191f37dcbSRobert Watson /*- 25293465fSRobert Watson * Copyright (c) 1999, 2000, 2001 Robert N. M. Watson 391f37dcbSRobert Watson * All rights reserved. 491f37dcbSRobert Watson * 591f37dcbSRobert Watson * Redistribution and use in source and binary forms, with or without 691f37dcbSRobert Watson * modification, are permitted provided that the following conditions 791f37dcbSRobert Watson * are met: 891f37dcbSRobert Watson * 1. Redistributions of source code must retain the above copyright 991f37dcbSRobert Watson * notice, this list of conditions and the following disclaimer. 1091f37dcbSRobert Watson * 2. Redistributions in binary form must reproduce the above copyright 1191f37dcbSRobert Watson * notice, this list of conditions and the following disclaimer in the 1291f37dcbSRobert Watson * documentation and/or other materials provided with the distribution. 1391f37dcbSRobert Watson * 1491f37dcbSRobert Watson * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND 1591f37dcbSRobert Watson * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 1691f37dcbSRobert Watson * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 1791f37dcbSRobert Watson * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 1891f37dcbSRobert Watson * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 1991f37dcbSRobert Watson * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 2091f37dcbSRobert Watson * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 2191f37dcbSRobert Watson * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 2291f37dcbSRobert Watson * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 2391f37dcbSRobert Watson * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 2491f37dcbSRobert Watson * SUCH DAMAGE. 2591f37dcbSRobert Watson * 2691f37dcbSRobert Watson * $FreeBSD$ 2791f37dcbSRobert Watson */ 2891f37dcbSRobert Watson /* 295293465fSRobert Watson * Developed by the TrustedBSD Project. 305293465fSRobert Watson * Support for POSIX.1e access control lists. 3191f37dcbSRobert Watson */ 3291f37dcbSRobert Watson 3391f37dcbSRobert Watson #include <sys/param.h> 3491f37dcbSRobert Watson #include <sys/systm.h> 3591f37dcbSRobert Watson #include <sys/sysproto.h> 3691f37dcbSRobert Watson #include <sys/kernel.h> 3791f37dcbSRobert Watson #include <sys/malloc.h> 3891f37dcbSRobert Watson #include <sys/vnode.h> 3991f37dcbSRobert Watson #include <sys/lock.h> 4091f37dcbSRobert Watson #include <sys/namei.h> 4191f37dcbSRobert Watson #include <sys/file.h> 4291f37dcbSRobert Watson #include <sys/proc.h> 4391f37dcbSRobert Watson #include <sys/sysent.h> 4491f37dcbSRobert Watson #include <sys/errno.h> 4591f37dcbSRobert Watson #include <sys/stat.h> 4691f37dcbSRobert Watson #include <sys/acl.h> 4791f37dcbSRobert Watson 485293465fSRobert Watson MALLOC_DEFINE(M_ACL, "acl", "access control list"); 4991f37dcbSRobert Watson 5091f37dcbSRobert Watson static int vacl_set_acl(struct proc *p, struct vnode *vp, acl_type_t type, 5191f37dcbSRobert Watson struct acl *aclp); 5291f37dcbSRobert Watson static int vacl_get_acl(struct proc *p, struct vnode *vp, acl_type_t type, 5391f37dcbSRobert Watson struct acl *aclp); 5491f37dcbSRobert Watson static int vacl_aclcheck(struct proc *p, struct vnode *vp, acl_type_t type, 5591f37dcbSRobert Watson struct acl *aclp); 5691f37dcbSRobert Watson 5791f37dcbSRobert Watson /* 585293465fSRobert Watson * Implement a version of vaccess() that understands POSIX.1e ACL semantics. 595293465fSRobert Watson * Return 0 on success, else an errno value. Should be merged into 605293465fSRobert Watson * vaccess() eventually. 615293465fSRobert Watson */ 625293465fSRobert Watson int 635293465fSRobert Watson vaccess_acl_posix1e(enum vtype type, struct acl *acl, mode_t acc_mode, 645293465fSRobert Watson struct ucred *cred, int *privused) 655293465fSRobert Watson { 665293465fSRobert Watson struct acl_entry *acl_other, *acl_mask; 675293465fSRobert Watson mode_t dac_granted; 685293465fSRobert Watson mode_t cap_granted; 695293465fSRobert Watson mode_t acl_mask_granted; 705293465fSRobert Watson int group_matched, i; 715293465fSRobert Watson 725293465fSRobert Watson /* 735293465fSRobert Watson * Look for a normal, non-privileged way to access the file/directory 745293465fSRobert Watson * as requested. If it exists, go with that. Otherwise, attempt 755293465fSRobert Watson * to use privileges granted via cap_granted. In some cases, 765293465fSRobert Watson * which privileges to use may be ambiguous due to "best match", 775293465fSRobert Watson * in which case fall back on first match for the time being. 