1 // SPDX-License-Identifier: CDDL-1.0 2 /* 3 * CDDL HEADER START 4 * 5 * The contents of this file are subject to the terms of the 6 * Common Development and Distribution License (the "License"). 7 * You may not use this file except in compliance with the License. 8 * 9 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10 * or https://opensource.org/licenses/CDDL-1.0. 11 * See the License for the specific language governing permissions 12 * and limitations under the License. 13 * 14 * When distributing Covered Code, include this CDDL HEADER in each 15 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16 * If applicable, add the following below this CDDL HEADER, with the 17 * fields enclosed by brackets "[]" replaced with your own identifying 18 * information: Portions Copyright [yyyy] [name of copyright owner] 19 * 20 * CDDL HEADER END 21 */ 22 /* 23 * Copyright (c) 2005, 2010, Oracle and/or its affiliates. All rights reserved. 24 * Copyright (c) 2013 by Delphix. All rights reserved. 25 * Copyright 2014 Nexenta Systems, Inc. All rights reserved. 26 */ 27 28 29 #include <sys/types.h> 30 #include <sys/param.h> 31 #include <sys/time.h> 32 #include <sys/sysmacros.h> 33 #include <sys/vfs.h> 34 #include <sys/vnode.h> 35 #include <sys/sid.h> 36 #include <sys/file.h> 37 #include <sys/stat.h> 38 #include <sys/kmem.h> 39 #include <sys/cmn_err.h> 40 #include <sys/errno.h> 41 #include <sys/fs/zfs.h> 42 #include <sys/policy.h> 43 #include <sys/zfs_znode.h> 44 #include <sys/zfs_fuid.h> 45 #include <sys/zfs_acl.h> 46 #include <sys/zfs_dir.h> 47 #include <sys/zfs_quota.h> 48 #include <sys/zfs_vfsops.h> 49 #include <sys/dmu.h> 50 #include <sys/dnode.h> 51 #include <sys/zap.h> 52 #include <sys/sa.h> 53 #include <sys/trace_acl.h> 54 #include <sys/zpl.h> 55 56 #define ALLOW ACE_ACCESS_ALLOWED_ACE_TYPE 57 #define DENY ACE_ACCESS_DENIED_ACE_TYPE 58 #define MAX_ACE_TYPE ACE_SYSTEM_ALARM_CALLBACK_OBJECT_ACE_TYPE 59 #define MIN_ACE_TYPE ALLOW 60 61 #define OWNING_GROUP (ACE_GROUP|ACE_IDENTIFIER_GROUP) 62 #define EVERYONE_ALLOW_MASK (ACE_READ_ACL|ACE_READ_ATTRIBUTES | \ 63 ACE_READ_NAMED_ATTRS|ACE_SYNCHRONIZE) 64 #define EVERYONE_DENY_MASK (ACE_WRITE_ACL|ACE_WRITE_OWNER | \ 65 ACE_WRITE_ATTRIBUTES|ACE_WRITE_NAMED_ATTRS) 66 #define OWNER_ALLOW_MASK (ACE_WRITE_ACL | ACE_WRITE_OWNER | \ 67 ACE_WRITE_ATTRIBUTES|ACE_WRITE_NAMED_ATTRS) 68 69 #define ZFS_CHECKED_MASKS (ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_READ_DATA| \ 70 ACE_READ_NAMED_ATTRS|ACE_WRITE_DATA|ACE_WRITE_ATTRIBUTES| \ 71 ACE_WRITE_NAMED_ATTRS|ACE_APPEND_DATA|ACE_EXECUTE|ACE_WRITE_OWNER| \ 72 ACE_WRITE_ACL|ACE_DELETE|ACE_DELETE_CHILD|ACE_SYNCHRONIZE) 73 74 #define WRITE_MASK_DATA (ACE_WRITE_DATA|ACE_APPEND_DATA|ACE_WRITE_NAMED_ATTRS) 75 #define WRITE_MASK_ATTRS (ACE_WRITE_ACL|ACE_WRITE_OWNER|ACE_WRITE_ATTRIBUTES| \ 76 ACE_DELETE|ACE_DELETE_CHILD) 77 #define WRITE_MASK (WRITE_MASK_DATA|WRITE_MASK_ATTRS) 78 79 #define OGE_CLEAR (ACE_READ_DATA|ACE_LIST_DIRECTORY|ACE_WRITE_DATA| \ 80 ACE_ADD_FILE|ACE_APPEND_DATA|ACE_ADD_SUBDIRECTORY|ACE_EXECUTE) 81 82 #define OKAY_MASK_BITS (ACE_READ_DATA|ACE_LIST_DIRECTORY|ACE_WRITE_DATA| \ 83 ACE_ADD_FILE|ACE_APPEND_DATA|ACE_ADD_SUBDIRECTORY|ACE_EXECUTE) 84 85 #define ALL_INHERIT (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE | \ 86 ACE_NO_PROPAGATE_INHERIT_ACE|ACE_INHERIT_ONLY_ACE|ACE_INHERITED_ACE) 87 88 #define RESTRICTED_CLEAR (ACE_WRITE_ACL|ACE_WRITE_OWNER) 89 90 #define V4_ACL_WIDE_FLAGS (ZFS_ACL_AUTO_INHERIT|ZFS_ACL_DEFAULTED|\ 91 ZFS_ACL_PROTECTED) 92 93 #define ZFS_ACL_WIDE_FLAGS (V4_ACL_WIDE_FLAGS|ZFS_ACL_TRIVIAL|ZFS_INHERIT_ACE|\ 94 ZFS_ACL_OBJ_ACE) 95 96 #define ALL_MODE_EXECS (S_IXUSR | S_IXGRP | S_IXOTH) 97 98 #define IDMAP_WK_CREATOR_OWNER_UID 2147483648U 99 100 static uint16_t 101 zfs_ace_v0_get_type(void *acep) 102 { 103 return (((zfs_oldace_t *)acep)->z_type); 104 } 105 106 static uint16_t 107 zfs_ace_v0_get_flags(void *acep) 108 { 109 return (((zfs_oldace_t *)acep)->z_flags); 110 } 111 112 static uint32_t 113 zfs_ace_v0_get_mask(void *acep) 114 { 115 return (((zfs_oldace_t *)acep)->z_access_mask); 116 } 117 118 static uint64_t 119 zfs_ace_v0_get_who(void *acep) 120 { 121 return (((zfs_oldace_t *)acep)->z_fuid); 122 } 123 124 static void 125 zfs_ace_v0_set_type(void *acep, uint16_t type) 126 { 127 ((zfs_oldace_t *)acep)->z_type = type; 128 } 129 130 static void 131 zfs_ace_v0_set_flags(void *acep, uint16_t flags) 132 { 133 ((zfs_oldace_t *)acep)->z_flags = flags; 134 } 135 136 static void 137 zfs_ace_v0_set_mask(void *acep, uint32_t mask) 138 { 139 ((zfs_oldace_t *)acep)->z_access_mask = mask; 140 } 141 142 static void 143 zfs_ace_v0_set_who(void *acep, uint64_t who) 144 { 145 ((zfs_oldace_t *)acep)->z_fuid = who; 146 } 147 148 static size_t 149 zfs_ace_v0_size(void *acep) 150 { 151 (void) acep; 152 return (sizeof (zfs_oldace_t)); 153 } 154 155 static size_t 156 zfs_ace_v0_abstract_size(void) 157 { 158 return (sizeof (zfs_oldace_t)); 159 } 160 161 static int 162 zfs_ace_v0_mask_off(void) 163 { 164 return (offsetof(zfs_oldace_t, z_access_mask)); 165 } 166 167 static int 168 zfs_ace_v0_data(void *acep, void **datap) 169 { 170 (void) acep; 171 *datap = NULL; 172 return (0); 173 } 174 175 static const acl_ops_t zfs_acl_v0_ops = { 176 .ace_mask_get = zfs_ace_v0_get_mask, 177 .ace_mask_set = zfs_ace_v0_set_mask, 178 .ace_flags_get = zfs_ace_v0_get_flags, 179 .ace_flags_set = zfs_ace_v0_set_flags, 180 .ace_type_get = zfs_ace_v0_get_type, 181 .ace_type_set = zfs_ace_v0_set_type, 182 .ace_who_get = zfs_ace_v0_get_who, 183 .ace_who_set = zfs_ace_v0_set_who, 184 .ace_size = zfs_ace_v0_size, 185 .ace_abstract_size = zfs_ace_v0_abstract_size, 186 .ace_mask_off = zfs_ace_v0_mask_off, 187 .ace_data = zfs_ace_v0_data 188 }; 189 190 static uint16_t 191 zfs_ace_fuid_get_type(void *acep) 192 { 193 return (((zfs_ace_hdr_t *)acep)->z_type); 194 } 195 196 static uint16_t 197 zfs_ace_fuid_get_flags(void *acep) 198 { 199 return (((zfs_ace_hdr_t *)acep)->z_flags); 200 } 201 202 static uint32_t 203 zfs_ace_fuid_get_mask(void *acep) 204 { 205 return (((zfs_ace_hdr_t *)acep)->z_access_mask); 206 } 207 208 static uint64_t 209 zfs_ace_fuid_get_who(void *args) 210 { 211 uint16_t entry_type; 212 zfs_ace_t *acep = args; 213 214 entry_type = acep->z_hdr.z_flags & ACE_TYPE_FLAGS; 215 216 if (entry_type == ACE_OWNER || entry_type == OWNING_GROUP || 217 entry_type == ACE_EVERYONE) 218 return (-1); 219 return (((zfs_ace_t *)acep)->z_fuid); 220 } 221 222 static void 223 zfs_ace_fuid_set_type(void *acep, uint16_t type) 224 { 225 ((zfs_ace_hdr_t *)acep)->z_type = type; 226 } 227 228 static void 229 zfs_ace_fuid_set_flags(void *acep, uint16_t flags) 230 { 231 ((zfs_ace_hdr_t *)acep)->z_flags = flags; 232 } 233 234 static void 235 zfs_ace_fuid_set_mask(void *acep, uint32_t mask) 236 { 237 ((zfs_ace_hdr_t *)acep)->z_access_mask = mask; 238 } 239 240 static void 241 zfs_ace_fuid_set_who(void *arg, uint64_t who) 242 { 243 zfs_ace_t *acep = arg; 244 245 uint16_t entry_type = acep->z_hdr.z_flags & ACE_TYPE_FLAGS; 246 247 if (entry_type == ACE_OWNER || entry_type == OWNING_GROUP || 248 entry_type == ACE_EVERYONE) 249 return; 250 acep->z_fuid = who; 251 } 252 253 static size_t 254 zfs_ace_fuid_size(void *acep) 255 { 256 zfs_ace_hdr_t *zacep = acep; 257 uint16_t entry_type; 258 259 switch (zacep->z_type) { 260 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 261 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 262 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 263 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 264 return (sizeof (zfs_object_ace_t)); 265 case ALLOW: 266 case DENY: 267 entry_type = 268 (((zfs_ace_hdr_t *)acep)->z_flags & ACE_TYPE_FLAGS); 269 if (entry_type == ACE_OWNER || 270 entry_type == OWNING_GROUP || 271 entry_type == ACE_EVERYONE) 272 return (sizeof (zfs_ace_hdr_t)); 273 zfs_fallthrough; 274 default: 275 return (sizeof (zfs_ace_t)); 276 } 277 } 278 279 static size_t 280 zfs_ace_fuid_abstract_size(void) 281 { 282 return (sizeof (zfs_ace_hdr_t)); 283 } 284 285 static int 286 zfs_ace_fuid_mask_off(void) 287 { 288 return (offsetof(zfs_ace_hdr_t, z_access_mask)); 289 } 290 291 static int 292 zfs_ace_fuid_data(void *acep, void **datap) 293 { 294 zfs_ace_t *zacep = acep; 295 zfs_object_ace_t *zobjp; 296 297 switch (zacep->z_hdr.z_type) { 298 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 299 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 300 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 301 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 302 zobjp = acep; 303 *datap = (caddr_t)zobjp + sizeof (zfs_ace_t); 304 return (sizeof (zfs_object_ace_t) - sizeof (zfs_ace_t)); 305 default: 306 *datap = NULL; 307 return (0); 308 } 309 } 310 311 static const acl_ops_t zfs_acl_fuid_ops = { 312 .ace_mask_get = zfs_ace_fuid_get_mask, 313 .ace_mask_set = zfs_ace_fuid_set_mask, 314 .ace_flags_get = zfs_ace_fuid_get_flags, 315 .ace_flags_set = zfs_ace_fuid_set_flags, 316 .ace_type_get = zfs_ace_fuid_get_type, 317 .ace_type_set = zfs_ace_fuid_set_type, 318 .ace_who_get = zfs_ace_fuid_get_who, 319 .ace_who_set = zfs_ace_fuid_set_who, 320 .ace_size = zfs_ace_fuid_size, 321 .ace_abstract_size = zfs_ace_fuid_abstract_size, 322 .ace_mask_off = zfs_ace_fuid_mask_off, 323 .ace_data = zfs_ace_fuid_data 324 }; 325 326 /* 327 * The following three functions are provided for compatibility with 328 * older ZPL version in order to determine if the file use to have 329 * an external ACL and what version of ACL previously existed on the 330 * file. Would really be nice to not need this, sigh. 331 */ 332 uint64_t 333 zfs_external_acl(znode_t *zp) 334 { 335 zfs_acl_phys_t acl_phys; 336 int error; 337 338 if (zp->z_is_sa) 339 return (0); 340 341 /* 342 * Need to deal with a potential 343 * race where zfs_sa_upgrade could cause 344 * z_isa_sa to change. 345 * 346 * If the lookup fails then the state of z_is_sa should have 347 * changed. 348 */ 349 350 if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_ZNODE_ACL(ZTOZSB(zp)), 351 &acl_phys, sizeof (acl_phys))) == 0) 352 return (acl_phys.z_acl_extern_obj); 353 else { 354 /* 355 * after upgrade the SA_ZPL_ZNODE_ACL should have been 356 * removed 357 */ 358 VERIFY(zp->z_is_sa && error == ENOENT); 359 return (0); 360 } 361 } 362 363 /* 364 * Determine size of ACL in bytes 365 * 366 * This is more complicated than it should be since we have to deal 367 * with old external ACLs. 368 */ 369 static int 370 zfs_acl_znode_info(znode_t *zp, int *aclsize, int *aclcount, 371 zfs_acl_phys_t *aclphys) 372 { 373 zfsvfs_t *zfsvfs = ZTOZSB(zp); 374 uint64_t acl_count; 375 int size; 376 int error; 377 378 ASSERT(MUTEX_HELD(&zp->z_acl_lock)); 379 if (zp->z_is_sa) { 380 if ((error = sa_size(zp->z_sa_hdl, SA_ZPL_DACL_ACES(zfsvfs), 381 &size)) != 0) 382 return (error); 383 *aclsize = size; 384 if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_DACL_COUNT(zfsvfs), 385 &acl_count, sizeof (acl_count))) != 0) 386 return (error); 387 *aclcount = acl_count; 388 } else { 389 if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_ZNODE_ACL(zfsvfs), 390 aclphys, sizeof (*aclphys))) != 0) 391 return (error); 392 393 if (aclphys->z_acl_version == ZFS_ACL_VERSION_INITIAL) { 394 *aclsize = ZFS_ACL_SIZE(aclphys->z_acl_size); 395 *aclcount = aclphys->z_acl_size; 396 } else { 397 *aclsize = aclphys->z_acl_size; 398 *aclcount = aclphys->z_acl_count; 399 } 400 } 401 return (0); 402 } 403 404 int 405 zfs_znode_acl_version(znode_t *zp) 406 { 407 zfs_acl_phys_t acl_phys; 408 409 if (zp->z_is_sa) 410 return (ZFS_ACL_VERSION_FUID); 411 else { 412 int error; 413 414 /* 415 * Need to deal with a potential 416 * race where zfs_sa_upgrade could cause 417 * z_isa_sa to change. 