1 // SPDX-License-Identifier: CDDL-1.0
2 /*
3 * This file and its contents are supplied under the terms of the
4 * Common Development and Distribution License ("CDDL"), version 1.0.
5 * You may only use this file in accordance with the terms of version
6 * 1.0 of the CDDL.
7 *
8 * A full copy of the text of the CDDL should have accompanied this
9 * source. A copy of the CDDL is also available via the Internet at
10 * https://opensource.org/license/CDDL-1.0.
11 */
12 /*
13 * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
14 * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
15 */
16
17 #include <sys/types.h>
18 #include <sys/stat.h>
19 #include <sys/avl.h>
20 #include <sys/misc.h>
21 #if defined(_KERNEL)
22 #include <sys/kmem.h>
23 #include <sys/systm.h>
24 #include <sys/sysmacros.h>
25 #include <acl/acl_common.h>
26 #include <sys/debug.h>
27 #else
28 #include <errno.h>
29 #include <stdlib.h>
30 #include <stddef.h>
31 #include <unistd.h>
32 #include <assert.h>
33 #include <grp.h>
34 #include <pwd.h>
35 #include <acl_common.h>
36 #endif
37
38 #define ACE_POSIX_SUPPORTED_BITS (ACE_READ_DATA | \
39 ACE_WRITE_DATA | ACE_APPEND_DATA | ACE_EXECUTE | \
40 ACE_READ_ATTRIBUTES | ACE_READ_ACL | ACE_WRITE_ACL)
41
42
43 #define ACL_SYNCHRONIZE_SET_DENY 0x0000001
44 #define ACL_SYNCHRONIZE_SET_ALLOW 0x0000002
45 #define ACL_SYNCHRONIZE_ERR_DENY 0x0000004
46 #define ACL_SYNCHRONIZE_ERR_ALLOW 0x0000008
47
48 #define ACL_WRITE_OWNER_SET_DENY 0x0000010
49 #define ACL_WRITE_OWNER_SET_ALLOW 0x0000020
50 #define ACL_WRITE_OWNER_ERR_DENY 0x0000040
51 #define ACL_WRITE_OWNER_ERR_ALLOW 0x0000080
52
53 #define ACL_DELETE_SET_DENY 0x0000100
54 #define ACL_DELETE_SET_ALLOW 0x0000200
55 #define ACL_DELETE_ERR_DENY 0x0000400
56 #define ACL_DELETE_ERR_ALLOW 0x0000800
57
58 #define ACL_WRITE_ATTRS_OWNER_SET_DENY 0x0001000
59 #define ACL_WRITE_ATTRS_OWNER_SET_ALLOW 0x0002000
60 #define ACL_WRITE_ATTRS_OWNER_ERR_DENY 0x0004000
61 #define ACL_WRITE_ATTRS_OWNER_ERR_ALLOW 0x0008000
62
63 #define ACL_WRITE_ATTRS_WRITER_SET_DENY 0x0010000
64 #define ACL_WRITE_ATTRS_WRITER_SET_ALLOW 0x0020000
65 #define ACL_WRITE_ATTRS_WRITER_ERR_DENY 0x0040000
66 #define ACL_WRITE_ATTRS_WRITER_ERR_ALLOW 0x0080000
67
68 #define ACL_WRITE_NAMED_WRITER_SET_DENY 0x0100000
69 #define ACL_WRITE_NAMED_WRITER_SET_ALLOW 0x0200000
70 #define ACL_WRITE_NAMED_WRITER_ERR_DENY 0x0400000
71 #define ACL_WRITE_NAMED_WRITER_ERR_ALLOW 0x0800000
72
73 #define ACL_READ_NAMED_READER_SET_DENY 0x1000000
74 #define ACL_READ_NAMED_READER_SET_ALLOW 0x2000000
75 #define ACL_READ_NAMED_READER_ERR_DENY 0x4000000
76 #define ACL_READ_NAMED_READER_ERR_ALLOW 0x8000000
77
78
79 #define ACE_VALID_MASK_BITS (\
80 ACE_READ_DATA | \
81 ACE_LIST_DIRECTORY | \
82 ACE_WRITE_DATA | \
83 ACE_ADD_FILE | \
84 ACE_APPEND_DATA | \
85 ACE_ADD_SUBDIRECTORY | \
86 ACE_READ_NAMED_ATTRS | \
87 ACE_WRITE_NAMED_ATTRS | \
88 ACE_EXECUTE | \
89 ACE_DELETE_CHILD | \
90 ACE_READ_ATTRIBUTES | \
91 ACE_WRITE_ATTRIBUTES | \
92 ACE_DELETE | \
93 ACE_READ_ACL | \
94 ACE_WRITE_ACL | \
95 ACE_WRITE_OWNER | \
96 ACE_SYNCHRONIZE)
97
98 #define ACE_MASK_UNDEFINED 0x80000000
99
100 #define ACE_VALID_FLAG_BITS (ACE_FILE_INHERIT_ACE | \
101 ACE_DIRECTORY_INHERIT_ACE | \
102 ACE_NO_PROPAGATE_INHERIT_ACE | ACE_INHERIT_ONLY_ACE | \
103 ACE_SUCCESSFUL_ACCESS_ACE_FLAG | ACE_FAILED_ACCESS_ACE_FLAG | \
104 ACE_IDENTIFIER_GROUP | ACE_OWNER | ACE_GROUP | ACE_EVERYONE)
105
106 /*
107 * ACL conversion helpers
108 */
109
110 typedef enum {
111 ace_unused,
112 ace_user_obj,
113 ace_user,
114 ace_group, /* includes GROUP and GROUP_OBJ */
115 ace_other_obj
116 } ace_to_aent_state_t;
117
118 typedef struct acevals {
119 uid_t key;
120 avl_node_t avl;
121 uint32_t mask;
122 uint32_t allowed;
123 uint32_t denied;
124 int aent_type;
125 } acevals_t;
126
127 typedef struct ace_list {
128 acevals_t user_obj;
129 avl_tree_t user;
130 int numusers;
131 acevals_t group_obj;
132 avl_tree_t group;
133 int numgroups;
134 acevals_t other_obj;
135 uint32_t acl_mask;
136 int hasmask;
137 int dfacl_flag;
138 ace_to_aent_state_t state;
139 int seen; /* bitmask of all aclent_t a_type values seen */
140 } ace_list_t;
141
142 /*
143 * Generic shellsort, from K&R (1st ed, p 58.), somewhat modified.
