1 /*-
2 * SPDX-License-Identifier: BSD-3-Clause
3 *
4 * Copyright (c) 1982, 1986, 1989, 1993
5 * The Regents of the University of California. All rights reserved.
6 * (c) UNIX System Laboratories, Inc.
7 * All or some portions of this file are derived from material licensed
8 * to the University of California by American Telephone and Telegraph
9 * Co. or Unix System Laboratories, Inc. and are reproduced herein with
10 * the permission of UNIX System Laboratories, Inc.
11 *
12 * Redistribution and use in source and binary forms, with or without
13 * modification, are permitted provided that the following conditions
14 * are met:
15 * 1. Redistributions of source code must retain the above copyright
16 * notice, this list of conditions and the following disclaimer.
17 * 2. Redistributions in binary form must reproduce the above copyright
18 * notice, this list of conditions and the following disclaimer in the
19 * documentation and/or other materials provided with the distribution.
20 * 3. Neither the name of the University nor the names of its contributors
21 * may be used to endorse or promote products derived from this software
22 * without specific prior written permission.
23 *
24 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34 * SUCH DAMAGE.
35 */
36
37 #include <sys/cdefs.h>
38 #include "opt_capsicum.h"
39 #include "opt_ktrace.h"
40
41 #include <sys/param.h>
42 #include <sys/systm.h>
43 #include <sys/dirent.h>
44 #include <sys/kernel.h>
45 #include <sys/capsicum.h>
46 #include <sys/fcntl.h>
47 #include <sys/jail.h>
48 #include <sys/lock.h>
49 #include <sys/mutex.h>
50 #include <sys/namei.h>
51 #include <sys/vnode.h>
52 #include <sys/mount.h>
53 #include <sys/filedesc.h>
54 #include <sys/proc.h>
55 #include <sys/sdt.h>
56 #include <sys/syscallsubr.h>
57 #include <sys/sysctl.h>
58 #ifdef KTRACE
59 #include <sys/ktrace.h>
60 #endif
61 #ifdef INVARIANTS
62 #include <machine/_inttypes.h>
63 #endif
64
65 #include <security/audit/audit.h>
66 #include <security/mac/mac_framework.h>
67
68 #include <vm/uma.h>
69
70 #ifdef INVARIANTS
71 static void NDVALIDATE_impl(struct nameidata *, int);
72 #define NDVALIDATE(ndp) NDVALIDATE_impl(ndp, __LINE__)
73 #else
74 #define NDVALIDATE(ndp)
75 #endif
76
77 /*
78 * Prepare namei() to restart. Reset components to its original state and set
79 * ISRESTARTED flag which signals the underlying lookup code to change the root
80 * from ABI root to actual root and prevents a further restarts.
81 */
82 #define NDRESTART(ndp) do { \
83 NDREINIT_DBG(ndp); \
84 ndp->ni_resflags = 0; \
85 ndp->ni_cnd.cn_flags &= ~NAMEI_INTERNAL_FLAGS; \
86 ndp->ni_cnd.cn_flags |= ISRESTARTED; \
87 } while (0)
88
89 #ifdef KTRACE
90 #define NIKTRCAPFAIL(path) ktrcapfail(CAPFAIL_NAMEI, (path))
91 #else
92 #define NIKTRCAPFAIL(path)
93 #endif
94
95 #define NI_CAP_VIOLATION(ndp, path) do { \
96 NIKTRCAPFAIL(path); \
97 (ndp)->ni_lcf &= ~NI_LCF_KTR_FLAGS; \
98 } while (0)
99
100 SDT_PROVIDER_DEFINE(vfs);
101 SDT_PROBE_DEFINE4(vfs, namei, lookup, entry, "struct vnode *", "char *",
102 "unsigned long", "bool");
103 SDT_PROBE_DEFINE4(vfs, namei, lookup, return, "int", "struct vnode *", "bool",
104 "struct nameidata");
105
106 /* Allocation zone for namei. */
107 uma_zone_t namei_zone;
108
109 /* Placeholder vnode for mp traversal. */
110 static struct vnode *vp_crossmp;
111
112 static int
crossmp_vop_islocked(struct vop_islocked_args * ap)113 crossmp_vop_islocked(struct vop_islocked_args *ap)
114 {
115
116 return (LK_SHARED);
117 }
118
119 static int
crossmp_vop_lock1(struct vop_lock1_args * ap)120 crossmp_vop_lock1(struct vop_lock1_args *ap)
121 {
122 struct vnode *vp;
123 struct lock *lk __diagused;
124 int flags;
125
126 vp = ap->a_vp;
127 lk = vp->v_vnlock;
128 flags = ap->a_flags;
129
130 KASSERT((flags & (LK_SHARED | LK_NOWAIT)) == (LK_SHARED | LK_NOWAIT),
131 ("%s: invalid lock request 0x%x for crossmp", __func__, flags));
132
133 if ((flags & LK_INTERLOCK) != 0)
134 VI_UNLOCK(vp);
135 LOCK_LOG_LOCK("SLOCK", &lk->lock_object, 0, 0, ap->a_file, ap->a_line);
136 return (0);
137 }
138
139 static int
crossmp_vop_unlock(struct vop_unlock_args * ap)140 crossmp_vop_unlock(struct vop_unlock_args *ap)
141 {
142 struct vnode *vp;
143 struct lock *lk __diagused;
144
145 vp = ap->a_vp;
146 lk = vp->v_vnlock;
147
148 LOCK_LOG_LOCK("SUNLOCK", &lk->lock_object, 0, 0, LOCK_FILE,
149 LOCK_LINE);
150 return (0);
151 }
152
153 static struct vop_vector crossmp_vnodeops = {
154 .vop_default = &default_vnodeops,
155 .vop_islocked = crossmp_vop_islocked,
156 .vop_lock1 = crossmp_vop_lock1,
157 .vop_unlock = crossmp_vop_unlock,
158 };
159 /*
160 * VFS_VOP_VECTOR_REGISTER(crossmp_vnodeops) is not used here since the vnode
161 * gets allocated early. See nameiinit for the direct call below.
162 */
163
164 struct nameicap_tracker {
165 struct vnode *dp;
166 TAILQ_ENTRY(nameicap_tracker) nm_link;
167 };
168
169 /* Zone for cap mode tracker elements used for dotdot capability checks. */
170 MALLOC_DEFINE(M_NAMEITRACKER, "namei_tracker", "namei tracking for dotdot");
171
172 static void
nameiinit(void * dummy __unused)173 nameiinit(void *dummy __unused)
174 {
175
176 namei_zone = uma_zcreate("NAMEI", MAXPATHLEN, NULL, NULL, NULL, NULL,
177 UMA_ALIGN_PTR, 0);
178 vfs_vector_op_register(&crossmp_vnodeops);
179 getnewvnode("crossmp", NULL, &crossmp_vnodeops, &vp_crossmp);
180 vp_crossmp->v_state = VSTATE_CONSTRUCTED;
181 vp_crossmp->v_irflag |= VIRF_CROSSMP;
182 }
183 SYSINIT(vfs, SI_SUB_VFS, SI_ORDER_SECOND, nameiinit, NULL);
184
185 static int lookup_cap_dotdot = 1;
186 SYSCTL_INT(_vfs, OID_AUTO, lookup_cap_dotdot, CTLFLAG_RWTUN,
187 &lookup_cap_dotdot, 0,
188 "enables \"..\" components in path lookup in capability mode");
189 static int lookup_cap_dotdot_nonlocal = 1;
190 SYSCTL_INT(_vfs, OID_AUTO, lookup_cap_dotdot_nonlocal, CTLFLAG_RWTUN,
191 &lookup_cap_dotdot_nonlocal, 0,
192 "enables \"..\" components in path lookup in capability mode "
193 "on non-local mount");
194
195 static void
nameicap_tracker_add(struct nameidata * ndp,struct vnode * dp)196 nameicap_tracker_add(struct nameidata *ndp, struct vnode *dp)
197 {
198 struct nameicap_tracker *nt;
199
200 if ((ndp->ni_lcf & NI_LCF_CAP_DOTDOT) == 0 || dp->v_type != VDIR)
201 return;
202 nt = TAILQ_LAST(&ndp->ni_cap_tracker, nameicap_tracker_head);
203 if (nt != NULL && nt->dp == dp)
204 return;
205 nt = malloc(sizeof(*nt), M_NAMEITRACKER, M_WAITOK);
206 vhold(dp);
207 nt->dp = dp;
208 TAILQ_INSERT_TAIL(&ndp->ni_cap_tracker, nt, nm_link);
209 }
210
211 static void
nameicap_cleanup_from(struct nameidata * ndp,struct nameicap_tracker * first)212 nameicap_cleanup_from(struct nameidata *ndp, struct nameicap_tracker *first)
213 {
214 struct nameicap_tracker *nt, *nt1;
215
216 nt = first;
217 TAILQ_FOREACH_FROM_SAFE(nt, &ndp->ni_cap_tracker, nm_link, nt1) {
218 TAILQ_REMOVE(&ndp->ni_cap_tracker, nt, nm_link);
219 vdrop(nt->dp);
220 free(nt, M_NAMEITRACKER);
221 }
222 }
223
224 static void
nameicap_cleanup(struct nameidata * ndp)225 nameicap_cleanup(struct nameidata *ndp)
226 {
227 KASSERT(TAILQ_EMPTY(&ndp->ni_cap_tracker) ||
228 (ndp->ni_lcf & NI_LCF_CAP_DOTDOT) != 0, ("not strictrelative"));
229 nameicap_cleanup_from(ndp, NULL);
230 }
231
232 /*
233 * For dotdot lookups in capability mode, only allow the component
234 * lookup to succeed if the resulting directory was already traversed
235 * during the operation. This catches situations where already
236 * traversed directory is moved to different parent, and then we walk
237 * over it with dotdots.