785293465fSRobert Watson */ 795293465fSRobert Watson if (privused != NULL) 805293465fSRobert Watson *privused = 0; 815293465fSRobert Watson 825293465fSRobert Watson /* 835293465fSRobert Watson * Determine privileges now, but don't apply until we've found 845293465fSRobert Watson * a DAC match that has failed to allow access. 855293465fSRobert Watson */ 865293465fSRobert Watson #ifndef CAPABILITIES 875293465fSRobert Watson if (suser_xxx(cred, NULL, PRISON_ROOT) == 0) 885293465fSRobert Watson cap_granted = (VEXEC | VREAD | VWRITE | VADMIN); 895293465fSRobert Watson else 905293465fSRobert Watson cap_granted = 0; 915293465fSRobert Watson #else 925293465fSRobert Watson cap_granted = 0; 935293465fSRobert Watson 945293465fSRobert Watson if (type == VDIR) { 955293465fSRobert Watson if ((acc_mode & VEXEC) && !cap_check(cred, NULL, 965293465fSRobert Watson CAP_DAC_READ_SEARCH, PRISON_ROOT)) 975293465fSRobert Watson cap_granted |= VEXEC; 985293465fSRobert Watson } else { 995293465fSRobert Watson if ((acc_mode & VEXEC) && !cap_check(cred, NULL, 1005293465fSRobert Watson CAP_DAC_EXECUTE, PRISON_ROOT)) 1015293465fSRobert Watson cap_granted |= VEXEC; 1025293465fSRobert Watson } 1035293465fSRobert Watson 1045293465fSRobert Watson if ((acc_mode & VREAD) && !cap_check(cred, NULL, CAP_DAC_READ_SEARCH, 1055293465fSRobert Watson PRISON_ROOT)) 1065293465fSRobert Watson cap_granted |= VREAD; 1075293465fSRobert Watson 1085293465fSRobert Watson if ((acc_mode & VWRITE) && !cap_check(cred, NULL, CAP_DAC_WRITE, 1095293465fSRobert Watson PRISON_ROOT)) 1105293465fSRobert Watson cap_granted |= VWRITE; 1115293465fSRobert Watson 1125293465fSRobert Watson if ((acc_mode & VADMIN) && !cap_check(cred, NULL, CAP_FOWNER, 1135293465fSRobert Watson PRISON_ROOT)) 1145293465fSRobert Watson cap_granted |= VADMIN; 1155293465fSRobert Watson #endif /* CAPABILITIES */ 1165293465fSRobert Watson 1175293465fSRobert Watson /* 1185293465fSRobert Watson * Check the owner. 1195293465fSRobert Watson * Also, record locations of ACL_MASK and ACL_OTHER for reference 1205293465fSRobert Watson * later if the owner doesn't match. 1215293465fSRobert Watson */ 1225293465fSRobert Watson acl_mask = acl_other = NULL; 1235293465fSRobert Watson for (i = 0; i < acl->acl_cnt; i++) { 1245293465fSRobert Watson switch (acl->acl_entry[i].ae_tag) { 1255293465fSRobert Watson case ACL_USER_OBJ: 1265293465fSRobert Watson if (acl->acl_entry[i].ae_id != cred->cr_uid) 1275293465fSRobert Watson break; 1285293465fSRobert Watson dac_granted = 0; 1295293465fSRobert Watson dac_granted |= VADMIN; 1305293465fSRobert Watson if (acl->acl_entry[i].ae_perm & ACL_PERM_EXEC) 1315293465fSRobert Watson dac_granted |= VEXEC; 1325293465fSRobert Watson if (acl->acl_entry[i].ae_perm & ACL_PERM_READ) 1335293465fSRobert Watson dac_granted |= VREAD; 1345293465fSRobert Watson if (acl->acl_entry[i].ae_perm & ACL_PERM_WRITE) 1355293465fSRobert Watson dac_granted |= VWRITE; 1365293465fSRobert Watson if ((acc_mode & dac_granted) == acc_mode) 1375293465fSRobert Watson return (0); 1385293465fSRobert Watson if ((acc_mode & (dac_granted | cap_granted)) == 1395293465fSRobert Watson acc_mode) { 1405293465fSRobert Watson if (privused != NULL) 1415293465fSRobert Watson *privused = 1; 1425293465fSRobert Watson return (0); 1435293465fSRobert Watson } 1445293465fSRobert Watson goto error; 1455293465fSRobert Watson 1465293465fSRobert Watson case ACL_MASK: 1475293465fSRobert Watson acl_mask = &acl->acl_entry[i]; 1485293465fSRobert Watson break; 1495293465fSRobert Watson 1505293465fSRobert Watson case ACL_OTHER: 1515293465fSRobert Watson acl_other = &acl->acl_entry[i]; 1525293465fSRobert Watson break; 1535293465fSRobert Watson 1545293465fSRobert Watson default: 1555293465fSRobert Watson } 1565293465fSRobert Watson } 1575293465fSRobert Watson 1585293465fSRobert Watson /* 1595293465fSRobert Watson * Checks against ACL_USER, ACL_GROUP_OBJ, and ACL_GROUP fields 1605293465fSRobert Watson * are masked by an ACL_MASK entry, if any. As such, first identify 1615293465fSRobert Watson * the ACL_MASK field, then iterate through identifying potential 1625293465fSRobert Watson * user matches, then group matches. If there is no ACL_MASK, 1635293465fSRobert Watson * assume that the mask allows all requests to succeed. 1645293465fSRobert Watson * Also keep track of the location of ACL_OTHER for later consumption. 