144 * v = Ptr to array/vector of objs
145 * n = # objs in the array
146 * s = size of each obj (must be multiples of a word size)
147 * f = ptr to function to compare two objs
148 * returns (-1 = less than, 0 = equal, 1 = greater than
149 */
150 void
ksort(caddr_t v,int n,int s,int (* f)(void *,void *))151 ksort(caddr_t v, int n, int s, int (*f)(void *, void *))
152 {
153 int g, i, j, ii;
154 unsigned int *p1, *p2;
155 unsigned int tmp;
156
157 /* No work to do */
158 if (v == NULL || n <= 1)
159 return;
160
161 /* Sanity check on arguments */
162 ASSERT3U(((uintptr_t)v & 0x3), ==, 0);
163 ASSERT3S((s & 0x3), ==, 0);
164 ASSERT3S(s, >, 0);
165 for (g = n / 2; g > 0; g /= 2) {
166 for (i = g; i < n; i++) {
167 for (j = i - g; j >= 0 &&
168 (*f)(v + j * s, v + (j + g) * s) == 1;
169 j -= g) {
170 p1 = (void *)(v + j * s);
171 p2 = (void *)(v + (j + g) * s);
172 for (ii = 0; ii < s / 4; ii++) {
173 tmp = *p1;
174 *p1++ = *p2;
175 *p2++ = tmp;
176 }
177 }
178 }
179 }
180 }
181
182 /*
183 * Compare two acls, all fields. Returns:
184 * -1 (less than)
185 * 0 (equal)
186 * +1 (greater than)
187 */
188 int
cmp2acls(void * a,void * b)189 cmp2acls(void *a, void *b)
190 {
191 aclent_t *x = (aclent_t *)a;
192 aclent_t *y = (aclent_t *)b;
193
194 /* Compare types */
195 if (x->a_type < y->a_type)
196 return (-1);
197 if (x->a_type > y->a_type)
198 return (1);
199 /* Equal types; compare id's */
200 if (x->a_id < y->a_id)
201 return (-1);
202 if (x->a_id > y->a_id)
203 return (1);
204 /* Equal ids; compare perms */
205 if (x->a_perm < y->a_perm)
206 return (-1);
207 if (x->a_perm > y->a_perm)
208 return (1);
209 /* Totally equal */
210 return (0);
211 }
212
213 static int
cacl_malloc(void ** ptr,size_t size)214 cacl_malloc(void **ptr, size_t size)
215 {
216 *ptr = kmem_zalloc(size, KM_SLEEP);
217 return (0);
218 }
219
220
221 #if !defined(_KERNEL)
222 acl_t *
acl_alloc(enum acl_type type)223 acl_alloc(enum acl_type type)
224 {
225 acl_t *aclp;
226
227 if (cacl_malloc((void **)&aclp, sizeof (acl_t)) != 0)
228 return (NULL);
229
230 aclp->acl_aclp = NULL;
231 aclp->acl_cnt = 0;
232
233 switch (type) {
234 case ACE_T:
235 aclp->acl_type = ACE_T;
236 aclp->acl_entry_size = sizeof (ace_t);
237 break;
238 case ACLENT_T:
239 aclp->acl_type = ACLENT_T;
240 aclp->acl_entry_size = sizeof (aclent_t);
241 break;
242 default:
243 acl_free(aclp);
244 aclp = NULL;
245 }
246 return (aclp);
247 }
248
249 /*
250 * Free acl_t structure
251 */
252 void
acl_free(acl_t * aclp)253 acl_free(acl_t *aclp)
254 {
255 int acl_size;
256
257 if (aclp == NULL)
258 return;
259
260 if (aclp->acl_aclp) {
261 acl_size = aclp->acl_cnt * aclp->acl_entry_size;
262 cacl_free(aclp->acl_aclp, acl_size);
263 }
264
265 cacl_free(aclp, sizeof (acl_t));
266 }
267
268 static uint32_t
access_mask_set(int haswriteperm,int hasreadperm,int isowner,int isallow)269 access_mask_set(int haswriteperm, int hasreadperm, int isowner, int isallow)
270 {
271 uint32_t access_mask = 0;
272 int acl_produce;
273 int synchronize_set = 0, write_owner_set = 0;
274 int delete_set = 0, write_attrs_set = 0;
275 int read_named_set = 0, write_named_set = 0;
276
277 acl_produce = (ACL_SYNCHRONIZE_SET_ALLOW |
278 ACL_WRITE_ATTRS_OWNER_SET_ALLOW |
279 ACL_WRITE_ATTRS_WRITER_SET_DENY);
280
281 if (isallow) {
282 synchronize_set = ACL_SYNCHRONIZE_SET_ALLOW;
283 write_owner_set = ACL_WRITE_OWNER_SET_ALLOW;
284 delete_set = ACL_DELETE_SET_ALLOW;
285 if (hasreadperm)
286 read_named_set = ACL_READ_NAMED_READER_SET_ALLOW;
287 if (haswriteperm)
288 write_named_set = ACL_WRITE_NAMED_WRITER_SET_ALLOW;
289 if (isowner)
290 write_attrs_set = ACL_WRITE_ATTRS_OWNER_SET_ALLOW;
291 else if (haswriteperm)
292 write_attrs_set = ACL_WRITE_ATTRS_WRITER_SET_ALLOW;
293 } else {
294
295 synchronize_set = ACL_SYNCHRONIZE_SET_DENY;
296 write_owner_set = ACL_WRITE_OWNER_SET_DENY;
297 delete_set = ACL_DELETE_SET_DENY;
298 if (hasreadperm)
299 read_named_set = ACL_READ_NAMED_READER_SET_DENY;
300 if (haswriteperm)
301 write_named_set = ACL_WRITE_NAMED_WRITER_SET_DENY;
302 if (isowner)
303 write_attrs_set = ACL_WRITE_ATTRS_OWNER_SET_DENY;
304 else if (haswriteperm)
305 write_attrs_set = ACL_WRITE_ATTRS_WRITER_SET_DENY;
306 else
307 /*
308 * If the entity is not the owner and does not
309 * have write permissions ACE_WRITE_ATTRIBUTES will
310 * always go in the DENY ACE.
311 */
312 access_mask |= ACE_WRITE_ATTRIBUTES;
313 }
314
315 if (acl_produce & synchronize_set)
316 access_mask |= ACE_SYNCHRONIZE;
317 if (acl_produce & write_owner_set)
318 access_mask |= ACE_WRITE_OWNER;
319 if (acl_produce & delete_set)
320 access_mask |= ACE_DELETE;
321 if (acl_produce & write_attrs_set)
322 access_mask |= ACE_WRITE_ATTRIBUTES;
323 if (acl_produce & read_named_set)
324 access_mask |= ACE_READ_NAMED_ATTRS;
325 if (acl_produce & write_named_set)
326 access_mask |= ACE_WRITE_NAMED_ATTRS;
327
328 return (access_mask);
329 }
330
331 /*
332 * Given an mode_t, convert it into an access_mask as used
333 * by nfsace, assuming aclent_t -> nfsace semantics.
334 */
335 static uint32_t
mode_to_ace_access(mode_t mode,boolean_t isdir,int isowner,int isallow)336 mode_to_ace_access(mode_t mode, boolean_t isdir, int isowner, int isallow)
337 {
338 uint32_t access = 0;
339 int haswriteperm = 0;
340 int hasreadperm = 0;
341
342 if (isallow) {
343 haswriteperm = (mode & S_IWOTH);
344 hasreadperm = (mode & S_IROTH);
345 } else {
346 haswriteperm = !(mode & S_IWOTH);
347 hasreadperm = !(mode & S_IROTH);
348 }
349
350 /*
351 * The following call takes care of correctly setting the following
352 * mask bits in the access_mask:
353 * ACE_SYNCHRONIZE, ACE_WRITE_OWNER, ACE_DELETE,
354 * ACE_WRITE_ATTRIBUTES, ACE_WRITE_NAMED_ATTRS, ACE_READ_NAMED_ATTRS
355 */
356 access = access_mask_set(haswriteperm, hasreadperm, isowner, isallow);
357
358 if (isallow) {
359 access |= ACE_READ_ACL | ACE_READ_ATTRIBUTES;
360 if (isowner)
361 access |= ACE_WRITE_ACL;
362 } else {
363 if (! isowner)
364 access |= ACE_WRITE_ACL;
365 }
366
367 /* read */
368 if (mode & S_IROTH) {
369 access |= ACE_READ_DATA;
370 }
371 /* write */
372 if (mode & S_IWOTH) {
373 access |= ACE_WRITE_DATA |
374 ACE_APPEND_DATA;
375 if (isdir)
376 access |= ACE_DELETE_CHILD;
377 }
378 /* exec */
379 if (mode & S_IXOTH) {
380 access |= ACE_EXECUTE;
381 }
382
383 return (access);
384 }
385
386 /*
387 * Given an nfsace (presumably an ALLOW entry), make a
388 * corresponding DENY entry at the address given.
389 */
390 static void
ace_make_deny(ace_t * allow,ace_t * deny,int isdir,int isowner)391 ace_make_deny(ace_t *allow, ace_t *deny, int isdir, int isowner)
392 {
393 (void) memcpy(deny, allow, sizeof (ace_t));
394
395 deny->a_who = allow->a_who;
396
397 deny->a_type = ACE_ACCESS_DENIED_ACE_TYPE;
398 deny->a_access_mask ^= ACE_POSIX_SUPPORTED_BITS;
399 if (isdir)
400 deny->a_access_mask ^= ACE_DELETE_CHILD;
401
402 deny->a_access_mask &= ~(ACE_SYNCHRONIZE | ACE_WRITE_OWNER |
403 ACE_DELETE | ACE_WRITE_ATTRIBUTES | ACE_READ_NAMED_ATTRS |
404 ACE_WRITE_NAMED_ATTRS);
405 deny->a_access_mask |= access_mask_set((allow->a_access_mask &
406 ACE_WRITE_DATA), (allow->a_access_mask & ACE_READ_DATA), isowner,
407 B_FALSE);
408 }
409 /*
410 * Make an initial pass over an array of aclent_t's. Gather
411 * information such as an ACL_MASK (if any), number of users,
412 * number of groups, and whether the array needs to be sorted.