238 *
239 * Also allow to force failure of dotdot lookups for non-local
240 * filesystems, where external agents might assist local lookups to
241 * escape the compartment.
242 */
243 static int
nameicap_check_dotdot(struct nameidata * ndp,struct vnode * dp)244 nameicap_check_dotdot(struct nameidata *ndp, struct vnode *dp)
245 {
246 struct nameicap_tracker *nt;
247 struct mount *mp;
248
249 if (dp == NULL || dp->v_type != VDIR || (ndp->ni_lcf &
250 NI_LCF_STRICTREL) == 0)
251 return (0);
252 if (__predict_false((ndp->ni_lcf & (NI_LCF_STRICTREL_KTR |
253 NI_LCF_CAP_DOTDOT_KTR)) == NI_LCF_STRICTREL_KTR))
254 NI_CAP_VIOLATION(ndp, ndp->ni_cnd.cn_pnbuf);
255 if ((ndp->ni_lcf & NI_LCF_CAP_DOTDOT) == 0)
256 return (ENOTCAPABLE);
257 mp = dp->v_mount;
258 if (lookup_cap_dotdot_nonlocal == 0 && mp != NULL &&
259 (mp->mnt_flag & MNT_LOCAL) == 0)
260 goto capfail;
261 TAILQ_FOREACH_REVERSE(nt, &ndp->ni_cap_tracker, nameicap_tracker_head,
262 nm_link) {
263 if (dp == nt->dp) {
264 nt = TAILQ_NEXT(nt, nm_link);
265 if (nt != NULL)
266 nameicap_cleanup_from(ndp, nt);
267 return (0);
268 }
269 }
270
271 capfail:
272 if (__predict_false((ndp->ni_lcf & NI_LCF_STRICTREL_KTR) != 0))
273 NI_CAP_VIOLATION(ndp, ndp->ni_cnd.cn_pnbuf);
274 return (ENOTCAPABLE);
275 }
276
277 static void
namei_cleanup_cnp(struct componentname * cnp)278 namei_cleanup_cnp(struct componentname *cnp)
279 {
280
281 uma_zfree(namei_zone, cnp->cn_pnbuf);
282 cnp->cn_pnbuf = NULL;
283 cnp->cn_nameptr = NULL;
284 }
285
286 static int
namei_handle_root(struct nameidata * ndp,struct vnode ** dpp)287 namei_handle_root(struct nameidata *ndp, struct vnode **dpp)
288 {
289 struct componentname *cnp;
290
291 cnp = &ndp->ni_cnd;
292 if (__predict_false((ndp->ni_lcf & (NI_LCF_STRICTREL |
293 NI_LCF_STRICTREL_KTR)) != 0)) {
294 if ((ndp->ni_lcf & NI_LCF_STRICTREL_KTR) != 0)
295 NI_CAP_VIOLATION(ndp, cnp->cn_pnbuf);
296 if ((ndp->ni_lcf & NI_LCF_STRICTREL) != 0)
297 return (ENOTCAPABLE);
298 }
299 while (*(cnp->cn_nameptr) == '/') {
300 cnp->cn_nameptr++;
301 ndp->ni_pathlen--;
302 }
303 *dpp = ndp->ni_rootdir;
304 vrefact(*dpp);
305 return (0);
306 }
307
308 static int
namei_setup(struct nameidata * ndp,struct vnode ** dpp,struct pwd ** pwdp)309 namei_setup(struct nameidata *ndp, struct vnode **dpp, struct pwd **pwdp)
310 {
311 struct componentname *cnp;
312 struct thread *td;
313 struct pwd *pwd;
314 int error;
315 bool startdir_used;
316
317 cnp = &ndp->ni_cnd;
318 td = curthread;
319
320 startdir_used = false;
321 *pwdp = NULL;
322 *dpp = NULL;
323
324 #ifdef CAPABILITY_MODE
325 /*
326 * In capability mode, lookups must be restricted to happen in
327 * the subtree with the root specified by the file descriptor:
328 * - The root must be real file descriptor, not the pseudo-descriptor
329 * AT_FDCWD.
330 * - The passed path must be relative and not absolute.
331 * - If lookup_cap_dotdot is disabled, path must not contain the
332 * '..' components.
333 * - If lookup_cap_dotdot is enabled, we verify that all '..'
334 * components lookups result in the directories which were
335 * previously walked by us, which prevents an escape from
336 * the relative root.
337 */
338 if ((cnp->cn_flags & NOCAPCHECK) == 0) {
339 if (CAP_TRACING(td)) {
340 ndp->ni_lcf |= NI_LCF_STRICTREL_KTR;
341 if (ndp->ni_dirfd == AT_FDCWD)
342 NI_CAP_VIOLATION(ndp, "AT_FDCWD");
343 }
344 if (IN_CAPABILITY_MODE(td)) {
345 ndp->ni_lcf |= NI_LCF_STRICTREL;
346 ndp->ni_resflags |= NIRES_STRICTREL;
347 if (ndp->ni_dirfd == AT_FDCWD)
348 return (ECAPMODE);
349 }
350 }
351 #endif
352 error = 0;
353
354 /*
355 * Get starting point for the translation.
356 */
357 pwd = pwd_hold(td);
358 /*
359 * The reference on ni_rootdir is acquired in the block below to avoid
360 * back-to-back atomics for absolute lookups.
361 */
362 namei_setup_rootdir(ndp, cnp, pwd);
363 ndp->ni_topdir = pwd->pwd_jdir;
364
365 if (cnp->cn_pnbuf[0] == '/') {
366 ndp->ni_resflags |= NIRES_ABS;
367 error = namei_handle_root(ndp, dpp);
368 } else {
369 if (ndp->ni_startdir != NULL) {
370 *dpp = ndp->ni_startdir;
371 startdir_used = true;
372 } else if (ndp->ni_dirfd == AT_FDCWD) {
373 *dpp = pwd->pwd_cdir;
374 vrefact(*dpp);
375 } else {
376 if (cnp->cn_flags & AUDITVNODE1)
377 AUDIT_ARG_ATFD1(ndp->ni_dirfd);
378 if (cnp->cn_flags & AUDITVNODE2)
379 AUDIT_ARG_ATFD2(ndp->ni_dirfd);
380
381 error = fgetvp_lookup(ndp, dpp);
382 }
383 if (error == 0 && (*dpp)->v_type != VDIR &&
384 (cnp->cn_flags & OPENNAMED) == 0 &&
385 (cnp->cn_pnbuf[0] != '\0' ||
386 (cnp->cn_flags & EMPTYPATH) == 0))
387 error = ENOTDIR;
388 }
389 if (error == 0 && (cnp->cn_flags & RBENEATH) != 0) {
390 if (cnp->cn_pnbuf[0] == '/') {
391 error = ENOTCAPABLE;
392 } else if ((ndp->ni_lcf & NI_LCF_STRICTREL) == 0) {
393 ndp->ni_lcf |= NI_LCF_STRICTREL |
394 NI_LCF_CAP_DOTDOT;
395 }
396 }
397
398 /*
399 * If we are auditing the kernel pathname, save the user pathname.