1655293465fSRobert Watson */ 1665293465fSRobert Watson if (acl_other == NULL) { 1675293465fSRobert Watson /* 1685293465fSRobert Watson * XXX: This should never happen. Only properly formatted 1695293465fSRobert Watson * ACLs should be passed to vaccess_acl_posix1e. 1705293465fSRobert Watson * Should make this a panic post-debugging. 1715293465fSRobert Watson */ 1725293465fSRobert Watson printf("vaccess_acl_posix1e: ACL_OTHER missing\n"); 1735293465fSRobert Watson return (EPERM); 1745293465fSRobert Watson } 1755293465fSRobert Watson if (acl_mask != NULL) { 1765293465fSRobert Watson acl_mask_granted = 0; 1775293465fSRobert Watson if (acl_mask->ae_perm & ACL_PERM_EXEC) 1785293465fSRobert Watson acl_mask_granted |= VEXEC; 1795293465fSRobert Watson if (acl_mask->ae_perm & ACL_PERM_READ) 1805293465fSRobert Watson acl_mask_granted |= VREAD; 1815293465fSRobert Watson if (acl_mask->ae_perm & ACL_PERM_WRITE) 1825293465fSRobert Watson acl_mask_granted |= VWRITE; 1835293465fSRobert Watson } else 1845293465fSRobert Watson acl_mask_granted = VEXEC | VREAD | VWRITE; 1855293465fSRobert Watson 1865293465fSRobert Watson /* 1875293465fSRobert Watson * We have to check each type even if we know ACL_MASK will reject, 1885293465fSRobert Watson * as we need to know what match there might have been, and 1895293465fSRobert Watson * therefore what further types we might be allowed to check. 1905293465fSRobert Watson * Do the checks twice -- once without privilege, and a second time 1915293465fSRobert Watson * with, if there was a match. 1925293465fSRobert Watson */ 1935293465fSRobert Watson 1945293465fSRobert Watson /* 1955293465fSRobert Watson * Check ACL_USER ACL entries. 1965293465fSRobert Watson */ 1975293465fSRobert Watson for (i = 0; i < acl->acl_cnt; i++) { 1985293465fSRobert Watson switch (acl->acl_entry[i].ae_tag) { 1995293465fSRobert Watson case ACL_USER: 2005293465fSRobert Watson if (acl->acl_entry[i].ae_id != cred->cr_uid) 2015293465fSRobert Watson break; 2025293465fSRobert Watson dac_granted = 0; 2035293465fSRobert Watson if (acl->acl_entry[i].ae_perm & ACL_PERM_EXEC) 2045293465fSRobert Watson dac_granted |= VEXEC; 2055293465fSRobert Watson if (acl->acl_entry[i].ae_perm & ACL_PERM_READ) 2065293465fSRobert Watson dac_granted |= VREAD; 2075293465fSRobert Watson if (acl->acl_entry[i].ae_perm & ACL_PERM_WRITE) 2085293465fSRobert Watson dac_granted |= VWRITE; 2095293465fSRobert Watson dac_granted &= acl_mask_granted; 2105293465fSRobert Watson if ((acc_mode & dac_granted) == acc_mode) 2115293465fSRobert Watson return (0); 2125293465fSRobert Watson if ((acc_mode & (dac_granted | cap_granted)) == 2135293465fSRobert Watson acc_mode) { 2145293465fSRobert Watson if (privused != NULL) 2155293465fSRobert Watson *privused = 1; 2165293465fSRobert Watson return (0); 2175293465fSRobert Watson } 2185293465fSRobert Watson goto error; 2195293465fSRobert Watson } 2205293465fSRobert Watson } 2215293465fSRobert Watson 2225293465fSRobert Watson /* 2235293465fSRobert Watson * Group match is best-match, not first-match, so find a 2245293465fSRobert Watson * "best" match. Iterate across, testing each potential group 2255293465fSRobert Watson * match. Make sure we keep track of whether we found a match 2265293465fSRobert Watson * or not, so that we know if we can move on to ACL_OTHER. 2275293465fSRobert Watson */ 2285293465fSRobert Watson group_matched = 0; 2295293465fSRobert Watson for (i = 0; i < acl->acl_cnt; i++) { 2305293465fSRobert Watson switch (acl->acl_entry[i].ae_tag) { 2315293465fSRobert Watson case ACL_GROUP_OBJ: 2325293465fSRobert Watson case ACL_GROUP: 2335293465fSRobert Watson if (groupmember(acl->acl_entry[i].ae_id, cred)) { 2345293465fSRobert Watson dac_granted = 0; 2355293465fSRobert Watson if (acl->acl_entry[i].ae_perm & ACL_PERM_EXEC) 2365293465fSRobert Watson dac_granted |= VEXEC; 2375293465fSRobert Watson if (acl->acl_entry[i].ae_perm & ACL_PERM_READ) 2385293465fSRobert Watson dac_granted |= VREAD; 2395293465fSRobert Watson if (acl->acl_entry[i].ae_perm & ACL_PERM_WRITE) 2405293465fSRobert Watson dac_granted |= VWRITE; 2415293465fSRobert Watson dac_granted &= acl_mask_granted; 2425293465fSRobert Watson 2435293465fSRobert Watson if ((acc_mode & dac_granted) == acc_mode) 2445293465fSRobert Watson return (0); 2455293465fSRobert Watson 2465293465fSRobert Watson group_matched = 1; 2475293465fSRobert Watson } 2485293465fSRobert Watson default: 2495293465fSRobert Watson } 2505293465fSRobert Watson } 2515293465fSRobert Watson 2525293465fSRobert Watson if (group_matched == 1) { 2535293465fSRobert Watson /* 2545293465fSRobert Watson * There was a match, but it did not grant rights via 2555293465fSRobert Watson * pure DAC. Try again, this time with privilege. 