413 */
414 static int
ln_aent_preprocess(aclent_t * aclent,int n,int * hasmask,mode_t * mask,int * numuser,int * numgroup,int * needsort)415 ln_aent_preprocess(aclent_t *aclent, int n,
416 int *hasmask, mode_t *mask,
417 int *numuser, int *numgroup, int *needsort)
418 {
419 int error = 0;
420 int i;
421 int curtype = 0;
422
423 *hasmask = 0;
424 *mask = 07;
425 *needsort = 0;
426 *numuser = 0;
427 *numgroup = 0;
428
429 for (i = 0; i < n; i++) {
430 if (aclent[i].a_type < curtype)
431 *needsort = 1;
432 else if (aclent[i].a_type > curtype)
433 curtype = aclent[i].a_type;
434 if (aclent[i].a_type & USER)
435 (*numuser)++;
436 if (aclent[i].a_type & (GROUP | GROUP_OBJ))
437 (*numgroup)++;
438 if (aclent[i].a_type & CLASS_OBJ) {
439 if (*hasmask) {
440 error = EINVAL;
441 goto out;
442 } else {
443 *hasmask = 1;
444 *mask = aclent[i].a_perm;
445 }
446 }
447 }
448
449 if ((! *hasmask) && (*numuser + *numgroup > 1)) {
450 error = EINVAL;
451 goto out;
452 }
453
454 out:
455 return (error);
456 }
457
458 /*
459 * Convert an array of aclent_t into an array of nfsace entries,
460 * following POSIX draft -> nfsv4 conversion semantics as outlined in
461 * the IETF draft.
462 */
463 static int
ln_aent_to_ace(aclent_t * aclent,int n,ace_t ** acepp,int * rescount,int isdir)464 ln_aent_to_ace(aclent_t *aclent, int n, ace_t **acepp, int *rescount, int isdir)
465 {
466 int error = 0;
467 mode_t mask;
468 int numuser, numgroup, needsort;
469 int resultsize = 0;
470 int i, groupi = 0, skip;
471 ace_t *acep, *result = NULL;
472 int hasmask;
473
474 error = ln_aent_preprocess(aclent, n, &hasmask, &mask,
475 &numuser, &numgroup, &needsort);
476 if (error != 0)
477 goto out;
478
479 /* allow + deny for each aclent */
480 resultsize = n * 2;
481 if (hasmask) {
482 /*
483 * stick extra deny on the group_obj and on each
484 * user|group for the mask (the group_obj was added
485 * into the count for numgroup)
486 */
487 resultsize += numuser + numgroup;
488 /* ... and don't count the mask itself */
489 resultsize -= 2;
490 }
491
492 /* sort the source if necessary */
493 if (needsort)
494 ksort((caddr_t)aclent, n, sizeof (aclent_t), cmp2acls);
495
496 if (cacl_malloc((void **)&result, resultsize * sizeof (ace_t)) != 0)
497 goto out;
498
499 acep = result;
500
501 for (i = 0; i < n; i++) {
502 /*
503 * don't process CLASS_OBJ (mask); mask was grabbed in
504 * ln_aent_preprocess()
505 */
506 if (aclent[i].a_type & CLASS_OBJ)
507 continue;
508
509 /* If we need an ACL_MASK emulator, prepend it now */
510 if ((hasmask) &&
511 (aclent[i].a_type & (USER | GROUP | GROUP_OBJ))) {
512 acep->a_type = ACE_ACCESS_DENIED_ACE_TYPE;
513 acep->a_flags = 0;
514 if (aclent[i].a_type & GROUP_OBJ) {
515 acep->a_who = (uid_t)-1;
516 acep->a_flags |=
517 (ACE_IDENTIFIER_GROUP|ACE_GROUP);
518 } else if (aclent[i].a_type & USER) {
519 acep->a_who = aclent[i].a_id;
520 } else {
521 acep->a_who = aclent[i].a_id;
522 acep->a_flags |= ACE_IDENTIFIER_GROUP;
523 }
524 if (aclent[i].a_type & ACL_DEFAULT) {
525 acep->a_flags |= ACE_INHERIT_ONLY_ACE |
526 ACE_FILE_INHERIT_ACE |
527 ACE_DIRECTORY_INHERIT_ACE;
528 }
529 /*
530 * Set the access mask for the prepended deny
531 * ace. To do this, we invert the mask (found
532 * in ln_aent_preprocess()) then convert it to an
533 * DENY ace access_mask.
534 */
535 acep->a_access_mask = mode_to_ace_access((mask ^ 07),
536 isdir, 0, 0);
537 acep += 1;
538 }
539
540 /* handle a_perm -> access_mask */
541 acep->a_access_mask = mode_to_ace_access(aclent[i].a_perm,
542 isdir, aclent[i].a_type & USER_OBJ, 1);
543
544 /* emulate a default aclent */
545 if (aclent[i].a_type & ACL_DEFAULT) {
546 acep->a_flags |= ACE_INHERIT_ONLY_ACE |
547 ACE_FILE_INHERIT_ACE |
548 ACE_DIRECTORY_INHERIT_ACE;
549 }
550
551 /*
552 * handle a_perm and a_id
553 *
554 * this must be done last, since it involves the
555 * corresponding deny aces, which are handled
556 * differently for each different a_type.
557 */
558 if (aclent[i].a_type & USER_OBJ) {
559 acep->a_who = (uid_t)-1;
560 acep->a_flags |= ACE_OWNER;
561 ace_make_deny(acep, acep + 1, isdir, B_TRUE);
562 acep += 2;
563 } else if (aclent[i].a_type & USER) {
564 acep->a_who = aclent[i].a_id;
565 ace_make_deny(acep, acep + 1, isdir, B_FALSE);
566 acep += 2;
567 } else if (aclent[i].a_type & (GROUP_OBJ | GROUP)) {
568 if (aclent[i].a_type & GROUP_OBJ) {
569 acep->a_who = (uid_t)-1;
570 acep->a_flags |= ACE_GROUP;
571 } else {
572 acep->a_who = aclent[i].a_id;
573 }
574 acep->a_flags |= ACE_IDENTIFIER_GROUP;
575 /*
576 * Set the corresponding deny for the group ace.
577 *
578 * The deny aces go after all of the groups, unlike
579 * everything else, where they immediately follow
580 * the allow ace.
581 *
582 * We calculate "skip", the number of slots to
583 * skip ahead for the deny ace, here.
584 *
585 * The pattern is:
586 * MD1 A1 MD2 A2 MD3 A3 D1 D2 D3
587 * thus, skip is
588 * (2 * numgroup) - 1 - groupi
589 * (2 * numgroup) to account for MD + A
590 * - 1 to account for the fact that we're on the
591 * access (A), not the mask (MD)
592 * - groupi to account for the fact that we have
593 * passed up groupi number of MD's.
594 */
595 skip = (2 * numgroup) - 1 - groupi;
596 ace_make_deny(acep, acep + skip, isdir, B_FALSE);
597 /*
598 * If we just did the last group, skip acep past
599 * all of the denies; else, just move ahead one.