400 */
401 if (AUDITING_TD(td)) {
402 if (cnp->cn_flags & AUDITVNODE1)
403 AUDIT_ARG_UPATH1_VP(td, ndp->ni_rootdir, *dpp, cnp->cn_pnbuf);
404 if (cnp->cn_flags & AUDITVNODE2)
405 AUDIT_ARG_UPATH2_VP(td, ndp->ni_rootdir, *dpp, cnp->cn_pnbuf);
406 }
407 if (ndp->ni_startdir != NULL && !startdir_used)
408 vrele(ndp->ni_startdir);
409 if (error != 0) {
410 if (*dpp != NULL)
411 vrele(*dpp);
412 pwd_drop(pwd);
413 return (error);
414 }
415 if (lookup_cap_dotdot != 0) {
416 if ((ndp->ni_lcf & NI_LCF_STRICTREL_KTR) != 0)
417 ndp->ni_lcf |= NI_LCF_CAP_DOTDOT_KTR;
418 if ((ndp->ni_lcf & NI_LCF_STRICTREL) != 0)
419 ndp->ni_lcf |= NI_LCF_CAP_DOTDOT;
420 }
421 SDT_PROBE4(vfs, namei, lookup, entry, *dpp, cnp->cn_pnbuf,
422 cnp->cn_flags, false);
423 *pwdp = pwd;
424 return (0);
425 }
426
427 static int
namei_getpath(struct nameidata * ndp)428 namei_getpath(struct nameidata *ndp)
429 {
430 struct componentname *cnp;
431 int error;
432
433 cnp = &ndp->ni_cnd;
434
435 /*
436 * Get a buffer for the name to be translated, and copy the
437 * name into the buffer.
438 */
439 cnp->cn_pnbuf = uma_zalloc(namei_zone, M_WAITOK);
440 if (ndp->ni_segflg == UIO_SYSSPACE) {
441 error = copystr(ndp->ni_dirp, cnp->cn_pnbuf, MAXPATHLEN,
442 &ndp->ni_pathlen);
443 } else {
444 error = copyinstr(ndp->ni_dirp, cnp->cn_pnbuf, MAXPATHLEN,
445 &ndp->ni_pathlen);
446 }
447
448 return (error);
449 }
450
451 static int
namei_emptypath(struct nameidata * ndp)452 namei_emptypath(struct nameidata *ndp)
453 {
454 struct componentname *cnp;
455 struct pwd *pwd;
456 struct vnode *dp;
457 int error;
458
459 cnp = &ndp->ni_cnd;
460 MPASS(*cnp->cn_pnbuf == '\0');
461 MPASS((cnp->cn_flags & EMPTYPATH) != 0);
462 MPASS((cnp->cn_flags & (LOCKPARENT | WANTPARENT)) == 0);
463
464 ndp->ni_resflags |= NIRES_EMPTYPATH;
465 error = namei_setup(ndp, &dp, &pwd);
466 if (error != 0) {
467 goto errout;
468 }
469
470 /*
471 * Usecount on dp already provided by namei_setup.
472 */
473 ndp->ni_vp = dp;
474 pwd_drop(pwd);
475 NDVALIDATE(ndp);
476 if ((cnp->cn_flags & LOCKLEAF) != 0) {
477 VOP_LOCK(dp, (cnp->cn_flags & LOCKSHARED) != 0 ?
478 LK_SHARED : LK_EXCLUSIVE);
479 if (VN_IS_DOOMED(dp)) {
480 vput(dp);
481 error = ENOENT;
482 goto errout;
483 }
484 }
485 SDT_PROBE4(vfs, namei, lookup, return, 0, ndp->ni_vp, false, ndp);
486 return (0);
487
488 errout:
489 SDT_PROBE4(vfs, namei, lookup, return, error, NULL, false, ndp);
490 namei_cleanup_cnp(cnp);
491 return (error);
492 }
493
494 static int __noinline
namei_follow_link(struct nameidata * ndp)495 namei_follow_link(struct nameidata *ndp)
496 {
497 char *cp;
498 struct iovec aiov;
499 struct uio auio;
500 struct componentname *cnp;
501 struct thread *td;
502 int error, linklen;
503
504 error = 0;
505 cnp = &ndp->ni_cnd;
506 td = curthread;
507
508 if (ndp->ni_loopcnt++ >= MAXSYMLINKS) {
509 error = ELOOP;
510 goto out;
511 }
512 #ifdef MAC
513 if ((cnp->cn_flags & NOMACCHECK) == 0) {
514 error = mac_vnode_check_readlink(td->td_ucred, ndp->ni_vp);
515 if (error != 0)
516 goto out;
517 }
518 #endif
519 if (ndp->ni_pathlen > 1)
520 cp = uma_zalloc(namei_zone, M_WAITOK);
521 else
522 cp = cnp->cn_pnbuf;
523 aiov.iov_base = cp;
524 aiov.iov_len = MAXPATHLEN;
525 auio.uio_iov = &aiov;
526 auio.uio_iovcnt = 1;
527 auio.uio_offset = 0;
528 auio.uio_rw = UIO_READ;
529 auio.uio_segflg = UIO_SYSSPACE;
530 auio.uio_td = td;
531 auio.uio_resid = MAXPATHLEN;
532 error = VOP_READLINK(ndp->ni_vp, &auio, cnp->cn_cred);
533 if (error != 0) {
534 if (ndp->ni_pathlen > 1)
535 uma_zfree(namei_zone, cp);
536 goto out;
537 }
538 linklen = MAXPATHLEN - auio.uio_resid;
539 if (linklen == 0) {
540 if (ndp->ni_pathlen > 1)
541 uma_zfree(namei_zone, cp);
542 error = ENOENT;
543 goto out;
544 }
545 if (linklen + ndp->ni_pathlen > MAXPATHLEN) {
546 if (ndp->ni_pathlen > 1)
547 uma_zfree(namei_zone, cp);
548 error = ENAMETOOLONG;
549 goto out;
550 }
551 if (ndp->ni_pathlen > 1) {
552 bcopy(ndp->ni_next, cp + linklen, ndp->ni_pathlen);
553 uma_zfree(namei_zone, cnp->cn_pnbuf);
554 cnp->cn_pnbuf = cp;
555 } else
556 cnp->cn_pnbuf[linklen] = '\0';
557 ndp->ni_pathlen += linklen;
558 out:
559 return (error);
560 }
561
562 /*
563 * Convert a pathname into a pointer to a locked vnode.
564 *
565 * The FOLLOW flag is set when symbolic links are to be followed
566 * when they occur at the end of the name translation process.
567 * Symbolic links are always followed for all other pathname
568 * components other than the last.
569 *
570 * The segflg defines whether the name is to be copied from user
571 * space or kernel space.
572 *
573 * Overall outline of namei:
574 *
575 * copy in name
576 * get starting directory
577 * while (!done && !error) {
578 * call lookup to search path.
579 * if symbolic link, massage name in buffer and continue
580 * }
581 */
582 int
namei(struct nameidata * ndp)583 namei(struct nameidata *ndp)
584 {
585 struct vnode *dp; /* the directory we are searching */
586 struct componentname *cnp;
587 struct thread *td;
588 struct pwd *pwd;
589 int error;
590 enum cache_fpl_status status;
591
592 cnp = &ndp->ni_cnd;
593 td = curthread;
594 #ifdef INVARIANTS
595 KASSERT((ndp->ni_debugflags & NAMEI_DBG_CALLED) == 0,
596 ("%s: repeated call to namei without NDREINIT", __func__));
597 KASSERT(ndp->ni_debugflags == NAMEI_DBG_INITED,
598 ("%s: bad debugflags %d", __func__, ndp->ni_debugflags));
599 ndp->ni_debugflags |= NAMEI_DBG_CALLED;
600 if (ndp->ni_startdir != NULL)
601 ndp->ni_debugflags |= NAMEI_DBG_HADSTARTDIR;
602 if (cnp->cn_flags & FAILIFEXISTS) {
603 KASSERT(cnp->cn_nameiop == CREATE,
604 ("%s: FAILIFEXISTS passed for op %d", __func__, cnp->cn_nameiop));
605 /*
606 * The limitation below is to restrict hairy corner cases.
