1 /*- 2 * Copyright (c) 1982, 1986, 1989, 1993 3 * The Regents of the University of California. All rights reserved. 4 * (c) UNIX System Laboratories, Inc. 5 * All or some portions of this file are derived from material licensed 6 * to the University of California by American Telephone and Telegraph 7 * Co. or Unix System Laboratories, Inc. and are reproduced herein with 8 * the permission of UNIX System Laboratories, Inc. 9 * 10 * Redistribution and use in source and binary forms, with or without 11 * modification, are permitted provided that the following conditions 12 * are met: 13 * 1. Redistributions of source code must retain the above copyright 14 * notice, this list of conditions and the following disclaimer. 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in the 17 * documentation and/or other materials provided with the distribution. 18 * 4. Neither the name of the University nor the names of its contributors 19 * may be used to endorse or promote products derived from this software 20 * without specific prior written permission. 21 * 22 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 23 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 26 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32 * SUCH DAMAGE. 33 * 34 * @(#)vfs_lookup.c 8.4 (Berkeley) 2/16/94 35 */ 36 37 #include <sys/cdefs.h> 38 __FBSDID("$FreeBSD$"); 39 40 #include "opt_capsicum.h" 41 #include "opt_ktrace.h" 42 43 #include <sys/param.h> 44 #include <sys/systm.h> 45 #include <sys/kernel.h> 46 #include <sys/capsicum.h> 47 #include <sys/fcntl.h> 48 #include <sys/jail.h> 49 #include <sys/lock.h> 50 #include <sys/mutex.h> 51 #include <sys/namei.h> 52 #include <sys/vnode.h> 53 #include <sys/mount.h> 54 #include <sys/filedesc.h> 55 #include <sys/proc.h> 56 #include <sys/sdt.h> 57 #include <sys/syscallsubr.h> 58 #include <sys/sysctl.h> 59 #ifdef KTRACE 60 #include <sys/ktrace.h> 61 #endif 62 63 #include <security/audit/audit.h> 64 #include <security/mac/mac_framework.h> 65 66 #include <vm/uma.h> 67 68 #define NAMEI_DIAGNOSTIC 1 69 #undef NAMEI_DIAGNOSTIC 70 71 SDT_PROVIDER_DECLARE(vfs); 72 SDT_PROBE_DEFINE3(vfs, namei, lookup, entry, "struct vnode *", "char *", 73 "unsigned long"); 74 SDT_PROBE_DEFINE2(vfs, namei, lookup, return, "int", "struct vnode *"); 75 76 /* 77 * Allocation zone for namei 78 */ 79 uma_zone_t namei_zone; 80 /* 81 * Placeholder vnode for mp traversal 82 */ 83 static struct vnode *vp_crossmp; 84 85 static void 86 nameiinit(void *dummy __unused) 87 { 88 89 namei_zone = uma_zcreate("NAMEI", MAXPATHLEN, NULL, NULL, NULL, NULL, 90 UMA_ALIGN_PTR, 0); 91 getnewvnode("crossmp", NULL, &dead_vnodeops, &vp_crossmp); 92 vn_lock(vp_crossmp, LK_EXCLUSIVE); 93 VN_LOCK_ASHARE(vp_crossmp); 94 VOP_UNLOCK(vp_crossmp, 0); 95 } 96 SYSINIT(vfs, SI_SUB_VFS, SI_ORDER_SECOND, nameiinit, NULL); 97 98 static int lookup_shared = 1; 99 SYSCTL_INT(_vfs, OID_AUTO, lookup_shared, CTLFLAG_RWTUN, &lookup_shared, 0, 100 "Enables/Disables shared locks for path name translation"); 101 102 /* 103 * Convert a pathname into a pointer to a locked vnode. 104 * 105 * The FOLLOW flag is set when symbolic links are to be followed 106 * when they occur at the end of the name translation process. 107 * Symbolic links are always followed for all other pathname 108 * components other than the last. 109 * 110 * The segflg defines whether the name is to be copied from user 111 * space or kernel space. 112 * 113 * Overall outline of namei: 114 * 115 * copy in name 116 * get starting directory 117 * while (!done && !error) { 118 * call lookup to search path. 119 * if symbolic link, massage name in buffer and continue 120 * } 121 */ 122 int 123 namei(struct nameidata *ndp) 124 { 125 struct filedesc *fdp; /* pointer to file descriptor state */ 126 char *cp; /* pointer into pathname argument */ 127 struct vnode *dp; /* the directory we are searching */ 128 struct iovec aiov; /* uio for reading symbolic links */ 129 struct uio auio; 130 int error, linklen; 131 struct componentname *cnp = &ndp->ni_cnd; 132 struct thread *td = cnp->cn_thread; 133 struct proc *p = td->td_proc; 134 135 ndp->ni_cnd.cn_cred = ndp->ni_cnd.cn_thread->td_ucred; 136 KASSERT(cnp->cn_cred && p, ("namei: bad cred/proc")); 137 KASSERT((cnp->cn_nameiop & (~OPMASK)) == 0, 138 ("namei: nameiop contaminated with flags")); 139 KASSERT((cnp->cn_flags & OPMASK) == 0, 140 ("namei: flags contaminated with nameiops")); 141 if (!lookup_shared) 142 cnp->cn_flags &= ~LOCKSHARED; 143 fdp = p->p_fd; 144 145 /* We will set this ourselves if we need it. */ 146 cnp->cn_flags &= ~TRAILINGSLASH; 147 148 /* 149 * Get a buffer for the name to be translated, and copy the 150 * name into the buffer. 