xref: /freebsd/sys/kern/subr_acl_nfs4.c (revision 0b3105a37d7adcadcb720112fed4dc4e8040be99)
1 /*-
2  * Copyright (c) 2008-2010 Edward Tomasz Napierała <trasz@FreeBSD.org>
3  * All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  *
14  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
15  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
16  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
17  * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
18  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
19  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
20  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
21  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
22  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
23  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
24  * SUCH DAMAGE.
25  */
26 
27 /*
28  * ACL support routines specific to NFSv4 access control lists.  These are
29  * utility routines for code common across file systems implementing NFSv4
30  * ACLs.
31  */
32 
33 #ifdef _KERNEL
34 #include <sys/cdefs.h>
35 __FBSDID("$FreeBSD$");
36 
37 #include <sys/param.h>
38 #include <sys/kernel.h>
39 #include <sys/module.h>
40 #include <sys/systm.h>
41 #include <sys/mount.h>
42 #include <sys/priv.h>
43 #include <sys/vnode.h>
44 #include <sys/errno.h>
45 #include <sys/stat.h>
46 #include <sys/sysctl.h>
47 #include <sys/acl.h>
48 #else
49 #include <errno.h>
50 #include <assert.h>
51 #include <sys/acl.h>
52 #include <sys/stat.h>
53 #define KASSERT(a, b) assert(a)
54 #define CTASSERT(a)
55 
56 #endif /* !_KERNEL */
57 
58 #ifdef _KERNEL
59 
60 static void	acl_nfs4_trivial_from_mode(struct acl *aclp, mode_t mode);
61 
62 static int	acl_nfs4_old_semantics = 0;
63 
64 SYSCTL_INT(_vfs, OID_AUTO, acl_nfs4_old_semantics, CTLFLAG_RW,
65     &acl_nfs4_old_semantics, 0, "Use pre-PSARC/2010/029 NFSv4 ACL semantics");
66 
67 static struct {
68 	accmode_t accmode;
69 	int mask;
70 } accmode2mask[] = {{VREAD, ACL_READ_DATA},
71 		    {VWRITE, ACL_WRITE_DATA},
72 		    {VAPPEND, ACL_APPEND_DATA},
73 		    {VEXEC, ACL_EXECUTE},
74 		    {VREAD_NAMED_ATTRS, ACL_READ_NAMED_ATTRS},
75 		    {VWRITE_NAMED_ATTRS, ACL_WRITE_NAMED_ATTRS},
76 		    {VDELETE_CHILD, ACL_DELETE_CHILD},
77 		    {VREAD_ATTRIBUTES, ACL_READ_ATTRIBUTES},
78 		    {VWRITE_ATTRIBUTES, ACL_WRITE_ATTRIBUTES},
79 		    {VDELETE, ACL_DELETE},
80 		    {VREAD_ACL, ACL_READ_ACL},
81 		    {VWRITE_ACL, ACL_WRITE_ACL},
82 		    {VWRITE_OWNER, ACL_WRITE_OWNER},
83 		    {VSYNCHRONIZE, ACL_SYNCHRONIZE},
84 		    {0, 0}};
85 
86 static int
87 _access_mask_from_accmode(accmode_t accmode)
88 {
89 	int access_mask = 0, i;
90 
91 	for (i = 0; accmode2mask[i].accmode != 0; i++) {
92 		if (accmode & accmode2mask[i].accmode)
93 			access_mask |= accmode2mask[i].mask;
94 	}
95 
96 	/*
97 	 * VAPPEND is just a modifier for VWRITE; if the caller asked
98 	 * for 'VAPPEND | VWRITE', we want to check for ACL_APPEND_DATA only.
99 	 */
100 	if (access_mask & ACL_APPEND_DATA)
101 		access_mask &= ~ACL_WRITE_DATA;
102 
103 	return (access_mask);
104 }
105 
106 /*
107  * Return 0, iff access is allowed, 1 otherwise.
108  */
109 static int
110 _acl_denies(const struct acl *aclp, int access_mask, struct ucred *cred,
111     int file_uid, int file_gid, int *denied_explicitly)
112 {
113 	int i;
114 	const struct acl_entry *entry;
115 
116 	if (denied_explicitly != NULL)
117 		*denied_explicitly = 0;
118 
119 	KASSERT(aclp->acl_cnt <= ACL_MAX_ENTRIES,
120 	    ("aclp->acl_cnt <= ACL_MAX_ENTRIES"));
121 
122 	for (i = 0; i < aclp->acl_cnt; i++) {
123 		entry = &(aclp->acl_entry[i]);
124 
125 		if (entry->ae_entry_type != ACL_ENTRY_TYPE_ALLOW &&
126 		    entry->ae_entry_type != ACL_ENTRY_TYPE_DENY)
127 			continue;
128 		if (entry->ae_flags & ACL_ENTRY_INHERIT_ONLY)
129 			continue;
130 		switch (entry->ae_tag) {
131 		case ACL_USER_OBJ:
132 			if (file_uid != cred->cr_uid)
133 				continue;
134 			break;
135 		case ACL_USER:
136 			if (entry->ae_id != cred->cr_uid)
137 				continue;
138 			break;
139 		case ACL_GROUP_OBJ:
140 			if (!groupmember(file_gid, cred))
141 				continue;
142 			break;
143 		case ACL_GROUP:
144 			if (!groupmember(entry->ae_id, cred))
145 				continue;
146 			break;
147 		default:
148 			KASSERT(entry->ae_tag == ACL_EVERYONE,
149 			    ("entry->ae_tag == ACL_EVERYONE"));
150 		}
151 
152 		if (entry->ae_entry_type == ACL_ENTRY_TYPE_DENY) {
153 			if (entry->ae_perm & access_mask) {
154 				if (denied_explicitly != NULL)
155 					*denied_explicitly = 1;
156 				return (1);
157 			}
158 		}
159 
160 		access_mask &= ~(entry->ae_perm);
161 		if (access_mask == 0)
162 			return (0);
163 	}
164 
165 	if (access_mask == 0)
166 		return (0);
167 
168 	return (1);
169 }
170 
171 int
172 vaccess_acl_nfs4(enum vtype type, uid_t file_uid, gid_t file_gid,
173     struct acl *aclp, accmode_t accmode, struct ucred *cred, int *privused)
174 {
175 	accmode_t priv_granted = 0;
176 	int denied, explicitly_denied, access_mask, is_directory,
177 	    must_be_owner = 0;
178 	mode_t file_mode = 0;
179 
180 	KASSERT((accmode & ~(VEXEC | VWRITE | VREAD | VADMIN | VAPPEND |
181 	    VEXPLICIT_DENY | VREAD_NAMED_ATTRS | VWRITE_NAMED_ATTRS |
182 	    VDELETE_CHILD | VREAD_ATTRIBUTES | VWRITE_ATTRIBUTES | VDELETE |
183 	    VREAD_ACL | VWRITE_ACL | VWRITE_OWNER | VSYNCHRONIZE)) == 0,
184 	    ("invalid bit in accmode"));
185 	KASSERT((accmode & VAPPEND) == 0 || (accmode & VWRITE),
186 	    	("VAPPEND without VWRITE"));
187 
188 	if (privused != NULL)
189 		*privused = 0;
190 
191 	if (accmode & VADMIN)
192 		must_be_owner = 1;
193 
194 	/*
195 	 * Ignore VSYNCHRONIZE permission.
196 	 */
197 	accmode &= ~VSYNCHRONIZE;
198 
199 	access_mask = _access_mask_from_accmode(accmode);
200 
201 	if (type == VDIR)
202 		is_directory = 1;
203 	else
204 		is_directory = 0;
205 
206 	/*
207 	 * File owner is always allowed to read and write the ACL
208 	 * and basic attributes.  This is to prevent a situation
209 	 * where user would change ACL in a way that prevents him
210 	 * from undoing the change.