607 */
608 KASSERT((cnp->cn_flags & (LOCKPARENT | LOCKLEAF)) == LOCKPARENT,
609 ("%s: FAILIFEXISTS must be passed with LOCKPARENT and without LOCKLEAF",
610 __func__));
611 }
612 #endif
613 ndp->ni_cnd.cn_cred = td->td_ucred;
614 KASSERT(ndp->ni_resflags == 0, ("%s: garbage in ni_resflags: %x",
615 __func__, ndp->ni_resflags));
616 KASSERT(cnp->cn_cred && td->td_proc, ("namei: bad cred/proc"));
617 KASSERT((cnp->cn_flags & NAMEI_INTERNAL_FLAGS) == 0,
618 ("namei: unexpected flags: %#jx",
619 (uintmax_t)(cnp->cn_flags & NAMEI_INTERNAL_FLAGS)));
620 if (cnp->cn_flags & NOCACHE)
621 KASSERT(cnp->cn_nameiop != LOOKUP,
622 ("%s: NOCACHE passed with LOOKUP", __func__));
623 MPASS(ndp->ni_startdir == NULL || ndp->ni_startdir->v_type == VDIR ||
624 ndp->ni_startdir->v_type == VBAD);
625
626 restart:
627 ndp->ni_lcf = 0;
628 ndp->ni_loopcnt = 0;
629 ndp->ni_vp = NULL;
630
631 error = namei_getpath(ndp);
632 if (__predict_false(error != 0)) {
633 namei_cleanup_cnp(cnp);
634 SDT_PROBE4(vfs, namei, lookup, return, error, NULL,
635 false, ndp);
636 return (error);
637 }
638
639 cnp->cn_nameptr = cnp->cn_pnbuf;
640
641 #ifdef KTRACE
642 if (KTRPOINT(td, KTR_NAMEI)) {
643 ktrnamei(cnp->cn_pnbuf);
644 }
645 #endif
646 TSNAMEI(curthread->td_proc->p_pid, cnp->cn_pnbuf);
647
648 /*
649 * First try looking up the target without locking any vnodes.
650 *
651 * We may need to start from scratch or pick up where it left off.
652 */
653 error = cache_fplookup(ndp, &status, &pwd);
654 switch (status) {
655 case CACHE_FPL_STATUS_UNSET:
656 __assert_unreachable();
657 break;
658 case CACHE_FPL_STATUS_HANDLED:
659 if (error == 0)
660 NDVALIDATE(ndp);
661 else if (__predict_false(pwd->pwd_adir != pwd->pwd_rdir &&
662 (cnp->cn_flags & ISRESTARTED) == 0)) {
663 namei_cleanup_cnp(cnp);
664 NDRESTART(ndp);
665 goto restart;
666 }
667 return (error);
668 case CACHE_FPL_STATUS_PARTIAL:
669 TAILQ_INIT(&ndp->ni_cap_tracker);
670 dp = ndp->ni_startdir;
671 break;
672 case CACHE_FPL_STATUS_DESTROYED:
673 ndp->ni_loopcnt = 0;
674 error = namei_getpath(ndp);
675 if (__predict_false(error != 0)) {
676 namei_cleanup_cnp(cnp);
677 return (error);
678 }
679 cnp->cn_nameptr = cnp->cn_pnbuf;
680 /* FALLTHROUGH */
681 case CACHE_FPL_STATUS_ABORTED:
682 TAILQ_INIT(&ndp->ni_cap_tracker);
683 MPASS(ndp->ni_lcf == 0);
684 if (*cnp->cn_pnbuf == '\0') {
685 if ((cnp->cn_flags & EMPTYPATH) != 0) {
686 return (namei_emptypath(ndp));
687 }
688 namei_cleanup_cnp(cnp);
689 SDT_PROBE4(vfs, namei, lookup, return, ENOENT, NULL,
690 false, ndp);
691 return (ENOENT);
692 }
693 error = namei_setup(ndp, &dp, &pwd);
694 if (error != 0) {
695 namei_cleanup_cnp(cnp);
696 return (error);
697 }
698 break;
699 }
700
701 /*
702 * Locked lookup.
703 */
704 for (;;) {
705 ndp->ni_startdir = dp;
706 error = vfs_lookup(ndp);
707 if (error != 0) {
708 if (__predict_false(pwd->pwd_adir != pwd->pwd_rdir &&
709 error == ENOENT &&
710 (cnp->cn_flags & ISRESTARTED) == 0)) {
711 nameicap_cleanup(ndp);
712 pwd_drop(pwd);
713 namei_cleanup_cnp(cnp);
714 NDRESTART(ndp);
715 goto restart;
716 } else
717 goto out;
718 }
719
720 /*
721 * If not a symbolic link, we're done.
722 */
723 if ((cnp->cn_flags & ISSYMLINK) == 0) {
724 SDT_PROBE4(vfs, namei, lookup, return, error,
725 ndp->ni_vp, false, ndp);
726 nameicap_cleanup(ndp);
727 pwd_drop(pwd);
728 NDVALIDATE(ndp);
729 return (0);
730 }
731 error = namei_follow_link(ndp);
732 if (error != 0)
733 break;
734 vput(ndp->ni_vp);
735 dp = ndp->ni_dvp;
736 /*
737 * Check if root directory should replace current directory.
738 */
739 cnp->cn_nameptr = cnp->cn_pnbuf;
740 if (*(cnp->cn_nameptr) == '/') {
741 /*
742 * Reset the lookup to start from the real root without
743 * origin path name reloading.
744 */
745 if (__predict_false(ndp->ni_rootdir != pwd->pwd_rdir)) {
746 cnp->cn_flags |= ISRESTARTED;
747 ndp->ni_rootdir = pwd->pwd_rdir;
748 }
749 vrele(dp);
750 error = namei_handle_root(ndp, &dp);
751 if (error != 0)
752 goto out;
753 }
754 }
755 vput(ndp->ni_vp);
756 ndp->ni_vp = NULL;
757 vrele(ndp->ni_dvp);
758 out:
759 MPASS(error != 0);
760 SDT_PROBE4(vfs, namei, lookup, return, error, NULL, false, ndp);
761 namei_cleanup_cnp(cnp);
762 nameicap_cleanup(ndp);
763 pwd_drop(pwd);
764 return (error);
765 }
766
767 static int
enforce_lkflags(struct mount * mp,int lkflags)768 enforce_lkflags(struct mount *mp, int lkflags)
769 {
770
771 if (mp == NULL || ((lkflags & LK_SHARED) &&
772 !(mp->mnt_kern_flag & MNTK_LOOKUP_SHARED))) {
773 lkflags &= ~LK_SHARED;
774 lkflags |= LK_EXCLUSIVE;
775 }
776 lkflags |= LK_NODDLKTREAT;
777 return (lkflags);
778 }
779
780 static __inline int
needs_exclusive_leaf(struct mount * mp,int flags)781 needs_exclusive_leaf(struct mount *mp, int flags)
782 {
783
784 /*
785 * Intermediate nodes can use shared locks, we only need to
786 * force an exclusive lock for leaf nodes.
787 */
788 if ((flags & (ISLASTCN | LOCKLEAF)) != (ISLASTCN | LOCKLEAF))
789 return (0);
790
791 /* Always use exclusive locks if LOCKSHARED isn't set. */
792 if (!(flags & LOCKSHARED))
793 return (1);
794
795 /*
796 * For lookups during open(), if the mount point supports
797 * extended shared operations, then use a shared lock for the
798 * leaf node, otherwise use an exclusive lock.
799 */
800 if ((flags & ISOPEN) != 0)
801 return (!MNT_EXTENDED_SHARED(mp));
802
803 /*
804 * Lookup requests outside of open() that specify LOCKSHARED
805 * only need a shared lock on the leaf vnode.
806 */
807 return (0);
808 }
809
810 /*
811 * Various filesystems expect to be able to copy a name component with length
812 * bounded by NAME_MAX into a directory entry buffer of size MAXNAMLEN. Make
813 * sure that these are the same size.