151 */ 152 if ((cnp->cn_flags & HASBUF) == 0) 153 cnp->cn_pnbuf = uma_zalloc(namei_zone, M_WAITOK); 154 if (ndp->ni_segflg == UIO_SYSSPACE) 155 error = copystr(ndp->ni_dirp, cnp->cn_pnbuf, 156 MAXPATHLEN, (size_t *)&ndp->ni_pathlen); 157 else 158 error = copyinstr(ndp->ni_dirp, cnp->cn_pnbuf, 159 MAXPATHLEN, (size_t *)&ndp->ni_pathlen); 160 161 /* 162 * Don't allow empty pathnames. 163 */ 164 if (!error && *cnp->cn_pnbuf == '\0') 165 error = ENOENT; 166 167 #ifdef CAPABILITY_MODE 168 /* 169 * In capability mode, lookups must be "strictly relative" (i.e. 170 * not an absolute path, and not containing '..' components) to 171 * a real file descriptor, not the pseudo-descriptor AT_FDCWD. 172 */ 173 if (error == 0 && IN_CAPABILITY_MODE(td) && 174 (cnp->cn_flags & NOCAPCHECK) == 0) { 175 ndp->ni_strictrelative = 1; 176 if (ndp->ni_dirfd == AT_FDCWD) { 177 #ifdef KTRACE 178 if (KTRPOINT(td, KTR_CAPFAIL)) 179 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 180 #endif 181 error = ECAPMODE; 182 } 183 } 184 #endif 185 if (error) { 186 uma_zfree(namei_zone, cnp->cn_pnbuf); 187 #ifdef DIAGNOSTIC 188 cnp->cn_pnbuf = NULL; 189 cnp->cn_nameptr = NULL; 190 #endif 191 ndp->ni_vp = NULL; 192 return (error); 193 } 194 ndp->ni_loopcnt = 0; 195 #ifdef KTRACE 196 if (KTRPOINT(td, KTR_NAMEI)) { 197 KASSERT(cnp->cn_thread == curthread, 198 ("namei not using curthread")); 199 ktrnamei(cnp->cn_pnbuf); 200 } 201 #endif 202 /* 203 * Get starting point for the translation. 204 */ 205 FILEDESC_SLOCK(fdp); 206 ndp->ni_rootdir = fdp->fd_rdir; 207 ndp->ni_topdir = fdp->fd_jdir; 208 209 /* 210 * If we are auditing the kernel pathname, save the user pathname. 211 */ 212 if (cnp->cn_flags & AUDITVNODE1) 213 AUDIT_ARG_UPATH1(td, ndp->ni_dirfd, cnp->cn_pnbuf); 214 if (cnp->cn_flags & AUDITVNODE2) 215 AUDIT_ARG_UPATH2(td, ndp->ni_dirfd, cnp->cn_pnbuf); 216 217 dp = NULL; 218 if (cnp->cn_pnbuf[0] != '/') { 219 if (ndp->ni_startdir != NULL) { 220 dp = ndp->ni_startdir; 221 error = 0; 222 } else if (ndp->ni_dirfd != AT_FDCWD) { 223 cap_rights_t rights; 224 225 rights = ndp->ni_rightsneeded; 226 cap_rights_set(&rights, CAP_LOOKUP); 227 228 if (cnp->cn_flags & AUDITVNODE1) 229 AUDIT_ARG_ATFD1(ndp->ni_dirfd); 230 if (cnp->cn_flags & AUDITVNODE2) 231 AUDIT_ARG_ATFD2(ndp->ni_dirfd); 232 error = fgetvp_rights(td, ndp->ni_dirfd, 233 &rights, &ndp->ni_filecaps, &dp); 234 #ifdef CAPABILITIES 235 /* 236 * If file descriptor doesn't have all rights, 237 * all lookups relative to it must also be 238 * strictly relative. 239 */ 240 CAP_ALL(&rights); 241 if (!cap_rights_contains(&ndp->ni_filecaps.fc_rights, 242 &rights) || 243 ndp->ni_filecaps.fc_fcntls != CAP_FCNTL_ALL || 244 ndp->ni_filecaps.fc_nioctls != -1) { 245 ndp->ni_strictrelative = 1; 246 } 247 #endif 248 } 249 if (error != 0 || dp != NULL) { 250 FILEDESC_SUNLOCK(fdp); 251 if (error == 0 && dp->v_type != VDIR) { 252 vrele(dp); 253 error = ENOTDIR; 254 } 255 } 256 if (error) { 257 uma_zfree(namei_zone, cnp->cn_pnbuf); 258 #ifdef DIAGNOSTIC 259 cnp->cn_pnbuf = NULL; 260 cnp->cn_nameptr = NULL; 261 #endif 262 return (error); 263 } 264 } 265 if (dp == NULL) { 266 dp = fdp->fd_cdir; 267 VREF(dp); 268 FILEDESC_SUNLOCK(fdp); 269 if (ndp->ni_startdir != NULL) 270 vrele(ndp->ni_startdir); 271 } 272 SDT_PROBE(vfs, namei, lookup, entry, dp, cnp->cn_pnbuf, 273 cnp->cn_flags, 0, 0); 274 for (;;) { 275 /* 276 * Check if root directory should replace current directory. 277 * Done at start of translation and after symbolic link. 278 */ 279 cnp->cn_nameptr = cnp->cn_pnbuf; 280 if (*(cnp->cn_nameptr) == '/') { 281 vrele(dp); 282 if (ndp->ni_strictrelative != 0) { 283 #ifdef KTRACE 284 if (KTRPOINT(curthread, KTR_CAPFAIL)) 285 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 286 #endif 287 return (ENOTCAPABLE); 288 } 289 while (*(cnp->cn_nameptr) == '/') { 290 cnp->cn_nameptr++; 291 ndp->ni_pathlen--; 292 } 293 dp = ndp->ni_rootdir; 294 VREF(dp); 295 } 296 ndp->ni_startdir = dp; 297 error = lookup(ndp); 298 if (error) { 299 uma_zfree(namei_zone, cnp->cn_pnbuf); 300 #ifdef DIAGNOSTIC 301 cnp->cn_pnbuf = NULL; 302 cnp->cn_nameptr = NULL; 303 #endif 304 SDT_PROBE(vfs, namei, lookup, return, error, NULL, 0, 305 0, 0); 306 return (error); 307 } 308 /* 309 * If not a symbolic link, we're done. 310 */ 311 if ((cnp->cn_flags & ISSYMLINK) == 0) { 312 if ((cnp->cn_flags & (SAVENAME | SAVESTART)) == 0) { 313 uma_zfree(namei_zone, cnp->cn_pnbuf); 314 #ifdef DIAGNOSTIC 315 cnp->cn_pnbuf = NULL; 316 cnp->cn_nameptr = NULL; 317 #endif 318 } else 319 cnp->cn_flags |= HASBUF; 320 321 SDT_PROBE(vfs, namei, lookup, return, 0, ndp->ni_vp, 322 0, 0, 0); 323 return (0); 324 } 325 if (ndp->ni_loopcnt++ >= MAXSYMLINKS) { 326 error = ELOOP; 327 break; 328 } 329 #ifdef MAC 330 if ((cnp->cn_flags & NOMACCHECK) == 0) { 331 error = mac_vnode_check_readlink(td->td_ucred, 332 ndp->ni_vp); 333 if (error) 334 break; 335 } 336 #endif 337 if (ndp->ni_pathlen > 1) 338 cp = uma_zalloc(namei_zone, M_WAITOK); 339 else 340 cp = cnp->cn_pnbuf; 341 aiov.iov_base = cp; 342 aiov.iov_len = MAXPATHLEN; 343 auio.uio_iov = &aiov; 344 auio.uio_iovcnt = 1; 345 auio.uio_offset = 0; 346 auio.uio_rw = UIO_READ; 347 auio.uio_segflg = UIO_SYSSPACE; 348 auio.uio_td = td; 349 auio.uio_resid = MAXPATHLEN; 350 error = VOP_READLINK(ndp->ni_vp, &auio, cnp->cn_cred); 351 if (error) { 352 if (ndp->ni_pathlen > 1) 353 uma_zfree(namei_zone, cp); 354 break; 355 } 356 linklen = MAXPATHLEN - auio.uio_resid; 357 if (linklen == 0) { 358 if (ndp->ni_pathlen > 1) 359 uma_zfree(namei_zone, cp); 360 error = ENOENT; 361 break; 362 } 363 if (linklen + ndp->ni_pathlen >= MAXPATHLEN) { 364 if (ndp->ni_pathlen > 1) 365 uma_zfree(namei_zone, cp); 366 error = ENAMETOOLONG; 367 break; 368 } 369 if (ndp->ni_pathlen > 1) { 370 bcopy(ndp->ni_next, cp + linklen, ndp->ni_pathlen); 371 uma_zfree(namei_zone, cnp->cn_pnbuf); 372 cnp->cn_pnbuf = cp; 373 } else 374 cnp->cn_pnbuf[linklen] = '\0'; 375 ndp->ni_pathlen += linklen; 376 vput(ndp->ni_vp); 377 dp = ndp->ni_dvp; 378 } 379 uma_zfree(namei_zone, cnp->cn_pnbuf); 380 #ifdef DIAGNOSTIC 381 cnp->cn_pnbuf = NULL; 382 cnp->cn_nameptr = NULL; 383 #endif 384 vput(ndp->ni_vp); 385 ndp->ni_vp = NULL; 386 vrele(ndp->ni_dvp); 387 SDT_PROBE(vfs, namei, lookup, return, error, NULL, 0, 0, 0); 388 return (error); 389 } 390 391 static int 392 compute_cn_lkflags(struct mount *mp, int lkflags, int cnflags) 393 { 394 395 if (mp == NULL || ((lkflags & LK_SHARED) && 396 (!(mp->mnt_kern_flag & MNTK_LOOKUP_SHARED) || 397 ((cnflags & ISDOTDOT) && 398 (mp->mnt_kern_flag & MNTK_LOOKUP_EXCL_DOTDOT))))) { 399 lkflags &= ~LK_SHARED; 400 lkflags |= LK_EXCLUSIVE; 401 } 402 return (lkflags); 403 } 404 405 static __inline int 406 needs_exclusive_leaf(struct mount *mp, int flags) 407 { 408 409 /* 410 * Intermediate nodes can use shared locks, we only need to 411 * force an exclusive lock for leaf nodes. 412 */ 413 if ((flags & (ISLASTCN | LOCKLEAF)) != (ISLASTCN | LOCKLEAF)) 414 return (0); 415 416 /* Always use exclusive locks if LOCKSHARED isn't set. */ 417 if (!(flags & LOCKSHARED)) 418 return (1); 419 420 /* 421 * For lookups during open(), if the mount point supports 422 * extended shared operations, then use a shared lock for the 423 * leaf node, otherwise use an exclusive lock. 424 */ 425 if ((flags & ISOPEN) != 0) 426 return (!MNT_EXTENDED_SHARED(mp)); 427 428 /* 429 * Lookup requests outside of open() that specify LOCKSHARED 430 * only need a shared lock on the leaf vnode. 431 */ 432 return (0); 433 } 434 435 /* 436 * Search a pathname. 437 * This is a very central and rather complicated routine. 438 * 439 * The pathname is pointed to by ni_ptr and is of length ni_pathlen. 440 * The starting directory is taken from ni_startdir. The pathname is 441 * descended until done, or a symbolic link is encountered. The variable 442 * ni_more is clear if the path is completed; it is set to one if a 443 * symbolic link needing interpretation is encountered. 444 * 445 * The flag argument is LOOKUP, CREATE, RENAME, or DELETE depending on 446 * whether the name is to be looked up, created, renamed, or deleted. 447 * When CREATE, RENAME, or DELETE is specified, information usable in 448 * creating, renaming, or deleting a directory entry may be calculated. 449 * If flag has LOCKPARENT or'ed into it, the parent directory is returned 450 * locked. If flag has WANTPARENT or'ed into it, the parent directory is 451 * returned unlocked. Otherwise the parent directory is not returned. If 452 * the target of the pathname exists and LOCKLEAF is or'ed into the flag 453 * the target is returned locked, otherwise it is returned unlocked. 454 * When creating or renaming and LOCKPARENT is specified, the target may not 455 * be ".". When deleting and LOCKPARENT is specified, the target may be ".". 