xref: /freebsd/sys/contrib/openzfs/module/os/freebsd/zfs/zfs_acl.c (revision c7046f76c2c027b00c0e6ba57cfd28f1a78f5e23)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or https://opensource.org/licenses/CDDL-1.0.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved.
23  * Copyright (c) 2013 by Delphix. All rights reserved.
24  * Copyright 2017 Nexenta Systems, Inc.  All rights reserved.
25  */
26 
27 #include <sys/types.h>
28 #include <sys/param.h>
29 #include <sys/time.h>
30 #include <sys/systm.h>
31 #include <sys/sysmacros.h>
32 #include <sys/resource.h>
33 #include <sys/vfs.h>
34 #include <sys/vnode.h>
35 #include <sys/file.h>
36 #include <sys/stat.h>
37 #include <sys/kmem.h>
38 #include <sys/cmn_err.h>
39 #include <sys/errno.h>
40 #include <sys/unistd.h>
41 #include <sys/sdt.h>
42 #include <sys/fs/zfs.h>
43 #include <sys/policy.h>
44 #include <sys/zfs_znode.h>
45 #include <sys/zfs_fuid.h>
46 #include <sys/zfs_acl.h>
47 #include <sys/zfs_dir.h>
48 #include <sys/zfs_quota.h>
49 #include <sys/zfs_vfsops.h>
50 #include <sys/dmu.h>
51 #include <sys/dnode.h>
52 #include <sys/zap.h>
53 #include <sys/sa.h>
54 #include <acl/acl_common.h>
55 
56 
57 #define	ALLOW	ACE_ACCESS_ALLOWED_ACE_TYPE
58 #define	DENY	ACE_ACCESS_DENIED_ACE_TYPE
59 #define	MAX_ACE_TYPE	ACE_SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE
60 #define	MIN_ACE_TYPE	ALLOW
61 
62 #define	OWNING_GROUP		(ACE_GROUP|ACE_IDENTIFIER_GROUP)
63 #define	EVERYONE_ALLOW_MASK (ACE_READ_ACL|ACE_READ_ATTRIBUTES | \
64     ACE_READ_NAMED_ATTRS|ACE_SYNCHRONIZE)
65 #define	EVERYONE_DENY_MASK (ACE_WRITE_ACL|ACE_WRITE_OWNER | \
66     ACE_WRITE_ATTRIBUTES|ACE_WRITE_NAMED_ATTRS)
67 #define	OWNER_ALLOW_MASK (ACE_WRITE_ACL | ACE_WRITE_OWNER | \
68     ACE_WRITE_ATTRIBUTES|ACE_WRITE_NAMED_ATTRS)
69 
70 #define	ZFS_CHECKED_MASKS (ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_READ_DATA| \
71     ACE_READ_NAMED_ATTRS|ACE_WRITE_DATA|ACE_WRITE_ATTRIBUTES| \
72     ACE_WRITE_NAMED_ATTRS|ACE_APPEND_DATA|ACE_EXECUTE|ACE_WRITE_OWNER| \
73     ACE_WRITE_ACL|ACE_DELETE|ACE_DELETE_CHILD|ACE_SYNCHRONIZE)
74 
75 #define	WRITE_MASK_DATA (ACE_WRITE_DATA|ACE_APPEND_DATA|ACE_WRITE_NAMED_ATTRS)
76 #define	WRITE_MASK_ATTRS (ACE_WRITE_ACL|ACE_WRITE_OWNER|ACE_WRITE_ATTRIBUTES| \
77     ACE_DELETE|ACE_DELETE_CHILD)
78 #define	WRITE_MASK (WRITE_MASK_DATA|WRITE_MASK_ATTRS)
79 
80 #define	OGE_CLEAR	(ACE_READ_DATA|ACE_LIST_DIRECTORY|ACE_WRITE_DATA| \
81     ACE_ADD_FILE|ACE_APPEND_DATA|ACE_ADD_SUBDIRECTORY|ACE_EXECUTE)
82 
83 #define	OKAY_MASK_BITS (ACE_READ_DATA|ACE_LIST_DIRECTORY|ACE_WRITE_DATA| \
84     ACE_ADD_FILE|ACE_APPEND_DATA|ACE_ADD_SUBDIRECTORY|ACE_EXECUTE)
85 
86 #define	ALL_INHERIT	(ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE | \
87     ACE_NO_PROPAGATE_INHERIT_ACE|ACE_INHERIT_ONLY_ACE|ACE_INHERITED_ACE)
88 
89 #define	RESTRICTED_CLEAR	(ACE_WRITE_ACL|ACE_WRITE_OWNER)
90 
91 #define	V4_ACL_WIDE_FLAGS (ZFS_ACL_AUTO_INHERIT|ZFS_ACL_DEFAULTED|\
92     ZFS_ACL_PROTECTED)
93 
94 #define	ZFS_ACL_WIDE_FLAGS (V4_ACL_WIDE_FLAGS|ZFS_ACL_TRIVIAL|ZFS_INHERIT_ACE|\
95     ZFS_ACL_OBJ_ACE)
96 
97 #define	ALL_MODE_EXECS (S_IXUSR | S_IXGRP | S_IXOTH)
98 
99 static uint16_t
100 zfs_ace_v0_get_type(void *acep)
101 {
102 	return (((zfs_oldace_t *)acep)->z_type);
103 }
104 
105 static uint16_t
106 zfs_ace_v0_get_flags(void *acep)
107 {
108 	return (((zfs_oldace_t *)acep)->z_flags);
109 }
110 
111 static uint32_t
112 zfs_ace_v0_get_mask(void *acep)
113 {
114 	return (((zfs_oldace_t *)acep)->z_access_mask);
115 }
116 
117 static uint64_t
118 zfs_ace_v0_get_who(void *acep)
119 {
120 	return (((zfs_oldace_t *)acep)->z_fuid);
121 }
122 
123 static void
124 zfs_ace_v0_set_type(void *acep, uint16_t type)
125 {
126 	((zfs_oldace_t *)acep)->z_type = type;
127 }
128 
129 static void
130 zfs_ace_v0_set_flags(void *acep, uint16_t flags)
131 {
132 	((zfs_oldace_t *)acep)->z_flags = flags;
133 }
134 
135 static void
136 zfs_ace_v0_set_mask(void *acep, uint32_t mask)
137 {
138 	((zfs_oldace_t *)acep)->z_access_mask = mask;
139 }
140 
141 static void
142 zfs_ace_v0_set_who(void *acep, uint64_t who)
143 {
144 	((zfs_oldace_t *)acep)->z_fuid = who;
145 }
146 
147 static size_t
148 zfs_ace_v0_size(void *acep)
149 {
150 	(void) acep;
151 	return (sizeof (zfs_oldace_t));
152 }
153 
154 static size_t
155 zfs_ace_v0_abstract_size(void)
156 {
157 	return (sizeof (zfs_oldace_t));
158 }
159 
160 static int
161 zfs_ace_v0_mask_off(void)
162 {
163 	return (offsetof(zfs_oldace_t, z_access_mask));
164 }
165 
166 static int
167 zfs_ace_v0_data(void *acep, void **datap)
168 {
169 	(void) acep;
170 	*datap = NULL;
171 	return (0);
172 }
173 
174 static const acl_ops_t zfs_acl_v0_ops = {
175 	zfs_ace_v0_get_mask,
176 	zfs_ace_v0_set_mask,
177 	zfs_ace_v0_get_flags,
178 	zfs_ace_v0_set_flags,
179 	zfs_ace_v0_get_type,
180 	zfs_ace_v0_set_type,
181 	zfs_ace_v0_get_who,
182 	zfs_ace_v0_set_who,
183 	zfs_ace_v0_size,
184 	zfs_ace_v0_abstract_size,
185 	zfs_ace_v0_mask_off,
186 	zfs_ace_v0_data
187 };
188 
189 static uint16_t
190 zfs_ace_fuid_get_type(void *acep)
191 {
192 	return (((zfs_ace_hdr_t *)acep)->z_type);
193 }
194 
195 static uint16_t
196 zfs_ace_fuid_get_flags(void *acep)
197 {
198 	return (((zfs_ace_hdr_t *)acep)->z_flags);
199 }
200 
201 static uint32_t
202 zfs_ace_fuid_get_mask(void *acep)
203 {
204 	return (((zfs_ace_hdr_t *)acep)->z_access_mask);
205 }
206 
207 static uint64_t
208 zfs_ace_fuid_get_who(void *args)
209 {
210 	uint16_t entry_type;
211 	zfs_ace_t *acep = args;
212 
213 	entry_type = acep->z_hdr.z_flags & ACE_TYPE_FLAGS;
214 
215 	if (entry_type == ACE_OWNER || entry_type == OWNING_GROUP ||
216 	    entry_type == ACE_EVERYONE)
217 		return (-1);
218 	return (((zfs_ace_t *)acep)->z_fuid);
219 }
220 
221 static void
222 zfs_ace_fuid_set_type(void *acep, uint16_t type)
223 {
224 	((zfs_ace_hdr_t *)acep)->z_type = type;
225 }
226 
227 static void
228 zfs_ace_fuid_set_flags(void *acep, uint16_t flags)
229 {
230 	((zfs_ace_hdr_t *)acep)->z_flags = flags;
231 }
232 
233 static void
234 zfs_ace_fuid_set_mask(void *acep, uint32_t mask)
235 {
236 	((zfs_ace_hdr_t *)acep)->z_access_mask = mask;
237 }
238 
239 static void
240 zfs_ace_fuid_set_who(void *arg, uint64_t who)
241 {
242 	zfs_ace_t *acep = arg;
243 
244 	uint16_t entry_type = acep->z_hdr.z_flags & ACE_TYPE_FLAGS;
245 
246 	if (entry_type == ACE_OWNER || entry_type == OWNING_GROUP ||
247 	    entry_type == ACE_EVERYONE)
248 		return;
249 	acep->z_fuid = who;
250 }
251 
252 static size_t
253 zfs_ace_fuid_size(void *acep)
254 {
255 	zfs_ace_hdr_t *zacep = acep;
256 	uint16_t entry_type;
257 
258 	switch (zacep->z_type) {
259 	case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE:
260 	case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE:
261 	case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE:
262 	case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE:
263 		return (sizeof (zfs_object_ace_t));
264 	case ALLOW:
265 	case DENY:
266 		entry_type =
267 		    (((zfs_ace_hdr_t *)acep)->z_flags & ACE_TYPE_FLAGS);
268 		if (entry_type == ACE_OWNER ||
269 		    entry_type == OWNING_GROUP ||
270 		    entry_type == ACE_EVERYONE)
271 			return (sizeof (zfs_ace_hdr_t));
272 		zfs_fallthrough;
273 	default:
274 		return (sizeof (zfs_ace_t));
275 	}
276 }
277 
278 static size_t
279 zfs_ace_fuid_abstract_size(void)
280 {
281 	return (sizeof (zfs_ace_hdr_t));
282 }
283 
284 static int
285 zfs_ace_fuid_mask_off(void)
286 {
287 	return (offsetof(zfs_ace_hdr_t, z_access_mask));
288 }
289 
290 static int
291 zfs_ace_fuid_data(void *acep, void **datap)
292 {
293 	zfs_ace_t *zacep = acep;
294 	zfs_object_ace_t *zobjp;
295 
296 	switch (zacep->z_hdr.z_type) {
297 	case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE:
298 	case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE:
299 	case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE:
300 	case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE:
301 		zobjp = acep;
302 		*datap = (caddr_t)zobjp + sizeof (zfs_ace_t);
303 		return (sizeof (zfs_object_ace_t) - sizeof (zfs_ace_t));
304 	default:
305 		*datap = NULL;
306 		return (0);
307 	}
308 }
309 
310 static const acl_ops_t zfs_acl_fuid_ops = {
311 	zfs_ace_fuid_get_mask,
312 	zfs_ace_fuid_set_mask,
313 	zfs_ace_fuid_get_flags,
314 	zfs_ace_fuid_set_flags,
315 	zfs_ace_fuid_get_type,
316 	zfs_ace_fuid_set_type,
317 	zfs_ace_fuid_get_who,
318 	zfs_ace_fuid_set_who,
319 	zfs_ace_fuid_size,
320 	zfs_ace_fuid_abstract_size,
321 	zfs_ace_fuid_mask_off,
322 	zfs_ace_fuid_data
323 };
324 
325 /*
326  * The following three functions are provided for compatibility with
327  * older ZPL version in order to determine if the file use to have
328  * an external ACL and what version of ACL previously existed on the
329  * file.  Would really be nice to not need this, sigh.
330  */
331 uint64_t
332 zfs_external_acl(znode_t *zp)
333 {
334 	zfs_acl_phys_t acl_phys;
335 	int error;
336 
337 	if (zp->z_is_sa)
338 		return (0);
339 
340 	/*
341 	 * Need to deal with a potential
342 	 * race where zfs_sa_upgrade could cause
343 	 * z_isa_sa to change.
344 	 *
345 	 * If the lookup fails then the state of z_is_sa should have
346 	 * changed.
347 	 */
348 
349 	if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_ZNODE_ACL(zp->z_zfsvfs),
350 	    &acl_phys, sizeof (acl_phys))) == 0)
351 		return (acl_phys.z_acl_extern_obj);
352 	else {
353 		/*
354 		 * after upgrade the SA_ZPL_ZNODE_ACL should have been
355 		 * removed
356 		 */
357 		VERIFY(zp->z_is_sa);
358 		VERIFY3S(error, ==, ENOENT);
359 		return (0);
360 	}
361 }
362 
363 /*
364  * Determine size of ACL in bytes
365  *
366  * This is more complicated than it should be since we have to deal
367  * with old external ACLs.
