1 /*- 2 * SPDX-License-Identifier: BSD-3-Clause 3 * 4 * Copyright (c) 1982, 1986, 1989, 1993 5 * The Regents of the University of California. All rights reserved. 6 * (c) UNIX System Laboratories, Inc. 7 * All or some portions of this file are derived from material licensed 8 * to the University of California by American Telephone and Telegraph 9 * Co. or Unix System Laboratories, Inc. and are reproduced herein with 10 * the permission of UNIX System Laboratories, Inc. 11 * 12 * Redistribution and use in source and binary forms, with or without 13 * modification, are permitted provided that the following conditions 14 * are met: 15 * 1. Redistributions of source code must retain the above copyright 16 * notice, this list of conditions and the following disclaimer. 17 * 2. Redistributions in binary form must reproduce the above copyright 18 * notice, this list of conditions and the following disclaimer in the 19 * documentation and/or other materials provided with the distribution. 20 * 3. Neither the name of the University nor the names of its contributors 21 * may be used to endorse or promote products derived from this software 22 * without specific prior written permission. 23 * 24 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 25 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 26 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 27 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 28 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 29 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 30 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 31 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 32 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 33 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 34 * SUCH DAMAGE. 35 * 36 * @(#)vfs_lookup.c 8.4 (Berkeley) 2/16/94 37 */ 38 39 #include <sys/cdefs.h> 40 __FBSDID("$FreeBSD$"); 41 42 #include "opt_capsicum.h" 43 #include "opt_ktrace.h" 44 45 #include <sys/param.h> 46 #include <sys/systm.h> 47 #include <sys/kernel.h> 48 #include <sys/capsicum.h> 49 #include <sys/fcntl.h> 50 #include <sys/jail.h> 51 #include <sys/lock.h> 52 #include <sys/mutex.h> 53 #include <sys/namei.h> 54 #include <sys/vnode.h> 55 #include <sys/mount.h> 56 #include <sys/filedesc.h> 57 #include <sys/proc.h> 58 #include <sys/sdt.h> 59 #include <sys/syscallsubr.h> 60 #include <sys/sysctl.h> 61 #ifdef KTRACE 62 #include <sys/ktrace.h> 63 #endif 64 65 #include <security/audit/audit.h> 66 #include <security/mac/mac_framework.h> 67 68 #include <vm/uma.h> 69 70 #define NAMEI_DIAGNOSTIC 1 71 #undef NAMEI_DIAGNOSTIC 72 73 SDT_PROVIDER_DECLARE(vfs); 74 SDT_PROBE_DEFINE3(vfs, namei, lookup, entry, "struct vnode *", "char *", 75 "unsigned long"); 76 SDT_PROBE_DEFINE2(vfs, namei, lookup, return, "int", "struct vnode *"); 77 78 /* Allocation zone for namei. */ 79 uma_zone_t namei_zone; 80 81 /* Placeholder vnode for mp traversal. */ 82 static struct vnode *vp_crossmp; 83 84 static int 85 crossmp_vop_islocked(struct vop_islocked_args *ap) 86 { 87 88 return (LK_SHARED); 89 } 90 91 static int 92 crossmp_vop_lock1(struct vop_lock1_args *ap) 93 { 94 struct vnode *vp; 95 struct lock *lk __unused; 96 const char *file __unused; 97 int flags, line __unused; 98 99 vp = ap->a_vp; 100 lk = vp->v_vnlock; 101 flags = ap->a_flags; 102 file = ap->a_file; 103 line = ap->a_line; 104 105 if ((flags & LK_SHARED) == 0) 106 panic("invalid lock request for crossmp"); 107 108 WITNESS_CHECKORDER(&lk->lock_object, LOP_NEWORDER, file, line, 109 flags & LK_INTERLOCK ? &VI_MTX(vp)->lock_object : NULL); 110 WITNESS_LOCK(&lk->lock_object, 0, file, line); 111 if ((flags & LK_INTERLOCK) != 0) 112 VI_UNLOCK(vp); 113 LOCK_LOG_LOCK("SLOCK", &lk->lock_object, 0, 0, ap->a_file, line); 114 return (0); 115 } 116 117 static int 118 crossmp_vop_unlock(struct vop_unlock_args *ap) 119 { 120 struct vnode *vp; 121 struct lock *lk __unused; 122 123 vp = ap->a_vp; 124 lk = vp->v_vnlock; 125 126 WITNESS_UNLOCK(&lk->lock_object, 0, LOCK_FILE, LOCK_LINE); 127 LOCK_LOG_LOCK("SUNLOCK", &lk->lock_object, 0, 0, LOCK_FILE, 128 LOCK_LINE); 129 return (0); 130 } 131 132 static struct vop_vector crossmp_vnodeops = { 133 .vop_default = &default_vnodeops, 134 .vop_islocked = crossmp_vop_islocked, 135 .vop_lock1 = crossmp_vop_lock1, 136 .vop_unlock = crossmp_vop_unlock, 137 }; 138 /* 139 * VFS_VOP_VECTOR_REGISTER(crossmp_vnodeops) is not used here since the vnode 140 * gets allocated early. See nameiinit for the direct call below. 141 */ 142 143 struct nameicap_tracker { 144 struct vnode *dp; 145 TAILQ_ENTRY(nameicap_tracker) nm_link; 146 }; 147 148 /* Zone for cap mode tracker elements used for dotdot capability checks. */ 149 static uma_zone_t nt_zone; 150 151 static void 152 nameiinit(void *dummy __unused) 153 { 154 155 namei_zone = uma_zcreate("NAMEI", MAXPATHLEN, NULL, NULL, NULL, NULL, 156 UMA_ALIGN_PTR, 0); 157 nt_zone = uma_zcreate("rentr", sizeof(struct nameicap_tracker), 158 NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, 0); 159 vfs_vector_op_register(&crossmp_vnodeops); 160 getnewvnode("crossmp", NULL, &crossmp_vnodeops, &vp_crossmp); 161 } 162 SYSINIT(vfs, SI_SUB_VFS, SI_ORDER_SECOND, nameiinit, NULL); 163 164 static int lookup_cap_dotdot = 1; 165 SYSCTL_INT(_vfs, OID_AUTO, lookup_cap_dotdot, CTLFLAG_RWTUN, 166 &lookup_cap_dotdot, 0, 167 "enables \"..\" components in path lookup in capability mode"); 168 static int lookup_cap_dotdot_nonlocal = 1; 169 SYSCTL_INT(_vfs, OID_AUTO, lookup_cap_dotdot_nonlocal, CTLFLAG_RWTUN, 170 &lookup_cap_dotdot_nonlocal, 0, 171 "enables \"..