1 // SPDX-License-Identifier: CDDL-1.0 2 /* 3 * CDDL HEADER START 4 * 5 * The contents of this file are subject to the terms of the 6 * Common Development and Distribution License (the "License"). 7 * You may not use this file except in compliance with the License. 8 * 9 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10 * or https://opensource.org/licenses/CDDL-1.0. 11 * See the License for the specific language governing permissions 12 * and limitations under the License. 13 * 14 * When distributing Covered Code, include this CDDL HEADER in each 15 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16 * If applicable, add the following below this CDDL HEADER, with the 17 * fields enclosed by brackets "[]" replaced with your own identifying 18 * information: Portions Copyright [yyyy] [name of copyright owner] 19 * 20 * CDDL HEADER END 21 */ 22 /* 23 * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved. 24 * Copyright (c) 2013 by Delphix. All rights reserved. 25 * Copyright 2017 Nexenta Systems, Inc. All rights reserved. 26 */ 27 28 #include <sys/types.h> 29 #include <sys/param.h> 30 #include <sys/time.h> 31 #include <sys/systm.h> 32 #include <sys/sysmacros.h> 33 #include <sys/resource.h> 34 #include <sys/vfs.h> 35 #include <sys/vnode.h> 36 #include <sys/file.h> 37 #include <sys/stat.h> 38 #include <sys/kmem.h> 39 #include <sys/cmn_err.h> 40 #include <sys/errno.h> 41 #include <sys/unistd.h> 42 #include <sys/sdt.h> 43 #include <sys/fs/zfs.h> 44 #include <sys/policy.h> 45 #include <sys/zfs_znode.h> 46 #include <sys/zfs_fuid.h> 47 #include <sys/zfs_acl.h> 48 #include <sys/zfs_dir.h> 49 #include <sys/zfs_quota.h> 50 #include <sys/zfs_vfsops.h> 51 #include <sys/dmu.h> 52 #include <sys/dnode.h> 53 #include <sys/zap.h> 54 #include <sys/sa.h> 55 #include <acl/acl_common.h> 56 57 58 #define ALLOW ACE_ACCESS_ALLOWED_ACE_TYPE 59 #define DENY ACE_ACCESS_DENIED_ACE_TYPE 60 #define MAX_ACE_TYPE ACE_SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE 61 #define MIN_ACE_TYPE ALLOW 62 63 #define OWNING_GROUP (ACE_GROUP|ACE_IDENTIFIER_GROUP) 64 #define EVERYONE_ALLOW_MASK (ACE_READ_ACL|ACE_READ_ATTRIBUTES | \ 65 ACE_READ_NAMED_ATTRS|ACE_SYNCHRONIZE) 66 #define EVERYONE_DENY_MASK (ACE_WRITE_ACL|ACE_WRITE_OWNER | \ 67 ACE_WRITE_ATTRIBUTES|ACE_WRITE_NAMED_ATTRS) 68 #define OWNER_ALLOW_MASK (ACE_WRITE_ACL | ACE_WRITE_OWNER | \ 69 ACE_WRITE_ATTRIBUTES|ACE_WRITE_NAMED_ATTRS) 70 71 #define ZFS_CHECKED_MASKS (ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_READ_DATA| \ 72 ACE_READ_NAMED_ATTRS|ACE_WRITE_DATA|ACE_WRITE_ATTRIBUTES| \ 73 ACE_WRITE_NAMED_ATTRS|ACE_APPEND_DATA|ACE_EXECUTE|ACE_WRITE_OWNER| \ 74 ACE_WRITE_ACL|ACE_DELETE|ACE_DELETE_CHILD|ACE_SYNCHRONIZE) 75 76 #define WRITE_MASK_DATA (ACE_WRITE_DATA|ACE_APPEND_DATA|ACE_WRITE_NAMED_ATTRS) 77 #define WRITE_MASK_ATTRS (ACE_WRITE_ACL|ACE_WRITE_OWNER|ACE_WRITE_ATTRIBUTES| \ 78 ACE_DELETE|ACE_DELETE_CHILD) 79 #define WRITE_MASK (WRITE_MASK_DATA|WRITE_MASK_ATTRS) 80 81 #define OGE_CLEAR (ACE_READ_DATA|ACE_LIST_DIRECTORY|ACE_WRITE_DATA| \ 82 ACE_ADD_FILE|ACE_APPEND_DATA|ACE_ADD_SUBDIRECTORY|ACE_EXECUTE) 83 84 #define OKAY_MASK_BITS (ACE_READ_DATA|ACE_LIST_DIRECTORY|ACE_WRITE_DATA| \ 85 ACE_ADD_FILE|ACE_APPEND_DATA|ACE_ADD_SUBDIRECTORY|ACE_EXECUTE) 86 87 #define ALL_INHERIT (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE | \ 88 ACE_NO_PROPAGATE_INHERIT_ACE|ACE_INHERIT_ONLY_ACE|ACE_INHERITED_ACE) 89 90 #define RESTRICTED_CLEAR (ACE_WRITE_ACL|ACE_WRITE_OWNER) 91 92 #define V4_ACL_WIDE_FLAGS (ZFS_ACL_AUTO_INHERIT|ZFS_ACL_DEFAULTED|\ 93 ZFS_ACL_PROTECTED) 94 95 #define ZFS_ACL_WIDE_FLAGS (V4_ACL_WIDE_FLAGS|ZFS_ACL_TRIVIAL|ZFS_INHERIT_ACE|\ 96 ZFS_ACL_OBJ_ACE) 97 98 #define ALL_MODE_EXECS (S_IXUSR | S_IXGRP | S_IXOTH) 99 100 static uint16_t 101 zfs_ace_v0_get_type(void *acep) 102 { 103 return (((zfs_oldace_t *)acep)->z_type); 104 } 105 106 static uint16_t 107 zfs_ace_v0_get_flags(void *acep) 108 { 109 return (((zfs_oldace_t *)acep)->z_flags); 110 } 111 112 static uint32_t 113 zfs_ace_v0_get_mask(void *acep) 114 { 115 return (((zfs_oldace_t *)acep)->z_access_mask); 116 } 117 118 static uint64_t 119 zfs_ace_v0_get_who(void *acep) 120 { 121 return (((zfs_oldace_t *)acep)->z_fuid); 122 } 123 124 static void 125 zfs_ace_v0_set_type(void *acep, uint16_t type) 126 { 127 ((zfs_oldace_t *)acep)->z_type = type; 128 } 129 130 static void 131 zfs_ace_v0_set_flags(void *acep, uint16_t flags) 132 { 133 ((zfs_oldace_t *)acep)->z_flags = flags; 134 } 135 136 static void 137 zfs_ace_v0_set_mask(void *acep, uint32_t mask) 138 { 139 ((zfs_oldace_t *)acep)->z_access_mask = mask; 140 } 141 142 static void 143 zfs_ace_v0_set_who(void *acep, uint64_t who) 144 { 145 ((zfs_oldace_t *)acep)->z_fuid = who; 146 } 147 148 static size_t 149 zfs_ace_v0_size(void *acep) 150 { 151 (void) acep; 152 return (sizeof (zfs_oldace_t)); 153 } 154 155 static size_t 156 zfs_ace_v0_abstract_size(void) 157 { 158 return (sizeof (zfs_oldace_t)); 159 } 160 161 static int 162 zfs_ace_v0_mask_off(void) 163 { 164 return (offsetof(zfs_oldace_t, z_access_mask)); 165 } 166 167 static int 168 zfs_ace_v0_data(void *acep, void **datap) 169 { 170 (void) acep; 171 *datap = NULL; 172 return (0); 173 } 174 175 static const acl_ops_t zfs_acl_v0_ops = { 176 zfs_ace_v0_get_mask, 177 zfs_ace_v0_set_mask, 178 zfs_ace_v0_get_flags, 179 zfs_ace_v0_set_flags, 180 zfs_ace_v0_get_type, 181 zfs_ace_v0_set_type, 182 zfs_ace_v0_get_who, 183 zfs_ace_v0_set_who, 184 zfs_ace_v0_size, 185 zfs_ace_v0_abstract_size, 186 zfs_ace_v0_mask_off, 187 zfs_ace_v0_data 188 }; 189 190 static uint16_t 191 zfs_ace_fuid_get_type(void *acep) 192 { 193 return (((zfs_ace_hdr_t *)acep)->z_type); 194 } 195 196 static uint16_t 197 zfs_ace_fuid_get_flags(void *acep) 198 { 199 return (((zfs_ace_hdr_t *)acep)->z_flags); 200 } 201 202 static uint32_t 203 zfs_ace_fuid_get_mask(void *acep) 204 { 205 return (((zfs_ace_hdr_t *)acep)->z_access_mask); 206 } 207 208 static uint64_t 209 zfs_ace_fuid_get_who(void *args) 210 { 211 uint16_t entry_type; 212 zfs_ace_t *acep = args; 213 214 entry_type = acep->z_hdr.z_flags & ACE_TYPE_FLAGS; 215 216 if (entry_type == ACE_OWNER || entry_type == OWNING_GROUP || 217 entry_type == ACE_EVERYONE) 218 return (-1); 219 return (((zfs_ace_t *)acep)->z_fuid); 220 } 221 222 static void 223 zfs_ace_fuid_set_type(void *acep, uint16_t type) 224 { 225 ((zfs_ace_hdr_t *)acep)->z_type = type; 226 } 227 228 static void 229 zfs_ace_fuid_set_flags(void *acep, uint16_t flags) 230 { 231 ((zfs_ace_hdr_t *)acep)->z_flags = flags; 232 } 233 234 static void 235 zfs_ace_fuid_set_mask(void *acep, uint32_t mask) 236 { 237 ((zfs_ace_hdr_t *)acep)->z_access_mask = mask; 238 } 239 240 static void 241 zfs_ace_fuid_set_who(void *arg, uint64_t who) 242 { 243 zfs_ace_t *acep = arg; 244 245 uint16_t entry_type = acep->z_hdr.z_flags & ACE_TYPE_FLAGS; 246 247 if (entry_type == ACE_OWNER || entry_type == OWNING_GROUP || 248 entry_type == ACE_EVERYONE) 249 return; 250 acep->z_fuid = who; 251 } 252 253 static size_t 254 zfs_ace_fuid_size(void *acep) 255 { 256 zfs_ace_hdr_t *zacep = acep; 257 uint16_t entry_type; 258 259 switch (zacep->z_type) { 260 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 261 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 262 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 263 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 264 return (sizeof (zfs_object_ace_t)); 265 case ALLOW: 266 case DENY: 267 entry_type = 268 (((zfs_ace_hdr_t *)acep)->z_flags & ACE_TYPE_FLAGS); 269 if (entry_type == ACE_OWNER || 270 entry_type == OWNING_GROUP || 271 entry_type == ACE_EVERYONE) 272 return (sizeof (zfs_ace_hdr_t)); 273 zfs_fallthrough; 274 default: 275 return (sizeof (zfs_ace_t)); 276 } 277 } 278 279 static size_t 280 zfs_ace_fuid_abstract_size(void) 281 { 282 return (sizeof (zfs_ace_hdr_t)); 283 } 284 285 static int 286 zfs_ace_fuid_mask_off(void) 287 { 288 return (offsetof(zfs_ace_hdr_t, z_access_mask)); 289 } 290 291 static int 292 zfs_ace_fuid_data(void *acep, void **datap) 293 { 294 zfs_ace_t *zacep = acep; 295 zfs_object_ace_t *zobjp; 296 297 switch (zacep->z_hdr.z_type) { 298 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 299 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 300 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 301 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 302 zobjp = acep; 303 *datap = (caddr_t)zobjp + sizeof (zfs_ace_t); 304 return (sizeof (zfs_object_ace_t) - sizeof (zfs_ace_t)); 305 default: 306 *datap = NULL; 307 return (0); 308 } 309 } 310 311 static const acl_ops_t zfs_acl_fuid_ops = { 312 zfs_ace_fuid_get_mask, 313 zfs_ace_fuid_set_mask, 314 zfs_ace_fuid_get_flags, 315 zfs_ace_fuid_set_flags, 316 zfs_ace_fuid_get_type, 317 zfs_ace_fuid_set_type, 318 zfs_ace_fuid_get_who, 319 zfs_ace_fuid_set_who, 320 zfs_ace_fuid_size, 321 zfs_ace_fuid_abstract_size, 322 zfs_ace_fuid_mask_off, 323 zfs_ace_fuid_data 324 }; 325 326 /* 327 * The following three functions are provided for compatibility with 328 * older ZPL version in order to determine if the file use to have 329 * an external ACL and what version of ACL previously existed on the 330 * file. Would really be nice to not need this, sigh. 331 */ 332 uint64_t 333 zfs_external_acl(znode_t *zp) 334 { 335 zfs_acl_phys_t acl_phys; 336 int error; 337 338 if (zp->z_is_sa) 339 return (0); 340 341 /* 342 * Need to deal with a potential 343 * race where zfs_sa_upgrade could cause 344 * z_isa_sa to change. 