368  */
369 static int
370 zfs_acl_znode_info(znode_t *zp, int *aclsize, int *aclcount,
371     zfs_acl_phys_t *aclphys)
372 {
373 	zfsvfs_t *zfsvfs = zp->z_zfsvfs;
374 	uint64_t acl_count;
375 	int size;
376 	int error;
377 
378 	ASSERT(MUTEX_HELD(&zp->z_acl_lock));
379 	if (zp->z_is_sa) {
380 		if ((error = sa_size(zp->z_sa_hdl, SA_ZPL_DACL_ACES(zfsvfs),
381 		    &size)) != 0)
382 			return (error);
383 		*aclsize = size;
384 		if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_DACL_COUNT(zfsvfs),
385 		    &acl_count, sizeof (acl_count))) != 0)
386 			return (error);
387 		*aclcount = acl_count;
388 	} else {
389 		if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_ZNODE_ACL(zfsvfs),
390 		    aclphys, sizeof (*aclphys))) != 0)
391 			return (error);
392 
393 		if (aclphys->z_acl_version == ZFS_ACL_VERSION_INITIAL) {
394 			*aclsize = ZFS_ACL_SIZE(aclphys->z_acl_size);
395 			*aclcount = aclphys->z_acl_size;
396 		} else {
397 			*aclsize = aclphys->z_acl_size;
398 			*aclcount = aclphys->z_acl_count;
399 		}
400 	}
401 	return (0);
402 }
403 
404 int
405 zfs_znode_acl_version(znode_t *zp)
406 {
407 	zfs_acl_phys_t acl_phys;
408 
409 	if (zp->z_is_sa)
410 		return (ZFS_ACL_VERSION_FUID);
411 	else {
412 		int error;
413 
414 		/*
415 		 * Need to deal with a potential
416 		 * race where zfs_sa_upgrade could cause
417 		 * z_isa_sa to change.
418 		 *
419 		 * If the lookup fails then the state of z_is_sa should have
420 		 * changed.
421 		 */
422 		if ((error = sa_lookup(zp->z_sa_hdl,
423 		    SA_ZPL_ZNODE_ACL(zp->z_zfsvfs),
424 		    &acl_phys, sizeof (acl_phys))) == 0)
425 			return (acl_phys.z_acl_version);
426 		else {
427 			/*
428 			 * After upgrade SA_ZPL_ZNODE_ACL should have
429 			 * been removed.
430 			 */
431 			VERIFY(zp->z_is_sa);
432 			VERIFY3S(error, ==, ENOENT);
433 			return (ZFS_ACL_VERSION_FUID);
434 		}
435 	}
436 }
437 
438 static int
439 zfs_acl_version(int version)
440 {
441 	if (version < ZPL_VERSION_FUID)
442 		return (ZFS_ACL_VERSION_INITIAL);
443 	else
444 		return (ZFS_ACL_VERSION_FUID);
445 }
446 
447 static int
448 zfs_acl_version_zp(znode_t *zp)
449 {
450 	return (zfs_acl_version(zp->z_zfsvfs->z_version));
451 }
452 
453 zfs_acl_t *
454 zfs_acl_alloc(int vers)
455 {
456 	zfs_acl_t *aclp;
457 
458 	aclp = kmem_zalloc(sizeof (zfs_acl_t), KM_SLEEP);
459 	list_create(&aclp->z_acl, sizeof (zfs_acl_node_t),
460 	    offsetof(zfs_acl_node_t, z_next));
461 	aclp->z_version = vers;
462 	if (vers == ZFS_ACL_VERSION_FUID)
463 		aclp->z_ops = &zfs_acl_fuid_ops;
464 	else
465 		aclp->z_ops = &zfs_acl_v0_ops;
466 	return (aclp);
467 }
468 
469 zfs_acl_node_t *
470 zfs_acl_node_alloc(size_t bytes)
471 {
472 	zfs_acl_node_t *aclnode;
473 
474 	aclnode = kmem_zalloc(sizeof (zfs_acl_node_t), KM_SLEEP);
475 	if (bytes) {
476 		aclnode->z_acldata = kmem_alloc(bytes, KM_SLEEP);
477 		aclnode->z_allocdata = aclnode->z_acldata;
478 		aclnode->z_allocsize = bytes;
479 		aclnode->z_size = bytes;
480 	}
481 
482 	return (aclnode);
483 }
484 
485 static void
486 zfs_acl_node_free(zfs_acl_node_t *aclnode)
487 {
488 	if (aclnode->z_allocsize)
489 		kmem_free(aclnode->z_allocdata, aclnode->z_allocsize);
490 	kmem_free(aclnode, sizeof (zfs_acl_node_t));
491 }
492 
493 static void
494 zfs_acl_release_nodes(zfs_acl_t *aclp)
495 {
496 	zfs_acl_node_t *aclnode;
497 
498 	while ((aclnode = list_head(&aclp->z_acl))) {
499 		list_remove(&aclp->z_acl, aclnode);
500 		zfs_acl_node_free(aclnode);
501 	}
502 	aclp->z_acl_count = 0;
503 	aclp->z_acl_bytes = 0;
504 }
505 
506 void
507 zfs_acl_free(zfs_acl_t *aclp)
508 {
509 	zfs_acl_release_nodes(aclp);
510 	list_destroy(&aclp->z_acl);
511 	kmem_free(aclp, sizeof (zfs_acl_t));
512 }
513 
514 static boolean_t
515 zfs_acl_valid_ace_type(uint_t type, uint_t flags)
516 {
517 	uint16_t entry_type;
518 
519 	switch (type) {
520 	case ALLOW:
521 	case DENY:
522 	case ACE_SYSTEM_AUDIT_ACE_TYPE:
523 	case ACE_SYSTEM_ALARM_ACE_TYPE:
524 		entry_type = flags & ACE_TYPE_FLAGS;
525 		return (entry_type == ACE_OWNER ||
526 		    entry_type == OWNING_GROUP ||
527 		    entry_type == ACE_EVERYONE || entry_type == 0 ||
528 		    entry_type == ACE_IDENTIFIER_GROUP);
529 	default:
530 		if (type >= MIN_ACE_TYPE && type <= MAX_ACE_TYPE)
531 			return (B_TRUE);
532 	}
533 	return (B_FALSE);
534 }
535 
536 static boolean_t
537 zfs_ace_valid(vtype_t obj_type, zfs_acl_t *aclp, uint16_t type, uint16_t iflags)
538 {
539 	/*
540 	 * first check type of entry
541 	 */
542 
543 	if (!zfs_acl_valid_ace_type(type, iflags))
544 		return (B_FALSE);
545 
546 	switch (type) {
547 	case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE:
548 	case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE:
549 	case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE:
550 	case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE:
551 		if (aclp->z_version < ZFS_ACL_VERSION_FUID)
552 			return (B_FALSE);
553 		aclp->z_hints |= ZFS_ACL_OBJ_ACE;
554 	}
555 
556 	/*
557 	 * next check inheritance level flags
558 	 */
559 
560 	if (obj_type == VDIR &&
561 	    (iflags & (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE)))
562 		aclp->z_hints |= ZFS_INHERIT_ACE;
563 
564 	if (iflags & (ACE_INHERIT_ONLY_ACE|ACE_NO_PROPAGATE_INHERIT_ACE)) {
565 		if ((iflags & (ACE_FILE_INHERIT_ACE|
566 		    ACE_DIRECTORY_INHERIT_ACE)) == 0) {
567 			return (B_FALSE);
568 		}
569 	}
570 
571 	return (B_TRUE);
572 }
573 
574 static void *
575 zfs_acl_next_ace(zfs_acl_t *aclp, void *start, uint64_t *who,
576     uint32_t *access_mask, uint16_t *iflags, uint16_t *type)
577 {
578 	zfs_acl_node_t *aclnode;
579 
580 	ASSERT3P(aclp, !=, NULL);
581 
582 	if (start == NULL) {
583 		aclnode = list_head(&aclp->z_acl);
584 		if (aclnode == NULL)
585 			return (NULL);
586 
587 		aclp->z_next_ace = aclnode->z_acldata;
588 		aclp->z_curr_node = aclnode;
589 		aclnode->z_ace_idx = 0;
590 	}
591 
592 	aclnode = aclp->z_curr_node;
593 
594 	if (aclnode == NULL)
595 		return (NULL);
596 
597 	if (aclnode->z_ace_idx >= aclnode->z_ace_count) {
598 		aclnode = list_next(&aclp->z_acl, aclnode);
599 		if (aclnode == NULL)
600 			return (NULL);
601 		else {
602 			aclp->z_curr_node = aclnode;
603 			aclnode->z_ace_idx = 0;
604 			aclp->z_next_ace = aclnode->z_acldata;
605 		}
606 	}
607 
608 	if (aclnode->z_ace_idx < aclnode->z_ace_count) {
609 		void *acep = aclp->z_next_ace;
610 		size_t ace_size;
611 
612 		/*
613 		 * Make sure we don't overstep our bounds
614 		 */
615 		ace_size = aclp->z_ops->ace_size(acep);
616 
617 		if (((caddr_t)acep + ace_size) >
618 		    ((caddr_t)aclnode->z_acldata + aclnode->z_size)) {
619 			return (NULL);
620 		}
621 
622 		*iflags = aclp->z_ops->ace_flags_get(acep);
623 		*type = aclp->z_ops->ace_type_get(acep);
624 		*access_mask = aclp->z_ops->ace_mask_get(acep);
625 		*who = aclp->z_ops->ace_who_get(acep);
626 		aclp->z_next_ace = (caddr_t)aclp->z_next_ace + ace_size;
627 		aclnode->z_ace_idx++;
628 
629 		return ((void *)acep);
630 	}
631 	return (NULL);
632 }
633 
634 static uint64_t
635 zfs_ace_walk(void *datap, uint64_t cookie, int aclcnt,
636     uint16_t *flags, uint16_t *type, uint32_t *mask)
637 {
638 	(void) aclcnt;
639 	zfs_acl_t *aclp = datap;
640 	zfs_ace_hdr_t *acep = (zfs_ace_hdr_t *)(uintptr_t)cookie;
641 	uint64_t who;
642 
643 	acep = zfs_acl_next_ace(aclp, acep, &who, mask,
644 	    flags, type);
645 	return ((uint64_t)(uintptr_t)acep);
646 }
647 
648 /*
649  * Copy ACE to internal ZFS format.
650  * While processing the ACL each ACE will be validated for correctness.
651  * ACE FUIDs will be created later.
652  */
653 static int
654 zfs_copy_ace_2_fuid(zfsvfs_t *zfsvfs, vtype_t obj_type, zfs_acl_t *aclp,
655     void *datap, zfs_ace_t *z_acl, uint64_t aclcnt, size_t *size,
656     zfs_fuid_info_t **fuidp, cred_t *cr)
657 {
658 	int i;
659 	uint16_t entry_type;
660 	zfs_ace_t *aceptr = z_acl;
661 	ace_t *acep = datap;
662 	zfs_object_ace_t *zobjacep;
663 	ace_object_t *aceobjp;
664 
665 	for (i = 0; i != aclcnt; i++) {
666 		aceptr->z_hdr.z_access_mask = acep->a_access_mask;
667 		aceptr->z_hdr.z_flags = acep->a_flags;
668 		aceptr->z_hdr.z_type = acep->a_type;
669 		entry_type = aceptr->z_hdr.z_flags & ACE_TYPE_FLAGS;
670 		if (entry_type != ACE_OWNER && entry_type != OWNING_GROUP &&
671 		    entry_type != ACE_EVERYONE) {
672 			aceptr->z_fuid = zfs_fuid_create(zfsvfs, acep->a_who,
673 			    cr, (entry_type == 0) ?
674 			    ZFS_ACE_USER : ZFS_ACE_GROUP, fuidp);
675 		}
676 
677 		/*
678 		 * Make sure ACE is valid
679 		 */
680 		if (zfs_ace_valid(obj_type, aclp, aceptr->z_hdr.z_type,
681 		    aceptr->z_hdr.z_flags) != B_TRUE)
682 			return (SET_ERROR(EINVAL));
683 
684 		switch (acep->a_type) {
685 		case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE:
686 		case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE:
687 		case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE:
688 		case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE:
689 			zobjacep = (zfs_object_ace_t *)aceptr;
690 			aceobjp = (ace_object_t *)acep;
691 
692 			memcpy(zobjacep->z_object_type, aceobjp->a_obj_type,
693 			    sizeof (aceobjp->a_obj_type));
694 			memcpy(zobjacep->z_inherit_type,
695 			    aceobjp->a_inherit_obj_type,
696 			    sizeof (aceobjp->a_inherit_obj_type));
697 			acep = (ace_t *)((caddr_t)acep + sizeof (ace_object_t));
698 			break;
699 		default:
700 			acep = (ace_t *)((caddr_t)acep + sizeof (ace_t));
701 		}
702 
703 		aceptr = (zfs_ace_t *)((caddr_t)aceptr +
704 		    aclp->z_ops->ace_size(aceptr));
705 	}
706 
707 	*size = (caddr_t)aceptr - (caddr_t)z_acl;
708 
709 	return (0);
710 }
711 
712 /*
713  * Copy ZFS ACEs to fixed size ace_t layout
714  */
715 static void
716 zfs_copy_fuid_2_ace(zfsvfs_t *zfsvfs, zfs_acl_t *aclp, cred_t *cr,
717     void *datap, int filter)
718 {
719 	uint64_t who;
720 	uint32_t access_mask;
721 	uint16_t iflags, type;
722 	zfs_ace_hdr_t *zacep = NULL;
723 	ace_t *acep = datap;
724 	ace_object_t *objacep;
725 	zfs_object_ace_t *zobjacep;
726 	size_t ace_size;
727 	uint16_t entry_type;
728 
729 	while ((zacep = zfs_acl_next_ace(aclp, zacep,
730 	    &who, &access_mask, &iflags, &type))) {
731 
732 		switch (type) {
733 		case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE:
734 		case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE:
735 		case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE:
736 		case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE:
737 			if (filter) {
738 				continue;
739 			}
740 			zobjacep = (zfs_object_ace_t *)zacep;
741 			objacep = (ace_object_t *)acep;
742 			memcpy(objacep->a_obj_type,
743 			    zobjacep->z_object_type,
744 			    sizeof (zobjacep->z_object_type));
745 			memcpy(objacep->a_inherit_obj_type,
746 			    zobjacep->z_inherit_type,
747 			    sizeof (zobjacep->z_inherit_type));
748 			ace_size = sizeof (ace_object_t);
749 			break;
750 		default:
751 			ace_size = sizeof (ace_t);
752 			break;
753 		}
754 
755 		entry_type = (iflags & ACE_TYPE_FLAGS);
756 		if ((entry_type != ACE_OWNER &&
757 		    entry_type != OWNING_GROUP &&
758 		    entry_type != ACE_EVERYONE)) {
759 			acep->a_who = zfs_fuid_map_id(zfsvfs, who,
760 			    cr, (entry_type & ACE_IDENTIFIER_GROUP) ?