211 	 */
212 	if (file_uid == cred->cr_uid)
213 		access_mask &= ~(ACL_READ_ACL | ACL_WRITE_ACL |
214 		    ACL_READ_ATTRIBUTES | ACL_WRITE_ATTRIBUTES);
215 
216 	/*
217 	 * Ignore append permission for regular files; use write
218 	 * permission instead.
219 	 */
220 	if (!is_directory && (access_mask & ACL_APPEND_DATA)) {
221 		access_mask &= ~ACL_APPEND_DATA;
222 		access_mask |= ACL_WRITE_DATA;
223 	}
224 
225 	denied = _acl_denies(aclp, access_mask, cred, file_uid, file_gid,
226 	    &explicitly_denied);
227 
228 	if (must_be_owner) {
229 		if (file_uid != cred->cr_uid)
230 			denied = EPERM;
231 	}
232 
233 	/*
234 	 * For VEXEC, ensure that at least one execute bit is set for
235 	 * non-directories. We have to check the mode here to stay
236 	 * consistent with execve(2). See the test in
237 	 * exec_check_permissions().
238 	 */
239 	acl_nfs4_sync_mode_from_acl(&file_mode, aclp);
240 	if (!denied && !is_directory && (accmode & VEXEC) &&
241 	    (file_mode & (S_IXUSR | S_IXGRP | S_IXOTH)) == 0)
242 		denied = EACCES;
243 
244 	if (!denied)
245 		return (0);
246 
247 	/*
248 	 * Access failed.  Iff it was not denied explicitly and
249 	 * VEXPLICIT_DENY flag was specified, allow access.
250 	 */
251 	if ((accmode & VEXPLICIT_DENY) && explicitly_denied == 0)
252 		return (0);
253 
254 	accmode &= ~VEXPLICIT_DENY;
255 
256 	/*
257 	 * No match.  Try to use privileges, if there are any.
258 	 */
259 	if (is_directory) {
260 		if ((accmode & VEXEC) && !priv_check_cred(cred,
261 		    PRIV_VFS_LOOKUP, 0))
262 			priv_granted |= VEXEC;
263 	} else {
264 		/*
265 		 * Ensure that at least one execute bit is on. Otherwise,
266 		 * a privileged user will always succeed, and we don't want
267 		 * this to happen unless the file really is executable.
268 		 */
269 		if ((accmode & VEXEC) && (file_mode &
270 		    (S_IXUSR | S_IXGRP | S_IXOTH)) != 0 &&
271 		    !priv_check_cred(cred, PRIV_VFS_EXEC, 0))
272 			priv_granted |= VEXEC;
273 	}
274 
275 	if ((accmode & VREAD) && !priv_check_cred(cred, PRIV_VFS_READ, 0))
276 		priv_granted |= VREAD;
277 
278 	if ((accmode & (VWRITE | VAPPEND | VDELETE_CHILD)) &&
279 	    !priv_check_cred(cred, PRIV_VFS_WRITE, 0))
280 		priv_granted |= (VWRITE | VAPPEND | VDELETE_CHILD);
281 
282 	if ((accmode & VADMIN_PERMS) &&
283 	    !priv_check_cred(cred, PRIV_VFS_ADMIN, 0))
284 		priv_granted |= VADMIN_PERMS;
285 
286 	if ((accmode & VSTAT_PERMS) &&
287 	    !priv_check_cred(cred, PRIV_VFS_STAT, 0))
288 		priv_granted |= VSTAT_PERMS;
289 
290 	if ((accmode & priv_granted) == accmode) {
291 		if (privused != NULL)
292 			*privused = 1;
293 
294 		return (0);
295 	}
296 
297 	if (accmode & (VADMIN_PERMS | VDELETE_CHILD | VDELETE))
298 		denied = EPERM;
299 	else
300 		denied = EACCES;
301 
302 	return (denied);
303 }
304 #endif /* _KERNEL */
305 
306 static int
307 _acl_entry_matches(struct acl_entry *entry, acl_tag_t tag, acl_perm_t perm,
308     acl_entry_type_t entry_type)
309 {
310 	if (entry->ae_tag != tag)
311 		return (0);
312 
313 	if (entry->ae_id != ACL_UNDEFINED_ID)
314 		return (0);
315 
316 	if (entry->ae_perm != perm)
317 		return (0);
318 
319 	if (entry->ae_entry_type != entry_type)
320 		return (0);
321 
322 	if (entry->ae_flags != 0)
323 		return (0);
324 
325 	return (1);
326 }
327 
328 static struct acl_entry *
329 _acl_append(struct acl *aclp, acl_tag_t tag, acl_perm_t perm,
330     acl_entry_type_t entry_type)
331 {
332 	struct acl_entry *entry;
333 
334 	KASSERT(aclp->acl_cnt + 1 <= ACL_MAX_ENTRIES,
335 	    ("aclp->acl_cnt + 1 <= ACL_MAX_ENTRIES"));
336 
337 	entry = &(aclp->acl_entry[aclp->acl_cnt]);
338 	aclp->acl_cnt++;
339 
340 	entry->ae_tag = tag;
341 	entry->ae_id = ACL_UNDEFINED_ID;
342 	entry->ae_perm = perm;
343 	entry->ae_entry_type = entry_type;
344 	entry->ae_flags = 0;
345 
346 	return (entry);
347 }
348 
349 static struct acl_entry *
350 _acl_duplicate_entry(struct acl *aclp, int entry_index)
351 {
352 	int i;
353 
354 	KASSERT(aclp->acl_cnt + 1 <= ACL_MAX_ENTRIES,
355 	    ("aclp->acl_cnt + 1 <= ACL_MAX_ENTRIES"));
356 
357 	for (i = aclp->acl_cnt; i > entry_index; i--)
358 		aclp->acl_entry[i] = aclp->acl_entry[i - 1];
359 
360 	aclp->acl_cnt++;
361 
362 	return (&(aclp->acl_entry[entry_index + 1]));
363 }
364 
365 static void
366 acl_nfs4_sync_acl_from_mode_draft(struct acl *aclp, mode_t mode,
367     int file_owner_id)
368 {
369 	int i, meets, must_append;
370 	struct acl_entry *entry, *copy, *previous,
371 	    *a1, *a2, *a3, *a4, *a5, *a6;
372 	mode_t amode;
373 	const int READ = 04;
374 	const int WRITE = 02;
375 	const int EXEC = 01;
376 
377 	KASSERT(aclp->acl_cnt <= ACL_MAX_ENTRIES,
378 	    ("aclp->acl_cnt <= ACL_MAX_ENTRIES"));
379 
380 	/*
381 	 * NFSv4 Minor Version 1, draft-ietf-nfsv4-minorversion1-03.txt
382 	 *
383 	 * 3.16.6.3. Applying a Mode to an Existing ACL
384 	 */
385 
386 	/*
387 	 * 1. For each ACE:
388 	 */
389 	for (i = 0; i < aclp->acl_cnt; i++) {
390 		entry = &(aclp->acl_entry[i]);
391 
392 		/*
393 		 * 1.1. If the type is neither ALLOW or DENY - skip.
394 		 */
395 		if (entry->ae_entry_type != ACL_ENTRY_TYPE_ALLOW &&
396 		    entry->ae_entry_type != ACL_ENTRY_TYPE_DENY)
397 			continue;
398 
399 		/*
400 		 * 1.2. If ACL_ENTRY_INHERIT_ONLY is set - skip.