2565293465fSRobert Watson */ 2575293465fSRobert Watson for (i = 0; i < acl->acl_cnt; i++) { 2585293465fSRobert Watson switch (acl->acl_entry[i].ae_tag) { 2595293465fSRobert Watson case ACL_GROUP_OBJ: 2605293465fSRobert Watson case ACL_GROUP: 2615293465fSRobert Watson if (groupmember(acl->acl_entry[i].ae_id, 2625293465fSRobert Watson cred)) { 2635293465fSRobert Watson dac_granted = 0; 2645293465fSRobert Watson if (acl->acl_entry[i].ae_perm & 2655293465fSRobert Watson ACL_PERM_EXEC) 2665293465fSRobert Watson dac_granted |= VEXEC; 2675293465fSRobert Watson if (acl->acl_entry[i].ae_perm & 2685293465fSRobert Watson ACL_PERM_READ) 2695293465fSRobert Watson dac_granted |= VREAD; 2705293465fSRobert Watson if (acl->acl_entry[i].ae_perm & 2715293465fSRobert Watson ACL_PERM_WRITE) 2725293465fSRobert Watson dac_granted |= VWRITE; 2735293465fSRobert Watson dac_granted &= acl_mask_granted; 2745293465fSRobert Watson if ((acc_mode & (dac_granted | 2755293465fSRobert Watson cap_granted)) == acc_mode) { 2765293465fSRobert Watson if (privused != NULL) 2775293465fSRobert Watson *privused = 1; 2785293465fSRobert Watson return (0); 2795293465fSRobert Watson } 2805293465fSRobert Watson } 2815293465fSRobert Watson default: 2825293465fSRobert Watson } 2835293465fSRobert Watson } 2845293465fSRobert Watson /* 2855293465fSRobert Watson * Even with privilege, group membership was not sufficient. 2865293465fSRobert Watson * Return failure. 2875293465fSRobert Watson */ 2885293465fSRobert Watson goto error; 2895293465fSRobert Watson } 2905293465fSRobert Watson 2915293465fSRobert Watson /* 2925293465fSRobert Watson * Fall back on ACL_OTHER. ACL_MASK is not applied to ACL_OTHER. 2935293465fSRobert Watson */ 2945293465fSRobert Watson dac_granted = 0; 2955293465fSRobert Watson if (acl_other->ae_perm & ACL_PERM_EXEC) 2965293465fSRobert Watson dac_granted |= VEXEC; 2975293465fSRobert Watson if (acl_other->ae_perm & ACL_PERM_READ) 2985293465fSRobert Watson dac_granted |= VREAD; 2995293465fSRobert Watson if (acl_other->ae_perm & ACL_PERM_WRITE) 3005293465fSRobert Watson dac_granted |= VWRITE; 3015293465fSRobert Watson 3025293465fSRobert Watson if ((acc_mode & dac_granted) == acc_mode) 3035293465fSRobert Watson return (0); 3045293465fSRobert Watson if ((acc_mode & (dac_granted | cap_granted)) == acc_mode) { 3055293465fSRobert Watson if (privused != NULL) 3065293465fSRobert Watson *privused = 1; 3075293465fSRobert Watson return (0); 3085293465fSRobert Watson } 3095293465fSRobert Watson 3105293465fSRobert Watson error: 3115293465fSRobert Watson return ((acc_mode & VADMIN) ? EPERM : EACCES); 3125293465fSRobert Watson } 3135293465fSRobert Watson 3145293465fSRobert Watson /* 3155293465fSRobert Watson * For the purposes of file systems maintaining the _OBJ entries in an 3165293465fSRobert Watson * inode with a mode_t field, this routine converts a mode_t entry 3175293465fSRobert Watson * to an acl_perm_t. 3185293465fSRobert Watson */ 3195293465fSRobert Watson acl_perm_t 3205293465fSRobert Watson acl_posix1e_mode_to_perm(acl_tag_t tag, mode_t mode) 3215293465fSRobert Watson { 3225293465fSRobert Watson acl_perm_t perm = 0; 3235293465fSRobert Watson 3245293465fSRobert Watson switch(tag) { 3255293465fSRobert Watson case ACL_USER_OBJ: 3265293465fSRobert Watson if (mode & S_IXUSR) 3275293465fSRobert Watson perm |= ACL_PERM_EXEC; 3285293465fSRobert Watson if (mode & S_IRUSR) 3295293465fSRobert Watson perm |= ACL_PERM_READ; 3305293465fSRobert Watson if (mode & S_IWUSR) 3315293465fSRobert Watson perm |= ACL_PERM_WRITE; 3325293465fSRobert Watson return (perm); 3335293465fSRobert Watson 3345293465fSRobert Watson case ACL_GROUP_OBJ: 3355293465fSRobert Watson if (mode & S_IXGRP) 3365293465fSRobert Watson perm |= ACL_PERM_EXEC; 3375293465fSRobert Watson if (mode & S_IRGRP) 3385293465fSRobert Watson perm |= ACL_PERM_READ; 3395293465fSRobert Watson if (mode & S_IWGRP) 3405293465fSRobert Watson perm |= ACL_PERM_WRITE; 3415293465fSRobert Watson return (perm); 3425293465fSRobert Watson 3435293465fSRobert Watson case ACL_OTHER: 3445293465fSRobert Watson if (mode & S_IXOTH) 3455293465fSRobert Watson perm |= ACL_PERM_EXEC; 3465293465fSRobert Watson if (mode & S_IROTH) 3475293465fSRobert