761 			    ZFS_ACE_GROUP : ZFS_ACE_USER);
762 		} else {
763 			acep->a_who = (uid_t)(int64_t)who;
764 		}
765 		acep->a_access_mask = access_mask;
766 		acep->a_flags = iflags;
767 		acep->a_type = type;
768 		acep = (ace_t *)((caddr_t)acep + ace_size);
769 	}
770 }
771 
772 static int
773 zfs_copy_ace_2_oldace(vtype_t obj_type, zfs_acl_t *aclp, ace_t *acep,
774     zfs_oldace_t *z_acl, int aclcnt, size_t *size)
775 {
776 	int i;
777 	zfs_oldace_t *aceptr = z_acl;
778 
779 	for (i = 0; i != aclcnt; i++, aceptr++) {
780 		aceptr->z_access_mask = acep[i].a_access_mask;
781 		aceptr->z_type = acep[i].a_type;
782 		aceptr->z_flags = acep[i].a_flags;
783 		aceptr->z_fuid = acep[i].a_who;
784 		/*
785 		 * Make sure ACE is valid
786 		 */
787 		if (zfs_ace_valid(obj_type, aclp, aceptr->z_type,
788 		    aceptr->z_flags) != B_TRUE)
789 			return (SET_ERROR(EINVAL));
790 	}
791 	*size = (caddr_t)aceptr - (caddr_t)z_acl;
792 	return (0);
793 }
794 
795 /*
796  * convert old ACL format to new
797  */
798 void
799 zfs_acl_xform(znode_t *zp, zfs_acl_t *aclp, cred_t *cr)
800 {
801 	zfs_oldace_t *oldaclp;
802 	int i;
803 	uint16_t type, iflags;
804 	uint32_t access_mask;
805 	uint64_t who;
806 	void *cookie = NULL;
807 	zfs_acl_node_t *newaclnode;
808 
809 	ASSERT3U(aclp->z_version, ==, ZFS_ACL_VERSION_INITIAL);
810 	/*
811 	 * First create the ACE in a contiguous piece of memory
812 	 * for zfs_copy_ace_2_fuid().
813 	 *
814 	 * We only convert an ACL once, so this won't happen
815 	 * everytime.
816 	 */
817 	oldaclp = kmem_alloc(sizeof (zfs_oldace_t) * aclp->z_acl_count,
818 	    KM_SLEEP);
819 	i = 0;
820 	while ((cookie = zfs_acl_next_ace(aclp, cookie, &who,
821 	    &access_mask, &iflags, &type))) {
822 		oldaclp[i].z_flags = iflags;
823 		oldaclp[i].z_type = type;
824 		oldaclp[i].z_fuid = who;
825 		oldaclp[i++].z_access_mask = access_mask;
826 	}
827 
828 	newaclnode = zfs_acl_node_alloc(aclp->z_acl_count *
829 	    sizeof (zfs_object_ace_t));
830 	aclp->z_ops = &zfs_acl_fuid_ops;
831 	VERIFY0(zfs_copy_ace_2_fuid(zp->z_zfsvfs, ZTOV(zp)->v_type, aclp,
832 	    oldaclp, newaclnode->z_acldata, aclp->z_acl_count,
833 	    &newaclnode->z_size, NULL, cr));
834 	newaclnode->z_ace_count = aclp->z_acl_count;
835 	aclp->z_version = ZFS_ACL_VERSION;
836 	kmem_free(oldaclp, aclp->z_acl_count * sizeof (zfs_oldace_t));
837 
838 	/*
839 	 * Release all previous ACL nodes
840 	 */
841 
842 	zfs_acl_release_nodes(aclp);
843 
844 	list_insert_head(&aclp->z_acl, newaclnode);
845 
846 	aclp->z_acl_bytes = newaclnode->z_size;
847 	aclp->z_acl_count = newaclnode->z_ace_count;
848 
849 }
850 
851 /*
852  * Convert unix access mask to v4 access mask
853  */
854 static uint32_t
855 zfs_unix_to_v4(uint32_t access_mask)
856 {
857 	uint32_t new_mask = 0;
858 
859 	if (access_mask & S_IXOTH)
860 		new_mask |= ACE_EXECUTE;
861 	if (access_mask & S_IWOTH)
862 		new_mask |= ACE_WRITE_DATA;
863 	if (access_mask & S_IROTH)
864 		new_mask |= ACE_READ_DATA;
865 	return (new_mask);
866 }
867 
868 static void
869 zfs_set_ace(zfs_acl_t *aclp, void *acep, uint32_t access_mask,
870     uint16_t access_type, uint64_t fuid, uint16_t entry_type)
871 {
872 	uint16_t type = entry_type & ACE_TYPE_FLAGS;
873 
874 	aclp->z_ops->ace_mask_set(acep, access_mask);
875 	aclp->z_ops->ace_type_set(acep, access_type);
876 	aclp->z_ops->ace_flags_set(acep, entry_type);
877 	if ((type != ACE_OWNER && type != OWNING_GROUP &&
878 	    type != ACE_EVERYONE))
879 		aclp->z_ops->ace_who_set(acep, fuid);
880 }
881 
882 /*
883  * Determine mode of file based on ACL.
884  */
885 uint64_t
886 zfs_mode_compute(uint64_t fmode, zfs_acl_t *aclp,
887     uint64_t *pflags, uint64_t fuid, uint64_t fgid)
888 {
889 	int		entry_type;
890 	mode_t		mode;
891 	mode_t		seen = 0;
892 	zfs_ace_hdr_t 	*acep = NULL;
893 	uint64_t	who;
894 	uint16_t	iflags, type;
895 	uint32_t	access_mask;
896 	boolean_t	an_exec_denied = B_FALSE;
897 
898 	mode = (fmode & (S_IFMT | S_ISUID | S_ISGID | S_ISVTX));
899 
900 	while ((acep = zfs_acl_next_ace(aclp, acep, &who,
901 	    &access_mask, &iflags, &type))) {
902 
903 		if (!zfs_acl_valid_ace_type(type, iflags))
904 			continue;
905 
906 		entry_type = (iflags & ACE_TYPE_FLAGS);
907 
908 		/*
909 		 * Skip over any inherit_only ACEs
910 		 */
911 		if (iflags & ACE_INHERIT_ONLY_ACE)
912 			continue;
913 
914 		if (entry_type == ACE_OWNER || (entry_type == 0 &&
915 		    who == fuid)) {
916 			if ((access_mask & ACE_READ_DATA) &&
917 			    (!(seen & S_IRUSR))) {
918 				seen |= S_IRUSR;
919 				if (type == ALLOW) {
920 					mode |= S_IRUSR;
921 				}
922 			}
923 			if ((access_mask & ACE_WRITE_DATA) &&
924 			    (!(seen & S_IWUSR))) {
925 				seen |= S_IWUSR;
926 				if (type == ALLOW) {
927 					mode |= S_IWUSR;
928 				}
929 			}
930 			if ((access_mask & ACE_EXECUTE) &&
931 			    (!(seen & S_IXUSR))) {
932 				seen |= S_IXUSR;
933 				if (type == ALLOW) {
934 					mode |= S_IXUSR;
935 				}
936 			}
937 		} else if (entry_type == OWNING_GROUP ||
938 		    (entry_type == ACE_IDENTIFIER_GROUP && who == fgid)) {
939 			if ((access_mask & ACE_READ_DATA) &&
940 			    (!(seen & S_IRGRP))) {
941 				seen |= S_IRGRP;
942 				if (type == ALLOW) {
943 					mode |= S_IRGRP;
944 				}
945 			}
946 			if ((access_mask & ACE_WRITE_DATA) &&
947 			    (!(seen & S_IWGRP))) {
948 				seen |= S_IWGRP;
949 				if (type == ALLOW) {
950 					mode |= S_IWGRP;
951 				}
952 			}
953 			if ((access_mask & ACE_EXECUTE) &&
954 			    (!(seen & S_IXGRP))) {
955 				seen |= S_IXGRP;
956 				if (type == ALLOW) {
957 					mode |= S_IXGRP;
958 				}
959 			}
960 		} else if (entry_type == ACE_EVERYONE) {
961 			if ((access_mask & ACE_READ_DATA)) {
962 				if (!(seen & S_IRUSR)) {
963 					seen |= S_IRUSR;
964 					if (type == ALLOW) {
965 						mode |= S_IRUSR;
966 					}
967 				}
968 				if (!(seen & S_IRGRP)) {
969 					seen |= S_IRGRP;
970 					if (type == ALLOW) {
971 						mode |= S_IRGRP;
972 					}
973 				}
974 				if (!(seen & S_IROTH)) {
975 					seen |= S_IROTH;
976 					if (type == ALLOW) {
977 						mode |= S_IROTH;
978 					}
979 				}
980 			}
981 			if ((access_mask & ACE_WRITE_DATA)) {
982 				if (!(seen & S_IWUSR)) {
983 					seen |= S_IWUSR;
984 					if (type == ALLOW) {
985 						mode |= S_IWUSR;
986 					}
987 				}
988 				if (!(seen & S_IWGRP)) {
989 					seen |= S_IWGRP;
990 					if (type == ALLOW) {
991 						mode |= S_IWGRP;
992 					}
993 				}
994 				if (!(seen & S_IWOTH)) {
995 					seen |= S_IWOTH;
996 					if (type == ALLOW) {
997 						mode |= S_IWOTH;
998 					}
999 				}
1000 			}
1001 			if ((access_mask & ACE_EXECUTE)) {
1002 				if (!(seen & S_IXUSR)) {
1003 					seen |= S_IXUSR;
1004 					if (type == ALLOW) {
1005 						mode |= S_IXUSR;
1006 					}
1007 				}
1008 				if (!(seen & S_IXGRP)) {
1009 					seen |= S_IXGRP;
1010 					if (type == ALLOW) {
1011 						mode |= S_IXGRP;
1012 					}
1013 				}
1014 				if (!(seen & S_IXOTH)) {
1015 					seen |= S_IXOTH;
1016 					if (type == ALLOW) {
1017 						mode |= S_IXOTH;
1018 					}
1019 				}
1020 			}
1021 		} else {
1022 			/*
1023 			 * Only care if this IDENTIFIER_GROUP or
1024 			 * USER ACE denies execute access to someone,
1025 			 * mode is not affected
1026 			 */
1027 			if ((access_mask & ACE_EXECUTE) && type == DENY)
1028 				an_exec_denied = B_TRUE;
1029 		}
1030 	}
1031 
1032 	/*
1033 	 * Failure to allow is effectively a deny, so execute permission
1034 	 * is denied if it was never mentioned or if we explicitly
1035 	 * weren't allowed it.
1036 	 */
1037 	if (!an_exec_denied &&
1038 	    ((seen & ALL_MODE_EXECS) != ALL_MODE_EXECS ||
1039 	    (mode & ALL_MODE_EXECS) != ALL_MODE_EXECS))
1040 		an_exec_denied = B_TRUE;
1041 
1042 	if (an_exec_denied)
1043 		*pflags &= ~ZFS_NO_EXECS_DENIED;
1044 	else
1045 		*pflags |= ZFS_NO_EXECS_DENIED;
1046 
1047 	return (mode);
1048 }
1049 
1050 /*
1051  * Read an external acl object.  If the intent is to modify, always
1052  * create a new acl and leave any cached acl in place.