345 * 346 * If the lookup fails then the state of z_is_sa should have 347 * changed. 348 */ 349 350 if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_ZNODE_ACL(zp->z_zfsvfs), 351 &acl_phys, sizeof (acl_phys))) == 0) 352 return (acl_phys.z_acl_extern_obj); 353 else { 354 /* 355 * after upgrade the SA_ZPL_ZNODE_ACL should have been 356 * removed 357 */ 358 VERIFY(zp->z_is_sa); 359 VERIFY3S(error, ==, ENOENT); 360 return (0); 361 } 362 } 363 364 /* 365 * Determine size of ACL in bytes 366 * 367 * This is more complicated than it should be since we have to deal 368 * with old external ACLs. 369 */ 370 static int 371 zfs_acl_znode_info(znode_t *zp, int *aclsize, int *aclcount, 372 zfs_acl_phys_t *aclphys) 373 { 374 zfsvfs_t *zfsvfs = zp->z_zfsvfs; 375 uint64_t acl_count; 376 int size; 377 int error; 378 379 ASSERT(MUTEX_HELD(&zp->z_acl_lock)); 380 if (zp->z_is_sa) { 381 if ((error = sa_size(zp->z_sa_hdl, SA_ZPL_DACL_ACES(zfsvfs), 382 &size)) != 0) 383 return (error); 384 *aclsize = size; 385 if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_DACL_COUNT(zfsvfs), 386 &acl_count, sizeof (acl_count))) != 0) 387 return (error); 388 *aclcount = acl_count; 389 } else { 390 if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_ZNODE_ACL(zfsvfs), 391 aclphys, sizeof (*aclphys))) != 0) 392 return (error); 393 394 if (aclphys->z_acl_version == ZFS_ACL_VERSION_INITIAL) { 395 *aclsize = ZFS_ACL_SIZE(aclphys->z_acl_size); 396 *aclcount = aclphys->z_acl_size; 397 } else { 398 *aclsize = aclphys->z_acl_size; 399 *aclcount = aclphys->z_acl_count; 400 } 401 } 402 return (0); 403 } 404 405 int 406 zfs_znode_acl_version(znode_t *zp) 407 { 408 zfs_acl_phys_t acl_phys; 409 410 if (zp->z_is_sa) 411 return (ZFS_ACL_VERSION_FUID); 412 else { 413 int error; 414 415 /* 416 * Need to deal with a potential 417 * race where zfs_sa_upgrade could cause 418 * z_isa_sa to change. 419 * 420 * If the lookup fails then the state of z_is_sa should have 421 * changed. 422 */ 423 if ((error = sa_lookup(zp->z_sa_hdl, 424 SA_ZPL_ZNODE_ACL(zp->z_zfsvfs), 425 &acl_phys, sizeof (acl_phys))) == 0) 426 return (acl_phys.z_acl_version); 427 else { 428 /* 429 * After upgrade SA_ZPL_ZNODE_ACL should have 430 * been removed. 431 */ 432 VERIFY(zp->z_is_sa); 433 VERIFY3S(error, ==, ENOENT); 434 return (ZFS_ACL_VERSION_FUID); 435 } 436 } 437 } 438 439 static int 440 zfs_acl_version(int version) 441 { 442 if (version < ZPL_VERSION_FUID) 443 return (ZFS_ACL_VERSION_INITIAL); 444 else 445 return (ZFS_ACL_VERSION_FUID); 446 } 447 448 static int 449 zfs_acl_version_zp(znode_t *zp) 450 { 451 return (zfs_acl_version(zp->z_zfsvfs->z_version)); 452 } 453 454 zfs_acl_t * 455 zfs_acl_alloc(int vers) 456 { 457 zfs_acl_t *aclp; 458 459 aclp = kmem_zalloc(sizeof (zfs_acl_t), KM_SLEEP); 460 list_create(&aclp->z_acl, sizeof (zfs_acl_node_t), 461 offsetof(zfs_acl_node_t, z_next)); 462 aclp->z_version = vers; 463 if (vers == ZFS_ACL_VERSION_FUID) 464 aclp->z_ops = &zfs_acl_fuid_ops; 465 else 466 aclp->z_ops = &zfs_acl_v0_ops; 467 return (aclp); 468 } 469 470 zfs_acl_node_t * 471 zfs_acl_node_alloc(size_t bytes) 472 { 473 zfs_acl_node_t *aclnode; 474 475 aclnode = kmem_zalloc(sizeof (zfs_acl_node_t), KM_SLEEP); 476 if (bytes) { 477 aclnode->z_acldata = kmem_zalloc(bytes, KM_SLEEP); 478 aclnode->z_allocdata = aclnode->z_acldata; 479 aclnode->z_allocsize = bytes; 480 aclnode->z_size = bytes; 481 } 482 483 return (aclnode); 484 } 485 486 static void 487 zfs_acl_node_free(zfs_acl_node_t *aclnode) 488 { 489 if (aclnode->z_allocsize) 490 kmem_free(aclnode->z_allocdata, aclnode->z_allocsize); 491 kmem_free(aclnode, sizeof (zfs_acl_node_t)); 492 } 493 494 static void 495 zfs_acl_release_nodes(zfs_acl_t *aclp) 496 { 497 zfs_acl_node_t *aclnode; 498 499 while ((aclnode = list_remove_head(&aclp->z_acl))) 500 zfs_acl_node_free(aclnode); 501 aclp->z_acl_count = 0; 502 aclp->z_acl_bytes = 0; 503 } 504 505 void 506 zfs_acl_free(zfs_acl_t *aclp) 507 { 508 zfs_acl_release_nodes(aclp); 509 list_destroy(&aclp->z_acl); 510 kmem_free(aclp, sizeof (zfs_acl_t)); 511 } 512 513 static boolean_t 514 zfs_acl_valid_ace_type(uint_t type, uint_t flags) 515 { 516 uint16_t entry_type; 517 518 switch (type) { 519 case ALLOW: 520 case DENY: 521 case ACE_SYSTEM_AUDIT_ACE_TYPE: 522 case ACE_SYSTEM_ALARM_ACE_TYPE: 523 entry_type = flags & ACE_TYPE_FLAGS; 524 return (entry_type == ACE_OWNER || 525 entry_type == OWNING_GROUP || 526 entry_type == ACE_EVERYONE || entry_type == 0 || 527 entry_type == ACE_IDENTIFIER_GROUP); 528 default: 529 if (type <= MAX_ACE_TYPE) 530 return (B_TRUE); 531 } 532 return (B_FALSE); 533 } 534 535 static boolean_t 536 zfs_ace_valid(vtype_t obj_type, zfs_acl_t *aclp, uint16_t type, uint16_t iflags) 537 { 538 /* 539 * first check type of entry 540 */ 541 542 if (!zfs_acl_valid_ace_type(type, iflags)) 543 return (B_FALSE); 544 545 switch (type) { 546 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 547 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 548 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 549 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 550 if (aclp->z_version < ZFS_ACL_VERSION_FUID) 551 return (B_FALSE); 552 aclp->z_hints |= ZFS_ACL_OBJ_ACE; 553 } 554 555 /* 556 * next check inheritance level flags 557 */ 558 559 if (obj_type == VDIR && 560 (iflags & (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE))) 561 aclp->z_hints |= ZFS_INHERIT_ACE; 562 563 if (iflags & (ACE_INHERIT_ONLY_ACE|ACE_NO_PROPAGATE_INHERIT_ACE)) { 564 if ((iflags & (ACE_FILE_INHERIT_ACE| 565 ACE_DIRECTORY_INHERIT_ACE)) == 0) { 566 return (B_FALSE); 567 } 568 } 569 570 return (B_TRUE); 571 } 572 573 static void * 574 zfs_acl_next_ace(zfs_acl_t *aclp, void *start, uint64_t *who, 575 uint32_t *access_mask, uint16_t *iflags, uint16_t *type) 576 { 577 zfs_acl_node_t *aclnode; 578 579 ASSERT3P(aclp, !=, NULL); 580 581 if (start == NULL) { 582 aclnode = list_head(&aclp->z_acl); 583 if (aclnode == NULL) 584 return (NULL); 585 586 aclp->z_next_ace = aclnode->z_acldata; 587 aclp->z_curr_node = aclnode; 588 aclnode->z_ace_idx = 0; 589 } 590 591 aclnode = aclp->z_curr_node; 592 593 if (aclnode == NULL) 594 return (NULL); 595 596 if (aclnode->z_ace_idx >= aclnode->z_ace_count) { 597 aclnode = list_next(&aclp->z_acl, aclnode); 598 if (aclnode == NULL) 599 return (NULL); 600 else { 601 aclp->z_curr_node = aclnode; 602 aclnode->z_ace_idx = 0; 603 aclp->z_next_ace = aclnode->z_acldata; 604 } 605 } 606 607 if (aclnode->z_ace_idx < aclnode->z_ace_count) { 608 void *acep = aclp->z_next_ace; 609 size_t ace_size; 610 611 /* 612 * Make sure we don't overstep our bounds 613 */ 614 ace_size = aclp->z_ops->ace_size(acep); 615 616 if (((caddr_t)acep + ace_size) > 617 ((caddr_t)aclnode->z_acldata + aclnode->z_size)) { 618 return (NULL); 619 } 620 621 *iflags = aclp->z_ops->ace_flags_get(acep); 622 *type = aclp->z_ops->ace_type_get(acep); 623 *access_mask = aclp->z_ops->ace_mask_get(acep); 624 *who = aclp->z_ops->ace_who_get(acep); 625 aclp->z_next_ace = (caddr_t)aclp->z_next_ace + ace_size; 626 aclnode->z_ace_idx++; 627 628 return ((void *)acep); 629 } 630 return (NULL); 631 } 632 633 static uintptr_t 634 zfs_ace_walk(void *datap, uintptr_t cookie, int aclcnt, 635 uint16_t *flags, uint16_t *type, uint32_t *mask) 636 { 637 (void) aclcnt; 638 zfs_acl_t *aclp = datap; 639 zfs_ace_hdr_t *acep = (zfs_ace_hdr_t *)(uintptr_t)cookie; 640 uint64_t who; 641 642 acep = zfs_acl_next_ace(aclp, acep, &who, mask, 643 flags, type); 644 return ((uintptr_t)acep); 645 } 646 647 /* 648 * Copy ACE to internal ZFS format. 649 * While processing the ACL each ACE will be validated for correctness. 650 * ACE FUIDs will be created later. 651 */ 652 static int 653 zfs_copy_ace_2_fuid(zfsvfs_t *zfsvfs, vtype_t obj_type, zfs_acl_t *aclp, 654 void *datap, zfs_ace_t *z_acl, uint64_t aclcnt, size_t *size, 655 zfs_fuid_info_t **fuidp, cred_t *cr) 656 { 657 int i; 658 uint16_t entry_type; 659 zfs_ace_t *aceptr = z_acl; 660 ace_t *acep = datap; 661 zfs_object_ace_t *zobjacep; 662 ace_object_t *aceobjp; 663 664 for (i = 0; i != aclcnt; i++) { 665 aceptr->z_hdr.z_access_mask = acep->a_access_mask; 666 aceptr->z_hdr.z_flags = acep->a_flags; 667 aceptr->z_hdr.z_type = acep->a_type; 668 entry_type = aceptr->z_hdr.z_flags & ACE_TYPE_FLAGS; 669 if (entry_type != ACE_OWNER && entry_type != OWNING_GROUP && 670 entry_type != ACE_EVERYONE) { 671 aceptr->z_fuid = zfs_fuid_create(zfsvfs, acep->a_who, 672 cr, (entry_type == 0) ? 