600 */
601 if (++groupi >= numgroup)
602 acep += numgroup + 1;
603 else
604 acep += 1;
605 } else if (aclent[i].a_type & OTHER_OBJ) {
606 acep->a_who = (uid_t)-1;
607 acep->a_flags |= ACE_EVERYONE;
608 ace_make_deny(acep, acep + 1, isdir, B_FALSE);
609 acep += 2;
610 } else {
611 error = EINVAL;
612 goto out;
613 }
614 }
615
616 *acepp = result;
617 *rescount = resultsize;
618
619 out:
620 if (error != 0) {
621 if ((result != NULL) && (resultsize > 0)) {
622 cacl_free(result, resultsize * sizeof (ace_t));
623 }
624 }
625
626 return (error);
627 }
628
629 static int
convert_aent_to_ace(aclent_t * aclentp,int aclcnt,boolean_t isdir,ace_t ** retacep,int * retacecnt)630 convert_aent_to_ace(aclent_t *aclentp, int aclcnt, boolean_t isdir,
631 ace_t **retacep, int *retacecnt)
632 {
633 ace_t *acep;
634 ace_t *dfacep;
635 int acecnt = 0;
636 int dfacecnt = 0;
637 int dfaclstart = 0;
638 int dfaclcnt = 0;
639 aclent_t *aclp;
640 int i;
641 int error;
642 int acesz, dfacesz;
643
644 ksort((caddr_t)aclentp, aclcnt, sizeof (aclent_t), cmp2acls);
645
646 for (i = 0, aclp = aclentp; i < aclcnt; aclp++, i++) {
647 if (aclp->a_type & ACL_DEFAULT)
648 break;
649 }
650
651 if (i < aclcnt) {
652 dfaclstart = i;
653 dfaclcnt = aclcnt - i;
654 }
655
656 if (dfaclcnt && !isdir) {
657 return (EINVAL);
658 }
659
660 error = ln_aent_to_ace(aclentp, i, &acep, &acecnt, isdir);
661 if (error)
662 return (error);
663
664 if (dfaclcnt) {
665 error = ln_aent_to_ace(&aclentp[dfaclstart], dfaclcnt,
666 &dfacep, &dfacecnt, isdir);
667 if (error) {
668 if (acep) {
669 cacl_free(acep, acecnt * sizeof (ace_t));
670 }
671 return (error);
672 }
673 }
674
675 if (dfacecnt != 0) {
676 acesz = sizeof (ace_t) * acecnt;
677 dfacesz = sizeof (ace_t) * dfacecnt;
678 acep = cacl_realloc(acep, acesz, acesz + dfacesz);
679 if (acep == NULL)
680 return (ENOMEM);
681 if (dfaclcnt) {
682 (void) memcpy(acep + acecnt, dfacep, dfacesz);
683 }
684 }
685 if (dfaclcnt)
686 cacl_free(dfacep, dfacecnt * sizeof (ace_t));
687
688 *retacecnt = acecnt + dfacecnt;
689 *retacep = acep;
690 return (0);
691 }
692
693 static int
ace_mask_to_mode(uint32_t mask,o_mode_t * modep,boolean_t isdir)694 ace_mask_to_mode(uint32_t mask, o_mode_t *modep, boolean_t isdir)
695 {
696 int error = 0;
697 o_mode_t mode = 0;
698 uint32_t bits, wantbits;
699
700 /* read */
701 if (mask & ACE_READ_DATA)
702 mode |= S_IROTH;
703
704 /* write */
705 wantbits = (ACE_WRITE_DATA | ACE_APPEND_DATA);
706 if (isdir)
707 wantbits |= ACE_DELETE_CHILD;
708 bits = mask & wantbits;
709 if (bits != 0) {
710 if (bits != wantbits) {
711 error = ENOTSUP;
712 goto out;
713 }
714 mode |= S_IWOTH;
715 }
716
717 /* exec */
718 if (mask & ACE_EXECUTE) {
719 mode |= S_IXOTH;
720 }
721
722 *modep = mode;
723
724 out:
725 return (error);
726 }
727
728 static void
acevals_init(acevals_t * vals,uid_t key)729 acevals_init(acevals_t *vals, uid_t key)
730 {
731 memset(vals, 0, sizeof (*vals));
732 vals->allowed = ACE_MASK_UNDEFINED;
733 vals->denied = ACE_MASK_UNDEFINED;
734 vals->mask = ACE_MASK_UNDEFINED;
735 vals->key = key;
736 }
737
738 static void
ace_list_init(ace_list_t * al,int dfacl_flag)739 ace_list_init(ace_list_t *al, int dfacl_flag)
740 {
741 acevals_init(&al->user_obj, 0);
742 acevals_init(&al->group_obj, 0);
743 acevals_init(&al->other_obj, 0);
744 al->numusers = 0;
745 al->numgroups = 0;
746 al->acl_mask = 0;
747 al->hasmask = 0;
748 al->state = ace_unused;
749 al->seen = 0;
750 al->dfacl_flag = dfacl_flag;
751 }
752
753 /*
754 * Find or create an acevals holder for a given id and avl tree.
755 *
756 * Note that only one thread will ever touch these avl trees, so
757 * there is no need for locking.
758 */
759 static acevals_t *
acevals_find(ace_t * ace,avl_tree_t * avl,int * num)760 acevals_find(ace_t *ace, avl_tree_t *avl, int *num)
761 {
762 acevals_t key, *rc;
763 avl_index_t where;
764
765 key.key = ace->a_who;
766 rc = avl_find(avl, &key, &where);
767 if (rc != NULL)
768 return (rc);
769
770 /* this memory is freed by ln_ace_to_aent()->ace_list_free() */
771 if (cacl_malloc((void **)&rc, sizeof (acevals_t)) != 0)
772 return (NULL);
773
774 acevals_init(rc, ace->a_who);
775 avl_insert(avl, rc, where);
776 (*num)++;
777
778 return (rc);
779 }
780
781 static int
access_mask_check(ace_t * acep,int mask_bit,int isowner)782 access_mask_check(ace_t *acep, int mask_bit, int isowner)
783 {
784 int set_deny, err_deny;
785 int set_allow, err_allow;
786 int acl_consume;
787 int haswriteperm, hasreadperm;
788
789 if (acep->a_type == ACE_ACCESS_DENIED_ACE_TYPE) {
790 haswriteperm = (acep->a_access_mask & ACE_WRITE_DATA) ? 0 : 1;
791 hasreadperm = (acep->a_access_mask & ACE_READ_DATA) ? 0 : 1;
792 } else {
793 haswriteperm = (acep->a_access_mask & ACE_WRITE_DATA) ? 1 : 0;
794 hasreadperm = (acep->a_access_mask & ACE_READ_DATA) ? 1 : 0;
795 }
796
797 acl_consume = (ACL_SYNCHRONIZE_ERR_DENY |
798 ACL_DELETE_ERR_DENY |
799 ACL_WRITE_OWNER_ERR_DENY |
800 ACL_WRITE_OWNER_ERR_ALLOW |
801 ACL_WRITE_ATTRS_OWNER_SET_ALLOW |
802 ACL_WRITE_ATTRS_OWNER_ERR_DENY |
803 ACL_WRITE_ATTRS_WRITER_SET_DENY |
804 ACL_WRITE_ATTRS_WRITER_ERR_ALLOW |
805 ACL_WRITE_NAMED_WRITER_ERR_DENY |
806 ACL_READ_NAMED_READER_ERR_DENY);
807
808 if (mask_bit == ACE_SYNCHRONIZE) {
809 set_deny = ACL_SYNCHRONIZE_SET_DENY;
810 err_deny = ACL_SYNCHRONIZE_ERR_DENY;
811 set_allow = ACL_SYNCHRONIZE_SET_ALLOW;
812 err_allow = ACL_SYNCHRONIZE_ERR_ALLOW;
813 } else if (mask_bit == ACE_WRITE_OWNER) {
814 set_deny = ACL_WRITE_OWNER_SET_DENY;
815 err_deny = ACL_WRITE_OWNER_ERR_DENY;
816 set_allow = ACL_WRITE_OWNER_SET_ALLOW;
817 err_allow = ACL_WRITE_OWNER_ERR_ALLOW;
818 } else if (mask_bit == ACE_DELETE) {
819 set_deny = ACL_DELETE_SET_DENY;
820 err_deny = ACL_DELETE_ERR_DENY;
821 set_allow = ACL_DELETE_SET_ALLOW;
822 err_allow = ACL_DELETE_ERR_ALLOW;
823 } else if (mask_bit == ACE_WRITE_ATTRIBUTES) {
824 if (isowner) {
825 set_deny = ACL_WRITE_ATTRS_OWNER_SET_DENY;
826 err_deny = ACL_WRITE_ATTRS_OWNER_ERR_DENY;
827 set_allow = ACL_WRITE_ATTRS_OWNER_SET_ALLOW;
828 err_allow = ACL_WRITE_ATTRS_OWNER_ERR_ALLOW;
829 } else if (haswriteperm) {
830 set_deny = ACL_WRITE_ATTRS_WRITER_SET_DENY;
831 err_deny = ACL_WRITE_ATTRS_WRITER_ERR_DENY;
832 set_allow = ACL_WRITE_ATTRS_WRITER_SET_ALLOW;
833 err_allow = ACL_WRITE_ATTRS_WRITER_ERR_ALLOW;
834 } else {
835 if ((acep->a_access_mask & mask_bit) &&
836 (acep->a_type & ACE_ACCESS_ALLOWED_ACE_TYPE)) {
837 return (ENOTSUP);
838 }
839 return (0);
840 }
841 } else if (mask_bit == ACE_READ_NAMED_ATTRS) {
842 if (!hasreadperm)
843 return (0);
844
845 set_deny = ACL_READ_NAMED_READER_SET_DENY;
846 err_deny = ACL_READ_NAMED_READER_ERR_DENY;
847 set_allow = ACL_READ_NAMED_READER_SET_ALLOW;
848 err_allow = ACL_READ_NAMED_READER_ERR_ALLOW;
849 } else if (mask_bit == ACE_WRITE_NAMED_ATTRS) {
850 if (!haswriteperm)
851 return (0);
852
853 set_deny = ACL_WRITE_NAMED_WRITER_SET_DENY;
854 err_deny = ACL_WRITE_NAMED_WRITER_ERR_DENY;
855 set_allow = ACL_WRITE_NAMED_WRITER_SET_ALLOW;
856 err_allow = ACL_WRITE_NAMED_WRITER_ERR_ALLOW;