456 * 457 * Overall outline of lookup: 458 * 459 * dirloop: 460 * identify next component of name at ndp->ni_ptr 461 * handle degenerate case where name is null string 462 * if .. and crossing mount points and on mounted filesys, find parent 463 * call VOP_LOOKUP routine for next component name 464 * directory vnode returned in ni_dvp, unlocked unless LOCKPARENT set 465 * component vnode returned in ni_vp (if it exists), locked. 466 * if result vnode is mounted on and crossing mount points, 467 * find mounted on vnode 468 * if more components of name, do next level at dirloop 469 * return the answer in ni_vp, locked if LOCKLEAF set 470 * if LOCKPARENT set, return locked parent in ni_dvp 471 * if WANTPARENT set, return unlocked parent in ni_dvp 472 */ 473 int 474 lookup(struct nameidata *ndp) 475 { 476 char *cp; /* pointer into pathname argument */ 477 struct vnode *dp = 0; /* the directory we are searching */ 478 struct vnode *tdp; /* saved dp */ 479 struct mount *mp; /* mount table entry */ 480 struct prison *pr; 481 int docache; /* == 0 do not cache last component */ 482 int wantparent; /* 1 => wantparent or lockparent flag */ 483 int rdonly; /* lookup read-only flag bit */ 484 int error = 0; 485 int dpunlocked = 0; /* dp has already been unlocked */ 486 struct componentname *cnp = &ndp->ni_cnd; 487 int lkflags_save; 488 int ni_dvp_unlocked; 489 490 /* 491 * Setup: break out flag bits into variables. 492 */ 493 ni_dvp_unlocked = 0; 494 wantparent = cnp->cn_flags & (LOCKPARENT | WANTPARENT); 495 KASSERT(cnp->cn_nameiop == LOOKUP || wantparent, 496 ("CREATE, DELETE, RENAME require LOCKPARENT or WANTPARENT.")); 497 docache = (cnp->cn_flags & NOCACHE) ^ NOCACHE; 498 if (cnp->cn_nameiop == DELETE || 499 (wantparent && cnp->cn_nameiop != CREATE && 500 cnp->cn_nameiop != LOOKUP)) 501 docache = 0; 502 rdonly = cnp->cn_flags & RDONLY; 503 cnp->cn_flags &= ~ISSYMLINK; 504 ndp->ni_dvp = NULL; 505 /* 506 * We use shared locks until we hit the parent of the last cn then 507 * we adjust based on the requesting flags. 508 */ 509 if (lookup_shared) 510 cnp->cn_lkflags = LK_SHARED; 511 else 512 cnp->cn_lkflags = LK_EXCLUSIVE; 513 dp = ndp->ni_startdir; 514 ndp->ni_startdir = NULLVP; 515 vn_lock(dp, 516 compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags | LK_RETRY, 517 cnp->cn_flags)); 518 519 dirloop: 520 /* 521 * Search a new directory. 522 * 523 * The last component of the filename is left accessible via 524 * cnp->cn_nameptr for callers that need the name. Callers needing 525 * the name set the SAVENAME flag. When done, they assume 526 * responsibility for freeing the pathname buffer. 527 */ 528 cnp->cn_consume = 0; 529 for (cp = cnp->cn_nameptr; *cp != 0 && *cp != '/'; cp++) 530 continue; 531 cnp->cn_namelen = cp - cnp->cn_nameptr; 532 if (cnp->cn_namelen > NAME_MAX) { 533 error = ENAMETOOLONG; 534 goto bad; 535 } 536 #ifdef NAMEI_DIAGNOSTIC 537 { char c = *cp; 538 *cp = '\0'; 539 printf("{%s}: ", cnp->cn_nameptr); 540 *cp = c; } 541 #endif 542 ndp->ni_pathlen -= cnp->cn_namelen; 543 ndp->ni_next = cp; 544 545 /* 546 * Replace multiple slashes by a single slash and trailing slashes 547 * by a null. This must be done before VOP_LOOKUP() because some 548 * fs's don't know about trailing slashes. Remember if there were 549 * trailing slashes to handle symlinks, existing non-directories 550 * and non-existing files that won't be directories specially later. 551 */ 552 while (*cp == '/' && (cp[1] == '/' || cp[1] == '\0')) { 553 cp++; 554 ndp->ni_pathlen--; 555 if (*cp == '\0') { 556 *ndp->ni_next = '\0'; 557 cnp->cn_flags |= TRAILINGSLASH; 558 } 559 } 560 ndp->ni_next = cp; 561 562 cnp->cn_flags |= MAKEENTRY; 563 if (*cp == '\0' && docache == 0) 564 cnp->cn_flags &= ~MAKEENTRY; 565 if (cnp->cn_namelen == 2 && 566 cnp->cn_nameptr[1] == '.' && cnp->cn_nameptr[0] == '.') 567 cnp->cn_flags |= ISDOTDOT; 568 else 569 cnp->cn_flags &= ~ISDOTDOT; 570 if (*ndp->ni_next == 0) 571 cnp->cn_flags |= ISLASTCN; 572 else 573 cnp->cn_flags &= ~ISLASTCN; 574 575 if ((cnp->cn_flags & ISLASTCN) != 0 && 576 cnp->cn_namelen == 1 && cnp->cn_nameptr[0] == '.' && 577 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { 578 error = EINVAL; 579 goto bad; 580 } 581 582 /* 583 * Check for degenerate name (e.g. / or "") 584 * which is a way of talking about a directory, 585 * e.g. like "/." or ".". 586 */ 587 if (cnp->cn_nameptr[0] == '\0') { 588 if (dp->v_type != VDIR) { 589 error = ENOTDIR; 590 goto bad; 591 } 592 if (cnp->cn_nameiop != LOOKUP) { 593 error = EISDIR; 594 goto bad; 595 } 596 if (wantparent) { 597 ndp->ni_dvp = dp; 598 VREF(dp); 599 } 600 ndp->ni_vp = dp; 601 602 if (cnp->cn_flags & AUDITVNODE1) 603 AUDIT_ARG_VNODE1(dp); 604 else if (cnp->cn_flags & AUDITVNODE2) 605 AUDIT_ARG_VNODE2(dp); 606 607 if (!