418 * 419 * If the lookup fails then the state of z_is_sa should have 420 * changed. 421 */ 422 if ((error = sa_lookup(zp->z_sa_hdl, 423 SA_ZPL_ZNODE_ACL(ZTOZSB(zp)), 424 &acl_phys, sizeof (acl_phys))) == 0) 425 return (acl_phys.z_acl_version); 426 else { 427 /* 428 * After upgrade SA_ZPL_ZNODE_ACL should have 429 * been removed. 430 */ 431 VERIFY(zp->z_is_sa && error == ENOENT); 432 return (ZFS_ACL_VERSION_FUID); 433 } 434 } 435 } 436 437 static int 438 zfs_acl_version(int version) 439 { 440 if (version < ZPL_VERSION_FUID) 441 return (ZFS_ACL_VERSION_INITIAL); 442 else 443 return (ZFS_ACL_VERSION_FUID); 444 } 445 446 static int 447 zfs_acl_version_zp(znode_t *zp) 448 { 449 return (zfs_acl_version(ZTOZSB(zp)->z_version)); 450 } 451 452 zfs_acl_t * 453 zfs_acl_alloc(int vers) 454 { 455 zfs_acl_t *aclp; 456 457 aclp = kmem_zalloc(sizeof (zfs_acl_t), KM_SLEEP); 458 list_create(&aclp->z_acl, sizeof (zfs_acl_node_t), 459 offsetof(zfs_acl_node_t, z_next)); 460 aclp->z_version = vers; 461 if (vers == ZFS_ACL_VERSION_FUID) 462 aclp->z_ops = &zfs_acl_fuid_ops; 463 else 464 aclp->z_ops = &zfs_acl_v0_ops; 465 return (aclp); 466 } 467 468 zfs_acl_node_t * 469 zfs_acl_node_alloc(size_t bytes) 470 { 471 zfs_acl_node_t *aclnode; 472 473 aclnode = kmem_zalloc(sizeof (zfs_acl_node_t), KM_SLEEP); 474 if (bytes) { 475 aclnode->z_acldata = kmem_zalloc(bytes, KM_SLEEP); 476 aclnode->z_allocdata = aclnode->z_acldata; 477 aclnode->z_allocsize = bytes; 478 aclnode->z_size = bytes; 479 } 480 481 return (aclnode); 482 } 483 484 static void 485 zfs_acl_node_free(zfs_acl_node_t *aclnode) 486 { 487 if (aclnode->z_allocsize) 488 kmem_free(aclnode->z_allocdata, aclnode->z_allocsize); 489 kmem_free(aclnode, sizeof (zfs_acl_node_t)); 490 } 491 492 static void 493 zfs_acl_release_nodes(zfs_acl_t *aclp) 494 { 495 zfs_acl_node_t *aclnode; 496 497 while ((aclnode = list_remove_head(&aclp->z_acl))) 498 zfs_acl_node_free(aclnode); 499 aclp->z_acl_count = 0; 500 aclp->z_acl_bytes = 0; 501 } 502 503 void 504 zfs_acl_free(zfs_acl_t *aclp) 505 { 506 zfs_acl_release_nodes(aclp); 507 list_destroy(&aclp->z_acl); 508 kmem_free(aclp, sizeof (zfs_acl_t)); 509 } 510 511 static boolean_t 512 zfs_acl_valid_ace_type(uint_t type, uint_t flags) 513 { 514 uint16_t entry_type; 515 516 switch (type) { 517 case ALLOW: 518 case DENY: 519 case ACE_SYSTEM_AUDIT_ACE_TYPE: 520 case ACE_SYSTEM_ALARM_ACE_TYPE: 521 entry_type = flags & ACE_TYPE_FLAGS; 522 return (entry_type == ACE_OWNER || 523 entry_type == OWNING_GROUP || 524 entry_type == ACE_EVERYONE || entry_type == 0 || 525 entry_type == ACE_IDENTIFIER_GROUP); 526 default: 527 if (type <= MAX_ACE_TYPE) 528 return (B_TRUE); 529 } 530 return (B_FALSE); 531 } 532 533 static boolean_t 534 zfs_ace_valid(umode_t obj_mode, zfs_acl_t *aclp, uint16_t type, uint16_t iflags) 535 { 536 /* 537 * first check type of entry 538 */ 539 540 if (!zfs_acl_valid_ace_type(type, iflags)) 541 return (B_FALSE); 542 543 switch (type) { 544 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 545 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 546 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 547 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 548 if (aclp->z_version < ZFS_ACL_VERSION_FUID) 549 return (B_FALSE); 550 aclp->z_hints |= ZFS_ACL_OBJ_ACE; 551 } 552 553 /* 554 * next check inheritance level flags 555 */ 556 557 if (S_ISDIR(obj_mode) && 558 (iflags & (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE))) 559 aclp->z_hints |= ZFS_INHERIT_ACE; 560 561 if (iflags & (ACE_INHERIT_ONLY_ACE|ACE_NO_PROPAGATE_INHERIT_ACE)) { 562 if ((iflags & (ACE_FILE_INHERIT_ACE| 563 ACE_DIRECTORY_INHERIT_ACE)) == 0) { 564 return (B_FALSE); 565 } 566 } 567 568 return (B_TRUE); 569 } 570 571 static void * 572 zfs_acl_next_ace(zfs_acl_t *aclp, void *start, uint64_t *who, 573 uint32_t *access_mask, uint16_t *iflags, uint16_t *type) 574 { 575 zfs_acl_node_t *aclnode; 576 577 ASSERT(aclp); 578 579 if (start == NULL) { 580 aclnode = list_head(&aclp->z_acl); 581 if (aclnode == NULL) 582 return (NULL); 583 584 aclp->z_next_ace = aclnode->z_acldata; 585 aclp->z_curr_node = aclnode; 586 aclnode->z_ace_idx = 0; 587 } 588 589 aclnode = aclp->z_curr_node; 590 591 if (aclnode == NULL) 592 return (NULL); 593 594 if (aclnode->z_ace_idx >= aclnode->z_ace_count) { 595 aclnode = list_next(&aclp->z_acl, aclnode); 596 if (aclnode == NULL) 597 return (NULL); 598 else { 599 aclp->z_curr_node = aclnode; 600 aclnode->z_ace_idx = 0; 601 aclp->z_next_ace = aclnode->z_acldata; 602 } 603 } 604 605 if (aclnode->z_ace_idx < aclnode->z_ace_count) { 606 void *acep = aclp->z_next_ace; 607 size_t ace_size; 608 609 /* 610 * Make sure we don't overstep our bounds 611 */ 612 ace_size = aclp->z_ops->ace_size(acep); 613 614 if (((caddr_t)acep + ace_size) > 615 ((caddr_t)aclnode->z_acldata + aclnode->z_size)) { 616 return (NULL); 617 } 618 619 *iflags = aclp->z_ops->ace_flags_get(acep); 620 *type = aclp->z_ops->ace_type_get(acep); 621 *access_mask = aclp->z_ops->ace_mask_get(acep); 622 *who = aclp->z_ops->ace_who_get(acep); 623 aclp->z_next_ace = (caddr_t)aclp->z_next_ace + ace_size; 624 aclnode->z_ace_idx++; 625 626 return ((void *)acep); 627 } 628 return (NULL); 629 } 630 631 static uintptr_t 632 zfs_ace_walk(void *datap, uintptr_t cookie, int aclcnt, 633 uint16_t *flags, uint16_t *type, uint32_t *mask) 634 { 635 (void) aclcnt; 636 zfs_acl_t *aclp = datap; 637 zfs_ace_hdr_t *acep = (zfs_ace_hdr_t *)cookie; 638 uint64_t who; 639 640 acep = zfs_acl_next_ace(aclp, acep, &who, mask, 641 flags, type); 642 return ((uintptr_t)acep); 643 } 644 645 /* 646 * Copy ACE to internal ZFS format. 647 * While processing the ACL each ACE will be validated for correctness. 648 * ACE FUIDs will be created later. 649 */ 650 static int 651 zfs_copy_ace_2_fuid(zfsvfs_t *zfsvfs, umode_t obj_mode, zfs_acl_t *aclp, 652 void *datap, zfs_ace_t *z_acl, uint64_t aclcnt, size_t *size, 653 zfs_fuid_info_t **fuidp, cred_t *cr) 654 { 655 int i; 656 uint16_t entry_type; 657 zfs_ace_t *aceptr = z_acl; 658 ace_t *acep = datap; 659 zfs_object_ace_t *zobjacep; 660 ace_object_t *aceobjp; 661 662 for (i = 0; i != aclcnt; i++) { 663 aceptr->z_hdr.z_access_mask = acep->a_access_mask; 664 aceptr->z_hdr.z_flags = acep->a_flags; 665 aceptr->z_hdr.z_type = acep->a_type; 666 entry_type = aceptr->z_hdr.z_flags & ACE_TYPE_FLAGS; 667 if (entry_type != ACE_OWNER && entry_type != OWNING_GROUP && 668 entry_type != ACE_EVERYONE) { 669 aceptr->z_fuid = zfs_fuid_create(zfsvfs, acep->a_who, 670 cr, (entry_type == 0) ? 671 ZFS_ACE_USER : ZFS_ACE_GROUP, fuidp); 672 } 673 674 /* 675 * Make sure ACE is valid 676 */ 677 if (zfs_ace_valid(obj_mode, aclp, aceptr->z_hdr.z_type, 678 aceptr->z_hdr.z_flags) != B_TRUE) 679 return (SET_ERROR(EINVAL)); 680 681 switch (acep->a_type) { 682 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 683 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 684 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 685 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 686 zobjacep = (zfs_object_ace_t *)aceptr; 687 aceobjp = (ace_object_t *)acep; 688 689 memcpy(zobjacep->z_object_type, aceobjp->a_obj_type, 690 sizeof (aceobjp->a_obj_type)); 691 memcpy(zobjacep->z_inherit_type, 692 aceobjp->a_inherit_obj_type, 693 sizeof (aceobjp->a_inherit_obj_type)); 694 acep = (ace_t *)((caddr_t)acep + sizeof (ace_object_t)); 695 break; 696 default: 697 acep = (ace_t *)((caddr_t)acep + sizeof (ace_t)); 698 } 699 700 aceptr = (zfs_ace_t *)((caddr_t)aceptr + 701 aclp->z_ops->ace_size(aceptr)); 702 } 703 704 *size = (caddr_t)aceptr - (caddr_t)z_acl; 705 706 return (0); 707 } 708 709 /* 710 * Copy ZFS ACEs to fixed size ace_t layout 711 */ 712 static void 713 zfs_copy_fuid_2_ace(zfsvfs_t *zfsvfs, zfs_acl_t *aclp, cred_t *cr, 714 void *datap, int filter) 715 { 716 uint64_t who; 717 uint32_t access_mask; 718 uint16_t iflags, type; 719 zfs_ace_hdr_t *zacep = NULL; 720 ace_t *acep = datap; 721 ace_object_t *objacep; 722 zfs_object_ace_t *zobjacep; 723 size_t ace_size; 724 uint16_t entry_type; 725 726 while ((zacep = zfs_acl_next_ace(aclp, zacep, 727 &who, &access_mask, &iflags, &type))) { 728 729 switch (type) { 730 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 731 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 732 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 733 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 734 if (filter) { 735 continue; 736 } 737 zobjacep = (zfs_object_ace_t *)zacep; 738 objacep = (ace_object_t *)acep; 739 memcpy(objacep->a_obj_type, 740 zobjacep->z_object_type, 741 sizeof (zobjacep->z_object_type)); 742 memcpy(objacep->a_inherit_obj_type, 743 zobjacep->z_inherit_type, 744 sizeof (zobjacep->z_inherit_type)); 745 ace_size = sizeof (ace_object_t); 746 break; 747 default: 748 ace_size = sizeof (ace_t); 749 break; 750 } 751 752 entry_type = (iflags & ACE_TYPE_FLAGS); 753 if ((entry_type != ACE_OWNER && 754 entry_type != OWNING_GROUP && 755 entry_type != ACE_EVERYONE)) { 756 acep->a_who = zfs_fuid_map_id(zfsvfs, who, 757 cr, (entry_type & ACE_IDENTIFIER_GROUP) ? 758 ZFS_ACE_GROUP : ZFS_ACE_USER); 759 } else { 760 acep->a_who = (uid_t)(int64_t)who; 761 } 762 acep->a_access_mask = access_mask; 763 acep->a_flags = iflags; 764 acep->a_type = type; 765 acep = (ace_t *)((caddr_t)acep + ace_size); 766 } 767 } 768 769 static int 770 zfs_copy_ace_2_oldace(umode_t obj_mode, zfs_acl_t *aclp, ace_t *acep, 771 zfs_oldace_t *z_acl, int aclcnt, size_t *size) 772 { 773 int i; 774 zfs_oldace_t *aceptr = z_acl; 775 776 for (i = 0; i != aclcnt; i++, aceptr++) { 777 aceptr->z_access_mask = acep[i].a_access_mask; 778 aceptr->z_type = acep[i].a_type; 779 aceptr->z_flags = acep[i].a_flags; 780 aceptr->z_fuid = acep[i].a_who; 781 /* 782 * Make sure ACE is valid 783 */ 784 if (zfs_ace_valid(obj_mode, aclp, aceptr->z_type, 785 aceptr->z_flags) != B_TRUE) 786 return (SET_ERROR(EINVAL)); 787 } 788 *size = (caddr_t)aceptr - (caddr_t)z_acl; 789 return (0); 790 } 791 792 /* 793 * convert old ACL format to new 794 */ 795 void 796 zfs_acl_xform(znode_t *zp, zfs_acl_t *aclp, cred_t *cr) 797 { 798 zfs_oldace_t *oldaclp; 799 int i; 800 uint16_t type, iflags; 801 uint32_t access_mask; 802 uint64_t who; 803 void *cookie = NULL; 804 zfs_acl_node_t *newaclnode; 805 806 ASSERT(aclp->z_version == ZFS_ACL_VERSION_INITIAL); 807 /* 808 * First create the ACE in a contiguous piece of memory 809 * for zfs_copy_ace_2_fuid(). 