857 } else {
858 return (EINVAL);
859 }
860
861 if (acep->a_type == ACE_ACCESS_DENIED_ACE_TYPE) {
862 if (acl_consume & set_deny) {
863 if (!(acep->a_access_mask & mask_bit)) {
864 return (ENOTSUP);
865 }
866 } else if (acl_consume & err_deny) {
867 if (acep->a_access_mask & mask_bit) {
868 return (ENOTSUP);
869 }
870 }
871 } else {
872 /* ACE_ACCESS_ALLOWED_ACE_TYPE */
873 if (acl_consume & set_allow) {
874 if (!(acep->a_access_mask & mask_bit)) {
875 return (ENOTSUP);
876 }
877 } else if (acl_consume & err_allow) {
878 if (acep->a_access_mask & mask_bit) {
879 return (ENOTSUP);
880 }
881 }
882 }
883 return (0);
884 }
885
886 static int
ace_to_aent_legal(ace_t * acep)887 ace_to_aent_legal(ace_t *acep)
888 {
889 int error = 0;
890 int isowner;
891
892 /* only ALLOW or DENY */
893 if ((acep->a_type != ACE_ACCESS_ALLOWED_ACE_TYPE) &&
894 (acep->a_type != ACE_ACCESS_DENIED_ACE_TYPE)) {
895 error = ENOTSUP;
896 goto out;
897 }
898
899 /* check for invalid flags */
900 if (acep->a_flags & ~(ACE_VALID_FLAG_BITS)) {
901 error = EINVAL;
902 goto out;
903 }
904
905 /* some flags are illegal */
906 if (acep->a_flags & (ACE_SUCCESSFUL_ACCESS_ACE_FLAG |
907 ACE_FAILED_ACCESS_ACE_FLAG |
908 ACE_NO_PROPAGATE_INHERIT_ACE)) {
909 error = ENOTSUP;
910 goto out;
911 }
912
913 /* check for invalid masks */
914 if (acep->a_access_mask & ~(ACE_VALID_MASK_BITS)) {
915 error = EINVAL;
916 goto out;
917 }
918
919 if ((acep->a_flags & ACE_OWNER)) {
920 isowner = 1;
921 } else {
922 isowner = 0;
923 }
924
925 error = access_mask_check(acep, ACE_SYNCHRONIZE, isowner);
926 if (error)
927 goto out;
928
929 error = access_mask_check(acep, ACE_WRITE_OWNER, isowner);
930 if (error)
931 goto out;
932
933 error = access_mask_check(acep, ACE_DELETE, isowner);
934 if (error)
935 goto out;
936
937 error = access_mask_check(acep, ACE_WRITE_ATTRIBUTES, isowner);
938 if (error)
939 goto out;
940
941 error = access_mask_check(acep, ACE_READ_NAMED_ATTRS, isowner);
942 if (error)
943 goto out;
944
945 error = access_mask_check(acep, ACE_WRITE_NAMED_ATTRS, isowner);
946 if (error)
947 goto out;
948
949 /* more detailed checking of masks */
950 if (acep->a_type == ACE_ACCESS_ALLOWED_ACE_TYPE) {
951 if (! (acep->a_access_mask & ACE_READ_ATTRIBUTES)) {
952 error = ENOTSUP;
953 goto out;
954 }
955 if ((acep->a_access_mask & ACE_WRITE_DATA) &&
956 (! (acep->a_access_mask & ACE_APPEND_DATA))) {
957 error = ENOTSUP;
958 goto out;
959 }
960 if ((! (acep->a_access_mask & ACE_WRITE_DATA)) &&
961 (acep->a_access_mask & ACE_APPEND_DATA)) {
962 error = ENOTSUP;
963 goto out;
964 }
965 }
966
967 /* ACL enforcement */
968 if ((acep->a_access_mask & ACE_READ_ACL) &&
969 (acep->a_type != ACE_ACCESS_ALLOWED_ACE_TYPE)) {
970 error = ENOTSUP;
971 goto out;
972 }
973 if (acep->a_access_mask & ACE_WRITE_ACL) {
974 if ((acep->a_type == ACE_ACCESS_DENIED_ACE_TYPE) &&
975 (isowner)) {
976 error = ENOTSUP;
977 goto out;
978 }
979 if ((acep->a_type == ACE_ACCESS_ALLOWED_ACE_TYPE) &&
980 (! isowner)) {
981 error = ENOTSUP;
982 goto out;
983 }
984 }
985
986 out:
987 return (error);
988 }
989
990 static int
ace_allow_to_mode(uint32_t mask,o_mode_t * modep,boolean_t isdir)991 ace_allow_to_mode(uint32_t mask, o_mode_t *modep, boolean_t isdir)
992 {
993 /* ACE_READ_ACL and ACE_READ_ATTRIBUTES must both be set */
994 if ((mask & (ACE_READ_ACL | ACE_READ_ATTRIBUTES)) !=
995 (ACE_READ_ACL | ACE_READ_ATTRIBUTES)) {
996 return (ENOTSUP);
997 }
998
999 return (ace_mask_to_mode(mask, modep, isdir));
1000 }
1001
1002 static int
acevals_to_aent(acevals_t * vals,aclent_t * dest,ace_list_t * list,uid_t owner,gid_t group,boolean_t isdir)1003 acevals_to_aent(acevals_t *vals, aclent_t *dest, ace_list_t *list,
1004 uid_t owner, gid_t group, boolean_t isdir)
1005 {
1006 int error;
1007 uint32_t flips = ACE_POSIX_SUPPORTED_BITS;
1008
1009 if (isdir)
1010 flips |= ACE_DELETE_CHILD;
1011 if (vals->allowed != (vals->denied ^ flips)) {
1012 error = ENOTSUP;
1013 goto out;
1014 }
1015 if ((list->hasmask) && (list->acl_mask != vals->mask) &&
1016 (vals->aent_type & (USER | GROUP | GROUP_OBJ))) {
1017 error = ENOTSUP;
1018 goto out;
1019 }
1020 error = ace_allow_to_mode(vals->allowed, &dest->a_perm, isdir);
1021 if (error != 0)
1022 goto out;
1023 dest->a_type = vals->aent_type;
1024 if (dest->a_type & (USER | GROUP)) {
1025 dest->a_id = vals->key;
1026 } else if (dest->a_type & USER_OBJ) {
1027 dest->a_id = owner;
1028 } else if (dest->a_type & GROUP_OBJ) {
1029 dest->a_id = group;
1030 } else if (dest->a_type & OTHER_OBJ) {
1031 dest->a_id = 0;
1032 } else {
1033 error = EINVAL;
1034 goto out;
1035 }
1036
1037 out:
1038 return (error);
1039 }
1040
1041
1042 static int
ace_list_to_aent(ace_list_t * list,aclent_t ** aclentp,int * aclcnt,uid_t owner,gid_t group,boolean_t isdir)1043 ace_list_to_aent(ace_list_t *list, aclent_t **aclentp, int *aclcnt,
1044 uid_t owner, gid_t group, boolean_t isdir)
1045 {
1046 int error = 0;
1047 aclent_t *aent, *result = NULL;
1048 acevals_t *vals;
1049 int resultcount;
1050
1051 if ((list->seen & (USER_OBJ | GROUP_OBJ | OTHER_OBJ)) !=
1052 (USER_OBJ | GROUP_OBJ | OTHER_OBJ)) {
1053 error = ENOTSUP;
1054 goto out;
1055 }
1056 if ((! list->hasmask) && (list->numusers + list->numgroups > 0)) {
1057 error = ENOTSUP;
1058 goto out;
1059 }
1060
1061 resultcount = 3 + list->numusers + list->numgroups;
1062 /*
1063 * This must be the same condition as below, when we add the CLASS_OBJ
1064 * (aka ACL mask)
1065 */
1066 if ((list->hasmask) || (! list->dfacl_flag))
1067 resultcount += 1;
1068
1069 if (cacl_malloc((void **)&result,
1070 resultcount * sizeof (aclent_t)) != 0) {
1071 error = ENOMEM;
1072 goto out;
1073 }
1074 aent = result;
1075
1076 /* USER_OBJ */
1077 if (!(list->user_obj.aent_type & USER_OBJ)) {
1078 error = EINVAL;
1079 goto out;
1080 }
1081
1082 error = acevals_to_aent(&list->user_obj, aent, list, owner, group,
1083 isdir);
1084
1085 if (error != 0)
1086 goto out;
1087 ++aent;
1088 /* USER */
1089 vals = NULL;
1090 for (vals = avl_first(&list->user); vals != NULL;
1091 vals = AVL_NEXT(&list->user, vals)) {
1092 if (!(vals->aent_type & USER)) {
1093 error = EINVAL;
1094 goto out;
1095 }
1096 error = acevals_to_aent(vals, aent, list, owner, group,
1097 isdir);
1098 if (error != 0)
1099 goto out;
1100 ++aent;
1101 }
1102 /* GROUP_OBJ */
1103 if (!(list->group_obj.aent_type & GROUP_OBJ)) {
1104 error = EINVAL;
1105 goto out;
1106 }
1107 error = acevals_to_aent(&list->group_obj, aent, list, owner, group,
1108 isdir);
1109 if (error != 0)
1110 goto out;
1111 ++aent;
1112 /* GROUP */
1113 vals = NULL;
1114 for (vals = avl_first(&list->group); vals != NULL;
1115 vals = AVL_NEXT(&list->group, vals)) {
1116 if (!(vals->aent_type & GROUP)) {
1117 error = EINVAL;
1118 goto out;
1119 }
1120 error = acevals_to_aent(vals, aent, list, owner, group,
1121 isdir);
1122 if (error != 0)
1123 goto out;
1124 ++aent;
1125 }
1126 /*
1127 * CLASS_OBJ (aka ACL_MASK)
1128 *
1129 * An ACL_MASK is not fabricated if the ACL is a default ACL.