1053  */
1054 int
1055 zfs_acl_node_read(znode_t *zp, boolean_t have_lock, zfs_acl_t **aclpp,
1056     boolean_t will_modify)
1057 {
1058 	zfs_acl_t	*aclp;
1059 	int		aclsize;
1060 	int		acl_count;
1061 	zfs_acl_node_t	*aclnode;
1062 	zfs_acl_phys_t	znode_acl;
1063 	int		version;
1064 	int		error;
1065 
1066 	ASSERT(MUTEX_HELD(&zp->z_acl_lock));
1067 	if (zp->z_zfsvfs->z_replay == B_FALSE)
1068 		ASSERT_VOP_LOCKED(ZTOV(zp), __func__);
1069 
1070 	if (zp->z_acl_cached && !will_modify) {
1071 		*aclpp = zp->z_acl_cached;
1072 		return (0);
1073 	}
1074 
1075 	version = zfs_znode_acl_version(zp);
1076 
1077 	if ((error = zfs_acl_znode_info(zp, &aclsize,
1078 	    &acl_count, &znode_acl)) != 0) {
1079 		goto done;
1080 	}
1081 
1082 	aclp = zfs_acl_alloc(version);
1083 
1084 	aclp->z_acl_count = acl_count;
1085 	aclp->z_acl_bytes = aclsize;
1086 
1087 	aclnode = zfs_acl_node_alloc(aclsize);
1088 	aclnode->z_ace_count = aclp->z_acl_count;
1089 	aclnode->z_size = aclsize;
1090 
1091 	if (!zp->z_is_sa) {
1092 		if (znode_acl.z_acl_extern_obj) {
1093 			error = dmu_read(zp->z_zfsvfs->z_os,
1094 			    znode_acl.z_acl_extern_obj, 0, aclnode->z_size,
1095 			    aclnode->z_acldata, DMU_READ_PREFETCH);
1096 		} else {
1097 			memcpy(aclnode->z_acldata, znode_acl.z_ace_data,
1098 			    aclnode->z_size);
1099 		}
1100 	} else {
1101 		error = sa_lookup(zp->z_sa_hdl, SA_ZPL_DACL_ACES(zp->z_zfsvfs),
1102 		    aclnode->z_acldata, aclnode->z_size);
1103 	}
1104 
1105 	if (error != 0) {
1106 		zfs_acl_free(aclp);
1107 		zfs_acl_node_free(aclnode);
1108 		/* convert checksum errors into IO errors */
1109 		if (error == ECKSUM)
1110 			error = SET_ERROR(EIO);
1111 		goto done;
1112 	}
1113 
1114 	list_insert_head(&aclp->z_acl, aclnode);
1115 
1116 	*aclpp = aclp;
1117 	if (!will_modify)
1118 		zp->z_acl_cached = aclp;
1119 done:
1120 	return (error);
1121 }
1122 
1123 void
1124 zfs_acl_data_locator(void **dataptr, uint32_t *length, uint32_t buflen,
1125     boolean_t start, void *userdata)
1126 {
1127 	(void) buflen;
1128 	zfs_acl_locator_cb_t *cb = (zfs_acl_locator_cb_t *)userdata;
1129 
1130 	if (start) {
1131 		cb->cb_acl_node = list_head(&cb->cb_aclp->z_acl);
1132 	} else {
1133 		cb->cb_acl_node = list_next(&cb->cb_aclp->z_acl,
1134 		    cb->cb_acl_node);
1135 	}
1136 	*dataptr = cb->cb_acl_node->z_acldata;
1137 	*length = cb->cb_acl_node->z_size;
1138 }
1139 
1140 int
1141 zfs_acl_chown_setattr(znode_t *zp)
1142 {
1143 	int error;
1144 	zfs_acl_t *aclp;
1145 
1146 	if (zp->z_zfsvfs->z_replay == B_FALSE) {
1147 		ASSERT_VOP_ELOCKED(ZTOV(zp), __func__);
1148 		ASSERT_VOP_IN_SEQC(ZTOV(zp));
1149 	}
1150 	ASSERT(MUTEX_HELD(&zp->z_acl_lock));
1151 
1152 	if ((error = zfs_acl_node_read(zp, B_TRUE, &aclp, B_FALSE)) == 0)
1153 		zp->z_mode = zfs_mode_compute(zp->z_mode, aclp,
1154 		    &zp->z_pflags, zp->z_uid, zp->z_gid);
1155 	return (error);
1156 }
1157 
1158 /*
1159  * common code for setting ACLs.
1160  *
1161  * This function is called from zfs_mode_update, zfs_perm_init, and zfs_setacl.
1162  * zfs_setacl passes a non-NULL inherit pointer (ihp) to indicate that it's
1163  * already checked the acl and knows whether to inherit.
1164  */
1165 int
1166 zfs_aclset_common(znode_t *zp, zfs_acl_t *aclp, cred_t *cr, dmu_tx_t *tx)
1167 {
1168 	int			error;
1169 	zfsvfs_t		*zfsvfs = zp->z_zfsvfs;
1170 	dmu_object_type_t	otype;
1171 	zfs_acl_locator_cb_t	locate = { 0 };
1172 	uint64_t		mode;
1173 	sa_bulk_attr_t		bulk[5];
1174 	uint64_t		ctime[2];
1175 	int			count = 0;
1176 	zfs_acl_phys_t		acl_phys;
1177 
1178 	if (zp->z_zfsvfs->z_replay == B_FALSE) {
1179 		ASSERT_VOP_IN_SEQC(ZTOV(zp));
1180 	}
1181 
1182 	mode = zp->z_mode;
1183 
1184 	mode = zfs_mode_compute(mode, aclp, &zp->z_pflags,
1185 	    zp->z_uid, zp->z_gid);
1186 
1187 	zp->z_mode = mode;
1188 	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_MODE(zfsvfs), NULL,
1189 	    &mode, sizeof (mode));
1190 	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_FLAGS(zfsvfs), NULL,
1191 	    &zp->z_pflags, sizeof (zp->z_pflags));
1192 	SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_CTIME(zfsvfs), NULL,
1193 	    &ctime, sizeof (ctime));
1194 
1195 	if (zp->z_acl_cached) {
1196 		zfs_acl_free(zp->z_acl_cached);
1197 		zp->z_acl_cached = NULL;
1198 	}
1199 
1200 	/*
1201 	 * Upgrade needed?
1202 	 */
1203 	if (!zfsvfs->z_use_fuids) {
1204 		otype = DMU_OT_OLDACL;
1205 	} else {
1206 		if ((aclp->z_version == ZFS_ACL_VERSION_INITIAL) &&
1207 		    (zfsvfs->z_version >= ZPL_VERSION_FUID))
1208 			zfs_acl_xform(zp, aclp, cr);
1209 		ASSERT3U(aclp->z_version, >=, ZFS_ACL_VERSION_FUID);
1210 		otype = DMU_OT_ACL;
1211 	}
1212 
1213 	/*
1214 	 * Arrgh, we have to handle old on disk format
1215 	 * as well as newer (preferred) SA format.
1216 	 */
1217 
1218 	if (zp->z_is_sa) { /* the easy case, just update the ACL attribute */
1219 		locate.cb_aclp = aclp;
1220 		SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_DACL_ACES(zfsvfs),
1221 		    zfs_acl_data_locator, &locate, aclp->z_acl_bytes);
1222 		SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_DACL_COUNT(zfsvfs),
1223 		    NULL, &aclp->z_acl_count, sizeof (uint64_t));
1224 	} else { /* Painful legacy way */
1225 		zfs_acl_node_t *aclnode;
1226 		uint64_t off = 0;
1227 		uint64_t aoid;
1228 
1229 		if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_ZNODE_ACL(zfsvfs),
1230 		    &acl_phys, sizeof (acl_phys))) != 0)
1231 			return (error);
1232 
1233 		aoid = acl_phys.z_acl_extern_obj;
1234 
1235 		if (aclp->z_acl_bytes > ZFS_ACE_SPACE) {
1236 			/*
1237 			 * If ACL was previously external and we are now
1238 			 * converting to new ACL format then release old
1239 			 * ACL object and create a new one.
1240 			 */
1241 			if (aoid &&
1242 			    aclp->z_version != acl_phys.z_acl_version) {
1243 				error = dmu_object_free(zfsvfs->z_os, aoid, tx);
1244 				if (error)
1245 					return (error);
1246 				aoid = 0;
1247 			}
1248 			if (aoid == 0) {
1249 				aoid = dmu_object_alloc(zfsvfs->z_os,
1250 				    otype, aclp->z_acl_bytes,
1251 				    otype == DMU_OT_ACL ?
1252 				    DMU_OT_SYSACL : DMU_OT_NONE,
1253 				    otype == DMU_OT_ACL ?
1254 				    DN_OLD_MAX_BONUSLEN : 0, tx);
1255 			} else {
1256 				(void) dmu_object_set_blocksize(zfsvfs->z_os,
1257 				    aoid, aclp->z_acl_bytes, 0, tx);
1258 			}
1259 			acl_phys.z_acl_extern_obj = aoid;
1260 			for (aclnode = list_head(&aclp->z_acl); aclnode;
1261 			    aclnode = list_next(&aclp->z_acl, aclnode)) {
1262 				if (aclnode->z_ace_count == 0)
1263 					continue;
1264 				dmu_write(zfsvfs->z_os, aoid, off,
1265 				    aclnode->z_size, aclnode->z_acldata, tx);
1266 				off += aclnode->z_size;
1267 			}
1268 		} else {
1269 			void *start = acl_phys.z_ace_data;
1270 			/*
1271 			 * Migrating back embedded?
1272 			 */
1273 			if (acl_phys.z_acl_extern_obj) {
1274 				error = dmu_object_free(zfsvfs->z_os,
1275 				    acl_phys.z_acl_extern_obj, tx);
1276 				if (error)
1277 					return (error);
1278 				acl_phys.z_acl_extern_obj = 0;
1279 			}
1280 
1281 			for (aclnode = list_head(&aclp->z_acl); aclnode;
1282 			    aclnode = list_next(&aclp->z_acl, aclnode)) {
1283 				if (aclnode->z_ace_count == 0)
1284 					continue;
1285 				memcpy(start, aclnode->z_acldata,
1286 				    aclnode->z_size);
1287 				start = (caddr_t)start + aclnode->z_size;
1288 			}
1289 		}
1290 		/*
1291 		 * If Old version then swap count/bytes to match old
1292 		 * layout of znode_acl_phys_t.
1293 		 */
1294 		if (aclp->z_version == ZFS_ACL_VERSION_INITIAL) {
1295 			acl_phys.z_acl_size = aclp->z_acl_count;
1296 			acl_phys.z_acl_count = aclp->z_acl_bytes;
1297 		} else {
1298 			acl_phys.z_acl_size = aclp->z_acl_bytes;
1299 			acl_phys.z_acl_count = aclp->z_acl_count;
1300 		}
1301 		acl_phys.z_acl_version = aclp->z_version;
1302 
1303 		SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_ZNODE_ACL(zfsvfs), NULL,
1304 		    &acl_phys, sizeof (acl_phys));
1305 	}
1306 
1307 	/*
1308 	 * Replace ACL wide bits, but first clear them.
1309 	 */
1310 	zp->z_pflags &= ~ZFS_ACL_WIDE_FLAGS;
1311 
1312 	zp->z_pflags |= aclp->z_hints;
1313 
1314 	if (ace_trivial_common(aclp, 0, zfs_ace_walk) == 0)
1315 		zp->z_pflags |= ZFS_ACL_TRIVIAL;
1316 
1317 	zfs_tstamp_update_setup(zp, STATE_CHANGED, NULL, ctime);
1318 	return (sa_bulk_update(zp->z_sa_hdl, bulk, count, tx));
1319 }
1320 
1321 static void
1322 zfs_acl_chmod(vtype_t vtype, uint64_t mode, boolean_t split, boolean_t trim,
1323     zfs_acl_t *aclp)
1324 {
1325 	void		*acep = NULL;
1326 	uint64_t	who;
1327 	int		new_count, new_bytes;
1328 	int		ace_size;
1329 	int 		entry_type;
1330 	uint16_t	iflags, type;
1331 	uint32_t	access_mask;
1332 	zfs_acl_node_t	*newnode;
1333 	size_t 		abstract_size = aclp->z_ops->ace_abstract_size();
1334 	void 		*zacep;
1335 	boolean_t	isdir;
1336 	trivial_acl_t	masks;
1337 
1338 	new_count = new_bytes = 0;
1339 
1340 	isdir = (vtype == VDIR);
1341 
1342 	acl_trivial_access_masks((mode_t)mode, isdir, &masks);
1343 
1344 	newnode = zfs_acl_node_alloc((abstract_size * 6) + aclp->z_acl_bytes);
1345 
1346 	zacep = newnode->z_acldata;
1347 	if (masks.allow0) {
1348 		zfs_set_ace(aclp, zacep, masks.allow0, ALLOW, -1, ACE_OWNER);
1349 		zacep = (void *)((uintptr_t)zacep + abstract_size);
1350 		new_count++;
1351 		new_bytes += abstract_size;
1352 	}
1353 	if (masks.deny1) {
1354 		zfs_set_ace(aclp, zacep, masks.deny1, DENY, -1, ACE_OWNER);
1355 		zacep = (void *)((uintptr_t)zacep + abstract_size);
1356 		new_count++;
1357 		new_bytes += abstract_size;
1358 	}
1359 	if (masks.deny2) {
1360 		zfs_set_ace(aclp, zacep, masks.deny2, DENY, -1, OWNING_GROUP);
1361 		zacep = (void *)((uintptr_t)zacep + abstract_size);
1362 		new_count++;
1363 		new_bytes += abstract_size;
1364 	}
1365 
1366 	while ((acep = zfs_acl_next_ace(aclp, acep, &who, &access_mask,
1367 	    &iflags, &type))) {
1368 		entry_type = (iflags & ACE_TYPE_FLAGS);
1369 		/*
1370 		 * ACEs used to represent the file mode may be divided
1371 		 * into an equivalent pair of inherit-only and regular
1372 		 * ACEs, if they are inheritable.
1373 		 * Skip regular ACEs, which are replaced by the new mode.
1374 		 */
1375 		if (split && (entry_type == ACE_OWNER ||
1376 		    entry_type == OWNING_GROUP ||
1377 		    entry_type == ACE_EVERYONE)) {
1378 			if (!isdir || !(iflags &
1379 			    (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE)))
1380 				continue;
1381 			/*
1382 			 * We preserve owner@, group@, or @everyone
1383 			 * permissions, if they are inheritable, by
1384 			 * copying them to inherit_only ACEs. This
1385 			 * prevents inheritable permissions from being
1386 			 * altered along with the file mode.
1387 			 */
1388 			iflags |= ACE_INHERIT_ONLY_ACE;
1389 		}
1390 
1391 		/*
1392 		 * If this ACL has any inheritable ACEs, mark that in
1393 		 * the hints (which are later masked into the pflags)
1394 		 * so create knows to do inheritance.
1395 		 */
1396 		if (isdir && (iflags &
1397 		    (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE)))
1398 			aclp->z_hints |= ZFS_INHERIT_ACE;
1399 
1400 		if ((type != ALLOW && type != DENY) ||
1401 		    (iflags & ACE_INHERIT_ONLY_ACE)) {
1402 			switch (type) {
1403 			case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE:
1404 			case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE:
1405 			case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE:
1406 			case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE:
1407 				aclp->z_hints |= ZFS_ACL_OBJ_ACE;
1408 				break;
1409 			}
1410 		} else {
1411 			/*
1412 			 * Limit permissions granted by ACEs to be no greater
1413 			 * than permissions of the requested group mode.
1414 			 * Applies when the "aclmode" property is set to
1415 			 * "groupmask".