810 * 811 * We only convert an ACL once, so this won't happen 812 * every time. 813 */ 814 oldaclp = kmem_alloc(sizeof (zfs_oldace_t) * aclp->z_acl_count, 815 KM_SLEEP); 816 i = 0; 817 while ((cookie = zfs_acl_next_ace(aclp, cookie, &who, 818 &access_mask, &iflags, &type))) { 819 oldaclp[i].z_flags = iflags; 820 oldaclp[i].z_type = type; 821 oldaclp[i].z_fuid = who; 822 oldaclp[i++].z_access_mask = access_mask; 823 } 824 825 newaclnode = zfs_acl_node_alloc(aclp->z_acl_count * 826 sizeof (zfs_object_ace_t)); 827 aclp->z_ops = &zfs_acl_fuid_ops; 828 VERIFY(zfs_copy_ace_2_fuid(ZTOZSB(zp), ZTOI(zp)->i_mode, 829 aclp, oldaclp, newaclnode->z_acldata, aclp->z_acl_count, 830 &newaclnode->z_size, NULL, cr) == 0); 831 newaclnode->z_ace_count = aclp->z_acl_count; 832 aclp->z_version = ZFS_ACL_VERSION; 833 kmem_free(oldaclp, aclp->z_acl_count * sizeof (zfs_oldace_t)); 834 835 /* 836 * Release all previous ACL nodes 837 */ 838 839 zfs_acl_release_nodes(aclp); 840 841 list_insert_head(&aclp->z_acl, newaclnode); 842 843 aclp->z_acl_bytes = newaclnode->z_size; 844 aclp->z_acl_count = newaclnode->z_ace_count; 845 846 } 847 848 /* 849 * Convert unix access mask to v4 access mask 850 */ 851 static uint32_t 852 zfs_unix_to_v4(uint32_t access_mask) 853 { 854 uint32_t new_mask = 0; 855 856 if (access_mask & S_IXOTH) 857 new_mask |= ACE_EXECUTE; 858 if (access_mask & S_IWOTH) 859 new_mask |= ACE_WRITE_DATA; 860 if (access_mask & S_IROTH) 861 new_mask |= ACE_READ_DATA; 862 return (new_mask); 863 } 864 865 866 static int 867 zfs_v4_to_unix(uint32_t access_mask, int *unmapped) 868 { 869 int new_mask = 0; 870 871 *unmapped = access_mask & 872 (ACE_WRITE_OWNER | ACE_WRITE_ACL | ACE_DELETE); 873 874 if (access_mask & WRITE_MASK) 875 new_mask |= S_IWOTH; 876 if (access_mask & ACE_READ_DATA) 877 new_mask |= S_IROTH; 878 if (access_mask & ACE_EXECUTE) 879 new_mask |= S_IXOTH; 880 881 return (new_mask); 882 } 883 884 885 static void 886 zfs_set_ace(zfs_acl_t *aclp, void *acep, uint32_t access_mask, 887 uint16_t access_type, uint64_t fuid, uint16_t entry_type) 888 { 889 uint16_t type = entry_type & ACE_TYPE_FLAGS; 890 891 aclp->z_ops->ace_mask_set(acep, access_mask); 892 aclp->z_ops->ace_type_set(acep, access_type); 893 aclp->z_ops->ace_flags_set(acep, entry_type); 894 if ((type != ACE_OWNER && type != OWNING_GROUP && 895 type != ACE_EVERYONE)) 896 aclp->z_ops->ace_who_set(acep, fuid); 897 } 898 899 /* 900 * Determine mode of file based on ACL. 901 */ 902 uint64_t 903 zfs_mode_compute(uint64_t fmode, zfs_acl_t *aclp, 904 uint64_t *pflags, uint64_t fuid, uint64_t fgid) 905 { 906 int entry_type; 907 mode_t mode; 908 mode_t seen = 0; 909 zfs_ace_hdr_t *acep = NULL; 910 uint64_t who; 911 uint16_t iflags, type; 912 uint32_t access_mask; 913 boolean_t an_exec_denied = B_FALSE; 914 915 mode = (fmode & (S_IFMT | S_ISUID | S_ISGID | S_ISVTX)); 916 917 while ((acep = zfs_acl_next_ace(aclp, acep, &who, 918 &access_mask, &iflags, &type))) { 919 920 if (!zfs_acl_valid_ace_type(type, iflags)) 921 continue; 922 923 entry_type = (iflags & ACE_TYPE_FLAGS); 924 925 /* 926 * Skip over any inherit_only ACEs 927 */ 928 if (iflags & ACE_INHERIT_ONLY_ACE) 929 continue; 930 931 if (entry_type == ACE_OWNER || (entry_type == 0 && 932 who == fuid)) { 933 if ((access_mask & ACE_READ_DATA) && 934 (!(seen & S_IRUSR))) { 935 seen |= S_IRUSR; 936 if (type == ALLOW) { 937 mode |= S_IRUSR; 938 } 939 } 940 if ((access_mask & ACE_WRITE_DATA) && 941 (!(seen & S_IWUSR))) { 942 seen |= S_IWUSR; 943 if (type == ALLOW) { 944 mode |= S_IWUSR; 945 } 946 } 947 if ((access_mask & ACE_EXECUTE) && 948 (!(seen & S_IXUSR))) { 949 seen |= S_IXUSR; 950 if (type == ALLOW) { 951 mode |= S_IXUSR; 952 } 953 } 954 } else if (entry_type == OWNING_GROUP || 955 (entry_type == ACE_IDENTIFIER_GROUP && who == fgid)) { 956 if ((access_mask & ACE_READ_DATA) && 957 (!(seen & S_IRGRP))) { 958 seen |= S_IRGRP; 959 if (type == ALLOW) { 960 mode |= S_IRGRP; 961 } 962 } 963 if ((access_mask & ACE_WRITE_DATA) && 964 (!(seen & S_IWGRP))) { 965 seen |= S_IWGRP; 966 if (type == ALLOW) { 967 mode |= S_IWGRP; 968 } 969 } 970 if ((access_mask & ACE_EXECUTE) && 971 (!(seen & S_IXGRP))) { 972 seen |= S_IXGRP; 973 if (type == ALLOW) { 974 mode |= S_IXGRP; 975 } 976 } 977 } else if (entry_type == ACE_EVERYONE) { 978 if ((access_mask & ACE_READ_DATA)) { 979 if (!(seen & S_IRUSR)) { 980 seen |= S_IRUSR; 981 if (type == ALLOW) { 982 mode |= S_IRUSR; 983 } 984 } 985 if (!(seen & S_IRGRP)) { 986 seen |= S_IRGRP; 987 if (type == ALLOW) { 988 mode |= S_IRGRP; 989 } 990 } 991 if (!(seen & S_IROTH)) { 992 seen |= S_IROTH; 993 if (type == ALLOW) { 994 mode |= S_IROTH; 995 } 996 } 997 } 998 if ((access_mask & ACE_WRITE_DATA)) { 999 if (!(seen & S_IWUSR)) { 1000 seen |= S_IWUSR; 1001 if (type == ALLOW) { 1002 mode |= S_IWUSR; 1003 } 1004 } 1005 if (!(seen & S_IWGRP)) { 1006 seen |= S_IWGRP; 1007 if (type == ALLOW) { 1008 mode |= S_IWGRP; 1009 } 1010 } 1011 if (!(seen & S_IWOTH)) { 1012 seen |= S_IWOTH; 1013 if (type == ALLOW) { 1014 mode |= S_IWOTH; 1015 } 1016 } 1017 } 1018 if ((access_mask & ACE_EXECUTE)) { 1019 if (!(seen & S_IXUSR)) { 1020 seen |= S_IXUSR; 1021 if (type == ALLOW) { 1022 mode |= S_IXUSR; 1023 } 1024 } 1025 if (!(seen & S_IXGRP)) { 1026 seen |= S_IXGRP; 1027 if (type == ALLOW) { 1028 mode |= S_IXGRP; 1029 } 1030 } 1031 if (!(seen & S_IXOTH)) { 1032 seen |= S_IXOTH; 1033 if (type == ALLOW) { 1034 mode |= S_IXOTH; 1035 } 1036 } 1037 } 1038 } else { 1039 /* 1040 * Only care if this IDENTIFIER_GROUP or 1041 * USER ACE denies execute access to someone, 1042 * mode is not affected 1043 */ 1044 if ((access_mask & ACE_EXECUTE) && type == DENY) 1045 an_exec_denied = B_TRUE; 1046 } 1047 } 1048 1049 /* 1050 * Failure to allow is effectively a deny, so execute permission 1051 * is denied if it was never mentioned or if we explicitly 1052 * weren't allowed it. 1053 */ 1054 if (!an_exec_denied && 1055 ((seen & ALL_MODE_EXECS) != ALL_MODE_EXECS || 1056 (mode & ALL_MODE_EXECS) != ALL_MODE_EXECS)) 1057 an_exec_denied = B_TRUE; 1058 1059 if (an_exec_denied) 1060 *pflags &= ~ZFS_NO_EXECS_DENIED; 1061 else 1062 *pflags |= ZFS_NO_EXECS_DENIED; 1063 1064 return (mode); 1065 } 1066 1067 /* 1068 * Read an external acl object. If the intent is to modify, always 1069 * create a new acl and leave any cached acl in place. 1070 */ 1071 int 1072 zfs_acl_node_read(struct znode *zp, boolean_t have_lock, zfs_acl_t **aclpp, 1073 boolean_t will_modify) 1074 { 1075 zfs_acl_t *aclp; 1076 int aclsize = 0; 1077 int acl_count = 0; 1078 zfs_acl_node_t *aclnode; 1079 zfs_acl_phys_t znode_acl; 1080 int version; 1081 int error; 1082 boolean_t drop_lock = B_FALSE; 1083 1084 ASSERT(MUTEX_HELD(&zp->z_acl_lock)); 1085 1086 if (zp->z_acl_cached && !will_modify) { 1087 *aclpp = zp->z_acl_cached; 1088 return (0); 1089 } 1090 1091 /* 1092 * close race where znode could be upgrade while trying to 1093 * read the znode attributes. 1094 * 1095 * But this could only happen if the file isn't already an SA 1096 * znode 1097 */ 1098 if (!zp->z_is_sa && !have_lock) { 1099 mutex_enter(&zp->z_lock); 1100 drop_lock = B_TRUE; 1101 } 1102 version = zfs_znode_acl_version(zp); 1103 1104 if ((error = zfs_acl_znode_info(zp, &aclsize, 1105 &acl_count, &znode_acl)) != 0) { 1106 goto done; 1107 } 1108 1109 aclp = zfs_acl_alloc(version); 1110 1111 aclp->z_acl_count = acl_count; 1112 aclp->z_acl_bytes = aclsize; 1113 1114 aclnode = zfs_acl_node_alloc(aclsize); 1115 aclnode->z_ace_count = aclp->z_acl_count; 1116 aclnode->z_size = aclsize; 1117 1118 if (!zp->z_is_sa) { 1119 if (znode_acl.z_acl_extern_obj) { 1120 error = dmu_read(ZTOZSB(zp)->z_os, 1121 znode_acl.z_acl_extern_obj, 0, aclnode->z_size, 1122 aclnode->z_acldata, DMU_READ_PREFETCH); 1123 } else { 1124 memcpy(aclnode->z_acldata, znode_acl.z_ace_data, 1125 aclnode->z_size); 1126 } 1127 } else { 1128 error = sa_lookup(zp->z_sa_hdl, SA_ZPL_DACL_ACES(ZTOZSB(zp)), 1129 aclnode->z_acldata, aclnode->z_size); 1130 } 1131 1132 if (error != 0) { 1133 zfs_acl_free(aclp); 1134 zfs_acl_node_free(aclnode); 1135 /* convert checksum errors into IO errors */ 1136 if (error == ECKSUM) 1137 error = SET_ERROR(EIO); 1138 goto done; 1139 } 1140 1141 list_insert_head(&aclp->z_acl, aclnode); 1142 1143 *aclpp = aclp; 1144 if (!will_modify) 1145 zp->z_acl_cached = aclp; 1146 done: 1147 if (drop_lock) 1148 mutex_exit(&zp->z_lock); 1149 return (error); 1150 } 1151 1152 void 1153 zfs_acl_data_locator(void **dataptr, uint32_t *length, uint32_t buflen, 1154 boolean_t start, void *userdata) 1155 { 1156 (void) buflen; 1157 zfs_acl_locator_cb_t *cb = (zfs_acl_locator_cb_t *)userdata; 1158 1159 if (start) { 1160 cb->cb_acl_node = list_head(&cb->cb_aclp->z_acl); 1161 } else { 1162 cb->cb_acl_node = list_next(&cb->cb_aclp->z_acl, 1163 cb->cb_acl_node); 1164 } 1165 ASSERT3P(cb->cb_acl_node, !=, NULL); 1166 *dataptr = cb->cb_acl_node->z_acldata; 1167 *length = cb->cb_acl_node->z_size; 1168 } 1169 1170 int 1171 zfs_acl_chown_setattr(znode_t *zp) 1172 { 1173 int error; 1174 zfs_acl_t *aclp; 1175 1176 if (ZTOZSB(zp)->z_acl_type == ZFS_ACLTYPE_POSIX) 1177 return (0); 1178 1179 ASSERT(MUTEX_HELD(&zp->z_lock)); 1180 ASSERT(MUTEX_HELD(&zp->z_acl_lock)); 1181 1182 error = zfs_acl_node_read(zp, B_TRUE, &aclp, B_FALSE); 1183 if (error == 0 && aclp->z_acl_count > 0) 1184 zp->z_mode = ZTOI(zp)->i_mode = 1185 zfs_mode_compute(zp->z_mode, aclp, 1186 &zp->z_pflags, KUID_TO_SUID(ZTOI(zp)->i_uid), 1187 KGID_TO_SGID(ZTOI(zp)->i_gid)); 1188 1189 /* 1190 * Some ZFS implementations (ZEVO) create neither a ZNODE_ACL 1191 * nor a DACL_ACES SA in which case ENOENT is returned from 1192 * zfs_acl_node_read() when the SA can't be located. 1193 * Allow chown/chgrp to succeed in these cases rather than 1194 * returning an error that makes no sense in the context of 1195 * the caller. 1196 */ 1197 if (error == ENOENT) 1198 return (0); 1199 1200 return (error); 1201 } 1202 1203 typedef struct trivial_acl { 1204 uint32_t allow0; /* allow mask for bits only in owner */ 1205 uint32_t deny1; /* deny mask for bits not in owner */ 1206 uint32_t deny2; /* deny mask for bits not in group */ 1207 uint32_t owner; /* allow mask matching mode */ 1208 uint32_t group; /* allow mask matching mode */ 1209 uint32_t everyone; /* allow mask matching mode */ 1210 } trivial_acl_t; 1211 1212 static void 1213 acl_trivial_access_masks(mode_t mode, boolean_t isdir, trivial_acl_t *masks) 1214 { 1215 uint32_t read_mask = ACE_READ_DATA; 1216 uint32_t write_mask = ACE_WRITE_DATA|ACE_APPEND_DATA; 1217 uint32_t execute_mask = ACE_EXECUTE; 1218 1219 if (isdir) 1220 write_mask |= ACE_DELETE_CHILD; 1221 1222 masks->deny1 = 0; 1223 1224 if (!(mode & S_IRUSR) && (mode & (S_IRGRP|S_IROTH))) 1225 masks->deny1 |= read_mask; 1226 if (!(mode & S_IWUSR) && (mode & (S_IWGRP|S_IWOTH))) 1227 masks->deny1 |= write_mask; 1228 if (!(mode & S_IXUSR) && (mode & (S_IXGRP|S_IXOTH))) 1229 masks->deny1 |= execute_mask; 1230 1231 masks->deny2 = 0; 1232 if (!(mode & S_IRGRP) && (mode & S_IROTH)) 1233 masks->deny2 |= read_mask; 1234 if (!