1130 * This is to follow UFS's behavior.
1131 */
1132 if ((list->hasmask) || (! list->dfacl_flag)) {
1133 if (list->hasmask) {
1134 uint32_t flips = ACE_POSIX_SUPPORTED_BITS;
1135 if (isdir)
1136 flips |= ACE_DELETE_CHILD;
1137 error = ace_mask_to_mode(list->acl_mask ^ flips,
1138 &aent->a_perm, isdir);
1139 if (error != 0)
1140 goto out;
1141 } else {
1142 /* fabricate the ACL_MASK from the group permissions */
1143 error = ace_mask_to_mode(list->group_obj.allowed,
1144 &aent->a_perm, isdir);
1145 if (error != 0)
1146 goto out;
1147 }
1148 aent->a_id = 0;
1149 aent->a_type = CLASS_OBJ | list->dfacl_flag;
1150 ++aent;
1151 }
1152 /* OTHER_OBJ */
1153 if (!(list->other_obj.aent_type & OTHER_OBJ)) {
1154 error = EINVAL;
1155 goto out;
1156 }
1157 error = acevals_to_aent(&list->other_obj, aent, list, owner, group,
1158 isdir);
1159 if (error != 0)
1160 goto out;
1161 ++aent;
1162
1163 *aclentp = result;
1164 *aclcnt = resultcount;
1165
1166 out:
1167 if (error != 0) {
1168 if (result != NULL)
1169 cacl_free(result, resultcount * sizeof (aclent_t));
1170 }
1171
1172 return (error);
1173 }
1174
1175
1176 /*
1177 * free all data associated with an ace_list
1178 */
1179 static void
ace_list_free(ace_list_t * al)1180 ace_list_free(ace_list_t *al)
1181 {
1182 acevals_t *node;
1183 void *cookie;
1184
1185 if (al == NULL)
1186 return;
1187
1188 cookie = NULL;
1189 while ((node = avl_destroy_nodes(&al->user, &cookie)) != NULL)
1190 cacl_free(node, sizeof (acevals_t));
1191 cookie = NULL;
1192 while ((node = avl_destroy_nodes(&al->group, &cookie)) != NULL)
1193 cacl_free(node, sizeof (acevals_t));
1194
1195 avl_destroy(&al->user);
1196 avl_destroy(&al->group);
1197
1198 /* free the container itself */
1199 cacl_free(al, sizeof (ace_list_t));
1200 }
1201
1202 static int
acevals_compare(const void * va,const void * vb)1203 acevals_compare(const void *va, const void *vb)
1204 {
1205 const acevals_t *a = va, *b = vb;
1206 return (TREE_CMP(a->key, b->key));
1207 }
1208
1209 /*
1210 * Convert a list of ace_t entries to equivalent regular and default
1211 * aclent_t lists. Return error (ENOTSUP) when conversion is not possible.
1212 */
1213 static int
ln_ace_to_aent(ace_t * ace,int n,uid_t owner,gid_t group,aclent_t ** aclentp,int * aclcnt,aclent_t ** dfaclentp,int * dfaclcnt,boolean_t isdir)1214 ln_ace_to_aent(ace_t *ace, int n, uid_t owner, gid_t group,
1215 aclent_t **aclentp, int *aclcnt, aclent_t **dfaclentp, int *dfaclcnt,
1216 boolean_t isdir)
1217 {
1218 int error = 0;
1219 ace_t *acep;
1220 uint32_t bits;
1221 int i;
1222 ace_list_t *normacl = NULL, *dfacl = NULL, *acl;
1223 acevals_t *vals;
1224
1225 *aclentp = NULL;
1226 *aclcnt = 0;
1227 *dfaclentp = NULL;
1228 *dfaclcnt = 0;
1229
1230 /* we need at least user_obj, group_obj, and other_obj */
1231 if (n < 6) {
1232 error = ENOTSUP;
1233 goto out;
1234 }
1235 if (ace == NULL) {
1236 error = EINVAL;
1237 goto out;
1238 }
1239
1240 error = cacl_malloc((void **)&normacl, sizeof (ace_list_t));
1241 if (error != 0)
1242 goto out;
1243
1244 avl_create(&normacl->user, acevals_compare, sizeof (acevals_t),
1245 offsetof(acevals_t, avl));
1246 avl_create(&normacl->group, acevals_compare, sizeof (acevals_t),
1247 offsetof(acevals_t, avl));
1248
1249 ace_list_init(normacl, 0);
1250
1251 error = cacl_malloc((void **)&dfacl, sizeof (ace_list_t));
1252 if (error != 0)
1253 goto out;
1254
1255 avl_create(&dfacl->user, acevals_compare, sizeof (acevals_t),
1256 offsetof(acevals_t, avl));
1257 avl_create(&dfacl->group, acevals_compare, sizeof (acevals_t),
1258 offsetof(acevals_t, avl));
1259 ace_list_init(dfacl, ACL_DEFAULT);
1260
1261 /* process every ace_t... */
1262 for (i = 0; i < n; i++) {
1263 acep = &ace[i];
1264
1265 /* rule out certain cases quickly */
1266 error = ace_to_aent_legal(acep);
1267 if (error != 0)
1268 goto out;
1269
1270 /*
1271 * Turn off these bits in order to not have to worry about
1272 * them when doing the checks for compliments.