1416 			 */
1417 			if ((type == ALLOW) && trim)
1418 				access_mask &= masks.group;
1419 		}
1420 		zfs_set_ace(aclp, zacep, access_mask, type, who, iflags);
1421 		ace_size = aclp->z_ops->ace_size(acep);
1422 		zacep = (void *)((uintptr_t)zacep + ace_size);
1423 		new_count++;
1424 		new_bytes += ace_size;
1425 	}
1426 	zfs_set_ace(aclp, zacep, masks.owner, ALLOW, -1, ACE_OWNER);
1427 	zacep = (void *)((uintptr_t)zacep + abstract_size);
1428 	zfs_set_ace(aclp, zacep, masks.group, ALLOW, -1, OWNING_GROUP);
1429 	zacep = (void *)((uintptr_t)zacep + abstract_size);
1430 	zfs_set_ace(aclp, zacep, masks.everyone, ALLOW, -1, ACE_EVERYONE);
1431 
1432 	new_count += 3;
1433 	new_bytes += abstract_size * 3;
1434 	zfs_acl_release_nodes(aclp);
1435 	aclp->z_acl_count = new_count;
1436 	aclp->z_acl_bytes = new_bytes;
1437 	newnode->z_ace_count = new_count;
1438 	newnode->z_size = new_bytes;
1439 	list_insert_tail(&aclp->z_acl, newnode);
1440 }
1441 
1442 int
1443 zfs_acl_chmod_setattr(znode_t *zp, zfs_acl_t **aclp, uint64_t mode)
1444 {
1445 	int error = 0;
1446 
1447 	mutex_enter(&zp->z_acl_lock);
1448 	if (zp->z_zfsvfs->z_replay == B_FALSE)
1449 		ASSERT_VOP_ELOCKED(ZTOV(zp), __func__);
1450 	if (zp->z_zfsvfs->z_acl_mode == ZFS_ACL_DISCARD)
1451 		*aclp = zfs_acl_alloc(zfs_acl_version_zp(zp));
1452 	else
1453 		error = zfs_acl_node_read(zp, B_TRUE, aclp, B_TRUE);
1454 
1455 	if (error == 0) {
1456 		(*aclp)->z_hints = zp->z_pflags & V4_ACL_WIDE_FLAGS;
1457 		zfs_acl_chmod(ZTOV(zp)->v_type, mode, B_TRUE,
1458 		    (zp->z_zfsvfs->z_acl_mode == ZFS_ACL_GROUPMASK), *aclp);
1459 	}
1460 	mutex_exit(&zp->z_acl_lock);
1461 
1462 	return (error);
1463 }
1464 
1465 /*
1466  * Should ACE be inherited?
1467  */
1468 static int
1469 zfs_ace_can_use(vtype_t vtype, uint16_t acep_flags)
1470 {
1471 	int	iflags = (acep_flags & 0xf);
1472 
1473 	if ((vtype == VDIR) && (iflags & ACE_DIRECTORY_INHERIT_ACE))
1474 		return (1);
1475 	else if (iflags & ACE_FILE_INHERIT_ACE)
1476 		return (!((vtype == VDIR) &&
1477 		    (iflags & ACE_NO_PROPAGATE_INHERIT_ACE)));
1478 	return (0);
1479 }
1480 
1481 /*
1482  * inherit inheritable ACEs from parent
1483  */
1484 static zfs_acl_t *
1485 zfs_acl_inherit(zfsvfs_t *zfsvfs, vtype_t vtype, zfs_acl_t *paclp,
1486     uint64_t mode, boolean_t *need_chmod)
1487 {
1488 	void		*pacep = NULL;
1489 	void		*acep;
1490 	zfs_acl_node_t  *aclnode;
1491 	zfs_acl_t	*aclp = NULL;
1492 	uint64_t	who;
1493 	uint32_t	access_mask;
1494 	uint16_t	iflags, newflags, type;
1495 	size_t		ace_size;
1496 	void		*data1, *data2;
1497 	size_t		data1sz, data2sz;
1498 	uint_t		aclinherit;
1499 	boolean_t	isdir = (vtype == VDIR);
1500 	boolean_t	isreg = (vtype == VREG);
1501 
1502 	*need_chmod = B_TRUE;
1503 
1504 	aclp = zfs_acl_alloc(paclp->z_version);
1505 	aclinherit = zfsvfs->z_acl_inherit;
1506 	if (aclinherit == ZFS_ACL_DISCARD || vtype == VLNK)
1507 		return (aclp);
1508 
1509 	while ((pacep = zfs_acl_next_ace(paclp, pacep, &who,
1510 	    &access_mask, &iflags, &type))) {
1511 
1512 		/*
1513 		 * don't inherit bogus ACEs
1514 		 */
1515 		if (!zfs_acl_valid_ace_type(type, iflags))
1516 			continue;
1517 
1518 		/*
1519 		 * Check if ACE is inheritable by this vnode
1520 		 */
1521 		if ((aclinherit == ZFS_ACL_NOALLOW && type == ALLOW) ||
1522 		    !zfs_ace_can_use(vtype, iflags))
1523 			continue;
1524 
1525 		/*
1526 		 * If owner@, group@, or everyone@ inheritable
1527 		 * then zfs_acl_chmod() isn't needed.
1528 		 */
1529 		if ((aclinherit == ZFS_ACL_PASSTHROUGH ||
1530 		    aclinherit == ZFS_ACL_PASSTHROUGH_X) &&
1531 		    ((iflags & (ACE_OWNER|ACE_EVERYONE)) ||
1532 		    ((iflags & OWNING_GROUP) == OWNING_GROUP)) &&
1533 		    (isreg || (isdir && (iflags & ACE_DIRECTORY_INHERIT_ACE))))
1534 			*need_chmod = B_FALSE;
1535 
1536 		/*
1537 		 * Strip inherited execute permission from file if
1538 		 * not in mode
1539 		 */
1540 		if (aclinherit == ZFS_ACL_PASSTHROUGH_X && type == ALLOW &&
1541 		    !isdir && ((mode & (S_IXUSR|S_IXGRP|S_IXOTH)) == 0)) {
1542 			access_mask &= ~ACE_EXECUTE;
1543 		}
1544 
1545 		/*
1546 		 * Strip write_acl and write_owner from permissions
1547 		 * when inheriting an ACE
1548 		 */
1549 		if (aclinherit == ZFS_ACL_RESTRICTED && type == ALLOW) {
1550 			access_mask &= ~RESTRICTED_CLEAR;
1551 		}
1552 
1553 		ace_size = aclp->z_ops->ace_size(pacep);
1554 		aclnode = zfs_acl_node_alloc(ace_size);
1555 		list_insert_tail(&aclp->z_acl, aclnode);
1556 		acep = aclnode->z_acldata;
1557 
1558 		zfs_set_ace(aclp, acep, access_mask, type,
1559 		    who, iflags|ACE_INHERITED_ACE);
1560 
1561 		/*
1562 		 * Copy special opaque data if any
1563 		 */
1564 		if ((data1sz = paclp->z_ops->ace_data(pacep, &data1)) != 0) {
1565 			data2sz = aclp->z_ops->ace_data(acep, &data2);
1566 			VERIFY3U(data2sz, ==, data1sz);
1567 			memcpy(data2, data1, data2sz);
1568 		}
1569 
1570 		aclp->z_acl_count++;
1571 		aclnode->z_ace_count++;
1572 		aclp->z_acl_bytes += aclnode->z_size;
1573 		newflags = aclp->z_ops->ace_flags_get(acep);
1574 
1575 		/*
1576 		 * If ACE is not to be inherited further, or if the vnode is
1577 		 * not a directory, remove all inheritance flags
1578 		 */
1579 		if (!isdir || (iflags & ACE_NO_PROPAGATE_INHERIT_ACE)) {
1580 			newflags &= ~ALL_INHERIT;
1581 			aclp->z_ops->ace_flags_set(acep,
1582 			    newflags|ACE_INHERITED_ACE);
1583 			continue;
1584 		}
1585 
1586 		/*
1587 		 * This directory has an inheritable ACE
1588 		 */
1589 		aclp->z_hints |= ZFS_INHERIT_ACE;
1590 
1591 		/*
1592 		 * If only FILE_INHERIT is set then turn on
1593 		 * inherit_only
1594 		 */
1595 		if ((iflags & (ACE_FILE_INHERIT_ACE |
1596 		    ACE_DIRECTORY_INHERIT_ACE)) == ACE_FILE_INHERIT_ACE) {
1597 			newflags |= ACE_INHERIT_ONLY_ACE;
1598 			aclp->z_ops->ace_flags_set(acep,
1599 			    newflags|ACE_INHERITED_ACE);
1600 		} else {
1601 			newflags &= ~ACE_INHERIT_ONLY_ACE;
1602 			aclp->z_ops->ace_flags_set(acep,
1603 			    newflags|ACE_INHERITED_ACE);
1604 		}
1605 	}
1606 	if (zfsvfs->z_acl_mode == ZFS_ACL_RESTRICTED &&
1607 	    aclp->z_acl_count != 0) {
1608 		*need_chmod = B_FALSE;
1609 	}
1610 
1611 	return (aclp);
1612 }
1613 
1614 /*
1615  * Create file system object initial permissions
1616  * including inheritable ACEs.
1617  * Also, create FUIDs for owner and group.
1618  */
1619 int
1620 zfs_acl_ids_create(znode_t *dzp, int flag, vattr_t *vap, cred_t *cr,
1621     vsecattr_t *vsecp, zfs_acl_ids_t *acl_ids)
1622 {
1623 	int		error;
1624 	zfsvfs_t	*zfsvfs = dzp->z_zfsvfs;
1625 	zfs_acl_t	*paclp;
1626 	gid_t		gid;
1627 	boolean_t	need_chmod = B_TRUE;
1628 	boolean_t	trim = B_FALSE;
1629 	boolean_t	inherited = B_FALSE;
1630 
1631 	if ((flag & IS_ROOT_NODE) == 0) {
1632 		if (zfsvfs->z_replay == B_FALSE)
1633 			ASSERT_VOP_ELOCKED(ZTOV(dzp), __func__);
1634 	} else
1635 		ASSERT3P(dzp->z_vnode, ==, NULL);
1636 	memset(acl_ids, 0, sizeof (zfs_acl_ids_t));
1637 	acl_ids->z_mode = MAKEIMODE(vap->va_type, vap->va_mode);
1638 
1639 	if (vsecp)
1640 		if ((error = zfs_vsec_2_aclp(zfsvfs, vap->va_type, vsecp, cr,
1641 		    &acl_ids->z_fuidp, &acl_ids->z_aclp)) != 0)
1642 			return (error);
1643 	/*
1644 	 * Determine uid and gid.
1645 	 */
1646 	if ((flag & IS_ROOT_NODE) || zfsvfs->z_replay ||
1647 	    ((flag & IS_XATTR) && (vap->va_type == VDIR))) {
1648 		acl_ids->z_fuid = zfs_fuid_create(zfsvfs,
1649 		    (uint64_t)vap->va_uid, cr,
1650 		    ZFS_OWNER, &acl_ids->z_fuidp);
1651 		acl_ids->z_fgid = zfs_fuid_create(zfsvfs,
1652 		    (uint64_t)vap->va_gid, cr,
1653 		    ZFS_GROUP, &acl_ids->z_fuidp);
1654 		gid = vap->va_gid;
1655 	} else {
1656 		uid_t id = crgetuid(cr);
1657 		if (IS_EPHEMERAL(id))
1658 			id = UID_NOBODY;
1659 		acl_ids->z_fuid = (uint64_t)id;
1660 		acl_ids->z_fgid = 0;
1661 		if (vap->va_mask & AT_GID)  {
1662 			acl_ids->z_fgid = zfs_fuid_create(zfsvfs,
1663 			    (uint64_t)vap->va_gid,
1664 			    cr, ZFS_GROUP, &acl_ids->z_fuidp);
1665 			gid = vap->va_gid;
1666 			if (acl_ids->z_fgid != dzp->z_gid &&
1667 			    !groupmember(vap->va_gid, cr) &&
1668 			    secpolicy_vnode_create_gid(cr) != 0)
1669 				acl_ids->z_fgid = 0;
1670 		}
1671 		if (acl_ids->z_fgid == 0) {
1672 			const char	*domain;
1673 			uint32_t	rid;
1674 
1675 			acl_ids->z_fgid = dzp->z_gid;
1676 			gid = zfs_fuid_map_id(zfsvfs, acl_ids->z_fgid,
1677 			    cr, ZFS_GROUP);
1678 
1679 			if (zfsvfs->z_use_fuids &&
1680 			    IS_EPHEMERAL(acl_ids->z_fgid)) {
1681 				domain =
1682 				    zfs_fuid_idx_domain(&zfsvfs->z_fuid_idx,
1683 				    FUID_INDEX(acl_ids->z_fgid));
1684 				rid = FUID_RID(acl_ids->z_fgid);
1685 				zfs_fuid_node_add(&acl_ids->z_fuidp,
1686 				    domain, rid, FUID_INDEX(acl_ids->z_fgid),
1687 				    acl_ids->z_fgid, ZFS_GROUP);
1688 			}
1689 		}
1690 	}
1691 
1692 	/*
1693 	 * If we're creating a directory, and the parent directory has the
1694 	 * set-GID bit set, set in on the new directory.
1695 	 * Otherwise, if the user is neither privileged nor a member of the
1696 	 * file's new group, clear the file's set-GID bit.