(cnp->cn_flags & (LOCKPARENT | LOCKLEAF))) 608 VOP_UNLOCK(dp, 0); 609 /* XXX This should probably move to the top of function. */ 610 if (cnp->cn_flags & SAVESTART) 611 panic("lookup: SAVESTART"); 612 goto success; 613 } 614 615 /* 616 * Handle "..": five special cases. 617 * 0. If doing a capability lookup, return ENOTCAPABLE (this is a 618 * fairly conservative design choice, but it's the only one that we 619 * are satisfied guarantees the property we're looking for). 620 * 1. Return an error if this is the last component of 621 * the name and the operation is DELETE or RENAME. 622 * 2. If at root directory (e.g. after chroot) 623 * or at absolute root directory 624 * then ignore it so can't get out. 625 * 3. If this vnode is the root of a mounted 626 * filesystem, then replace it with the 627 * vnode which was mounted on so we take the 628 * .. in the other filesystem. 629 * 4. If the vnode is the top directory of 630 * the jail or chroot, don't let them out. 631 */ 632 if (cnp->cn_flags & ISDOTDOT) { 633 if (ndp->ni_strictrelative != 0) { 634 #ifdef KTRACE 635 if (KTRPOINT(curthread, KTR_CAPFAIL)) 636 ktrcapfail(CAPFAIL_LOOKUP, NULL, NULL); 637 #endif 638 error = ENOTCAPABLE; 639 goto bad; 640 } 641 if ((cnp->cn_flags & ISLASTCN) != 0 && 642 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { 643 error = EINVAL; 644 goto bad; 645 } 646 for (;;) { 647 for (pr = cnp->cn_cred->cr_prison; pr != NULL; 648 pr = pr->pr_parent) 649 if (dp == pr->pr_root) 650 break; 651 if (dp == ndp->ni_rootdir || 652 dp == ndp->ni_topdir || 653 dp == rootvnode || 654 pr != NULL || 655 ((dp->v_vflag & VV_ROOT) != 0 && 656 (cnp->cn_flags & NOCROSSMOUNT) != 0)) { 657 ndp->ni_dvp = dp; 658 ndp->ni_vp = dp; 659 VREF(dp); 660 goto nextname; 661 } 662 if ((dp->v_vflag & VV_ROOT) == 0) 663 break; 664 if (dp->v_iflag & VI_DOOMED) { /* forced unmount */ 665 error = ENOENT; 666 goto bad; 667 } 668 tdp = dp; 669 dp = dp->v_mount->mnt_vnodecovered; 670 VREF(dp); 671 vput(tdp); 672 vn_lock(dp, 673 compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags | 674 LK_RETRY, ISDOTDOT)); 675 } 676 } 677 678 /* 679 * We now have a segment name to search for, and a directory to search. 680 */ 681 unionlookup: 682 #ifdef MAC 683 if ((cnp->cn_flags & NOMACCHECK) == 0) { 684 error = mac_vnode_check_lookup(cnp->cn_thread->td_ucred, dp, 685 cnp); 686 if (error) 687 goto bad; 688 } 689 #endif 690 ndp->ni_dvp = dp; 691 ndp->ni_vp = NULL; 692 ASSERT_VOP_LOCKED(dp, "lookup"); 693 /* 694 * If we have a shared lock we may need to upgrade the lock for the 695 * last operation. 696 */ 697 if (dp != vp_crossmp && 698 VOP_ISLOCKED(dp) == LK_SHARED && 699 (cnp->cn_flags & ISLASTCN) && (cnp->cn_flags & LOCKPARENT)) 700 vn_lock(dp, LK_UPGRADE|LK_RETRY); 701 if ((dp->v_iflag & VI_DOOMED) != 0) { 702 error = ENOENT; 703 goto bad; 704 } 705 /* 706 * If we're looking up the last component and we need an exclusive 707 * lock, adjust our lkflags. 708 */ 709 if (needs_exclusive_leaf(dp->v_mount, cnp->cn_flags)) 710 cnp->cn_lkflags = LK_EXCLUSIVE; 711 #ifdef NAMEI_DIAGNOSTIC 712 vprint("lookup in", dp); 713 #endif 714 lkflags_save = cnp->cn_lkflags; 715 cnp->cn_lkflags = compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags, 716 cnp->cn_flags); 717 if ((error = VOP_LOOKUP(dp, &ndp->ni_vp, cnp)) != 0) { 718 cnp->cn_lkflags = lkflags_save; 719 KASSERT(ndp->ni_vp == NULL, ("leaf should be empty")); 720 #ifdef NAMEI_DIAGNOSTIC 721 printf("not found\n"); 722 #endif 723 if ((error == ENOENT) && 724 (dp->v_vflag & VV_ROOT) && (dp->v_mount != NULL) && 725 (dp->v_mount->mnt_flag & MNT_UNION)) { 726 tdp = dp; 727 dp = dp->v_mount->mnt_vnodecovered; 728 VREF(dp); 729 vput(tdp); 730 vn_lock(dp, 731 compute_cn_lkflags(dp->v_mount, cnp->cn_lkflags | 732 LK_RETRY, cnp->cn_flags)); 733 goto unionlookup; 734 } 735 736 if (error != EJUSTRETURN) 737 goto bad; 738 /* 739 * At this point, we know we're at the end of the 740 * pathname. If creating / renaming, we can consider 741 * allowing the file or directory to be created / renamed, 742 * provided we're not on a read-only filesystem. 743 */ 744 if (rdonly) { 745 error = EROFS; 746 goto bad; 747 } 748 /* trailing slash only allowed for directories */ 749 if ((cnp->cn_flags & TRAILINGSLASH) && 750 !