Watson perm |= ACL_PERM_READ; 3485293465fSRobert Watson if (mode & S_IWOTH) 3495293465fSRobert Watson perm |= ACL_PERM_WRITE; 3505293465fSRobert Watson return (perm); 3515293465fSRobert Watson 3525293465fSRobert Watson default: 3535293465fSRobert Watson printf("acl_posix1e_mode_to_perm: invalid tag (%d)\n", tag); 3545293465fSRobert Watson return (0); 3555293465fSRobert Watson } 3565293465fSRobert Watson } 3575293465fSRobert Watson 3585293465fSRobert Watson /* 3595293465fSRobert Watson * Given inode information (uid, gid, mode), return an acl entry of the 3605293465fSRobert Watson * appropriate type. 3615293465fSRobert Watson */ 3625293465fSRobert Watson struct acl_entry 3635293465fSRobert Watson acl_posix1e_mode_to_entry(acl_tag_t tag, uid_t uid, gid_t gid, mode_t mode) 3645293465fSRobert Watson { 3655293465fSRobert Watson struct acl_entry acl_entry; 3665293465fSRobert Watson 3675293465fSRobert Watson acl_entry.ae_tag = tag; 3685293465fSRobert Watson acl_entry.ae_perm = acl_posix1e_mode_to_perm(tag, mode); 3695293465fSRobert Watson switch(tag) { 3705293465fSRobert Watson case ACL_USER_OBJ: 3715293465fSRobert Watson acl_entry.ae_id = uid; 3725293465fSRobert Watson break; 3735293465fSRobert Watson 3745293465fSRobert Watson case ACL_GROUP_OBJ: 3755293465fSRobert Watson acl_entry.ae_id = gid; 3765293465fSRobert Watson break; 3775293465fSRobert Watson 3785293465fSRobert Watson case ACL_OTHER: 3795293465fSRobert Watson acl_entry.ae_id = 0; 3805293465fSRobert Watson break; 3815293465fSRobert Watson 3825293465fSRobert Watson default: 3835293465fSRobert Watson acl_entry.ae_id = 0; 3845293465fSRobert Watson printf("acl_posix1e_mode_to_entry: invalid tag (%d)\n", tag); 3855293465fSRobert Watson } 3865293465fSRobert Watson 3875293465fSRobert Watson return (acl_entry); 3885293465fSRobert Watson } 3895293465fSRobert Watson 3905293465fSRobert Watson /* 3915293465fSRobert Watson * Utility function to generate a file mode given appropriate ACL entries. 3925293465fSRobert Watson */ 3935293465fSRobert Watson mode_t 3945293465fSRobert Watson acl_posix1e_perms_to_mode(struct acl_entry *acl_user_obj_entry, 3955293465fSRobert Watson struct acl_entry *acl_group_obj_entry, struct acl_entry *acl_other_entry) 3965293465fSRobert Watson { 3975293465fSRobert Watson mode_t mode; 3985293465fSRobert Watson 3995293465fSRobert Watson mode = 0; 4005293465fSRobert Watson if (acl_user_obj_entry->ae_perm & ACL_PERM_EXEC) 4015293465fSRobert Watson mode |= S_IXUSR; 4025293465fSRobert Watson if (acl_user_obj_entry->ae_perm & ACL_PERM_READ) 4035293465fSRobert Watson mode |= S_IRUSR; 4045293465fSRobert Watson if (acl_user_obj_entry->ae_perm & ACL_PERM_WRITE) 4055293465fSRobert Watson mode |= S_IWUSR; 4065293465fSRobert Watson if (acl_group_obj_entry->ae_perm & ACL_PERM_EXEC) 4075293465fSRobert Watson mode |= S_IXGRP; 4085293465fSRobert Watson if (acl_group_obj_entry->ae_perm & ACL_PERM_READ) 4095293465fSRobert Watson mode |= S_IRGRP; 4105293465fSRobert Watson if (acl_group_obj_entry->ae_perm & ACL_PERM_WRITE) 4115293465fSRobert Watson mode |= S_IWGRP; 4125293465fSRobert Watson if (acl_other_entry->ae_perm & ACL_PERM_EXEC) 4135293465fSRobert Watson mode |= S_IXOTH; 4145293465fSRobert Watson if (acl_other_entry->ae_perm & ACL_PERM_READ) 4155293465fSRobert Watson mode |= S_IROTH; 4165293465fSRobert Watson if (acl_other_entry->ae_perm & ACL_PERM_WRITE) 4175293465fSRobert Watson mode |= S_IWOTH; 4185293465fSRobert Watson 4195293465fSRobert Watson return (mode); 4205293465fSRobert Watson } 4215293465fSRobert Watson 4225293465fSRobert Watson /* 4235293465fSRobert Watson * Perform a syntactic check of the ACL, sufficient to allow an 4245293465fSRobert Watson * implementing file system to determine if it should accept this and 4255293465fSRobert Watson * rely on the POSIX.1e ACL properties. 4265293465fSRobert Watson */ 4275293465fSRobert Watson int 4285293465fSRobert Watson acl_posix1e_check(struct acl *acl) 4295293465fSRobert Watson { 4305293465fSRobert Watson int num_acl_user_obj, num_acl_user, num_acl_group_obj, num_acl_group; 4315293465fSRobert Watson int num_acl_mask, num_acl_other, i; 4325293465fSRobert Watson 4335293465fSRobert Watson /* 4345293465fSRobert Watson * Verify that the number of entries does not exceed the maximum 4355293465fSRobert Watson * defined for acl_t. 4365293465fSRobert Watson * Verify that the correct number of various sorts of ae_tags are 4375293465fSRobert Watson * present: 4385293465fSRobert Watson * Exactly one ACL_USER_OBJ 4395293465fSRobert Watson * Exactly one ACL_GROUP_OBJ 4405293465fSRobert Watson * Exactly one ACL_OTHER 4415293465fSRobert Watson * If any ACL_USER or ACL_GROUP entries appear, then exactly one 4425293465fSRobert Watson * ACL_MASK entry must also appear. 