401 		 */
402 		if (entry->ae_flags & ACL_ENTRY_INHERIT_ONLY)
403 			continue;
404 
405 		/*
406 		 * 1.3. If ACL_ENTRY_FILE_INHERIT or ACL_ENTRY_DIRECTORY_INHERIT
407 		 *      are set:
408 		 */
409 		if (entry->ae_flags &
410 		    (ACL_ENTRY_FILE_INHERIT | ACL_ENTRY_DIRECTORY_INHERIT)) {
411 			/*
412 			 * 1.3.1. A copy of the current ACE is made, and placed
413 			 *        in the ACL immediately following the current
414 			 *        ACE.
415 			 */
416 			copy = _acl_duplicate_entry(aclp, i);
417 
418 			/*
419 			 * 1.3.2. In the first ACE, the flag
420 			 *        ACL_ENTRY_INHERIT_ONLY is set.
421 			 */
422 			entry->ae_flags |= ACL_ENTRY_INHERIT_ONLY;
423 
424 			/*
425 			 * 1.3.3. In the second ACE, the following flags
426 			 *        are cleared:
427 			 *        ACL_ENTRY_FILE_INHERIT,
428 			 *        ACL_ENTRY_DIRECTORY_INHERIT,
429 			 *        ACL_ENTRY_NO_PROPAGATE_INHERIT.
430 			 */
431 			copy->ae_flags &= ~(ACL_ENTRY_FILE_INHERIT |
432 			    ACL_ENTRY_DIRECTORY_INHERIT |
433 			    ACL_ENTRY_NO_PROPAGATE_INHERIT);
434 
435 			/*
436 			 * The algorithm continues on with the second ACE.
437 			 */
438 			i++;
439 			entry = copy;
440 		}
441 
442 		/*
443 		 * 1.4. If it's owner@, group@ or everyone@ entry, clear
444 		 *      ACL_READ_DATA, ACL_WRITE_DATA, ACL_APPEND_DATA
445 		 *      and ACL_EXECUTE.  Continue to the next entry.
446 		 */
447 		if (entry->ae_tag == ACL_USER_OBJ ||
448 		    entry->ae_tag == ACL_GROUP_OBJ ||
449 		    entry->ae_tag == ACL_EVERYONE) {
450 			entry->ae_perm &= ~(ACL_READ_DATA | ACL_WRITE_DATA |
451 			    ACL_APPEND_DATA | ACL_EXECUTE);
452 			continue;
453 		}
454 
455 		/*
456 		 * 1.5. Otherwise, if the "who" field did not match one
457 		 *      of OWNER@, GROUP@, EVERYONE@:
458 		 *
459 		 * 1.5.1. If the type is ALLOW, check the preceding ACE.
460 		 *        If it does not meet all of the following criteria:
461 		 */
462 		if (entry->ae_entry_type != ACL_ENTRY_TYPE_ALLOW)
463 			continue;
464 
465 		meets = 0;
466 		if (i > 0) {
467 			meets = 1;
468 			previous = &(aclp->acl_entry[i - 1]);
469 
470 			/*
471 			 * 1.5.1.1. The type field is DENY,
472 			 */
473 			if (previous->ae_entry_type != ACL_ENTRY_TYPE_DENY)
474 				meets = 0;
475 
476 			/*
477 			 * 1.5.1.2. The "who" field is the same as the current
478 			 *          ACE,
479 			 *
480 			 * 1.5.1.3. The flag bit ACE4_IDENTIFIER_GROUP
481 			 *          is the same as it is in the current ACE,
482 			 *          and no other flag bits are set,
483 			 */
484 			if (previous->ae_id != entry->ae_id ||
485 			    previous->ae_tag != entry->ae_tag)
486 				meets = 0;
487 
488 			if (previous->ae_flags)
489 				meets = 0;
490 
491 			/*
492 			 * 1.5.1.4. The mask bits are a subset of the mask bits
493 			 *          of the current ACE, and are also subset of
494 			 *          the following: ACL_READ_DATA,
495 			 *          ACL_WRITE_DATA, ACL_APPEND_DATA, ACL_EXECUTE
496 			 */
497 			if (previous->ae_perm & ~(entry->ae_perm))
498 				meets = 0;
499 
500 			if (previous->ae_perm & ~(ACL_READ_DATA |
501 			    ACL_WRITE_DATA | ACL_APPEND_DATA | ACL_EXECUTE))
502 				meets = 0;
503 		}
504 
505 		if (!meets) {
506 			/*
507 		 	 * Then the ACE of type DENY, with a who equal
508 			 * to the current ACE, flag bits equal to
509 			 * (<current ACE flags> & <ACE_IDENTIFIER_GROUP>)
510 			 * and no mask bits, is prepended.
511 			 */
512 			previous = entry;
513 			entry = _acl_duplicate_entry(aclp, i);
514 
515 			/* Adjust counter, as we've just added an entry. */
516 			i++;
517 
518 			previous->ae_tag = entry->ae_tag;
519 			previous->ae_id = entry->ae_id;
520 			previous->ae_flags = entry->ae_flags;
521 			previous->ae_perm = 0;
522 			previous->ae_entry_type = ACL_ENTRY_TYPE_DENY;
523 		}
524 
525 		/*
526 		 * 1.5.2. The following modifications are made to the prepended
527 		 *        ACE.  The intent is to mask the following ACE
528 		 *        to disallow ACL_READ_DATA, ACL_WRITE_DATA,
529 		 *        ACL_APPEND_DATA, or ACL_EXECUTE, based upon the group
530 		 *        permissions of the new mode.  As a special case,
531 		 *        if the ACE matches the current owner of the file,
532 		 *        the owner bits are used, rather than the group bits.
533 		 *        This is reflected in the algorithm below.
534 		 */
535 		amode = mode >> 3;
536 
537 		/*
538 		 * If ACE4_IDENTIFIER_GROUP is not set, and the "who" field
539 		 * in ACE matches the owner of the file, we shift amode three
540 		 * more bits, in order to have the owner permission bits
541 		 * placed in the three low order bits of amode.
542 		 */
543 		if (entry->ae_tag == ACL_USER && entry->ae_id == file_owner_id)
544 			amode = amode >> 3;
545 
546 		if (entry->ae_perm & ACL_READ_DATA) {
547 			if (amode & READ)
548 				previous->ae_perm &= ~ACL_READ_DATA;
549 			else
550 				previous->ae_perm |= ACL_READ_DATA;
551 		}
552 
553 		if (entry->ae_perm & ACL_WRITE_DATA) {
554 			if (amode & WRITE)
555 				previous->ae_perm &= ~ACL_WRITE_DATA;
556 			else
557 				previous->ae_perm |= ACL_WRITE_DATA;
558 		}
559 
560 		if (entry->ae_perm & ACL_APPEND_DATA) {
561 			if (amode & WRITE)
562 				previous->ae_perm &= ~ACL_APPEND_DATA;
563 			else
564 				previous->ae_perm |= ACL_APPEND_DATA;
565 		}
566 
567 		if (entry->ae_perm & ACL_EXECUTE) {
568 			if (amode & EXEC)
569 				previous->ae_perm &= ~ACL_EXECUTE;
570 			else
571 				previous->ae_perm |= ACL_EXECUTE;
572 		}
573 
574 		/*
575 		 * 1.5.3. If ACE4_IDENTIFIER_GROUP is set in the flags
576 		 *        of the ALLOW ace:
577 		 *
578 		 * XXX: This point is not there in the Falkner's draft.