\" components in path lookup in capability mode " 172 "on non-local mount"); 173 174 static void 175 nameicap_tracker_add(struct nameidata *ndp, struct vnode *dp) 176 { 177 struct nameicap_tracker *nt; 178 179 if ((ndp->ni_lcf & NI_LCF_CAP_DOTDOT) == 0 || dp->v_type != VDIR) 180 return; 181 if ((ndp->ni_lcf & (NI_LCF_BENEATH_ABS | NI_LCF_BENEATH_LATCHED)) == 182 NI_LCF_BENEATH_ABS) { 183 MPASS((ndp->ni_lcf & NI_LCF_LATCH) != 0); 184 if (dp != ndp->ni_beneath_latch) 185 return; 186 ndp->ni_lcf |= NI_LCF_BENEATH_LATCHED; 187 } 188 nt = uma_zalloc(nt_zone, M_WAITOK); 189 vhold(dp); 190 nt->dp = dp; 191 TAILQ_INSERT_TAIL(&ndp->ni_cap_tracker, nt, nm_link); 192 } 193 194 static void 195 nameicap_cleanup(struct nameidata *ndp, bool clean_latch) 196 { 197 struct nameicap_tracker *nt, *nt1; 198 199 KASSERT(TAILQ_EMPTY(&ndp->ni_cap_tracker) || 200 (ndp->ni_lcf & NI_LCF_CAP_DOTDOT) != 0, ("not strictrelative")); 201 TAILQ_FOREACH_SAFE(nt, &ndp->ni_cap_tracker, nm_link, nt1) { 202 TAILQ_REMOVE(&ndp->ni_cap_tracker, nt, nm_link); 203 vdrop(nt->dp); 204 uma_zfree(nt_zone, nt); 205 } 206 if (clean_latch && (ndp->ni_lcf & NI_LCF_LATCH) != 0) { 207 ndp->ni_lcf &= ~NI_LCF_LATCH; 208 vrele(ndp->ni_beneath_latch); 209 } 210 } 211 212 /* 213 * For dotdot lookups in capability mode, only allow the component 214 * lookup to succeed if the resulting directory was already traversed 215 * during the operation. Also fail dotdot lookups for non-local 216 * filesystems, where external agents might assist local lookups to 217 * escape the compartment. 218 */ 219 static int 220 nameicap_check_dotdot(struct nameidata *ndp, struct vnode *dp) 221 { 222 struct nameicap_tracker *nt; 223 struct mount *mp; 224 225 if ((ndp->ni_lcf & NI_LCF_CAP_DOTDOT) == 0 || dp == NULL || 226 dp->v_type != VDIR) 227 return (0); 228 mp = dp->v_mount; 229 if (lookup_cap_dotdot_nonlocal == 0 && mp != NULL && 230 (mp->mnt_flag & MNT_LOCAL) == 0) 231 return (ENOTCAPABLE); 232 TAILQ_FOREACH_REVERSE(nt, &ndp->ni_cap_tracker, nameicap_tracker_head, 233 nm_link) { 234 if (dp == nt->dp) 235 return (0); 236 } 237 if ((ndp->ni_lcf & NI_LCF_BENEATH_ABS) != 0) { 238 ndp->ni_lcf &= ~NI_LCF_BENEATH_LATCHED; 239 nameicap_cleanup(ndp, false); 240 return (0); 241 } 242 return (ENOTCAPABLE); 243 } 244 245 static void 246 namei_cleanup_cnp(struct componentname *cnp) 247 { 248 249 uma_zfree(namei_zone, cnp->cn_pnbuf); 250 #ifdef DIAGNOSTIC 251 cnp->cn_pnbuf = NULL; 252 cnp->cn_nameptr = NULL; 253 #endif 254 } 255 256 static int 257 namei_handle_root(struct nameidata *ndp, struct vnode **dpp, u_int n) 258 { 259 struct componentname *cnp; 260 261 cnp = &ndp->ni_cnd; 262 if ((ndp->ni_lcf & NI_LCF_STRICTRELATIVE) != 0) { 263 #ifdef KTRACE 264 if (KTRPOINT(curthread, KTR_CAPFAIL)) 265 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 266 #endif 267 return (ENOTCAPABLE); 268 } 269 if ((cnp->cn_flags & BENEATH) != 0) { 270 ndp->ni_lcf |= NI_LCF_BENEATH_ABS; 271 ndp->ni_lcf &= ~NI_LCF_BENEATH_LATCHED; 272 nameicap_cleanup(ndp, false); 273 } 274 while (*(cnp->cn_nameptr) == '/') { 275 cnp->cn_nameptr++; 276 ndp->ni_pathlen--; 277 } 278 *dpp = ndp->ni_rootdir; 279 vrefactn(*dpp, n); 280 return (0); 281 } 282 283 /* 284 * Convert a pathname into a pointer to a locked vnode. 285 * 286 * The FOLLOW flag is set when symbolic links are to be followed 287 * when they occur at the end of the name translation process. 288 * Symbolic links are always followed for all other pathname 289 * components other than the last. 290 * 291 * The segflg defines whether the name is to be copied from user 292 * space or kernel space. 293 * 294 * Overall outline of namei: 295 * 296 * copy in name 297 * get starting directory 298 * while (!done && !error) { 299 * call lookup to search path. 300 * if symbolic link, massage name in buffer and continue 301 * } 302 */ 303 int 304 namei(struct nameidata *ndp) 305 { 306 struct filedesc *fdp; /* pointer to file descriptor state */ 307 char *cp; /* pointer into pathname argument */ 308 struct vnode *dp; /* the directory we are searching */ 309 struct iovec aiov; /* uio for reading symbolic links */ 310 struct componentname *cnp; 311 struct file *dfp; 312 struct thread *td; 313 struct proc *p; 314 cap_rights_t rights; 315 struct filecaps dirfd_caps; 316 struct uio auio; 317 int error, linklen, startdir_used; 318 319 cnp = &ndp->ni_cnd; 320 td = cnp->cn_thread; 321 p = td->td_proc; 322 ndp->ni_cnd.cn_cred = ndp->ni_cnd.cn_thread->td_ucred; 323 KASSERT(cnp->cn_cred && p, ("namei: bad cred/proc")); 324 KASSERT((cnp->cn_nameiop & (~OPMASK)) == 0, 325 ("namei: nameiop contaminated with flags")); 326 KASSERT((cnp->cn_flags & OPMASK) == 0, 327 ("namei: flags contaminated with nameiops")); 328 MPASS(ndp->ni_startdir == NULL || ndp->ni_startdir->v_type == VDIR || 329 ndp->ni_startdir->v_type == VBAD); 330 fdp = p->p_fd; 331 TAILQ_INIT(&ndp->ni_cap_tracker); 332 ndp->ni_lcf = 0; 333 334 /* We will set this ourselves if we need it. */ 335 cnp->cn_flags &= ~TRAILINGSLASH; 336 337 /* 338 * Get a buffer for the name to be translated, and copy the 339 * name into the buffer. 340 */ 341 if ((cnp->cn_flags & HASBUF) == 0) 342 cnp->cn_pnbuf = uma_zalloc(namei_zone, M_WAITOK); 343 if (ndp->ni_segflg == UIO_SYSSPACE) 344 error = copystr(ndp->ni_dirp, cnp->cn_pnbuf, MAXPATHLEN, 345 &ndp->ni_pathlen); 346 else 347 error = copyinstr(ndp->ni_dirp, cnp->cn_pnbuf, MAXPATHLEN, 348 &ndp->ni_pathlen); 349 350 /* 351 * Don't allow empty pathnames. 352 */ 353 if (error == 0 && *cnp->cn_pnbuf == '\0') 354 error = ENOENT; 355 356 #ifdef CAPABILITY_MODE 357 /* 358 * In capability mode, lookups must be restricted to happen in 359 * the subtree with the root specified by the file descriptor: 360 * - The root must be real file descriptor, not the pseudo-descriptor 361 * AT_FDCWD. 