4435293465fSRobert Watson * Verify that all ae_perm entries are in ACL_PERM_BITS. 4445293465fSRobert Watson * Verify all ae_tag entries are understood by this implementation. 4455293465fSRobert Watson * Note: Does not check for uniqueness of qualifier (ae_id) field. 4465293465fSRobert Watson */ 4475293465fSRobert Watson num_acl_user_obj = num_acl_user = num_acl_group_obj = num_acl_group = 4485293465fSRobert Watson num_acl_mask = num_acl_other = 0; 4495293465fSRobert Watson if (acl->acl_cnt > ACL_MAX_ENTRIES || acl->acl_cnt < 0) 4505293465fSRobert Watson return (EINVAL); 4515293465fSRobert Watson for (i = 0; i < acl->acl_cnt; i++) { 4525293465fSRobert Watson /* 4535293465fSRobert Watson * Check for a valid tag. 4545293465fSRobert Watson */ 4555293465fSRobert Watson switch(acl->acl_entry[i].ae_tag) { 4565293465fSRobert Watson case ACL_USER_OBJ: 4575293465fSRobert Watson num_acl_user_obj++; 4585293465fSRobert Watson break; 4595293465fSRobert Watson case ACL_GROUP_OBJ: 4605293465fSRobert Watson num_acl_group_obj++; 4615293465fSRobert Watson break; 4625293465fSRobert Watson case ACL_USER: 4635293465fSRobert Watson num_acl_user++; 4645293465fSRobert Watson break; 4655293465fSRobert Watson case ACL_GROUP: 4665293465fSRobert Watson num_acl_group++; 4675293465fSRobert Watson break; 4685293465fSRobert Watson case ACL_OTHER: 4695293465fSRobert Watson num_acl_other++; 4705293465fSRobert Watson break; 4715293465fSRobert Watson case ACL_MASK: 4725293465fSRobert Watson num_acl_mask++; 4735293465fSRobert Watson break; 4745293465fSRobert Watson default: 4755293465fSRobert Watson return (EINVAL); 4765293465fSRobert Watson } 4775293465fSRobert Watson /* 4785293465fSRobert Watson * Check for valid perm entries. 4795293465fSRobert Watson */ 4805293465fSRobert Watson if ((acl->acl_entry[i].ae_perm | ACL_PERM_BITS) != 4815293465fSRobert Watson ACL_PERM_BITS) 4825293465fSRobert Watson return (EINVAL); 4835293465fSRobert Watson } 4845293465fSRobert Watson if ((num_acl_user_obj != 1) || (num_acl_group_obj != 1) || 4855293465fSRobert Watson (num_acl_other != 1) || (num_acl_mask != 0 && num_acl_mask != 1)) 4865293465fSRobert Watson return (EINVAL); 4875293465fSRobert Watson if (((num_acl_group != 0) || (num_acl_user != 0)) && 4885293465fSRobert Watson (num_acl_mask != 1)) 4895293465fSRobert Watson return (EINVAL); 4905293465fSRobert Watson return (0); 4915293465fSRobert Watson } 4925293465fSRobert Watson 4935293465fSRobert Watson /* 49491f37dcbSRobert Watson * These calls wrap the real vnode operations, and are called by the 49591f37dcbSRobert Watson * syscall code once the syscall has converted the path or file 49691f37dcbSRobert Watson * descriptor to a vnode (unlocked). The aclp pointer is assumed 49791f37dcbSRobert Watson * still to point to userland, so this should not be consumed within 49891f37dcbSRobert Watson * the kernel except by syscall code. Other code should directly 49991f37dcbSRobert Watson * invoke VOP_{SET,GET}ACL. 50091f37dcbSRobert Watson */ 50191f37dcbSRobert Watson 50291f37dcbSRobert Watson /* 50391f37dcbSRobert Watson * Given a vnode, set its ACL. 50491f37dcbSRobert Watson */ 50591f37dcbSRobert Watson static int 50691f37dcbSRobert Watson vacl_set_acl(struct proc *p, struct vnode *vp, acl_type_t type, 50791f37dcbSRobert Watson struct acl *aclp) 50891f37dcbSRobert Watson { 50991f37dcbSRobert Watson struct acl inkernacl; 51091f37dcbSRobert Watson int error; 51191f37dcbSRobert Watson 51291f37dcbSRobert Watson error = copyin(aclp, &inkernacl, sizeof(struct acl)); 51391f37dcbSRobert Watson if (error) 51491f37dcbSRobert Watson return(error); 515ba88dfc7SJohn Baldwin VOP_LEASE(vp, p, p->p_ucred, LEASE_WRITE); 51691f37dcbSRobert Watson vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, p); 517ba88dfc7SJohn Baldwin error = VOP_SETACL(vp, type, &inkernacl, p->p_ucred, p); 51891f37dcbSRobert Watson VOP_UNLOCK(vp, 0, p); 51991f37dcbSRobert Watson return(error); 52091f37dcbSRobert Watson } 52191f37dcbSRobert Watson 52291f37dcbSRobert Watson /* 52391f37dcbSRobert Watson * Given a vnode, get its ACL. 52491f37dcbSRobert Watson */ 52591f37dcbSRobert Watson static int 52691f37dcbSRobert Watson vacl_get_acl(struct