1697 	 */
1698 
1699 	if (!(flag & IS_ROOT_NODE) && (dzp->z_mode & S_ISGID) &&
1700 	    (vap->va_type == VDIR)) {
1701 		acl_ids->z_mode |= S_ISGID;
1702 	} else {
1703 		if ((acl_ids->z_mode & S_ISGID) &&
1704 		    secpolicy_vnode_setids_setgids(ZTOV(dzp), cr, gid) != 0)
1705 			acl_ids->z_mode &= ~S_ISGID;
1706 	}
1707 
1708 	if (acl_ids->z_aclp == NULL) {
1709 		mutex_enter(&dzp->z_acl_lock);
1710 		if (!(flag & IS_ROOT_NODE) &&
1711 		    (dzp->z_pflags & ZFS_INHERIT_ACE) &&
1712 		    !(dzp->z_pflags & ZFS_XATTR)) {
1713 			VERIFY0(zfs_acl_node_read(dzp, B_TRUE,
1714 			    &paclp, B_FALSE));
1715 			acl_ids->z_aclp = zfs_acl_inherit(zfsvfs,
1716 			    vap->va_type, paclp, acl_ids->z_mode, &need_chmod);
1717 			inherited = B_TRUE;
1718 		} else {
1719 			acl_ids->z_aclp =
1720 			    zfs_acl_alloc(zfs_acl_version_zp(dzp));
1721 			acl_ids->z_aclp->z_hints |= ZFS_ACL_TRIVIAL;
1722 		}
1723 		mutex_exit(&dzp->z_acl_lock);
1724 
1725 		if (need_chmod) {
1726 			if (vap->va_type == VDIR)
1727 				acl_ids->z_aclp->z_hints |=
1728 				    ZFS_ACL_AUTO_INHERIT;
1729 
1730 			if (zfsvfs->z_acl_mode == ZFS_ACL_GROUPMASK &&
1731 			    zfsvfs->z_acl_inherit != ZFS_ACL_PASSTHROUGH &&
1732 			    zfsvfs->z_acl_inherit != ZFS_ACL_PASSTHROUGH_X)
1733 				trim = B_TRUE;
1734 			zfs_acl_chmod(vap->va_type, acl_ids->z_mode, B_FALSE,
1735 			    trim, acl_ids->z_aclp);
1736 		}
1737 	}
1738 
1739 	if (inherited || vsecp) {
1740 		acl_ids->z_mode = zfs_mode_compute(acl_ids->z_mode,
1741 		    acl_ids->z_aclp, &acl_ids->z_aclp->z_hints,
1742 		    acl_ids->z_fuid, acl_ids->z_fgid);
1743 		if (ace_trivial_common(acl_ids->z_aclp, 0, zfs_ace_walk) == 0)
1744 			acl_ids->z_aclp->z_hints |= ZFS_ACL_TRIVIAL;
1745 	}
1746 
1747 	return (0);
1748 }
1749 
1750 /*
1751  * Free ACL and fuid_infop, but not the acl_ids structure
1752  */
1753 void
1754 zfs_acl_ids_free(zfs_acl_ids_t *acl_ids)
1755 {
1756 	if (acl_ids->z_aclp)
1757 		zfs_acl_free(acl_ids->z_aclp);
1758 	if (acl_ids->z_fuidp)
1759 		zfs_fuid_info_free(acl_ids->z_fuidp);
1760 	acl_ids->z_aclp = NULL;
1761 	acl_ids->z_fuidp = NULL;
1762 }
1763 
1764 boolean_t
1765 zfs_acl_ids_overquota(zfsvfs_t *zv, zfs_acl_ids_t *acl_ids, uint64_t projid)
1766 {
1767 	return (zfs_id_overquota(zv, DMU_USERUSED_OBJECT, acl_ids->z_fuid) ||
1768 	    zfs_id_overquota(zv, DMU_GROUPUSED_OBJECT, acl_ids->z_fgid) ||
1769 	    (projid != ZFS_DEFAULT_PROJID && projid != ZFS_INVALID_PROJID &&
1770 	    zfs_id_overquota(zv, DMU_PROJECTUSED_OBJECT, projid)));
1771 }
1772 
1773 /*
1774  * Retrieve a file's ACL
1775  */
1776 int
1777 zfs_getacl(znode_t *zp, vsecattr_t *vsecp, boolean_t skipaclchk, cred_t *cr)
1778 {
1779 	zfs_acl_t	*aclp;
1780 	ulong_t		mask;
1781 	int		error;
1782 	int 		count = 0;
1783 	int		largeace = 0;
1784 
1785 	mask = vsecp->vsa_mask & (VSA_ACE | VSA_ACECNT |
1786 	    VSA_ACE_ACLFLAGS | VSA_ACE_ALLTYPES);
1787 
1788 	if (mask == 0)
1789 		return (SET_ERROR(ENOSYS));
1790 
1791 	if ((error = zfs_zaccess(zp, ACE_READ_ACL, 0, skipaclchk, cr)))
1792 		return (error);
1793 
1794 	mutex_enter(&zp->z_acl_lock);
1795 
1796 	if (zp->z_zfsvfs->z_replay == B_FALSE)
1797 		ASSERT_VOP_LOCKED(ZTOV(zp), __func__);
1798 	error = zfs_acl_node_read(zp, B_TRUE, &aclp, B_FALSE);
1799 	if (error != 0) {
1800 		mutex_exit(&zp->z_acl_lock);
1801 		return (error);
1802 	}
1803 
1804 	/*
1805 	 * Scan ACL to determine number of ACEs
1806 	 */
1807 	if ((zp->z_pflags & ZFS_ACL_OBJ_ACE) && !(mask & VSA_ACE_ALLTYPES)) {
1808 		void *zacep = NULL;
1809 		uint64_t who;
1810 		uint32_t access_mask;
1811 		uint16_t type, iflags;
1812 
1813 		while ((zacep = zfs_acl_next_ace(aclp, zacep,
1814 		    &who, &access_mask, &iflags, &type))) {
1815 			switch (type) {
1816 			case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE:
1817 			case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE:
1818 			case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE:
1819 			case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE:
1820 				largeace++;
1821 				continue;
1822 			default:
1823 				count++;
1824 			}
1825 		}
1826 		vsecp->vsa_aclcnt = count;
1827 	} else
1828 		count = (int)aclp->z_acl_count;
1829 
1830 	if (mask & VSA_ACECNT) {
1831 		vsecp->vsa_aclcnt = count;
1832 	}
1833 
1834 	if (mask & VSA_ACE) {
1835 		size_t aclsz;
1836 
1837 		aclsz = count * sizeof (ace_t) +
1838 		    sizeof (ace_object_t) * largeace;
1839 
1840 		vsecp->vsa_aclentp = kmem_alloc(aclsz, KM_SLEEP);
1841 		vsecp->vsa_aclentsz = aclsz;
1842 
1843 		if (aclp->z_version == ZFS_ACL_VERSION_FUID)
1844 			zfs_copy_fuid_2_ace(zp->z_zfsvfs, aclp, cr,
1845 			    vsecp->vsa_aclentp, !(mask & VSA_ACE_ALLTYPES));
1846 		else {
1847 			zfs_acl_node_t *aclnode;
1848 			void *start = vsecp->vsa_aclentp;
1849 
1850 			for (aclnode = list_head(&aclp->z_acl); aclnode;
1851 			    aclnode = list_next(&aclp->z_acl, aclnode)) {
1852 				memcpy(start, aclnode->z_acldata,
1853 				    aclnode->z_size);
1854 				start = (caddr_t)start + aclnode->z_size;
1855 			}
1856 			ASSERT3U((caddr_t)start - (caddr_t)vsecp->vsa_aclentp,
1857 			    ==, aclp->z_acl_bytes);
1858 		}
1859 	}
1860 	if (mask & VSA_ACE_ACLFLAGS) {
1861 		vsecp->vsa_aclflags = 0;
1862 		if (zp->z_pflags & ZFS_ACL_DEFAULTED)
1863 			vsecp->vsa_aclflags |= ACL_DEFAULTED;
1864 		if (zp->z_pflags & ZFS_ACL_PROTECTED)
1865 			vsecp->vsa_aclflags |= ACL_PROTECTED;
1866 		if (zp->z_pflags & ZFS_ACL_AUTO_INHERIT)
1867 			vsecp->vsa_aclflags |= ACL_AUTO_INHERIT;
1868 	}
1869 
1870 	mutex_exit(&zp->z_acl_lock);
1871 
1872 	return (0);
1873 }
1874 
1875 int
1876 zfs_vsec_2_aclp(zfsvfs_t *zfsvfs, umode_t obj_type,
1877     vsecattr_t *vsecp, cred_t *cr, zfs_fuid_info_t **fuidp, zfs_acl_t **zaclp)
1878 {
1879 	zfs_acl_t *aclp;
1880 	zfs_acl_node_t *aclnode;
1881 	int aclcnt = vsecp->vsa_aclcnt;
1882 	int error;
1883 
1884 	if (vsecp->vsa_aclcnt > MAX_ACL_ENTRIES || vsecp->vsa_aclcnt <= 0)
1885 		return (SET_ERROR(EINVAL));
1886 
1887 	aclp = zfs_acl_alloc(zfs_acl_version(zfsvfs->z_version));
1888 
1889 	aclp->z_hints = 0;
1890 	aclnode = zfs_acl_node_alloc(aclcnt * sizeof (zfs_object_ace_t));
1891 	if (aclp->z_version == ZFS_ACL_VERSION_INITIAL) {
1892 		if ((error = zfs_copy_ace_2_oldace(obj_type, aclp,
1893 		    (ace_t *)vsecp->vsa_aclentp, aclnode->z_acldata,
1894 		    aclcnt, &aclnode->z_size)) != 0) {
1895 			zfs_acl_free(aclp);
1896 			zfs_acl_node_free(aclnode);
1897 			return (error);
1898 		}
1899 	} else {
1900 		if ((error = zfs_copy_ace_2_fuid(zfsvfs, obj_type, aclp,
1901 		    vsecp->vsa_aclentp, aclnode->z_acldata, aclcnt,
1902 		    &aclnode->z_size, fuidp, cr)) != 0) {
1903 			zfs_acl_free(aclp);
1904 			zfs_acl_node_free(aclnode);
1905 			return (error);
1906 		}
1907 	}
1908 	aclp->z_acl_bytes = aclnode->z_size;
1909 	aclnode->z_ace_count = aclcnt;
1910 	aclp->z_acl_count = aclcnt;
1911 	list_insert_head(&aclp->z_acl, aclnode);
1912 
1913 	/*
1914 	 * If flags are being set then add them to z_hints
1915 	 */
1916 	if (vsecp->vsa_mask & VSA_ACE_ACLFLAGS) {
1917 		if (vsecp->vsa_aclflags & ACL_PROTECTED)
1918 			aclp->z_hints |= ZFS_ACL_PROTECTED;
1919 		if (vsecp->vsa_aclflags & ACL_DEFAULTED)
1920 			aclp->z_hints |= ZFS_ACL_DEFAULTED;
1921 		if (vsecp->vsa_aclflags & ACL_AUTO_INHERIT)
1922 			aclp->z_hints |= ZFS_ACL_AUTO_INHERIT;
1923 	}
1924 
1925 	*zaclp = aclp;
1926 
1927 	return (0);
1928 }
1929 
1930 /*
1931  * Set a file's ACL
1932  */
1933 int
1934 zfs_setacl(znode_t *zp, vsecattr_t *vsecp, boolean_t skipaclchk, cred_t *cr)
1935 {
1936 	zfsvfs_t	*zfsvfs = zp->z_zfsvfs;
1937 	zilog_t		*zilog = zfsvfs->z_log;
1938 	ulong_t		mask = vsecp->vsa_mask & (VSA_ACE | VSA_ACECNT);
1939 	dmu_tx_t	*tx;
1940 	int		error;
1941 	zfs_acl_t	*aclp;
1942 	zfs_fuid_info_t	*fuidp = NULL;
1943 	boolean_t	fuid_dirtied;
1944 	uint64_t	acl_obj;
1945 
1946 	if (zp->z_zfsvfs->z_replay == B_FALSE)
1947 		ASSERT_VOP_ELOCKED(ZTOV(zp), __func__);
1948 	if (mask == 0)
1949 		return (SET_ERROR(ENOSYS));
1950 
1951 	if (zp->z_pflags & ZFS_IMMUTABLE)
1952 		return (SET_ERROR(EPERM));
1953 
1954 	if ((error = zfs_zaccess(zp, ACE_WRITE_ACL, 0, skipaclchk, cr)))
1955 		return (error);
1956 
1957 	error = zfs_vsec_2_aclp(zfsvfs, ZTOV(zp)->v_type, vsecp, cr, &fuidp,
1958 	    &aclp);
1959 	if (error)
1960 		return (error);
1961 
1962 	/*
1963 	 * If ACL wide flags aren't being set then preserve any
1964 	 * existing flags.
1965 	 */
1966 	if (!(vsecp->vsa_mask & VSA_ACE_ACLFLAGS)) {
1967 		aclp->z_hints |=
1968 		    (zp->z_pflags & V4_ACL_WIDE_FLAGS);
1969 	}
1970 top:
1971 	mutex_enter(&zp->z_acl_lock);
1972 
1973 	tx = dmu_tx_create(zfsvfs->z_os);
1974 
1975 	dmu_tx_hold_sa(tx, zp->z_sa_hdl, B_TRUE);
1976 
1977 	fuid_dirtied = zfsvfs->z_fuid_dirty;
1978 	if (fuid_dirtied)
1979 		zfs_fuid_txhold(zfsvfs, tx);
1980 
1981 	/*
1982 	 * If old version and ACL won't fit in bonus and we aren't
1983 	 * upgrading then take out necessary DMU holds
1984 	 */
1985 
1986 	if ((acl_obj = zfs_external_acl(zp)) != 0) {
1987 		if (zfsvfs->z_version >= ZPL_VERSION_FUID &&
1988 		    zfs_znode_acl_version(zp) <= ZFS_ACL_VERSION_INITIAL) {
1989 			dmu_tx_hold_free(tx, acl_obj, 0,
1990 			    DMU_OBJECT_END);
1991 			dmu_tx_hold_write(tx, DMU_NEW_OBJECT, 0,
1992 			    aclp->z_acl_bytes);
1993 		} else {
1994 			dmu_tx_hold_write(tx, acl_obj, 0, aclp->z_acl_bytes);
1995 		}
1996 	} else if (!zp->z_is_sa && aclp->z_acl_bytes > ZFS_ACE_SPACE) {
1997 		dmu_tx_hold_write(tx, DMU_NEW_OBJECT, 0, aclp->z_acl_bytes);
1998 	}
1999 
2000 	zfs_sa_upgrade_txholds(tx, zp);
2001 	error = dmu_tx_assign(tx, TXG_NOWAIT);
2002 	if (error) {
2003 		mutex_exit(&zp->z_acl_lock);
2004 
2005 		if (error == ERESTART) {
2006 			dmu_tx_wait(tx);
2007 			dmu_tx_abort(tx);
2008 			goto top;
2009 		}
2010 		dmu_tx_abort(tx);
2011 		zfs_acl_free(aclp);
2012 		return (error);
2013 	}
2014 
2015 	error = zfs_aclset_common(zp, aclp, cr, tx);
2016 	ASSERT0(error);
2017 	ASSERT3P(zp->z_acl_cached, ==, NULL);
2018 	zp->z_acl_cached = aclp;
2019 
2020 	if (fuid_dirtied)
2021 		zfs_fuid_sync(zfsvfs, tx);
2022 
2023 	zfs_log_acl(zilog, tx, zp, vsecp, fuidp);
2024 
2025 	if (fuidp)
2026 		zfs_fuid_info_free(fuidp);
2027 	dmu_tx_commit(tx);
2028 	mutex_exit(&zp->z_acl_lock);
2029 
2030 	return (error);
2031 }
2032 
2033 /*
2034  * Check accesses of interest (AoI) against attributes of the dataset
2035  * such as read-only.  Returns zero if no AoI conflict with dataset
2036  * attributes, otherwise an appropriate errno is returned.