362 * - The passed path must be relative and not absolute. 363 * - If lookup_cap_dotdot is disabled, path must not contain the 364 * '..' components. 365 * - If lookup_cap_dotdot is enabled, we verify that all '..' 366 * components lookups result in the directories which were 367 * previously walked by us, which prevents an escape from 368 * the relative root. 369 */ 370 if (error == 0 && IN_CAPABILITY_MODE(td) && 371 (cnp->cn_flags & NOCAPCHECK) == 0) { 372 ndp->ni_lcf |= NI_LCF_STRICTRELATIVE; 373 if (ndp->ni_dirfd == AT_FDCWD) { 374 #ifdef KTRACE 375 if (KTRPOINT(td, KTR_CAPFAIL)) 376 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 377 #endif 378 error = ECAPMODE; 379 } 380 } 381 #endif 382 if (error != 0) { 383 namei_cleanup_cnp(cnp); 384 ndp->ni_vp = NULL; 385 return (error); 386 } 387 ndp->ni_loopcnt = 0; 388 #ifdef KTRACE 389 if (KTRPOINT(td, KTR_NAMEI)) { 390 KASSERT(cnp->cn_thread == curthread, 391 ("namei not using curthread")); 392 ktrnamei(cnp->cn_pnbuf); 393 } 394 #endif 395 /* 396 * Get starting point for the translation. 397 */ 398 FILEDESC_SLOCK(fdp); 399 /* 400 * The reference on ni_rootdir is acquired in the block below to avoid 401 * back-to-back atomics for absolute lookups. 402 */ 403 ndp->ni_rootdir = fdp->fd_rdir; 404 ndp->ni_topdir = fdp->fd_jdir; 405 406 /* 407 * If we are auditing the kernel pathname, save the user pathname. 408 */ 409 if (cnp->cn_flags & AUDITVNODE1) 410 AUDIT_ARG_UPATH1(td, ndp->ni_dirfd, cnp->cn_pnbuf); 411 if (cnp->cn_flags & AUDITVNODE2) 412 AUDIT_ARG_UPATH2(td, ndp->ni_dirfd, cnp->cn_pnbuf); 413 414 startdir_used = 0; 415 dp = NULL; 416 cnp->cn_nameptr = cnp->cn_pnbuf; 417 if (cnp->cn_pnbuf[0] == '/') { 418 ndp->ni_resflags |= NIRES_ABS; 419 error = namei_handle_root(ndp, &dp, 2); 420 if (error != 0) { 421 /* 422 * Simplify error handling, we should almost never be 423 * here. 424 */ 425 vrefact(ndp->ni_rootdir); 426 } 427 } else { 428 if (ndp->ni_startdir != NULL) { 429 vrefact(ndp->ni_rootdir); 430 dp = ndp->ni_startdir; 431 startdir_used = 1; 432 } else if (ndp->ni_dirfd == AT_FDCWD) { 433 dp = fdp->fd_cdir; 434 if (dp == ndp->ni_rootdir) { 435 vrefactn(dp, 2); 436 } else { 437 vrefact(ndp->ni_rootdir); 438 vrefact(dp); 439 } 440 } else { 441 vrefact(ndp->ni_rootdir); 442 rights = ndp->ni_rightsneeded; 443 cap_rights_set(&rights, CAP_LOOKUP); 444 445 if (cnp->cn_flags & AUDITVNODE1) 446 AUDIT_ARG_ATFD1(ndp->ni_dirfd); 447 if (cnp->cn_flags & AUDITVNODE2) 448 AUDIT_ARG_ATFD2(ndp->ni_dirfd); 449 /* 450 * Effectively inlined fgetvp_rights, because we need to 451 * inspect the file as well as grabbing the vnode. 452 */ 453 error = fget_cap_locked(fdp, ndp->ni_dirfd, &rights, 454 &dfp, &ndp->ni_filecaps); 455 if (error != 0 || dfp->f_ops == &badfileops || 456 dfp->f_vnode == NULL) { 457 error = ENOTDIR; 458 } else { 459 dp = dfp->f_vnode; 460 vrefact(dp); 461 462 if ((dfp->f_flag & FSEARCH) != 0) 463 cnp->cn_flags |= NOEXECCHECK; 464 } 465 #ifdef CAPABILITIES 466 /* 467 * If file descriptor doesn't have all rights, 468 * all lookups relative to it must also be 469 * strictly relative. 470 */ 471 CAP_ALL(&rights); 472 if (!cap_rights_contains(&ndp->ni_filecaps.fc_rights, 473 &rights) || 474 ndp->ni_filecaps.fc_fcntls != CAP_FCNTL_ALL || 475 ndp->ni_filecaps.fc_nioctls != -1) { 476 ndp->ni_lcf |= NI_LCF_STRICTRELATIVE; 477 } 478 #endif 479 } 480 if (error == 0 && dp->v_type != VDIR) 481 error = ENOTDIR; 482 } 483 if (error == 0 && (cnp->cn_flags & BENEATH) != 0) { 484 if (ndp->ni_dirfd == AT_FDCWD) { 485 ndp->ni_beneath_latch = fdp->fd_cdir; 486 vrefact(ndp->ni_beneath_latch); 487 } else { 488 rights = ndp->ni_rightsneeded; 489 cap_rights_set(&rights, CAP_LOOKUP); 490 error = fgetvp_rights(td, ndp->ni_dirfd, &rights, 491 &dirfd_caps, &ndp->ni_beneath_latch); 492 if (error == 0 && dp->v_type != VDIR) { 493 vrele(ndp->ni_beneath_latch); 494 error = ENOTDIR; 495 } 496 } 497 if (error == 0) 498 ndp->ni_lcf |= NI_LCF_LATCH; 499 } 500 FILEDESC_SUNLOCK(fdp); 501 if (ndp->ni_startdir != NULL && !startdir_used) 502 vrele(ndp->ni_startdir); 503 if (error != 0) { 504 if (dp != NULL) 505 vrele(dp); 506 goto out; 507 } 508 MPASS((ndp->ni_lcf & (NI_LCF_BENEATH_ABS | NI_LCF_LATCH)) != 509 NI_LCF_BENEATH_ABS); 510 if (((ndp->ni_lcf & NI_LCF_STRICTRELATIVE) != 0 && 511 lookup_cap_dotdot != 0) || 512 ((ndp->ni_lcf & NI_LCF_STRICTRELATIVE) == 0 && 513 (cnp->cn_flags & BENEATH) != 0)) 514 ndp->ni_lcf |= NI_LCF_CAP_DOTDOT; 515 SDT_PROBE3(vfs, namei, lookup, entry, dp, cnp->cn_pnbuf, 516 cnp->cn_flags); 517 for (;;) { 518 ndp->ni_startdir = dp; 519 error = lookup(ndp); 520 if (error != 0) 521 goto out; 522 /* 523 * If not a symbolic link, we're done. 524 */ 525 if ((cnp->cn_flags & ISSYMLINK) == 0) { 526 vrele(ndp->ni_rootdir); 527 if ((cnp->cn_flags & (SAVENAME | SAVESTART)) == 0) { 528 namei_cleanup_cnp(cnp); 529 } else 530 cnp->cn_flags |= HASBUF; 531 if ((ndp->ni_lcf & (NI_LCF_BENEATH_ABS | 532 NI_LCF_BENEATH_LATCHED)) == NI_LCF_BENEATH_ABS) { 533 NDFREE(ndp, 0); 534 error = ENOTCAPABLE; 535 } 536 nameicap_cleanup(ndp, true); 537 SDT_PROBE2(vfs, namei, lookup, return, error, 538 (error == 0 ? ndp->ni_vp : NULL)); 539 return (error); 540 } 541 if (ndp->ni_loopcnt++ >= MAXSYMLINKS) { 542 error = ELOOP; 543 break; 544 } 545 #ifdef MAC 546 if ((cnp->cn_flags & NOMACCHECK) == 0) { 547 error = mac_vnode_check_readlink(td->td_ucred, 548 ndp->ni_vp); 549 if (error != 0) 550 break; 551 } 552 #endif 553 if (ndp->ni_pathlen > 1) 554 cp = uma_zalloc(namei_zone, M_WAITOK); 555 else 556 cp = cnp->cn_pnbuf; 557 aiov.iov_base = cp; 558 aiov.iov_len = MAXPATHLEN; 559 auio.uio_iov = &aiov; 560 auio.uio_iovcnt = 1; 561 auio.uio_offset = 0; 562 auio.uio_rw = UIO_READ; 563 auio.uio_segflg = UIO_SYSSPACE; 564 auio.uio_td = td; 565 auio.uio_resid = MAXPATHLEN; 566 error = VOP_READLINK(ndp->ni_vp, &auio, cnp->cn_cred); 567 if (error != 0) { 568 if (ndp->ni_pathlen > 1) 569 uma_zfree(namei_zone, cp); 570 break; 571 } 572 linklen = MAXPATHLEN - auio.uio_resid; 573 if (linklen == 0) { 574 if (ndp->ni_pathlen > 1) 575 uma_zfree(namei_zone, cp); 576 error = ENOENT; 577 break; 578 } 579 if (linklen + ndp->ni_pathlen > MAXPATHLEN) { 580 if (ndp->ni_pathlen > 1) 581 uma_zfree(namei_zone, cp); 582 error = ENAMETOOLONG; 583 break; 584 } 585 if (ndp->ni_pathlen > 1) { 586 bcopy(ndp->ni_next, cp + linklen, ndp->ni_pathlen); 587 uma_zfree(namei_zone, cnp->cn_pnbuf); 588 cnp->cn_pnbuf = cp; 589 } else 590 cnp->cn_pnbuf[linklen] = '\0'; 591 ndp->ni_pathlen += linklen; 592 vput(ndp->ni_vp); 593 dp = ndp->ni_dvp; 594 /* 595 * Check if root directory should replace current directory. 596 */ 597 cnp->cn_nameptr = cnp->cn_pnbuf; 598 if (*(cnp->cn_nameptr) == '/') { 599 vrele(dp); 600 error = namei_handle_root(ndp, &dp, 1); 601 if (error != 0) 602 goto out; 603 } 604 } 605 vput(ndp->ni_vp); 606 ndp->ni_vp = NULL; 607 vrele(ndp->ni_dvp); 608 out: 609 vrele(ndp->ni_rootdir); 610 MPASS(error != 0); 611 namei_cleanup_cnp(cnp); 612 nameicap_cleanup(ndp, true); 613 SDT_PROBE2(vfs, namei, lookup, return, error, NULL); 614 return (error); 615 } 616 617 static int 618 compute_cn_lkflags(struct mount *mp, int lkflags, int cnflags) 619 { 620 621 if (mp == NULL || ((lkflags & LK_SHARED) && 622 (!(mp->mnt_kern_flag & MNTK_LOOKUP_SHARED) || 623 ((cnflags & ISDOTDOT) && 624 (mp->mnt_kern_flag & MNTK_LOOKUP_EXCL_DOTDOT))))) { 625 lkflags &= ~LK_SHARED; 626 lkflags |= LK_EXCLUSIVE; 627 } 628 lkflags |= LK_NODDLKTREAT; 629 return (lkflags); 630 } 631 632 static __inline int 633 needs_exclusive_leaf(struct mount *mp, int flags) 634 { 635 636 /* 637 * Intermediate nodes can use shared locks, we only need to 638 * force an exclusive lock for leaf nodes. 639 */ 640 if ((flags & (ISLASTCN | LOCKLEAF)) != (ISLASTCN | LOCKLEAF)) 641 return (0); 642 643 /* Always use exclusive locks if LOCKSHARED isn't set. */ 644 if (!(flags & LOCKSHARED)) 645 return (1); 646 647 /* 648 * For lookups during open(), if the mount point supports 649 * extended shared operations, then use a shared lock for the 650 * leaf node, otherwise use an exclusive lock. 651 */ 652 if ((flags & ISOPEN) != 0) 653 return (!MNT_EXTENDED_SHARED(mp)); 654 655 /* 656 * Lookup requests outside of open() that specify LOCKSHARED 657 * only need a shared lock on the leaf vnode. 658 */ 659 return (0); 660 } 661 662 /* 663 * Search a pathname. 664 * This is a very central and rather complicated routine. 665 * 666 * The pathname is pointed to by ni_ptr and is of length ni_pathlen. 667 * The starting directory is taken from ni_startdir. The pathname is 668 * descended until done, or a symbolic link is encountered. The variable 669 * ni_more is clear if the path is completed; it is set to one if a 670 * symbolic link needing interpretation is encountered. 671 * 672 * The flag argument is LOOKUP, CREATE, RENAME, or DELETE depending on 673 * whether the name is to be looked up, created, renamed, or deleted. 674 * When CREATE, RENAME, or DELETE is specified, information usable in 675 * creating, renaming, or deleting a directory entry may be calculated. 676 * If flag has LOCKPARENT or'ed into it, the parent directory is returned 677 * locked. If flag has WANTPARENT or'ed into it, the parent directory is 678 * returned unlocked. Otherwise the parent directory is not returned. If 679 * the target of the pathname exists and LOCKLEAF is or'ed into the flag 680 * the target is returned locked, otherwise it is returned unlocked. 681 * When creating or renaming and LOCKPARENT is specified, the target may not 682 * be ".". When deleting and LOCKPARENT is specified, the target may be ".". 683 * 684 * Overall outline of lookup: 685 * 686 * dirloop: 687 * identify next component of name at ndp->ni_ptr 688 * handle degenerate case where name is null string 689 * if .. and crossing mount points and on mounted filesys, find parent 690 * call VOP_LOOKUP routine for next component name 691 * directory vnode returned in ni_dvp, unlocked unless LOCKPARENT set 692 * component vnode returned in ni_vp (if it exists), locked. 693 * if result vnode is mounted on and crossing mount points, 694 * find mounted on vnode 695 * if more components of name, do next level at dirloop 696 * return the answer in ni_vp, locked if LOCKLEAF set 697 * if LOCKPARENT set, return locked parent in ni_dvp 698 * if WANTPARENT set, return unlocked parent in ni_dvp 699 */ 700 int 701 lookup(struct nameidata *ndp) 702 { 703 char *cp; /* pointer into pathname argument */ 704 char *prev_ni_next; /* saved ndp->ni_next */ 705 struct vnode *dp = NULL; /* the directory we are searching */ 706 struct vnode *tdp; /* saved dp */ 707 struct mount *mp; /* mount table entry */ 708 struct prison *pr; 709 size_t prev_ni_pathlen; /* saved ndp->ni_pathlen */ 710 int docache; /* == 0 do not cache last component */ 711 int wantparent; /* 1 => wantparent or lockparent flag */ 712 int rdonly; /* lookup read-only flag bit */ 713 int error = 0; 714 int dpunlocked = 0; /* dp has already been unlocked */ 715 int relookup = 0; /* do not consume the path component */ 716 struct componentname *cnp = &ndp->ni_cnd; 717 int lkflags_save; 718 int ni_dvp_unlocked; 719 720 /* 721 * Setup: break out flag bits into variables. 