(mode & S_IWGRP) && (mode & S_IWOTH)) 1235 masks->deny2 |= write_mask; 1236 if (!(mode & S_IXGRP) && (mode & S_IXOTH)) 1237 masks->deny2 |= execute_mask; 1238 1239 masks->allow0 = 0; 1240 if ((mode & S_IRUSR) && (!(mode & S_IRGRP) && (mode & S_IROTH))) 1241 masks->allow0 |= read_mask; 1242 if ((mode & S_IWUSR) && (!(mode & S_IWGRP) && (mode & S_IWOTH))) 1243 masks->allow0 |= write_mask; 1244 if ((mode & S_IXUSR) && (!(mode & S_IXGRP) && (mode & S_IXOTH))) 1245 masks->allow0 |= execute_mask; 1246 1247 masks->owner = ACE_WRITE_ATTRIBUTES|ACE_WRITE_OWNER|ACE_WRITE_ACL| 1248 ACE_WRITE_NAMED_ATTRS|ACE_READ_ACL|ACE_READ_ATTRIBUTES| 1249 ACE_READ_NAMED_ATTRS|ACE_SYNCHRONIZE; 1250 if (mode & S_IRUSR) 1251 masks->owner |= read_mask; 1252 if (mode & S_IWUSR) 1253 masks->owner |= write_mask; 1254 if (mode & S_IXUSR) 1255 masks->owner |= execute_mask; 1256 1257 masks->group = ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_READ_NAMED_ATTRS| 1258 ACE_SYNCHRONIZE; 1259 if (mode & S_IRGRP) 1260 masks->group |= read_mask; 1261 if (mode & S_IWGRP) 1262 masks->group |= write_mask; 1263 if (mode & S_IXGRP) 1264 masks->group |= execute_mask; 1265 1266 masks->everyone = ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_READ_NAMED_ATTRS| 1267 ACE_SYNCHRONIZE; 1268 if (mode & S_IROTH) 1269 masks->everyone |= read_mask; 1270 if (mode & S_IWOTH) 1271 masks->everyone |= write_mask; 1272 if (mode & S_IXOTH) 1273 masks->everyone |= execute_mask; 1274 } 1275 1276 /* 1277 * ace_trivial: 1278 * determine whether an ace_t acl is trivial 1279 * 1280 * Trivialness implies that the acl is composed of only 1281 * owner, group, everyone entries. ACL can't 1282 * have read_acl denied, and write_owner/write_acl/write_attributes 1283 * can only be owner@ entry. 1284 */ 1285 static int 1286 ace_trivial_common(void *acep, int aclcnt, 1287 uintptr_t (*walk)(void *, uintptr_t, int, 1288 uint16_t *, uint16_t *, uint32_t *)) 1289 { 1290 uint16_t flags; 1291 uint32_t mask; 1292 uint16_t type; 1293 uint64_t cookie = 0; 1294 1295 while ((cookie = walk(acep, cookie, aclcnt, &flags, &type, &mask))) { 1296 switch (flags & ACE_TYPE_FLAGS) { 1297 case ACE_OWNER: 1298 case ACE_GROUP|ACE_IDENTIFIER_GROUP: 1299 case ACE_EVERYONE: 1300 break; 1301 default: 1302 return (1); 1303 } 1304 1305 if (flags & (ACE_FILE_INHERIT_ACE| 1306 ACE_DIRECTORY_INHERIT_ACE|ACE_NO_PROPAGATE_INHERIT_ACE| 1307 ACE_INHERIT_ONLY_ACE)) 1308 return (1); 1309 1310 /* 1311 * Special check for some special bits 1312 * 1313 * Don't allow anybody to deny reading basic 1314 * attributes or a files ACL. 1315 */ 1316 if ((mask & (ACE_READ_ACL|ACE_READ_ATTRIBUTES)) && 1317 (type == ACE_ACCESS_DENIED_ACE_TYPE)) 1318 return (1); 1319 1320 /* 1321 * Delete permission is never set by default 1322 */ 1323 if (mask & ACE_DELETE) 1324 return (1); 1325 1326 /* 1327 * Child delete permission should be accompanied by write 1328 */ 1329 if ((mask & ACE_DELETE_CHILD) && !(mask & ACE_WRITE_DATA)) 1330 return (1); 1331 1332 /* 1333 * only allow owner@ to have 1334 * write_acl/write_owner/write_attributes/write_xattr/ 1335 */ 1336 if (type == ACE_ACCESS_ALLOWED_ACE_TYPE && 1337 (!(flags & ACE_OWNER) && (mask & 1338 (ACE_WRITE_OWNER|ACE_WRITE_ACL| ACE_WRITE_ATTRIBUTES| 1339 ACE_WRITE_NAMED_ATTRS)))) 1340 return (1); 1341 1342 } 1343 1344 return (0); 1345 } 1346 1347 /* 1348 * common code for setting ACLs. 1349 * 1350 * This function is called from zfs_mode_update, zfs_perm_init, and zfs_setacl. 1351 * zfs_setacl passes a non-NULL inherit pointer (ihp) to indicate that it's 1352 * already checked the acl and knows whether to inherit. 1353 */ 1354 int 1355 zfs_aclset_common(znode_t *zp, zfs_acl_t *aclp, cred_t *cr, dmu_tx_t *tx) 1356 { 1357 int error; 1358 zfsvfs_t *zfsvfs = ZTOZSB(zp); 1359 dmu_object_type_t otype; 1360 zfs_acl_locator_cb_t locate = { 0 }; 1361 uint64_t mode; 1362 sa_bulk_attr_t bulk[5]; 1363 uint64_t ctime[2]; 1364 int count = 0; 1365 zfs_acl_phys_t acl_phys; 1366 1367 mode = zp->z_mode; 1368 1369 mode = zfs_mode_compute(mode, aclp, &zp->z_pflags, 1370 KUID_TO_SUID(ZTOI(zp)->i_uid), KGID_TO_SGID(ZTOI(zp)->i_gid)); 1371 1372 zp->z_mode = ZTOI(zp)->i_mode = mode; 1373 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_MODE(zfsvfs), NULL, 1374 &mode, sizeof (mode)); 1375 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_FLAGS(zfsvfs), NULL, 1376 &zp->z_pflags, sizeof (zp->z_pflags)); 1377 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_CTIME(zfsvfs), NULL, 1378 &ctime, sizeof (ctime)); 1379 1380 if (zp->z_acl_cached) { 1381 zfs_acl_free(zp->z_acl_cached); 1382 zp->z_acl_cached = NULL; 1383 } 1384 1385 /* 1386 * Upgrade needed? 1387 */ 1388 if (!zfsvfs->z_use_fuids) { 1389 otype = DMU_OT_OLDACL; 1390 } else { 1391 if ((aclp->z_version == ZFS_ACL_VERSION_INITIAL) && 1392 (zfsvfs->z_version >= ZPL_VERSION_FUID)) 1393 zfs_acl_xform(zp, aclp, cr); 1394 ASSERT(aclp->z_version >= ZFS_ACL_VERSION_FUID); 1395 otype = DMU_OT_ACL; 1396 } 1397 1398 /* 1399 * Arrgh, we have to handle old on disk format 1400 * as well as newer (preferred) SA format. 1401 */ 1402 1403 if (zp->z_is_sa) { /* the easy case, just update the ACL attribute */ 1404 locate.cb_aclp = aclp; 1405 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_DACL_ACES(zfsvfs), 1406 zfs_acl_data_locator, &locate, aclp->z_acl_bytes); 1407 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_DACL_COUNT(zfsvfs), 1408 NULL, &aclp->z_acl_count, sizeof (uint64_t)); 1409 } else { /* Painful legacy way */ 1410 zfs_acl_node_t *aclnode; 1411 uint64_t off = 0; 1412 uint64_t aoid; 1413 1414 if ((error = sa_lookup(zp->z_sa_hdl, SA_ZPL_ZNODE_ACL(zfsvfs), 1415 &acl_phys, sizeof (acl_phys))) != 0) 1416 return (error); 1417 1418 aoid = acl_phys.z_acl_extern_obj; 1419 1420 if (aclp->z_acl_bytes > ZFS_ACE_SPACE) { 1421 /* 1422 * If ACL was previously external and we are now 1423 * converting to new ACL format then release old 1424 * ACL object and create a new one. 1425 */ 1426 if (aoid && 1427 aclp->z_version != acl_phys.z_acl_version) { 1428 error = dmu_object_free(zfsvfs->z_os, aoid, tx); 1429 if (error) 1430 return (error); 1431 aoid = 0; 1432 } 1433 if (aoid == 0) { 1434 aoid = dmu_object_alloc(zfsvfs->z_os, 1435 otype, aclp->z_acl_bytes, 1436 otype == DMU_OT_ACL ? 1437 DMU_OT_SYSACL : DMU_OT_NONE, 1438 otype == DMU_OT_ACL ? 1439 DN_OLD_MAX_BONUSLEN : 0, tx); 1440 } else { 1441 (void) dmu_object_set_blocksize(zfsvfs->z_os, 1442 aoid, aclp->z_acl_bytes, 0, tx); 1443 } 1444 acl_phys.z_acl_extern_obj = aoid; 1445 for (aclnode = list_head(&aclp->z_acl); aclnode; 1446 aclnode = list_next(&aclp->z_acl, aclnode)) { 1447 if (aclnode->z_ace_count == 0) 1448 continue; 1449 dmu_write(zfsvfs->z_os, aoid, off, 1450 aclnode->z_size, aclnode->z_acldata, tx, 1451 DMU_READ_NO_PREFETCH); 1452 off += aclnode->z_size; 1453 } 1454 } else { 1455 void *start = acl_phys.z_ace_data; 1456 /* 1457 * Migrating back embedded? 1458 */ 1459 if (acl_phys.z_acl_extern_obj) { 1460 error = dmu_object_free(zfsvfs->z_os, 1461 acl_phys.z_acl_extern_obj, tx); 1462 if (error) 1463 return (error); 1464 acl_phys.z_acl_extern_obj = 0; 1465 } 1466 1467 for (aclnode = list_head(&aclp->z_acl); aclnode; 1468 aclnode = list_next(&aclp->z_acl, aclnode)) { 1469 if (aclnode->z_ace_count == 0) 1470 continue; 1471 memcpy(start, aclnode->z_acldata, 1472 aclnode->z_size); 1473 start = (caddr_t)start + aclnode->z_size; 1474 } 1475 } 1476 /* 1477 * If Old version then swap count/bytes to match old 1478 * layout of znode_acl_phys_t. 1479 */ 1480 if (aclp->z_version == ZFS_ACL_VERSION_INITIAL) { 1481 acl_phys.z_acl_size = aclp->z_acl_count; 1482 acl_phys.z_acl_count = aclp->z_acl_bytes; 1483 } else { 1484 acl_phys.z_acl_size = aclp->z_acl_bytes; 1485 acl_phys.z_acl_count = aclp->z_acl_count; 1486 } 1487 acl_phys.z_acl_version = aclp->z_version; 1488 1489 SA_ADD_BULK_ATTR(bulk, count, SA_ZPL_ZNODE_ACL(zfsvfs), NULL, 1490 &acl_phys, sizeof (acl_phys)); 1491 } 1492 1493 /* 1494 * Replace ACL wide bits, but first clear them. 1495 */ 1496 zp->z_pflags &= ~ZFS_ACL_WIDE_FLAGS; 1497 1498 zp->z_pflags |= aclp->z_hints; 1499 1500 if (ace_trivial_common(aclp, 0, zfs_ace_walk) == 0) 1501 zp->z_pflags |= ZFS_ACL_TRIVIAL; 1502 1503 zfs_tstamp_update_setup(zp, STATE_CHANGED, NULL, ctime); 1504 return (sa_bulk_update(zp->z_sa_hdl, bulk, count, tx)); 1505 } 1506 1507 static void 1508 zfs_acl_chmod(boolean_t isdir, uint64_t mode, boolean_t split, boolean_t trim, 1509 zfs_acl_t *aclp) 1510 { 1511 void *acep = NULL; 1512 uint64_t who; 1513 int new_count, new_bytes; 1514 int ace_size; 1515 int entry_type; 1516 uint16_t iflags, type; 1517 uint32_t access_mask; 1518 zfs_acl_node_t *newnode; 1519 size_t abstract_size = aclp->z_ops->ace_abstract_size(); 1520 void *zacep; 1521 trivial_acl_t masks; 1522 1523 new_count = new_bytes = 0; 1524 1525 acl_trivial_access_masks((mode_t)mode, isdir, &masks); 1526 1527 newnode = zfs_acl_node_alloc((abstract_size * 6) + aclp->z_acl_bytes); 1528 1529 zacep = newnode->z_acldata; 1530 if (masks.allow0) { 1531 zfs_set_ace(aclp, zacep, masks.allow0, ALLOW, -1, ACE_OWNER); 1532 zacep = (void *)((uintptr_t)zacep + abstract_size); 1533 new_count++; 1534 new_bytes += abstract_size; 1535 } 1536 if (masks.deny1) { 1537 zfs_set_ace(aclp, zacep, masks.deny1, DENY, -1, ACE_OWNER); 1538 zacep = (void *)((uintptr_t)zacep + abstract_size); 1539 new_count++; 1540 new_bytes += abstract_size; 1541 } 1542 if (masks.deny2) { 1543 zfs_set_ace(aclp, zacep, masks.deny2, DENY, -1, OWNING_GROUP); 1544 zacep = (void *)((uintptr_t)zacep + abstract_size); 1545 new_count++; 1546 new_bytes += abstract_size; 1547 } 1548 1549 while ((acep = zfs_acl_next_ace(aclp, acep, &who, &access_mask, 1550 &iflags, &type))) { 1551 entry_type = (iflags & ACE_TYPE_FLAGS); 1552 /* 1553 * ACEs used to represent the file mode may be divided 1554 * into an equivalent pair of inherit-only and regular 1555 * ACEs, if they are inheritable. 1556 * Skip regular ACEs, which are replaced by the new mode. 1557 */ 1558 if (split && (entry_type == ACE_OWNER || 1559 entry_type == OWNING_GROUP || 1560 entry_type == ACE_EVERYONE)) { 1561 if (!isdir || !(iflags & 1562 (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE))) 1563 continue; 1564 /* 1565 * We preserve owner@, group@, or @everyone 1566 * permissions, if they are inheritable, by 1567 * copying them to inherit_only ACEs. This 1568 * prevents inheritable permissions from being 1569 * altered along with the file mode. 1570 */ 1571 iflags |= ACE_INHERIT_ONLY_ACE; 1572 } 1573 1574 /* 1575 * If this ACL has any inheritable ACEs, mark that in 1576 * the hints (which are later masked into the pflags) 1577 * so create knows to do inheritance. 1578 */ 1579 if (isdir && (iflags & 1580 (ACE_FILE_INHERIT_ACE|ACE_DIRECTORY_INHERIT_ACE))) 1581 aclp->z_hints |= ZFS_INHERIT_ACE; 1582 1583 if ((type != ALLOW && type != DENY) || 1584 (iflags & ACE_INHERIT_ONLY_ACE)) { 1585 switch (type) { 1586 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 1587 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 1588 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 1589 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 1590 aclp->z_hints |= ZFS_ACL_OBJ_ACE; 1591 break; 1592 } 1593 } else { 1594 /* 1595 * Limit permissions to be no greater than 1596 * group permissions. 