2037  */
2038 static int
2039 zfs_zaccess_dataset_check(znode_t *zp, uint32_t v4_mode)
2040 {
2041 	if ((v4_mode & WRITE_MASK) &&
2042 	    (zp->z_zfsvfs->z_vfs->vfs_flag & VFS_RDONLY) &&
2043 	    (!IS_DEVVP(ZTOV(zp)) ||
2044 	    (IS_DEVVP(ZTOV(zp)) && (v4_mode & WRITE_MASK_ATTRS)))) {
2045 		return (SET_ERROR(EROFS));
2046 	}
2047 
2048 	/*
2049 	 * Intentionally allow ZFS_READONLY through here.
2050 	 * See zfs_zaccess_common().
2051 	 */
2052 	if ((v4_mode & WRITE_MASK_DATA) &&
2053 	    (zp->z_pflags & ZFS_IMMUTABLE)) {
2054 		return (SET_ERROR(EPERM));
2055 	}
2056 
2057 	/*
2058 	 * In FreeBSD we allow to modify directory's content is ZFS_NOUNLINK
2059 	 * (sunlnk) is set. We just don't allow directory removal, which is
2060 	 * handled in zfs_zaccess_delete().
2061 	 */
2062 	if ((v4_mode & ACE_DELETE) &&
2063 	    (zp->z_pflags & ZFS_NOUNLINK)) {
2064 		return (EPERM);
2065 	}
2066 
2067 	if (((v4_mode & (ACE_READ_DATA|ACE_EXECUTE)) &&
2068 	    (zp->z_pflags & ZFS_AV_QUARANTINED))) {
2069 		return (SET_ERROR(EACCES));
2070 	}
2071 
2072 	return (0);
2073 }
2074 
2075 /*
2076  * The primary usage of this function is to loop through all of the
2077  * ACEs in the znode, determining what accesses of interest (AoI) to
2078  * the caller are allowed or denied.  The AoI are expressed as bits in
2079  * the working_mode parameter.  As each ACE is processed, bits covered
2080  * by that ACE are removed from the working_mode.  This removal
2081  * facilitates two things.  The first is that when the working mode is
2082  * empty (= 0), we know we've looked at all the AoI. The second is
2083  * that the ACE interpretation rules don't allow a later ACE to undo
2084  * something granted or denied by an earlier ACE.  Removing the
2085  * discovered access or denial enforces this rule.  At the end of
2086  * processing the ACEs, all AoI that were found to be denied are
2087  * placed into the working_mode, giving the caller a mask of denied
2088  * accesses.  Returns:
2089  *	0		if all AoI granted
2090  *	EACCESS 	if the denied mask is non-zero
2091  *	other error	if abnormal failure (e.g., IO error)
2092  *
2093  * A secondary usage of the function is to determine if any of the
2094  * AoI are granted.  If an ACE grants any access in
2095  * the working_mode, we immediately short circuit out of the function.
2096  * This mode is chosen by setting anyaccess to B_TRUE.  The
2097  * working_mode is not a denied access mask upon exit if the function
2098  * is used in this manner.
2099  */
2100 static int
2101 zfs_zaccess_aces_check(znode_t *zp, uint32_t *working_mode,
2102     boolean_t anyaccess, cred_t *cr)
2103 {
2104 	zfsvfs_t	*zfsvfs = zp->z_zfsvfs;
2105 	zfs_acl_t	*aclp;
2106 	int		error;
2107 	uid_t		uid = crgetuid(cr);
2108 	uint64_t 	who;
2109 	uint16_t	type, iflags;
2110 	uint16_t	entry_type;
2111 	uint32_t	access_mask;
2112 	uint32_t	deny_mask = 0;
2113 	zfs_ace_hdr_t	*acep = NULL;
2114 	boolean_t	checkit;
2115 	uid_t		gowner;
2116 	uid_t		fowner;
2117 
2118 	zfs_fuid_map_ids(zp, cr, &fowner, &gowner);
2119 
2120 	mutex_enter(&zp->z_acl_lock);
2121 
2122 	if (zp->z_zfsvfs->z_replay == B_FALSE)
2123 		ASSERT_VOP_LOCKED(ZTOV(zp), __func__);
2124 	error = zfs_acl_node_read(zp, B_TRUE, &aclp, B_FALSE);
2125 	if (error != 0) {
2126 		mutex_exit(&zp->z_acl_lock);
2127 		return (error);
2128 	}
2129 
2130 	ASSERT3P(zp->z_acl_cached, !=, NULL);
2131 
2132 	while ((acep = zfs_acl_next_ace(aclp, acep, &who, &access_mask,
2133 	    &iflags, &type))) {
2134 		uint32_t mask_matched;
2135 
2136 		if (!zfs_acl_valid_ace_type(type, iflags))
2137 			continue;
2138 
2139 		if (ZTOV(zp)->v_type == VDIR && (iflags & ACE_INHERIT_ONLY_ACE))
2140 			continue;
2141 
2142 		/* Skip ACE if it does not affect any AoI */
2143 		mask_matched = (access_mask & *working_mode);
2144 		if (!mask_matched)
2145 			continue;
2146 
2147 		entry_type = (iflags & ACE_TYPE_FLAGS);
2148 
2149 		checkit = B_FALSE;
2150 
2151 		switch (entry_type) {
2152 		case ACE_OWNER:
2153 			if (uid == fowner)
2154 				checkit = B_TRUE;
2155 			break;
2156 		case OWNING_GROUP:
2157 			who = gowner;
2158 			zfs_fallthrough;
2159 		case ACE_IDENTIFIER_GROUP:
2160 			checkit = zfs_groupmember(zfsvfs, who, cr);
2161 			break;
2162 		case ACE_EVERYONE:
2163 			checkit = B_TRUE;
2164 			break;
2165 
2166 		/* USER Entry */
2167 		default:
2168 			if (entry_type == 0) {
2169 				uid_t newid;
2170 
2171 				newid = zfs_fuid_map_id(zfsvfs, who, cr,
2172 				    ZFS_ACE_USER);
2173 				if (newid !=  UID_NOBODY &&
2174 				    uid == newid)
2175 					checkit = B_TRUE;
2176 				break;
2177 			} else {
2178 				mutex_exit(&zp->z_acl_lock);
2179 				return (SET_ERROR(EIO));
2180 			}
2181 		}
2182 
2183 		if (checkit) {
2184 			if (type == DENY) {
2185 				DTRACE_PROBE3(zfs__ace__denies,
2186 				    znode_t *, zp,
2187 				    zfs_ace_hdr_t *, acep,
2188 				    uint32_t, mask_matched);
2189 				deny_mask |= mask_matched;
2190 			} else {
2191 				DTRACE_PROBE3(zfs__ace__allows,
2192 				    znode_t *, zp,
2193 				    zfs_ace_hdr_t *, acep,
2194 				    uint32_t, mask_matched);
2195 				if (anyaccess) {
2196 					mutex_exit(&zp->z_acl_lock);
2197 					return (0);
2198 				}
2199 			}
2200 			*working_mode &= ~mask_matched;
2201 		}
2202 
2203 		/* Are we done? */
2204 		if (*working_mode == 0)
2205 			break;
2206 	}
2207 
2208 	mutex_exit(&zp->z_acl_lock);
2209 
2210 	/* Put the found 'denies' back on the working mode */
2211 	if (deny_mask) {
2212 		*working_mode |= deny_mask;
2213 		return (SET_ERROR(EACCES));
2214 	} else if (*working_mode) {
2215 		return (-1);
2216 	}
2217 
2218 	return (0);
2219 }
2220 
2221 /*
2222  * Return true if any access whatsoever granted, we don't actually
2223  * care what access is granted.
2224  */
2225 boolean_t
2226 zfs_has_access(znode_t *zp, cred_t *cr)
2227 {
2228 	uint32_t have = ACE_ALL_PERMS;
2229 
2230 	if (zfs_zaccess_aces_check(zp, &have, B_TRUE, cr) != 0) {
2231 		uid_t owner;
2232 
2233 		owner = zfs_fuid_map_id(zp->z_zfsvfs, zp->z_uid, cr, ZFS_OWNER);
2234 		return (secpolicy_vnode_any_access(cr, ZTOV(zp), owner) == 0);
2235 	}
2236 	return (B_TRUE);
2237 }
2238 
2239 static int
2240 zfs_zaccess_common(znode_t *zp, uint32_t v4_mode, uint32_t *working_mode,
2241     boolean_t *check_privs, boolean_t skipaclchk, cred_t *cr)
2242 {
2243 	zfsvfs_t *zfsvfs = zp->z_zfsvfs;
2244 	int err;
2245 
2246 	*working_mode = v4_mode;
2247 	*check_privs = B_TRUE;
2248 
2249 	/*
2250 	 * Short circuit empty requests
2251 	 */
2252 	if (v4_mode == 0 || zfsvfs->z_replay) {
2253 		*working_mode = 0;
2254 		return (0);
2255 	}
2256 
2257 	if ((err = zfs_zaccess_dataset_check(zp, v4_mode)) != 0) {
2258 		*check_privs = B_FALSE;
2259 		return (err);
2260 	}
2261 
2262 	/*
2263 	 * The caller requested that the ACL check be skipped.  This
2264 	 * would only happen if the caller checked VOP_ACCESS() with a
2265 	 * 32 bit ACE mask and already had the appropriate permissions.
2266 	 */
2267 	if (skipaclchk) {
2268 		*working_mode = 0;
2269 		return (0);
2270 	}
2271 
2272 	/*
2273 	 * Note: ZFS_READONLY represents the "DOS R/O" attribute.
2274 	 * When that flag is set, we should behave as if write access
2275 	 * were not granted by anything in the ACL.  In particular:
2276 	 * We _must_ allow writes after opening the file r/w, then
2277 	 * setting the DOS R/O attribute, and writing some more.
2278 	 * (Similar to how you can write after fchmod(fd, 0444).)
2279 	 *
2280 	 * Therefore ZFS_READONLY is ignored in the dataset check
2281 	 * above, and checked here as if part of the ACL check.
2282 	 * Also note: DOS R/O is ignored for directories.
2283 	 */
2284 	if ((v4_mode & WRITE_MASK_DATA) &&
2285 	    (ZTOV(zp)->v_type != VDIR) &&
2286 	    (zp->z_pflags & ZFS_READONLY)) {
2287 		return (SET_ERROR(EPERM));
2288 	}
2289 
2290 	return (zfs_zaccess_aces_check(zp, working_mode, B_FALSE, cr));
2291 }
2292 
2293 static int
2294 zfs_zaccess_append(znode_t *zp, uint32_t *working_mode, boolean_t *check_privs,
2295     cred_t *cr)
2296 {
2297 	if (*working_mode != ACE_WRITE_DATA)
2298 		return (SET_ERROR(EACCES));
2299 
2300 	return (zfs_zaccess_common(zp, ACE_APPEND_DATA, working_mode,
2301 	    check_privs, B_FALSE, cr));
2302 }
2303 
2304 /*
2305  * Check if VEXEC is allowed.
2306  *
2307  * This routine is based on zfs_fastaccesschk_execute which has slowpath
2308  * calling zfs_zaccess. This would be incorrect on FreeBSD (see
2309  * zfs_freebsd_access for the difference). Thus this variant let's the
2310  * caller handle the slowpath (if necessary).
2311  *
2312  * On top of that we perform a lockless check for ZFS_NO_EXECS_DENIED.
2313  *
2314  * Safe access to znode_t is provided by the vnode lock.
2315  */
2316 int
2317 zfs_fastaccesschk_execute(znode_t *zdp, cred_t *cr)
2318 {
2319 	boolean_t is_attr;
2320 
2321 	if (zdp->z_pflags & ZFS_AV_QUARANTINED)
2322 		return (1);
2323 
2324 	is_attr = ((zdp->z_pflags & ZFS_XATTR) &&
2325 	    (ZTOV(zdp)->v_type == VDIR));
2326 	if (is_attr)
2327 		return (1);
2328 
2329 	if (zdp->z_pflags & ZFS_NO_EXECS_DENIED)
2330 		return (0);
2331 
2332 	return (1);
2333 }
2334 
2335 
2336 /*
2337  * Determine whether Access should be granted/denied.
2338  *
2339  * The least priv subsystem is always consulted as a basic privilege
2340  * can define any form of access.