722 */ 723 ni_dvp_unlocked = 0; 724 wantparent = cnp->cn_flags & (LOCKPARENT | WANTPARENT); 725 KASSERT(cnp->cn_nameiop == LOOKUP || wantparent, 726 ("CREATE, DELETE, RENAME require LOCKPARENT or WANTPARENT.")); 727 docache = (cnp->cn_flags & NOCACHE) ^ NOCACHE; 728 if (cnp->cn_nameiop == DELETE || 729 (wantparent && cnp->cn_nameiop != CREATE && 730 cnp->cn_nameiop != LOOKUP)) 731 docache = 0; 732 rdonly = cnp->cn_flags & RDONLY; 733 cnp->cn_flags &= ~ISSYMLINK; 734 ndp->ni_dvp = NULL; 735 /* 736 * We use shared locks until we hit the parent of the last cn then 737 * we adjust based on the requesting flags. 738 */ 739 cnp->cn_lkflags = LK_SHARED; 740 dp = ndp->ni_startdir; 741 ndp->ni_startdir = NULLVP; 742 vn_lock(dp, 743 compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags | LK_RETRY, 744 cnp->cn_flags)); 745 746 dirloop: 747 /* 748 * Search a new directory. 749 * 750 * The last component of the filename is left accessible via 751 * cnp->cn_nameptr for callers that need the name. Callers needing 752 * the name set the SAVENAME flag. When done, they assume 753 * responsibility for freeing the pathname buffer. 754 */ 755 for (cp = cnp->cn_nameptr; *cp != 0 && *cp != '/'; cp++) 756 continue; 757 cnp->cn_namelen = cp - cnp->cn_nameptr; 758 if (cnp->cn_namelen > NAME_MAX) { 759 error = ENAMETOOLONG; 760 goto bad; 761 } 762 #ifdef NAMEI_DIAGNOSTIC 763 { char c = *cp; 764 *cp = '\0'; 765 printf("{%s}: ", cnp->cn_nameptr); 766 *cp = c; } 767 #endif 768 prev_ni_pathlen = ndp->ni_pathlen; 769 ndp->ni_pathlen -= cnp->cn_namelen; 770 KASSERT(ndp->ni_pathlen <= PATH_MAX, 771 ("%s: ni_pathlen underflow to %zd\n", __func__, ndp->ni_pathlen)); 772 prev_ni_next = ndp->ni_next; 773 ndp->ni_next = cp; 774 775 /* 776 * Replace multiple slashes by a single slash and trailing slashes 777 * by a null. This must be done before VOP_LOOKUP() because some 778 * fs's don't know about trailing slashes. Remember if there were 779 * trailing slashes to handle symlinks, existing non-directories 780 * and non-existing files that won't be directories specially later. 781 */ 782 while (*cp == '/' && (cp[1] == '/' || cp[1] == '\0')) { 783 cp++; 784 ndp->ni_pathlen--; 785 if (*cp == '\0') { 786 *ndp->ni_next = '\0'; 787 cnp->cn_flags |= TRAILINGSLASH; 788 } 789 } 790 ndp->ni_next = cp; 791 792 cnp->cn_flags |= MAKEENTRY; 793 if (*cp == '\0' && docache == 0) 794 cnp->cn_flags &= ~MAKEENTRY; 795 if (cnp->cn_namelen == 2 && 796 cnp->cn_nameptr[1] == '.' && cnp->cn_nameptr[0] == '.') 797 cnp->cn_flags |= ISDOTDOT; 798 else 799 cnp->cn_flags &= ~ISDOTDOT; 800 if (*ndp->ni_next == 0) 801 cnp->cn_flags |= ISLASTCN; 802 else 803 cnp->cn_flags &= ~ISLASTCN; 804 805 if ((cnp->cn_flags & ISLASTCN) != 0 && 806 cnp->cn_namelen == 1 && cnp->cn_nameptr[0] == '.' && 807 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { 808 error = EINVAL; 809 goto bad; 810 } 811 812 nameicap_tracker_add(ndp, dp); 813 814 /* 815 * Check for degenerate name (e.g. / or "") 816 * which is a way of talking about a directory, 817 * e.g. like "/." or ".". 818 */ 819 if (cnp->cn_nameptr[0] == '\0') { 820 if (dp->v_type != VDIR) { 821 error = ENOTDIR; 822 goto bad; 823 } 824 if (cnp->cn_nameiop != LOOKUP) { 825 error = EISDIR; 826 goto bad; 827 } 828 if (wantparent) { 829 ndp->ni_dvp = dp; 830 VREF(dp); 831 } 832 ndp->ni_vp = dp; 833 834 if (cnp->cn_flags & AUDITVNODE1) 835 AUDIT_ARG_VNODE1(dp); 836 else if (cnp->cn_flags & AUDITVNODE2) 837 AUDIT_ARG_VNODE2(dp); 838 839 if (!(cnp->cn_flags & (LOCKPARENT | LOCKLEAF))) 840 VOP_UNLOCK(dp); 841 /* XXX This should probably move to the top of function. */ 842 if (cnp->cn_flags & SAVESTART) 843 panic("lookup: SAVESTART"); 844 goto success; 845 } 846 847 /* 848 * Handle "..": five special cases. 849 * 0. If doing a capability lookup and lookup_cap_dotdot is 850 * disabled, return ENOTCAPABLE. 851 * 1. Return an error if this is the last component of 852 * the name and the operation is DELETE or RENAME. 853 * 2. If at root directory (e.g. after chroot) 854 * or at absolute root directory 855 * then ignore it so can't get out. 856 * 3. If this vnode is the root of a mounted 857 * filesystem, then replace it with the 858 * vnode which was mounted on so we take the 859 * .. in the other filesystem. 860 * 4. If the vnode is the top directory of 861 * the jail or chroot, don't let them out. 862 * 5. If doing a capability lookup and lookup_cap_dotdot is 863 * enabled, return ENOTCAPABLE if the lookup would escape 864 * from the initial file descriptor directory. Checks are 865 * done by ensuring that namei() already traversed the 866 * result of dotdot lookup. 867 */ 868 if (cnp->cn_flags & ISDOTDOT) { 869 if ((ndp->ni_lcf & (NI_LCF_STRICTRELATIVE | NI_LCF_CAP_DOTDOT)) 870 == NI_LCF_STRICTRELATIVE) { 871 #ifdef KTRACE 872 if (KTRPOINT(curthread, KTR_CAPFAIL)) 873 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 874 #endif 875 error = ENOTCAPABLE; 876 goto bad; 877 } 878 if ((cnp->cn_flags & ISLASTCN) != 0 && 879 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { 880 error = EINVAL; 881 goto bad; 882 } 883 for (;;) { 884 for (pr = cnp->cn_cred->cr_prison; pr != NULL; 885 pr = pr->pr_parent) 886 if (dp == pr->pr_root) 887 break; 888 if (dp == ndp->ni_rootdir || 889 dp == ndp->ni_topdir || 890 dp == rootvnode || 891 pr != NULL || 892 ((dp->v_vflag & VV_ROOT) != 0 && 893 (cnp->cn_flags & NOCROSSMOUNT) != 0)) { 894 ndp->ni_dvp = dp; 895 ndp->ni_vp = dp; 896 VREF(dp); 897 goto nextname; 898 } 899 if ((dp->v_vflag & VV_ROOT) == 0) 900 break; 901 if (VN_IS_DOOMED(dp)) { /* forced unmount */ 902 error = ENOENT; 903 goto bad; 904 } 905 tdp = dp; 906 dp = dp->v_mount->mnt_vnodecovered; 907 VREF(dp); 908 vput(tdp); 909 vn_lock(dp, 910 compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags | 911 LK_RETRY, ISDOTDOT)); 912 error = nameicap_check_dotdot(ndp, dp); 913 if (error != 0) { 914 #ifdef KTRACE 915 if (KTRPOINT(curthread, KTR_CAPFAIL)) 916 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 917 #endif 918 goto bad; 919 } 920 } 921 } 922 923 /* 924 * We now have a segment name to search for, and a directory to search. 