1597 * The "aclinherit" and "aclmode" properties 1598 * affect policy for create and chmod(2), 1599 * respectively. 1600 */ 1601 if ((type == ALLOW) && trim) 1602 access_mask &= masks.group; 1603 } 1604 zfs_set_ace(aclp, zacep, access_mask, type, who, iflags); 1605 ace_size = aclp->z_ops->ace_size(acep); 1606 zacep = (void *)((uintptr_t)zacep + ace_size); 1607 new_count++; 1608 new_bytes += ace_size; 1609 } 1610 zfs_set_ace(aclp, zacep, masks.owner, ALLOW, -1, ACE_OWNER); 1611 zacep = (void *)((uintptr_t)zacep + abstract_size); 1612 zfs_set_ace(aclp, zacep, masks.group, ALLOW, -1, OWNING_GROUP); 1613 zacep = (void *)((uintptr_t)zacep + abstract_size); 1614 zfs_set_ace(aclp, zacep, masks.everyone, ALLOW, -1, ACE_EVERYONE); 1615 1616 new_count += 3; 1617 new_bytes += abstract_size * 3; 1618 zfs_acl_release_nodes(aclp); 1619 aclp->z_acl_count = new_count; 1620 aclp->z_acl_bytes = new_bytes; 1621 newnode->z_ace_count = new_count; 1622 newnode->z_size = new_bytes; 1623 list_insert_tail(&aclp->z_acl, newnode); 1624 } 1625 1626 int 1627 zfs_acl_chmod_setattr(znode_t *zp, zfs_acl_t **aclp, uint64_t mode) 1628 { 1629 int error = 0; 1630 1631 mutex_enter(&zp->z_acl_lock); 1632 mutex_enter(&zp->z_lock); 1633 if (ZTOZSB(zp)->z_acl_mode == ZFS_ACL_DISCARD) 1634 *aclp = zfs_acl_alloc(zfs_acl_version_zp(zp)); 1635 else 1636 error = zfs_acl_node_read(zp, B_TRUE, aclp, B_TRUE); 1637 1638 if (error == 0) { 1639 (*aclp)->z_hints = zp->z_pflags & V4_ACL_WIDE_FLAGS; 1640 zfs_acl_chmod(S_ISDIR(ZTOI(zp)->i_mode), mode, B_TRUE, 1641 (ZTOZSB(zp)->z_acl_mode == ZFS_ACL_GROUPMASK), *aclp); 1642 } 1643 mutex_exit(&zp->z_lock); 1644 mutex_exit(&zp->z_acl_lock); 1645 1646 return (error); 1647 } 1648 1649 /* 1650 * Should ACE be inherited? 1651 */ 1652 static int 1653 zfs_ace_can_use(umode_t obj_mode, uint16_t acep_flags) 1654 { 1655 int iflags = (acep_flags & 0xf); 1656 1657 if (S_ISDIR(obj_mode) && (iflags & ACE_DIRECTORY_INHERIT_ACE)) 1658 return (1); 1659 else if (iflags & ACE_FILE_INHERIT_ACE) 1660 return (!(S_ISDIR(obj_mode) && 1661 (iflags & ACE_NO_PROPAGATE_INHERIT_ACE))); 1662 return (0); 1663 } 1664 1665 /* 1666 * inherit inheritable ACEs from parent 1667 */ 1668 static zfs_acl_t * 1669 zfs_acl_inherit(zfsvfs_t *zfsvfs, umode_t va_mode, zfs_acl_t *paclp, 1670 uint64_t mode, boolean_t *need_chmod) 1671 { 1672 void *pacep = NULL; 1673 void *acep; 1674 zfs_acl_node_t *aclnode; 1675 zfs_acl_t *aclp = NULL; 1676 uint64_t who; 1677 uint32_t access_mask; 1678 uint16_t iflags, newflags, type; 1679 size_t ace_size; 1680 void *data1, *data2; 1681 size_t data1sz, data2sz; 1682 uint_t aclinherit; 1683 boolean_t isdir = S_ISDIR(va_mode); 1684 boolean_t isreg = S_ISREG(va_mode); 1685 1686 *need_chmod = B_TRUE; 1687 1688 aclp = zfs_acl_alloc(paclp->z_version); 1689 aclinherit = zfsvfs->z_acl_inherit; 1690 if (aclinherit == ZFS_ACL_DISCARD || S_ISLNK(va_mode)) 1691 return (aclp); 1692 1693 while ((pacep = zfs_acl_next_ace(paclp, pacep, &who, 1694 &access_mask, &iflags, &type))) { 1695 1696 /* 1697 * don't inherit bogus ACEs 1698 */ 1699 if (!zfs_acl_valid_ace_type(type, iflags)) 1700 continue; 1701 1702 /* 1703 * Check if ACE is inheritable by this vnode 1704 */ 1705 if ((aclinherit == ZFS_ACL_NOALLOW && type == ALLOW) || 1706 !zfs_ace_can_use(va_mode, iflags)) 1707 continue; 1708 1709 /* 1710 * If owner@, group@, or everyone@ inheritable 1711 * then zfs_acl_chmod() isn't needed. 1712 */ 1713 if ((aclinherit == ZFS_ACL_PASSTHROUGH || 1714 aclinherit == ZFS_ACL_PASSTHROUGH_X) && 1715 ((iflags & (ACE_OWNER|ACE_EVERYONE)) || 1716 ((iflags & OWNING_GROUP) == OWNING_GROUP)) && 1717 (isreg || (isdir && (iflags & ACE_DIRECTORY_INHERIT_ACE)))) 1718 *need_chmod = B_FALSE; 1719 1720 /* 1721 * Strip inherited execute permission from file if 1722 * not in mode 1723 */ 1724 if (aclinherit == ZFS_ACL_PASSTHROUGH_X && type == ALLOW && 1725 !isdir && ((mode & (S_IXUSR|S_IXGRP|S_IXOTH)) == 0)) { 1726 access_mask &= ~ACE_EXECUTE; 1727 } 1728 1729 /* 1730 * Strip write_acl and write_owner from permissions 1731 * when inheriting an ACE 1732 */ 1733 if (aclinherit == ZFS_ACL_RESTRICTED && type == ALLOW) { 1734 access_mask &= ~RESTRICTED_CLEAR; 1735 } 1736 1737 ace_size = aclp->z_ops->ace_size(pacep); 1738 aclnode = zfs_acl_node_alloc(ace_size); 1739 list_insert_tail(&aclp->z_acl, aclnode); 1740 acep = aclnode->z_acldata; 1741 1742 zfs_set_ace(aclp, acep, access_mask, type, 1743 who, iflags|ACE_INHERITED_ACE); 1744 1745 /* 1746 * Copy special opaque data if any 1747 */ 1748 if ((data1sz = paclp->z_ops->ace_data(pacep, &data1)) != 0) { 1749 VERIFY((data2sz = aclp->z_ops->ace_data(acep, 1750 &data2)) == data1sz); 1751 memcpy(data2, data1, data2sz); 1752 } 1753 1754 aclp->z_acl_count++; 1755 aclnode->z_ace_count++; 1756 aclp->z_acl_bytes += aclnode->z_size; 1757 newflags = aclp->z_ops->ace_flags_get(acep); 1758 1759 /* 1760 * If ACE is not to be inherited further, or if the vnode is 1761 * not a directory, remove all inheritance flags 1762 */ 1763 if (!isdir || (iflags & ACE_NO_PROPAGATE_INHERIT_ACE)) { 1764 newflags &= ~ALL_INHERIT; 1765 aclp->z_ops->ace_flags_set(acep, 1766 newflags|ACE_INHERITED_ACE); 1767 continue; 1768 } 1769 1770 /* 1771 * This directory has an inheritable ACE 1772 */ 1773 aclp->z_hints |= ZFS_INHERIT_ACE; 1774 1775 /* 1776 * If only FILE_INHERIT is set then turn on 1777 * inherit_only 1778 */ 1779 if ((iflags & (ACE_FILE_INHERIT_ACE | 1780 ACE_DIRECTORY_INHERIT_ACE)) == ACE_FILE_INHERIT_ACE) { 1781 newflags |= ACE_INHERIT_ONLY_ACE; 1782 aclp->z_ops->ace_flags_set(acep, 1783 newflags|ACE_INHERITED_ACE); 1784 } else { 1785 newflags &= ~ACE_INHERIT_ONLY_ACE; 1786 aclp->z_ops->ace_flags_set(acep, 1787 newflags|ACE_INHERITED_ACE); 1788 } 1789 } 1790 if (zfsvfs->z_acl_mode == ZFS_ACL_RESTRICTED && 1791 aclp->z_acl_count != 0) { 1792 *need_chmod = B_FALSE; 1793 } 1794 1795 return (aclp); 1796 } 1797 1798 /* 1799 * Create file system object initial permissions 1800 * including inheritable ACEs. 1801 * Also, create FUIDs for owner and group. 1802 */ 1803 int 1804 zfs_acl_ids_create(znode_t *dzp, int flag, vattr_t *vap, cred_t *cr, 1805 vsecattr_t *vsecp, zfs_acl_ids_t *acl_ids, zidmap_t *mnt_ns) 1806 { 1807 int error; 1808 zfsvfs_t *zfsvfs = ZTOZSB(dzp); 1809 zfs_acl_t *paclp; 1810 gid_t gid = vap->va_gid; 1811 boolean_t need_chmod = B_TRUE; 1812 boolean_t trim = B_FALSE; 1813 boolean_t inherited = B_FALSE; 1814 1815 memset(acl_ids, 0, sizeof (zfs_acl_ids_t)); 1816 acl_ids->z_mode = vap->va_mode; 1817 1818 if (vsecp) 1819 if ((error = zfs_vsec_2_aclp(zfsvfs, vap->va_mode, vsecp, 1820 cr, &acl_ids->z_fuidp, &acl_ids->z_aclp)) != 0) 1821 return (error); 1822 1823 acl_ids->z_fuid = vap->va_uid; 1824 acl_ids->z_fgid = vap->va_gid; 1825 #ifdef HAVE_KSID 1826 /* 1827 * Determine uid and gid. 1828 */ 1829 if ((flag & IS_ROOT_NODE) || zfsvfs->z_replay || 1830 ((flag & IS_XATTR) && (S_ISDIR(vap->va_mode)))) { 1831 acl_ids->z_fuid = zfs_fuid_create(zfsvfs, (uint64_t)vap->va_uid, 1832 cr, ZFS_OWNER, &acl_ids->z_fuidp); 1833 acl_ids->z_fgid = zfs_fuid_create(zfsvfs, (uint64_t)vap->va_gid, 1834 cr, ZFS_GROUP, &acl_ids->z_fuidp); 1835 gid = vap->va_gid; 1836 } else { 1837 acl_ids->z_fuid = zfs_fuid_create_cred(zfsvfs, ZFS_OWNER, 1838 cr, &acl_ids->z_fuidp); 1839 acl_ids->z_fgid = 0; 1840 if (vap->va_mask & AT_GID) { 1841 acl_ids->z_fgid = zfs_fuid_create(zfsvfs, 1842 (uint64_t)vap->va_gid, 1843 cr, ZFS_GROUP, &acl_ids->z_fuidp); 1844 gid = vap->va_gid; 1845 if (acl_ids->z_fgid != KGID_TO_SGID(ZTOI(dzp)->i_gid) && 1846 !groupmember(vap->va_gid, cr) && 1847 secpolicy_vnode_create_gid(cr) != 0) 1848 acl_ids->z_fgid = 0; 1849 } 1850 if (acl_ids->z_fgid == 0) { 1851 if (dzp->z_mode & S_ISGID) { 1852 char *domain; 1853 uint32_t rid; 1854 1855 acl_ids->z_fgid = KGID_TO_SGID( 1856 ZTOI(dzp)->i_gid); 1857 gid = zfs_fuid_map_id(zfsvfs, acl_ids->z_fgid, 1858 cr, ZFS_GROUP); 1859 1860 if (zfsvfs->z_use_fuids && 1861 IS_EPHEMERAL(acl_ids->z_fgid)) { 1862 domain = zfs_fuid_idx_domain( 1863 &zfsvfs->z_fuid_idx, 1864 FUID_INDEX(acl_ids->z_fgid)); 1865 rid = FUID_RID(acl_ids->z_fgid); 1866 zfs_fuid_node_add(&acl_ids->z_fuidp, 1867 domain, rid, 1868 FUID_INDEX(acl_ids->z_fgid), 1869 acl_ids->z_fgid, ZFS_GROUP); 1870 } 1871 } else { 1872 acl_ids->z_fgid = zfs_fuid_create_cred(zfsvfs, 1873 ZFS_GROUP, cr, &acl_ids->z_fuidp); 1874 gid = crgetgid(cr); 1875 } 1876 } 1877 } 1878 #endif /* HAVE_KSID */ 1879 1880 /* 1881 * If we're creating a directory, and the parent directory has the 1882 * set-GID bit set, set in on the new directory. 1883 * Otherwise, if the user is neither privileged nor a member of the 1884 * file's new group, clear the file's set-GID bit. 1885 */ 1886 1887 if (!(flag & IS_ROOT_NODE) && (dzp->z_mode & S_ISGID) && 1888 (S_ISDIR(vap->va_mode))) { 1889 acl_ids->z_mode |= S_ISGID; 1890 } else { 1891 if ((acl_ids->z_mode & S_ISGID) && 1892 secpolicy_vnode_setids_setgids(cr, gid, mnt_ns, 1893 zfs_i_user_ns(ZTOI(dzp))) != 0) { 1894 acl_ids->z_mode &= ~S_ISGID; 1895 } 1896 } 1897 1898 if (acl_ids->z_aclp == NULL) { 1899 mutex_enter(&dzp->z_acl_lock); 1900 mutex_enter(&dzp->z_lock); 1901 if (!(flag & IS_ROOT_NODE) && 1902 (dzp->z_pflags & ZFS_INHERIT_ACE) && 1903 !(dzp->z_pflags & ZFS_XATTR)) { 1904 VERIFY0(zfs_acl_node_read(dzp, B_TRUE, 1905 &paclp, B_FALSE)); 1906 acl_ids->z_aclp = zfs_acl_inherit(zfsvfs, 1907 vap->va_mode, paclp, acl_ids->z_mode, &need_chmod); 1908 inherited = B_TRUE; 1909 } else { 1910 acl_ids->z_aclp = 1911 zfs_acl_alloc(zfs_acl_version_zp(dzp)); 1912 acl_ids->z_aclp->z_hints |= ZFS_ACL_TRIVIAL; 1913 } 1914 mutex_exit(&dzp->z_lock); 1915 mutex_exit(&dzp->z_acl_lock); 1916 1917 if (need_chmod) { 1918 if (S_ISDIR(vap->va_mode)) 1919 acl_ids->z_aclp->z_hints |= 1920 ZFS_ACL_AUTO_INHERIT; 1921 1922 if (zfsvfs->z_acl_mode == ZFS_ACL_GROUPMASK && 1923 zfsvfs->z_acl_inherit != ZFS_ACL_PASSTHROUGH && 1924 zfsvfs->z_acl_inherit != ZFS_ACL_PASSTHROUGH_X) 1925 trim = B_TRUE; 1926 zfs_acl_chmod(S_ISDIR(vap->va_mode), acl_ids->z_mode, 1927 B_FALSE, trim, acl_ids->z_aclp); 1928 } 1929 } 1930 1931 if (inherited || vsecp) { 1932 acl_ids->z_mode = zfs_mode_compute(acl_ids->z_mode, 1933 acl_ids->z_aclp, &acl_ids->z_aclp->z_hints, 1934 acl_ids->z_fuid, acl_ids->z_fgid); 1935 if (ace_trivial_common(acl_ids->z_aclp, 0, zfs_ace_walk) == 0) 1936 acl_ids->z_aclp->z_hints |= ZFS_ACL_TRIVIAL; 1937 } 1938 1939 return (0); 1940 } 1941 1942 /* 1943 * Free ACL and fuid_infop, but not the acl_ids structure 1944 */ 1945 void 1946 zfs_acl_ids_free(zfs_acl_ids_t *acl_ids) 1947 { 1948 if (acl_ids->z_aclp) 1949 zfs_acl_free(acl_ids->z_aclp); 1950 if (acl_ids->z_fuidp) 1951 zfs_fuid_info_free(acl_ids->z_fuidp); 1952 acl_ids->z_aclp = NULL; 1953 acl_ids->z_fuidp = NULL; 1954 } 1955 1956 boolean_t 1957 zfs_acl_ids_overquota(zfsvfs_t *zv, zfs_acl_ids_t *acl_ids, uint64_t projid) 1958 { 1959 return (zfs_id_overquota(zv, DMU_USERUSED_OBJECT, acl_ids->z_fuid) || 1960 zfs_id_overquota(zv, DMU_GROUPUSED_OBJECT, acl_ids->z_fgid) || 1961 (projid != ZFS_DEFAULT_PROJID && projid != ZFS_INVALID_PROJID && 1962 zfs_id_overquota(zv, DMU_PROJECTUSED_OBJECT, projid))); 1963 } 1964 1965 /* 1966 * Retrieve a file's ACL 1967 */ 1968 int 1969 zfs_getacl(znode_t *zp, vsecattr_t *vsecp, boolean_t skipaclchk, cred_t *cr) 1970 { 1971 zfs_acl_t *aclp; 1972 ulong_t mask; 1973 int error; 1974 int count = 0; 1975 int largeace = 0; 1976 1977 mask = vsecp->vsa_mask & (VSA_ACE | VSA_ACECNT | 1978 VSA_ACE_ACLFLAGS | VSA_ACE_ALLTYPES); 1979 1980 if (mask == 0) 1981 return (SET_ERROR(ENOSYS)); 1982 1983 if ((error = zfs_zaccess(zp, ACE_READ_ACL, 0, skipaclchk, cr, 1984 zfs_init_idmap))) 1985 return (error); 1986 1987 mutex_enter(&zp->z_acl_lock); 1988 1989 error = zfs_acl_node_read(zp, B_FALSE, &aclp, B_FALSE); 1990 if (error != 0) { 1991 mutex_exit(&zp->z_acl_lock); 1992 return (error); 1993 } 1994 1995 /* 1996 * Scan ACL to determine number of ACEs 1997 */ 1998 if ((zp->z_pflags & ZFS_ACL_OBJ_ACE) && !