814 */
815 _Static_assert(MAXNAMLEN == NAME_MAX,
816 "MAXNAMLEN and NAME_MAX have different values");
817
818 static int __noinline
vfs_lookup_degenerate(struct nameidata * ndp,struct vnode * dp,int wantparent)819 vfs_lookup_degenerate(struct nameidata *ndp, struct vnode *dp, int wantparent)
820 {
821 struct componentname *cnp;
822 struct mount *mp;
823 int error;
824
825 cnp = &ndp->ni_cnd;
826
827 cnp->cn_flags |= ISLASTCN;
828
829 mp = atomic_load_ptr(&dp->v_mount);
830 if (needs_exclusive_leaf(mp, cnp->cn_flags)) {
831 cnp->cn_lkflags &= ~LK_SHARED;
832 cnp->cn_lkflags |= LK_EXCLUSIVE;
833 }
834
835 vn_lock(dp, enforce_lkflags(mp, cnp->cn_lkflags | LK_RETRY));
836
837 if (dp->v_type != VDIR) {
838 error = ENOTDIR;
839 goto bad;
840 }
841 if (cnp->cn_nameiop != LOOKUP) {
842 error = EISDIR;
843 goto bad;
844 }
845 if (wantparent) {
846 ndp->ni_dvp = dp;
847 VREF(dp);
848 }
849 ndp->ni_vp = dp;
850 cnp->cn_namelen = 0;
851
852 if (cnp->cn_flags & AUDITVNODE1)
853 AUDIT_ARG_VNODE1(dp);
854 else if (cnp->cn_flags & AUDITVNODE2)
855 AUDIT_ARG_VNODE2(dp);
856
857 if (!(cnp->cn_flags & (LOCKPARENT | LOCKLEAF)))
858 VOP_UNLOCK(dp);
859 return (0);
860 bad:
861 VOP_UNLOCK(dp);
862 return (error);
863 }
864
865 struct nameidata *
vfs_lookup_nameidata(struct componentname * cnp)866 vfs_lookup_nameidata(struct componentname *cnp)
867 {
868 if ((cnp->cn_flags & NAMEILOOKUP) == 0)
869 return (NULL);
870 return (__containerof(cnp, struct nameidata, ni_cnd));
871 }
872
873 /*
874 * Would a dotdot lookup relative to dvp cause this lookup to cross a jail or
875 * chroot boundary?
876 */
877 bool
vfs_lookup_isroot(struct nameidata * ndp,struct vnode * dvp)878 vfs_lookup_isroot(struct nameidata *ndp, struct vnode *dvp)
879 {
880 for (struct prison *pr = ndp->ni_cnd.cn_cred->cr_prison; pr != NULL;
881 pr = pr->pr_parent) {
882 if (dvp == pr->pr_root)
883 return (true);
884 }
885 return (dvp == ndp->ni_rootdir || dvp == ndp->ni_topdir ||
886 dvp == rootvnode);
887 }
888
889 /*
890 * FAILIFEXISTS handling.
891 *
892 * XXX namei called with LOCKPARENT but not LOCKLEAF has the strange
893 * behaviour of leaving the vnode unlocked if the target is the same
894 * vnode as the parent.
895 */
896 static int __noinline
vfs_lookup_failifexists(struct nameidata * ndp)897 vfs_lookup_failifexists(struct nameidata *ndp)
898 {
899 struct componentname *cnp __diagused;
900
901 cnp = &ndp->ni_cnd;
902
903 MPASS((cnp->cn_flags & ISSYMLINK) == 0);
904 if (ndp->ni_vp == ndp->ni_dvp)
905 vrele(ndp->ni_dvp);
906 else
907 vput(ndp->ni_dvp);
908 vrele(ndp->ni_vp);
909 ndp->ni_dvp = NULL;
910 ndp->ni_vp = NULL;
911 NDFREE_PNBUF(ndp);
912 return (EEXIST);
913 }
914
915 static int __noinline
vfs_lookup_cross_mount(struct nameidata * ndp)916 vfs_lookup_cross_mount(struct nameidata *ndp)
917 {
918 struct componentname *cnp;
919 struct mount *mp;
920 struct vnode *dp, *tdp;
921 int error, crosslkflags;
922 bool crosslock;
923
924 cnp = &ndp->ni_cnd;
925 dp = ndp->ni_vp;
926
927 /*
928 * The vnode has been mounted on, find the root of the mounted
929 * filesystem.
930 */
931 do {
932 mp = dp->v_mountedhere;
933 ASSERT_VOP_LOCKED(dp, __func__);
934 VNPASS((vn_irflag_read(dp) & VIRF_MOUNTPOINT) != 0 && mp != NULL, dp);
935
936 crosslock = (dp->v_vflag & VV_CROSSLOCK) != 0;
937 crosslkflags = enforce_lkflags(mp, cnp->cn_lkflags);
938 if (__predict_false(crosslock)) {
939 /*
940 * We are going to be holding the vnode lock, which
941 * in this case is shared by the root vnode of the
942 * filesystem mounted at mp, across the call to
943 * VFS_ROOT(). Make the situation clear to the
944 * filesystem by passing LK_CANRECURSE if the
945 * lock is held exclusive, or by clearinng
946 * LK_NODDLKTREAT to allow recursion on the shared
947 * lock in the presence of an exclusive waiter.
948 */
949 if (VOP_ISLOCKED(dp) == LK_EXCLUSIVE) {
950 crosslkflags &= ~LK_SHARED;
951 crosslkflags |= LK_EXCLUSIVE | LK_CANRECURSE;
952 } else if ((crosslkflags & LK_EXCLUSIVE) != 0) {
953 error = vn_lock(dp, LK_UPGRADE);
954 if (error != 0) {
955 MPASS(error == ENOENT);
956 vrele(dp);
957 if (dp != ndp->ni_dvp)
958 vput(ndp->ni_dvp);
959 else
960 vrele(ndp->ni_dvp);
961 break;
962 }
963 if (dp->v_mountedhere != mp) {
964 /*
965 * Note that we rely on the
966 * VIRF_MOUNTPOINT loop condition to
967 * ensure we stop iterating if dp is
968 * no longer a mountpoint at all.
969 */
970 continue;
971 }
972 } else
973 crosslkflags &= ~LK_NODDLKTREAT;
974 }
975 if (vfs_busy(mp, 0) != 0)
976 continue;
977 if (__predict_true(!crosslock))
978 vput(dp);
979 if (dp != ndp->ni_dvp)
980 vput(ndp->ni_dvp);
981 else
982 vrele(ndp->ni_dvp);
983 vrefact(vp_crossmp);
984 ndp->ni_dvp = vp_crossmp;
985 error = VFS_ROOT(mp, crosslkflags, &tdp);
986 vfs_unbusy(mp);
987 if (__predict_false(crosslock))
988 vput(dp);
989 if (vn_lock(vp_crossmp, LK_SHARED | LK_NOWAIT))
990 panic("vp_crossmp exclusively locked or reclaimed");
991 if (error != 0)
992 break;
993 ndp->ni_vp = dp = tdp;
994 } while ((vn_irflag_read(dp) & VIRF_MOUNTPOINT) != 0);
995
996 return (error);
997 }
998
999 /*
1000 * Search a pathname.
1001 * This is a very central and rather complicated routine.
1002 *
1003 * The pathname is pointed to by cn_nameptr and is of length ni_pathlen.
1004 * The starting directory is taken from ni_startdir. The pathname is
1005 * descended until done, or a symbolic link is encountered. The cn_flags
1006 * has ISLASTCN or'ed if the path is completed or ISSYMLINK or'ed if a
1007 * symbolic link needing interpretation is encountered.
1008 *
1009 * The cn_nameiop is LOOKUP, CREATE, RENAME, or DELETE depending on
1010 * whether the name is to be looked up, created, renamed, or deleted.
1011 * When CREATE, RENAME, or DELETE is specified, information usable in
1012 * creating, renaming, or deleting a directory entry may be calculated.
1013 * If cn_flags has LOCKPARENT or'ed into it, the parent directory is returned
1014 * locked. If it has WANTPARENT or'ed into it, the parent directory is
1015 * returned unlocked. Otherwise the parent directory is not returned. If
1016 * the target of the pathname exists and LOCKLEAF is or'ed into the cn_flags
1017 * the target is returned locked, otherwise it is returned unlocked.
1018 *
1019 * Overall outline of lookup:
1020 *
1021 * handle degenerate case where name is null string
1022 *
1023 * dirloop:
1024 * identify next component of name at ndp->ni_cnd.cn_nameptr
1025 * handle .. special cases related to capabilities, chroot, jail
1026 * if .. and crossing mount points and on mounted filesys, find parent
1027 * call VOP_LOOKUP routine for next component name
1028 * directory vnode returned in ni_dvp, unlocked unless LOCKPARENT set
1029 * component vnode returned in ni_vp (if it exists), locked.