proc *p, struct vnode *vp, acl_type_t type, 52791f37dcbSRobert Watson struct acl *aclp) 52891f37dcbSRobert Watson { 52991f37dcbSRobert Watson struct acl inkernelacl; 53091f37dcbSRobert Watson int error; 53191f37dcbSRobert Watson 532ba88dfc7SJohn Baldwin VOP_LEASE(vp, p, p->p_ucred, LEASE_WRITE); 533988ee790SRobert Watson vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, p); 534ba88dfc7SJohn Baldwin error = VOP_GETACL(vp, type, &inkernelacl, p->p_ucred, p); 535988ee790SRobert Watson VOP_UNLOCK(vp, 0, p); 53691f37dcbSRobert Watson if (error == 0) 53791f37dcbSRobert Watson error = copyout(&inkernelacl, aclp, sizeof(struct acl)); 53891f37dcbSRobert Watson return (error); 53991f37dcbSRobert Watson } 54091f37dcbSRobert Watson 54191f37dcbSRobert Watson /* 54291f37dcbSRobert Watson * Given a vnode, delete its ACL. 54391f37dcbSRobert Watson */ 54491f37dcbSRobert Watson static int 54591f37dcbSRobert Watson vacl_delete(struct proc *p, struct vnode *vp, acl_type_t type) 54691f37dcbSRobert Watson { 54791f37dcbSRobert Watson int error; 54891f37dcbSRobert Watson 549ba88dfc7SJohn Baldwin VOP_LEASE(vp, p, p->p_ucred, LEASE_WRITE); 55091f37dcbSRobert Watson vn_lock(vp, LK_EXCLUSIVE | LK_RETRY, p); 551ba88dfc7SJohn Baldwin error = VOP_SETACL(vp, ACL_TYPE_DEFAULT, 0, p->p_ucred, p); 55291f37dcbSRobert Watson VOP_UNLOCK(vp, 0, p); 55391f37dcbSRobert Watson return (error); 55491f37dcbSRobert Watson } 55591f37dcbSRobert Watson 55691f37dcbSRobert Watson /* 55791f37dcbSRobert Watson * Given a vnode, check whether an ACL is appropriate for it 55891f37dcbSRobert Watson */ 55991f37dcbSRobert Watson static int 56091f37dcbSRobert Watson vacl_aclcheck(struct proc *p, struct vnode *vp, acl_type_t type, 56191f37dcbSRobert Watson struct acl *aclp) 56291f37dcbSRobert Watson { 56391f37dcbSRobert Watson struct acl inkernelacl; 56491f37dcbSRobert Watson int error; 56591f37dcbSRobert Watson 56691f37dcbSRobert Watson error = copyin(aclp, &inkernelacl, sizeof(struct acl)); 56791f37dcbSRobert Watson if (error) 56891f37dcbSRobert Watson return(error); 569ba88dfc7SJohn Baldwin error = VOP_ACLCHECK(vp, type, &inkernelacl, p->p_ucred, p); 57091f37dcbSRobert Watson return (error); 57191f37dcbSRobert Watson } 57291f37dcbSRobert Watson 57391f37dcbSRobert Watson /* 57491f37dcbSRobert Watson * syscalls -- convert the path/fd to a vnode, and call vacl_whatever. 57591f37dcbSRobert Watson * Don't need to lock, as the vacl_ code will get/release any locks 57691f37dcbSRobert Watson * required. 57791f37dcbSRobert Watson */ 57891f37dcbSRobert Watson 57991f37dcbSRobert Watson /* 58091f37dcbSRobert Watson * Given a file path, get an ACL for it 58191f37dcbSRobert Watson */ 58291f37dcbSRobert Watson int 5838f073875SRobert Watson __acl_get_file(struct proc *p, struct __acl_get_file_args *uap) 58491f37dcbSRobert Watson { 58591f37dcbSRobert Watson struct nameidata nd; 58691f37dcbSRobert Watson int error; 58791f37dcbSRobert Watson 58891f37dcbSRobert Watson /* what flags are required here -- possible not LOCKLEAF? */ 58991f37dcbSRobert Watson NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, SCARG(uap, path), p); 59091f37dcbSRobert Watson error = namei(&nd); 59191f37dcbSRobert Watson if (error) 59291f37dcbSRobert Watson return(error); 59391f37dcbSRobert Watson error = vacl_get_acl(p, nd.ni_vp, SCARG(uap, type), SCARG(uap, aclp)); 59491f37dcbSRobert Watson NDFREE(&nd, 0); 59591f37dcbSRobert Watson return (error); 59691f37dcbSRobert Watson } 59791f37dcbSRobert Watson 59891f37dcbSRobert Watson /* 59991f37dcbSRobert Watson * Given a file path, set an ACL for it 60091f37dcbSRobert Watson */ 60191f37dcbSRobert Watson int 6028f073875SRobert Watson __acl_set_file(struct proc *p, struct __acl_set_file_args *uap) 60391f37dcbSRobert Watson { 60491f37dcbSRobert Watson struct nameidata nd; 60591f37dcbSRobert Watson int error; 60691f37dcbSRobert Watson 60791f37dcbSRobert Watson NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, SCARG(uap, path), p); 60891f37dcbSRobert Watson error = namei(&nd); 60991f37dcbSRobert Watson if (error) 61091f37dcbSRobert Watson return(error); 61191f37dcbSRobert Watson error = vacl_set_acl(p, nd.ni_vp, SCARG(uap, type), SCARG(uap, aclp)); 61291f37dcbSRobert Watson NDFREE(&nd, 0); 61391f37dcbSRobert Watson return (error); 61491f37dcbSRobert Watson } 61591f37dcbSRobert Watson 61691f37dcbSRobert Watson /* 61791f37dcbSRobert Watson * Given a file descriptor, get an ACL for it 61891f37dcbSRobert Watson */ 