(mask & VSA_ACE_ALLTYPES)) { 1999 void *zacep = NULL; 2000 uint64_t who; 2001 uint32_t access_mask; 2002 uint16_t type, iflags; 2003 2004 while ((zacep = zfs_acl_next_ace(aclp, zacep, 2005 &who, &access_mask, &iflags, &type))) { 2006 switch (type) { 2007 case ACE_ACCESS_ALLOWED_OBJECT_ACE_TYPE: 2008 case ACE_ACCESS_DENIED_OBJECT_ACE_TYPE: 2009 case ACE_SYSTEM_AUDIT_OBJECT_ACE_TYPE: 2010 case ACE_SYSTEM_ALARM_OBJECT_ACE_TYPE: 2011 largeace++; 2012 continue; 2013 default: 2014 count++; 2015 } 2016 } 2017 vsecp->vsa_aclcnt = count; 2018 } else 2019 count = (int)aclp->z_acl_count; 2020 2021 if (mask & VSA_ACECNT) { 2022 vsecp->vsa_aclcnt = count; 2023 } 2024 2025 if (mask & VSA_ACE) { 2026 size_t aclsz; 2027 2028 aclsz = count * sizeof (ace_t) + 2029 sizeof (ace_object_t) * largeace; 2030 2031 vsecp->vsa_aclentp = kmem_alloc(aclsz, KM_SLEEP); 2032 vsecp->vsa_aclentsz = aclsz; 2033 2034 if (aclp->z_version == ZFS_ACL_VERSION_FUID) 2035 zfs_copy_fuid_2_ace(ZTOZSB(zp), aclp, cr, 2036 vsecp->vsa_aclentp, !(mask & VSA_ACE_ALLTYPES)); 2037 else { 2038 zfs_acl_node_t *aclnode; 2039 void *start = vsecp->vsa_aclentp; 2040 2041 for (aclnode = list_head(&aclp->z_acl); aclnode; 2042 aclnode = list_next(&aclp->z_acl, aclnode)) { 2043 memcpy(start, aclnode->z_acldata, 2044 aclnode->z_size); 2045 start = (caddr_t)start + aclnode->z_size; 2046 } 2047 ASSERT((caddr_t)start - (caddr_t)vsecp->vsa_aclentp == 2048 aclp->z_acl_bytes); 2049 } 2050 } 2051 if (mask & VSA_ACE_ACLFLAGS) { 2052 vsecp->vsa_aclflags = 0; 2053 if (zp->z_pflags & ZFS_ACL_DEFAULTED) 2054 vsecp->vsa_aclflags |= ACL_DEFAULTED; 2055 if (zp->z_pflags & ZFS_ACL_PROTECTED) 2056 vsecp->vsa_aclflags |= ACL_PROTECTED; 2057 if (zp->z_pflags & ZFS_ACL_AUTO_INHERIT) 2058 vsecp->vsa_aclflags |= ACL_AUTO_INHERIT; 2059 } 2060 2061 mutex_exit(&zp->z_acl_lock); 2062 2063 return (0); 2064 } 2065 2066 int 2067 zfs_vsec_2_aclp(zfsvfs_t *zfsvfs, umode_t obj_mode, 2068 vsecattr_t *vsecp, cred_t *cr, zfs_fuid_info_t **fuidp, zfs_acl_t **zaclp) 2069 { 2070 zfs_acl_t *aclp; 2071 zfs_acl_node_t *aclnode; 2072 int aclcnt = vsecp->vsa_aclcnt; 2073 int error; 2074 2075 if (vsecp->vsa_aclcnt > MAX_ACL_ENTRIES || vsecp->vsa_aclcnt <= 0) 2076 return (SET_ERROR(EINVAL)); 2077 2078 aclp = zfs_acl_alloc(zfs_acl_version(zfsvfs->z_version)); 2079 2080 aclp->z_hints = 0; 2081 aclnode = zfs_acl_node_alloc(aclcnt * sizeof (zfs_object_ace_t)); 2082 if (aclp->z_version == ZFS_ACL_VERSION_INITIAL) { 2083 if ((error = zfs_copy_ace_2_oldace(obj_mode, aclp, 2084 (ace_t *)vsecp->vsa_aclentp, aclnode->z_acldata, 2085 aclcnt, &aclnode->z_size)) != 0) { 2086 zfs_acl_free(aclp); 2087 zfs_acl_node_free(aclnode); 2088 return (error); 2089 } 2090 } else { 2091 if ((error = zfs_copy_ace_2_fuid(zfsvfs, obj_mode, aclp, 2092 vsecp->vsa_aclentp, aclnode->z_acldata, aclcnt, 2093 &aclnode->z_size, fuidp, cr)) != 0) { 2094 zfs_acl_free(aclp); 2095 zfs_acl_node_free(aclnode); 2096 return (error); 2097 } 2098 } 2099 aclp->z_acl_bytes = aclnode->z_size; 2100 aclnode->z_ace_count = aclcnt; 2101 aclp->z_acl_count = aclcnt; 2102 list_insert_head(&aclp->z_acl, aclnode); 2103 2104 /* 2105 * If flags are being set then add them to z_hints 2106 */ 2107 if (vsecp->vsa_mask & VSA_ACE_ACLFLAGS) { 2108 if (vsecp->vsa_aclflags & ACL_PROTECTED) 2109 aclp->z_hints |= ZFS_ACL_PROTECTED; 2110 if (vsecp->vsa_aclflags & ACL_DEFAULTED) 2111 aclp->z_hints |= ZFS_ACL_DEFAULTED; 2112 if (vsecp->vsa_aclflags & ACL_AUTO_INHERIT) 2113 aclp->z_hints |= ZFS_ACL_AUTO_INHERIT; 2114 } 2115 2116 *zaclp = aclp; 2117 2118 return (0); 2119 } 2120 2121 /* 2122 * Set a file's ACL 2123 */ 2124 int 2125 zfs_setacl(znode_t *zp, vsecattr_t *vsecp, boolean_t skipaclchk, cred_t *cr) 2126 { 2127 zfsvfs_t *zfsvfs = ZTOZSB(zp); 2128 zilog_t *zilog = zfsvfs->z_log; 2129 ulong_t mask = vsecp->vsa_mask & (VSA_ACE | VSA_ACECNT); 2130 dmu_tx_t *tx; 2131 int error; 2132 zfs_acl_t *aclp; 2133 zfs_fuid_info_t *fuidp = NULL; 2134 boolean_t fuid_dirtied; 2135 uint64_t acl_obj; 2136 2137 if (mask == 0) 2138 return (SET_ERROR(ENOSYS)); 2139 2140 if (zp->z_pflags & ZFS_IMMUTABLE) 2141 return (SET_ERROR(EPERM)); 2142 2143 if ((error = zfs_zaccess(zp, ACE_WRITE_ACL, 0, skipaclchk, cr, 2144 zfs_init_idmap))) 2145 return (error); 2146 2147 error = zfs_vsec_2_aclp(zfsvfs, ZTOI(zp)->i_mode, vsecp, cr, &fuidp, 2148 &aclp); 2149 if (error) 2150 return (error); 2151 2152 /* 2153 * If ACL wide flags aren't being set then preserve any 2154 * existing flags. 2155 */ 2156 if (!(vsecp->vsa_mask & VSA_ACE_ACLFLAGS)) { 2157 aclp->z_hints |= 2158 (zp->z_pflags & V4_ACL_WIDE_FLAGS); 2159 } 2160 top: 2161 mutex_enter(&zp->z_acl_lock); 2162 mutex_enter(&zp->z_lock); 2163 2164 tx = dmu_tx_create(zfsvfs->z_os); 2165 2166 dmu_tx_hold_sa(tx, zp->z_sa_hdl, B_TRUE); 2167 2168 fuid_dirtied = zfsvfs->z_fuid_dirty; 2169 if (fuid_dirtied) 2170 zfs_fuid_txhold(zfsvfs, tx); 2171 2172 /* 2173 * If old version and ACL won't fit in bonus and we aren't 2174 * upgrading then take out necessary DMU holds 2175 */ 2176 2177 if ((acl_obj = zfs_external_acl(zp)) != 0) { 2178 if (zfsvfs->z_version >= ZPL_VERSION_FUID && 2179 zfs_znode_acl_version(zp) <= ZFS_ACL_VERSION_INITIAL) { 2180 dmu_tx_hold_free(tx, acl_obj, 0, 2181 DMU_OBJECT_END); 2182 dmu_tx_hold_write(tx, DMU_NEW_OBJECT, 0, 2183 aclp->z_acl_bytes); 2184 } else { 2185 dmu_tx_hold_write(tx, acl_obj, 0, aclp->z_acl_bytes); 2186 } 2187 } else if (!zp->z_is_sa && aclp->z_acl_bytes > ZFS_ACE_SPACE) { 2188 dmu_tx_hold_write(tx, DMU_NEW_OBJECT, 0, aclp->z_acl_bytes); 2189 } 2190 2191 zfs_sa_upgrade_txholds(tx, zp); 2192 error = dmu_tx_assign(tx, DMU_TX_NOWAIT); 2193 if (error) { 2194 mutex_exit(&zp->z_acl_lock); 2195 mutex_exit(&zp->z_lock); 2196 2197 if (error == ERESTART) { 2198 dmu_tx_wait(tx); 2199 dmu_tx_abort(tx); 2200 goto top; 2201 } 2202 dmu_tx_abort(tx); 2203 zfs_acl_free(aclp); 2204 return (error); 2205 } 2206 2207 error = zfs_aclset_common(zp, aclp, cr, tx); 2208 ASSERT0(error); 2209 ASSERT0P(zp->z_acl_cached); 2210 zp->z_acl_cached = aclp; 2211 2212 if (fuid_dirtied) 2213 zfs_fuid_sync(zfsvfs, tx); 2214 2215 zfs_log_acl(zilog, tx, zp, vsecp, fuidp); 2216 2217 if (fuidp) 2218 zfs_fuid_info_free(fuidp); 2219 dmu_tx_commit(tx); 2220 2221 mutex_exit(&zp->z_lock); 2222 mutex_exit(&zp->z_acl_lock); 2223 2224 return (error); 2225 } 2226 2227 /* 2228 * Check accesses of interest (AoI) against attributes of the dataset 2229 * such as read-only. Returns zero if no AoI conflict with dataset 2230 * attributes, otherwise an appropriate errno is returned. 2231 */ 2232 static int 2233 zfs_zaccess_dataset_check(znode_t *zp, uint32_t v4_mode) 2234 { 2235 if ((v4_mode & WRITE_MASK) && (zfs_is_readonly(ZTOZSB(zp))) && 2236 (!Z_ISDEV(ZTOI(zp)->i_mode) || (v4_mode & WRITE_MASK_ATTRS))) { 2237 return (SET_ERROR(EROFS)); 2238 } 2239 2240 /* 2241 * Intentionally allow ZFS_READONLY through here. 2242 * See zfs_zaccess_common(). 2243 */ 2244 if ((v4_mode & WRITE_MASK_DATA) && 2245 (zp->z_pflags & ZFS_IMMUTABLE)) { 2246 return (SET_ERROR(EPERM)); 2247 } 2248 2249 if ((v4_mode & (ACE_DELETE | ACE_DELETE_CHILD)) && 2250 (zp->z_pflags & ZFS_NOUNLINK)) { 2251 return (SET_ERROR(EPERM)); 2252 } 2253 2254 if (((v4_mode & (ACE_READ_DATA|ACE_EXECUTE)) && 2255 (zp->z_pflags & ZFS_AV_QUARANTINED))) { 2256 return (SET_ERROR(EACCES)); 2257 } 2258 2259 return (0); 2260 } 2261 2262 /* 2263 * The primary usage of this function is to loop through all of the 2264 * ACEs in the znode, determining what accesses of interest (AoI) to 2265 * the caller are allowed or denied. The AoI are expressed as bits in 2266 * the working_mode parameter. As each ACE is processed, bits covered 2267 * by that ACE are removed from the working_mode. This removal 2268 * facilitates two things. The first is that when the working mode is 2269 * empty (= 0), we know we've looked at all the AoI. The second is 2270 * that the ACE interpretation rules don't allow a later ACE to undo 2271 * something granted or denied by an earlier ACE. Removing the 2272 * discovered access or denial enforces this rule. At the end of 2273 * processing the ACEs, all AoI that were found to be denied are 2274 * placed into the working_mode, giving the caller a mask of denied 2275 * accesses. Returns: 2276 * 0 if all AoI granted 2277 * EACCES if the denied mask is non-zero 2278 * other error if abnormal failure (e.g., IO error) 2279 * 2280 * A secondary usage of the function is to determine if any of the 2281 * AoI are granted. If an ACE grants any access in 2282 * the working_mode, we immediately short circuit out of the function. 2283 * This mode is chosen by setting anyaccess to B_TRUE. The 2284 * working_mode is not a denied access mask upon exit if the function 2285 * is used in this manner. 