673 ZFS_ACE_USER : ZFS_ACE_GROUP, fuidp); 674 } 675 676 /* 677 * Make sure ACE is valid 678 */ 679 if (zfs_ace_valid(obj_type, aclp, aceptr->z_hdr.z_type, 680 aceptr->z_hdr.z_flags) != B_TRUE) 681 return (SET_ERROR(EINVAL)); 682 683 switch (acep->a_type) { 684 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 685 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 686 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 687 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 688 zobjacep = (zfs_object_ace_t *)aceptr; 689 aceobjp = (ace_object_t *)acep; 690 691 memcpy(zobjacep->z_object_type, aceobjp->a_obj_type, 692 sizeof (aceobjp->a_obj_type)); 693 memcpy(zobjacep->z_inherit_type, 694 aceobjp->a_inherit_obj_type, 695 sizeof (aceobjp->a_inherit_obj_type)); 696 acep = (ace_t *)((caddr_t)acep + sizeof (ace_object_t)); 697 break; 698 default: 699 acep = (ace_t *)((caddr_t)acep + sizeof (ace_t)); 700 } 701 702 aceptr = (zfs_ace_t *)((caddr_t)aceptr + 703 aclp->z_ops->ace_size(aceptr)); 704 } 705 706 *size = (caddr_t)aceptr - (caddr_t)z_acl; 707 708 return (0); 709 } 710 711 /* 712 * Copy ZFS ACEs to fixed size ace_t layout 713 */ 714 static void 715 zfs_copy_fuid_2_ace(zfsvfs_t *zfsvfs, zfs_acl_t *aclp, cred_t *cr, 716 void *datap, int filter) 717 { 718 uint64_t who; 719 uint32_t access_mask; 720 uint16_t iflags, type; 721 zfs_ace_hdr_t *zacep = NULL; 722 ace_t *acep = datap; 723 ace_object_t *objacep; 724 zfs_object_ace_t *zobjacep; 725 size_t ace_size; 726 uint16_t entry_type; 727 728 while ((zacep = zfs_acl_next_ace(aclp, zacep, 729 &who, &access_mask, &iflags, &type))) { 730 731 switch (type) { 732 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 733 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 734 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 735 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 736 if (filter) { 737 continue; 738 } 739 zobjacep = (zfs_object_ace_t *)zacep; 740 objacep = (ace_object_t *)acep; 741 memcpy(objacep->a_obj_type, 742 zobjacep->z_object_type, 743 sizeof (zobjacep->z_object_type)); 744 memcpy(objacep->a_inherit_obj_type, 745 zobjacep->z_inherit_type, 746 sizeof (zobjacep->z_inherit_type)); 747 ace_size = sizeof (ace_object_t); 748 break; 749 default: 750 ace_size = sizeof (ace_t); 751 break; 752 } 753 754 entry_type = (iflags & ACE_TYPE_FLAGS); 755 if ((entry_type != ACE_OWNER && 756 entry_type != OWNING_GROUP && 757 entry_type != ACE_EVERYONE)) { 758 acep->a_who = zfs_fuid_map_id(zfsvfs, who, 759 cr, (entry_type & ACE_IDENTIFIER_GROUP) ? 760 ZFS_ACE_GROUP : ZFS_ACE_USER); 761 } else { 762 acep->a_who = (uid_t)(int64_t)who; 763 } 764 acep->a_access_mask = access_mask; 765 acep->a_flags = iflags; 766 acep->a_type = type; 767 acep = (ace_t *)((caddr_t)acep + ace_size); 768 } 769 } 770 771 static int 772 zfs_copy_ace_2_oldace(vtype_t obj_type, zfs_acl_t *aclp, ace_t *acep, 773 zfs_oldace_t *z_acl, int aclcnt, size_t *size) 774 { 775 int i; 776 zfs_oldace_t *aceptr = z_acl; 777 778 for (i = 0; i != aclcnt; i++, aceptr++) { 779 aceptr->z_access_mask = acep[i].a_access_mask; 780 aceptr->z_type = acep[i].a_type; 781 aceptr->z_flags = acep[i].a_flags; 782 aceptr->z_fuid = acep[i].a_who; 783 /* 784 * Make sure ACE is valid 785 */ 786 if (zfs_ace_valid(obj_type, aclp, aceptr->z_type, 787 aceptr->z_flags) != B_TRUE) 788 return (SET_ERROR(EINVAL)); 789 } 790 *size = (caddr_t)aceptr - (caddr_t)z_acl; 791 return (0); 792 } 793 794 /* 795 * convert old ACL format to new 796 */ 797 void 798 zfs_acl_xform(znode_t *zp, zfs_acl_t *aclp, cred_t *cr) 799 { 800 zfs_oldace_t *oldaclp; 801 int i; 802 uint16_t type, iflags; 803 uint32_t access_mask; 804 uint64_t who; 805 void *cookie = NULL; 806 zfs_acl_node_t *newaclnode; 807 808 ASSERT3U(aclp->z_version, ==, ZFS_ACL_VERSION_INITIAL); 809 /* 810 * First create the ACE in a contiguous piece of memory 811 * for zfs_copy_ace_2_fuid(). 812 * 813 * We only convert an ACL once, so this won't happen 814 * everytime. 815 */ 816 oldaclp = kmem_alloc(sizeof (zfs_oldace_t) * aclp->z_acl_count, 817 KM_SLEEP); 818 i = 0; 819 while ((cookie = zfs_acl_next_ace(aclp, cookie, &who, 820 &access_mask, &iflags, &type))) { 821 oldaclp[i].z_flags = iflags; 822 oldaclp[i].z_type = type; 823 oldaclp[i].z_fuid = who; 824 oldaclp[i++].z_access_mask = access_mask; 825 } 826 827 newaclnode = zfs_acl_node_alloc(aclp->z_acl_count * 828 sizeof (zfs_object_ace_t)); 829 aclp->z_ops = &zfs_acl_fuid_ops; 830 VERIFY0(zfs_copy_ace_2_fuid(zp->z_zfsvfs, ZTOV(zp)->v_type, aclp, 831 oldaclp, newaclnode->z_acldata, aclp->z_acl_count, 832 &newaclnode->z_size, NULL, cr)); 833 newaclnode->z_ace_count = aclp->z_acl_count; 834 aclp->z_version = ZFS_ACL_VERSION; 835 kmem_free(oldaclp, aclp->z_acl_count * sizeof (zfs_oldace_t)); 836 837 /* 838 * Release all previous ACL nodes 839 */ 840 841 zfs_acl_release_nodes(aclp); 842 843 list_insert_head(&aclp->z_acl, newaclnode); 844 845 aclp->z_acl_bytes = newaclnode->z_size; 846 aclp->z_acl_count = newaclnode->z_ace_count; 847 848 } 849 850 /* 851 * Convert unix access mask to v4 access mask 852 */ 853 static uint32_t 854 zfs_unix_to_v4(uint32_t access_mask) 855 { 856 uint32_t new_mask = 0; 857 858 if (access_mask & S_IXOTH) 859 new_mask |= ACE_EXECUTE; 860 if (access_mask & S_IWOTH) 861 new_mask |= ACE_WRITE_DATA; 862 if (access_mask & S_IROTH) 863 new_mask |= ACE_READ_DATA; 864 return (new_mask); 865 } 866 867 static void 868 zfs_set_ace(zfs_acl_t *aclp, void *acep, uint32_t access_mask, 869 uint16_t access_type, uint64_t fuid, uint16_t entry_type) 870 { 871 uint16_t type = entry_type & ACE_TYPE_FLAGS; 872 873 aclp->z_ops->ace_mask_set(acep, access_mask); 874 aclp->z_ops->ace_type_set(acep, access_type); 875 aclp->z_ops->ace_flags_set(acep, entry_type); 876 if ((type != ACE_OWNER && type != OWNING_GROUP && 877 type != ACE_EVERYONE)) 878 aclp->z_ops->ace_who_set(acep, fuid); 879 } 880 881 /* 882 * Determine mode of file based on ACL. 883 */ 884 uint64_t 885 zfs_mode_compute(uint64_t fmode, zfs_acl_t *aclp, 886 uint64_t *pflags, uint64_t fuid, uint64_t fgid) 887 { 888 int entry_type; 889 mode_t mode; 890 mode_t seen = 0; 891 zfs_ace_hdr_t *acep = NULL; 892 uint64_t who; 893 uint16_t iflags, type; 894 uint32_t access_mask; 895 boolean_t an_exec_denied = B_FALSE; 896 897 mode = (fmode & (S_IFMT | S_ISUID | S_ISGID | S_ISVTX)); 898 899 while ((acep = zfs_acl_next_ace(aclp, acep, &who, 900 &access_mask, &iflags, &type))) { 901 902 if (!zfs_acl_valid_ace_type(type, iflags)) 903 continue; 904 905 entry_type = (iflags & ACE_TYPE_FLAGS); 906 907 /* 908 * Skip over any inherit_only ACEs 909 */ 910 if (iflags & ACE_INHERIT_ONLY_ACE) 911 continue; 912 913 if (entry_type == ACE_OWNER || (entry_type == 0 && 914 who == fuid)) { 915 if ((access_mask & ACE_READ_DATA) && 916 (!(seen & S_IRUSR))) { 917 seen |= S_IRUSR; 918 if (type == ALLOW) { 919 mode |= S_IRUSR; 920 } 921 } 922 if ((access_mask & ACE_WRITE_DATA) && 923 (!(seen & S_IWUSR))) { 924 seen |= S_IWUSR; 925 if (type == ALLOW) { 926 mode |= S_IWUSR; 927 } 928 } 929 if ((access_mask & ACE_EXECUTE) && 930 (!(seen & S_IXUSR))) { 931 seen |= S_IXUSR; 932 if (type == ALLOW) { 933 mode |= S_IXUSR; 934 } 935 } 936 } else if (entry_type == OWNING_GROUP || 937 (entry_type == ACE_IDENTIFIER_GROUP && who == fgid)) { 938 if ((access_mask & ACE_READ_DATA) && 939 (!(seen & S_IRGRP))) { 940 seen |= S_IRGRP; 941 if (type == ALLOW) { 942 mode |= S_IRGRP; 943 } 944 } 945 if ((access_mask & ACE_WRITE_DATA) && 946 (!(seen & S_IWGRP))) { 947 seen |= S_IWGRP; 948 if (type == ALLOW) { 949 mode |= S_IWGRP; 950 } 951 } 952 if ((access_mask & ACE_EXECUTE) && 953 (!(seen & S_IXGRP))) { 954 seen |= S_IXGRP; 955 if (type == ALLOW) { 956 mode |= S_IXGRP; 957 } 958 } 959 } else if (entry_type == ACE_EVERYONE) { 960 if ((access_mask & ACE_READ_DATA)) { 961 if (!(seen & S_IRUSR)) { 962 seen |= S_IRUSR; 963 if (type == ALLOW) { 964 mode |= S_IRUSR; 965 } 966 } 967 if (!(seen & S_IRGRP)) { 968 seen |= S_IRGRP; 969 if (type == ALLOW) { 970 mode |= S_IRGRP; 971 } 972 } 973 if (!(seen & S_IROTH)) { 974 seen |= S_IROTH; 975 if (type == ALLOW) { 976 mode |= S_IROTH; 977 } 978 } 979 } 980 if ((access_mask & ACE_WRITE_DATA)) { 981 if (!(seen & S_IWUSR)) { 982 seen |= S_IWUSR; 983 if (type == ALLOW) { 984 mode |= S_IWUSR; 985 } 986 } 987 if (!(seen & S_IWGRP)) { 988 seen |= S_IWGRP; 989 if (type == ALLOW) { 990 mode |= S_IWGRP; 991 } 992 } 993 if (!(seen & S_IWOTH)) { 994 seen |= S_IWOTH; 995 if (type == ALLOW) { 996 mode |= S_IWOTH; 997 } 998 } 999 } 1000 if ((access_mask & ACE_EXECUTE)) { 1001 if (!(seen & S_IXUSR)) { 1002 seen |= S_IXUSR; 1003 if (type == ALLOW) { 1004 mode |= S_IXUSR; 1005 } 1006 } 1007 if (!(seen & S_IXGRP)) { 1008 seen |= S_IXGRP; 1009 if (type == ALLOW) { 1010 mode |= S_IXGRP; 1011 } 1012 } 1013 if (!(seen & S_IXOTH)) { 1014 seen |= S_IXOTH; 1015 if (type == ALLOW) { 1016 mode |= S_IXOTH; 1017 } 1018 } 1019 } 1020 } else { 1021 /* 1022 * Only care if this IDENTIFIER_GROUP or 1023 * USER ACE denies execute access to someone, 1024 * mode is not affected 1025 */ 1026 if ((access_mask & ACE_EXECUTE) && type == DENY) 1027 an_exec_denied = B_TRUE; 1028 } 1029 } 1030 1031 /* 1032 * Failure to allow is effectively a deny, so execute permission 1033 * is denied if it was never mentioned or if we explicitly 1034 * weren't allowed it. 1035 */ 1036 if (!an_exec_denied && 1037 ((seen & ALL_MODE_EXECS) != ALL_MODE_EXECS || 1038 (mode & ALL_MODE_EXECS) != ALL_MODE_EXECS)) 1039 an_exec_denied = B_TRUE; 1040 1041 if (an_exec_denied) 1042 *pflags &= ~ZFS_NO_EXECS_DENIED; 1043 else 1044 *pflags |= ZFS_NO_EXECS_DENIED; 1045 1046 return (mode); 1047 } 1048 1049 /* 1050 * Read an external acl object. If the intent is to modify, always 1051 * create a new acl and leave any cached acl in place. 