2341  */
2342 int
2343 zfs_zaccess(znode_t *zp, int mode, int flags, boolean_t skipaclchk, cred_t *cr)
2344 {
2345 	uint32_t	working_mode;
2346 	int		error;
2347 	int		is_attr;
2348 	boolean_t 	check_privs;
2349 	znode_t		*xzp = NULL;
2350 	znode_t 	*check_zp = zp;
2351 	mode_t		needed_bits;
2352 	uid_t		owner;
2353 
2354 	is_attr = ((zp->z_pflags & ZFS_XATTR) && (ZTOV(zp)->v_type == VDIR));
2355 
2356 	/*
2357 	 * In FreeBSD, we don't care about permissions of individual ADS.
2358 	 * Note that not checking them is not just an optimization - without
2359 	 * this shortcut, EA operations may bogusly fail with EACCES.
2360 	 */
2361 	if (zp->z_pflags & ZFS_XATTR)
2362 		return (0);
2363 
2364 	owner = zfs_fuid_map_id(zp->z_zfsvfs, zp->z_uid, cr, ZFS_OWNER);
2365 
2366 	/*
2367 	 * Map the bits required to the standard vnode flags VREAD|VWRITE|VEXEC
2368 	 * in needed_bits.  Map the bits mapped by working_mode (currently
2369 	 * missing) in missing_bits.
2370 	 * Call secpolicy_vnode_access2() with (needed_bits & ~checkmode),
2371 	 * needed_bits.
2372 	 */
2373 	needed_bits = 0;
2374 
2375 	working_mode = mode;
2376 	if ((working_mode & (ACE_READ_ACL|ACE_READ_ATTRIBUTES)) &&
2377 	    owner == crgetuid(cr))
2378 		working_mode &= ~(ACE_READ_ACL|ACE_READ_ATTRIBUTES);
2379 
2380 	if (working_mode & (ACE_READ_DATA|ACE_READ_NAMED_ATTRS|
2381 	    ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_SYNCHRONIZE))
2382 		needed_bits |= VREAD;
2383 	if (working_mode & (ACE_WRITE_DATA|ACE_WRITE_NAMED_ATTRS|
2384 	    ACE_APPEND_DATA|ACE_WRITE_ATTRIBUTES|ACE_SYNCHRONIZE))
2385 		needed_bits |= VWRITE;
2386 	if (working_mode & ACE_EXECUTE)
2387 		needed_bits |= VEXEC;
2388 
2389 	if ((error = zfs_zaccess_common(check_zp, mode, &working_mode,
2390 	    &check_privs, skipaclchk, cr)) == 0) {
2391 		if (is_attr)
2392 			VN_RELE(ZTOV(xzp));
2393 		return (secpolicy_vnode_access2(cr, ZTOV(zp), owner,
2394 		    needed_bits, needed_bits));
2395 	}
2396 
2397 	if (error && !check_privs) {
2398 		if (is_attr)
2399 			VN_RELE(ZTOV(xzp));
2400 		return (error);
2401 	}
2402 
2403 	if (error && (flags & V_APPEND)) {
2404 		error = zfs_zaccess_append(zp, &working_mode, &check_privs, cr);
2405 	}
2406 
2407 	if (error && check_privs) {
2408 		mode_t		checkmode = 0;
2409 		vnode_t *check_vp = ZTOV(check_zp);
2410 
2411 		/*
2412 		 * First check for implicit owner permission on
2413 		 * read_acl/read_attributes
2414 		 */
2415 
2416 		error = 0;
2417 		ASSERT3U(working_mode, !=, 0);
2418 
2419 		if ((working_mode & (ACE_READ_ACL|ACE_READ_ATTRIBUTES) &&
2420 		    owner == crgetuid(cr)))
2421 			working_mode &= ~(ACE_READ_ACL|ACE_READ_ATTRIBUTES);
2422 
2423 		if (working_mode & (ACE_READ_DATA|ACE_READ_NAMED_ATTRS|
2424 		    ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_SYNCHRONIZE))
2425 			checkmode |= VREAD;
2426 		if (working_mode & (ACE_WRITE_DATA|ACE_WRITE_NAMED_ATTRS|
2427 		    ACE_APPEND_DATA|ACE_WRITE_ATTRIBUTES|ACE_SYNCHRONIZE))
2428 			checkmode |= VWRITE;
2429 		if (working_mode & ACE_EXECUTE)
2430 			checkmode |= VEXEC;
2431 
2432 		error = secpolicy_vnode_access2(cr, check_vp, owner,
2433 		    needed_bits & ~checkmode, needed_bits);
2434 
2435 		if (error == 0 && (working_mode & ACE_WRITE_OWNER))
2436 			error = secpolicy_vnode_chown(check_vp, cr, owner);
2437 		if (error == 0 && (working_mode & ACE_WRITE_ACL))
2438 			error = secpolicy_vnode_setdac(check_vp, cr, owner);
2439 
2440 		if (error == 0 && (working_mode &
2441 		    (ACE_DELETE|ACE_DELETE_CHILD)))
2442 			error = secpolicy_vnode_remove(check_vp, cr);
2443 
2444 		if (error == 0 && (working_mode & ACE_SYNCHRONIZE)) {
2445 			error = secpolicy_vnode_chown(check_vp, cr, owner);
2446 		}
2447 		if (error == 0) {
2448 			/*
2449 			 * See if any bits other than those already checked
2450 			 * for are still present.  If so then return EACCES
2451 			 */
2452 			if (working_mode & ~(ZFS_CHECKED_MASKS)) {
2453 				error = SET_ERROR(EACCES);
2454 			}
2455 		}
2456 	} else if (error == 0) {
2457 		error = secpolicy_vnode_access2(cr, ZTOV(zp), owner,
2458 		    needed_bits, needed_bits);
2459 	}
2460 
2461 
2462 	if (is_attr)
2463 		VN_RELE(ZTOV(xzp));
2464 
2465 	return (error);
2466 }
2467 
2468 /*
2469  * Translate traditional unix VREAD/VWRITE/VEXEC mode into
2470  * NFSv4-style ZFS ACL format and call zfs_zaccess()
2471  */
2472 int
2473 zfs_zaccess_rwx(znode_t *zp, mode_t mode, int flags, cred_t *cr)
2474 {
2475 	return (zfs_zaccess(zp, zfs_unix_to_v4(mode >> 6), flags, B_FALSE, cr));
2476 }
2477 
2478 /*
2479  * Access function for secpolicy_vnode_setattr
2480  */
2481 int
2482 zfs_zaccess_unix(znode_t *zp, mode_t mode, cred_t *cr)
2483 {
2484 	int v4_mode = zfs_unix_to_v4(mode >> 6);
2485 
2486 	return (zfs_zaccess(zp, v4_mode, 0, B_FALSE, cr));
2487 }
2488 
2489 static int
2490 zfs_delete_final_check(znode_t *zp, znode_t *dzp,
2491     mode_t available_perms, cred_t *cr)
2492 {
2493 	int error;
2494 	uid_t downer;
2495 
2496 	downer = zfs_fuid_map_id(dzp->z_zfsvfs, dzp->z_uid, cr, ZFS_OWNER);
2497 
2498 	error = secpolicy_vnode_access2(cr, ZTOV(dzp),
2499 	    downer, available_perms, VWRITE|VEXEC);
2500 
2501 	if (error == 0)
2502 		error = zfs_sticky_remove_access(dzp, zp, cr);
2503 
2504 	return (error);
2505 }
2506 
2507 /*
2508  * Determine whether Access should be granted/deny, without
2509  * consulting least priv subsystem.
2510  *
2511  * The following chart is the recommended NFSv4 enforcement for
2512  * ability to delete an object.
2513  *
2514  *      -------------------------------------------------------
2515  *      |   Parent Dir  |           Target Object Permissions |
2516  *      |  permissions  |                                     |
2517  *      -------------------------------------------------------
2518  *      |               | ACL Allows | ACL Denies| Delete     |
2519  *      |               |  Delete    |  Delete   | unspecified|
2520  *      -------------------------------------------------------
2521  *      |  ACL Allows   | Permit     | Permit    | Permit     |
2522  *      |  DELETE_CHILD |                                     |
2523  *      -------------------------------------------------------
2524  *      |  ACL Denies   | Permit     | Deny      | Deny       |
2525  *      |  DELETE_CHILD |            |           |            |
2526  *      -------------------------------------------------------
2527  *      | ACL specifies |            |           |            |
2528  *      | only allow    | Permit     | Permit    | Permit     |
2529  *      | write and     |            |           |            |
2530  *      | execute       |            |           |            |
2531  *      -------------------------------------------------------
2532  *      | ACL denies    |            |           |            |
2533  *      | write and     | Permit     | Deny      | Deny       |
2534  *      | execute       |            |           |            |
2535  *      -------------------------------------------------------
2536  *         ^
2537  *         |
2538  *         No search privilege, can't even look up file?
2539  *
2540  */
2541 int
2542 zfs_zaccess_delete(znode_t *dzp, znode_t *zp, cred_t *cr)
2543 {
2544 	uint32_t dzp_working_mode = 0;
2545 	uint32_t zp_working_mode = 0;
2546 	int dzp_error, zp_error;
2547 	mode_t available_perms;
2548 	boolean_t dzpcheck_privs = B_TRUE;
2549 	boolean_t zpcheck_privs = B_TRUE;
2550 
2551 	/*
2552 	 * We want specific DELETE permissions to
2553 	 * take precedence over WRITE/EXECUTE.  We don't
2554 	 * want an ACL such as this to mess us up.
2555 	 * user:joe:write_data:deny,user:joe:delete:allow
2556 	 *
2557 	 * However, deny permissions may ultimately be overridden
2558 	 * by secpolicy_vnode_access().
2559 	 *
2560 	 * We will ask for all of the necessary permissions and then
2561 	 * look at the working modes from the directory and target object
2562 	 * to determine what was found.
2563 	 */
2564 
2565 	if (zp->z_pflags & (ZFS_IMMUTABLE | ZFS_NOUNLINK))
2566 		return (SET_ERROR(EPERM));
2567 
2568 	/*
2569 	 * First row
2570 	 * If the directory permissions allow the delete, we are done.
2571 	 */
2572 	if ((dzp_error = zfs_zaccess_common(dzp, ACE_DELETE_CHILD,
2573 	    &dzp_working_mode, &dzpcheck_privs, B_FALSE, cr)) == 0)
2574 		return (0);
2575 
2576 	/*
2577 	 * If target object has delete permission then we are done
2578 	 */
2579 	if ((zp_error = zfs_zaccess_common(zp, ACE_DELETE, &zp_working_mode,
2580 	    &zpcheck_privs, B_FALSE, cr)) == 0)
2581 		return (0);
2582 
2583 	ASSERT(dzp_error);
2584 	ASSERT(zp_error);
2585 
2586 	if (!dzpcheck_privs)
2587 		return (dzp_error);
2588 	if (!zpcheck_privs)
2589 		return (zp_error);
2590 
2591 	/*
2592 	 * Second row
2593 	 *
2594 	 * If directory returns EACCES then delete_child was denied
2595 	 * due to deny delete_child.  In this case send the request through
2596 	 * secpolicy_vnode_remove().  We don't use zfs_delete_final_check()
2597 	 * since that *could* allow the delete based on write/execute permission
2598 	 * and we want delete permissions to override write/execute.
2599 	 */
2600 
2601 	if (dzp_error == EACCES) {
2602 		/* XXXPJD: s/dzp/zp/ ? */
2603 		return (secpolicy_vnode_remove(ZTOV(dzp), cr));
2604 	}
2605 	/*
2606 	 * Third Row
2607 	 * only need to see if we have write/execute on directory.
2608 	 */
2609 
2610 	dzp_error = zfs_zaccess_common(dzp, ACE_EXECUTE|ACE_WRITE_DATA,
2611 	    &dzp_working_mode, &dzpcheck_privs, B_FALSE, cr);
2612 
2613 	if (dzp_error != 0 && !dzpcheck_privs)
2614 		return (dzp_error);
2615 
2616 	/*
2617 	 * Fourth row
2618 	 */
2619 
2620 	available_perms = (dzp_working_mode & ACE_WRITE_DATA) ? 0 : VWRITE;
2621 	available_perms |= (dzp_working_mode & ACE_EXECUTE) ? 0 : VEXEC;
2622 
2623 	return (zfs_delete_final_check(zp, dzp, available_perms, cr));
2624 
2625 }
2626 
2627 int
2628 zfs_zaccess_rename(znode_t *sdzp, znode_t *szp, znode_t *tdzp,
2629     znode_t *tzp, cred_t *cr)
2630 {
2631 	int add_perm;
2632 	int error;
2633 
2634 	if (szp->z_pflags & ZFS_AV_QUARANTINED)
2635 		return (SET_ERROR(EACCES));
2636 
2637 	add_perm = (ZTOV(szp)->v_type == VDIR) ?
2638 	    ACE_ADD_SUBDIRECTORY : ACE_ADD_FILE;
2639 
2640 	/*
2641 	 * Rename permissions are combination of delete permission +
2642 	 * add file/subdir permission.
2643 	 *
2644 	 * BSD operating systems also require write permission
2645 	 * on the directory being moved from one parent directory
2646 	 * to another.
2647 	 */
2648 	if (ZTOV(szp)->v_type == VDIR && ZTOV(sdzp) != ZTOV(tdzp)) {
2649 		if ((error = zfs_zaccess(szp, ACE_WRITE_DATA, 0, B_FALSE, cr)))
2650 			return (error);
2651 	}
2652 
2653 	/*
2654 	 * first make sure we do the delete portion.
2655 	 *
2656 	 * If that succeeds then check for add_file/add_subdir permissions
2657 	 */
2658 
2659 	if ((error = zfs_zaccess_delete(sdzp, szp, cr)))
2660 		return (error);
2661 
2662 	/*
2663 	 * If we have a tzp, see if we can delete it?
2664 	 */
2665 	if (tzp && (error = zfs_zaccess_delete(tdzp, tzp, cr)))
2666 		return (error);
2667 
2668 	/*
2669 	 * Now check for add permissions
2670 	 */
2671 	error = zfs_zaccess(tdzp, add_perm, 0, B_FALSE, cr);
2672 
2673 	return (error);
2674 }
2675