579 		 */
580 		if (entry->ae_tag == ACL_GROUP &&
581 		    entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW) {
582 			mode_t extramode, ownermode;
583 			extramode = (mode >> 3) & 07;
584 			ownermode = mode >> 6;
585 			extramode &= ~ownermode;
586 
587 			if (extramode) {
588 				if (extramode & READ) {
589 					entry->ae_perm &= ~ACL_READ_DATA;
590 					previous->ae_perm &= ~ACL_READ_DATA;
591 				}
592 
593 				if (extramode & WRITE) {
594 					entry->ae_perm &=
595 					    ~(ACL_WRITE_DATA | ACL_APPEND_DATA);
596 					previous->ae_perm &=
597 					    ~(ACL_WRITE_DATA | ACL_APPEND_DATA);
598 				}
599 
600 				if (extramode & EXEC) {
601 					entry->ae_perm &= ~ACL_EXECUTE;
602 					previous->ae_perm &= ~ACL_EXECUTE;
603 				}
604 			}
605 		}
606 	}
607 
608 	/*
609 	 * 2. If there at least six ACEs, the final six ACEs are examined.
610 	 *    If they are not equal to what we want, append six ACEs.
611 	 */
612 	must_append = 0;
613 	if (aclp->acl_cnt < 6) {
614 		must_append = 1;
615 	} else {
616 		a6 = &(aclp->acl_entry[aclp->acl_cnt - 1]);
617 		a5 = &(aclp->acl_entry[aclp->acl_cnt - 2]);
618 		a4 = &(aclp->acl_entry[aclp->acl_cnt - 3]);
619 		a3 = &(aclp->acl_entry[aclp->acl_cnt - 4]);
620 		a2 = &(aclp->acl_entry[aclp->acl_cnt - 5]);
621 		a1 = &(aclp->acl_entry[aclp->acl_cnt - 6]);
622 
623 		if (!_acl_entry_matches(a1, ACL_USER_OBJ, 0,
624 		    ACL_ENTRY_TYPE_DENY))
625 			must_append = 1;
626 		if (!_acl_entry_matches(a2, ACL_USER_OBJ, ACL_WRITE_ACL |
627 		    ACL_WRITE_OWNER | ACL_WRITE_ATTRIBUTES |
628 		    ACL_WRITE_NAMED_ATTRS, ACL_ENTRY_TYPE_ALLOW))
629 			must_append = 1;
630 		if (!_acl_entry_matches(a3, ACL_GROUP_OBJ, 0,
631 		    ACL_ENTRY_TYPE_DENY))
632 			must_append = 1;
633 		if (!_acl_entry_matches(a4, ACL_GROUP_OBJ, 0,
634 		    ACL_ENTRY_TYPE_ALLOW))
635 			must_append = 1;
636 		if (!_acl_entry_matches(a5, ACL_EVERYONE, ACL_WRITE_ACL |
637 		    ACL_WRITE_OWNER | ACL_WRITE_ATTRIBUTES |
638 		    ACL_WRITE_NAMED_ATTRS, ACL_ENTRY_TYPE_DENY))
639 			must_append = 1;
640 		if (!_acl_entry_matches(a6, ACL_EVERYONE, ACL_READ_ACL |
641 		    ACL_READ_ATTRIBUTES | ACL_READ_NAMED_ATTRS |
642 		    ACL_SYNCHRONIZE, ACL_ENTRY_TYPE_ALLOW))
643 			must_append = 1;
644 	}
645 
646 	if (must_append) {
647 		KASSERT(aclp->acl_cnt + 6 <= ACL_MAX_ENTRIES,
648 		    ("aclp->acl_cnt <= ACL_MAX_ENTRIES"));
649 
650 		a1 = _acl_append(aclp, ACL_USER_OBJ, 0, ACL_ENTRY_TYPE_DENY);
651 		a2 = _acl_append(aclp, ACL_USER_OBJ, ACL_WRITE_ACL |
652 		    ACL_WRITE_OWNER | ACL_WRITE_ATTRIBUTES |
653 		    ACL_WRITE_NAMED_ATTRS, ACL_ENTRY_TYPE_ALLOW);
654 		a3 = _acl_append(aclp, ACL_GROUP_OBJ, 0, ACL_ENTRY_TYPE_DENY);
655 		a4 = _acl_append(aclp, ACL_GROUP_OBJ, 0, ACL_ENTRY_TYPE_ALLOW);
656 		a5 = _acl_append(aclp, ACL_EVERYONE, ACL_WRITE_ACL |
657 		    ACL_WRITE_OWNER | ACL_WRITE_ATTRIBUTES |
658 		    ACL_WRITE_NAMED_ATTRS, ACL_ENTRY_TYPE_DENY);
659 		a6 = _acl_append(aclp, ACL_EVERYONE, ACL_READ_ACL |
660 		    ACL_READ_ATTRIBUTES | ACL_READ_NAMED_ATTRS |
661 		    ACL_SYNCHRONIZE, ACL_ENTRY_TYPE_ALLOW);
662 
663 		KASSERT(a1 != NULL && a2 != NULL && a3 != NULL && a4 != NULL &&
664 		    a5 != NULL && a6 != NULL, ("couldn't append to ACL."));
665 	}
666 
667 	/*
668 	 * 3. The final six ACEs are adjusted according to the incoming mode.
669 	 */
670 	if (mode & S_IRUSR)
671 		a2->ae_perm |= ACL_READ_DATA;
672 	else
673 		a1->ae_perm |= ACL_READ_DATA;
674 	if (mode & S_IWUSR)
675 		a2->ae_perm |= (ACL_WRITE_DATA | ACL_APPEND_DATA);
676 	else
677 		a1->ae_perm |= (ACL_WRITE_DATA | ACL_APPEND_DATA);
678 	if (mode & S_IXUSR)
679 		a2->ae_perm |= ACL_EXECUTE;
680 	else
681 		a1->ae_perm |= ACL_EXECUTE;
682 
683 	if (mode & S_IRGRP)
684 		a4->ae_perm |= ACL_READ_DATA;
685 	else
686 		a3->ae_perm |= ACL_READ_DATA;
687 	if (mode & S_IWGRP)
688 		a4->ae_perm |= (ACL_WRITE_DATA | ACL_APPEND_DATA);
689 	else
690 		a3->ae_perm |= (ACL_WRITE_DATA | ACL_APPEND_DATA);
691 	if (mode & S_IXGRP)
692 		a4->ae_perm |= ACL_EXECUTE;
693 	else
694 		a3->ae_perm |= ACL_EXECUTE;
695 
696 	if (mode & S_IROTH)
697 		a6->ae_perm |= ACL_READ_DATA;
698 	else
699 		a5->ae_perm |= ACL_READ_DATA;
700 	if (mode & S_IWOTH)
701 		a6->ae_perm |= (ACL_WRITE_DATA | ACL_APPEND_DATA);
702 	else
703 		a5->ae_perm |= (ACL_WRITE_DATA | ACL_APPEND_DATA);
704 	if (mode & S_IXOTH)
705 		a6->ae_perm |= ACL_EXECUTE;
706 	else
707 		a5->ae_perm |= ACL_EXECUTE;
708 }
709 
710 #ifdef _KERNEL
711 void
712 acl_nfs4_sync_acl_from_mode(struct acl *aclp, mode_t mode,
713     int file_owner_id)
714 {
715 
716 	if (acl_nfs4_old_semantics)
717 		acl_nfs4_sync_acl_from_mode_draft(aclp, mode, file_owner_id);
718 	else
719 		acl_nfs4_trivial_from_mode(aclp, mode);
720 }
721 #endif /* _KERNEL */
722 
723 void
724 acl_nfs4_sync_mode_from_acl(mode_t *_mode, const struct acl *aclp)
725 {
726 	int i;
727 	mode_t old_mode = *_mode, mode = 0, seen = 0;
728 	const struct acl_entry *entry;
729 
730 	KASSERT(aclp->acl_cnt <= ACL_MAX_ENTRIES,
731 	    ("aclp->acl_cnt <= ACL_MAX_ENTRIES"));
732 
733 	/*
734 	 * NFSv4 Minor Version 1, draft-ietf-nfsv4-minorversion1-03.txt
735 	 *
736 	 * 3.16.6.1. Recomputing mode upon SETATTR of ACL
737 	 */
738 
739 	for (i = 0; i < aclp->acl_cnt; i++) {
740 		entry = &(aclp->acl_entry[i]);
741 
742 		if (entry->ae_entry_type != ACL_ENTRY_TYPE_ALLOW &&
743 		    entry->ae_entry_type != ACL_ENTRY_TYPE_DENY)
744 			continue;
745 
746 		if (entry->ae_flags & ACL_ENTRY_INHERIT_ONLY)
747 			continue;
