37dcbSRobert Watson int error; 70091f37dcbSRobert Watson 701f708f4d1SMatthew Dillon mtx_lock(&Giant); 702b40ce416SJulian Elischer error = getvnode(td->td_proc->p_fd, SCARG(uap, filedes), &fp); 703f708f4d1SMatthew Dillon if (error == 0) { 704b40ce416SJulian Elischer error = vacl_get_acl(td, (struct vnode *)fp->f_data, 705f708f4d1SMatthew Dillon SCARG(uap, type), SCARG(uap, aclp)); 706426da3bcSAlfred Perlstein fdrop(fp, td); 707f708f4d1SMatthew Dillon } 708f708f4d1SMatthew Dillon mtx_unlock(&Giant); 70991f37dcbSRobert Watson return (error); 71091f37dcbSRobert Watson } 71191f37dcbSRobert Watson 71291f37dcbSRobert Watson /* 71391f37dcbSRobert Watson * Given a file descriptor, set an ACL for it 714f708f4d1SMatthew Dillon * 715f708f4d1SMatthew Dillon * MPSAFE 71691f37dcbSRobert Watson */ 71791f37dcbSRobert Watson int 718b40ce416SJulian Elischer __acl_set_fd(struct thread *td, struct __acl_set_fd_args *uap) 71991f37dcbSRobert Watson { 72091f37dcbSRobert Watson struct file *fp; 72191f37dcbSRobert Watson int error; 72291f37dcbSRobert Watson 723f708f4d1SMatthew Dillon mtx_lock(&Giant); 724b40ce416SJulian Elischer error = getvnode(td->td_proc->p_fd, SCARG(uap, filedes), &fp); 725f708f4d1SMatthew Dillon if (error == 0) { 726b40ce416SJulian Elischer error = vacl_set_acl(td, (struct vnode *)fp->f_data, 727f708f4d1SMatthew Dillon SCARG(uap, type), SCARG(uap, aclp)); 728426da3bcSAlfred Perlstein fdrop(fp, td); 729f708f4d1SMatthew Dillon } 730f708f4d1SMatthew Dillon mtx_unlock(&Giant); 73191f37dcbSRobert Watson return (error); 73291f37dcbSRobert Watson } 73391f37dcbSRobert Watson 73491f37dcbSRobert Watson /* 73591f37dcbSRobert Watson * Given a file path, delete an ACL from it. 736f708f4d1SMatthew Dillon * 737f708f4d1SMatthew Dillon * MPSAFE 73891f37dcbSRobert Watson */ 73991f37dcbSRobert Watson int 740b40ce416SJulian Elischer __acl_delete_file(struct thread *td, struct __acl_delete_file_args *uap) 74191f37dcbSRobert Watson { 74291f37dcbSRobert Watson struct nameidata nd; 74391f37dcbSRobert Watson int error; 74491f37dcbSRobert Watson 745f708f4d1SMatthew Dillon mtx_lock(&Giant); 746b40ce416SJulian Elischer NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, SCARG(uap, path), td); 74791f37dcbSRobert Watson error = namei(&nd); 748f708f4d1SMatthew Dillon if (error == 0) { 749b40ce416SJulian Elischer error = vacl_delete(td, nd.ni_vp, SCARG(uap, type)); 75091f37dcbSRobert Watson NDFREE(&nd, 0); 751f708f4d1SMatthew Dillon } 752f708f4d1SMatthew Dillon mtx_unlock(&Giant); 75391f37dcbSRobert Watson return (error); 75491f37dcbSRobert Watson } 75591f37dcbSRobert Watson 75691f37dcbSRobert Watson /* 75791f37dcbSRobert Watson * Given a file path, delete an ACL from it. 758f708f4d1SMatthew Dillon * 759f708f4d1SMatthew Dillon * MPSAFE 76091f37dcbSRobert Watson */ 76191f37dcbSRobert Watson int 762b40ce416SJulian Elischer __acl_delete_fd(struct thread *td, struct __acl_delete_fd_args *uap) 76391f37dcbSRobert Watson { 76491f37dcbSRobert Watson struct file *fp; 76591f37dcbSRobert Watson int error; 76691f37dcbSRobert Watson 767f708f4d1SMatthew Dillon mtx_lock(&Giant); 768b40ce416SJulian Elischer error = getvnode(td->td_proc->p_fd, SCARG(uap, filedes), &fp); 769f708f4d1SMatthew Dillon if (error == 0) { 770b40ce416SJulian Elischer error = vacl_delete(td, (struct vnode *)fp->f_data, 771f708f4d1SMatthew Dillon SCARG(uap, type)); 772426da3bcSAlfred Perlstein fdrop(fp, td); 773f708f4d1SMatthew Dillon } 774f708f4d1SMatthew Dillon mtx_unlock(&Giant); 77591f37dcbSRobert Watson return (error); 77691f37dcbSRobert Watson } 77791f37dcbSRobert Watson 77891f37dcbSRobert Watson /* 77991f37dcbSRobert Watson * Given a file path, check an ACL for it 780f708f4d1SMatthew Dillon * 781f708f4d1SMatthew Dillon * MPSAFE 78291f37dcbSRobert Watson */ 78391f37dcbSRobert Watson int 784b40ce416SJulian Elischer __acl_aclcheck_file(struct thread *td, struct __acl_aclcheck_file_args *uap) 78591f37dcbSRobert Watson { 78691f37dcbSRobert Watson struct nameidata nd; 78791f37dcbSRobert Watson int error; 78891f37dcbSRobert Watson 789f708f4d1SMatthew Dillon mtx_lock(&Giant); 790b40ce416SJulian Elischer NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, SCARG(uap, path), td); 79191f37dcbSRobert Watson error = namei(&nd); 792f708f4d1SMatthew Dillon if (error == 0) { 793b40ce416SJulian Elischer error = vacl_aclcheck(td, nd.ni_vp, SCARG(uap, type), 794f708f4d1SMatthew Dillon SCARG(uap, aclp)); 79591f37dcbSRobert Watson NDFREE(&nd, 0); 796f708f4d1SMatthew Dillon } 797f708f4d1SMatthew Dillon mtx_unlock(&Giant); 79891f37dcbSRobert Watson return (error); 79991f37dcbSRobert Watson } 80091f37dcbSRobert Watson 80191f37dcbSRobert Watson /* 80291f37dcbSRobert Watson * Given a file descriptor, check an ACL for it 803f708f4d1SMatthew Dillon * 804f708f4d1SMatthew Dillon * MPSAFE 80591f37dcbSRobert Watson */ 80691f37dcbSRobert Watson int 807b40ce416SJulian Elischer __acl_aclcheck_fd(struct thread *td, struct __acl_aclcheck_fd_args *uap) 80891f37dcbSRobert Watson { 80991f37dcbSRobert Watson struct file *fp; 81091f37dcbSRobert Watson int error; 81191f37dcbSRobert Watson 812f708f4d1SMatthew Dillon mtx_lock(&Giant); 813b40ce416SJulian Elischer error = getvnode(td->td_proc->p_fd, SCARG(uap, filedes), &fp); 814f708f4d1SMatthew Dillon if (error == 0) { 815b40ce416SJulian Elischer error = vacl_aclcheck(td, (struct vnode *)fp->f_data, 816f708f4d1SMatthew Dillon SCARG(uap, type), SCARG(uap, aclp)); 817426da3bcSAlfred Perlstein fdrop(fp, td); 818f708f4d1SMatthew Dillon } 819f708f4d1SMatthew Dillon mtx_unlock(&Giant); 82091f37dcbSRobert Watson return (error); 82191f37dcbSRobert Watson } 822