(cnp->cn_flags & WILLBEDIR)) { 751 error = ENOENT; 752 goto bad; 753 } 754 if ((cnp->cn_flags & LOCKPARENT) == 0) 755 VOP_UNLOCK(dp, 0); 756 /* 757 * We return with ni_vp NULL to indicate that the entry 758 * doesn't currently exist, leaving a pointer to the 759 * (possibly locked) directory vnode in ndp->ni_dvp. 760 */ 761 if (cnp->cn_flags & SAVESTART) { 762 ndp->ni_startdir = ndp->ni_dvp; 763 VREF(ndp->ni_startdir); 764 } 765 goto success; 766 } else 767 cnp->cn_lkflags = lkflags_save; 768 #ifdef NAMEI_DIAGNOSTIC 769 printf("found\n"); 770 #endif 771 /* 772 * Take into account any additional components consumed by 773 * the underlying filesystem. 774 */ 775 if (cnp->cn_consume > 0) { 776 cnp->cn_nameptr += cnp->cn_consume; 777 ndp->ni_next += cnp->cn_consume; 778 ndp->ni_pathlen -= cnp->cn_consume; 779 cnp->cn_consume = 0; 780 } 781 782 dp = ndp->ni_vp; 783 784 /* 785 * Check to see if the vnode has been mounted on; 786 * if so find the root of the mounted filesystem. 787 */ 788 while (dp->v_type == VDIR && (mp = dp->v_mountedhere) && 789 (cnp->cn_flags & NOCROSSMOUNT) == 0) { 790 if (vfs_busy(mp, 0)) 791 continue; 792 vput(dp); 793 if (dp != ndp->ni_dvp) 794 vput(ndp->ni_dvp); 795 else 796 vrele(ndp->ni_dvp); 797 vref(vp_crossmp); 798 ndp->ni_dvp = vp_crossmp; 799 error = VFS_ROOT(mp, compute_cn_lkflags(mp, cnp->cn_lkflags, 800 cnp->cn_flags), &tdp); 801 vfs_unbusy(mp); 802 if (vn_lock(vp_crossmp, LK_SHARED | LK_NOWAIT)) 803 panic("vp_crossmp exclusively locked or reclaimed"); 804 if (error) { 805 dpunlocked = 1; 806 goto bad2; 807 } 808 ndp->ni_vp = dp = tdp; 809 } 810 811 /* 812 * Check for symbolic link 813 */ 814 if ((dp->v_type == VLNK) && 815 ((cnp->cn_flags & FOLLOW) || (cnp->cn_flags & TRAILINGSLASH) || 816 *ndp->ni_next == '/')) { 817 cnp->cn_flags |= ISSYMLINK; 818 if (dp->v_iflag & VI_DOOMED) { 819 /* 820 * We can't know whether the directory was mounted with 821 * NOSYMFOLLOW, so we can't follow safely. 822 */ 823 error = ENOENT; 824 goto bad2; 825 } 826 if (dp->v_mount->mnt_flag & MNT_NOSYMFOLLOW) { 827 error = EACCES; 828 goto bad2; 829 } 830 /* 831 * Symlink code always expects an unlocked dvp. 832 */ 833 if (ndp->ni_dvp != ndp->ni_vp) { 834 VOP_UNLOCK(ndp->ni_dvp, 0); 835 ni_dvp_unlocked = 1; 836 } 837 goto success; 838 } 839 840 nextname: 841 /* 842 * Not a symbolic link that we will follow. Continue with the 843 * next component if there is any; otherwise, we're done. 844 */ 845 KASSERT((cnp->cn_flags & ISLASTCN) || *ndp->ni_next == '/', 846 ("lookup: invalid path state.")); 847 if (*ndp->ni_next == '/') { 848 cnp->cn_nameptr = ndp->ni_next; 849 while (*cnp->cn_nameptr == '/') { 850 cnp->cn_nameptr++; 851 ndp->ni_pathlen--; 852 } 853 if (ndp->ni_dvp != dp) 854 vput(ndp->ni_dvp); 855 else 856 vrele(ndp->ni_dvp); 857 goto dirloop; 858 } 859 /* 860 * If we're processing a path with a trailing slash, 861 * check that the end result is a directory. 862 */ 863 if ((cnp->cn_flags & TRAILINGSLASH) && dp->v_type != VDIR) { 864 error = ENOTDIR; 865 goto bad2; 866 } 867 /* 868 * Disallow directory write attempts on read-only filesystems. 869 */ 870 if (rdonly && 871 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { 872 error = EROFS; 873 goto bad2; 874 } 875 if (cnp->cn_flags & SAVESTART) { 876 ndp->ni_startdir = ndp->ni_dvp; 877 VREF(ndp->ni_startdir); 878 } 879 if (!wantparent) { 880 ni_dvp_unlocked = 2; 881 if (ndp->ni_dvp != dp) 882 vput(ndp->ni_dvp); 883 else 884 vrele(ndp->ni_dvp); 885 } else if ((cnp->cn_flags & LOCKPARENT) == 0 && ndp->ni_dvp != dp) { 886 VOP_UNLOCK(ndp->ni_dvp, 0); 887 ni_dvp_unlocked = 1; 888 } 889 890 if (cnp->cn_flags & AUDITVNODE1) 891 AUDIT_ARG_VNODE1(dp); 892 else if (cnp->cn_flags & AUDITVNODE2) 893 AUDIT_ARG_VNODE2(dp); 894 895 if ((cnp->cn_flags & LOCKLEAF) == 0) 896 VOP_UNLOCK(dp, 0); 897 success: 898 /* 899 * Because of lookup_shared we may have the vnode shared locked, but 900 * the caller may want it to be exclusively locked. 901 */ 902 if (needs_exclusive_leaf(dp->v_mount, cnp->cn_flags) && 903 VOP_ISLOCKED(dp) != LK_EXCLUSIVE) { 904 vn_lock(dp, LK_UPGRADE | LK_RETRY); 905 if (dp->v_iflag & VI_DOOMED) { 906 error = ENOENT; 907 goto bad2; 908 } 909 } 910 return (0); 911 912 bad2: 913 if (ni_dvp_unlocked != 2) { 914 if (dp != ndp->ni_dvp && !ni_dvp_unlocked) 915 vput(ndp->ni_dvp); 916 else 917 vrele(ndp->ni_dvp); 918 } 919 bad: 920 if (!dpunlocked) 921 vput(dp); 922 ndp->ni_vp = NULL; 923 return (error); 924 } 925 926 /* 927 * relookup - lookup a path name component 928 * Used by lookup to re-acquire things. 