748 
749 		if (entry->ae_tag == ACL_USER_OBJ) {
750 			if ((entry->ae_perm & ACL_READ_DATA) &&
751 			    ((seen & S_IRUSR) == 0)) {
752 				seen |= S_IRUSR;
753 				if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
754 					mode |= S_IRUSR;
755 			}
756 			if ((entry->ae_perm & ACL_WRITE_DATA) &&
757 			     ((seen & S_IWUSR) == 0)) {
758 				seen |= S_IWUSR;
759 				if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
760 					mode |= S_IWUSR;
761 			}
762 			if ((entry->ae_perm & ACL_EXECUTE) &&
763 			    ((seen & S_IXUSR) == 0)) {
764 				seen |= S_IXUSR;
765 				if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
766 					mode |= S_IXUSR;
767 			}
768 		} else if (entry->ae_tag == ACL_GROUP_OBJ) {
769 			if ((entry->ae_perm & ACL_READ_DATA) &&
770 			    ((seen & S_IRGRP) == 0)) {
771 				seen |= S_IRGRP;
772 				if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
773 					mode |= S_IRGRP;
774 			}
775 			if ((entry->ae_perm & ACL_WRITE_DATA) &&
776 			    ((seen & S_IWGRP) == 0)) {
777 				seen |= S_IWGRP;
778 				if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
779 					mode |= S_IWGRP;
780 			}
781 			if ((entry->ae_perm & ACL_EXECUTE) &&
782 			    ((seen & S_IXGRP) == 0)) {
783 				seen |= S_IXGRP;
784 				if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
785 					mode |= S_IXGRP;
786 			}
787 		} else if (entry->ae_tag == ACL_EVERYONE) {
788 			if (entry->ae_perm & ACL_READ_DATA) {
789 				if ((seen & S_IRUSR) == 0) {
790 					seen |= S_IRUSR;
791 					if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
792 						mode |= S_IRUSR;
793 				}
794 				if ((seen & S_IRGRP) == 0) {
795 					seen |= S_IRGRP;
796 					if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
797 						mode |= S_IRGRP;
798 				}
799 				if ((seen & S_IROTH) == 0) {
800 					seen |= S_IROTH;
801 					if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
802 						mode |= S_IROTH;
803 				}
804 			}
805 			if (entry->ae_perm & ACL_WRITE_DATA) {
806 				if ((seen & S_IWUSR) == 0) {
807 					seen |= S_IWUSR;
808 					if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
809 						mode |= S_IWUSR;
810 				}
811 				if ((seen & S_IWGRP) == 0) {
812 					seen |= S_IWGRP;
813 					if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
814 						mode |= S_IWGRP;
815 				}
816 				if ((seen & S_IWOTH) == 0) {
817 					seen |= S_IWOTH;
818 					if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
819 						mode |= S_IWOTH;
820 				}
821 			}
822 			if (entry->ae_perm & ACL_EXECUTE) {
823 				if ((seen & S_IXUSR) == 0) {
824 					seen |= S_IXUSR;
825 					if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
826 						mode |= S_IXUSR;
827 				}
828 				if ((seen & S_IXGRP) == 0) {
829 					seen |= S_IXGRP;
830 					if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
831 						mode |= S_IXGRP;
832 				}
833 				if ((seen & S_IXOTH) == 0) {
834 					seen |= S_IXOTH;
835 					if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
836 						mode |= S_IXOTH;
837 				}
838 			}
839 		}
840 	}
841 
842 	*_mode = mode | (old_mode & ACL_PRESERVE_MASK);
843 }
844 
845 #ifdef _KERNEL
846 /*
847  * Calculate inherited ACL in a manner compatible with NFSv4 Minor Version 1,
848  * draft-ietf-nfsv4-minorversion1-03.txt.
849  */
850 static void
851 acl_nfs4_compute_inherited_acl_draft(const struct acl *parent_aclp,
852     struct acl *child_aclp, mode_t mode, int file_owner_id,
853     int is_directory)
854 {
855 	int i, flags;
856 	const struct acl_entry *parent_entry;
857 	struct acl_entry *entry, *copy;
858 
859 	KASSERT(child_aclp->acl_cnt == 0, ("child_aclp->acl_cnt == 0"));
860 	KASSERT(parent_aclp->acl_cnt <= ACL_MAX_ENTRIES,
861 	    ("parent_aclp->acl_cnt <= ACL_MAX_ENTRIES"));
862 
863 	/*
864 	 * NFSv4 Minor Version 1, draft-ietf-nfsv4-minorversion1-03.txt
865 	 *
866 	 * 3.16.6.2. Applying the mode given to CREATE or OPEN
867 	 *           to an inherited ACL
868 	 */
869 
870 	/*
871 	 * 1. Form an ACL that is the concatenation of all inheritable ACEs.
872 	 */
873 	for (i = 0; i < parent_aclp->acl_cnt; i++) {
874 		parent_entry = &(parent_aclp->acl_entry[i]);
875 		flags = parent_entry->ae_flags;
876 
877 		/*
878 		 * Entry is not inheritable at all.
879 		 */
880 		if ((flags & (ACL_ENTRY_DIRECTORY_INHERIT |
881 		    ACL_ENTRY_FILE_INHERIT)) == 0)
882 			continue;
883 
884 		/*
885 		 * We're creating a file, but entry is not inheritable
886 		 * by files.
887 		 */
888 		if (!is_directory && (flags & ACL_ENTRY_FILE_INHERIT) == 0)
889 			continue;
890 
891 		/*
892 		 * Entry is inheritable only by files, but has NO_PROPAGATE
893 		 * flag set, and we're creating a directory, so it wouldn't
894 		 * propagate to any file in that directory anyway.
895 		 */
896 		if (is_directory &&
897 		    (flags & ACL_ENTRY_DIRECTORY_INHERIT) == 0 &&
898 		    (flags & ACL_ENTRY_NO_PROPAGATE_INHERIT))
899 			continue;
900 
901 		KASSERT(child_aclp->acl_cnt + 1 <= ACL_MAX_ENTRIES,
902 		    ("child_aclp->acl_cnt + 1 <= ACL_MAX_ENTRIES"));
903 		child_aclp->acl_entry[child_aclp->acl_cnt] = *parent_entry;
904 		child_aclp->acl_cnt++;
905 	}
906 
907 	/*
908 	 * 2. For each entry in the new ACL, adjust its flags, possibly
909 	 *    creating two entries in place of one.
910 	 */
911 	for (i = 0; i < child_aclp->acl_cnt; i++) {
912 		entry = &(child_aclp->acl_entry[i]);
913 
914 		/*
915 		 * This is not in the specification, but SunOS
916 		 * apparently does that.