925 */ 926 unionlookup: 927 #ifdef MAC 928 if ((cnp->cn_flags & NOMACCHECK) == 0) { 929 error = mac_vnode_check_lookup(cnp->cn_thread->td_ucred, dp, 930 cnp); 931 if (error) 932 goto bad; 933 } 934 #endif 935 ndp->ni_dvp = dp; 936 ndp->ni_vp = NULL; 937 ASSERT_VOP_LOCKED(dp, "lookup"); 938 /* 939 * If we have a shared lock we may need to upgrade the lock for the 940 * last operation. 941 */ 942 if ((cnp->cn_flags & LOCKPARENT) && (cnp->cn_flags & ISLASTCN) && 943 dp != vp_crossmp && VOP_ISLOCKED(dp) == LK_SHARED) 944 vn_lock(dp, LK_UPGRADE|LK_RETRY); 945 if (VN_IS_DOOMED(dp)) { 946 error = ENOENT; 947 goto bad; 948 } 949 /* 950 * If we're looking up the last component and we need an exclusive 951 * lock, adjust our lkflags. 952 */ 953 if (needs_exclusive_leaf(dp->v_mount, cnp->cn_flags)) 954 cnp->cn_lkflags = LK_EXCLUSIVE; 955 #ifdef NAMEI_DIAGNOSTIC 956 vn_printf(dp, "lookup in "); 957 #endif 958 lkflags_save = cnp->cn_lkflags; 959 cnp->cn_lkflags = compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags, 960 cnp->cn_flags); 961 error = VOP_LOOKUP(dp, &ndp->ni_vp, cnp); 962 cnp->cn_lkflags = lkflags_save; 963 if (error != 0) { 964 KASSERT(ndp->ni_vp == NULL, ("leaf should be empty")); 965 #ifdef NAMEI_DIAGNOSTIC 966 printf("not found\n"); 967 #endif 968 if ((error == ENOENT) && 969 (dp->v_vflag & VV_ROOT) && (dp->v_mount != NULL) && 970 (dp->v_mount->mnt_flag & MNT_UNION)) { 971 tdp = dp; 972 dp = dp->v_mount->mnt_vnodecovered; 973 VREF(dp); 974 vput(tdp); 975 vn_lock(dp, 976 compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags | 977 LK_RETRY, cnp->cn_flags)); 978 nameicap_tracker_add(ndp, dp); 979 goto unionlookup; 980 } 981 982 if (error == ERELOOKUP) { 983 vref(dp); 984 ndp->ni_vp = dp; 985 error = 0; 986 relookup = 1; 987 goto good; 988 } 989 990 if (error != EJUSTRETURN) 991 goto bad; 992 /* 993 * At this point, we know we're at the end of the 994 * pathname. If creating / renaming, we can consider 995 * allowing the file or directory to be created / renamed, 996 * provided we're not on a read-only filesystem. 997 */ 998 if (rdonly) { 999 error = EROFS; 1000 goto bad; 1001 } 1002 /* trailing slash only allowed for directories */ 1003 if ((cnp->cn_flags & TRAILINGSLASH) && 1004 !(cnp->cn_flags & WILLBEDIR)) { 1005 error = ENOENT; 1006 goto bad; 1007 } 1008 if ((cnp->cn_flags & LOCKPARENT) == 0) 1009 VOP_UNLOCK(dp); 1010 /* 1011 * We return with ni_vp NULL to indicate that the entry 1012 * doesn't currently exist, leaving a pointer to the 1013 * (possibly locked) directory vnode in ndp->ni_dvp. 1014 */ 1015 if (cnp->cn_flags & SAVESTART) { 1016 ndp->ni_startdir = ndp->ni_dvp; 1017 VREF(ndp->ni_startdir); 1018 } 1019 goto success; 1020 } 1021 1022 good: 1023 #ifdef NAMEI_DIAGNOSTIC 1024 printf("found\n"); 1025 #endif 1026 dp = ndp->ni_vp; 1027 1028 /* 1029 * Check to see if the vnode has been mounted on; 1030 * if so find the root of the mounted filesystem. 1031 */ 1032 while (dp->v_type == VDIR && (mp = dp->v_mountedhere) && 1033 (cnp->cn_flags & NOCROSSMOUNT) == 0) { 1034 if (vfs_busy(mp, 0)) 1035 continue; 1036 vput(dp); 1037 if (dp != ndp->ni_dvp) 1038 vput(ndp->ni_dvp); 1039 else 1040 vrele(ndp->ni_dvp); 1041 vrefact(vp_crossmp); 1042 ndp->ni_dvp = vp_crossmp; 1043 error = VFS_ROOT(mp, compute_cn_lkflags(mp, cnp->cn_lkflags, 1044 cnp->cn_flags), &tdp); 1045 vfs_unbusy(mp); 1046 if (vn_lock(vp_crossmp, LK_SHARED | LK_NOWAIT)) 1047 panic("vp_crossmp exclusively locked or reclaimed"); 1048 if (error) { 1049 dpunlocked = 1; 1050 goto bad2; 1051 } 1052 ndp->ni_vp = dp = tdp; 1053 } 1054 1055 /* 1056 * Check for symbolic link 1057 */ 1058 if ((dp->v_type == VLNK) && 1059 ((cnp->cn_flags & FOLLOW) || (cnp->cn_flags & TRAILINGSLASH) || 1060 *ndp->ni_next == '/')) { 1061 cnp->cn_flags |= ISSYMLINK; 1062 if (VN_IS_DOOMED(dp)) { 1063 /* 1064 * We can't know whether the directory was mounted with 1065 * NOSYMFOLLOW, so we can't follow safely. 1066 */ 1067 error = ENOENT; 1068 goto bad2; 1069 } 1070 if (dp->v_mount->mnt_flag & MNT_NOSYMFOLLOW) { 1071 error = EACCES; 1072 goto bad2; 1073 } 1074 /* 1075 * Symlink code always expects an unlocked dvp. 1076 */ 1077 if (ndp->ni_dvp != ndp->ni_vp) { 1078 VOP_UNLOCK(ndp->ni_dvp); 1079 ni_dvp_unlocked = 1; 1080 } 1081 goto success; 1082 } 1083 1084 nextname: 1085 /* 1086 * Not a symbolic link that we will follow. Continue with the 1087 * next component if there is any; otherwise, we're done. 1088 */ 1089 KASSERT((cnp->cn_flags & ISLASTCN) || *ndp->ni_next == '/', 1090 ("lookup: invalid path state.")); 1091 if (relookup) { 1092 relookup = 0; 1093 ndp->ni_pathlen = prev_ni_pathlen; 1094 ndp->ni_next = prev_ni_next; 1095 if (ndp->ni_dvp != dp) 1096 vput(ndp->ni_dvp); 1097 else 1098 vrele(ndp->ni_dvp); 1099 goto dirloop; 1100 } 1101 if (cnp->cn_flags & ISDOTDOT) { 1102 error = nameicap_check_dotdot(ndp, ndp->ni_vp); 1103 if (error != 0) { 1104 #ifdef KTRACE 1105 if (KTRPOINT(curthread, KTR_CAPFAIL)) 1106 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 1107 #endif 1108 goto bad2; 1109 } 1110 } 1111 if (*ndp->ni_next == '/') { 1112 cnp->cn_nameptr = ndp->ni_next; 1113 while (*cnp->cn_nameptr == '/') { 1114 cnp->cn_nameptr++; 1115 ndp->ni_pathlen--; 1116 } 1117 if (ndp->ni_dvp != dp) 1118 vput(ndp->ni_dvp); 1119 else 1120 vrele(ndp->ni_dvp); 1121 goto dirloop; 1122 } 1123 /* 1124 * If we're processing a path with a trailing slash, 1125 * check that the end result is a directory. 