2286 */ 2287 static int 2288 zfs_zaccess_aces_check(znode_t *zp, uint32_t *working_mode, 2289 boolean_t anyaccess, cred_t *cr, zidmap_t *mnt_ns) 2290 { 2291 zfsvfs_t *zfsvfs = ZTOZSB(zp); 2292 zfs_acl_t *aclp; 2293 int error; 2294 uid_t uid = crgetuid(cr); 2295 uint64_t who; 2296 uint16_t type, iflags; 2297 uint16_t entry_type; 2298 uint32_t access_mask; 2299 uint32_t deny_mask = 0; 2300 zfs_ace_hdr_t *acep = NULL; 2301 boolean_t checkit; 2302 uid_t gowner; 2303 uid_t fowner; 2304 2305 if (mnt_ns) { 2306 fowner = zfs_uid_to_vfsuid(mnt_ns, zfs_i_user_ns(ZTOI(zp)), 2307 KUID_TO_SUID(ZTOI(zp)->i_uid)); 2308 gowner = zfs_gid_to_vfsgid(mnt_ns, zfs_i_user_ns(ZTOI(zp)), 2309 KGID_TO_SGID(ZTOI(zp)->i_gid)); 2310 } else 2311 zfs_fuid_map_ids(zp, cr, &fowner, &gowner); 2312 2313 mutex_enter(&zp->z_acl_lock); 2314 2315 error = zfs_acl_node_read(zp, B_FALSE, &aclp, B_FALSE); 2316 if (error != 0) { 2317 mutex_exit(&zp->z_acl_lock); 2318 return (error); 2319 } 2320 2321 ASSERT(zp->z_acl_cached); 2322 2323 while ((acep = zfs_acl_next_ace(aclp, acep, &who, &access_mask, 2324 &iflags, &type))) { 2325 uint32_t mask_matched; 2326 2327 if (!zfs_acl_valid_ace_type(type, iflags)) 2328 continue; 2329 2330 if (S_ISDIR(ZTOI(zp)->i_mode) && 2331 (iflags & ACE_INHERIT_ONLY_ACE)) 2332 continue; 2333 2334 /* Skip ACE if it does not affect any AoI */ 2335 mask_matched = (access_mask & *working_mode); 2336 if (!mask_matched) 2337 continue; 2338 2339 entry_type = (iflags & ACE_TYPE_FLAGS); 2340 2341 checkit = B_FALSE; 2342 2343 switch (entry_type) { 2344 case ACE_OWNER: 2345 if (uid == fowner) 2346 checkit = B_TRUE; 2347 break; 2348 case OWNING_GROUP: 2349 who = gowner; 2350 zfs_fallthrough; 2351 case ACE_IDENTIFIER_GROUP: 2352 checkit = zfs_groupmember(zfsvfs, who, cr); 2353 break; 2354 case ACE_EVERYONE: 2355 checkit = B_TRUE; 2356 break; 2357 2358 /* USER Entry */ 2359 default: 2360 if (entry_type == 0) { 2361 uid_t newid; 2362 2363 newid = zfs_fuid_map_id(zfsvfs, who, cr, 2364 ZFS_ACE_USER); 2365 if (newid != IDMAP_WK_CREATOR_OWNER_UID && 2366 uid == newid) 2367 checkit = B_TRUE; 2368 break; 2369 } else { 2370 mutex_exit(&zp->z_acl_lock); 2371 return (SET_ERROR(EIO)); 2372 } 2373 } 2374 2375 if (checkit) { 2376 if (type == DENY) { 2377 DTRACE_PROBE3(zfs__ace__denies, 2378 znode_t *, zp, 2379 zfs_ace_hdr_t *, acep, 2380 uint32_t, mask_matched); 2381 deny_mask |= mask_matched; 2382 } else { 2383 DTRACE_PROBE3(zfs__ace__allows, 2384 znode_t *, zp, 2385 zfs_ace_hdr_t *, acep, 2386 uint32_t, mask_matched); 2387 if (anyaccess) { 2388 mutex_exit(&zp->z_acl_lock); 2389 return (0); 2390 } 2391 } 2392 *working_mode &= ~mask_matched; 2393 } 2394 2395 /* Are we done? */ 2396 if (*working_mode == 0) 2397 break; 2398 } 2399 2400 mutex_exit(&zp->z_acl_lock); 2401 2402 /* Put the found 'denies' back on the working mode */ 2403 if (deny_mask) { 2404 *working_mode |= deny_mask; 2405 return (SET_ERROR(EACCES)); 2406 } else if (*working_mode) { 2407 return (-1); 2408 } 2409 2410 return (0); 2411 } 2412 2413 /* 2414 * Return true if any access whatsoever granted, we don't actually 2415 * care what access is granted. 2416 */ 2417 boolean_t 2418 zfs_has_access(znode_t *zp, cred_t *cr) 2419 { 2420 uint32_t have = ACE_ALL_PERMS; 2421 2422 if (zfs_zaccess_aces_check(zp, &have, B_TRUE, cr, 2423 zfs_init_idmap) != 0) { 2424 uid_t owner; 2425 2426 owner = zfs_fuid_map_id(ZTOZSB(zp), 2427 KUID_TO_SUID(ZTOI(zp)->i_uid), cr, ZFS_OWNER); 2428 return (secpolicy_vnode_any_access(cr, ZTOI(zp), owner) == 0); 2429 } 2430 return (B_TRUE); 2431 } 2432 2433 /* 2434 * Simplified access check for case where ACL is known to not contain 2435 * information beyond what is defined in the mode. In this case, we 2436 * can pass along to the kernel / vfs generic_permission() check, which 2437 * evaluates the mode and POSIX ACL. 2438 * 2439 * NFSv4 ACLs allow granting permissions that are usually relegated only 2440 * to the file owner or superuser. Examples are ACE_WRITE_OWNER (chown), 2441 * ACE_WRITE_ACL(chmod), and ACE_DELETE. ACE_DELETE requests must fail 2442 * because with conventional posix permissions, right to delete file 2443 * is determined by write bit on the parent dir. 2444 * 2445 * If unmappable perms are requested, then we must return EPERM 2446 * and include those bits in the working_mode so that the caller of 2447 * zfs_zaccess_common() can decide whether to perform additional 2448 * policy / capability checks. EACCES is used in zfs_zaccess_aces_check() 2449 * to indicate access check failed due to explicit DENY entry, and so 2450 * we want to avoid that here. 2451 */ 2452 static int 2453 zfs_zaccess_trivial(znode_t *zp, uint32_t *working_mode, cred_t *cr, 2454 zidmap_t *mnt_ns) 2455 { 2456 int err, mask; 2457 int unmapped = 0; 2458 2459 ASSERT(zp->z_pflags & ZFS_ACL_TRIVIAL); 2460 2461 mask = zfs_v4_to_unix(*working_mode, &unmapped); 2462 if (mask == 0 || unmapped) { 2463 *working_mode = unmapped; 2464 return (unmapped ? SET_ERROR(EPERM) : 0); 2465 } 2466 2467 #if (defined(HAVE_IOPS_PERMISSION_USERNS) || \ 2468 defined(HAVE_IOPS_PERMISSION_IDMAP)) 2469 err = generic_permission(mnt_ns, ZTOI(zp), mask); 2470 #else 2471 err = generic_permission(ZTOI(zp), mask); 2472 #endif 2473 if (err != 0) { 2474 return (SET_ERROR(EPERM)); 2475 } 2476 2477 *working_mode = unmapped; 2478 2479 return (0); 2480 } 2481 2482 static int 2483 zfs_zaccess_common(znode_t *zp, uint32_t v4_mode, uint32_t *working_mode, 2484 boolean_t *check_privs, boolean_t skipaclchk, cred_t *cr, zidmap_t *mnt_ns) 2485 { 2486 zfsvfs_t *zfsvfs = ZTOZSB(zp); 2487 int err; 2488 2489 *working_mode = v4_mode; 2490 *check_privs = B_TRUE; 2491 2492 /* 2493 * Short circuit empty requests 2494 */ 2495 if (v4_mode == 0 || zfsvfs->z_replay) { 2496 *working_mode = 0; 2497 return (0); 2498 } 2499 2500 if ((err = zfs_zaccess_dataset_check(zp, v4_mode)) != 0) { 2501 *check_privs = B_FALSE; 2502 return (err); 2503 } 2504 2505 /* 2506 * The caller requested that the ACL check be skipped. This 2507 * would only happen if the caller checked VOP_ACCESS() with a 2508 * 32 bit ACE mask and already had the appropriate permissions. 2509 */ 2510 if (skipaclchk) { 2511 *working_mode = 0; 2512 return (0); 2513 } 2514 2515 /* 2516 * Note: ZFS_READONLY represents the "DOS R/O" attribute. 2517 * When that flag is set, we should behave as if write access 2518 * were not granted by anything in the ACL. In particular: 2519 * We _must_ allow writes after opening the file r/w, then 2520 * setting the DOS R/O attribute, and writing some more. 2521 * (Similar to how you can write after fchmod(fd, 0444).) 2522 * 2523 * Therefore ZFS_READONLY is ignored in the dataset check 2524 * above, and checked here as if part of the ACL check. 2525 * Also note: DOS R/O is ignored for directories. 2526 */ 2527 if ((v4_mode & WRITE_MASK_DATA) && 2528 !S_ISDIR(ZTOI(zp)->i_mode) && 2529 (zp->z_pflags & ZFS_READONLY)) { 2530 return (SET_ERROR(EPERM)); 2531 } 2532 2533 if (zp->z_pflags & ZFS_ACL_TRIVIAL) 2534 return (zfs_zaccess_trivial(zp, working_mode, cr, mnt_ns)); 2535 2536 return (zfs_zaccess_aces_check(zp, working_mode, B_FALSE, cr, mnt_ns)); 2537 } 2538 2539 static int 2540 zfs_zaccess_append(znode_t *zp, uint32_t *working_mode, boolean_t *check_privs, 2541 cred_t *cr, zidmap_t *mnt_ns) 2542 { 2543 if (*working_mode != ACE_WRITE_DATA) 2544 return (SET_ERROR(EACCES)); 2545 2546 return (zfs_zaccess_common(zp, ACE_APPEND_DATA, working_mode, 2547 check_privs, B_FALSE, cr, mnt_ns)); 2548 } 2549 2550 int 2551 zfs_fastaccesschk_execute(znode_t *zdp, cred_t *cr) 2552 { 2553 boolean_t owner = B_FALSE; 2554 boolean_t groupmbr = B_FALSE; 2555 boolean_t is_attr; 2556 uid_t uid = crgetuid(cr); 2557 int error; 2558 2559 if (zdp->z_pflags & ZFS_AV_QUARANTINED) 2560 return (SET_ERROR(EACCES)); 2561 2562 is_attr = ((zdp->z_pflags & ZFS_XATTR) && 2563 (S_ISDIR(ZTOI(zdp)->i_mode))); 2564 if (is_attr) 2565 goto slow; 2566 2567 2568 mutex_enter(&zdp->z_acl_lock); 2569 2570 if (zdp->z_pflags & ZFS_NO_EXECS_DENIED) { 2571 mutex_exit(&zdp->z_acl_lock); 2572 return (0); 2573 } 2574 2575 if (KUID_TO_SUID(ZTOI(zdp)->i_uid) != 0 || 2576 KGID_TO_SGID(ZTOI(zdp)->i_gid) != 0) { 2577 mutex_exit(&zdp->z_acl_lock); 2578 goto slow; 2579 } 2580 2581 if (uid == KUID_TO_SUID(ZTOI(zdp)->i_uid)) { 2582 if (zdp->z_mode & S_IXUSR) { 2583 mutex_exit(&zdp->z_acl_lock); 2584 return (0); 2585 } else { 2586 mutex_exit(&zdp->z_acl_lock); 2587 goto slow; 2588 } 2589 } 2590 if (groupmember(KGID_TO_SGID(ZTOI(zdp)->i_gid), cr)) { 2591 if (zdp->z_mode & S_IXGRP) { 2592 mutex_exit(&zdp->z_acl_lock); 2593 return (0); 2594 } else { 2595 mutex_exit(&zdp->z_acl_lock); 2596 goto slow; 2597 } 2598 } 2599 if (!owner && !groupmbr) { 2600 if (zdp->z_mode & S_IXOTH) { 2601 mutex_exit(&zdp->z_acl_lock); 2602 return (0); 2603 } 2604 } 2605 2606 mutex_exit(&zdp->z_acl_lock); 2607 2608 slow: 2609 DTRACE_PROBE(zfs__fastpath__execute__access__miss); 2610 if ((error = zfs_enter(ZTOZSB(zdp), FTAG)) != 0) 2611 return (error); 2612 error = zfs_zaccess(zdp, ACE_EXECUTE, 0, B_FALSE, cr, 2613 zfs_init_idmap); 2614 zfs_exit(ZTOZSB(zdp), FTAG); 2615 return (error); 2616 } 2617 2618 /* 2619 * Determine whether Access should be granted/denied. 2620 * 2621 * The least priv subsystem is always consulted as a basic privilege 2622 * can define any form of access. 2623 */ 2624 int 2625 zfs_zaccess(znode_t *zp, int mode, int flags, boolean_t skipaclchk, cred_t *cr, 2626 zidmap_t *mnt_ns) 2627 { 2628 uint32_t working_mode; 2629 int error; 2630 int is_attr; 2631 boolean_t check_privs; 2632 znode_t *xzp; 2633 znode_t *check_zp = zp; 2634 mode_t needed_bits; 2635 uid_t owner; 2636 2637 is_attr = ((zp->z_pflags & ZFS_XATTR) && S_ISDIR(ZTOI(zp)->i_mode)); 2638 2639 /* 2640 * If attribute then validate against base file 2641 */ 2642 if (is_attr) { 2643 if ((error = zfs_zget(ZTOZSB(zp), 2644 zp->z_xattr_parent, &xzp)) != 0) { 2645 return (error); 2646 } 2647 2648 check_zp = xzp; 2649 2650 /* 2651 * fixup mode to map to xattr perms 2652 */ 2653 2654 if (mode & (ACE_WRITE_DATA|ACE_APPEND_DATA)) { 2655 mode &= ~(ACE_WRITE_DATA|ACE_APPEND_DATA); 2656 mode |= ACE_WRITE_NAMED_ATTRS; 2657 } 2658 2659 if (mode & (ACE_READ_DATA|ACE_EXECUTE)) { 2660 mode &= ~(ACE_READ_DATA|ACE_EXECUTE); 2661 mode |= ACE_READ_NAMED_ATTRS; 2662 } 2663 } 2664 2665 owner = zfs_uid_to_vfsuid(mnt_ns, zfs_i_user_ns(ZTOI(zp)), 2666 KUID_TO_SUID(ZTOI(zp)->i_uid)); 2667 owner = zfs_fuid_map_id(ZTOZSB(zp), owner, cr, ZFS_OWNER); 2668 2669 /* 2670 * Map the bits required to the standard inode flags 2671 * S_IRUSR|S_IWUSR|S_IXUSR in the needed_bits. Map the bits 2672 * mapped by working_mode (currently missing) in missing_bits. 2673 * Call secpolicy_vnode_access2() with (needed_bits & ~checkmode), 2674 * needed_bits. 2675 */ 2676 needed_bits = 0; 2677 2678 working_mode = mode; 2679 if ((working_mode & (ACE_READ_ACL|ACE_READ_ATTRIBUTES)) && 2680 owner == crgetuid(cr)) 2681 working_mode &= ~(ACE_READ_ACL|ACE_READ_ATTRIBUTES); 2682 2683 if (working_mode & (ACE_READ_DATA|ACE_READ_NAMED_ATTRS| 2684 ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_SYNCHRONIZE)) 2685 needed_bits |= S_IRUSR; 2686 if (working_mode & (ACE_WRITE_DATA|ACE_WRITE_NAMED_ATTRS| 2687 ACE_APPEND_DATA|ACE_WRITE_ATTRIBUTES|ACE_SYNCHRONIZE)) 2688 needed_bits |= S_IWUSR; 2689 if (working_mode & ACE_EXECUTE) 2690 needed_bits |= S_IXUSR; 2691 2692 if ((error = zfs_zaccess_common(check_zp, mode, &working_mode, 2693 &check_privs, skipaclchk, cr, mnt_ns)) == 0) { 2694 if (is_attr) 2695 zrele(xzp); 2696 return (secpolicy_vnode_access2(cr, ZTOI(zp), owner, 2697 needed_bits, needed_bits)); 2698 } 2699 2700 if (error && !check_privs) { 2701 if (is_attr) 2702 zrele(xzp); 2703 return (error); 2704 } 2705 2706 if (error && (flags & V_APPEND)) { 2707 error = zfs_zaccess_append(zp, &working_mode, &check_privs, cr, 2708 mnt_ns); 2709 } 2710 2711 if (error && check_privs) { 2712 mode_t checkmode = 0; 2713 2714 /* 2715 * First check for implicit owner permission on 2716 * read_acl/read_attributes 2717 */ 2718 2719 ASSERT(working_mode != 0); 2720 2721 if ((working_mode & (ACE_READ_ACL|ACE_READ_ATTRIBUTES) && 2722 owner == crgetuid(cr))) 2723 working_mode &= ~(ACE_READ_ACL|ACE_READ_ATTRIBUTES); 2724 2725 if (working_mode & (ACE_READ_DATA|ACE_READ_NAMED_ATTRS| 