917 		 */
918 		if (((entry->ae_flags & ACL_ENTRY_NO_PROPAGATE_INHERIT) ||
919 		    !is_directory) &&
920 		    entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
921 			entry->ae_perm &= ~(ACL_WRITE_ACL | ACL_WRITE_OWNER);
922 
923 		/*
924 		 * 2.A. If the ACL_ENTRY_NO_PROPAGATE_INHERIT is set, or if the object
925 		 *      being created is not a directory, then clear the
926 		 *      following flags: ACL_ENTRY_NO_PROPAGATE_INHERIT,
927 		 *      ACL_ENTRY_FILE_INHERIT, ACL_ENTRY_DIRECTORY_INHERIT,
928 		 *      ACL_ENTRY_INHERIT_ONLY.
929 		 */
930 		if (entry->ae_flags & ACL_ENTRY_NO_PROPAGATE_INHERIT ||
931 		    !is_directory) {
932 			entry->ae_flags &= ~(ACL_ENTRY_NO_PROPAGATE_INHERIT |
933 			ACL_ENTRY_FILE_INHERIT | ACL_ENTRY_DIRECTORY_INHERIT |
934 			ACL_ENTRY_INHERIT_ONLY);
935 
936 			/*
937 			 * Continue on to the next ACE.
938 			 */
939 			continue;
940 		}
941 
942 		/*
943 		 * 2.B. If the object is a directory and ACL_ENTRY_FILE_INHERIT
944 		 *      is set, but ACL_ENTRY_NO_PROPAGATE_INHERIT is not set, ensure
945 		 *      that ACL_ENTRY_INHERIT_ONLY is set.  Continue to the
946 		 *      next ACE.  Otherwise...
947 		 */
948 		/*
949 		 * XXX: Read it again and make sure what does the "otherwise"
950 		 *      apply to.
951 		 */
952 		if (is_directory &&
953 		    (entry->ae_flags & ACL_ENTRY_FILE_INHERIT) &&
954 		    ((entry->ae_flags & ACL_ENTRY_DIRECTORY_INHERIT) == 0)) {
955 			entry->ae_flags |= ACL_ENTRY_INHERIT_ONLY;
956 			continue;
957 		}
958 
959 		/*
960 		 * 2.C. If the type of the ACE is neither ALLOW nor deny,
961 		 *      then continue.
962 		 */
963 		if (entry->ae_entry_type != ACL_ENTRY_TYPE_ALLOW &&
964 		    entry->ae_entry_type != ACL_ENTRY_TYPE_DENY)
965 			continue;
966 
967 		/*
968 		 * 2.D. Copy the original ACE into a second, adjacent ACE.
969 		 */
970 		copy = _acl_duplicate_entry(child_aclp, i);
971 
972 		/*
973 		 * 2.E. On the first ACE, ensure that ACL_ENTRY_INHERIT_ONLY
974 		 *      is set.
975 		 */
976 		entry->ae_flags |= ACL_ENTRY_INHERIT_ONLY;
977 
978 		/*
979 		 * 2.F. On the second ACE, clear the following flags:
980 		 *      ACL_ENTRY_NO_PROPAGATE_INHERIT, ACL_ENTRY_FILE_INHERIT,
981 		 *      ACL_ENTRY_DIRECTORY_INHERIT, ACL_ENTRY_INHERIT_ONLY.
982 		 */
983 		copy->ae_flags &= ~(ACL_ENTRY_NO_PROPAGATE_INHERIT |
984 		    ACL_ENTRY_FILE_INHERIT | ACL_ENTRY_DIRECTORY_INHERIT |
985 		    ACL_ENTRY_INHERIT_ONLY);
986 
987 		/*
988 		 * 2.G. On the second ACE, if the type is ALLOW,
989 		 *      an implementation MAY clear the following
990 		 *      mask bits: ACL_WRITE_ACL, ACL_WRITE_OWNER.
991 		 */
992 		if (copy->ae_entry_type == ACL_ENTRY_TYPE_ALLOW)
993 			copy->ae_perm &= ~(ACL_WRITE_ACL | ACL_WRITE_OWNER);
994 
995 		/*
996 		 * Increment the counter to skip the copied entry.
997 		 */
998 		i++;
999 	}
1000 
1001 	/*
1002 	 * 3. To ensure that the mode is honored, apply the algorithm describe
1003 	 *    in Section 2.16.6.3, using the mode that is to be used for file
1004 	 *    creation.
1005 	 */
1006 	acl_nfs4_sync_acl_from_mode(child_aclp, mode, file_owner_id);
1007 }
1008 #endif /* _KERNEL */
1009 
1010 /*
1011  * Populate the ACL with entries inherited from parent_aclp.
1012  */
1013 static void
1014 acl_nfs4_inherit_entries(const struct acl *parent_aclp,
1015     struct acl *child_aclp, mode_t mode, int file_owner_id,
1016     int is_directory)
1017 {
1018 	int i, flags, tag;
1019 	const struct acl_entry *parent_entry;
1020 	struct acl_entry *entry;
1021 
1022 	KASSERT(parent_aclp->acl_cnt <= ACL_MAX_ENTRIES,
1023 	    ("parent_aclp->acl_cnt <= ACL_MAX_ENTRIES"));
1024 
1025 	for (i = 0; i < parent_aclp->acl_cnt; i++) {
1026 		parent_entry = &(parent_aclp->acl_entry[i]);
1027 		flags = parent_entry->ae_flags;
1028 		tag = parent_entry->ae_tag;
1029 
1030 		/*
1031 		 * Don't inherit owner@, group@, or everyone@ entries.
1032 		 */
1033 		if (tag == ACL_USER_OBJ || tag == ACL_GROUP_OBJ ||
1034 		    tag == ACL_EVERYONE)
1035 			continue;
1036 
1037 		/*
1038 		 * Entry is not inheritable at all.
1039 		 */
1040 		if ((flags & (ACL_ENTRY_DIRECTORY_INHERIT |
1041 		    ACL_ENTRY_FILE_INHERIT)) == 0)
1042 			continue;
1043 
1044 		/*
1045 		 * We're creating a file, but entry is not inheritable
1046 		 * by files.
1047 		 */
1048 		if (!is_directory && (flags & ACL_ENTRY_FILE_INHERIT) == 0)
1049 			continue;
1050 
1051 		/*
1052 		 * Entry is inheritable only by files, but has NO_PROPAGATE
1053 		 * flag set, and we're creating a directory, so it wouldn't
1054 		 * propagate to any file in that directory anyway.
1055 		 */
1056 		if (is_directory &&
1057 		    (flags & ACL_ENTRY_DIRECTORY_INHERIT) == 0 &&
1058 		    (flags & ACL_ENTRY_NO_PROPAGATE_INHERIT))
1059 			continue;
1060 
1061 		/*
1062 		 * Entry qualifies for being inherited.
1063 		 */
1064 		KASSERT(child_aclp->acl_cnt + 1 <= ACL_MAX_ENTRIES,
1065 		    ("child_aclp->acl_cnt + 1 <= ACL_MAX_ENTRIES"));
1066 		entry = &(child_aclp->acl_entry[child_aclp->acl_cnt]);
1067 		*entry = *parent_entry;
1068 		child_aclp->acl_cnt++;
1069 
1070 		entry->ae_flags &= ~ACL_ENTRY_INHERIT_ONLY;
1071 		entry->ae_flags |= ACL_ENTRY_INHERITED;
1072 
1073 		/*
1074 		 * If the type of the ACE is neither ALLOW nor DENY,
1075 		 * then leave it as it is and proceed to the next one.