929 */ 930 int 931 relookup(struct vnode *dvp, struct vnode **vpp, struct componentname *cnp) 932 { 933 struct vnode *dp = 0; /* the directory we are searching */ 934 int wantparent; /* 1 => wantparent or lockparent flag */ 935 int rdonly; /* lookup read-only flag bit */ 936 int error = 0; 937 938 KASSERT(cnp->cn_flags & ISLASTCN, 939 ("relookup: Not given last component.")); 940 /* 941 * Setup: break out flag bits into variables. 942 */ 943 wantparent = cnp->cn_flags & (LOCKPARENT|WANTPARENT); 944 KASSERT(wantparent, ("relookup: parent not wanted.")); 945 rdonly = cnp->cn_flags & RDONLY; 946 cnp->cn_flags &= ~ISSYMLINK; 947 dp = dvp; 948 cnp->cn_lkflags = LK_EXCLUSIVE; 949 vn_lock(dp, LK_EXCLUSIVE | LK_RETRY); 950 951 /* 952 * Search a new directory. 953 * 954 * The last component of the filename is left accessible via 955 * cnp->cn_nameptr for callers that need the name. Callers needing 956 * the name set the SAVENAME flag. When done, they assume 957 * responsibility for freeing the pathname buffer. 958 */ 959 #ifdef NAMEI_DIAGNOSTIC 960 printf("{%s}: ", cnp->cn_nameptr); 961 #endif 962 963 /* 964 * Check for "" which represents the root directory after slash 965 * removal. 966 */ 967 if (cnp->cn_nameptr[0] == '\0') { 968 /* 969 * Support only LOOKUP for "/" because lookup() 970 * can't succeed for CREATE, DELETE and RENAME. 971 */ 972 KASSERT(cnp->cn_nameiop == LOOKUP, ("nameiop must be LOOKUP")); 973 KASSERT(dp->v_type == VDIR, ("dp is not a directory")); 974 975 if (!(cnp->cn_flags & LOCKLEAF)) 976 VOP_UNLOCK(dp, 0); 977 *vpp = dp; 978 /* XXX This should probably move to the top of function. */ 979 if (cnp->cn_flags & SAVESTART) 980 panic("lookup: SAVESTART"); 981 return (0); 982 } 983 984 if (cnp->cn_flags & ISDOTDOT) 985 panic ("relookup: lookup on dot-dot"); 986 987 /* 988 * We now have a segment name to search for, and a directory to search. 989 */ 990 #ifdef NAMEI_DIAGNOSTIC 991 vprint("search in:", dp); 992 #endif 993 if ((error = VOP_LOOKUP(dp, vpp, cnp)) != 0) { 994 KASSERT(*vpp == NULL, ("leaf should be empty")); 995 if (error != EJUSTRETURN) 996 goto bad; 997 /* 998 * If creating and at end of pathname, then can consider 999 * allowing file to be created. 1000 */ 1001 if (rdonly) { 1002 error = EROFS; 1003 goto bad; 1004 } 1005 /* ASSERT(dvp == ndp->ni_startdir) */ 1006 if (cnp->cn_flags & SAVESTART) 1007 VREF(dvp); 1008 if ((cnp->cn_flags & LOCKPARENT) == 0) 1009 VOP_UNLOCK(dp, 0); 1010 /* 1011 * We return with ni_vp NULL to indicate that the entry 1012 * doesn't currently exist, leaving a pointer to the 1013 * (possibly locked) directory vnode in ndp->ni_dvp. 1014 */ 1015 return (0); 1016 } 1017 1018 dp = *vpp; 1019 1020 /* 1021 * Disallow directory write attempts on read-only filesystems. 1022 */ 1023 if (rdonly && 1024 (cnp->cn_nameiop == DELETE || cnp->cn_nameiop == RENAME)) { 1025 if (dvp == dp) 1026 vrele(dvp); 1027 else 1028 vput(dvp); 1029 error = EROFS; 1030 goto bad; 1031 } 1032 /* 1033 * Set the parent lock/ref state to the requested state. 1034 */ 1035 if ((cnp->cn_flags & LOCKPARENT) == 0 && dvp != dp) { 1036 if (wantparent) 1037 VOP_UNLOCK(dvp, 0); 1038 else 1039 vput(dvp); 1040 } else if (!wantparent) 1041 vrele(dvp); 1042 /* 1043 * Check for symbolic link 1044 */ 1045 KASSERT(dp->v_type != VLNK || !(cnp->cn_flags & FOLLOW), 1046 ("relookup: symlink found.\n")); 1047 1048 /* ASSERT(dvp == ndp->ni_startdir) */ 1049 if (cnp->cn_flags & SAVESTART) 1050 VREF(dvp); 1051 1052 if ((cnp->cn_flags & LOCKLEAF) == 0) 1053 VOP_UNLOCK(dp, 0); 1054 return (0); 1055 bad: 1056 vput(dp); 1057 *vpp = NULL; 1058 return (error); 1059 } 1060 1061 void 1062 NDINIT_ALL(struct nameidata *ndp, u_long op, u_long flags, enum uio_seg segflg, 1063 const char *namep, int dirfd, struct vnode *startdir, cap_rights_t *rightsp, 1064 struct thread *td) 1065 { 1066 1067 ndp->ni_cnd.cn_nameiop = op; 1068 ndp->ni_cnd.cn_flags = flags; 1069 ndp->ni_segflg = segflg; 1070 ndp->ni_dirp = namep; 1071 ndp->ni_dirfd = dirfd; 1072 ndp->ni_startdir = startdir; 1073 ndp->ni_strictrelative = 0; 1074 if (rightsp != NULL) 1075 ndp->ni_rightsneeded = *rightsp; 1076 else 1077 cap_rights_init(&ndp->ni_rightsneeded); 1078 filecaps_init(&ndp->ni_filecaps); 1079 ndp->ni_cnd.cn_thread = td; 1080 } 1081 1082 /* 1083 * Free data allocated by namei(); see namei(9) for details. 1084 */ 1085 void 1086 NDFREE(struct nameidata *ndp, const u_int flags) 1087 { 1088 int unlock_dvp; 1089 int unlock_vp; 1090 1091 unlock_dvp = 0; 1092 unlock_vp = 0; 1093 1094 if (!