1126 */ 1127 if ((cnp->cn_flags & TRAILINGSLASH) && dp->v_type != VDIR) { 1128 error = ENOTDIR; 1129 goto bad2; 1130 } 1131 /* 1132 * Disallow directory write attempts on read-only filesystems. 1133 */ 1134 if (rdonly && 1135 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { 1136 error = EROFS; 1137 goto bad2; 1138 } 1139 if (cnp->cn_flags & SAVESTART) { 1140 ndp->ni_startdir = ndp->ni_dvp; 1141 VREF(ndp->ni_startdir); 1142 } 1143 if (!wantparent) { 1144 ni_dvp_unlocked = 2; 1145 if (ndp->ni_dvp != dp) 1146 vput(ndp->ni_dvp); 1147 else 1148 vrele(ndp->ni_dvp); 1149 } else if ((cnp->cn_flags & LOCKPARENT) == 0 && ndp->ni_dvp != dp) { 1150 VOP_UNLOCK(ndp->ni_dvp); 1151 ni_dvp_unlocked = 1; 1152 } 1153 1154 if (cnp->cn_flags & AUDITVNODE1) 1155 AUDIT_ARG_VNODE1(dp); 1156 else if (cnp->cn_flags & AUDITVNODE2) 1157 AUDIT_ARG_VNODE2(dp); 1158 1159 if ((cnp->cn_flags & LOCKLEAF) == 0) 1160 VOP_UNLOCK(dp); 1161 success: 1162 /* 1163 * Because of shared lookup we may have the vnode shared locked, but 1164 * the caller may want it to be exclusively locked. 1165 */ 1166 if (needs_exclusive_leaf(dp->v_mount, cnp->cn_flags) && 1167 VOP_ISLOCKED(dp) != LK_EXCLUSIVE) { 1168 vn_lock(dp, LK_UPGRADE | LK_RETRY); 1169 if (VN_IS_DOOMED(dp)) { 1170 error = ENOENT; 1171 goto bad2; 1172 } 1173 } 1174 return (0); 1175 1176 bad2: 1177 if (ni_dvp_unlocked != 2) { 1178 if (dp != ndp->ni_dvp && !ni_dvp_unlocked) 1179 vput(ndp->ni_dvp); 1180 else 1181 vrele(ndp->ni_dvp); 1182 } 1183 bad: 1184 if (!dpunlocked) 1185 vput(dp); 1186 ndp->ni_vp = NULL; 1187 return (error); 1188 } 1189 1190 /* 1191 * relookup - lookup a path name component 1192 * Used by lookup to re-acquire things. 1193 */ 1194 int 1195 relookup(struct vnode *dvp, struct vnode **vpp, struct componentname *cnp) 1196 { 1197 struct vnode *dp = NULL; /* the directory we are searching */ 1198 int wantparent; /* 1 => wantparent or lockparent flag */ 1199 int rdonly; /* lookup read-only flag bit */ 1200 int error = 0; 1201 1202 KASSERT(cnp->cn_flags & ISLASTCN, 1203 ("relookup: Not given last component.")); 1204 /* 1205 * Setup: break out flag bits into variables. 1206 */ 1207 wantparent = cnp->cn_flags & (LOCKPARENT|WANTPARENT); 1208 KASSERT(wantparent, ("relookup: parent not wanted.")); 1209 rdonly = cnp->cn_flags & RDONLY; 1210 cnp->cn_flags &= ~ISSYMLINK; 1211 dp = dvp; 1212 cnp->cn_lkflags = LK_EXCLUSIVE; 1213 vn_lock(dp, LK_EXCLUSIVE | LK_RETRY); 1214 1215 /* 1216 * Search a new directory. 1217 * 1218 * The last component of the filename is left accessible via 1219 * cnp->cn_nameptr for callers that need the name. Callers needing 1220 * the name set the SAVENAME flag. When done, they assume 1221 * responsibility for freeing the pathname buffer. 1222 */ 1223 #ifdef NAMEI_DIAGNOSTIC 1224 printf("{%s}: ", cnp->cn_nameptr); 1225 #endif 1226 1227 /* 1228 * Check for "" which represents the root directory after slash 1229 * removal. 1230 */ 1231 if (cnp->cn_nameptr[0] == '\0') { 1232 /* 1233 * Support only LOOKUP for "/" because lookup() 1234 * can't succeed for CREATE, DELETE and RENAME. 1235 */ 1236 KASSERT(cnp->cn_nameiop == LOOKUP, ("nameiop must be LOOKUP")); 1237 KASSERT(dp->v_type == VDIR, ("dp is not a directory")); 1238 1239 if (!(cnp->cn_flags & LOCKLEAF)) 1240 VOP_UNLOCK(dp); 1241 *vpp = dp; 1242 /* XXX This should probably move to the top of function. */ 1243 if (cnp->cn_flags & SAVESTART) 1244 panic("lookup: SAVESTART"); 1245 return (0); 1246 } 1247 1248 if (cnp->cn_flags & ISDOTDOT) 1249 panic ("relookup: lookup on dot-dot"); 1250 1251 /* 1252 * We now have a segment name to search for, and a directory to search. 1253 */ 1254 #ifdef NAMEI_DIAGNOSTIC 1255 vn_printf(dp, "search in "); 1256 #endif 1257 if ((error = VOP_LOOKUP(dp, vpp, cnp)) != 0) { 1258 KASSERT(*vpp == NULL, ("leaf should be empty")); 1259 if (error != EJUSTRETURN) 1260 goto bad; 1261 /* 1262 * If creating and at end of pathname, then can consider 1263 * allowing file to be created. 1264 */ 1265 if (rdonly) { 1266 error = EROFS; 1267 goto bad; 1268 } 1269 /* ASSERT(dvp == ndp->ni_startdir) */ 1270 if (cnp->cn_flags & SAVESTART) 1271 VREF(dvp); 1272 if ((cnp->cn_flags & LOCKPARENT) == 0) 1273 VOP_UNLOCK(dp); 1274 /* 1275 * We return with ni_vp NULL to indicate that the entry 1276 * doesn't currently exist, leaving a pointer to the 1277 * (possibly locked) directory vnode in ndp->ni_dvp. 1278 */ 1279 return (0); 1280 } 1281 1282 dp = *vpp; 1283 1284 /* 1285 * Disallow directory write attempts on read-only filesystems. 1286 */ 1287 if (rdonly && 1288 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { 1289 if (dvp == dp) 1290 vrele(dvp); 1291 else 1292 vput(dvp); 1293 error = EROFS; 1294 goto bad; 1295 } 1296 /* 1297 * Set the parent lock/ref state to the requested state. 1298 */ 1299 if ((cnp->cn_flags & LOCKPARENT) == 0 && dvp != dp) { 1300 if (wantparent) 1301 VOP_UNLOCK(dvp); 1302 else 1303 vput(dvp); 1304 } else if (!wantparent) 1305 vrele(dvp); 1306 /* 1307 * Check for symbolic link 1308 */ 1309 KASSERT(dp->v_type != VLNK || !(cnp->cn_flags & FOLLOW), 1310 ("relookup: symlink found.