1052 */ 1053 int 1054 zfs_acl_node_read(znode_t *zp, boolean_t have_lock, zfs_acl_t **aclpp, 1055 boolean_t will_modify) 1056 { 1057 zfs_acl_t *aclp; 1058 int aclsize; 1059 int acl_count; 1060 zfs_acl_node_t *aclnode; 1061 zfs_acl_phys_t znode_acl; 1062 int version; 1063 int error; 1064 1065 ASSERT(MUTEX_HELD(&zp->z_acl_lock)); 1066 if (zp->z_zfsvfs->z_replay == B_FALSE) 1067 ASSERT_VOP_LOCKED(ZTOV(zp), __func__); 1068 1069 if (zp->z_acl_cached && !will_modify) { 1070 *aclpp = zp->z_acl_cached; 1071 return (0); 1072 } 1073 1074 version = zfs_znode_acl_version(zp); 1075 1076 if ((error = zfs_acl_znode_info(zp, &aclsize, 1077 &acl_count, &znode_acl)) != 0) { 1078 goto done; 1079 } 1080 1081 aclp = zfs_acl_alloc(version); 1082 1083 aclp->z_acl_count = acl_count; 1084 aclp->z_acl_bytes = aclsize; 1085 1086 aclnode = zfs_acl_node_alloc(aclsize); 1087 aclnode->z_ace_count = aclp->z_acl_count; 1088 aclnode->z_size = aclsize; 1089 1090 if (!zp->z_is_sa) { 1091 if (znode_acl.z_acl_extern_obj) { 1092 error = dmu_read(zp->z_zfsvfs->z_os, 1093 znode_acl.z_acl_extern_obj, 0, aclnode->z_size, 1094 aclnode->z_acldata, DMU_READ_PREFETCH); 1095 } else { 1096 memcpy(aclnode->z_acldata, znode_acl.z_ace_data, 1097 aclnode->z_size); 1098 } 1099 } else { 1100 error = sa_lookup(zp->z_sa_hdl, SA_ZPL_DACL_ACES(zp->z_zfsvfs), 1101 aclnode->z_acldata, aclnode->z_size); 1102 } 1103 1104 if (error != 0) { 1105 zfs_acl_free(aclp); 1106 zfs_acl_node_free(aclnode); 1107 /* convert checksum errors into IO errors */ 1108 if (error == ECKSUM) 1109 error = SET_ERROR(EIO); 1110 goto done; 1111 } 1112 1113 list_insert_head(&aclp->z_acl, aclnode); 1114 1115 *aclpp = aclp; 1116 if (!will_modify) 1117 zp->z_acl_cached = aclp; 1118 done: 1119 return (error); 1120 } 1121 1122 void 1123 zfs_acl_data_locator(void **dataptr, uint32_t *length, uint32_t buflen, 1124 boolean_t start, void *userdata) 1125 { 1126 (void) buflen; 1127 zfs_acl_locator_cb_t *cb = (zfs_acl_locator_cb_t *)userdata; 1128 1129 if (start) { 1130 cb->cb_acl_node = list_head(&cb->cb_aclp->z_acl); 1131 } else { 1132 cb->cb_acl_node = list_next(&cb->cb_aclp->z_acl, 1133 cb->cb_acl_node); 1134 } 1135 ASSERT3P(cb->cb_acl_node, !=, NULL); 1136 *dataptr = cb->cb_acl_node->z_acldata; 1137 *length = cb->cb_acl_node->z_size; 1138 } 1139 1140 int 1141 zfs_acl_chown_setattr(znode_t *zp) 1142 { 1143 int error; 1144 zfs_acl_t *aclp; 1145 1146 if (zp->z_zfsvfs->z_replay == B_FALSE) { 1147 ASSERT_VOP_ELOCKED(ZTOV(zp), __func__); 1148 ASSERT_VOP_IN_SEQC(ZTOV(zp)); 1149 } 1150 ASSERT(MUTEX_HELD(&zp->z_acl_lock)); 1151 1152 if ((error = zfs_acl_node_read(zp, B_TRUE, &aclp, B_FALSE)) == 0) 1153 zp->z_mode = zfs_mode_compute(zp->z_mode, aclp, 1154 &zp->z_pflags, zp->z_uid, zp->z_gid); 1155 return (error); 1156 } 1157 1158 /* 1159 * common code for setting ACLs. 1160 * 1161 * This function is called from zfs_mode_update, zfs_perm_init, and zfs_setacl. 1162 * zfs_setacl passes a non-NULL inherit pointer (ihp) to indicate that it's 1163 * already checked the acl and knows whether to inherit. 1164 */ 1165 int 1166 zfs_aclset_common(znode_t *zp, zfs_acl_t *aclp, cred_t *cr, dmu_tx_t *tx) 1167 { 1168 int error; 1169 zfsvfs_t *zfsvfs = zp->z_zfsvfs; 1170 dmu_object_type_t otype; 1171 zfs_acl_locator_cb_t locate = { 0 }; 1172 uint64_t mode; 1173 sa_bulk_attr_t bulk[5]; 1174 uint64_t ctime[2]; 1175 int count = 0; 1176 zfs_acl_phys_t acl_phys; 1177 1178 if (zp->z_zfsvfs->z_replay == B_FALSE) { 1179 ASSERT_VOP_IN_SEQC(ZTOV(zp)); 1180 } 1181 1182 mode = zp->z_mode; 1183 1184 mode = zfs_mode_compute(mode, aclp, &zp->z_pflags, 1185 zp->z_uid, zp->z_gid); 1186 1187 zp->z_mode = mode; 1188 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_MODE(zfsvfs), NULL, 1189 &mode, sizeof (mode)); 1190 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_FLAGS(zfsvfs), NULL, 1191 &zp->z_pflags, sizeof (zp->z_pflags)); 1192 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_CTIME(zfsvfs), NULL, 1193 &ctime, sizeof (ctime)); 1194 1195 if (zp->z_acl_cached) { 1196 zfs_acl_free(zp->z_acl_cached); 1197 zp->z_acl_cached = NULL; 1198 } 1199 1200 /* 1201 * Upgrade needed? 1202 */ 1203 if (!zfsvfs->z_use_fuids) { 1204 otype = DMU_OT_OLDACL; 1205 } else { 1206 if ((aclp->z_version == ZFS_ACL_VERSION_INITIAL) && 1207 (zfsvfs->z_version >= ZPL_VERSION_FUID)) 1208 zfs_acl_xform(zp, aclp, cr); 1209 ASSERT3U(aclp->z_version, >=, ZFS_ACL_VERSION_FUID); 1210 otype = DMU_OT_ACL; 1211 } 1212 1213 /* 1214 * Arrgh, we have to handle old on disk format 1215 * as well as newer (preferred) SA format. 1216 */ 1217 1218 if (zp->z_is_sa) { /* the easy case, just update the ACL attribute */ 1219 locate.cb_aclp = aclp; 1220 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_DACL_ACES(zfsvfs), 1221 zfs_acl_data_locator, &locate, aclp->z_acl_bytes); 1222 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_DACL_COUNT(zfsvfs), 1223 NULL, &aclp->z_acl_count, sizeof (uint64_t)); 1224 } else { /* Painful legacy way */ 1225 zfs_acl_node_t *aclnode; 1226 uint64_t off = 0; 1227 uint64_t aoid; 1228 1229 if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_ZNODE_ACL(zfsvfs), 1230 &acl_phys, sizeof (acl_phys))) != 0) 1231 return (error); 1232 1233 aoid = acl_phys.z_acl_extern_obj; 1234 1235 if (aclp->z_acl_bytes > ZFS_ACE_SPACE) { 1236 /* 1237 * If ACL was previously external and we are now 1238 * converting to new ACL format then release old 1239 * ACL object and create a new one. 1240 */ 1241 if (aoid && 1242 aclp->z_version != acl_phys.z_acl_version) { 1243 error = dmu_object_free(zfsvfs->z_os, aoid, tx); 1244 if (error) 1245 return (error); 1246 aoid = 0; 1247 } 1248 if (aoid == 0) { 1249 aoid = dmu_object_alloc(zfsvfs->z_os, 1250 otype, aclp->z_acl_bytes, 1251 otype == DMU_OT_ACL ? 1252 DMU_OT_SYSACL : DMU_OT_NONE, 1253 otype == DMU_OT_ACL ? 1254 DN_OLD_MAX_BONUSLEN : 0, tx); 1255 } else { 1256 (void) dmu_object_set_blocksize(zfsvfs->z_os, 1257 aoid, aclp->z_acl_bytes, 0, tx); 1258 } 1259 acl_phys.z_acl_extern_obj = aoid; 1260 for (aclnode = list_head(&aclp->z_acl); aclnode; 1261 aclnode = list_next(&aclp->z_acl, aclnode)) { 1262 if (aclnode->z_ace_count == 0) 1263 continue; 1264 dmu_write(zfsvfs->z_os, aoid, off, 1265 aclnode->z_size, aclnode->z_acldata, tx); 1266 off += aclnode->z_size; 1267 } 1268 } else { 1269 void *start = acl_phys.z_ace_data; 1270 /* 1271 * Migrating back embedded? 1272 */ 1273 if (acl_phys.z_acl_extern_obj) { 1274 error = dmu_object_free(zfsvfs->z_os, 1275 acl_phys.z_acl_extern_obj, tx); 1276 if (error) 1277 return (error); 1278 acl_phys.z_acl_extern_obj = 0; 1279 } 1280 1281 for (aclnode = list_head(&aclp->z_acl); aclnode; 1282 aclnode = list_next(&aclp->z_acl, aclnode)) { 1283 if (aclnode->z_ace_count == 0) 1284 continue; 1285 memcpy(start, aclnode->z_acldata, 1286 aclnode->z_size); 1287 start = (caddr_t)start + aclnode->z_size; 1288 } 1289 } 1290 /* 1291 * If Old version then swap count/bytes to match old 1292 * layout of znode_acl_phys_t. 1293 */ 1294 if (aclp->z_version == ZFS_ACL_VERSION_INITIAL) { 1295 acl_phys.z_acl_size = aclp->z_acl_count; 1296 acl_phys.z_acl_count = aclp->z_acl_bytes; 1297 } else { 1298 acl_phys.z_acl_size = aclp->z_acl_bytes; 1299 acl_phys.z_acl_count = aclp->z_acl_count; 1300 } 1301 acl_phys.z_acl_version = aclp->z_version; 1302 1303 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_ZNODE_ACL(zfsvfs), NULL, 1304 &acl_phys, sizeof (acl_phys)); 1305 } 1306 1307 /* 1308 * Replace ACL wide bits, but first clear them. 1309 */ 1310 zp->z_pflags &= ~ZFS_ACL_WIDE_FLAGS; 1311 1312 zp->z_pflags |= aclp->z_hints; 1313 1314 if (ace_trivial_common(aclp, 0, zfs_ace_walk) == 0) 1315 zp->z_pflags |= ZFS_ACL_TRIVIAL; 1316 1317 zfs_tstamp_update_setup(zp, STATE_CHANGED, NULL, ctime); 1318 return (sa_bulk_update(zp->z_sa_hdl, bulk, count, tx)); 1319 } 1320 1321 static void 1322 zfs_acl_chmod(vtype_t vtype, uint64_t mode, boolean_t split, boolean_t trim, 1323 zfs_acl_t *aclp) 1324 { 1325 void *acep = NULL; 1326 uint64_t who; 1327 int new_count, new_bytes; 1328 int ace_size; 1329 int entry_type; 1330 uint16_t iflags, type; 1331 uint32_t access_mask; 1332 zfs_acl_node_t *newnode; 1333 size_t abstract_size = aclp->z_ops->ace_abstract_size(); 1334 void *zacep; 1335 boolean_t isdir; 1336 trivial_acl_t masks; 1337 1338 new_count = new_bytes = 0; 1339 1340 isdir = (vtype == VDIR); 1341 1342 acl_trivial_access_masks((mode_t)mode, isdir, &masks); 1343 1344 newnode = zfs_acl_node_alloc((abstract_size * 6) + aclp->z_acl_bytes); 1345 1346 zacep = newnode->z_acldata; 1347 if (masks.allow0) { 1348 zfs_set_ace(aclp, zacep, masks.allow0, ALLOW, -1, ACE_OWNER); 1349 zacep = (void *)((uintptr_t)zacep + abstract_size); 1350 new_count++; 1351 new_bytes += abstract_size; 1352 } 1353 if (masks.deny1) { 1354 zfs_set_ace(aclp, zacep, masks.deny1, DENY, -1, ACE_OWNER); 1355 zacep = (void *)((uintptr_t)zacep + abstract_size); 1356 new_count++; 1357 new_bytes += abstract_size; 1358 } 1359 if (masks.deny2) { 1360 zfs_set_ace(aclp, zacep, masks.deny2, DENY, -1, OWNING_GROUP); 1361 zacep = (void *)((uintptr_t)zacep + abstract_size); 1362 new_count++; 1363 new_bytes += abstract_size; 1364 } 1365 1366 while ((acep = zfs_acl_next_ace(aclp, acep, &who, &access_mask, 1367 &iflags, &type))) { 1368 entry_type = (iflags & ACE_TYPE_FLAGS); 1369 /* 1370 * ACEs used to represent the file mode may be divided 1371 * into an equivalent pair of inherit-only and regular 1372 * ACEs, if they are inheritable. 1373 * Skip regular ACEs, which are replaced by the new mode. 1374 */ 1375 if (split && (entry_type == ACE_OWNER || 1376 entry_type == OWNING_GROUP || 1377 entry_type == ACE_EVERYONE)) { 1378 if (!isdir || !(iflags & 1379 (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE))) 1380 continue; 1381 /* 1382 * We preserve owner@, group@, or @everyone 1383 * permissions, if they are inheritable, by 1384 * copying them to inherit_only ACEs. This 1385 * prevents inheritable permissions from being 1386 * altered along with the file mode. 1387 */ 1388 iflags |= ACE_INHERIT_ONLY_ACE; 1389 } 1390 1391 /* 1392 * If this ACL has any inheritable ACEs, mark that in 1393 * the hints (which are later masked into the pflags) 1394 * so create knows to do inheritance. 