1273 */
1274 acep->a_access_mask &= ~(ACE_WRITE_OWNER | ACE_DELETE |
1275 ACE_SYNCHRONIZE | ACE_WRITE_ATTRIBUTES |
1276 ACE_READ_NAMED_ATTRS | ACE_WRITE_NAMED_ATTRS);
1277
1278 /* see if this should be a regular or default acl */
1279 bits = acep->a_flags &
1280 (ACE_INHERIT_ONLY_ACE |
1281 ACE_FILE_INHERIT_ACE |
1282 ACE_DIRECTORY_INHERIT_ACE);
1283 if (bits != 0) {
1284 /* all or nothing on these inherit bits */
1285 if (bits != (ACE_INHERIT_ONLY_ACE |
1286 ACE_FILE_INHERIT_ACE |
1287 ACE_DIRECTORY_INHERIT_ACE)) {
1288 error = ENOTSUP;
1289 goto out;
1290 }
1291 acl = dfacl;
1292 } else {
1293 acl = normacl;
1294 }
1295
1296 if ((acep->a_flags & ACE_OWNER)) {
1297 if (acl->state > ace_user_obj) {
1298 error = ENOTSUP;
1299 goto out;
1300 }
1301 acl->state = ace_user_obj;
1302 acl->seen |= USER_OBJ;
1303 vals = &acl->user_obj;
1304 vals->aent_type = USER_OBJ | acl->dfacl_flag;
1305 } else if ((acep->a_flags & ACE_EVERYONE)) {
1306 acl->state = ace_other_obj;
1307 acl->seen |= OTHER_OBJ;
1308 vals = &acl->other_obj;
1309 vals->aent_type = OTHER_OBJ | acl->dfacl_flag;
1310 } else if (acep->a_flags & ACE_IDENTIFIER_GROUP) {
1311 if (acl->state > ace_group) {
1312 error = ENOTSUP;
1313 goto out;
1314 }
1315 if ((acep->a_flags & ACE_GROUP)) {
1316 acl->seen |= GROUP_OBJ;
1317 vals = &acl->group_obj;
1318 vals->aent_type = GROUP_OBJ | acl->dfacl_flag;
1319 } else {
1320 acl->seen |= GROUP;
1321 vals = acevals_find(acep, &acl->group,
1322 &acl->numgroups);
1323 if (vals == NULL) {
1324 error = ENOMEM;
1325 goto out;
1326 }
1327 vals->aent_type = GROUP | acl->dfacl_flag;
1328 }
1329 acl->state = ace_group;
1330 } else {
1331 if (acl->state > ace_user) {
1332 error = ENOTSUP;
1333 goto out;
1334 }
1335 acl->state = ace_user;
1336 acl->seen |= USER;
1337 vals = acevals_find(acep, &acl->user,
1338 &acl->numusers);
1339 if (vals == NULL) {
1340 error = ENOMEM;
1341 goto out;
1342 }
1343 vals->aent_type = USER | acl->dfacl_flag;
1344 }
1345
1346 if (!(acl->state > ace_unused)) {
1347 error = EINVAL;
1348 goto out;
1349 }
1350
1351 if (acep->a_type == ACE_ACCESS_ALLOWED_ACE_TYPE) {
1352 /* no more than one allowed per aclent_t */
1353 if (vals->allowed != ACE_MASK_UNDEFINED) {
1354 error = ENOTSUP;
1355 goto out;
1356 }
1357 vals->allowed = acep->a_access_mask;
1358 } else {
1359 /*
1360 * it's a DENY; if there was a previous DENY, it
1361 * must have been an ACL_MASK.
1362 */
1363 if (vals->denied != ACE_MASK_UNDEFINED) {
1364 /* ACL_MASK is for USER and GROUP only */
1365 if ((acl->state != ace_user) &&
1366 (acl->state != ace_group)) {
1367 error = ENOTSUP;
1368 goto out;
1369 }
1370
1371 if (! acl->hasmask) {
1372 acl->hasmask = 1;
1373 acl->acl_mask = vals->denied;
1374 /* check for mismatched ACL_MASK emulations */
1375 } else if (acl->acl_mask != vals->denied) {
1376 error = ENOTSUP;
1377 goto out;
1378 }
1379 vals->mask = vals->denied;
1380 }
1381 vals->denied = acep->a_access_mask;
1382 }
1383 }
1384
1385 /* done collating; produce the aclent_t lists */
1386 if (normacl->state != ace_unused) {
1387 error = ace_list_to_aent(normacl, aclentp, aclcnt,
1388 owner, group, isdir);
1389 if (error != 0) {
1390 goto out;
1391 }
1392 }
1393 if (dfacl->state != ace_unused) {
1394 error = ace_list_to_aent(dfacl, dfaclentp, dfaclcnt,
1395 owner, group, isdir);
1396 if (error != 0) {
1397 goto out;
1398 }
1399 }
1400
1401 out:
1402 if (normacl != NULL)
1403 ace_list_free(normacl);
1404 if (dfacl != NULL)
1405 ace_list_free(dfacl);
1406
1407 return (error);
1408 }
1409
1410 static int
convert_ace_to_aent(ace_t * acebufp,int acecnt,boolean_t isdir,uid_t owner,gid_t group,aclent_t ** retaclentp,int * retaclcnt)1411 convert_ace_to_aent(ace_t *acebufp, int acecnt, boolean_t isdir,
1412 uid_t owner, gid_t group, aclent_t **retaclentp, int *retaclcnt)
1413 {
1414 int error = 0;
1415 aclent_t *aclentp, *dfaclentp;
1416 int aclcnt, dfaclcnt;
1417 int aclsz, dfaclsz;
1418
1419 error = ln_ace_to_aent(acebufp, acecnt, owner, group,
1420 &aclentp, &aclcnt, &dfaclentp, &dfaclcnt, isdir);
1421
1422 if (error)
1423 return (error);
1424
1425
1426 if (dfaclcnt != 0) {
1427 /*
1428 * Slap aclentp and dfaclentp into a single array.
1429 */
1430 aclsz = sizeof (aclent_t) * aclcnt;
1431 dfaclsz = sizeof (aclent_t) * dfaclcnt;
1432 aclentp = cacl_realloc(aclentp, aclsz, aclsz + dfaclsz);
1433 if (aclentp != NULL) {
1434 (void) memcpy(aclentp + aclcnt, dfaclentp, dfaclsz);
1435 } else {
1436 error = ENOMEM;
1437 }
1438 }
1439
1440 if (aclentp) {
1441 *retaclentp = aclentp;
1442 *retaclcnt = aclcnt + dfaclcnt;
1443 }
1444
1445 if (dfaclentp)
1446 cacl_free(dfaclentp, dfaclsz);
1447
1448 return (error);
1449 }
1450
1451
1452 int
acl_translate(acl_t * aclp,int target_flavor,boolean_t isdir,uid_t owner,gid_t group)1453 acl_translate(acl_t *aclp, int target_flavor, boolean_t isdir, uid_t owner,
1454 gid_t group)
1455 {
1456 int aclcnt;
1457 void *acldata;
1458 int error;
1459
1460 /*
1461 * See if we need to translate
1462 */
1463 if ((target_flavor == _ACL_ACE_ENABLED && aclp->acl_type == ACE_T) ||
1464 (target_flavor == _ACL_ACLENT_ENABLED &&
1465 aclp->acl_type == ACLENT_T))
1466 return (0);
1467
1468 if (target_flavor == -1) {
1469 error = EINVAL;
1470 goto out;
1471 }
1472
1473 if (target_flavor == _ACL_ACE_ENABLED &&
1474 aclp->acl_type == ACLENT_T) {
1475 error = convert_aent_to_ace(aclp->acl_aclp,
1476 aclp->acl_cnt, isdir, (ace_t **)&acldata, &aclcnt);
1477 if (error)
1478 goto out;
1479
1480 } else if (target_flavor == _ACL_ACLENT_ENABLED &&
1481 aclp->acl_type == ACE_T) {
1482 error = convert_ace_to_aent(aclp->acl_aclp, aclp->acl_cnt,
1483 isdir, owner, group, (aclent_t **)&acldata, &aclcnt);
1484 if (error)
1485 goto out;
1486 } else {
1487 error = ENOTSUP;
1488 goto out;
1489 }
1490
1491 /*
1492 * replace old acl with newly translated acl
1493 */
1494 cacl_free(aclp->acl_aclp, aclp->acl_cnt * aclp->acl_entry_size);
1495 aclp->acl_aclp = acldata;
1496 aclp->acl_cnt = aclcnt;