1076 		 */
1077 		if (entry->ae_entry_type != ACL_ENTRY_TYPE_ALLOW &&
1078 		    entry->ae_entry_type != ACL_ENTRY_TYPE_DENY)
1079 			continue;
1080 
1081 		/*
1082 		 * If the ACL_ENTRY_NO_PROPAGATE_INHERIT is set, or if
1083 		 * the object being created is not a directory, then clear
1084 		 * the following flags: ACL_ENTRY_NO_PROPAGATE_INHERIT,
1085 		 * ACL_ENTRY_FILE_INHERIT, ACL_ENTRY_DIRECTORY_INHERIT,
1086 		 * ACL_ENTRY_INHERIT_ONLY.
1087 		 */
1088 		if (entry->ae_flags & ACL_ENTRY_NO_PROPAGATE_INHERIT ||
1089 		    !is_directory) {
1090 			entry->ae_flags &= ~(ACL_ENTRY_NO_PROPAGATE_INHERIT |
1091 			ACL_ENTRY_FILE_INHERIT | ACL_ENTRY_DIRECTORY_INHERIT |
1092 			ACL_ENTRY_INHERIT_ONLY);
1093 		}
1094 
1095 		/*
1096 		 * If the object is a directory and ACL_ENTRY_FILE_INHERIT
1097 		 * is set, but ACL_ENTRY_DIRECTORY_INHERIT is not set, ensure
1098 		 * that ACL_ENTRY_INHERIT_ONLY is set.
1099 		 */
1100 		if (is_directory &&
1101 		    (entry->ae_flags & ACL_ENTRY_FILE_INHERIT) &&
1102 		    ((entry->ae_flags & ACL_ENTRY_DIRECTORY_INHERIT) == 0)) {
1103 			entry->ae_flags |= ACL_ENTRY_INHERIT_ONLY;
1104 		}
1105 
1106 		if (entry->ae_entry_type == ACL_ENTRY_TYPE_ALLOW &&
1107 		    (entry->ae_flags & ACL_ENTRY_INHERIT_ONLY) == 0) {
1108 			/*
1109 			 * Some permissions must never be inherited.
1110 			 */
1111 			entry->ae_perm &= ~(ACL_WRITE_ACL | ACL_WRITE_OWNER |
1112 			    ACL_WRITE_NAMED_ATTRS | ACL_WRITE_ATTRIBUTES);
1113 
1114 			/*
1115 			 * Others must be masked according to the file mode.
1116 			 */
1117 			if ((mode & S_IRGRP) == 0)
1118 				entry->ae_perm &= ~ACL_READ_DATA;
1119 			if ((mode & S_IWGRP) == 0)
1120 				entry->ae_perm &=
1121 				    ~(ACL_WRITE_DATA | ACL_APPEND_DATA);
1122 			if ((mode & S_IXGRP) == 0)
1123 				entry->ae_perm &= ~ACL_EXECUTE;
1124 		}
1125 	}
1126 }
1127 
1128 /*
1129  * Calculate inherited ACL in a manner compatible with PSARC/2010/029.
1130  * It's also being used to calculate a trivial ACL, by inheriting from
1131  * a NULL ACL.
1132  */
1133 static void
1134 acl_nfs4_compute_inherited_acl_psarc(const struct acl *parent_aclp,
1135     struct acl *aclp, mode_t mode, int file_owner_id, int is_directory)
1136 {
1137 	acl_perm_t user_allow_first = 0, user_deny = 0, group_deny = 0;
1138 	acl_perm_t user_allow, group_allow, everyone_allow;
1139 
1140 	KASSERT(aclp->acl_cnt == 0, ("aclp->acl_cnt == 0"));
1141 
1142 	user_allow = group_allow = everyone_allow = ACL_READ_ACL |
1143 	    ACL_READ_ATTRIBUTES | ACL_READ_NAMED_ATTRS | ACL_SYNCHRONIZE;
1144 	user_allow |= ACL_WRITE_ACL | ACL_WRITE_OWNER | ACL_WRITE_ATTRIBUTES |
1145 	    ACL_WRITE_NAMED_ATTRS;
1146 
1147 	if (mode & S_IRUSR)
1148 		user_allow |= ACL_READ_DATA;
1149 	if (mode & S_IWUSR)
1150 		user_allow |= (ACL_WRITE_DATA | ACL_APPEND_DATA);
1151 	if (mode & S_IXUSR)
1152 		user_allow |= ACL_EXECUTE;
1153 
1154 	if (mode & S_IRGRP)
1155 		group_allow |= ACL_READ_DATA;
1156 	if (mode & S_IWGRP)
1157 		group_allow |= (ACL_WRITE_DATA | ACL_APPEND_DATA);
1158 	if (mode & S_IXGRP)
1159 		group_allow |= ACL_EXECUTE;
1160 
1161 	if (mode & S_IROTH)
1162 		everyone_allow |= ACL_READ_DATA;
1163 	if (mode & S_IWOTH)
1164 		everyone_allow |= (ACL_WRITE_DATA | ACL_APPEND_DATA);
1165 	if (mode & S_IXOTH)
1166 		everyone_allow |= ACL_EXECUTE;
1167 
1168 	user_deny = ((group_allow | everyone_allow) & ~user_allow);
1169 	group_deny = everyone_allow & ~group_allow;
1170 	user_allow_first = group_deny & ~user_deny;
1171 
1172 	if (user_allow_first != 0)
1173 		_acl_append(aclp, ACL_USER_OBJ, user_allow_first,
1174 		    ACL_ENTRY_TYPE_ALLOW);
1175 	if (user_deny != 0)
1176 		_acl_append(aclp, ACL_USER_OBJ, user_deny,
1177 		    ACL_ENTRY_TYPE_DENY);
1178 	if (group_deny != 0)
1179 		_acl_append(aclp, ACL_GROUP_OBJ, group_deny,
1180 		    ACL_ENTRY_TYPE_DENY);
1181 
1182 	if (parent_aclp != NULL)
1183 		acl_nfs4_inherit_entries(parent_aclp, aclp, mode,
1184 		    file_owner_id, is_directory);
1185 
1186 	_acl_append(aclp, ACL_USER_OBJ, user_allow, ACL_ENTRY_TYPE_ALLOW);
1187 	_acl_append(aclp, ACL_GROUP_OBJ, group_allow, ACL_ENTRY_TYPE_ALLOW);
1188 	_acl_append(aclp, ACL_EVERYONE, everyone_allow, ACL_ENTRY_TYPE_ALLOW);
1189 }
1190 
1191 #ifdef _KERNEL
1192 void
1193 acl_nfs4_compute_inherited_acl(const struct acl *parent_aclp,
1194     struct acl *child_aclp, mode_t mode, int file_owner_id,
1195     int is_directory)
1196 {
1197 
1198 	if (acl_nfs4_old_semantics)
1199 		acl_nfs4_compute_inherited_acl_draft(parent_aclp, child_aclp,
1200 		    mode, file_owner_id, is_directory);
1201 	else
1202 		acl_nfs4_compute_inherited_acl_psarc(parent_aclp, child_aclp,
1203 		    mode, file_owner_id, is_directory);
1204 }
1205 #endif /* _KERNEL */
1206 
1207 /*
1208  * Calculate trivial ACL in a manner compatible with PSARC/2010/029.
1209  * Note that this results in an ACL different from (but semantically
1210  * equal to) the "canonical six" trivial ACL computed using algorithm
1211  * described in draft-ietf-nfsv4-minorversion1-03.txt, 3.16.6.2.
1212  */
1213 static void
1214 acl_nfs4_trivial_from_mode(struct acl *aclp, mode_t mode)
1215 {
1216 
1217 	aclp->acl_cnt = 0;
1218 	acl_nfs4_compute_inherited_acl_psarc(NULL, aclp, mode, -1, -1);
1219 }
1220 
1221 #ifndef _KERNEL
1222 /*
1223  * This routine is used by libc to implement acl_strip_np(3)
1224  * and acl_is_trivial_np(3).