1030 * if result vnode is mounted on and crossing mount points,
1031 * find mounted on vnode
1032 * if more components of name, do next level at dirloop
1033 * if VOP_LOOKUP returns ERELOOKUP, repeat the same level at dirloop
1034 * return the answer in ni_vp, locked if LOCKLEAF set
1035 * if LOCKPARENT set, return locked parent in ni_dvp
1036 * if WANTPARENT set, return unlocked parent in ni_dvp
1037 */
1038 int
vfs_lookup(struct nameidata * ndp)1039 vfs_lookup(struct nameidata *ndp)
1040 {
1041 char *cp; /* pointer into pathname argument */
1042 char *prev_ni_next; /* saved ndp->ni_next */
1043 char *nulchar; /* location of '\0' in cn_pnbuf */
1044 char *lastchar; /* location of the last character */
1045 struct vnode *dp = NULL; /* the directory we are searching */
1046 struct vnode *tdp; /* saved dp */
1047 size_t prev_ni_pathlen; /* saved ndp->ni_pathlen */
1048 int docache; /* == 0 do not cache last component */
1049 int wantparent; /* 1 => wantparent or lockparent flag */
1050 int rdonly; /* lookup read-only flag bit */
1051 int error = 0;
1052 int relookup = 0; /* do not consume the path component */
1053 struct componentname *cnp = &ndp->ni_cnd;
1054 int lkflags_save;
1055 int ni_dvp_unlocked;
1056
1057 /*
1058 * Setup: break out flag bits into variables.
1059 */
1060 ni_dvp_unlocked = 0;
1061 wantparent = cnp->cn_flags & (LOCKPARENT | WANTPARENT);
1062 KASSERT(cnp->cn_nameiop == LOOKUP || wantparent,
1063 ("CREATE, DELETE, RENAME require LOCKPARENT or WANTPARENT."));
1064 /*
1065 * When set to zero, docache causes the last component of the
1066 * pathname to be deleted from the cache and the full lookup
1067 * of the name to be done (via VOP_CACHEDLOOKUP()). Often
1068 * filesystems need some pre-computed values that are made
1069 * during the full lookup, for instance UFS sets dp->i_offset.
1070 *
1071 * The docache variable is set to zero when requested by the
1072 * NOCACHE flag and for all modifying operations except CREATE.
1073 */
1074 docache = (cnp->cn_flags & NOCACHE) ^ NOCACHE;
1075 if (cnp->cn_nameiop == DELETE ||
1076 (wantparent && cnp->cn_nameiop != CREATE &&
1077 cnp->cn_nameiop != LOOKUP))
1078 docache = 0;
1079 rdonly = cnp->cn_flags & RDONLY;
1080 cnp->cn_flags &= ~ISSYMLINK;
1081 ndp->ni_dvp = NULL;
1082
1083 cnp->cn_lkflags = LK_SHARED;
1084 dp = ndp->ni_startdir;
1085 ndp->ni_startdir = NULLVP;
1086
1087 /*
1088 * Leading slashes, if any, are supposed to be skipped by the caller.
1089 */
1090 MPASS(cnp->cn_nameptr[0] != '/');
1091
1092 /*
1093 * Check for degenerate name (e.g. / or "") which is a way of talking
1094 * about a directory, e.g. like "/." or ".".
1095 */
1096 if (__predict_false(cnp->cn_nameptr[0] == '\0')) {
1097 error = vfs_lookup_degenerate(ndp, dp, wantparent);
1098 if (error == 0)
1099 goto success_right_lock;
1100 goto bad_unlocked;
1101 }
1102
1103 /*
1104 * Nul-out trailing slashes (e.g., "foo///" -> "foo").
1105 *
1106 * This must be done before VOP_LOOKUP() because some fs's don't know
1107 * about trailing slashes. Remember if there were trailing slashes to
1108 * handle symlinks, existing non-directories and non-existing files
1109 * that won't be directories specially later.
1110 */
1111 MPASS(ndp->ni_pathlen >= 2);
1112 lastchar = &cnp->cn_nameptr[ndp->ni_pathlen - 2];
1113 if (*lastchar == '/') {
1114 while (lastchar >= cnp->cn_pnbuf) {
1115 *lastchar = '\0';
1116 lastchar--;
1117 ndp->ni_pathlen--;
1118 if (*lastchar != '/') {
1119 break;
1120 }
1121 }
1122 cnp->cn_flags |= TRAILINGSLASH;
1123 }
1124
1125 /*
1126 * We use shared locks until we hit the parent of the last cn then
1127 * we adjust based on the requesting flags.
1128 */
1129 vn_lock(dp,
1130 enforce_lkflags(dp->v_mount, cnp->cn_lkflags | LK_RETRY));
1131
1132 dirloop:
1133 /*
1134 * Search a new directory.
1135 *
1136 * The last component of the filename is left accessible via
1137 * cnp->cn_nameptr. It has to be freed with a call to NDFREE*.
1138 *
1139 * Store / as a temporary sentinel so that we only have one character
1140 * to test for. Pathnames tend to be short so this should not be
1141 * resulting in cache misses.
1142 */
1143 nulchar = &cnp->cn_nameptr[ndp->ni_pathlen - 1];
1144 KASSERT(*nulchar == '\0',
1145 ("%s: expected nul at %p; string [%s]\n", __func__, nulchar,
1146 cnp->cn_pnbuf));
1147 *nulchar = '/';
1148 for (cp = cnp->cn_nameptr; *cp != '/'; cp++) {
1149 KASSERT(*cp != '\0',
1150 ("%s: encountered unexpected nul; string [%s]\n", __func__,
1151 cnp->cn_nameptr));
1152 continue;
1153 }
1154 *nulchar = '\0';
1155 cnp->cn_namelen = cp - cnp->cn_nameptr;
1156 if (__predict_false(cnp->cn_namelen > NAME_MAX)) {
1157 error = ENAMETOOLONG;
1158 goto bad;
1159 }
1160 prev_ni_pathlen = ndp->ni_pathlen;
1161 ndp->ni_pathlen -= cnp->cn_namelen;
1162 KASSERT(ndp->ni_pathlen <= PATH_MAX,
1163 ("%s: ni_pathlen underflow to %zd\n", __func__, ndp->ni_pathlen));
1164 prev_ni_next = ndp->ni_next;
1165 ndp->ni_next = cp;
1166
1167 /*
1168 * Something else should be clearing this.
1169 */
1170 cnp->cn_flags &= ~(ISDOTDOT|ISLASTCN);
1171
1172 cnp->cn_flags |= MAKEENTRY;
1173 if (*cp == '\0' && docache == 0)
1174 cnp->cn_flags &= ~MAKEENTRY;
1175 if (cnp->cn_namelen == 2 &&
1176 cnp->cn_nameptr[1] == '.' && cnp->cn_nameptr[0] == '.')
1177 cnp->cn_flags |= ISDOTDOT;
1178 if (*ndp->ni_next == 0) {
1179 cnp->cn_flags |= ISLASTCN;
1180
1181 if (__predict_false(cnp->cn_namelen == 1 && cnp->cn_nameptr[0] == '.' &&
1182 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME))) {
1183 error = EINVAL;
1184 goto bad;
1185 }
1186 }
1187
1188 nameicap_tracker_add(ndp, dp);
1189
1190 /*
1191 * Make sure degenerate names don't get here, their handling was
1192 * previously found in this spot.
1193 */
1194 MPASS(cnp->cn_nameptr[0] != '\0');
1195
1196 /*
1197 * Handle "..": five special cases.
1198 * 0. If doing a capability lookup and lookup_cap_dotdot is
1199 * disabled, return ENOTCAPABLE.
1200 * 1. Return an error if this is the last component of
1201 * the name and the operation is DELETE or RENAME.
1202 * 2. If at root directory (e.g. after chroot)
1203 * or at absolute root directory
1204 * then ignore it so can't get out.
1205 * 3. If this vnode is the root of a mounted
1206 * filesystem, then replace it with the
1207 * vnode which was mounted on so we take the
1208 * .. in the other filesystem.
1209 * 4. If the vnode is the top directory of
1210 * the jail or chroot, don't let them out.
1211 * 5. If doing a capability lookup and lookup_cap_dotdot is
1212 * enabled, return ENOTCAPABLE if the lookup would escape
1213 * from the initial file descriptor directory. Checks are
1214 * done by ensuring that namei() already traversed the
1215 * result of dotdot lookup.