(flags & NDF_NO_FREE_PNBUF) && 1095 (ndp->ni_cnd.cn_flags & HASBUF)) { 1096 uma_zfree(namei_zone, ndp->ni_cnd.cn_pnbuf); 1097 ndp->ni_cnd.cn_flags &= ~HASBUF; 1098 } 1099 if (!(flags & NDF_NO_VP_UNLOCK) && 1100 (ndp->ni_cnd.cn_flags & LOCKLEAF) && ndp->ni_vp) 1101 unlock_vp = 1; 1102 if (!(flags & NDF_NO_VP_RELE) && ndp->ni_vp) { 1103 if (unlock_vp) { 1104 vput(ndp->ni_vp); 1105 unlock_vp = 0; 1106 } else 1107 vrele(ndp->ni_vp); 1108 ndp->ni_vp = NULL; 1109 } 1110 if (unlock_vp) 1111 VOP_UNLOCK(ndp->ni_vp, 0); 1112 if (!(flags & NDF_NO_DVP_UNLOCK) && 1113 (ndp->ni_cnd.cn_flags & LOCKPARENT) && 1114 ndp->ni_dvp != ndp->ni_vp) 1115 unlock_dvp = 1; 1116 if (!(flags & NDF_NO_DVP_RELE) && 1117 (ndp->ni_cnd.cn_flags & (LOCKPARENT|WANTPARENT))) { 1118 if (unlock_dvp) { 1119 vput(ndp->ni_dvp); 1120 unlock_dvp = 0; 1121 } else 1122 vrele(ndp->ni_dvp); 1123 ndp->ni_dvp = NULL; 1124 } 1125 if (unlock_dvp) 1126 VOP_UNLOCK(ndp->ni_dvp, 0); 1127 if (!(flags & NDF_NO_STARTDIR_RELE) && 1128 (ndp->ni_cnd.cn_flags & SAVESTART)) { 1129 vrele(ndp->ni_startdir); 1130 ndp->ni_startdir = NULL; 1131 } 1132 } 1133 1134 /* 1135 * Determine if there is a suitable alternate filename under the specified 1136 * prefix for the specified path. If the create flag is set, then the 1137 * alternate prefix will be used so long as the parent directory exists. 1138 * This is used by the various compatiblity ABIs so that Linux binaries prefer 1139 * files under /compat/linux for example. The chosen path (whether under 1140 * the prefix or under /) is returned in a kernel malloc'd buffer pointed 1141 * to by pathbuf. The caller is responsible for free'ing the buffer from 1142 * the M_TEMP bucket if one is returned. 1143 */ 1144 int 1145 kern_alternate_path(struct thread *td, const char *prefix, const char *path, 1146 enum uio_seg pathseg, char **pathbuf, int create, int dirfd) 1147 { 1148 struct nameidata nd, ndroot; 1149 char *ptr, *buf, *cp; 1150 size_t len, sz; 1151 int error; 1152 1153 buf = (char *) malloc(MAXPATHLEN, M_TEMP, M_WAITOK); 1154 *pathbuf = buf; 1155 1156 /* Copy the prefix into the new pathname as a starting point. */ 1157 len = strlcpy(buf, prefix, MAXPATHLEN); 1158 if (len >= MAXPATHLEN) { 1159 *pathbuf = NULL; 1160 free(buf, M_TEMP); 1161 return (EINVAL); 1162 } 1163 sz = MAXPATHLEN - len; 1164 ptr = buf + len; 1165 1166 /* Append the filename to the prefix. */ 1167 if (pathseg == UIO_SYSSPACE) 1168 error = copystr(path, ptr, sz, &len); 1169 else 1170 error = copyinstr(path, ptr, sz, &len); 1171 1172 if (error) { 1173 *pathbuf = NULL; 1174 free(buf, M_TEMP); 1175 return (error); 1176 } 1177 1178 /* Only use a prefix with absolute pathnames. */ 1179 if (*ptr != '/') { 1180 error = EINVAL; 1181 goto keeporig; 1182 } 1183 1184 if (dirfd != AT_FDCWD) { 1185 /* 1186 * We want the original because the "prefix" is 1187 * included in the already opened dirfd. 1188 */ 1189 bcopy(ptr, buf, len); 1190 return (0); 1191 } 1192 1193 /* 1194 * We know that there is a / somewhere in this pathname. 1195 * Search backwards for it, to find the file's parent dir 1196 * to see if it exists in the alternate tree. If it does, 1197 * and we want to create a file (cflag is set). We don't 1198 * need to worry about the root comparison in this case. 1199 */ 1200 1201 if (create) { 1202 for (cp = &ptr[len] - 1; *cp != '/'; cp--); 1203 *cp = '\0'; 1204 1205 NDINIT(&nd, LOOKUP, FOLLOW, UIO_SYSSPACE, buf, td); 1206 error = namei(&nd); 1207 *cp = '/'; 1208 if (error != 0) 1209 goto keeporig; 1210 } else { 1211 NDINIT(&nd, LOOKUP, FOLLOW, UIO_SYSSPACE, buf, td); 1212 1213 error = namei(&nd); 1214 if (error != 0) 1215 goto keeporig; 1216 1217 /* 1218 * We now compare the vnode of the prefix to the one 1219 * vnode asked. If they resolve to be the same, then we 1220 * ignore the match so that the real root gets used. 1221 * This avoids the problem of traversing "../.." to find the 1222 * root directory and never finding it, because "/" resolves 1223 * to the emulation root directory. This is expensive :-( 1224 */ 1225 NDINIT(&ndroot, LOOKUP, FOLLOW, UIO_SYSSPACE, prefix, 1226 td); 1227 1228 /* We shouldn't ever get an error from this namei(). */ 1229 error = namei(&ndroot); 1230 if (error == 0) { 1231 if (nd.ni_vp == ndroot.ni_vp) 1232 error = ENOENT; 1233 1234 NDFREE(&ndroot, NDF_ONLY_PNBUF); 1235 vrele(ndroot.ni_vp); 1236 } 1237 } 1238 1239 NDFREE(&nd, NDF_ONLY_PNBUF); 1240 vrele(nd.ni_vp); 1241 1242 keeporig: 1243 /* If there was an error, use the original path name. */ 1244 if (error) 1245 bcopy(ptr, buf, len); 1246 return (error); 1247 } 1248