\n")); 1311 1312 /* ASSERT(dvp == ndp->ni_startdir) */ 1313 if (cnp->cn_flags & SAVESTART) 1314 VREF(dvp); 1315 1316 if ((cnp->cn_flags & LOCKLEAF) == 0) 1317 VOP_UNLOCK(dp); 1318 return (0); 1319 bad: 1320 vput(dp); 1321 *vpp = NULL; 1322 return (error); 1323 } 1324 1325 void 1326 NDINIT_ALL(struct nameidata *ndp, u_long op, u_long flags, enum uio_seg segflg, 1327 const char *namep, int dirfd, struct vnode *startdir, cap_rights_t *rightsp, 1328 struct thread *td) 1329 { 1330 1331 ndp->ni_cnd.cn_nameiop = op; 1332 ndp->ni_cnd.cn_flags = flags; 1333 ndp->ni_segflg = segflg; 1334 ndp->ni_dirp = namep; 1335 ndp->ni_dirfd = dirfd; 1336 ndp->ni_startdir = startdir; 1337 ndp->ni_resflags = 0; 1338 filecaps_init(&ndp->ni_filecaps); 1339 ndp->ni_cnd.cn_thread = td; 1340 if (rightsp != NULL) 1341 ndp->ni_rightsneeded = *rightsp; 1342 else 1343 cap_rights_init(&ndp->ni_rightsneeded); 1344 } 1345 1346 /* 1347 * Free data allocated by namei(); see namei(9) for details. 1348 */ 1349 void 1350 NDFREE(struct nameidata *ndp, const u_int flags) 1351 { 1352 int unlock_dvp; 1353 int unlock_vp; 1354 1355 unlock_dvp = 0; 1356 unlock_vp = 0; 1357 1358 if (!(flags & NDF_NO_FREE_PNBUF) && 1359 (ndp->ni_cnd.cn_flags & HASBUF)) { 1360 uma_zfree(namei_zone, ndp->ni_cnd.cn_pnbuf); 1361 ndp->ni_cnd.cn_flags &= ~HASBUF; 1362 } 1363 if (!(flags & NDF_NO_VP_UNLOCK) && 1364 (ndp->ni_cnd.cn_flags & LOCKLEAF) && ndp->ni_vp) 1365 unlock_vp = 1; 1366 if (!(flags & NDF_NO_DVP_UNLOCK) && 1367 (ndp->ni_cnd.cn_flags & LOCKPARENT) && 1368 ndp->ni_dvp != ndp->ni_vp) 1369 unlock_dvp = 1; 1370 if (!(flags & NDF_NO_VP_RELE) && ndp->ni_vp) { 1371 if (unlock_vp) { 1372 vput(ndp->ni_vp); 1373 unlock_vp = 0; 1374 } else 1375 vrele(ndp->ni_vp); 1376 ndp->ni_vp = NULL; 1377 } 1378 if (unlock_vp) 1379 VOP_UNLOCK(ndp->ni_vp); 1380 if (!(flags & NDF_NO_DVP_RELE) && 1381 (ndp->ni_cnd.cn_flags & (LOCKPARENT|WANTPARENT))) { 1382 if (unlock_dvp) { 1383 vput(ndp->ni_dvp); 1384 unlock_dvp = 0; 1385 } else 1386 vrele(ndp->ni_dvp); 1387 ndp->ni_dvp = NULL; 1388 } 1389 if (unlock_dvp) 1390 VOP_UNLOCK(ndp->ni_dvp); 1391 if (!(flags & NDF_NO_STARTDIR_RELE) && 1392 (ndp->ni_cnd.cn_flags & SAVESTART)) { 1393 vrele(ndp->ni_startdir); 1394 ndp->ni_startdir = NULL; 1395 } 1396 } 1397 1398 /* 1399 * Determine if there is a suitable alternate filename under the specified 1400 * prefix for the specified path. If the create flag is set, then the 1401 * alternate prefix will be used so long as the parent directory exists. 1402 * This is used by the various compatibility ABIs so that Linux binaries prefer 1403 * files under /compat/linux for example. The chosen path (whether under 1404 * the prefix or under /) is returned in a kernel malloc'd buffer pointed 1405 * to by pathbuf. The caller is responsible for free'ing the buffer from 1406 * the M_TEMP bucket if one is returned. 1407 */ 1408 int 1409 kern_alternate_path(struct thread *td, const char *prefix, const char *path, 1410 enum uio_seg pathseg, char **pathbuf, int create, int dirfd) 1411 { 1412 struct nameidata nd, ndroot; 1413 char *ptr, *buf, *cp; 1414 size_t len, sz; 1415 int error; 1416 1417 buf = (char *) malloc(MAXPATHLEN, M_TEMP, M_WAITOK); 1418 *pathbuf = buf; 1419 1420 /* Copy the prefix into the new pathname as a starting point. */ 1421 len = strlcpy(buf, prefix, MAXPATHLEN); 1422 if (len >= MAXPATHLEN) { 1423 *pathbuf = NULL; 1424 free(buf, M_TEMP); 1425 return (EINVAL); 1426 } 1427 sz = MAXPATHLEN - len; 1428 ptr = buf + len; 1429 1430 /* Append the filename to the prefix. */ 1431 if (pathseg == UIO_SYSSPACE) 1432 error = copystr(path, ptr, sz, &len); 1433 else 1434 error = copyinstr(path, ptr, sz, &len); 1435 1436 if (error) { 1437 *pathbuf = NULL; 1438 free(buf, M_TEMP); 1439 return (error); 1440 } 1441 1442 /* Only use a prefix with absolute pathnames. */ 1443 if (*ptr != '/') { 1444 error = EINVAL; 1445 goto keeporig; 1446 } 1447 1448 if (dirfd != AT_FDCWD) { 1449 /* 1450 * We want the original because the "prefix" is 1451 * included in the already opened dirfd. 1452 */ 1453 bcopy(ptr, buf, len); 1454 return (0); 1455 } 1456 1457 /* 1458 * We know that there is a / somewhere in this pathname. 1459 * Search backwards for it, to find the file's parent dir 1460 * to see if it exists in the alternate tree. If it does, 1461 * and we want to create a file (cflag is set). We don't 1462 * need to worry about the root comparison in this case. 1463 */ 1464 1465 if (create) { 1466 for (cp = &ptr[len] - 1; *cp != '/'; cp--); 1467 *cp = '\0'; 1468 1469 NDINIT(&nd, LOOKUP, NOFOLLOW, UIO_SYSSPACE, buf, td); 1470 error = namei(&nd); 1471 *cp = '/'; 1472 if (error != 0) 1473 goto keeporig; 1474 } else { 1475 NDINIT(&nd, LOOKUP, NOFOLLOW, UIO_SYSSPACE, buf, td); 1476 1477 error = namei(&nd); 1478 if (error != 0) 1479 goto keeporig; 1480 1481 /* 1482 * We now compare the vnode of the prefix to the one 1483 * vnode asked. If they resolve to be the same, then we 1484 * ignore the match so that the real root gets used. 1485 * This avoids the problem of traversing "../.." to find the 1486 * root directory and never finding it, because "/" resolves 1487 * to the emulation root directory. This is expensive :-( 1488 */ 1489 NDINIT(&ndroot, LOOKUP, FOLLOW, UIO_SYSSPACE, prefix, 1490 td); 1491 1492 /* We shouldn't ever get an error from this namei(). */ 1493 error = namei(&ndroot); 1494 if (error == 0) { 1495 if (nd.ni_vp == ndroot.ni_vp) 1496 error = ENOENT; 1497 1498 NDFREE(&ndroot, NDF_ONLY_PNBUF); 1499 vrele(ndroot.ni_vp); 1500 } 1501 } 1502 1503 NDFREE(&nd, NDF_ONLY_PNBUF); 1504 vrele(nd.ni_vp); 1505 1506 keeporig: 1507 /* If there was an error, use the original path name. */ 1508 if (error) 1509 bcopy(ptr, buf, len); 1510 return (error); 1511 } 1512