1216 */
1217 if (cnp->cn_flags & ISDOTDOT) {
1218 if (__predict_false((ndp->ni_lcf & (NI_LCF_STRICTREL_KTR |
1219 NI_LCF_CAP_DOTDOT_KTR)) == NI_LCF_STRICTREL_KTR))
1220 NI_CAP_VIOLATION(ndp, cnp->cn_pnbuf);
1221 if (__predict_false((ndp->ni_lcf & (NI_LCF_STRICTREL |
1222 NI_LCF_CAP_DOTDOT)) == NI_LCF_STRICTREL)) {
1223 error = ENOTCAPABLE;
1224 goto bad;
1225 }
1226 if ((cnp->cn_flags & ISLASTCN) != 0 &&
1227 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) {
1228 error = EINVAL;
1229 goto bad;
1230 }
1231 for (;;) {
1232 bool isroot;
1233
1234 isroot = vfs_lookup_isroot(ndp, dp);
1235 if (__predict_false(isroot && (ndp->ni_lcf &
1236 (NI_LCF_STRICTREL | NI_LCF_STRICTREL_KTR)) != 0)) {
1237 if ((ndp->ni_lcf & NI_LCF_STRICTREL_KTR) != 0)
1238 NI_CAP_VIOLATION(ndp, cnp->cn_pnbuf);
1239 if ((ndp->ni_lcf & NI_LCF_STRICTREL) != 0) {
1240 error = ENOTCAPABLE;
1241 goto capdotdot;
1242 }
1243 }
1244 if (isroot || ((dp->v_vflag & VV_ROOT) != 0 &&
1245 (cnp->cn_flags & NOCROSSMOUNT) != 0)) {
1246 ndp->ni_dvp = dp;
1247 ndp->ni_vp = dp;
1248 VREF(dp);
1249 goto nextname;
1250 }
1251 if ((dp->v_vflag & VV_ROOT) == 0)
1252 break;
1253 if (VN_IS_DOOMED(dp)) { /* forced unmount */
1254 error = ENOENT;
1255 goto bad;
1256 }
1257 tdp = dp;
1258 dp = dp->v_mount->mnt_vnodecovered;
1259 VREF(dp);
1260 vput(tdp);
1261 vn_lock(dp,
1262 enforce_lkflags(dp->v_mount, cnp->cn_lkflags |
1263 LK_RETRY));
1264 error = nameicap_check_dotdot(ndp, dp);
1265 if (error != 0) {
1266 capdotdot:
1267 goto bad;
1268 }
1269 }
1270 }
1271
1272 /*
1273 * We now have a segment name to search for, and a directory to search.
1274 */
1275 unionlookup:
1276 #ifdef MAC
1277 error = mac_vnode_check_lookup(cnp->cn_cred, dp, cnp);
1278 if (__predict_false(error))
1279 goto bad;
1280 #endif
1281 ndp->ni_dvp = dp;
1282 ndp->ni_vp = NULL;
1283 ASSERT_VOP_LOCKED(dp, "lookup");
1284 /*
1285 * If we have a shared lock we may need to upgrade the lock for the
1286 * last operation.
1287 */
1288 if ((cnp->cn_flags & LOCKPARENT) && (cnp->cn_flags & ISLASTCN) &&
1289 dp != vp_crossmp && VOP_ISLOCKED(dp) == LK_SHARED)
1290 vn_lock(dp, LK_UPGRADE|LK_RETRY);
1291 if (VN_IS_DOOMED(dp)) {
1292 error = ENOENT;
1293 goto bad;
1294 }
1295 /*
1296 * If we're looking up the last component and we need an exclusive
1297 * lock, adjust our lkflags.
1298 */
1299 if (needs_exclusive_leaf(dp->v_mount, cnp->cn_flags))
1300 cnp->cn_lkflags = LK_EXCLUSIVE;
1301 lkflags_save = cnp->cn_lkflags;
1302 cnp->cn_lkflags = enforce_lkflags(dp->v_mount, cnp->cn_lkflags);
1303 error = VOP_LOOKUP(dp, &ndp->ni_vp, cnp);
1304 cnp->cn_lkflags = lkflags_save;
1305 if (error != 0) {
1306 KASSERT(ndp->ni_vp == NULL, ("leaf should be empty"));
1307 if ((error == ENOENT) &&
1308 (dp->v_vflag & VV_ROOT) && (dp->v_mount != NULL) &&
1309 (dp->v_mount->mnt_flag & MNT_UNION)) {
1310 tdp = dp;
1311 dp = dp->v_mount->mnt_vnodecovered;
1312 VREF(dp);
1313 vput(tdp);
1314 vn_lock(dp,
1315 enforce_lkflags(dp->v_mount, cnp->cn_lkflags |
1316 LK_RETRY));
1317 nameicap_tracker_add(ndp, dp);
1318 goto unionlookup;
1319 }
1320
1321 if (error == ERELOOKUP) {
1322 vref(dp);
1323 ndp->ni_vp = dp;
1324 error = 0;
1325 relookup = 1;
1326 goto good;
1327 }
1328
1329 if (error != EJUSTRETURN)
1330 goto bad;
1331 /*
1332 * At this point, we know we're at the end of the
1333 * pathname. If creating / renaming, we can consider
1334 * allowing the file or directory to be created / renamed,
1335 * provided we're not on a read-only filesystem.
1336 */
1337 if (rdonly) {
1338 error = EROFS;
1339 goto bad;
1340 }
1341 /* trailing slash only allowed for directories */
1342 if ((cnp->cn_flags & TRAILINGSLASH) &&
1343 !(cnp->cn_flags & WILLBEDIR)) {
1344 error = ENOENT;
1345 goto bad;
1346 }
1347 if ((cnp->cn_flags & LOCKPARENT) == 0)
1348 VOP_UNLOCK(dp);
1349 /*
1350 * We return with ni_vp NULL to indicate that the entry
1351 * doesn't currently exist, leaving a pointer to the
1352 * (possibly locked) directory vnode in ndp->ni_dvp.
1353 */
1354 goto success;
1355 }
1356
1357 good:
1358 dp = ndp->ni_vp;
1359
1360 /*
1361 * Check for symbolic link
1362 */
1363 if ((dp->v_type == VLNK) &&
1364 ((cnp->cn_flags & FOLLOW) || (cnp->cn_flags & TRAILINGSLASH) ||
1365 *ndp->ni_next == '/')) {
1366 cnp->cn_flags |= ISSYMLINK;
1367 if (VN_IS_DOOMED(dp)) {
1368 /*
1369 * We can't know whether the directory was mounted with
1370 * NOSYMFOLLOW, so we can't follow safely.
1371 */
1372 error = ENOENT;
1373 goto bad2;
1374 }
1375 if (dp->v_mount->mnt_flag & MNT_NOSYMFOLLOW) {
1376 error = EACCES;
1377 goto bad2;
1378 }
1379 /*
1380 * Symlink code always expects an unlocked dvp.
1381 */
1382 if (ndp->ni_dvp != ndp->ni_vp) {
1383 VOP_UNLOCK(ndp->ni_dvp);
1384 ni_dvp_unlocked = 1;
1385 }
1386 goto success;
1387 }
1388
1389 if ((vn_irflag_read(dp) & VIRF_MOUNTPOINT) != 0 &&
1390 (cnp->cn_flags & NOCROSSMOUNT) == 0) {
1391 error = vfs_lookup_cross_mount(ndp);
1392 if (error != 0)
1393 goto bad_unlocked;
1394 /*
1395 * FALLTHROUGH to nextname
1396 */
1397 dp = ndp->ni_vp;
1398 }
1399
1400 nextname:
1401 /*
1402 * Not a symbolic link that we will follow. Continue with the
1403 * next component if there is any; otherwise, we're done.
1404 */
1405 KASSERT((cnp->cn_flags & ISLASTCN) || *ndp->ni_next == '/',
1406 ("lookup: invalid path state."));
1407 if (relookup) {
1408 relookup = 0;
1409 ndp->ni_pathlen = prev_ni_pathlen;
1410 ndp->ni_next = prev_ni_next;
1411 if (ndp->ni_dvp != dp)
1412 vput(ndp->ni_dvp);
1413 else
1414 vrele(ndp->ni_dvp);
1415 goto dirloop;
1416 }
1417 if (cnp->cn_flags & ISDOTDOT) {
1418 error = nameicap_check_dotdot(ndp, ndp->ni_vp);
1419 if (error != 0)
1420 goto bad2;
1421 }
1422 if (*ndp->ni_next == '/') {
1423 cnp->cn_nameptr = ndp->ni_next;
1424 while (*cnp->cn_nameptr == '/') {
1425 cnp->cn_nameptr++;
1426 ndp->ni_pathlen--;
1427 }
1428 if (ndp->ni_dvp != dp)
1429 vput(ndp->ni_dvp);
1430 else
1431 vrele(ndp->ni_dvp);
1432 goto dirloop;
1433 }
1434 /*
1435 * If we're processing a path with a trailing slash,
1436 * check that the end result is a directory.