1395 */ 1396 if (isdir && (iflags & 1397 (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE))) 1398 aclp->z_hints |= ZFS_INHERIT_ACE; 1399 1400 if ((type != ALLOW && type != DENY) || 1401 (iflags & ACE_INHERIT_ONLY_ACE)) { 1402 switch (type) { 1403 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 1404 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 1405 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 1406 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 1407 aclp->z_hints |= ZFS_ACL_OBJ_ACE; 1408 break; 1409 } 1410 } else { 1411 /* 1412 * Limit permissions granted by ACEs to be no greater 1413 * than permissions of the requested group mode. 1414 * Applies when the "aclmode" property is set to 1415 * "groupmask". 1416 */ 1417 if ((type == ALLOW) && trim) 1418 access_mask &= masks.group; 1419 } 1420 zfs_set_ace(aclp, zacep, access_mask, type, who, iflags); 1421 ace_size = aclp->z_ops->ace_size(acep); 1422 zacep = (void *)((uintptr_t)zacep + ace_size); 1423 new_count++; 1424 new_bytes += ace_size; 1425 } 1426 zfs_set_ace(aclp, zacep, masks.owner, ALLOW, -1, ACE_OWNER); 1427 zacep = (void *)((uintptr_t)zacep + abstract_size); 1428 zfs_set_ace(aclp, zacep, masks.group, ALLOW, -1, OWNING_GROUP); 1429 zacep = (void *)((uintptr_t)zacep + abstract_size); 1430 zfs_set_ace(aclp, zacep, masks.everyone, ALLOW, -1, ACE_EVERYONE); 1431 1432 new_count += 3; 1433 new_bytes += abstract_size * 3; 1434 zfs_acl_release_nodes(aclp); 1435 aclp->z_acl_count = new_count; 1436 aclp->z_acl_bytes = new_bytes; 1437 newnode->z_ace_count = new_count; 1438 newnode->z_size = new_bytes; 1439 list_insert_tail(&aclp->z_acl, newnode); 1440 } 1441 1442 int 1443 zfs_acl_chmod_setattr(znode_t *zp, zfs_acl_t **aclp, uint64_t mode) 1444 { 1445 int error = 0; 1446 1447 mutex_enter(&zp->z_acl_lock); 1448 if (zp->z_zfsvfs->z_replay == B_FALSE) 1449 ASSERT_VOP_ELOCKED(ZTOV(zp), __func__); 1450 if (zp->z_zfsvfs->z_acl_mode == ZFS_ACL_DISCARD) 1451 *aclp = zfs_acl_alloc(zfs_acl_version_zp(zp)); 1452 else 1453 error = zfs_acl_node_read(zp, B_TRUE, aclp, B_TRUE); 1454 1455 if (error == 0) { 1456 (*aclp)->z_hints = zp->z_pflags & V4_ACL_WIDE_FLAGS; 1457 zfs_acl_chmod(ZTOV(zp)->v_type, mode, B_TRUE, 1458 (zp->z_zfsvfs->z_acl_mode == ZFS_ACL_GROUPMASK), *aclp); 1459 } 1460 mutex_exit(&zp->z_acl_lock); 1461 1462 return (error); 1463 } 1464 1465 /* 1466 * Should ACE be inherited? 1467 */ 1468 static int 1469 zfs_ace_can_use(vtype_t vtype, uint16_t acep_flags) 1470 { 1471 int iflags = (acep_flags & 0xf); 1472 1473 if ((vtype == VDIR) && (iflags & ACE_DIRECTORY_INHERIT_ACE)) 1474 return (1); 1475 else if (iflags & ACE_FILE_INHERIT_ACE) 1476 return (!((vtype == VDIR) && 1477 (iflags & ACE_NO_PROPAGATE_INHERIT_ACE))); 1478 return (0); 1479 } 1480 1481 /* 1482 * inherit inheritable ACEs from parent 1483 */ 1484 static zfs_acl_t * 1485 zfs_acl_inherit(zfsvfs_t *zfsvfs, vtype_t vtype, zfs_acl_t *paclp, 1486 uint64_t mode, boolean_t *need_chmod) 1487 { 1488 void *pacep = NULL; 1489 void *acep; 1490 zfs_acl_node_t *aclnode; 1491 zfs_acl_t *aclp = NULL; 1492 uint64_t who; 1493 uint32_t access_mask; 1494 uint16_t iflags, newflags, type; 1495 size_t ace_size; 1496 void *data1, *data2; 1497 size_t data1sz, data2sz; 1498 uint_t aclinherit; 1499 boolean_t isdir = (vtype == VDIR); 1500 boolean_t isreg = (vtype == VREG); 1501 1502 *need_chmod = B_TRUE; 1503 1504 aclp = zfs_acl_alloc(paclp->z_version); 1505 aclinherit = zfsvfs->z_acl_inherit; 1506 if (aclinherit == ZFS_ACL_DISCARD || vtype == VLNK) 1507 return (aclp); 1508 1509 while ((pacep = zfs_acl_next_ace(paclp, pacep, &who, 1510 &access_mask, &iflags, &type))) { 1511 1512 /* 1513 * don't inherit bogus ACEs 1514 */ 1515 if (!zfs_acl_valid_ace_type(type, iflags)) 1516 continue; 1517 1518 /* 1519 * Check if ACE is inheritable by this vnode 1520 */ 1521 if ((aclinherit == ZFS_ACL_NOALLOW && type == ALLOW) || 1522 !zfs_ace_can_use(vtype, iflags)) 1523 continue; 1524 1525 /* 1526 * If owner@, group@, or everyone@ inheritable 1527 * then zfs_acl_chmod() isn't needed. 1528 */ 1529 if ((aclinherit == ZFS_ACL_PASSTHROUGH || 1530 aclinherit == ZFS_ACL_PASSTHROUGH_X) && 1531 ((iflags & (ACE_OWNER|ACE_EVERYONE)) || 1532 ((iflags & OWNING_GROUP) == OWNING_GROUP)) && 1533 (isreg || (isdir && (iflags & ACE_DIRECTORY_INHERIT_ACE)))) 1534 *need_chmod = B_FALSE; 1535 1536 /* 1537 * Strip inherited execute permission from file if 1538 * not in mode 1539 */ 1540 if (aclinherit == ZFS_ACL_PASSTHROUGH_X && type == ALLOW && 1541 !isdir && ((mode & (S_IXUSR|S_IXGRP|S_IXOTH)) == 0)) { 1542 access_mask &= ~ACE_EXECUTE; 1543 } 1544 1545 /* 1546 * Strip write_acl and write_owner from permissions 1547 * when inheriting an ACE 1548 */ 1549 if (aclinherit == ZFS_ACL_RESTRICTED && type == ALLOW) { 1550 access_mask &= ~RESTRICTED_CLEAR; 1551 } 1552 1553 ace_size = aclp->z_ops->ace_size(pacep); 1554 aclnode = zfs_acl_node_alloc(ace_size); 1555 list_insert_tail(&aclp->z_acl, aclnode); 1556 acep = aclnode->z_acldata; 1557 1558 zfs_set_ace(aclp, acep, access_mask, type, 1559 who, iflags|ACE_INHERITED_ACE); 1560 1561 /* 1562 * Copy special opaque data if any 1563 */ 1564 if ((data1sz = paclp->z_ops->ace_data(pacep, &data1)) != 0) { 1565 data2sz = aclp->z_ops->ace_data(acep, &data2); 1566 VERIFY3U(data2sz, ==, data1sz); 1567 memcpy(data2, data1, data2sz); 1568 } 1569 1570 aclp->z_acl_count++; 1571 aclnode->z_ace_count++; 1572 aclp->z_acl_bytes += aclnode->z_size; 1573 newflags = aclp->z_ops->ace_flags_get(acep); 1574 1575 /* 1576 * If ACE is not to be inherited further, or if the vnode is 1577 * not a directory, remove all inheritance flags 1578 */ 1579 if (!isdir || (iflags & ACE_NO_PROPAGATE_INHERIT_ACE)) { 1580 newflags &= ~ALL_INHERIT; 1581 aclp->z_ops->ace_flags_set(acep, 1582 newflags|ACE_INHERITED_ACE); 1583 continue; 1584 } 1585 1586 /* 1587 * This directory has an inheritable ACE 1588 */ 1589 aclp->z_hints |= ZFS_INHERIT_ACE; 1590 1591 /* 1592 * If only FILE_INHERIT is set then turn on 1593 * inherit_only 1594 */ 1595 if ((iflags & (ACE_FILE_INHERIT_ACE | 1596 ACE_DIRECTORY_INHERIT_ACE)) == ACE_FILE_INHERIT_ACE) { 1597 newflags |= ACE_INHERIT_ONLY_ACE; 1598 aclp->z_ops->ace_flags_set(acep, 1599 newflags|ACE_INHERITED_ACE); 1600 } else { 1601 newflags &= ~ACE_INHERIT_ONLY_ACE; 1602 aclp->z_ops->ace_flags_set(acep, 1603 newflags|ACE_INHERITED_ACE); 1604 } 1605 } 1606 if (zfsvfs->z_acl_mode == ZFS_ACL_RESTRICTED && 1607 aclp->z_acl_count != 0) { 1608 *need_chmod = B_FALSE; 1609 } 1610 1611 return (aclp); 1612 } 1613 1614 /* 1615 * Create file system object initial permissions 1616 * including inheritable ACEs. 1617 * Also, create FUIDs for owner and group. 1618 */ 1619 int 1620 zfs_acl_ids_create(znode_t *dzp, int flag, vattr_t *vap, cred_t *cr, 1621 vsecattr_t *vsecp, zfs_acl_ids_t *acl_ids, zidmap_t *mnt_ns) 1622 { 1623 int error; 1624 zfsvfs_t *zfsvfs = dzp->z_zfsvfs; 1625 zfs_acl_t *paclp; 1626 gid_t gid; 1627 boolean_t need_chmod = B_TRUE; 1628 boolean_t trim = B_FALSE; 1629 boolean_t inherited = B_FALSE; 1630 1631 if ((flag & IS_ROOT_NODE) == 0) { 1632 if (zfsvfs->z_replay == B_FALSE) 1633 ASSERT_VOP_ELOCKED(ZTOV(dzp), __func__); 1634 } else 1635 ASSERT3P(dzp->z_vnode, ==, NULL); 1636 memset(acl_ids, 0, sizeof (zfs_acl_ids_t)); 1637 acl_ids->z_mode = MAKEIMODE(vap->va_type, vap->va_mode); 1638 1639 if (vsecp) 1640 if ((error = zfs_vsec_2_aclp(zfsvfs, vap->va_type, vsecp, cr, 1641 &acl_ids->z_fuidp, &acl_ids->z_aclp)) != 0) 1642 return (error); 1643 /* 1644 * Determine uid and gid. 1645 */ 1646 if ((flag & IS_ROOT_NODE) || zfsvfs->z_replay || 1647 ((flag & IS_XATTR) && (vap->va_type == VDIR))) { 1648 acl_ids->z_fuid = zfs_fuid_create(zfsvfs, 1649 (uint64_t)vap->va_uid, cr, 1650 ZFS_OWNER, &acl_ids->z_fuidp); 1651 acl_ids->z_fgid = zfs_fuid_create(zfsvfs, 1652 (uint64_t)vap->va_gid, cr, 1653 ZFS_GROUP, &acl_ids->z_fuidp); 1654 gid = vap->va_gid; 1655 } else { 1656 uid_t id = crgetuid(cr); 1657 if (IS_EPHEMERAL(id)) 1658 id = UID_NOBODY; 1659 acl_ids->z_fuid = (uint64_t)id; 1660 acl_ids->z_fgid = 0; 1661 if (vap->va_mask & AT_GID) { 1662 acl_ids->z_fgid = zfs_fuid_create(zfsvfs, 1663 (uint64_t)vap->va_gid, 1664 cr, ZFS_GROUP, &acl_ids->z_fuidp); 1665 gid = vap->va_gid; 1666 if (acl_ids->z_fgid != dzp->z_gid && 1667 !groupmember(vap->va_gid, cr) && 1668 secpolicy_vnode_create_gid(cr) != 0) 1669 acl_ids->z_fgid = 0; 1670 } 1671 if (acl_ids->z_fgid == 0) { 1672 const char *domain; 1673 uint32_t rid; 1674 1675 acl_ids->z_fgid = dzp->z_gid; 1676 gid = zfs_fuid_map_id(zfsvfs, acl_ids->z_fgid, 1677 cr, ZFS_GROUP); 1678 1679 if (zfsvfs->z_use_fuids && 1680 IS_EPHEMERAL(acl_ids->z_fgid)) { 1681 domain = 1682 zfs_fuid_idx_domain(&zfsvfs->z_fuid_idx, 1683 FUID_INDEX(acl_ids->z_fgid)); 1684 rid = FUID_RID(acl_ids->z_fgid); 1685 zfs_fuid_node_add(&acl_ids->z_fuidp, 1686 domain, rid, FUID_INDEX(acl_ids->z_fgid), 1687 acl_ids->z_fgid, ZFS_GROUP); 1688 } 1689 } 1690 } 1691 1692 /* 1693 * If we're creating a directory, and the parent directory has the 1694 * set-GID bit set, set in on the new directory. 1695 * Otherwise, if the user is neither privileged nor a member of the 1696 * file's new group, clear the file's set-GID bit. 1697 */ 1698 1699 if (!(flag & IS_ROOT_NODE) && (dzp->z_mode & S_ISGID) && 1700 (vap->va_type == VDIR)) { 1701 acl_ids->z_mode |= S_ISGID; 1702 } else { 1703 if ((acl_ids->z_mode & S_ISGID) && 1704 secpolicy_vnode_setids_setgids(ZTOV(dzp), cr, gid) != 0) 1705 acl_ids->z_mode &= ~S_ISGID; 1706 } 1707 1708 if (acl_ids->z_aclp == NULL) { 1709 mutex_enter(&dzp->z_acl_lock); 1710 if (!