61991f37dcbSRobert Watson int 6208f073875SRobert Watson __acl_get_fd(struct proc *p, struct __acl_get_fd_args *uap) 62191f37dcbSRobert Watson { 62291f37dcbSRobert Watson struct file *fp; 62391f37dcbSRobert Watson int error; 62491f37dcbSRobert Watson 62591f37dcbSRobert Watson error = getvnode(p->p_fd, SCARG(uap, filedes), &fp); 62691f37dcbSRobert Watson if (error) 62791f37dcbSRobert Watson return(error); 62891f37dcbSRobert Watson return vacl_get_acl(p, (struct vnode *)fp->f_data, SCARG(uap, type), 62991f37dcbSRobert Watson SCARG(uap, aclp)); 63091f37dcbSRobert Watson } 63191f37dcbSRobert Watson 63291f37dcbSRobert Watson /* 63391f37dcbSRobert Watson * Given a file descriptor, set an ACL for it 63491f37dcbSRobert Watson */ 63591f37dcbSRobert Watson int 6368f073875SRobert Watson __acl_set_fd(struct proc *p, struct __acl_set_fd_args *uap) 63791f37dcbSRobert Watson { 63891f37dcbSRobert Watson struct file *fp; 63991f37dcbSRobert Watson int error; 64091f37dcbSRobert Watson 64191f37dcbSRobert Watson error = getvnode(p->p_fd, SCARG(uap, filedes), &fp); 64291f37dcbSRobert Watson if (error) 64391f37dcbSRobert Watson return(error); 64491f37dcbSRobert Watson return vacl_set_acl(p, (struct vnode *)fp->f_data, SCARG(uap, type), 64591f37dcbSRobert Watson SCARG(uap, aclp)); 64691f37dcbSRobert Watson } 64791f37dcbSRobert Watson 64891f37dcbSRobert Watson /* 64991f37dcbSRobert Watson * Given a file path, delete an ACL from it. 65091f37dcbSRobert Watson */ 65191f37dcbSRobert Watson int 6528f073875SRobert Watson __acl_delete_file(struct proc *p, struct __acl_delete_file_args *uap) 65391f37dcbSRobert Watson { 65491f37dcbSRobert Watson struct nameidata nd; 65591f37dcbSRobert Watson int error; 65691f37dcbSRobert Watson 65791f37dcbSRobert Watson NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, SCARG(uap, path), p); 65891f37dcbSRobert Watson error = namei(&nd); 65991f37dcbSRobert Watson if (error) 66091f37dcbSRobert Watson return(error); 66191f37dcbSRobert Watson error = vacl_delete(p, nd.ni_vp, SCARG(uap, type)); 66291f37dcbSRobert Watson NDFREE(&nd, 0); 66391f37dcbSRobert Watson return (error); 66491f37dcbSRobert Watson } 66591f37dcbSRobert Watson 66691f37dcbSRobert Watson /* 66791f37dcbSRobert Watson * Given a file path, delete an ACL from it. 66891f37dcbSRobert Watson */ 66991f37dcbSRobert Watson int 6708f073875SRobert Watson __acl_delete_fd(struct proc *p, struct __acl_delete_fd_args *uap) 67191f37dcbSRobert Watson { 67291f37dcbSRobert Watson struct file *fp; 67391f37dcbSRobert Watson int error; 67491f37dcbSRobert Watson 67591f37dcbSRobert Watson error = getvnode(p->p_fd, SCARG(uap, filedes), &fp); 67691f37dcbSRobert Watson if (error) 67791f37dcbSRobert Watson return(error); 67891f37dcbSRobert Watson error = vacl_delete(p, (struct vnode *)fp->f_data, SCARG(uap, type)); 67991f37dcbSRobert Watson return (error); 68091f37dcbSRobert Watson } 68191f37dcbSRobert Watson 68291f37dcbSRobert Watson /* 68391f37dcbSRobert Watson * Given a file path, check an ACL for it 68491f37dcbSRobert Watson */ 68591f37dcbSRobert Watson int 6868f073875SRobert Watson __acl_aclcheck_file(struct proc *p, struct __acl_aclcheck_file_args *uap) 68791f37dcbSRobert Watson { 68891f37dcbSRobert Watson struct nameidata nd; 68991f37dcbSRobert Watson int error; 69091f37dcbSRobert Watson 69191f37dcbSRobert Watson NDINIT(&nd, LOOKUP, FOLLOW, UIO_USERSPACE, SCARG(uap, path), p); 69291f37dcbSRobert Watson error = namei(&nd); 69391f37dcbSRobert Watson if (error) 69491f37dcbSRobert Watson return(error); 69591f37dcbSRobert Watson error = vacl_aclcheck(p, nd.ni_vp, SCARG(uap, type), SCARG(uap, aclp)); 69691f37dcbSRobert Watson NDFREE(&nd, 0); 69791f37dcbSRobert Watson return (error); 69891f37dcbSRobert Watson } 69991f37dcbSRobert Watson 70091f37dcbSRobert Watson /* 70191f37dcbSRobert Watson * Given a file descriptor, check an ACL for it 70291f37dcbSRobert Watson */ 70391f37dcbSRobert Watson int 7048f073875SRobert Watson __acl_aclcheck_fd(struct proc *p, struct __acl_aclcheck_fd_args *uap) 70591f37dcbSRobert Watson { 70691f37dcbSRobert Watson struct file *fp; 70791f37dcbSRobert Watson int error; 70891f37dcbSRobert Watson 70991f37dcbSRobert Watson error = getvnode(p->p_fd, SCARG(uap, filedes), &fp); 71091f37dcbSRobert Watson if (error) 71191f37dcbSRobert Watson return(error); 71291f37dcbSRobert Watson return vacl_aclcheck(p, (struct vnode *)fp->f_data, SCARG(uap, type), 71391f37dcbSRobert Watson SCARG(uap, aclp)); 71491f37dcbSRobert Watson } 715