1437 */
1438 if ((cnp->cn_flags & TRAILINGSLASH) && dp->v_type != VDIR) {
1439 error = ENOTDIR;
1440 goto bad2;
1441 }
1442 /*
1443 * Disallow directory write attempts on read-only filesystems.
1444 */
1445 if (rdonly &&
1446 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) {
1447 error = EROFS;
1448 goto bad2;
1449 }
1450 if (!wantparent) {
1451 ni_dvp_unlocked = 2;
1452 if (ndp->ni_dvp != dp)
1453 vput(ndp->ni_dvp);
1454 else
1455 vrele(ndp->ni_dvp);
1456 } else if ((cnp->cn_flags & LOCKPARENT) == 0 && ndp->ni_dvp != dp) {
1457 VOP_UNLOCK(ndp->ni_dvp);
1458 ni_dvp_unlocked = 1;
1459 }
1460
1461 if (cnp->cn_flags & AUDITVNODE1)
1462 AUDIT_ARG_VNODE1(dp);
1463 else if (cnp->cn_flags & AUDITVNODE2)
1464 AUDIT_ARG_VNODE2(dp);
1465
1466 if ((cnp->cn_flags & LOCKLEAF) == 0)
1467 VOP_UNLOCK(dp);
1468 success:
1469 /*
1470 * FIXME: for lookups which only cross a mount point to fetch the
1471 * root vnode, ni_dvp will be set to vp_crossmp. This can be a problem
1472 * if either WANTPARENT or LOCKPARENT is set.
1473 */
1474 /*
1475 * Because of shared lookup we may have the vnode shared locked, but
1476 * the caller may want it to be exclusively locked.
1477 */
1478 if (needs_exclusive_leaf(dp->v_mount, cnp->cn_flags) &&
1479 VOP_ISLOCKED(dp) != LK_EXCLUSIVE) {
1480 vn_lock(dp, LK_UPGRADE | LK_RETRY);
1481 if (VN_IS_DOOMED(dp)) {
1482 error = ENOENT;
1483 goto bad2;
1484 }
1485 }
1486 success_right_lock:
1487 if (ndp->ni_vp != NULL) {
1488 if ((cnp->cn_flags & ISDOTDOT) == 0)
1489 nameicap_tracker_add(ndp, ndp->ni_vp);
1490 if ((cnp->cn_flags & (FAILIFEXISTS | ISSYMLINK)) == FAILIFEXISTS)
1491 return (vfs_lookup_failifexists(ndp));
1492 }
1493 return (0);
1494
1495 bad2:
1496 if (ni_dvp_unlocked != 2) {
1497 if (dp != ndp->ni_dvp && !ni_dvp_unlocked)
1498 vput(ndp->ni_dvp);
1499 else
1500 vrele(ndp->ni_dvp);
1501 }
1502 bad:
1503 vput(dp);
1504 bad_unlocked:
1505 ndp->ni_vp = NULL;
1506 return (error);
1507 }
1508
1509 /*
1510 * relookup - lookup a path name component
1511 * Used by lookup to re-acquire things.
1512 */
1513 int
vfs_relookup(struct vnode * dvp,struct vnode ** vpp,struct componentname * cnp,bool refstart)1514 vfs_relookup(struct vnode *dvp, struct vnode **vpp, struct componentname *cnp,
1515 bool refstart)
1516 {
1517 struct vnode *dp = NULL; /* the directory we are searching */
1518 int rdonly; /* lookup read-only flag bit */
1519 int error = 0;
1520
1521 KASSERT(cnp->cn_flags & ISLASTCN,
1522 ("relookup: Not given last component."));
1523 /*
1524 * Setup: break out flag bits into variables.
1525 */
1526 KASSERT((cnp->cn_flags & (LOCKPARENT | WANTPARENT)) != 0,
1527 ("relookup: parent not wanted"));
1528 rdonly = cnp->cn_flags & RDONLY;
1529 cnp->cn_flags &= ~ISSYMLINK;
1530 dp = dvp;
1531 cnp->cn_lkflags = LK_EXCLUSIVE;
1532 vn_lock(dp, LK_EXCLUSIVE | LK_RETRY);
1533
1534 /*
1535 * Search a new directory.
1536 *
1537 * See a comment in vfs_lookup for cnp->cn_nameptr.
1538 *
1539 * Check for "" which represents the root directory after slash
1540 * removal.
1541 */
1542 if (cnp->cn_nameptr[0] == '\0') {
1543 /*
1544 * Support only LOOKUP for "/" because lookup()
1545 * can't succeed for CREATE, DELETE and RENAME.
1546 */
1547 KASSERT(cnp->cn_nameiop == LOOKUP, ("nameiop must be LOOKUP"));
1548 KASSERT(dp->v_type == VDIR, ("dp is not a directory"));
1549
1550 if (!(cnp->cn_flags & LOCKLEAF))
1551 VOP_UNLOCK(dp);
1552 *vpp = dp;
1553 /* XXX This should probably move to the top of function. */
1554 if (refstart)
1555 panic("lookup: SAVESTART");
1556 return (0);
1557 }
1558
1559 if (cnp->cn_flags & ISDOTDOT)
1560 panic ("relookup: lookup on dot-dot");
1561
1562 /*
1563 * We now have a segment name to search for, and a directory to search.
1564 */
1565 if ((error = VOP_LOOKUP(dp, vpp, cnp)) != 0) {
1566 KASSERT(*vpp == NULL, ("leaf should be empty"));
1567 if (error != EJUSTRETURN)
1568 goto bad;
1569 /*
1570 * If creating and at end of pathname, then can consider
1571 * allowing file to be created.
1572 */
1573 if (rdonly) {
1574 error = EROFS;
1575 goto bad;
1576 }
1577 /* ASSERT(dvp == ndp->ni_startdir) */
1578 if (refstart)
1579 VREF(dvp);
1580 if ((cnp->cn_flags & LOCKPARENT) == 0)
1581 VOP_UNLOCK(dp);
1582 /*
1583 * We return with ni_vp NULL to indicate that the entry
1584 * doesn't currently exist, leaving a pointer to the
1585 * (possibly locked) directory vnode in ndp->ni_dvp.
1586 */
1587 return (0);
1588 }
1589
1590 dp = *vpp;
1591
1592 /*
1593 * Disallow directory write attempts on read-only filesystems.
1594 */
1595 if (rdonly &&
1596 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) {
1597 if (dvp == dp)
1598 vrele(dvp);
1599 else
1600 vput(dvp);
1601 error = EROFS;
1602 goto bad;
1603 }
1604 /*
1605 * Set the parent lock/ref state to the requested state.
1606 */
1607 if ((cnp->cn_flags & LOCKPARENT) == 0 && dvp != dp)
1608 VOP_UNLOCK(dvp);
1609 /*
1610 * Check for symbolic link
1611 */
1612 KASSERT(dp->v_type != VLNK || !(cnp->cn_flags & FOLLOW),
1613 ("relookup: symlink found.\n"));
1614
1615 /* ASSERT(dvp == ndp->ni_startdir) */
1616 if (refstart)
1617 VREF(dvp);
1618
1619 if ((cnp->cn_flags & LOCKLEAF) == 0)
1620 VOP_UNLOCK(dp);
1621 return (0);
1622 bad:
1623 vput(dp);
1624 *vpp = NULL;
1625 return (error);
1626 }
1627
1628 #ifdef INVARIANTS
1629 /*
1630 * Validate the final state of ndp after the lookup.
1631 */
1632 static void
NDVALIDATE_impl(struct nameidata * ndp,int line)1633 NDVALIDATE_impl(struct nameidata *ndp, int line)
1634 {
1635 struct componentname *cnp;
1636
1637 cnp = &ndp->ni_cnd;
1638 if (cnp->cn_pnbuf == NULL)
1639 panic("%s: got no buf! called from %d", __func__, line);
1640 }
1641
1642 #endif
1643