1225  */
1226 void
1227 acl_nfs4_trivial_from_mode_libc(struct acl *aclp, int mode, int canonical_six)
1228 {
1229 
1230 	aclp->acl_cnt = 0;
1231 	if (canonical_six)
1232 		acl_nfs4_sync_acl_from_mode_draft(aclp, mode, -1);
1233 	else
1234 		acl_nfs4_trivial_from_mode(aclp, mode);
1235 }
1236 #endif /* !_KERNEL */
1237 
1238 #ifdef _KERNEL
1239 static int
1240 _acls_are_equal(const struct acl *a, const struct acl *b)
1241 {
1242 	int i;
1243 	const struct acl_entry *entrya, *entryb;
1244 
1245 	if (a->acl_cnt != b->acl_cnt)
1246 		return (0);
1247 
1248 	for (i = 0; i < b->acl_cnt; i++) {
1249 		entrya = &(a->acl_entry[i]);
1250 		entryb = &(b->acl_entry[i]);
1251 
1252 		if (entrya->ae_tag != entryb->ae_tag ||
1253 		    entrya->ae_id != entryb->ae_id ||
1254 		    entrya->ae_perm != entryb->ae_perm ||
1255 		    entrya->ae_entry_type != entryb->ae_entry_type ||
1256 		    entrya->ae_flags != entryb->ae_flags)
1257 			return (0);
1258 	}
1259 
1260 	return (1);
1261 }
1262 
1263 /*
1264  * This routine is used to determine whether to remove extended attribute
1265  * that stores ACL contents.
1266  */
1267 int
1268 acl_nfs4_is_trivial(const struct acl *aclp, int file_owner_id)
1269 {
1270 	int trivial;
1271 	mode_t tmpmode = 0;
1272 	struct acl *tmpaclp;
1273 
1274 	if (aclp->acl_cnt > 6)
1275 		return (0);
1276 
1277 	/*
1278 	 * Compute the mode from the ACL, then compute new ACL from that mode.
1279 	 * If the ACLs are identical, then the ACL is trivial.
1280 	 *
1281 	 * XXX: I guess there is a faster way to do this.  However, even
1282 	 *      this slow implementation significantly speeds things up
1283 	 *      for files that don't have non-trivial ACLs - it's critical
1284 	 *      for performance to not use EA when they are not needed.
1285 	 *
1286 	 * First try the PSARC/2010/029 semantics.
1287 	 */
1288 	tmpaclp = acl_alloc(M_WAITOK | M_ZERO);
1289 	acl_nfs4_sync_mode_from_acl(&tmpmode, aclp);
1290 	acl_nfs4_trivial_from_mode(tmpaclp, tmpmode);
1291 	trivial = _acls_are_equal(aclp, tmpaclp);
1292 	if (trivial) {
1293 		acl_free(tmpaclp);
1294 		return (trivial);
1295 	}
1296 
1297 	/*
1298 	 * Check if it's a draft-ietf-nfsv4-minorversion1-03.txt trivial ACL.
1299 	 */
1300 	tmpaclp->acl_cnt = 0;
1301 	acl_nfs4_sync_acl_from_mode_draft(tmpaclp, tmpmode, file_owner_id);
1302 	trivial = _acls_are_equal(aclp, tmpaclp);
1303 	acl_free(tmpaclp);
1304 
1305 	return (trivial);
1306 }
1307 #endif /* _KERNEL */
1308 
1309 int
1310 acl_nfs4_check(const struct acl *aclp, int is_directory)
1311 {
1312 	int i;
1313 	const struct acl_entry *entry;
1314 
1315 	/*
1316 	 * The spec doesn't seem to say anything about ACL validity.
1317 	 * It seems there is not much to do here.  There is even no need
1318 	 * to count "owner@" or "everyone@" (ACL_USER_OBJ and ACL_EVERYONE)
1319 	 * entries, as there can be several of them and that's perfectly
1320 	 * valid.  There can be none of them too.  Really.
1321 	 */
1322 
1323 	if (aclp->acl_cnt > ACL_MAX_ENTRIES || aclp->acl_cnt <= 0)
1324 		return (EINVAL);
1325 
1326 	for (i = 0; i < aclp->acl_cnt; i++) {
1327 		entry = &(aclp->acl_entry[i]);
1328 
1329 		switch (entry->ae_tag) {
1330 		case ACL_USER_OBJ:
1331 		case ACL_GROUP_OBJ:
1332 		case ACL_EVERYONE:
1333 			if (entry->ae_id != ACL_UNDEFINED_ID)
1334 				return (EINVAL);
1335 			break;
1336 
1337 		case ACL_USER:
1338 		case ACL_GROUP:
1339 			if (entry->ae_id == ACL_UNDEFINED_ID)
1340 				return (EINVAL);
1341 			break;
1342 
1343 		default:
1344 			return (EINVAL);
1345 		}
1346 
1347 		if ((entry->ae_perm | ACL_NFS4_PERM_BITS) != ACL_NFS4_PERM_BITS)
1348 			return (EINVAL);
1349 
1350 		/*
1351 		 * Disallow ACL_ENTRY_TYPE_AUDIT and ACL_ENTRY_TYPE_ALARM for now.
1352 		 */
1353 		if (entry->ae_entry_type != ACL_ENTRY_TYPE_ALLOW &&
1354 		    entry->ae_entry_type != ACL_ENTRY_TYPE_DENY)
1355 			return (EINVAL);
1356 
1357 		if ((entry->ae_flags | ACL_FLAGS_BITS) != ACL_FLAGS_BITS)
1358 			return (EINVAL);
1359 
1360 		/* Disallow unimplemented flags. */
1361 		if (entry->ae_flags & (ACL_ENTRY_SUCCESSFUL_ACCESS |
1362 		    ACL_ENTRY_FAILED_ACCESS))
1363 			return (EINVAL);
1364 
1365 		/* Disallow flags not allowed for ordinary files. */
1366 		if (!is_directory) {
1367 			if (entry->ae_flags & (ACL_ENTRY_FILE_INHERIT |
1368 			    ACL_ENTRY_DIRECTORY_INHERIT |
1369 			    ACL_ENTRY_NO_PROPAGATE_INHERIT | ACL_ENTRY_INHERIT_ONLY))
1370 				return (EINVAL);
1371 		}
1372 	}
1373 
1374 	return (0);
1375 }
1376 
1377 #ifdef	_KERNEL
1378 static int
1379 acl_nfs4_modload(module_t module, int what, void *arg)
1380 {
1381 	int ret;
1382 
1383 	ret = 0;
1384 
1385 	switch (what) {
1386 	case MOD_LOAD:
1387 	case MOD_SHUTDOWN:
1388 		break;
1389 
1390 	case MOD_QUIESCE:
1391 		/* XXX TODO */
1392 		ret = 0;
1393 		break;
1394 
1395 	case MOD_UNLOAD:
1396 		/* XXX TODO */
1397 		ret = 0;
1398 		break;
1399 	default:
1400 		ret = EINVAL;
1401 		break;
1402 	}
1403 
1404 	return (ret);
1405 }
1406 
1407 static moduledata_t acl_nfs4_mod = {
1408 	"acl_nfs4",
1409 	acl_nfs4_modload,
1410 	NULL
1411 };
1412 
1413 /*
1414  * XXX TODO: which subsystem, order?
1415  */
1416 DECLARE_MODULE(acl_nfs4, acl_nfs4_mod, SI_SUB_VFS, SI_ORDER_FIRST);
1417 MODULE_VERSION(acl_nfs4, 1);
1418 #endif	/* _KERNEL */
1419