(flag & IS_ROOT_NODE) && 1711 (dzp->z_pflags & ZFS_INHERIT_ACE) && 1712 !(dzp->z_pflags & ZFS_XATTR)) { 1713 VERIFY0(zfs_acl_node_read(dzp, B_TRUE, 1714 &paclp, B_FALSE)); 1715 acl_ids->z_aclp = zfs_acl_inherit(zfsvfs, 1716 vap->va_type, paclp, acl_ids->z_mode, &need_chmod); 1717 inherited = B_TRUE; 1718 } else { 1719 acl_ids->z_aclp = 1720 zfs_acl_alloc(zfs_acl_version_zp(dzp)); 1721 acl_ids->z_aclp->z_hints |= ZFS_ACL_TRIVIAL; 1722 } 1723 mutex_exit(&dzp->z_acl_lock); 1724 1725 if (need_chmod) { 1726 if (vap->va_type == VDIR) 1727 acl_ids->z_aclp->z_hints |= 1728 ZFS_ACL_AUTO_INHERIT; 1729 1730 if (zfsvfs->z_acl_mode == ZFS_ACL_GROUPMASK && 1731 zfsvfs->z_acl_inherit != ZFS_ACL_PASSTHROUGH && 1732 zfsvfs->z_acl_inherit != ZFS_ACL_PASSTHROUGH_X) 1733 trim = B_TRUE; 1734 zfs_acl_chmod(vap->va_type, acl_ids->z_mode, B_FALSE, 1735 trim, acl_ids->z_aclp); 1736 } 1737 } 1738 1739 if (inherited || vsecp) { 1740 acl_ids->z_mode = zfs_mode_compute(acl_ids->z_mode, 1741 acl_ids->z_aclp, &acl_ids->z_aclp->z_hints, 1742 acl_ids->z_fuid, acl_ids->z_fgid); 1743 if (ace_trivial_common(acl_ids->z_aclp, 0, zfs_ace_walk) == 0) 1744 acl_ids->z_aclp->z_hints |= ZFS_ACL_TRIVIAL; 1745 } 1746 1747 return (0); 1748 } 1749 1750 /* 1751 * Free ACL and fuid_infop, but not the acl_ids structure 1752 */ 1753 void 1754 zfs_acl_ids_free(zfs_acl_ids_t *acl_ids) 1755 { 1756 if (acl_ids->z_aclp) 1757 zfs_acl_free(acl_ids->z_aclp); 1758 if (acl_ids->z_fuidp) 1759 zfs_fuid_info_free(acl_ids->z_fuidp); 1760 acl_ids->z_aclp = NULL; 1761 acl_ids->z_fuidp = NULL; 1762 } 1763 1764 boolean_t 1765 zfs_acl_ids_overquota(zfsvfs_t *zv, zfs_acl_ids_t *acl_ids, uint64_t projid) 1766 { 1767 return (zfs_id_overquota(zv, DMU_USERUSED_OBJECT, acl_ids->z_fuid) || 1768 zfs_id_overquota(zv, DMU_GROUPUSED_OBJECT, acl_ids->z_fgid) || 1769 (projid != ZFS_DEFAULT_PROJID && projid != ZFS_INVALID_PROJID && 1770 zfs_id_overquota(zv, DMU_PROJECTUSED_OBJECT, projid))); 1771 } 1772 1773 /* 1774 * Retrieve a file's ACL 1775 */ 1776 int 1777 zfs_getacl(znode_t *zp, vsecattr_t *vsecp, boolean_t skipaclchk, cred_t *cr) 1778 { 1779 zfs_acl_t *aclp; 1780 ulong_t mask; 1781 int error; 1782 int count = 0; 1783 int largeace = 0; 1784 1785 mask = vsecp->vsa_mask & (VSA_ACE | VSA_ACECNT | 1786 VSA_ACE_ACLFLAGS | VSA_ACE_ALLTYPES); 1787 1788 if (mask == 0) 1789 return (SET_ERROR(ENOSYS)); 1790 1791 if ((error = zfs_zaccess(zp, ACE_READ_ACL, 0, skipaclchk, cr, NULL))) 1792 return (error); 1793 1794 mutex_enter(&zp->z_acl_lock); 1795 1796 if (zp->z_zfsvfs->z_replay == B_FALSE) 1797 ASSERT_VOP_LOCKED(ZTOV(zp), __func__); 1798 error = zfs_acl_node_read(zp, B_TRUE, &aclp, B_FALSE); 1799 if (error != 0) { 1800 mutex_exit(&zp->z_acl_lock); 1801 return (error); 1802 } 1803 1804 /* 1805 * Scan ACL to determine number of ACEs 1806 */ 1807 if ((zp->z_pflags & ZFS_ACL_OBJ_ACE) && !(mask & VSA_ACE_ALLTYPES)) { 1808 void *zacep = NULL; 1809 uint64_t who; 1810 uint32_t access_mask; 1811 uint16_t type, iflags; 1812 1813 while ((zacep = zfs_acl_next_ace(aclp, zacep, 1814 &who, &access_mask, &iflags, &type))) { 1815 switch (type) { 1816 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 1817 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 1818 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 1819 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 1820 largeace++; 1821 continue; 1822 default: 1823 count++; 1824 } 1825 } 1826 vsecp->vsa_aclcnt = count; 1827 } else 1828 count = (int)aclp->z_acl_count; 1829 1830 if (mask & VSA_ACECNT) { 1831 vsecp->vsa_aclcnt = count; 1832 } 1833 1834 if (mask & VSA_ACE) { 1835 size_t aclsz; 1836 1837 aclsz = count * sizeof (ace_t) + 1838 sizeof (ace_object_t) * largeace; 1839 1840 vsecp->vsa_aclentp = kmem_alloc(aclsz, KM_SLEEP); 1841 vsecp->vsa_aclentsz = aclsz; 1842 1843 if (aclp->z_version == ZFS_ACL_VERSION_FUID) 1844 zfs_copy_fuid_2_ace(zp->z_zfsvfs, aclp, cr, 1845 vsecp->vsa_aclentp, !(mask & VSA_ACE_ALLTYPES)); 1846 else { 1847 zfs_acl_node_t *aclnode; 1848 void *start = vsecp->vsa_aclentp; 1849 1850 for (aclnode = list_head(&aclp->z_acl); aclnode; 1851 aclnode = list_next(&aclp->z_acl, aclnode)) { 1852 memcpy(start, aclnode->z_acldata, 1853 aclnode->z_size); 1854 start = (caddr_t)start + aclnode->z_size; 1855 } 1856 ASSERT3U((caddr_t)start - (caddr_t)vsecp->vsa_aclentp, 1857 ==, aclp->z_acl_bytes); 1858 } 1859 } 1860 if (mask & VSA_ACE_ACLFLAGS) { 1861 vsecp->vsa_aclflags = 0; 1862 if (zp->z_pflags & ZFS_ACL_DEFAULTED) 1863 vsecp->vsa_aclflags |= ACL_DEFAULTED; 1864 if (zp->z_pflags & ZFS_ACL_PROTECTED) 1865 vsecp->vsa_aclflags |= ACL_PROTECTED; 1866 if (zp->z_pflags & ZFS_ACL_AUTO_INHERIT) 1867 vsecp->vsa_aclflags |= ACL_AUTO_INHERIT; 1868 } 1869 1870 mutex_exit(&zp->z_acl_lock); 1871 1872 return (0); 1873 } 1874 1875 int 1876 zfs_vsec_2_aclp(zfsvfs_t *zfsvfs, umode_t obj_type, 1877 vsecattr_t *vsecp, cred_t *cr, zfs_fuid_info_t **fuidp, zfs_acl_t **zaclp) 1878 { 1879 zfs_acl_t *aclp; 1880 zfs_acl_node_t *aclnode; 1881 int aclcnt = vsecp->vsa_aclcnt; 1882 int error; 1883 1884 if (vsecp->vsa_aclcnt > MAX_ACL_ENTRIES || vsecp->vsa_aclcnt <= 0) 1885 return (SET_ERROR(EINVAL)); 1886 1887 aclp = zfs_acl_alloc(zfs_acl_version(zfsvfs->z_version)); 1888 1889 aclp->z_hints = 0; 1890 aclnode = zfs_acl_node_alloc(aclcnt * sizeof (zfs_object_ace_t)); 1891 if (aclp->z_version == ZFS_ACL_VERSION_INITIAL) { 1892 if ((error = zfs_copy_ace_2_oldace(obj_type, aclp, 1893 (ace_t *)vsecp->vsa_aclentp, aclnode->z_acldata, 1894 aclcnt, &aclnode->z_size)) != 0) { 1895 zfs_acl_free(aclp); 1896 zfs_acl_node_free(aclnode); 1897 return (error); 1898 } 1899 } else { 1900 if ((error = zfs_copy_ace_2_fuid(zfsvfs, obj_type, aclp, 1901 vsecp->vsa_aclentp, aclnode->z_acldata, aclcnt, 1902 &aclnode->z_size, fuidp, cr)) != 0) { 1903 zfs_acl_free(aclp); 1904 zfs_acl_node_free(aclnode); 1905 return (error); 1906 } 1907 } 1908 aclp->z_acl_bytes = aclnode->z_size; 1909 aclnode->z_ace_count = aclcnt; 1910 aclp->z_acl_count = aclcnt; 1911 list_insert_head(&aclp->z_acl, aclnode); 1912 1913 /* 1914 * If flags are being set then add them to z_hints 1915 */ 1916 if (vsecp->vsa_mask & VSA_ACE_ACLFLAGS) { 1917 if (vsecp->vsa_aclflags & ACL_PROTECTED) 1918 aclp->z_hints |= ZFS_ACL_PROTECTED; 1919 if (vsecp->vsa_aclflags & ACL_DEFAULTED) 1920 aclp->z_hints |= ZFS_ACL_DEFAULTED; 1921 if (vsecp->vsa_aclflags & ACL_AUTO_INHERIT) 1922 aclp->z_hints |= ZFS_ACL_AUTO_INHERIT; 1923 } 1924 1925 *zaclp = aclp; 1926 1927 return (0); 1928 } 1929 1930 /* 1931 * Set a file's ACL 1932 */ 1933 int 1934 zfs_setacl(znode_t *zp, vsecattr_t *vsecp, boolean_t skipaclchk, cred_t *cr) 1935 { 1936 zfsvfs_t *zfsvfs = zp->z_zfsvfs; 1937 zilog_t *zilog = zfsvfs->z_log; 1938 ulong_t mask = vsecp->vsa_mask & (VSA_ACE | VSA_ACECNT); 1939 dmu_tx_t *tx; 1940 int error; 1941 zfs_acl_t *aclp; 1942 zfs_fuid_info_t *fuidp = NULL; 1943 boolean_t fuid_dirtied; 1944 uint64_t acl_obj; 1945 1946 if (zp->z_zfsvfs->z_replay == B_FALSE) 1947 ASSERT_VOP_ELOCKED(ZTOV(zp), __func__); 1948 if (mask == 0) 1949 return (SET_ERROR(ENOSYS)); 1950 1951 if (zp->z_pflags & ZFS_IMMUTABLE) 1952 return (SET_ERROR(EPERM)); 1953 1954 if ((error = zfs_zaccess(zp, ACE_WRITE_ACL, 0, skipaclchk, cr, NULL))) 1955 return (error); 1956 1957 error = zfs_vsec_2_aclp(zfsvfs, ZTOV(zp)->v_type, vsecp, cr, &fuidp, 1958 &aclp); 1959 if (error) 1960 return (error); 1961 1962 /* 1963 * If ACL wide flags aren't being set then preserve any 1964 * existing flags. 1965 */ 1966 if (!(vsecp->vsa_mask & VSA_ACE_ACLFLAGS)) { 1967 aclp->z_hints |= 1968 (zp->z_pflags & V4_ACL_WIDE_FLAGS); 1969 } 1970 top: 1971 mutex_enter(&zp->z_acl_lock); 1972 1973 tx = dmu_tx_create(zfsvfs->z_os); 1974 1975 dmu_tx_hold_sa(tx, zp->z_sa_hdl, B_TRUE); 1976 1977 fuid_dirtied = zfsvfs->z_fuid_dirty; 1978 if (fuid_dirtied) 1979 zfs_fuid_txhold(zfsvfs, tx); 1980 1981 /* 1982 * If old version and ACL won't fit in bonus and we aren't 1983 * upgrading then take out necessary DMU holds 1984 */ 1985 1986 if ((acl_obj = zfs_external_acl(zp)) != 0) { 1987 if (zfsvfs->z_version >= ZPL_VERSION_FUID && 1988 zfs_znode_acl_version(zp) <= ZFS_ACL_VERSION_INITIAL) { 1989 dmu_tx_hold_free(tx, acl_obj, 0, 1990 DMU_OBJECT_END); 1991 dmu_tx_hold_write(tx, DMU_NEW_OBJECT, 0, 1992 aclp->z_acl_bytes); 1993 } else { 1994 dmu_tx_hold_write(tx, acl_obj, 0, aclp->z_acl_bytes); 1995 } 1996 } else if (!zp->z_is_sa && aclp->z_acl_bytes > ZFS_ACE_SPACE) { 1997 dmu_tx_hold_write(tx, DMU_NEW_OBJECT, 0, aclp->z_acl_bytes); 1998 } 1999 2000 zfs_sa_upgrade_txholds(tx, zp); 2001 error = dmu_tx_assign(tx, DMU_TX_NOWAIT); 2002 if (error) { 2003 mutex_exit(&zp->z_acl_lock); 2004 2005 if (error == ERESTART) { 2006 dmu_tx_wait(tx); 2007 dmu_tx_abort(tx); 2008 goto top; 2009 } 2010 dmu_tx_abort(tx); 2011 zfs_acl_free(aclp); 2012 return (error); 2013 } 2014 2015 error = zfs_aclset_common(zp, aclp, cr, tx); 2016 ASSERT0(error); 2017 ASSERT3P(zp->z_acl_cached, ==, NULL); 2018 zp->z_acl_cached = aclp; 2019 2020 if (fuid_dirtied) 2021 zfs_fuid_sync(zfsvfs, tx); 2022 2023 zfs_log_acl(zilog, tx, zp, vsecp, fuidp); 2024 2025 if (fuidp) 2026 zfs_fuid_info_free(fuidp); 2027 dmu_tx_commit(tx); 2028 mutex_exit(&zp->z_acl_lock); 2029 2030 return (error); 2031 } 2032 2033 /* 2034 * Check accesses of interest (AoI) against attributes of the dataset 2035 * such as read-only. Returns zero if no AoI conflict with dataset 2036 * attributes, otherwise an appropriate errno is returned. 