2726 ACE_READ_ACL|ACE_READ_ATTRIBUTES|ACE_SYNCHRONIZE)) 2727 checkmode |= S_IRUSR; 2728 if (working_mode & (ACE_WRITE_DATA|ACE_WRITE_NAMED_ATTRS| 2729 ACE_APPEND_DATA|ACE_WRITE_ATTRIBUTES|ACE_SYNCHRONIZE)) 2730 checkmode |= S_IWUSR; 2731 if (working_mode & ACE_EXECUTE) 2732 checkmode |= S_IXUSR; 2733 2734 error = secpolicy_vnode_access2(cr, ZTOI(check_zp), owner, 2735 needed_bits & ~checkmode, needed_bits); 2736 2737 if (error == 0 && (working_mode & ACE_WRITE_OWNER)) 2738 error = secpolicy_vnode_chown(cr, owner); 2739 if (error == 0 && (working_mode & ACE_WRITE_ACL)) 2740 error = secpolicy_vnode_setdac(cr, owner); 2741 2742 if (error == 0 && (working_mode & 2743 (ACE_DELETE|ACE_DELETE_CHILD))) 2744 error = secpolicy_vnode_remove(cr); 2745 2746 if (error == 0 && (working_mode & ACE_SYNCHRONIZE)) { 2747 error = secpolicy_vnode_chown(cr, owner); 2748 } 2749 if (error == 0) { 2750 /* 2751 * See if any bits other than those already checked 2752 * for are still present. If so then return EACCES 2753 */ 2754 if (working_mode & ~(ZFS_CHECKED_MASKS)) { 2755 error = SET_ERROR(EACCES); 2756 } 2757 } 2758 } else if (error == 0) { 2759 error = secpolicy_vnode_access2(cr, ZTOI(zp), owner, 2760 needed_bits, needed_bits); 2761 } 2762 2763 if (is_attr) 2764 zrele(xzp); 2765 2766 return (error); 2767 } 2768 2769 /* 2770 * Translate traditional unix S_IRUSR/S_IWUSR/S_IXUSR mode into 2771 * NFSv4-style ZFS ACL format and call zfs_zaccess() 2772 */ 2773 int 2774 zfs_zaccess_rwx(znode_t *zp, mode_t mode, int flags, cred_t *cr, 2775 zidmap_t *mnt_ns) 2776 { 2777 return (zfs_zaccess(zp, zfs_unix_to_v4(mode >> 6), flags, B_FALSE, cr, 2778 mnt_ns)); 2779 } 2780 2781 /* 2782 * Access function for secpolicy_vnode_setattr 2783 */ 2784 int 2785 zfs_zaccess_unix(void *zp, int mode, cred_t *cr) 2786 { 2787 int v4_mode = zfs_unix_to_v4(mode >> 6); 2788 2789 return (zfs_zaccess(zp, v4_mode, 0, B_FALSE, cr, zfs_init_idmap)); 2790 } 2791 2792 /* See zfs_zaccess_delete() */ 2793 static const boolean_t zfs_write_implies_delete_child = B_TRUE; 2794 2795 /* 2796 * Determine whether delete access should be granted. 2797 * 2798 * The following chart outlines how we handle delete permissions which is 2799 * how recent versions of windows (Windows 2008) handles it. The efficiency 2800 * comes from not having to check the parent ACL where the object itself grants 2801 * delete: 2802 * 2803 * ------------------------------------------------------- 2804 * | Parent Dir | Target Object Permissions | 2805 * | permissions | | 2806 * ------------------------------------------------------- 2807 * | | ACL Allows | ACL Denies| Delete | 2808 * | | Delete | Delete | unspecified| 2809 * ------------------------------------------------------- 2810 * | ACL Allows | Permit | Deny * | Permit | 2811 * | DELETE_CHILD | | | | 2812 * ------------------------------------------------------- 2813 * | ACL Denies | Permit | Deny | Deny | 2814 * | DELETE_CHILD | | | | 2815 * ------------------------------------------------------- 2816 * | ACL specifies | | | | 2817 * | only allow | Permit | Deny * | Permit | 2818 * | write and | | | | 2819 * | execute | | | | 2820 * ------------------------------------------------------- 2821 * | ACL denies | | | | 2822 * | write and | Permit | Deny | Deny | 2823 * | execute | | | | 2824 * ------------------------------------------------------- 2825 * ^ 2826 * | 2827 * Re. execute permission on the directory: if that's missing, 2828 * the vnode lookup of the target will fail before we get here. 2829 * 2830 * Re [*] in the table above: NFSv4 would normally Permit delete for 2831 * these two cells of the matrix. 2832 * See acl.h for notes on which ACE_... flags should be checked for which 2833 * operations. Specifically, the NFSv4 committee recommendation is in 2834 * conflict with the Windows interpretation of DENY ACEs, where DENY ACEs 2835 * should take precedence ahead of ALLOW ACEs. 2836 * 2837 * This implementation always consults the target object's ACL first. 2838 * If a DENY ACE is present on the target object that specifies ACE_DELETE, 2839 * delete access is denied. If an ALLOW ACE with ACE_DELETE is present on 2840 * the target object, access is allowed. If and only if no entries with 2841 * ACE_DELETE are present in the object's ACL, check the container's ACL 2842 * for entries with ACE_DELETE_CHILD. 2843 * 2844 * A summary of the logic implemented from the table above is as follows: 2845 * 2846 * First check for DENY ACEs that apply. 2847 * If either target or container has a deny, EACCES. 2848 * 2849 * Delete access can then be summarized as follows: 2850 * 1: The object to be deleted grants ACE_DELETE, or 2851 * 2: The containing directory grants ACE_DELETE_CHILD. 2852 * In a Windows system, that would be the end of the story. 2853 * In this system, (2) has some complications... 2854 * 2a: "sticky" bit on a directory adds restrictions, and 2855 * 2b: existing ACEs from previous versions of ZFS may 2856 * not carry ACE_DELETE_CHILD where they should, so we 2857 * also allow delete when ACE_WRITE_DATA is granted. 2858 * 2859 * Note: 2b is technically a work-around for a prior bug, 2860 * which hopefully can go away some day. For those who 2861 * no longer need the work around, and for testing, this 2862 * work-around is made conditional via the tunable: 2863 * zfs_write_implies_delete_child 2864 */ 2865 int 2866 zfs_zaccess_delete(znode_t *dzp, znode_t *zp, cred_t *cr, zidmap_t *mnt_ns) 2867 { 2868 uint32_t wanted_dirperms; 2869 uint32_t dzp_working_mode = 0; 2870 uint32_t zp_working_mode = 0; 2871 int dzp_error, zp_error; 2872 boolean_t dzpcheck_privs; 2873 boolean_t zpcheck_privs; 2874 2875 if (zp->z_pflags & (ZFS_IMMUTABLE | ZFS_NOUNLINK)) 2876 return (SET_ERROR(EPERM)); 2877 2878 /* 2879 * Case 1: 2880 * If target object grants ACE_DELETE then we are done. This is 2881 * indicated by a return value of 0. For this case we don't worry 2882 * about the sticky bit because sticky only applies to the parent 2883 * directory and this is the child access result. 2884 * 2885 * If we encounter a DENY ACE here, we're also done (EACCES). 2886 * Note that if we hit a DENY ACE here (on the target) it should 2887 * take precedence over a DENY ACE on the container, so that when 2888 * we have more complete auditing support we will be able to 2889 * report an access failure against the specific target. 2890 * (This is part of why we're checking the target first.) 2891 */ 2892 zp_error = zfs_zaccess_common(zp, ACE_DELETE, &zp_working_mode, 2893 &zpcheck_privs, B_FALSE, cr, mnt_ns); 2894 if (zp_error == EACCES) { 2895 /* We hit a DENY ACE. */ 2896 if (!zpcheck_privs) 2897 return (SET_ERROR(zp_error)); 2898 return (secpolicy_vnode_remove(cr)); 2899 2900 } 2901 if (zp_error == 0) 2902 return (0); 2903 2904 /* 2905 * Case 2: 2906 * If the containing directory grants ACE_DELETE_CHILD, 2907 * or we're in backward compatibility mode and the 2908 * containing directory has ACE_WRITE_DATA, allow. 2909 * Case 2b is handled with wanted_dirperms. 2910 */ 2911 wanted_dirperms = ACE_DELETE_CHILD; 2912 if (zfs_write_implies_delete_child) 2913 wanted_dirperms |= ACE_WRITE_DATA; 2914 dzp_error = zfs_zaccess_common(dzp, wanted_dirperms, 2915 &dzp_working_mode, &dzpcheck_privs, B_FALSE, cr, mnt_ns); 2916 if (dzp_error == EACCES) { 2917 /* We hit a DENY ACE. */ 2918 if (!dzpcheck_privs) 2919 return (SET_ERROR(dzp_error)); 2920 return (secpolicy_vnode_remove(cr)); 2921 } 2922 2923 /* 2924 * Cases 2a, 2b (continued) 2925 * 2926 * Note: dzp_working_mode now contains any permissions 2927 * that were NOT granted. Therefore, if any of the 2928 * wanted_dirperms WERE granted, we will have: 2929 * dzp_working_mode != wanted_dirperms 2930 * We're really asking if ANY of those permissions 2931 * were granted, and if so, grant delete access. 2932 */ 2933 if (dzp_working_mode != wanted_dirperms) 2934 dzp_error = 0; 2935 2936 /* 2937 * dzp_error is 0 if the container granted us permissions to "modify". 2938 * If we do not have permission via one or more ACEs, our current 2939 * privileges may still permit us to modify the container. 2940 * 2941 * dzpcheck_privs is false when i.e. the FS is read-only. 2942 * Otherwise, do privilege checks for the container. 2943 */ 2944 if (dzp_error != 0 && dzpcheck_privs) { 2945 uid_t owner; 2946 2947 /* 2948 * The secpolicy call needs the requested access and 2949 * the current access mode of the container, but it 2950 * only knows about Unix-style modes (VEXEC, VWRITE), 2951 * so this must condense the fine-grained ACE bits into 2952 * Unix modes. 2953 * 2954 * The VEXEC flag is easy, because we know that has 2955 * always been checked before we get here (during the 2956 * lookup of the target vnode). The container has not 2957 * granted us permissions to "modify", so we do not set 2958 * the VWRITE flag in the current access mode. 2959 */ 2960 owner = zfs_fuid_map_id(ZTOZSB(dzp), 2961 KUID_TO_SUID(ZTOI(dzp)->i_uid), cr, ZFS_OWNER); 2962 dzp_error = secpolicy_vnode_access2(cr, ZTOI(dzp), 2963 owner, S_IXUSR, S_IWUSR|S_IXUSR); 2964 } 2965 if (dzp_error != 0) { 2966 /* 2967 * Note: We may have dzp_error = -1 here (from 2968 * zfs_zacess_common). Don't return that. 2969 */ 2970 return (SET_ERROR(EACCES)); 2971 } 2972 2973 2974 /* 2975 * At this point, we know that the directory permissions allow 2976 * us to modify, but we still need to check for the additional 2977 * restrictions that apply when the "sticky bit" is set. 2978 * 2979 * Yes, zfs_sticky_remove_access() also checks this bit, but 2980 * checking it here and skipping the call below is nice when 2981 * you're watching all of this with dtrace. 2982 */ 2983 if ((dzp->z_mode & S_ISVTX) == 0) 2984 return (0); 2985 2986 /* 2987 * zfs_sticky_remove_access will succeed if: 2988 * 1. The sticky bit is absent. 2989 * 2. We pass the sticky bit restrictions. 2990 * 3. We have privileges that always allow file removal. 2991 */ 2992 return (zfs_sticky_remove_access(dzp, zp, cr)); 2993 } 2994 2995 int 2996 zfs_zaccess_rename(znode_t *sdzp, znode_t *szp, znode_t *tdzp, 2997 znode_t *tzp, cred_t *cr, zidmap_t *mnt_ns) 2998 { 2999 int add_perm; 3000 int error; 3001 3002 if (szp->z_pflags & ZFS_AV_QUARANTINED) 3003 return (SET_ERROR(EACCES)); 3004 3005 add_perm = S_ISDIR(ZTOI(szp)->i_mode) ? 3006 ACE_ADD_SUBDIRECTORY : ACE_ADD_FILE; 3007 3008 /* 3009 * Rename permissions are combination of delete permission + 3010 * add file/subdir permission. 3011 */ 3012 3013 /* 3014 * first make sure we do the delete portion. 3015 * 3016 * If that succeeds then check for add_file/add_subdir permissions 3017 */ 3018 3019 if ((error = zfs_zaccess_delete(sdzp, szp, cr, mnt_ns))) 3020 return (error); 3021 3022 /* 3023 * If we have a tzp, see if we can delete it? 3024 */ 3025 if (tzp) { 3026 if ((error = zfs_zaccess_delete(tdzp, tzp, cr, mnt_ns))) 3027 return (error); 3028 } 3029 3030 /* 3031 * Now check for add permissions 3032 */ 3033 error = zfs_zaccess(tdzp, add_perm, 0, B_FALSE, cr, mnt_ns); 3034 3035 return (error); 3036 } 3037