1497 if (target_flavor == _ACL_ACE_ENABLED) {
1498 aclp->acl_type = ACE_T;
1499 aclp->acl_entry_size = sizeof (ace_t);
1500 } else {
1501 aclp->acl_type = ACLENT_T;
1502 aclp->acl_entry_size = sizeof (aclent_t);
1503 }
1504 return (0);
1505
1506 out:
1507
1508 #if !defined(_KERNEL)
1509 errno = error;
1510 return (-1);
1511 #else
1512 return (error);
1513 #endif
1514 }
1515 #endif /* !_KERNEL */
1516
1517 #define SET_ACE(acl, index, who, mask, type, flags) { \
1518 acl[0][index].a_who = (uint32_t)who; \
1519 acl[0][index].a_type = type; \
1520 acl[0][index].a_flags = flags; \
1521 acl[0][index++].a_access_mask = mask; \
1522 }
1523
1524 void
acl_trivial_access_masks(mode_t mode,boolean_t isdir,trivial_acl_t * masks)1525 acl_trivial_access_masks(mode_t mode, boolean_t isdir, trivial_acl_t *masks)
1526 {
1527 uint32_t read_mask = ACE_READ_DATA;
1528 uint32_t write_mask = ACE_WRITE_DATA|ACE_APPEND_DATA;
1529 uint32_t execute_mask = ACE_EXECUTE;
1530
1531 (void) isdir; /* will need this later */
1532
1533 masks->deny1 = 0;
1534 if (!(mode & S_IRUSR) && (mode & (S_IRGRP|S_IROTH)))
1535 masks->deny1 |= read_mask;
1536 if (!(mode & S_IWUSR) && (mode & (S_IWGRP|S_IWOTH)))
1537 masks->deny1 |= write_mask;
1538 if (!(mode & S_IXUSR) && (mode & (S_IXGRP|S_IXOTH)))
1539 masks->deny1 |= execute_mask;
1540
1541 masks->deny2 = 0;
1542 if (!(mode & S_IRGRP) && (mode & S_IROTH))
1543 masks->deny2 |= read_mask;
1544 if (!(mode & S_IWGRP) && (mode & S_IWOTH))
1545 masks->deny2 |= write_mask;
1546 if (!(mode & S_IXGRP) && (mode & S_IXOTH))
1547 masks->deny2 |= execute_mask;
1548
1549 masks->allow0 = 0;
1550 if ((mode & S_IRUSR) && (!(mode & S_IRGRP) && (mode & S_IROTH)))
1551 masks->allow0 |= read_mask;
1552 if ((mode & S_IWUSR) && (!(mode & S_IWGRP) && (mode & S_IWOTH)))
1553 masks->allow0 |= write_mask;
1554 if ((mode & S_IXUSR) && (!(mode & S_IXGRP) && (mode & S_IXOTH)))
1555 masks->allow0 |= execute_mask;
1556
1557 masks->owner = ACE_WRITE_ATTRIBUTES|ACE_WRITE_OWNER|ACE_WRITE_ACL|
1558 ACE_WRITE_NAMED_ATTRS|ACE_READ_ACL|ACE_READ_ATTRIBUTES|
1559 ACE_READ_NAMED_ATTRS|ACE_SYNCHRONIZE;
1560 if (mode & S_IRUSR)
1561 masks->owner |= read_mask;
1562 if (mode & S_IWUSR)
1563 masks->owner |= write_mask;
1564 if (mode & S_IXUSR)
1565 masks->owner |= execute_mask;
1566
1567 masks->group = ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_READ_NAMED_ATTRS|
1568 ACE_SYNCHRONIZE;
1569 if (mode & S_IRGRP)
1570 masks->group |= read_mask;
1571 if (mode & S_IWGRP)
1572 masks->group |= write_mask;
1573 if (mode & S_IXGRP)
1574 masks->group |= execute_mask;
1575
1576 masks->everyone = ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_READ_NAMED_ATTRS|
1577 ACE_SYNCHRONIZE;
1578 if (mode & S_IROTH)
1579 masks->everyone |= read_mask;
1580 if (mode & S_IWOTH)
1581 masks->everyone |= write_mask;
1582 if (mode & S_IXOTH)
1583 masks->everyone |= execute_mask;
1584 }
1585
1586 int
acl_trivial_create(mode_t mode,boolean_t isdir,ace_t ** acl,int * count)1587 acl_trivial_create(mode_t mode, boolean_t isdir, ace_t **acl, int *count)
1588 {
1589 int index = 0;
1590 int error;
1591 trivial_acl_t masks;
1592
1593 *count = 3;
1594 acl_trivial_access_masks(mode, isdir, &masks);
1595
1596 if (masks.allow0)
1597 (*count)++;
1598 if (masks.deny1)
1599 (*count)++;
1600 if (masks.deny2)
1601 (*count)++;
1602
1603 if ((error = cacl_malloc((void **)acl, *count * sizeof (ace_t))) != 0)
1604 return (error);
1605
1606 if (masks.allow0) {
1607 SET_ACE(acl, index, -1, masks.allow0,
1608 ACE_ACCESS_ALLOWED_ACE_TYPE, ACE_OWNER);
1609 }
1610 if (masks.deny1) {
1611 SET_ACE(acl, index, -1, masks.deny1,
1612 ACE_ACCESS_DENIED_ACE_TYPE, ACE_OWNER);
1613 }
1614 if (masks.deny2) {
1615 SET_ACE(acl, index, -1, masks.deny2,
1616 ACE_ACCESS_DENIED_ACE_TYPE, ACE_GROUP|ACE_IDENTIFIER_GROUP);
1617 }
1618
1619 SET_ACE(acl, index, -1, masks.owner, ACE_ACCESS_ALLOWED_ACE_TYPE,
1620 ACE_OWNER);
1621 SET_ACE(acl, index, -1, masks.group, ACE_ACCESS_ALLOWED_ACE_TYPE,
1622 ACE_IDENTIFIER_GROUP|ACE_GROUP);
1623 SET_ACE(acl, index, -1, masks.everyone, ACE_ACCESS_ALLOWED_ACE_TYPE,
1624 ACE_EVERYONE);
1625
1626 return (0);
1627 }
1628
1629 /*
1630 * ace_trivial:
1631 * determine whether an ace_t acl is trivial
1632 *
1633 * Trivialness implies that the acl is composed of only
1634 * owner, group, everyone entries. ACL can't
1635 * have read_acl denied, and write_owner/write_acl/write_attributes
1636 * can only be owner@ entry.
1637 */
1638 int
ace_trivial_common(void * acep,int aclcnt,uintptr_t (* walk)(void *,uintptr_t,int aclcnt,uint16_t *,uint16_t *,uint32_t *))1639 ace_trivial_common(void *acep, int aclcnt,
1640 uintptr_t (*walk)(void *, uintptr_t, int aclcnt,
1641 uint16_t *, uint16_t *, uint32_t *))
1642 {
1643 uint16_t flags;
1644 uint32_t mask;
1645 uint16_t type;
1646 uintptr_t cookie = 0;
1647
1648 while ((cookie = walk(acep, cookie, aclcnt, &flags, &type, &mask))) {
1649 switch (flags & ACE_TYPE_FLAGS) {
1650 case ACE_OWNER:
1651 case ACE_GROUP|ACE_IDENTIFIER_GROUP:
1652 case ACE_EVERYONE:
1653 break;
1654 default:
1655 return (1);
1656
1657 }
1658
1659 if (flags & (ACE_FILE_INHERIT_ACE|
1660 ACE_DIRECTORY_INHERIT_ACE|ACE_NO_PROPAGATE_INHERIT_ACE|
1661 ACE_INHERIT_ONLY_ACE))
1662 return (1);
1663
1664 /*
1665 * Special check for some special bits
1666 *
1667 * Don't allow anybody to deny reading basic
1668 * attributes or a files ACL.
1669 */
1670 if ((mask & (ACE_READ_ACL|ACE_READ_ATTRIBUTES)) &&
1671 (type == ACE_ACCESS_DENIED_ACE_TYPE))
1672 return (1);
1673
1674 /*
1675 * Delete permissions are never set by default
1676 */
1677 if (mask & (ACE_DELETE|ACE_DELETE_CHILD))
1678 return (1);
1679 /*
1680 * only allow owner@ to have
1681 * write_acl/write_owner/write_attributes/write_xattr/
1682 */
1683 if (type == ACE_ACCESS_ALLOWED_ACE_TYPE &&
1684 (!(flags & ACE_OWNER) && (mask &
1685 (ACE_WRITE_OWNER|ACE_WRITE_ACL| ACE_WRITE_ATTRIBUTES|
1686 ACE_WRITE_NAMED_ATTRS))))
1687 return (1);
1688
1689 }
1690 return (0);
1691 }
1692