2037 */ 2038 static int 2039 zfs_zaccess_dataset_check(znode_t *zp, uint32_t v4_mode) 2040 { 2041 if ((v4_mode & WRITE_MASK) && 2042 (zp->z_zfsvfs->z_vfs->vfs_flag & VFS_RDONLY) && 2043 (!IS_DEVVP(ZTOV(zp)) || (v4_mode & WRITE_MASK_ATTRS))) { 2044 return (SET_ERROR(EROFS)); 2045 } 2046 2047 /* 2048 * Intentionally allow ZFS_READONLY through here. 2049 * See zfs_zaccess_common(). 2050 */ 2051 if ((v4_mode & WRITE_MASK_DATA) && 2052 (zp->z_pflags & ZFS_IMMUTABLE)) { 2053 return (SET_ERROR(EPERM)); 2054 } 2055 2056 /* 2057 * In FreeBSD we allow to modify directory's content is ZFS_NOUNLINK 2058 * (sunlnk) is set. We just don't allow directory removal, which is 2059 * handled in zfs_zaccess_delete(). 2060 */ 2061 if ((v4_mode & ACE_DELETE) && 2062 (zp->z_pflags & ZFS_NOUNLINK)) { 2063 return (EPERM); 2064 } 2065 2066 if (((v4_mode & (ACE_READ_DATA|ACE_EXECUTE)) && 2067 (zp->z_pflags & ZFS_AV_QUARANTINED))) { 2068 return (SET_ERROR(EACCES)); 2069 } 2070 2071 return (0); 2072 } 2073 2074 /* 2075 * The primary usage of this function is to loop through all of the 2076 * ACEs in the znode, determining what accesses of interest (AoI) to 2077 * the caller are allowed or denied. The AoI are expressed as bits in 2078 * the working_mode parameter. As each ACE is processed, bits covered 2079 * by that ACE are removed from the working_mode. This removal 2080 * facilitates two things. The first is that when the working mode is 2081 * empty (= 0), we know we've looked at all the AoI. The second is 2082 * that the ACE interpretation rules don't allow a later ACE to undo 2083 * something granted or denied by an earlier ACE. Removing the 2084 * discovered access or denial enforces this rule. At the end of 2085 * processing the ACEs, all AoI that were found to be denied are 2086 * placed into the working_mode, giving the caller a mask of denied 2087 * accesses. Returns: 2088 * 0 if all AoI granted 2089 * EACCESS if the denied mask is non-zero 2090 * other error if abnormal failure (e.g., IO error) 2091 * 2092 * A secondary usage of the function is to determine if any of the 2093 * AoI are granted. If an ACE grants any access in 2094 * the working_mode, we immediately short circuit out of the function. 2095 * This mode is chosen by setting anyaccess to B_TRUE. The 2096 * working_mode is not a denied access mask upon exit if the function 2097 * is used in this manner. 2098 */ 2099 static int 2100 zfs_zaccess_aces_check(znode_t *zp, uint32_t *working_mode, 2101 boolean_t anyaccess, cred_t *cr) 2102 { 2103 zfsvfs_t *zfsvfs = zp->z_zfsvfs; 2104 zfs_acl_t *aclp; 2105 int error; 2106 uid_t uid = crgetuid(cr); 2107 uint64_t who; 2108 uint16_t type, iflags; 2109 uint16_t entry_type; 2110 uint32_t access_mask; 2111 uint32_t deny_mask = 0; 2112 zfs_ace_hdr_t *acep = NULL; 2113 boolean_t checkit; 2114 uid_t gowner; 2115 uid_t fowner; 2116 2117 zfs_fuid_map_ids(zp, cr, &fowner, &gowner); 2118 2119 mutex_enter(&zp->z_acl_lock); 2120 2121 if (zp->z_zfsvfs->z_replay == B_FALSE) 2122 ASSERT_VOP_LOCKED(ZTOV(zp), __func__); 2123 error = zfs_acl_node_read(zp, B_TRUE, &aclp, B_FALSE); 2124 if (error != 0) { 2125 mutex_exit(&zp->z_acl_lock); 2126 return (error); 2127 } 2128 2129 ASSERT3P(zp->z_acl_cached, !=, NULL); 2130 2131 while ((acep = zfs_acl_next_ace(aclp, acep, &who, &access_mask, 2132 &iflags, &type))) { 2133 uint32_t mask_matched; 2134 2135 if (!zfs_acl_valid_ace_type(type, iflags)) 2136 continue; 2137 2138 if (ZTOV(zp)->v_type == VDIR && (iflags & ACE_INHERIT_ONLY_ACE)) 2139 continue; 2140 2141 /* Skip ACE if it does not affect any AoI */ 2142 mask_matched = (access_mask & *working_mode); 2143 if (!mask_matched) 2144 continue; 2145 2146 entry_type = (iflags & ACE_TYPE_FLAGS); 2147 2148 checkit = B_FALSE; 2149 2150 switch (entry_type) { 2151 case ACE_OWNER: 2152 if (uid == fowner) 2153 checkit = B_TRUE; 2154 break; 2155 case OWNING_GROUP: 2156 who = gowner; 2157 zfs_fallthrough; 2158 case ACE_IDENTIFIER_GROUP: 2159 checkit = zfs_groupmember(zfsvfs, who, cr); 2160 break; 2161 case ACE_EVERYONE: 2162 checkit = B_TRUE; 2163 break; 2164 2165 /* USER Entry */ 2166 default: 2167 if (entry_type == 0) { 2168 uid_t newid; 2169 2170 newid = zfs_fuid_map_id(zfsvfs, who, cr, 2171 ZFS_ACE_USER); 2172 if (newid != UID_NOBODY && 2173 uid == newid) 2174 checkit = B_TRUE; 2175 break; 2176 } else { 2177 mutex_exit(&zp->z_acl_lock); 2178 return (SET_ERROR(EIO)); 2179 } 2180 } 2181 2182 if (checkit) { 2183 if (type == DENY) { 2184 DTRACE_PROBE3(zfs__ace__denies, 2185 znode_t *, zp, 2186 zfs_ace_hdr_t *, acep, 2187 uint32_t, mask_matched); 2188 deny_mask |= mask_matched; 2189 } else { 2190 DTRACE_PROBE3(zfs__ace__allows, 2191 znode_t *, zp, 2192 zfs_ace_hdr_t *, acep, 2193 uint32_t, mask_matched); 2194 if (anyaccess) { 2195 mutex_exit(&zp->z_acl_lock); 2196 return (0); 2197 } 2198 } 2199 *working_mode &= ~mask_matched; 2200 } 2201 2202 /* Are we done? */ 2203 if (*working_mode == 0) 2204 break; 2205 } 2206 2207 mutex_exit(&zp->z_acl_lock); 2208 2209 /* Put the found 'denies' back on the working mode */ 2210 if (deny_mask) { 2211 *working_mode |= deny_mask; 2212 return (SET_ERROR(EACCES)); 2213 } else if (*working_mode) { 2214 return (-1); 2215 } 2216 2217 return (0); 2218 } 2219 2220 /* 2221 * Return true if any access whatsoever granted, we don't actually 2222 * care what access is granted. 2223 */ 2224 boolean_t 2225 zfs_has_access(znode_t *zp, cred_t *cr) 2226 { 2227 uint32_t have = ACE_ALL_PERMS; 2228 2229 if (zfs_zaccess_aces_check(zp, &have, B_TRUE, cr) != 0) { 2230 uid_t owner; 2231 2232 owner = zfs_fuid_map_id(zp->z_zfsvfs, zp->z_uid, cr, ZFS_OWNER); 2233 return (secpolicy_vnode_any_access(cr, ZTOV(zp), owner) == 0); 2234 } 2235 return (B_TRUE); 2236 } 2237 2238 static int 2239 zfs_zaccess_common(znode_t *zp, uint32_t v4_mode, uint32_t *working_mode, 2240 boolean_t *check_privs, boolean_t skipaclchk, cred_t *cr) 2241 { 2242 zfsvfs_t *zfsvfs = zp->z_zfsvfs; 2243 int err; 2244 2245 *working_mode = v4_mode; 2246 *check_privs = B_TRUE; 2247 2248 /* 2249 * Short circuit empty requests 2250 */ 2251 if (v4_mode == 0 || zfsvfs->z_replay) { 2252 *working_mode = 0; 2253 return (0); 2254 } 2255 2256 if ((err = zfs_zaccess_dataset_check(zp, v4_mode)) != 0) { 2257 *check_privs = B_FALSE; 2258 return (err); 2259 } 2260 2261 /* 2262 * The caller requested that the ACL check be skipped. This 2263 * would only happen if the caller checked VOP_ACCESS() with a 2264 * 32 bit ACE mask and already had the appropriate permissions. 2265 */ 2266 if (skipaclchk) { 2267 *working_mode = 0; 2268 return (0); 2269 } 2270 2271 /* 2272 * Note: ZFS_READONLY represents the "DOS R/O" attribute. 2273 * When that flag is set, we should behave as if write access 2274 * were not granted by anything in the ACL. In particular: 2275 * We _must_ allow writes after opening the file r/w, then 2276 * setting the DOS R/O attribute, and writing some more. 2277 * (Similar to how you can write after fchmod(fd, 0444).) 2278 * 2279 * Therefore ZFS_READONLY is ignored in the dataset check 2280 * above, and checked here as if part of the ACL check. 2281 * Also note: DOS R/O is ignored for directories. 2282 */ 2283 if ((v4_mode & WRITE_MASK_DATA) && 2284 (ZTOV(zp)->v_type != VDIR) && 2285 (zp->z_pflags & ZFS_READONLY)) { 2286 return (SET_ERROR(EPERM)); 2287 } 2288 2289 return (zfs_zaccess_aces_check(zp, working_mode, B_FALSE, cr)); 2290 } 2291 2292 static int 2293 zfs_zaccess_append(znode_t *zp, uint32_t *working_mode, boolean_t *check_privs, 2294 cred_t *cr) 2295 { 2296 if (*working_mode != ACE_WRITE_DATA) 2297 return (SET_ERROR(EACCES)); 2298 2299 return (zfs_zaccess_common(zp, ACE_APPEND_DATA, working_mode, 2300 check_privs, B_FALSE, cr)); 2301 } 2302 2303 /* 2304 * Check if VEXEC is allowed. 2305 * 2306 * This routine is based on zfs_fastaccesschk_execute which has slowpath 2307 * calling zfs_zaccess. This would be incorrect on FreeBSD (see 2308 * zfs_freebsd_access for the difference). Thus this variant let's the 2309 * caller handle the slowpath (if necessary). 2310 * 2311 * On top of that we perform a lockless check for ZFS_NO_EXECS_DENIED. 2312 * 2313 * Safe access to znode_t is provided by the vnode lock. 2314 */ 2315 int 2316 zfs_fastaccesschk_execute(znode_t *zdp, cred_t *cr) 2317 { 2318 boolean_t is_attr; 2319 2320 if (zdp->z_pflags & ZFS_AV_QUARANTINED) 2321 return (1); 2322 2323 is_attr = ((zdp->z_pflags & ZFS_XATTR) && 2324 (ZTOV(zdp)->v_type == VDIR)); 2325 if (is_attr) 2326 return (1); 2327 2328 if (zdp->z_pflags & ZFS_NO_EXECS_DENIED) 2329 return (0); 2330 2331 return (1); 2332 } 2333 2334 2335 /* 2336 * Determine whether Access should be granted/denied. 2337 * 2338 * The least priv subsystem is always consulted as a basic privilege 2339 * can define any form of access. 2340 */ 2341 int 2342 zfs_zaccess(znode_t *zp, int mode, int flags, boolean_t skipaclchk, cred_t *cr, 2343 zidmap_t *mnt_ns) 2344 { 2345 uint32_t working_mode; 2346 int error; 2347 int is_attr; 2348 boolean_t check_privs; 2349 znode_t *xzp = NULL; 2350 znode_t *check_zp = zp; 2351 mode_t needed_bits; 2352 uid_t owner; 2353 2354 is_attr = ((zp->z_pflags & ZFS_XATTR) && (ZTOV(zp)->v_type == VDIR)); 2355 2356 /* 2357 * In FreeBSD, we don't care about permissions of individual ADS. 2358 * Note that not checking them is not just an optimization - without 2359 * this shortcut, EA operations may bogusly fail with EACCES. 2360 */ 2361 if (zp->z_pflags & ZFS_XATTR) 2362 return (0); 2363 2364 owner = zfs_fuid_map_id(zp->z_zfsvfs, zp->z_uid, cr, ZFS_OWNER); 2365 2366 /* 2367 * Map the bits required to the standard vnode flags VREAD|VWRITE|VEXEC 2368 * in needed_bits. Map the bits mapped by working_mode (currently 2369 * missing) in missing_bits. 2370 * Call secpolicy_vnode_access2() with (needed_bits & ~checkmode), 2371 * needed_bits. 2372 */ 2373 needed_bits = 0; 2374 2375 working_mode = mode; 2376 if ((working_mode & (ACE_READ_ACL|ACE_READ_ATTRIBUTES)) && 2377 owner == crgetuid(cr)) 2378 working_mode &= ~(ACE_READ_ACL|ACE_READ_ATTRIBUTES); 2379 2380 if (working_mode & (ACE_READ_DATA|ACE_READ_NAMED_ATTRS| 2381 ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_SYNCHRONIZE)) 2382 needed_bits |= VREAD; 2383 if (working_mode & (ACE_WRITE_DATA|ACE_WRITE_NAMED_ATTRS| 2384 ACE_APPEND_DATA|ACE_WRITE_ATTRIBUTES|ACE_SYNCHRONIZE)) 2385 needed_bits |= VWRITE; 2386 if (working_mode & ACE_EXECUTE) 2387 needed_bits |= VEXEC; 2388 2389 if ((error = zfs_zaccess_common(check_zp, mode, &working_mode, 2390 &check_privs, skipaclchk, cr)) == 0) { 2391 if (is_attr) 2392 VN_RELE(ZTOV(xzp)); 2393 return (secpolicy_vnode_access2(cr, ZTOV(zp), owner, 2394 needed_bits, needed_bits)); 2395 } 2396 2397 if (error && !check_privs) { 2398 if (is_attr) 2399 VN_RELE(ZTOV(xzp)); 2400 return (error); 2401 } 2402 2403 if (error && (flags & V_APPEND)) { 2404 error = zfs_zaccess_append(zp, &working_mode, &check_privs, cr); 2405 } 2406 2407 if (error && check_privs) { 2408 mode_t checkmode = 0; 2409 vnode_t *check_vp = ZTOV(check_zp); 2410 2411 /* 2412 * First check for implicit owner permission on 2413 * read_acl/read_attributes 2414 */ 2415 2416 ASSERT3U(working_mode, !=, 0); 2417 2418 if ((working_mode & (ACE_READ_ACL|ACE_READ_ATTRIBUTES) && 2419 owner == crgetuid(cr))) 2420 working_mode &= ~(ACE_READ_ACL|ACE_READ_ATTRIBUTES); 2421 2422 if (working_mode & (ACE_READ_DATA|ACE_READ_NAMED_ATTRS| 2423 ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_SYNCHRONIZE)) 2424 checkmode |= VREAD; 2425 if (working_mode & (ACE_WRITE_DATA|ACE_WRITE_NAMED_ATTRS| 2426 ACE_APPEND_DATA|ACE_WRITE_ATTRIBUTES|ACE_SYNCHRONIZE)) 2427 checkmode |= VWRITE; 2428 if (working_mode & ACE_EXECUTE) 2429 checkmode |= VEXEC; 2430 2431 error = secpolicy_vnode_access2(cr, check_vp, owner, 2432 needed_bits & ~checkmode, needed_bits); 2433 2434 if (error == 0 && (working_mode & ACE_WRITE_OWNER)) 2435 error = secpolicy_vnode_chown(check_vp, cr, owner); 2436 if (error == 0 && (working_mode & ACE_WRITE_ACL)) 2437 error = secpolicy_vnode_setdac(check_vp, cr, owner); 2438 2439 if (error == 0 && (working_mode & 2440 (ACE_DELETE|ACE_DELETE_CHILD))) 2441 error = secpolicy_vnode_remove(check_vp, cr); 2442 2443 if (error == 0 && (working_mode & ACE_SYNCHRONIZE)) { 2444 error = secpolicy_vnode_chown(check_vp, cr, owner); 2445 } 2446 if (error == 0) { 2447 /* 2448 * See if any bits other than those already checked 2449 * for are still present. If so then return EACCES 2450 */ 2451 if (working_mode & ~(ZFS_CHECKED_MASKS)) { 2452 error = SET_ERROR(EACCES); 2453 } 2454 } 2455 } else if (error == 0) { 2456 error = secpolicy_vnode_access2(cr, ZTOV(zp), owner, 2457 needed_bits, needed_bits); 2458 } 2459 2460 2461 if (is_attr) 2462 VN_RELE(ZTOV(xzp)); 2463 2464 return (error); 2465 } 2466 2467 /* 2468 * Translate traditional unix VREAD/VWRITE/VEXEC mode into 2469 * NFSv4-style ZFS ACL format and call zfs_zaccess() 2470 */ 2471 int 2472 zfs_zaccess_rwx(znode_t *zp, mode_t mode, int flags, cred_t *cr, 2473 zidmap_t *mnt_ns) 2474 { 2475 return (zfs_zaccess(zp, zfs_unix_to_v4(mode >> 6), flags, B_FALSE, cr, 2476 mnt_ns)); 2477 } 2478 2479 /* 2480 * Access function for secpolicy_vnode_setattr 2481 */ 2482 int 2483 zfs_zaccess_unix(void *zp, int mode, cred_t *cr) 2484 { 2485 int v4_mode = zfs_unix_to_v4(mode >> 6); 2486 2487 return (zfs_zaccess(zp, v4_mode, 0, B_FALSE, cr, NULL)); 2488 } 2489 2490 static int 2491 zfs_delete_final_check(znode_t *zp, znode_t *dzp, 2492 mode_t available_perms, cred_t *cr) 2493 { 2494 int error; 2495 uid_t downer; 2496 2497 downer = zfs_fuid_map_id(dzp->z_zfsvfs, dzp->z_uid, cr, ZFS_OWNER); 2498 2499 error = secpolicy_vnode_access2(cr, ZTOV(dzp), 2500 downer, available_perms, VWRITE|VEXEC); 2501 2502 if (error == 0) 2503 error = zfs_sticky_remove_access(dzp, zp, cr); 2504 2505 return (error); 2506 } 2507 2508 /* 2509 * Determine whether Access should be granted/deny, without 2510 * consulting least priv subsystem. 2511 * 2512 * The following chart is the recommended NFSv4 enforcement for 2513 * ability to delete an object. 2514 * 2515 * ------------------------------------------------------- 2516 * | Parent Dir | Target Object Permissions | 2517 * | permissions | | 2518 * ------------------------------------------------------- 2519 * | | ACL Allows | ACL Denies| Delete | 2520 * | | Delete | Delete | unspecified| 2521 * ------------------------------------------------------- 2522 * | ACL Allows | Permit | Permit | Permit | 2523 * | DELETE_CHILD | | 2524 * ------------------------------------------------------- 2525 * | ACL Denies | Permit | Deny | Deny | 2526 * | DELETE_CHILD | | | | 2527 * ------------------------------------------------------- 2528 * | ACL specifies | | | | 2529 * | only allow | Permit | Permit | Permit | 2530 * | write and | | | | 2531 * | execute | | | | 2532 * ------------------------------------------------------- 2533 * | ACL denies | | | | 2534 * | write and | Permit | Deny | Deny | 2535 * | execute | | | | 2536 * ------------------------------------------------------- 2537 * ^ 2538 * | 2539 * No search privilege, can't even look up file? 2540 * 2541 */ 2542 int 2543 zfs_zaccess_delete(znode_t *dzp, znode_t *zp, cred_t *cr, zidmap_t *mnt_ns) 2544 { 2545 uint32_t dzp_working_mode = 0; 2546 uint32_t zp_working_mode = 0; 2547 int dzp_error, zp_error; 2548 mode_t available_perms; 2549 boolean_t dzpcheck_privs = B_TRUE; 2550 boolean_t zpcheck_privs = B_TRUE; 2551 2552 /* 2553 * We want specific DELETE permissions to 2554 * take precedence over WRITE/EXECUTE. We don't 2555 * want an ACL such as this to mess us up. 2556 * user:joe:write_data:deny,user:joe:delete:allow 2557 * 2558 * However, deny permissions may ultimately be overridden 2559 * by secpolicy_vnode_access(). 2560 * 2561 * We will ask for all of the necessary permissions and then 2562 * look at the working modes from the directory and target object 2563 * to determine what was found. 2564 */ 2565 2566 if (zp->z_pflags & (ZFS_IMMUTABLE | ZFS_NOUNLINK)) 2567 return (SET_ERROR(EPERM)); 2568 2569 /* 2570 * First row 2571 * If the directory permissions allow the delete, we are done. 2572 */ 2573 if ((dzp_error = zfs_zaccess_common(dzp, ACE_DELETE_CHILD, 2574 &dzp_working_mode, &dzpcheck_privs, B_FALSE, cr)) == 0) 2575 return (0); 2576 2577 /* 2578 * If target object has delete permission then we are done 2579 */ 2580 if ((zp_error = zfs_zaccess_common(zp, ACE_DELETE, &zp_working_mode, 2581 &zpcheck_privs, B_FALSE, cr)) == 0) 2582 return (0); 2583 2584 ASSERT(dzp_error); 2585 ASSERT(zp_error); 2586 2587 if (!dzpcheck_privs) 2588 return (dzp_error); 2589 if (!zpcheck_privs) 2590 return (zp_error); 2591 2592 /* 2593 * Second row 2594 * 2595 * If directory returns EACCES then delete_child was denied 2596 * due to deny delete_child. In this case send the request through 2597 * secpolicy_vnode_remove(). We don't use zfs_delete_final_check() 2598 * since that *could* allow the delete based on write/execute permission 2599 * and we want delete permissions to override write/execute. 2600 */ 2601 2602 if (dzp_error == EACCES) { 2603 /* XXXPJD: s/dzp/zp/ ? */ 2604 return (secpolicy_vnode_remove(ZTOV(dzp), cr)); 2605 } 2606 /* 2607 * Third Row 2608 * only need to see if we have write/execute on directory. 2609 */ 2610 2611 dzp_error = zfs_zaccess_common(dzp, ACE_EXECUTE|ACE_WRITE_DATA, 2612 &dzp_working_mode, &dzpcheck_privs, B_FALSE, cr); 2613 2614 if (dzp_error != 0 && !dzpcheck_privs) 2615 return (dzp_error); 2616 2617 /* 2618 * Fourth row 2619 */ 2620 2621 available_perms = (dzp_working_mode & ACE_WRITE_DATA) ? 0 : VWRITE; 2622 available_perms |= (dzp_working_mode & ACE_EXECUTE) ? 0 : VEXEC; 2623 2624 return (zfs_delete_final_check(zp, dzp, available_perms, cr)); 2625 2626 } 2627 2628 int 2629 zfs_zaccess_rename(znode_t *sdzp, znode_t *szp, znode_t *tdzp, 2630 znode_t *tzp, cred_t *cr, zidmap_t *mnt_ns) 2631 { 2632 int add_perm; 2633 int error; 2634 2635 if (szp->z_pflags & ZFS_AV_QUARANTINED) 2636 return (SET_ERROR(EACCES)); 2637 2638 add_perm = (ZTOV(szp)->v_type == VDIR) ? 2639 ACE_ADD_SUBDIRECTORY : ACE_ADD_FILE; 2640 2641 /* 2642 * Rename permissions are combination of delete permission + 2643 * add file/subdir permission. 2644 * 2645 * BSD operating systems also require write permission 2646 * on the directory being moved from one parent directory 2647 * to another. 2648 */ 2649 if (ZTOV(szp)->v_type == VDIR && ZTOV(sdzp) != ZTOV(tdzp)) { 2650 if ((error = zfs_zaccess(szp, ACE_WRITE_DATA, 0, B_FALSE, cr, 2651 mnt_ns))) 2652 return (error); 2653 } 2654 2655 /* 2656 * first make sure we do the delete portion. 2657 * 2658 * If that succeeds then check for add_file/add_subdir permissions 2659 */ 2660 2661 if ((error = zfs_zaccess_delete(sdzp, szp, cr, mnt_ns))) 2662 return (error); 2663 2664 /* 2665 * If we have a tzp, see if we can delete it? 2666 */ 2667 if (tzp && (error = zfs_zaccess_delete(tdzp, tzp, cr, mnt_ns))) 2668 return (error); 2669 2670 /* 2671 * Now check for add permissions 2672 */ 2673 error = zfs_zaccess(tdzp, add_perm, 0, B_FALSE, cr, mnt_ns); 2674 2675 return (error); 2676 } 2677